@hsuite/smart-engines-cli 1.5.1 → 1.6.0

package/dist/_lib/registry-fanout.d.ts

@@ -2,7 +2,7 @@ import { Buffer } from 'buffer';
 /** A request against one cluster's Harbor Registry-v2 API. `path` is always `/v2/...` (or `/token...`). */
 export type RegistryRequest = {
     ip: string;
-    method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH';
+    method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
     path: string;
     headers?: Record<string, string>;
     body?: Buffer;
@@ -45,6 +45,17 @@ export type EnsureImageOpts = {
     /** Test seam — defaults to {@link defaultTransport} bound to `host`. */
     transport?: RegistryTransport;
 };
+/** Default per-request wall-clock budget for registry / cluster probes. */
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 10000;
+/**
+ * Reject after `ms` instead of waiting on a request that may never settle.
+ *
+ * {@link defaultTransport} builds a bare `https.request` with no socket timeout,
+ * so a peer that completes the TCP handshake and then black-holes the response
+ * hangs its promise forever. Every probe that fans out across the cluster set
+ * wraps its requests in this.
+ */
+export declare function withRequestTimeout<T>(p: Promise<T>, ms: number, what: string): Promise<T>;
 /** A parsed `WWW-Authenticate: Bearer ...` token challenge. `realm` is mandatory. */
 export type AuthChallenge = {
     realm: string;
@@ -91,6 +102,16 @@ export type ResolveRegistryDigestOpts = {
     transport?: RegistryTransport;
     /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
     resolve4?: (h: string) => Promise<string[]>;
+    /**
+     * Per-request wall-clock budget for the manifest probe. Default 10s.
+     *
+     * Load-bearing since {@link probeServedDigests} must visit EVERY endpoint (the
+     * agreement logic needs all the answers) and so can no longer skip past a
+     * black-holing cluster the way the old first-responder read did. A node that
+     * completes the TCP handshake and then never answers would otherwise wedge the
+     * deploy indefinitely — `defaultTransport` sets no socket timeout.
+     */
+    requestTimeoutMs?: number;
 };
 /**
  * Resolve the CANONICAL manifest digest the registry serves for `<repo>:<tag>`
@@ -117,6 +138,31 @@ export type ResolveRegistryDigestOpts = {
  * deployer still re-verifies).
  */
 export declare function resolveRegistryDigest(opts: ResolveRegistryDigestOpts): Promise<string | null>;
+/** What ONE cluster endpoint serves for a tag. `digest: null` ⇒ 404 / unreachable. */
+export type ServedDigestAnswer = {
+    ip: string;
+    digest: string | null;
+};
+/**
+ * Ask EVERY cluster endpoint what it serves for `<repo>:<tag>` and return all
+ * the answers, in endpoint order.
+ *
+ * The federated registry name is round-robin over N INDEPENDENT Harbors, so
+ * "what does the registry serve for this tag" is a set of answers, not one
+ * answer. In the window between a `docker push` (which lands on exactly ONE
+ * cluster) and the fan-out, a re-used tag legitimately resolves to the NEW
+ * artifact on the origin and the PREVIOUS artifact on its peers. Collapsing
+ * that set to "whoever answered first" is what signed a stale digest in #2787.
+ */
+export declare function probeServedDigests(opts: ResolveRegistryDigestOpts): Promise<ServedDigestAnswer[]>;
+/**
+ * Normalise a `registry.server` into the bare DNS name the endpoint resolvers
+ * and the push probe work with: scheme stripped, port stripped. One definition —
+ * this pair of regexes had accumulated four copies across three files, and a
+ * drift between them would silently change which host the fan-out resolves
+ * versus which one the push is pinned to.
+ */
+export declare function registryHostOf(server: string): string;
 /** Registry coordinates a push produced (shape of `BaasInitResponse.registry`). */
 export type FanOutRegistry = {
     server: string;
@@ -127,8 +173,29 @@ export type FanOutRegistry = {
 export type ResolveAttestationDigestOpts = {
     registry: FanOutRegistry;
     tag: string;
-    /** The `sha256:<64hex>` digest the local `docker push` reported. */
+    /**
+     * The `sha256:<64hex>` digest the push produced.
+     *
+     * On the build+push path this is NOT a local-daemon value: `buildAndPush`
+     * resolves it from the ORIGIN registry (`docker buildx imagetools inspect`
+     * against the pinned single-origin target) and hard-errors if the `docker
+     * push` summary disagrees with it. On `--skip-push` it is the round-robin
+     * registry's answer for a tag nobody is currently writing.
+     */
     pushDigest: string;
+    /**
+     * SINGLE-ORIGIN registry hostname the push was pinned to (`resolvePushOrigin`,
+     * #1679) — the one cluster that actually received the bytes this run.
+     *
+     * When set, the resolver returns {@link pushDigest} and nothing else: the
+     * origin's own live answer is a CROSS-CHECK (disagreement ⇒ throw), and a
+     * peer's differing answer is pre-fan-out divergence to converge, never a value
+     * to adopt (#2787). Omit it on `--skip-push` / an unpinned push: then no
+     * endpoint is privileged and the endpoints that answer must AGREE.
+     */
+    originHost?: string;
+    /** Per-request probe timeout (ms). Default {@link DEFAULT_PROBE_TIMEOUT_MS}. */
+    requestTimeoutMs?: number;
     /** Optional progress log sink (defaults to no-op). */
     log?: (msg: string) => void;
     /** Test seam — the registry transport. */
@@ -138,16 +205,100 @@ export type ResolveAttestationDigestOpts = {
 };
 /**
  * Decide the digest to ATTEST (and to feed the fan-out): the digest Harbor
- * SERVES for `<repo>:<tag>`, resolved the same way the deployer does. Falls back
- * to the local `docker push` summary digest ONLY if the registry can't be probed
- * (offline / dev registry / transient) — a fail-SOFT, never a fail-open, because
- * the deployer independently re-verifies the served digest against the attested
- * one before it pins the pod.
+ * SERVES for `<repo>:<tag>`, resolved the same way the deployer does.
+ *
+ * ## Which Harbor, though (#2787)
+ *
+ * `harbor.<domain>` is round-robin over N INDEPENDENT Harbors and a `docker
+ * push` lands on exactly ONE of them. Between the push and the fan-out, a
+ * re-used tag therefore resolves to the NEW artifact on the push origin and to
+ * the PREVIOUS artifact on its peers — both are "the registry-served digest".
+ * This function used to take whichever endpoint answered first, which on
+ * testnet signed `d889ff2a…` (a peer's stale `v12`) for a run that had just
+ * pushed `d6ae4a80…`. The deployer that received that attestation refused the
+ * image — correctly, it cannot tell a stale attestation from a swapped one —
+ * and stayed pinned to the old release while its two peers moved on.
+ *
+ * So:
+ *   - **`originHost` set** (a pinned push landed there) → the result is ALWAYS
+ *     {@link ResolveAttestationDigestOpts.pushDigest}, the digest `buildAndPush`
+ *     read back from the origin registry after the upload. The origin's live
+ *     answer is only a cross-check: if it answers something else we THROW (the
+ *     tag moved underneath us and either value would be a guess), and if it does
+ *     not answer at all we still attest `pushDigest` rather than fall through to
+ *     the peers — the silent-origin case is exactly when the peers unanimously
+ *     serve the PREVIOUS artifact. Peers serving something else are logged and
+ *     left to the fan-out, which copies this manifest to them and re-verifies
+ *     (throwing if it can't).
+ *   - **no `originHost`** (`--skip-push` / unpinned push) → no endpoint is
+ *     privileged, so the endpoints that answer MUST agree. A split mesh THROWS,
+ *     naming every endpoint and its digest — #2766 is a live condition here and
+ *     a coin flip is not an attestation. A served digest may only OVERRIDE
+ *     `pushDigest` when the WHOLE endpoint set answered; a lone answer from a
+ *     partially-reachable mesh also THROWS, because the fan-out would then copy
+ *     that one endpoint's bytes everywhere and make it mesh truth.
  *
- * See {@link resolveRegistryDigest} for why the served digest — not the push
- * summary — is authoritative for the #1445 strict-equality gate (issue #1589).
+ * Falls back to `pushDigest` without complaint when NO endpoint can be probed
+ * (offline / dev registry / transient) — a fail-SOFT, never a fail-open: the
+ * deployer independently re-verifies the served digest against the attested one
+ * before it pins the pod.
+ *
+ * See {@link resolveRegistryDigest} for why a registry-served digest — not the
+ * `docker push` summary — is authoritative for the #1445 strict-equality gate
+ * (issue #1589).
  */
 export declare function resolveAttestationDigest(opts: ResolveAttestationDigestOpts): Promise<string>;
+/**
+ * Result of {@link assertTagFreeOnMesh}: what each cluster Harbor serves for
+ * the candidate tag, or `null` when the registry is not a federated mesh
+ * (nothing was checked — identical semantics to `fanOutPushedImage`'s null).
+ */
+export type MeshTagOccupancy = {
+    host: string;
+    tag: string;
+    /** One entry per cluster ingress: the digest it serves, or `null` when the tag is absent there. */
+    perEndpoint: Array<{
+        ip: string;
+        digest: string | null;
+    }>;
+};
+/** Options for {@link assertTagFreeOnMesh}. */
+export type AssertTagFreeOnMeshOpts = {
+    registry: FanOutRegistry;
+    /** The candidate tag the deploy is about to `docker push` under. */
+    tag: string;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+    /** Test seam — the registry transport. */
+    transport?: RegistryTransport;
+    /** Optional progress log sink (defaults to no-op). */
+    log?: (msg: string) => void;
+};
+/**
+ * #2766 — BEFORE a `docker push`, prove the candidate tag is unoccupied on
+ * EVERY cluster Harbor of the mesh. Tag immutability is enforced per-cluster,
+ * so it cannot prevent divergence BETWEEN registries: a tag that already
+ * exists on any one of them (at any digest — the about-to-be-pushed build has
+ * a fresh, unknowable digest) makes the deploy 412 mid-fan-out at best, and at
+ * worst leaves the tag permanently inconsistent across the mesh (sn1/sn2 at
+ * one digest, sn3 at another, all immutable — unrecoverable without operator
+ * action). This check moves that failure BEFORE the build/push, where the
+ * operator just picks a fresh tag, and lists the divergence it found.
+ *
+ * Semantics:
+ *   - 0/1 endpoint, or DNS that does not fan out → `null` (single-target
+ *     registry; a single origin's own immutability already protects it).
+ *   - tag absent EVERYWHERE → the occupancy (all `digest: null`) — free to push.
+ *   - tag present on ANY endpoint at ANY digest → THROWS, one line per cluster
+ *     (`ip → sha256:… | absent`). A single-origin pre-check must never be
+ *     treated as authoritative anywhere in this path — the exact check that
+ *     produced the v10 incident.
+ *
+ * Fail-open is deliberate on TRANSPORT errors per endpoint? NO — a cluster we
+ * cannot interrogate is a cluster we cannot vouch for, so a non-404/200 answer
+ * is fatal too. Only the not-a-mesh case (above) returns `null`.
+ */
+export declare function assertTagFreeOnMesh(opts: AssertTagFreeOnMeshOpts): Promise<MeshTagOccupancy | null>;
 export type FanOutPushedImageOpts = {
     registry: FanOutRegistry;
     tag: string;
@@ -175,4 +326,143 @@ export type FanOutPushedImageOpts = {
  * resolves, so a failure here means a dev/local registry where fan-out is moot.
  */
 export declare function fanOutPushedImage(opts: FanOutPushedImageOpts): Promise<FanOutReport | null>;
+/** Options for {@link resolvePushOrigin}. */
+export type ResolvePushOriginOpts = {
+    /** Federated (round-robin) Harbor host, e.g. `harbor.testnet.hsuite.network`. */
+    host: string;
+    /** Repository path the push will target, e.g. `hsuite-customers-<appId>/app`. */
+    repository: string;
+    username: string;
+    password: string;
+    /** Test seam — the registry transport (defaults to {@link defaultTransport}). */
+    transport?: RegistryTransport;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+    /**
+     * Already-resolved cluster ingress IPs for {@link ResolvePushOriginOpts.host}.
+     * Supplied by {@link requirePushOrigin} so ONE DNS answer decides both "is
+     * this registry federated?" and "which origins do we probe?" — two
+     * independent lookups can disagree, and the whole point of this function is
+     * that a single answer set is authoritative for one push.
+     */
+    endpoints?: string[];
+    /** Optional progress log sink (defaults to no-op). */
+    log?: (msg: string) => void;
+};
+/**
+ * Resolve the SINGLE-ORIGIN hostname a `docker push` must be aimed at, by
+ * asking the mesh which name it wants upload traffic on. Returns `null` when
+ * there is nothing to pin (single-target registry, no server-side pin, or a pin
+ * that fails validation) — the caller then pushes at the round-robin name, i.e.
+ * exactly today's behaviour.
+ *
+ * ## Why the push must be pinned at all (#1679)
+ *
+ * `harbor.<domain>` is public-DNS round-robin over three INDEPENDENT Harbors.
+ * A chunked blob upload (`POST` init → `PATCH` → `PUT` finalize) is stateful:
+ * the `_state` token is HMAC'd by the serving registry and the uploaded bytes
+ * sit on that cluster's own ReadWriteOnce PVC. When the client reconnects
+ * between requests and round-robin lands the next hop on a different cluster,
+ * the upload dies (`blob upload invalid` / `invalid secret`). Sharing
+ * `REGISTRY_HTTP_SECRET` and the token CA across the mesh (PR #2763) fixes the
+ * HMAC and the bearer token, but NOT the blob bytes — those are still local to
+ * one cluster. The push has to stay on one origin end to end; the fan-out then
+ * distributes the finished artifact ({@link fanOutPushedImage}).
+ *
+ * ## Why we ASK instead of deriving the name
+ *
+ * Each cluster's registry is already pinned server-side (`REGISTRY_HTTP_HOST`)
+ * and advertises that name in the `Location` of an upload-init. The server
+ * honours it; docker 29.5.2 does not — it keeps the host it DIALLED and reuses
+ * only the path+query of the `Location`, so the server-side pin never reaches
+ * the wire. Reading the advertised host and dialling it ourselves is therefore
+ * the client-side half of a pin the server already publishes. Deriving
+ * `harbor-sn1` from `harbor` by string surgery would instead bake a testnet DNS
+ * convention into a customer-facing CLI, and silently mis-aim any other mesh.
+ *
+ * ## Validation
+ *
+ * The advertised value is server-controlled, and the CLI hands it to
+ * `docker login` / `docker push` — so it gates the robot credential and the
+ * customer's image. Three guards, all fail-CLOSED (return `null`, never throw;
+ * the caller then pushes unpinned, exactly as it would have anyway):
+ *
+ *   1. Not an IP literal — no cert covers one here, and "does this address
+ *      resolve to itself" is not an identity check.
+ *   2. Inside `host`'s own parent DNS zone. A registry may only nominate a name
+ *      the OPERATOR already controls, never an arbitrary internet name.
+ *   3. Resolves to exactly ONE address, and that address is the very cluster
+ *      that advertised it.
+ *
+ * RESIDUAL RISK (accepted, documented): validation and use are two different
+ * DNS lookups — ours via `dns.resolve4`, then docker's own, moments later. A
+ * DNS rebind between them is not detectable from here, because docker resolves
+ * the hostname itself and takes no IP pin. Guard 2 is what makes that
+ * uninteresting: a rebind would need control of the operator's own zone, and an
+ * attacker holding that already owns `harbor.<domain>` itself. Closing the
+ * window completely means not shelling out to `docker` for the push at all
+ * (doing the upload over the Registry-v2 transport in this file, which does pin
+ * IP + SNI) — a much larger change, tracked separately.
+ *
+ * The probe opens one blob-upload session per attempt and cancels it
+ * (`DELETE`), so it leaves no half-open upload behind.
+ */
+export declare function resolvePushOrigin(opts: ResolvePushOriginOpts): Promise<string | null>;
+/**
+ * Options for {@link requirePushOrigin} — identical to
+ * {@link ResolvePushOriginOpts}; the wrapper differs in what it does with a
+ * failed pin, not in what it needs to attempt one. Named separately so the
+ * fail-closed entry point has its own referenceable contract.
+ */
+export type RequirePushOriginOpts = ResolvePushOriginOpts;
+/**
+ * The pin every push goes through (#2887). Wraps {@link resolvePushOrigin} and
+ * turns its fail-OPEN `null` into a hard failure **when the registry name is
+ * federated** — i.e. when it resolves to more than one origin.
+ *
+ * ## Why the fail-open had to go
+ *
+ * `resolvePushOrigin` returning `null` means "I could not pin this push". Its
+ * callers then pushed at the round-robin name, which is documented as
+ * "exactly today's behaviour" — but on a federated mesh today's behaviour does
+ * not work. Measured on testnet 2026-08-27 against
+ * `harbor.testnet.hsuite.network` (three A records, three INDEPENDENT Harbors,
+ * each signing its own bearer tokens and holding blob-upload sessions on its
+ * own ReadWriteOnce PVC): `Login Succeeded`, then some layers reporting
+ * `Layer already exists` while others sat on `Waiting`, then
+ * `error from registry: unauthorized to access repository: …, action: push`
+ * — on all 6 retries. The identical push aimed at `harbor-sn2.…` succeeded on
+ * the first attempt, then again at sn1 and sn3.
+ *
+ * So the unpinned fall-back is not a degraded push, it is a push that cannot
+ * succeed, and taking it silently costs a full image build plus six retries
+ * before failing with an error message that blames permissions. Refusing up
+ * front — naming the mesh, its origins, and the server-side knob that fixes it
+ * — is strictly better information for the same outcome.
+ *
+ * ## What is still a legitimate no-pin (returns `null`, no throw)
+ *
+ *   - ONE origin. A dev / local / single-VIP registry cannot split a push
+ *     across clusters, so there is nothing to pin and nothing to fail.
+ *   - DNS that cannot enumerate the name at all. `dns.resolve4` (this module's
+ *     resolver) ignores `/etc/hosts` while docker's own resolution does not, so
+ *     an unresolvable name here can still be a perfectly working single-origin
+ *     registry on the developer's machine. Unproven federation is not proven
+ *     federation; we log it and let the push proceed.
+ *
+ * RESIDUAL RISK (accepted, documented): the A-record count is the ONLY signal
+ * we have for "is this mesh federated". A resolver that answers with fewer
+ * records than the mesh really has — a spoofed or on-path answer, or simply a
+ * health-pruned view at query time — makes a three-Harbor mesh look
+ * single-origin, and the push falls back to unpinned. That is not a
+ * credential-disclosure risk (the three validation guards in
+ * {@link resolvePushOrigin} are untouched, and the fall-back still targets the
+ * operator's own round-robin name, resolved independently by docker); the cost
+ * is reinstating the failure mode above — a wasted build and six confusing
+ * retries. Removing it needs a source of mesh cardinality that is not DNS.
+ *
+ * Callers that genuinely want no pin have `--skip-push` (nothing is uploaded,
+ * so there is no upload session to keep on one origin).
+ */
+export declare function requirePushOrigin(opts: RequirePushOriginOpts): Promise<string | null>;
 //# sourceMappingURL=registry-fanout.d.ts.map

package/dist/_lib/registry-fanout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-fanout.d.ts","sourceRoot":"","sources":["../../src/_lib/registry-fanout.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAmChC,2GAA2G;AAC3G,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEpF,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1F,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgBhF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAA0B,GAClE,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA6BhE;AAwHD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FxF;AA8ED,iDAAiD;AACjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+B9B"}
+{"version":3,"file":"registry-fanout.d.ts","sourceRoot":"","sources":["../../src/_lib/registry-fanout.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAmChC,2GAA2G;AAC3G,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IAGX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEpF,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1F,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAczF;AAED,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgBhF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAA0B,GAClE,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA6BhE;AAwHD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FxF;AA8ED,iDAAiD;AACjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB;AAED,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqC/B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC,CA2GjB;AAiBD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,mGAAmG;IACnG,WAAW,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3D,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAwDlC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+B9B;AAgBD,6CAA6C;AAC7C,MAAM,MAAM,qBAAqB,GAAG;IAClC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoJxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+C3F"}