@hsuite/smart-engines-cli 1.5.1 → 1.6.0

package/dist/_lib/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/_lib/docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAwCF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAiBvF;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,MAAM,CAAC,CAiBjB"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/_lib/docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAwCF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/dist/_lib/docker.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.imageRef = imageRef;
 exports.dockerLogin = dockerLogin;
 exports.parsePushDigest = parsePushDigest;
-exports.parseRepoDigests = parseRepoDigests;
-exports.inspectImageDigest = inspectImageDigest;
+exports.parseImagetoolsDigest = parseImagetoolsDigest;
+exports.inspectRegistryDigest = inspectRegistryDigest;
 exports.dockerPush = dockerPush;
 /**
  * Thin, testable wrappers around the `docker` CLI for the trusted-deploy flow.
@@ -87,63 +87,63 @@ function parsePushDigest(output) {
     return m ? m[1].toLowerCase() : null;
 }
 /**
- * Pick the `sha256:<64hex>` digest for `<server>/<repository>` out of a parsed
- * `docker inspect ... .RepoDigests` array. Pure — shared by both the
- * `spawn`-based {@link inspectImageDigest} and the `execFileSync`-based
- * `buildAndPush` inspect-fallback in `_lib/baas.ts`, so the matching rule lives
- * in exactly one place.
+ * Parse the top-level manifest digest from `docker buildx imagetools inspect
+ * <ref>` output. `imagetools inspect` queries the REGISTRY (not the local
+ * daemon cache), so this is the authoritative `sha256:<64hex>` the registry
+ * serves for the tag — the value the attestation must bind.
  *
- * `stdout` is the raw `{{json .RepoDigests}}` output (a JSON string array).
- * Returns the lower-cased `sha256:<64hex>` of the first entry whose ref matches
- * `<server>/<repository>@`, or `null` if the JSON is unparseable / no entry
- * matches.
+ * The default (non-`--raw`) report prints a top-level block:
+ *   `Name:      <ref>`
+ *   `MediaType: application/vnd.docker.distribution.manifest.v2+json`
+ *   `Digest:    sha256:<64hex>`
+ * We match the FIRST `Digest:` line — the top-level manifest digest. (Per-arch
+ * child digests appear only under a later `Manifests:` block for a multi-arch
+ * index, which the single-arch amd64 deploy flow never produces.)
+ *
+ * @returns the lower-cased `sha256:<64hex>` digest, or `null` if absent.
  */
-function parseRepoDigests(stdout, registry) {
-    let repoDigests;
-    try {
-        repoDigests = JSON.parse(stdout.trim());
-    }
-    catch {
-        return null;
-    }
-    if (!Array.isArray(repoDigests))
-        return null;
-    const repoPrefix = `${registry.server}/${registry.repository}@`;
-    for (const rd of repoDigests) {
-        if (typeof rd === 'string' && rd.startsWith(repoPrefix)) {
-            const at = rd.indexOf('@');
-            const digest = rd.slice(at + 1);
-            if (/^sha256:[a-f0-9]{64}$/i.test(digest))
-                return digest.toLowerCase();
-        }
-    }
-    return null;
+function parseImagetoolsDigest(output) {
+    // Scan only the top-level block: truncate at the `Manifests:` section so a
+    // per-arch child `Digest:` in a multi-arch index can never be mistaken for
+    // the top-level manifest digest. This anchors correctness to structure rather
+    // than to buildx's field-emission order (robust across buildx versions).
+    const topLevel = output.split(/^\s*Manifests:/m)[0];
+    const m = topLevel.match(/^\s*Digest:\s*(sha256:[a-f0-9]{64})/im);
+    return m ? m[1].toLowerCase() : null;
 }
 /**
- * `docker inspect` fallback to recover a pushed image's registry digest from
- * its `RepoDigests` when the push output didn't surface one (older docker,
- * buildx drivers, or an externally-run push we're inspecting after the fact).
+ * Resolve the digest the REGISTRY currently serves for `<server>/<repository>:
+ * <tag>` via `docker buildx imagetools inspect`. Authoritative: it hits the
+ * registry, so — unlike a local `docker inspect ... .RepoDigests` read — a
+ * prior push of the same tag or a round-robin retry can never leave a STALE
+ * value here (#1679).
  *
- * Returns the `sha256:<64hex>` portion of the matching `RepoDigests` entry, or
- * `null` if none matches `<server>/<repository>`.
+ * @returns the `sha256:<64hex>` registry digest, or `null` if it could not be
+ *   resolved (imagetools unavailable / registry unreachable / no digest line).
  */
-async function inspectImageDigest(registry, tag, spawnFn) {
+async function inspectRegistryDigest(registry, tag, spawnFn) {
     const ref = imageRef(registry, tag);
-    const { code, stdout } = await runDocker(['inspect', '--format', '{{json .RepoDigests}}', ref], { spawnFn });
+    const { code, stdout, stderr } = await runDocker(['buildx', 'imagetools', 'inspect', ref], { spawnFn });
     if (code !== 0)
         return null;
-    return parseRepoDigests(stdout, registry);
+    return parseImagetoolsDigest(stdout + '\n' + stderr);
 }
 /**
- * Push the backend image and RECORD its registry manifest digest.
+ * Push the backend image and RECORD the digest the registry serves for it.
  *
- * Runs `docker push <server>/<repository>:<tag>`, parses the digest from the
- * push summary, and falls back to {@link inspectImageDigest} if the summary
- * didn't carry one. Throws if the push fails OR if no digest can be recovered
- * (a deploy must never proceed with an unverifiable artifact reference).
+ * Runs `docker push <server>/<repository>:<tag>`, then resolves the pushed
+ * tag's digest from the REGISTRY via {@link inspectRegistryDigest} (NOT the
+ * local daemon cache). The `digest: sha256:...` line from the push summary,
+ * when present, is cross-checked against the registry digest and a MISMATCH is
+ * a hard error — that is the #1679 failure mode (a DNS-round-robin split /
+ * same-tag re-push surfacing a stale local digest that disagrees with what
+ * Harbor actually stored). Throws if the push fails, if the registry digest
+ * can't be resolved, or on a push/registry mismatch — a deploy must never
+ * proceed with an unverifiable or stale artifact reference.
  *
- * @returns the `sha256:<64hex>` manifest digest of the pushed tag.
- * @throws if push exits non-zero, or if no manifest digest can be determined.
+ * @returns the `sha256:<64hex>` registry manifest digest of the pushed tag.
+ * @throws if push exits non-zero, the registry digest is unresolvable, or the
+ *   push-summary digest disagrees with the registry.
  */
 async function dockerPush(registry, tag, spawnFn) {
     const ref = imageRef(registry, tag);
@@ -151,14 +151,18 @@ async function dockerPush(registry, tag, spawnFn) {
     if (code !== 0) {
         throw new Error(`docker push failed (exit ${code}): ${stderr.trim()}`);
     }
+    const fromRegistry = await inspectRegistryDigest(registry, tag, spawnFn);
+    if (!fromRegistry) {
+        throw new Error(`pushed ${ref} but could not resolve its registry manifest digest via ` +
+            '`docker buildx imagetools inspect` (registry unreachable or buildx unavailable). ' +
+            'Refusing to attest an unverifiable artifact reference.');
+    }
     const fromPush = parsePushDigest(stdout + '\n' + stderr);
-    if (fromPush)
-        return fromPush;
-    const fromInspect = await inspectImageDigest(registry, tag, spawnFn);
-    if (fromInspect)
-        return fromInspect;
-    throw new Error(`pushed ${ref} but could not determine its registry manifest digest ` +
-        '(no `digest: sha256:...` in push output and no matching RepoDigests). ' +
-        'Re-run with --image-digest <sha256:...> to supply it explicitly.');
+    if (fromPush && fromPush !== fromRegistry) {
+        throw new Error(`digest mismatch for ${ref}: push summary reported ${fromPush} but the registry ` +
+            `serves ${fromRegistry} (stale local digest / cross-cluster push split, #1679). ` +
+            'Refusing to attest a digest the registry does not serve.');
+    }
+    return fromRegistry;
 }
 //# sourceMappingURL=docker.js.map

package/dist/_lib/docker.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/_lib/docker.ts"],"names":[],"mappings":";;AAmEA,4BAEC;AAQD,kCAWC;AAaD,0CAIC;AAcD,4CAiBC;AAUD,gDAYC;AAaD,gCAqBC;AAhMD;;;;;;;;;;;;;;GAcG;AACH,iDAAsC;AAatC;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CACtB,IAAc,EACd,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAK,CAAC;IACxC,OAAO,IAAI,OAAO,CAAY,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE,CACxC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpD,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,QAAuB,EAAE,GAAW;IAC3D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,WAAW,CAC/B,QAAuB,EACvB,OAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CACtC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACvE,EAAE,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,MAAc;IAC5C,mEAAmE;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,MAAc,EAAE,QAAuB;IACtE,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAa,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;IAChE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CACtC,CAAC,SAAS,EAAE,UAAU,EAAE,uBAAuB,EAAE,GAAG,CAAC,EACrD,EAAE,OAAO,EAAE,CACZ,CAAC;IACF,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,UAAU,CAC9B,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,wDAAwD;QACnE,wEAAwE;QACxE,kEAAkE,CACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/_lib/docker.ts"],"names":[],"mappings":";;AAmEA,4BAEC;AAQD,kCAWC;AAaD,0CAIC;AAkBD,sDAQC;AAYD,sDAYC;AAmBD,gCA2BC;AAzMD;;;;;;;;;;;;;;GAcG;AACH,iDAAsC;AAatC;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CACtB,IAAc,EACd,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAK,CAAC;IACxC,OAAO,IAAI,OAAO,CAAY,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE,CACxC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpD,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,QAAuB,EAAE,GAAW;IAC3D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,WAAW,CAC/B,QAAuB,EACvB,OAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CACtC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACvE,EAAE,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,MAAc;IAC5C,mEAAmE;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,qBAAqB,CAAC,MAAc;IAClD,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,qBAAqB,CACzC,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAC9C,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,EACxC,EAAE,OAAO,EAAE,CACZ,CAAC;IACF,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,qBAAqB,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,UAAU,CAC9B,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,0DAA0D;YACrE,mFAAmF;YACnF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,2BAA2B,QAAQ,oBAAoB;YAC/E,UAAU,YAAY,2DAA2D;YACjF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/_lib/frontend-guard.d.ts

@@ -1,3 +1,4 @@
+import type { RunFn } from './baas';
 /**
  * Fail-closed guard shared by `deploy` and `redeploy`: refuse to ship a
  * frontend build that still carries unfilled `REPLACE_BEFORE_DEPLOY:<key>`
@@ -10,4 +11,62 @@
  * false-positive on the guard's own comparison literal (`REPLACE_BEFORE_DEPLOY:"`).
  */
 export declare function assertNoDeploySentinels(dir: string): Promise<void>;
+/**
+ * #2793: `resolveFrontendBundle` (`deploy.ts` / `redeploy.ts`) `mkdir -p`s the
+ * frontend `dir` BEFORE spawning the optional `frontend.build` hook — required
+ * (#2790, load-bearing): `execFileSync(..., { cwd: dir })` throws `ENOENT` on a
+ * missing cwd, verified empirically. Side effect: the sibling `existsSync(dir)`
+ * guard that used to catch a build that never produced its output dir can now
+ * NEVER fire once a hook is configured — `dir` always exists post-`mkdir`,
+ * whether or not the hook actually wrote into it.
+ *
+ * Nothing downstream catches an empty dir either: `assertNoDeploySentinels`'s
+ * `readdir` walk is a no-op on zero files, `tarFrontend` happily tars nothing
+ * into a syntactically valid tar, and the host only logs `size=<n>B` with no
+ * minimum. Net effect without this guard: a `frontend.build` hook that exits 0
+ * without populating `dir` ships an empty SPA bundle, silently, with no error
+ * at any layer.
+ *
+ * Assert `dir` is plausibly a built SPA: non-empty, and containing
+ * `index.html` at its root — the shape the browser-build output this CLI
+ * targets always has (`ng build`'s legacy `browser` builder — the one every
+ * shipped manifest uses — writes `index.html` directly under `outputPath`,
+ * not nested). Call this AFTER the build hook runs, so the hook remains what
+ * is allowed to populate `dir` (mirrors the existsSync timing already moved
+ * post-hook by #2788) — the failure then names the hook that ran, not the
+ * upload step three calls later that would otherwise be blamed.
+ *
+ * #2795: `frontend.build` is OPTIONAL (`ManifestFrontend.build?`), and a bare
+ * `frontend.dir` — "a pre-built/checked-in SPA dir" — is a first-class
+ * documented manifest shape. That branch has the SAME empty-bundle failure
+ * mode for a different reason: `existsSync(dir)` never checked
+ * empty-vs-populated, so an EXISTING but EMPTY dir (wiped, mis-`.gitignore`'d,
+ * stale checkout, a typo'd `dir` that resolves to an existing folder) shipped
+ * silently too. So `buildHook` is optional: pass `f.build` straight through
+ * and the remedy names whatever was actually responsible for populating `dir`
+ * on this branch — never a hook that was never configured.
+ */
+export declare function assertPlausibleSpaBundle(dir: string, buildHook?: string): Promise<void>;
+/**
+ * #2798 / #2791: the `frontend.bundlePath` branch of `resolveFrontendBundle`
+ * (deploy.ts / redeploy.ts) — "a pre-built tarball; takes precedence over
+ * `dir` when set" (deploy-manifest.ts) — returned BEFORE both dir-shaped
+ * guards, so an empty/truncated tarball, or one still carrying unfilled
+ * `REPLACE_BEFORE_DEPLOY:*` placeholders, uploaded unvalidated. Same silent
+ * broken-bundle symptom #2793/#2795 closed for `dir`, plus the sentinel
+ * exposure #2788 exists to prevent.
+ *
+ * The artifact here is a TAR, not a directory, so `fs.readdir` does not
+ * apply. Plausibility is checked from the archive LISTING (`tar -tf`): the
+ * bundle the host mounts must contain `index.html` at its root (`tarFrontend
+ * `-C <dir> .` puts it there; any pre-built bundle missing it has the same
+ * wrong-shape failure `assertPlausibleSpaBundle` rejects) and must be
+ * non-empty. A zero-byte file — the "build created the file then died" shape
+ * — fails both the size floor and the listing, and is named as such.
+ *
+ * Sentinels (#2791): `assertNoDeploySentinels` walks a directory tree, so the
+ * tarball is unpacked to a throwaway temp dir and the EXISTING guard runs
+ * unchanged against it — one sentinel matcher, not two that can drift.
+ */
+export declare function assertPlausibleSpaTarball(tarPath: string, runFn?: RunFn): Promise<void>;
 //# sourceMappingURL=frontend-guard.d.ts.map

package/dist/_lib/frontend-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-guard.d.ts","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxE"}
+{"version":3,"file":"frontend-guard.d.ts","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB7F;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA0C7F"}

package/dist/_lib/frontend-guard.js

@@ -1,8 +1,44 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertNoDeploySentinels = assertNoDeploySentinels;
+exports.assertPlausibleSpaBundle = assertPlausibleSpaBundle;
+exports.assertPlausibleSpaTarball = assertPlausibleSpaTarball;
 const fs_1 = require("fs");
 const path_1 = require("path");
+const os_1 = require("os");
 /**
  * Fail-closed guard shared by `deploy` and `redeploy`: refuse to ship a
  * frontend build that still carries unfilled `REPLACE_BEFORE_DEPLOY:<key>`
@@ -38,4 +74,116 @@ async function assertNoDeploySentinels(dir) {
             (hits.length > 5 ? `, +${hits.length - 5} more` : ''));
     }
 }
+/**
+ * #2793: `resolveFrontendBundle` (`deploy.ts` / `redeploy.ts`) `mkdir -p`s the
+ * frontend `dir` BEFORE spawning the optional `frontend.build` hook — required
+ * (#2790, load-bearing): `execFileSync(..., { cwd: dir })` throws `ENOENT` on a
+ * missing cwd, verified empirically. Side effect: the sibling `existsSync(dir)`
+ * guard that used to catch a build that never produced its output dir can now
+ * NEVER fire once a hook is configured — `dir` always exists post-`mkdir`,
+ * whether or not the hook actually wrote into it.
+ *
+ * Nothing downstream catches an empty dir either: `assertNoDeploySentinels`'s
+ * `readdir` walk is a no-op on zero files, `tarFrontend` happily tars nothing
+ * into a syntactically valid tar, and the host only logs `size=<n>B` with no
+ * minimum. Net effect without this guard: a `frontend.build` hook that exits 0
+ * without populating `dir` ships an empty SPA bundle, silently, with no error
+ * at any layer.
+ *
+ * Assert `dir` is plausibly a built SPA: non-empty, and containing
+ * `index.html` at its root — the shape the browser-build output this CLI
+ * targets always has (`ng build`'s legacy `browser` builder — the one every
+ * shipped manifest uses — writes `index.html` directly under `outputPath`,
+ * not nested). Call this AFTER the build hook runs, so the hook remains what
+ * is allowed to populate `dir` (mirrors the existsSync timing already moved
+ * post-hook by #2788) — the failure then names the hook that ran, not the
+ * upload step three calls later that would otherwise be blamed.
+ *
+ * #2795: `frontend.build` is OPTIONAL (`ManifestFrontend.build?`), and a bare
+ * `frontend.dir` — "a pre-built/checked-in SPA dir" — is a first-class
+ * documented manifest shape. That branch has the SAME empty-bundle failure
+ * mode for a different reason: `existsSync(dir)` never checked
+ * empty-vs-populated, so an EXISTING but EMPTY dir (wiped, mis-`.gitignore`'d,
+ * stale checkout, a typo'd `dir` that resolves to an existing folder) shipped
+ * silently too. So `buildHook` is optional: pass `f.build` straight through
+ * and the remedy names whatever was actually responsible for populating `dir`
+ * on this branch — never a hook that was never configured.
+ */
+async function assertPlausibleSpaBundle(dir, buildHook) {
+    const entries = await fs_1.promises.readdir(dir, { withFileTypes: true });
+    const hasIndexHtml = entries.some((e) => e.isFile() && e.name === 'index.html');
+    if (entries.length > 0 && hasIndexHtml)
+        return;
+    const reason = entries.length === 0 ? 'is empty' : 'has no index.html at its root';
+    throw new Error(buildHook
+        ? `frontend build produced no usable SPA bundle: ${dir} ${reason}. The ` +
+            `frontend.build hook (\`${buildHook}\`) exited 0 without writing a bundle ` +
+            `into its own output dir — verify it actually builds INTO ${dir} ` +
+            `(a mismatched --output-path / missing \`cd\` is the usual cause).`
+        : `frontend build produced no usable SPA bundle: ${dir} ${reason}, and ` +
+            `no \`frontend.build\` hook is configured — a bare frontend.dir must ` +
+            `ALREADY contain a built SPA. Build it before deploying (or add a ` +
+            `\`frontend.build\` hook to the manifest), and check frontend.dir points ` +
+            `at the real build output.`);
+}
+/**
+ * #2798 / #2791: the `frontend.bundlePath` branch of `resolveFrontendBundle`
+ * (deploy.ts / redeploy.ts) — "a pre-built tarball; takes precedence over
+ * `dir` when set" (deploy-manifest.ts) — returned BEFORE both dir-shaped
+ * guards, so an empty/truncated tarball, or one still carrying unfilled
+ * `REPLACE_BEFORE_DEPLOY:*` placeholders, uploaded unvalidated. Same silent
+ * broken-bundle symptom #2793/#2795 closed for `dir`, plus the sentinel
+ * exposure #2788 exists to prevent.
+ *
+ * The artifact here is a TAR, not a directory, so `fs.readdir` does not
+ * apply. Plausibility is checked from the archive LISTING (`tar -tf`): the
+ * bundle the host mounts must contain `index.html` at its root (`tarFrontend
+ * `-C <dir> .` puts it there; any pre-built bundle missing it has the same
+ * wrong-shape failure `assertPlausibleSpaBundle` rejects) and must be
+ * non-empty. A zero-byte file — the "build created the file then died" shape
+ * — fails both the size floor and the listing, and is named as such.
+ *
+ * Sentinels (#2791): `assertNoDeploySentinels` walks a directory tree, so the
+ * tarball is unpacked to a throwaway temp dir and the EXISTING guard runs
+ * unchanged against it — one sentinel matcher, not two that can drift.
+ */
+async function assertPlausibleSpaTarball(tarPath, runFn) {
+    const st = await fs_1.promises.stat(tarPath).catch(() => {
+        throw new Error(`frontend bundle not found: ${tarPath}`);
+    });
+    if (st.size === 0) {
+        throw new Error(`frontend bundle is a ZERO-BYTE file: ${tarPath}. A build that created ` +
+            `the tarball then died before writing it — rebuild it before deploying.`);
+    }
+    const run = runFn ?? (await Promise.resolve().then(() => __importStar(require('child_process')))).execFileSync;
+    let listing;
+    try {
+        listing = run('tar', ['-tf', tarPath], { encoding: 'utf8' });
+    }
+    catch {
+        throw new Error(`frontend bundle is not a readable tar archive: ${tarPath}. Rebuild it ` +
+            `before deploying (a truncated or partially-uploaded tar fails here).`);
+    }
+    const entries = listing
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
+    const hasRootIndex = entries.some((e) => e === './index.html' || e === 'index.html');
+    if (!hasRootIndex) {
+        throw new Error(`frontend bundle has no index.html at its root: ${tarPath} (entries: ` +
+            `${entries.slice(0, 5).join(', ')}${entries.length > 5 ? `, +${entries.length - 5} more` : ''}). ` +
+            `The bundle root must contain the built SPA — the same shape ` +
+            `assertPlausibleSpaBundle enforces for frontend.dir.`);
+    }
+    // #2791: run the UNCHANGED dir-shaped sentinel walk over the unpacked
+    // bundle. Temp dir is under os.tmpdir() and best-effort removed after.
+    const probe = await fs_1.promises.mkdtemp((0, path_1.join)((0, os_1.tmpdir)(), 'hsuite-bundlepath-'));
+    try {
+        run('tar', ['-xf', tarPath, '-C', probe], {});
+        await assertNoDeploySentinels(probe);
+    }
+    finally {
+        await fs_1.promises.rm(probe, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
 //# sourceMappingURL=frontend-guard.js.map

package/dist/_lib/frontend-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-guard.js","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":";;AAcA,0DAuBC;AArCD,2BAAoC;AACpC,+BAAsC;AAEtC;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAW;IACvD,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAiB,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,aAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;iBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,MAAM,aAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAA,eAAQ,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,iFAAiF;YACjF,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3C,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"frontend-guard.js","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,0DAuBC;AAqCD,4DAiBC;AAuBD,8DA0CC;AA9JD,2BAAoC;AACpC,+BAAsC;AACtC,2BAA4B;AAG5B;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAW;IACvD,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAiB,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,aAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;iBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,MAAM,aAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAA,eAAQ,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,iFAAiF;YACjF,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3C,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACI,KAAK,UAAU,wBAAwB,CAAC,GAAW,EAAE,SAAkB;IAC5E,MAAM,OAAO,GAAG,MAAM,aAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY;QAAE,OAAO;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,+BAA+B,CAAC;IACnF,MAAM,IAAI,KAAK,CACb,SAAS;QACP,CAAC,CAAC,iDAAiD,GAAG,IAAI,MAAM,QAAQ;YACtE,0BAA0B,SAAS,wCAAwC;YAC3E,4DAA4D,GAAG,GAAG;YAClE,mEAAmE;QACrE,CAAC,CAAC,iDAAiD,GAAG,IAAI,MAAM,QAAQ;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,0EAA0E;YAC1E,2BAA2B,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACI,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,KAAa;IAC5E,MAAM,EAAE,GAAG,MAAM,aAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,yBAAyB;YACtE,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,IAAK,CAAC,wDAAa,eAAe,GAAC,CAAC,CAAC,YAAiC,CAAC;IACxF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAsB,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,kDAAkD,OAAO,eAAe;YACtE,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC;IACrF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kDAAkD,OAAO,aAAa;YACpE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK;YAClG,8DAA8D;YAC9D,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,KAAK,GAAG,MAAM,aAAE,CAAC,OAAO,CAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,aAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}