@mannyc1/ts-release 0.0.7 → 0.3.0

package/dist/drivers/python-wheel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-wheel.js","sourceRoot":"","sources":["../../src/drivers/python-wheel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAA;AAShC,MAAM,SAAS,GAAG;IAChB,WAAW,EAAE,gCAAgC;IAC7C,aAAa,EAAE,iCAAiC;IAChD,YAAY,EAAE,6BAA6B;IAC3C,cAAc,EAAE,4BAA4B;CACoB,CAAA;AAElE,MAAM,CAAC,MAAM,0BAA0B,GAA6C,MAAM,CAAC,MAAM,CAC/F,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,YAAY,EAAE,MAAM,CAAC,YAAY;IACjC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;CAC/B,CAAC,CAAC,CACJ,CAAA;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AACjC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAc,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAClE,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,wCAAwC,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AACD,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAU,EAAE,CACpD,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACvD,MAAM,YAAY,GAAG,YAAY,CAAA;AACjC,MAAM,UAAU,GAAG,YAAY,CAAA;AAC/B,MAAM,WAAW,GAAG,YAAY,CAAA;AAChC,MAAM,aAAa,GAAG,YAAY,CAAA;AAElC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,MAAiC,EACjC,OAAe,EACP,EAAE,CAAC,GAAG,YAAY,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,MAAM,CAAA;AAEnF,MAAM,QAAQ,GAAG;;;;;;;;;;;;wCAYuB,UAAU,uBAAuB,aAAa;;;+CAGvC,aAAa;;;;;kBAK1C,aAAa;;;;;;CAM9B,CAAA;AAWD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,KAA+B,EACF,EAAE;IAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAA;IAC1E,MAAM,QAAQ,GAAG;QACf,uBAAuB;QACvB,SAAS,WAAW,EAAE;QACtB,YAAY,OAAO,EAAE;QACrB,YAAY,OAAO,EAAE;QACrB,cAAc,QAAQ,EAAE;QACxB,uBAAuB,OAAO,EAAE;QAChC,wBAAwB;QACxB,sCAAsC;QACtC,EAAE;QACF,OAAO;QACP,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,OAAO,GAAmB;QAC9B,EAAE,IAAI,EAAE,GAAG,UAAU,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChH,EAAE,IAAI,EAAE,GAAG,UAAU,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvE,EAAE,IAAI,EAAE,GAAG,UAAU,QAAQ,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClF,EAAE,IAAI,EAAE,GAAG,QAAQ,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvE;YACE,IAAI,EAAE,GAAG,QAAQ,QAAQ;YACzB,IAAI,EAAE,KAAK,CAAC;gBACV,oBAAoB;gBACpB,uBAAuB;gBACvB,wBAAwB;gBACxB,QAAQ,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC/B,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,IAAI,EAAE,QAAQ;SACf;QACD;YACE,IAAI,EAAE,GAAG,QAAQ,mBAAmB;YACpC,IAAI,EAAE,KAAK,CAAC,sBAAsB,aAAa,MAAM,UAAU,aAAa,CAAC;YAC7E,IAAI,EAAE,QAAQ;SACf;QACD,EAAE,IAAI,EAAE,GAAG,QAAQ,gBAAgB,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;KACtF,CAAA;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3F,MAAM,UAAU,GAAG,GAAG,QAAQ,SAAS,CAAA;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnC,GAAG,KAAK,CAAC,IAAI,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAC3G,CAAA;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,CAAC,CAAA;IAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACzF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAA+B,EAAc,EAAE,CACtF,GAAG,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAA"}

package/dist/drivers/redact.d.ts

@@ -0,0 +1,4 @@
+export declare const redactOutput: (text: string, env: Readonly<Record<string, string>>) => string;
+/** Complete redacted machine-protocol output for immediate decoding only. */
+export declare const redactProtocolOutput: (text: string, env: Readonly<Record<string, string>>) => string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/drivers/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/drivers/redact.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,YAAY,GACvB,MAAM,MAAM,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAClD,MAGF,CAAA;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAClD,MAA2B,CAAA"}

package/dist/drivers/redact.js

@@ -0,0 +1,24 @@
+import { secretPatterns } from "../model/secret-patterns.js";
+const EXCERPT_LIMIT = 2000;
+const redact = (text, env) => {
+    let out = text;
+    for (const [name, value] of Object.entries(env)
+        .filter(([name, value]) => name !== "PATH" && value.length >= 6)
+        .sort((left, right) => right[1].length - left[1].length)) {
+        out = out.split(value).join(`[redacted:${name}]`);
+    }
+    for (const pattern of secretPatterns) {
+        out = out.replace(new RegExp(pattern.source, `${pattern.flags.replace("u", "")}gu`), "[redacted:token]");
+    }
+    return out;
+};
+// Redacts KNOWN values (the exact env values the child received, longest
+// first, except PATH) and known token shapes, then bounds the excerpt. Child
+// output enters a durable diagnostic ledger only through this bounded form.
+export const redactOutput = (text, env) => {
+    const out = redact(text, env);
+    return out.length > EXCERPT_LIMIT ? `${out.slice(0, EXCERPT_LIMIT)}…[truncated]` : out;
+};
+/** Complete redacted machine-protocol output for immediate decoding only. */
+export const redactProtocolOutput = (text, env) => redact(text, env);
+//# sourceMappingURL=redact.js.map

package/dist/drivers/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/drivers/redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D,MAAM,aAAa,GAAG,IAAI,CAAA;AAE1B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAqC,EAAU,EAAE;IAC7E,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;SAC/D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,CAAA;IACnD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAC1G,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,IAAY,EAAE,GAAqC,EAC3C,EAAE;IACV,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC7B,OAAO,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAA;AACxF,CAAC,CAAA;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EAAE,GAAqC,EAC3C,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA"}

package/dist/drivers/seccomp-helper-source.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Embedded so source, built JS, npm consumers, and standalone CLI bundles all
+ * execute the same audited helper bytes through the pinned Bun runtime.
+ */
+export declare const makeNetworkIsolationHelperSource: (requiredLibrary?: string) => string;
+export declare const networkIsolationHelperSource: string;
+//# sourceMappingURL=seccomp-helper-source.d.ts.map

package/dist/drivers/seccomp-helper-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seccomp-helper-source.d.ts","sourceRoot":"","sources":["../../src/drivers/seccomp-helper-source.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,gCAAgC,GAAI,wBAAmC,KAAG,MAkHtF,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAqC,CAAA"}

package/dist/drivers/seccomp-helper-source.js

@@ -0,0 +1,121 @@
+/**
+ * Embedded so source, built JS, npm consumers, and standalone CLI bundles all
+ * execute the same audited helper bytes through the pinned Bun runtime.
+ */
+export const makeNetworkIsolationHelperSource = (requiredLibrary = "libseccomp.so.2") => String.raw `import { dlopen, ptr } from "bun:ffi"
+import { createHash } from "node:crypto"
+import { readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs"
+import { arch, release } from "node:os"
+
+const fail = (reason) => {
+  process.stderr.write("ts-release network isolation failed closed: " + reason + "\n")
+  process.exit(125)
+}
+if (process.platform !== "linux" || !["x64", "arm64"].includes(process.arch)) {
+  fail("unsupported host " + process.platform + "/" + process.arch)
+}
+const identityPath = process.env.TS_RELEASE_NETWORK_IDENTITY_FILE
+const expectedHelperDigest = process.env.TS_RELEASE_NETWORK_HELPER_SHA256
+const libraryName = process.env.TS_RELEASE_NETWORK_LIBRARY
+if (!identityPath || !expectedHelperDigest || libraryName !== ${JSON.stringify(requiredLibrary)}) {
+  fail("missing or invalid internal isolation parameters")
+}
+const helperDigest = createHash("sha256").update(readFileSync(process.argv[1])).digest("hex")
+if (helperDigest !== expectedHelperDigest) fail("helper digest disagrees with parent")
+const argv = process.argv.slice(2)
+if (argv.length === 0) fail("missing command")
+const deniedSyscalls = [
+  "socket", "socketpair", "connect", "bind", "listen", "accept", "accept4",
+  "sendto", "sendmsg", "sendmmsg", "recvfrom", "recvmsg", "recvmmsg",
+  "io_uring_setup", "io_uring_enter", "io_uring_register", "pidfd_getfd"
+]
+let library
+try {
+  library = dlopen(libraryName, {
+    seccomp_init: { args: ["u32"], returns: "ptr" },
+    seccomp_rule_add: { args: ["ptr", "u32", "i32", "u32"], returns: "i32" },
+    seccomp_load: { args: ["ptr"], returns: "i32" },
+    seccomp_release: { args: ["ptr"], returns: "void" },
+    seccomp_syscall_resolve_name: { args: ["ptr"], returns: "i32" }
+  })
+} catch (cause) {
+  fail("libseccomp.so.2 unavailable: " + String(cause))
+}
+let libraryPath
+try {
+  const mapping = readFileSync("/proc/self/maps", "utf8").split("\n").find((line) => line.includes("libseccomp.so"))
+  const candidate = mapping && mapping.trim().split(/\s+/).at(-1)
+  if (!candidate || !candidate.startsWith("/")) fail("loaded libseccomp mapping is unavailable")
+  libraryPath = realpathSync(candidate)
+} catch (cause) {
+  fail("cannot identify loaded libseccomp: " + String(cause))
+}
+const libraryDigest = createHash("sha256").update(readFileSync(libraryPath)).digest("hex")
+const bunDigest = createHash("sha256").update(readFileSync(realpathSync(process.execPath))).digest("hex")
+const context = library.symbols.seccomp_init(0x7fff0000)
+if (context === null) fail("seccomp_init returned null")
+try {
+  for (const name of deniedSyscalls) {
+    const bytes = new TextEncoder().encode(name + "\0")
+    const syscall = library.symbols.seccomp_syscall_resolve_name(ptr(bytes))
+    if (syscall < 0) fail("kernel/libseccomp cannot resolve " + name)
+    const result = library.symbols.seccomp_rule_add(context, 0x00050001, syscall, 0)
+    if (result !== 0) fail("seccomp_rule_add(" + name + ") returned " + result)
+  }
+  const loaded = library.symbols.seccomp_load(context)
+  if (loaded !== 0) fail("seccomp_load returned " + loaded)
+} finally {
+  library.symbols.seccomp_release(context)
+}
+library.close()
+const identity = {
+  protocol: "ts-release-seccomp-network-deny/v1",
+  helperSha256: helperDigest,
+  librarySha256: libraryDigest,
+  bunVersion: globalThis["Bun"].version,
+  bunSha256: bunDigest,
+  kernel: release(),
+  architecture: arch(),
+  deniedSyscalls
+}
+try {
+  writeFileSync(identityPath, JSON.stringify(identity), { encoding: "utf8", flag: "wx", mode: 0o600 })
+} catch (cause) {
+  fail("cannot persist isolation identity: " + String(cause))
+}
+const childEnvironment = { ...process.env }
+delete childEnvironment.TS_RELEASE_NETWORK_IDENTITY_FILE
+delete childEnvironment.TS_RELEASE_NETWORK_HELPER_SHA256
+delete childEnvironment.TS_RELEASE_NETWORK_LIBRARY
+// The runtime spawn API preserves caller-provided non-stdio descriptors. Close only the
+// descriptors explicitly inherited without FD_CLOEXEC; Bun's own internal
+// descriptors remain untouched and are closed by exec.
+let libc
+try {
+  libc = dlopen("libc.so.6", {
+    fcntl: { args: ["i32", "i32"], returns: "i32" },
+    close: { args: ["i32"], returns: "i32" }
+  })
+  for (const item of readdirSync("/proc/self/fd")) {
+    const fd = Number(item)
+    if (!Number.isSafeInteger(fd) || fd <= 2) continue
+    const flags = libc.symbols.fcntl(fd, 1)
+    if (flags >= 0 && (flags & 1) === 0) libc.symbols.close(fd)
+  }
+  libc.close()
+} catch (cause) {
+  fail("cannot close inherited non-stdio descriptors: " + String(cause))
+}
+let child
+try {
+  child = globalThis["Bun"].spawn(argv, {
+    env: childEnvironment,
+    stdio: ["ignore", "inherit", "inherit"]
+  })
+} catch (cause) {
+  fail("isolated child spawn failed: " + String(cause))
+}
+process.exit(await child.exited)
+`;
+export const networkIsolationHelperSource = makeNetworkIsolationHelperSource();
+//# sourceMappingURL=seccomp-helper-source.js.map

package/dist/drivers/seccomp-helper-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seccomp-helper-source.js","sourceRoot":"","sources":["../../src/drivers/seccomp-helper-source.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,eAAe,GAAG,iBAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;gEAe3C,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmG9F,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,EAAE,CAAA"}

package/dist/drivers/utils.d.ts

@@ -0,0 +1,4 @@
+import { DriverError } from "./errors.js";
+export declare const failure: (reason: string, commitment?: "before-commit" | "unknown") => DriverError;
+export declare const sha256: (bytes: Uint8Array) => string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/drivers/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/drivers/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,eAAO,MAAM,OAAO,GAClB,QAAQ,MAAM,EACd,aAAY,eAAe,GAAG,SAA2B,gBACd,CAAA;AAE7C,eAAO,MAAM,MAAM,GAAI,OAAO,UAAU,KAAG,MACO,CAAA"}

package/dist/drivers/utils.js

@@ -0,0 +1,5 @@
+import { createHash } from "node:crypto";
+import { DriverError } from "./errors.js";
+export const failure = (reason, commitment = "before-commit") => DriverError.make({ reason, commitment });
+export const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+//# sourceMappingURL=utils.js.map

package/dist/drivers/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/drivers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,MAAc,EACd,aAA0C,eAAe,EACzD,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;AAE7C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAClD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA"}

package/dist/drivers/workspace.d.ts

@@ -0,0 +1,9 @@
+/** Create private scratch beneath the host temp root and return its canonical path.
+ * macOS commonly exposes that root through /var while realpath resolves /private/var. */
+export declare const makeCanonicalTemporaryDirectory: (prefix: string) => string;
+export declare const secureRead: (root: string, path: string) => {
+    readonly bytes: Uint8Array;
+    readonly inode: number;
+};
+export declare const secureWrite: (root: string, path: string, bytes: Uint8Array | string) => void;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/drivers/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/drivers/workspace.ts"],"names":[],"mappings":"AAWA;yFACyF;AACzF,eAAO,MAAM,+BAA+B,GAAI,QAAQ,MAAM,KAAG,MACA,CAAA;AAEjE,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAe3G,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,EAAE,OAAO,UAAU,GAAG,MAAM,KAAG,IAYpF,CAAA"}

package/dist/drivers/workspace.js

@@ -0,0 +1,53 @@
+import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { contained } from "./contain.js";
+import { DriverError } from "./errors.js";
+const fail = (reason) => DriverError.make({ reason, commitment: "before-commit" });
+/** Create private scratch beneath the host temp root and return its canonical path.
+ * macOS commonly exposes that root through /var while realpath resolves /private/var. */
+export const makeCanonicalTemporaryDirectory = (prefix) => realpathSync(mkdtempSync(join(realpathSync(tmpdir()), prefix)));
+export const secureRead = (root, path) => {
+    let current = root;
+    for (const part of path.split(/[\\/]+/u)) {
+        current = join(current, part);
+        if (lstatSync(current).isSymbolicLink())
+            throw fail("Structured read encountered a symlink.");
+    }
+    const descriptor = openSync(current, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const opened = fstatSync(descriptor);
+        const resolved = realpathSync(current);
+        if (!contained(root, resolved))
+            throw fail("Opened file escaped the workspace root.");
+        const landed = lstatSync(resolved);
+        if (landed.ino !== opened.ino || landed.dev !== opened.dev)
+            throw fail("Opened file changed identity.");
+        return { bytes: new Uint8Array(readFileSync(descriptor)), inode: opened.ino };
+    }
+    finally {
+        closeSync(descriptor);
+    }
+};
+export const secureWrite = (root, path, bytes) => {
+    const parts = path.split(/[\\/]+/u).filter((part) => part.length > 0);
+    let parent = root;
+    for (const part of parts.slice(0, -1)) {
+        parent = join(parent, part);
+        mkdirSync(parent, { recursive: true });
+        if (lstatSync(parent).isSymbolicLink())
+            throw fail("Structured write encountered a symlink.");
+    }
+    const target = join(parent, parts.at(-1));
+    if (existsSync(target) && lstatSync(target).isSymbolicLink())
+        throw fail("Structured write encountered a symlink.");
+    const descriptor = openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 0o644);
+    try {
+        writeFileSync(descriptor, bytes);
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+};
+//# sourceMappingURL=workspace.js.map

package/dist/drivers/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/drivers/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACM,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAC5E,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAC5E,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAe,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;AAEvG;yFACyF;AACzF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,MAAc,EAAU,EAAE,CACxE,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;AAEjE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAA0D,EAAE;IAC/G,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC7B,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,CAAC,wCAAwC,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,CAAC,yCAAyC,CAAC,CAAA;QACrF,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,CAAC,+BAA+B,CAAC,CAAA;QACvG,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IAC/E,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;AACrC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,KAA0B,EAAQ,EAAE;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrE,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC3B,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,CAAC,yCAAyC,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;IAC1C,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACnH,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC7H,IAAI,CAAC;QAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;AACnG,CAAC,CAAA"}

package/dist/extensions/provider-adapter.d.ts

@@ -0,0 +1,48 @@
+import * as Schema from "effect/Schema";
+import { NonEmptyName } from "../model/primitives.js";
+import type { ReleaseSubject } from "../publication/coordinator.js";
+import { type PublicationProfileRegistration } from "../publication/recovery.js";
+import type { PublicationSubjectServices } from "../capabilities/module.js";
+import type { PreparedBundle } from "../release/prepared-store.js";
+declare const ProviderAdapterContract_base: Schema.Class<ProviderAdapterContract, Schema.Struct<{
+    readonly schemaVersion: Schema.Literal<"ts-release/provider-adapter-contract/v1">;
+    readonly preparedSubject: Schema.Literal<"typed-canonical-data">;
+    readonly identity: Schema.Literal<"canonical-subject-id">;
+    readonly observation: Schema.Literal<"exact-equality-and-authoritative-absence">;
+    readonly mutation: Schema.Literal<"typed-precondition-and-commitment">;
+    readonly credentials: Schema.Literal<"audience-and-purpose-scoped">;
+    readonly recovery: Schema.Literal<"coordinator-profile">;
+    readonly certification: Schema.Literal<"provider-protocol-and-public-boundary-tests">;
+}>, {}>;
+/**
+ * Closed acknowledgements required from every custom application adapter.
+ * They are intentionally precise rather than extensible strings: a boolean
+ * success callback or generic command publisher cannot satisfy this contract.
+ */
+export declare class ProviderAdapterContract extends ProviderAdapterContract_base {
+}
+export interface CustomProviderAdapterInput {
+    readonly id: string;
+    readonly contract: ProviderAdapterContract;
+    readonly profile: PublicationProfileRegistration;
+    /**
+     * Derive typed subjects only from a verified prepared bundle and opaque host
+     * sinks. Returning no subject means this installed application adapter does
+     * not apply to that bundle.
+     */
+    readonly subjects: (bundle: PreparedBundle, services: PublicationSubjectServices) => ReadonlyArray<ReleaseSubject>;
+}
+export interface CustomProviderAdapter extends Omit<CustomProviderAdapterInput, "id"> {
+    readonly _tag: "CustomProviderAdapter";
+    readonly id: NonEmptyName;
+}
+/** Validate once at custom-application composition time. */
+export declare const makeProviderAdapter: (input: CustomProviderAdapterInput) => CustomProviderAdapter;
+/**
+ * Build custom subjects behind the same profile and identity checks used by
+ * built-ins. Coordinator construction performs the final request identity,
+ * audience, purpose, mutation, prerequisite, and durable-history checks.
+ */
+export declare const customProviderSubjects: (bundle: PreparedBundle, adapters: ReadonlyArray<CustomProviderAdapter>, services: PublicationSubjectServices, reservedIds?: ReadonlySet<string>) => ReadonlyArray<ReleaseSubject>;
+export {};
+//# sourceMappingURL=provider-adapter.d.ts.map

package/dist/extensions/provider-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adapter.d.ts","sourceRoot":"","sources":["../../src/extensions/provider-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAGL,KAAK,8BAA8B,EACpC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;;;;;;;;;;;AAElE;;;;GAIG;AACH,qBAAa,uBACX,SAAQ,4BASN;CAAG;AAEP,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,CACjB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,0BAA0B,KACjC,aAAa,CAAC,cAAc,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC;IACnF,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAA;IACtC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAA;CAC1B;AAMD,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,GAAI,OAAO,0BAA0B,KAAG,qBAcvE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,QAAQ,cAAc,EACtB,UAAU,aAAa,CAAC,qBAAqB,CAAC,EAC9C,UAAU,0BAA0B,EACpC,cAAa,WAAW,CAAC,MAAM,CAAa,KAC3C,aAAa,CAAC,cAAc,CAmB9B,CAAA"}

package/dist/extensions/provider-adapter.js

@@ -0,0 +1,64 @@
+import * as Schema from "effect/Schema";
+import { NonEmptyName } from "../model/primitives.js";
+import { assertRecoveryProfileMatches, validatePublicationProfiles } from "../publication/recovery.js";
+/**
+ * Closed acknowledgements required from every custom application adapter.
+ * They are intentionally precise rather than extensible strings: a boolean
+ * success callback or generic command publisher cannot satisfy this contract.
+ */
+export class ProviderAdapterContract extends Schema.Class("ProviderAdapterContract")({
+    schemaVersion: Schema.Literal("ts-release/provider-adapter-contract/v1"),
+    preparedSubject: Schema.Literal("typed-canonical-data"),
+    identity: Schema.Literal("canonical-subject-id"),
+    observation: Schema.Literal("exact-equality-and-authoritative-absence"),
+    mutation: Schema.Literal("typed-precondition-and-commitment"),
+    credentials: Schema.Literal("audience-and-purpose-scoped"),
+    recovery: Schema.Literal("coordinator-profile"),
+    certification: Schema.Literal("provider-protocol-and-public-boundary-tests")
+}) {
+}
+const decodeContract = Schema.decodeUnknownSync(ProviderAdapterContract, {
+    onExcessProperty: "error"
+});
+/** Validate once at custom-application composition time. */
+export const makeProviderAdapter = (input) => {
+    const contract = decodeContract(input.contract);
+    const id = NonEmptyName.make(input.id);
+    const profile = validatePublicationProfiles({ [id.toString()]: input.profile })[id.toString()];
+    if (profile.id !== id.toString()) {
+        throw new Error("A custom provider adapter id must equal its recovery-profile registration id.");
+    }
+    return Object.freeze({
+        _tag: "CustomProviderAdapter",
+        ...input,
+        id,
+        contract,
+        profile
+    });
+};
+/**
+ * Build custom subjects behind the same profile and identity checks used by
+ * built-ins. Coordinator construction performs the final request identity,
+ * audience, purpose, mutation, prerequisite, and durable-history checks.
+ */
+export const customProviderSubjects = (bundle, adapters, services, reservedIds = new Set()) => {
+    const result = [];
+    const ids = new Set(reservedIds);
+    for (const adapter of adapters) {
+        const subjects = adapter.subjects(bundle, services);
+        for (const subject of subjects) {
+            if (ids.has(subject.id.toString())) {
+                throw new Error(`Custom provider adapter ${adapter.id} repeats subject ${subject.id}.`);
+            }
+            assertRecoveryProfileMatches(adapter.profile.id, adapter.profile.recovery, subject.recovery);
+            if (subject.observationRequests.some((request) => request.provider.toString() !== adapter.profile.provider) ||
+                subject.mutationRequest.provider.toString() !== adapter.profile.provider) {
+                throw new Error(`Custom provider adapter ${adapter.id} emitted credential authority for a foreign provider.`);
+            }
+            ids.add(subject.id.toString());
+            result.push(subject);
+        }
+    }
+    return result;
+};
+//# sourceMappingURL=provider-adapter.js.map

package/dist/extensions/provider-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adapter.js","sourceRoot":"","sources":["../../src/extensions/provider-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAE5B,MAAM,4BAA4B,CAAA;AAInC;;;;GAIG;AACH,MAAM,OAAO,uBACX,SAAQ,MAAM,CAAC,KAAK,CAA0B,yBAAyB,CAAC,CAAC;IACvE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,yCAAyC,CAAC;IACxE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACvD,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAChD,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,0CAA0C,CAAC;IACvE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAC/C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,6CAA6C,CAAC;CAC7E,CAAC;CAAG;AAsBP,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,EAAE;IACvE,gBAAgB,EAAE,OAAO;CAC1B,CAAC,CAAA;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAiC,EAAyB,EAAE;IAC9F,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAE,CAAA;IAC/F,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;IAClG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,uBAAgC;QACtC,GAAG,KAAK;QACR,EAAE;QACF,QAAQ;QACR,OAAO;KACR,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,MAAsB,EACtB,QAA8C,EAC9C,QAAoC,EACpC,cAAmC,IAAI,GAAG,EAAE,EACb,EAAE;IACjC,MAAM,MAAM,GAA0B,EAAE,CAAA;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,EAAE,oBAAoB,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;YACzF,CAAC;YACD,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC5F,IAAI,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,EAAE,uDAAuD,CAAC,CAAA;YAC/G,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/host.d.ts

@@ -0,0 +1,33 @@
+import type { ReleaseRuntimeShape } from "./api/runtime.js";
+import type { ReleaseApiLayer } from "./api/types.js";
+import type { RunCommand } from "./drivers/process.js";
+import { Sha256Digest, sha256Digest } from "./model/digest.js";
+import { SafeRelativePath, WorkspaceRoot } from "./model/primitives.js";
+import type { CredentialRequest } from "./model/authority.js";
+import { CredentialAudienceMismatch, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, makeCredentialProvider, type CredentialAuthorityError, type CredentialGrant, type CredentialGrantAcquirer, type CredentialGrantDescriptor, type CredentialProviderShape, type MutationCredentialGrant } from "./publication/authority.js";
+import { type AuthorizedMutationHttpShape, type HttpAuthorizationError, type HttpAuthorizerShape, type HttpObservationRequest, type HttpResponse } from "./publication/http.js";
+import { type CertifiedPublisherSpawnShape, type NpmUserConfigResourceShape } from "./publication/publisher.js";
+import { PublicationClaimOccupied, PublicationClaimRequest, PublicationClaimUnavailable, type PublicationClaimError, type PublicationClaimStoreShape } from "./publication/claim.js";
+import { ReleaseContextError, SourceMaterializationError, StagingEntry, StagingSnapshot, VerifiedSource, makeSourceObserver, type SourceObserverRuntime, type SourceObserverShape, type VerifiedReleaseContext } from "./release/context.js";
+import { type PreparedReleaseStoreShape } from "./release/prepared-store.js";
+export { CredentialAudienceMismatch, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, PublicationClaimOccupied, PublicationClaimRequest, PublicationClaimUnavailable, ReleaseContextError, SafeRelativePath, Sha256Digest, SourceMaterializationError, StagingEntry, StagingSnapshot, VerifiedSource, WorkspaceRoot, makeCredentialProvider, makeSourceObserver, sha256Digest };
+export type { CredentialAuthorityError, CredentialGrant, CredentialGrantAcquirer, CredentialGrantDescriptor, CredentialProviderShape, CredentialRequest, HttpAuthorizationError, HttpAuthorizerShape, HttpObservationRequest, HttpResponse, AuthorizedMutationHttpShape, CertifiedPublisherSpawnShape, NpmUserConfigResourceShape, PublicationClaimError, PublicationClaimStoreShape, MutationCredentialGrant, ReleaseRuntimeShape, RunCommand, SourceObserverRuntime, SourceObserverShape, VerifiedReleaseContext };
+/** Structural inputs for a library-owned host integration. */
+export interface CustomReleaseLayerInput {
+    readonly runtime: ReleaseRuntimeShape;
+    readonly preparedStore: PreparedReleaseStoreShape;
+    readonly credentialProvider: CredentialProviderShape;
+    readonly httpAuthorizer: HttpAuthorizerShape;
+    readonly authorizedMutationHttp: AuthorizedMutationHttpShape;
+    readonly npmUserConfigResource: NpmUserConfigResourceShape;
+    readonly certifiedPublisherSpawn: CertifiedPublisherSpawnShape;
+    /** Required before a durable-cas-required publication can acquire mutation credentials. */
+    readonly publicationClaimStore?: PublicationClaimStoreShape;
+}
+/**
+ * Compose the complete API service boundary without exposing Context service
+ * tags. Credentials remain opaque grants and HTTP authorization remains a
+ * host-owned elimination boundary.
+ */
+export declare const makeCustomReleaseLayer: (input: CustomReleaseLayerInput) => ReleaseApiLayer;
+//# sourceMappingURL=host.d.ts.map

package/dist/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EACL,0BAA0B,EAE1B,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAGL,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAChC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EAEvB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAChC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACb,CAAA;AAED,YAAY,EACV,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,EACZ,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACvB,CAAA;AAED,8DAA8D;AAC9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAA;IACjD,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAA;IACpD,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,sBAAsB,EAAE,2BAA2B,CAAA;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,0BAA0B,CAAA;IAC1D,QAAQ,CAAC,uBAAuB,EAAE,4BAA4B,CAAA;IAC9D,2FAA2F;IAC3F,QAAQ,CAAC,qBAAqB,CAAC,EAAE,0BAA0B,CAAA;CAC5D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO,uBAAuB,KAC7B,eAWF,CAAA"}

package/dist/host.js

@@ -0,0 +1,20 @@
+import * as Layer from "effect/Layer";
+import { ReleaseRuntime } from "./api/runtime.js";
+import { Sha256Digest, sha256Digest } from "./model/digest.js";
+import { SafeRelativePath, WorkspaceRoot } from "./model/primitives.js";
+import { CredentialAudienceMismatch, CredentialProvider, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, makeCredentialProvider } from "./publication/authority.js";
+import { AuthorizedMutationHttp, HttpAuthorizer } from "./publication/http.js";
+import { CertifiedPublisherSpawn, NpmUserConfigResource } from "./publication/publisher.js";
+import { PublicationClaimOccupied, PublicationClaimRequest, PublicationClaimStore, PublicationClaimUnavailable } from "./publication/claim.js";
+import { ReleaseContextError, SourceMaterializationError, StagingEntry, StagingSnapshot, VerifiedSource, makeSourceObserver } from "./release/context.js";
+import { PreparedReleaseStore } from "./release/prepared-store.js";
+export { CredentialAudienceMismatch, CredentialPurposeMismatch, CredentialStrategyUnsupported, CredentialSubjectMismatch, CredentialUnavailable, PublicationClaimOccupied, PublicationClaimRequest, PublicationClaimUnavailable, ReleaseContextError, SafeRelativePath, Sha256Digest, SourceMaterializationError, StagingEntry, StagingSnapshot, VerifiedSource, WorkspaceRoot, makeCredentialProvider, makeSourceObserver, sha256Digest };
+/**
+ * Compose the complete API service boundary without exposing Context service
+ * tags. Credentials remain opaque grants and HTTP authorization remains a
+ * host-owned elimination boundary.
+ */
+export const makeCustomReleaseLayer = (input) => Layer.mergeAll(Layer.succeed(ReleaseRuntime, input.runtime), Layer.succeed(PreparedReleaseStore, input.preparedStore), Layer.succeed(CredentialProvider, input.credentialProvider), Layer.succeed(HttpAuthorizer, input.httpAuthorizer), Layer.succeed(AuthorizedMutationHttp, input.authorizedMutationHttp), Layer.succeed(NpmUserConfigResource, input.npmUserConfigResource), Layer.succeed(CertifiedPublisherSpawn, input.certifiedPublisherSpawn), ...(input.publicationClaimStore === undefined
+    ? []
+    : [Layer.succeed(PublicationClaimStore, input.publicationClaimStore)]));
+//# sourceMappingURL=host.js.map

package/dist/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEvE,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EAOvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sBAAsB,EACtB,cAAc,EAMf,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAGtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAG5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,cAAc,EACd,kBAAkB,EAInB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,oBAAoB,EAErB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,eAAe,EACf,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACb,CAAA;AAuCD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAA8B,EACb,EAAE,CAAC,KAAK,CAAC,QAAQ,CAClC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAC5C,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,EACxD,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAC3D,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACnD,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,CAAC,EACnE,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAAC,EACjE,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,CAAC,EACrE,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;IAC3C,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACzE,CAAA"}

package/dist/index.d.ts

@@ -1,2 +1,20 @@
-export {};
+declare global {
+    const SchemaErrorTypeId: unique symbol;
+}
+export { CorrectionReport, correct, inspect, makeReleaseApi, observe, prepare, publish, release } from "./api/api.js";
+export type { CorrectInput, InspectInput, InspectOutput, ObserveInput, PrepareInput, PublishInput, ReleaseApi, ReleaseApiLayer, ReleaseApiOptions, ReleaseInput, ReleaseResult } from "./api/types.js";
+export { AuthoredCatalogForwardCorrection, AuthoredGithubReleaseAmendment, AuthoredNpmDeprecation, decodeAuthoredCorrection } from "./correction/intent.js";
+export type { AuthoredCorrection } from "./correction/intent.js";
+export { PreparationModeUnsupported, ReleaseAbortedError, ReleaseIncompleteError, ReleaseInputError, ReleasePreparationError } from "./api/errors.js";
+export { CredentialStrategyUnsupported, CredentialUnavailable } from "./publication/authority.js";
+export { CredentialFailureCause, CredentialStrategyUnsupportedCause, CredentialUnavailableCause, ObservationReport, ReleaseReport } from "./publication/report.js";
+export { CompletePreparedReleaseRef, GitHubActionsCompletePreparedReleaseRef, LocalCompletePreparedReleaseRef, PreparedReleaseRefCodecError, PreparedReleaseRefMalformedError, PreparedReleaseRefUnknownSchemeError, decodeCompletePreparedReleaseRef, encodeCompletePreparedReleaseRef, makeGitHubActionsCompletePreparedReleaseRef, makeLocalCompletePreparedReleaseRef } from "./release/prepared-ref.js";
+export type { PreparedReleaseSha256 } from "./release/prepared-ref.js";
+export { ReleaseRuntime } from "./api/runtime.js";
+export { unsupportedExecutionHost } from "./platform/host-support.js";
+export { resolveConfig } from "./resolve/resolve.js";
+export type { AuthoredConfig, AuthoredProject } from "./resolve/authored.js";
+export type { ObservedFacts } from "./resolve/facts.js";
+export { encodeResolvedConfig } from "./resolve/encode.js";
+export declare const defineRelease: <const Config>(config: Config) => Config;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,CAAC;IACb,MAAM,iBAAiB,EAAE,OAAO,MAAM,CAAA;CACvC;AAED,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACR,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EACL,0BAA0B,EAAE,mBAAmB,EAAE,sBAAsB,EACvE,iBAAiB,EAAE,uBAAuB,EAC3C,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,0BAA0B,EAAE,uCAAuC,EACnE,+BAA+B,EAAE,4BAA4B,EAC7D,gCAAgC,EAAE,oCAAoC,EACtE,gCAAgC,EAAE,gCAAgC,EAClE,2CAA2C,EAAE,mCAAmC,EACjF,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,eAAO,MAAM,aAAa,GAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,MAAM,KAAG,MAAgB,CAAA"}

package/dist/index.js

@@ -1,2 +1,13 @@
-export {};
+// The root is the intentionally small public lifecycle surface.
+export { CorrectionReport, correct, inspect, makeReleaseApi, observe, prepare, publish, release } from "./api/api.js";
+export { AuthoredCatalogForwardCorrection, AuthoredGithubReleaseAmendment, AuthoredNpmDeprecation, decodeAuthoredCorrection } from "./correction/intent.js";
+export { PreparationModeUnsupported, ReleaseAbortedError, ReleaseIncompleteError, ReleaseInputError, ReleasePreparationError } from "./api/errors.js";
+export { CredentialStrategyUnsupported, CredentialUnavailable } from "./publication/authority.js";
+export { CredentialFailureCause, CredentialStrategyUnsupportedCause, CredentialUnavailableCause, ObservationReport, ReleaseReport } from "./publication/report.js";
+export { CompletePreparedReleaseRef, GitHubActionsCompletePreparedReleaseRef, LocalCompletePreparedReleaseRef, PreparedReleaseRefCodecError, PreparedReleaseRefMalformedError, PreparedReleaseRefUnknownSchemeError, decodeCompletePreparedReleaseRef, encodeCompletePreparedReleaseRef, makeGitHubActionsCompletePreparedReleaseRef, makeLocalCompletePreparedReleaseRef } from "./release/prepared-ref.js";
+export { ReleaseRuntime } from "./api/runtime.js";
+export { unsupportedExecutionHost } from "./platform/host-support.js";
+export { resolveConfig } from "./resolve/resolve.js";
+export { encodeResolvedConfig } from "./resolve/encode.js";
+export const defineRelease = (config) => config;
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,gEAAgE;AAChE,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,cAAc,EACd,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACR,MAAM,cAAc,CAAA;AAcrB,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,0BAA0B,EAAE,mBAAmB,EAAE,sBAAsB,EACvE,iBAAiB,EAAE,uBAAuB,EAC3C,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,0BAA0B,EAAE,uCAAuC,EACnE,+BAA+B,EAAE,4BAA4B,EAC7D,gCAAgC,EAAE,oCAAoC,EACtE,gCAAgC,EAAE,gCAAgC,EAClE,2CAA2C,EAAE,mCAAmC,EACjF,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAe,MAAc,EAAU,EAAE,CAAC,MAAM,CAAA"}