@mannyc1/ts-release 0.0.7 → 0.3.0

package/dist/publication/adapter.d.ts

@@ -0,0 +1,212 @@
+import * as Effect from "effect/Effect";
+import type { PreparedBundle } from "../release/prepared-store.js";
+import { type ReleaseSubject } from "./coordinator.js";
+import { AuthorizedMutationHttp, HttpAuthorizer } from "./http.js";
+import { CertifiedPublisherSpawn, NpmUserConfigResource } from "./publisher.js";
+import { type CustomProviderAdapter } from "../extensions/provider-adapter.js";
+export { installedPublicationProfiles } from "./profiles.js";
+/**
+ * Construct provider subjects only after the caller has loaded and verified
+ * the complete prepared bundle. The host authorizer is captured as an opaque
+ * sink; transports and credential values never enter the subject contract.
+ */
+export declare const subjectsForPreparedRelease: (bundle: PreparedBundle, adapters?: readonly CustomProviderAdapter[] | undefined) => Effect.Effect<readonly ReleaseSubject[], never, AuthorizedMutationHttp | HttpAuthorizer | NpmUserConfigResource | CertifiedPublisherSpawn>;
+/** Remote, read-only observation through the same provider subjects as publish. */
+export declare const observePreparedRelease: (bundle: PreparedBundle, adapters?: readonly CustomProviderAdapter[] | undefined) => Effect.Effect<{
+    readonly subjects: readonly [import("./report.js").ObservedSubject, ...import("./report.js").ObservedSubject[]];
+    readonly status: "equivalent" | "different" | "inconclusive";
+}, import("./coordinator.js").ReleaseCoordinatorConstructionError, import("./authority.js").CredentialProvider | AuthorizedMutationHttp | HttpAuthorizer | NpmUserConfigResource | CertifiedPublisherSpawn>;
+/** Dependency-ordered conservative publication through the shared coordinator. */
+export declare const publishPreparedRelease: (bundle: PreparedBundle, adapters?: readonly CustomProviderAdapter[] | undefined) => Effect.Effect<{
+    readonly subjects: readonly [{
+        readonly _tag: "NotReached";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly reason: import("./report.js").DependencyBlocked | import("./report.js").RunAborted;
+    } | {
+        readonly _tag: "AlreadyEquivalent";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly observationAuthorities: readonly {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        }[];
+        readonly observations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+    } | {
+        readonly _tag: "ConvergedAfterMutation";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly observationAuthorities: readonly {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        }[];
+        readonly preObservations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+        readonly decision: import("./report.js").NeedsMutation | import("./report.js").ProviderAuthorizedCreate;
+        readonly authority: {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        };
+        readonly attempt: import("./report.js").RejectedByProvider | import("./report.js").Applied | import("./report.js").OutcomeUnknown;
+        readonly postObservations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+    } | {
+        readonly _tag: "BlockedSubject";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly observationAuthorities: readonly {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        }[];
+        readonly observations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+        readonly cause: import("./report.js").Conflict | import("./report.js").ProviderBlocked | import("./report.js").RejectedBeforeDispatch | {
+            readonly _tag: "AuthorityAcquiredButMutationNotDispatched";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly authority: {
+                readonly _tag: "AuthorityAcquired";
+                readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+                readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+                readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+                readonly requestedPurpose: "observe" | "publish" | "correct";
+                readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+                readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+            };
+            readonly attempt: import("./report.js").RejectedBeforeDispatch;
+        } | import("./report.js").ConclusiveProviderRejection;
+    } | {
+        readonly _tag: "UncertainSubject";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly observationAuthorities: readonly {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        }[];
+        readonly observations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+        readonly authority: {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        };
+        readonly attempt: import("./report.js").Started | import("./report.js").RejectedByProvider | import("./report.js").Applied | import("./report.js").OutcomeUnknown;
+        readonly trace: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+        readonly decision?: import("./report.js").NeedsMutation | import("./report.js").ProviderAuthorizedCreate | import("./report.js").ProviderAlreadyEquivalent | import("./report.js").Conflict | import("./report.js").ProviderBlocked;
+    }, ...({
+        readonly _tag: "NotReached";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly reason: import("./report.js").DependencyBlocked | import("./report.js").RunAborted;
+    } | {
+        readonly _tag: "AlreadyEquivalent";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly observationAuthorities: readonly {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        }[];
+        readonly observations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+    } | {
+        readonly _tag: "ConvergedAfterMutation";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly observationAuthorities: readonly {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        }[];
+        readonly preObservations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+        readonly decision: import("./report.js").NeedsMutation | import("./report.js").ProviderAuthorizedCreate;
+        readonly authority: {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        };
+        readonly attempt: import("./report.js").RejectedByProvider | import("./report.js").Applied | import("./report.js").OutcomeUnknown;
+        readonly postObservations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+    } | {
+        readonly _tag: "BlockedSubject";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly observationAuthorities: readonly {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        }[];
+        readonly observations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+        readonly cause: import("./report.js").Conflict | import("./report.js").ProviderBlocked | import("./report.js").RejectedBeforeDispatch | {
+            readonly _tag: "AuthorityAcquiredButMutationNotDispatched";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly authority: {
+                readonly _tag: "AuthorityAcquired";
+                readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+                readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+                readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+                readonly requestedPurpose: "observe" | "publish" | "correct";
+                readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+                readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+            };
+            readonly attempt: import("./report.js").RejectedBeforeDispatch;
+        } | import("./report.js").ConclusiveProviderRejection;
+    } | {
+        readonly _tag: "UncertainSubject";
+        readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+        readonly observationAuthorities: readonly {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        }[];
+        readonly observations: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+        readonly authority: {
+            readonly _tag: "AuthorityAcquired";
+            readonly subject: string & import("effect/Brand").Brand<"SubjectId">;
+            readonly provider: string & import("effect/Brand").Brand<"ProviderId">;
+            readonly audience: string & import("effect/Brand").Brand<"CanonicalAudience">;
+            readonly requestedPurpose: "observe" | "publish" | "correct";
+            readonly grantKind: "AnonymousAccess" | "ScopedSecret" | "WorkloadIdentity";
+            readonly purposes: readonly ["observe" | "publish" | "correct", ...("observe" | "publish" | "correct")[]];
+        };
+        readonly attempt: import("./report.js").Started | import("./report.js").RejectedByProvider | import("./report.js").Applied | import("./report.js").OutcomeUnknown;
+        readonly trace: readonly [import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation, ...(import("./report.js").PresentEquivalent | import("./report.js").PresentDifferent | import("./report.js").AuthoritativelyAbsent | import("./report.js").VisibilityPending | import("./report.js").InconclusiveObservation)[]];
+        readonly decision?: import("./report.js").NeedsMutation | import("./report.js").ProviderAuthorizedCreate | import("./report.js").ProviderAlreadyEquivalent | import("./report.js").Conflict | import("./report.js").ProviderBlocked;
+    })[]];
+    readonly status: "complete" | "blocked" | "uncertain";
+}, import("./coordinator.js").ReleaseCoordinatorConstructionError, import("./authority.js").CredentialProvider | AuthorizedMutationHttp | HttpAuthorizer | NpmUserConfigResource | CertifiedPublisherSpawn>;
+//# sourceMappingURL=adapter.d.ts.map

package/dist/publication/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/publication/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAUvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAElE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAClE,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,gBAAgB,CAAA;AASvB,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAA;AAkB5D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,iOA2DrC,CAAA;AAEF,mFAAmF;AACnF,eAAO,MAAM,sBAAsB;;;2MAMjC,CAAA;AAEF,kFAAkF;AAClF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2MAMjC,CAAA"}

package/dist/publication/adapter.js

@@ -0,0 +1,83 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { SubjectId } from "../model/authority.js";
+import { githubPublicationCapability, catalogPublicationCapability, npmPublicationCapability, pyPiPublicationCapability } from "../capabilities/registry.js";
+import { encodePreparedRelease } from "../release/prepared.js";
+import { sha256 } from "../drivers/utils.js";
+import { observeReleaseSubjects, publishReleaseSubjects } from "./coordinator.js";
+import { AuthorizedMutationHttp, HttpAuthorizer } from "./http.js";
+import { CertifiedPublisherSpawn, NpmUserConfigResource } from "./publisher.js";
+import { validateRecoveryProfileSubjects } from "./recovery.js";
+import { PublicationClaimStore, unavailablePublicationClaimStore } from "./claim.js";
+import { customProviderSubjects } from "../extensions/provider-adapter.js";
+export { installedPublicationProfiles } from "./profiles.js";
+const registerSubjects = (registration, subjects) => {
+    validateRecoveryProfileSubjects(registration.id, registration.recovery, subjects.map((subject) => subject.recovery));
+    return subjects;
+};
+const preparedSubject = (bundle) => SubjectId.make(`prepared:sha256-${sha256(encodePreparedRelease(bundle.manifest))}`);
+/**
+ * Construct provider subjects only after the caller has loaded and verified
+ * the complete prepared bundle. The host authorizer is captured as an opaque
+ * sink; transports and credential values never enter the subject contract.
+ */
+export const subjectsForPreparedRelease = Effect.fn("subjectsForPreparedRelease")(function* (bundle, adapters = []) {
+    const http = yield* HttpAuthorizer;
+    const mutationHttp = yield* AuthorizedMutationHttp;
+    const userConfigs = yield* NpmUserConfigResource;
+    const publisher = yield* CertifiedPublisherSpawn;
+    const claimOption = yield* Effect.serviceOption(PublicationClaimStore);
+    const claims = Option.getOrElse(claimOption, () => unavailablePublicationClaimStore);
+    const subjects = [];
+    const priorPublicationSubjects = [];
+    const services = { http, mutationHttp, userConfigs, publisher, claims };
+    for (const publication of bundle.manifest.publications) {
+        const moduleSubjects = publication._tag === "PreparedNpmPublication"
+            ? npmPublicationCapability.subjects(bundle, publication, services)
+            : publication._tag === "PreparedPyPiPublication"
+                ? pyPiPublicationCapability.subjects(bundle, publication, services)
+                : publication._tag === "PreparedGitHubPublication"
+                    ? githubPublicationCapability.subjects(bundle, publication, services)
+                    : catalogPublicationCapability.subjects(bundle, publication, services);
+        const registered = registerSubjects(publication._tag === "PreparedNpmPublication"
+            ? npmPublicationCapability.profile
+            : publication._tag === "PreparedPyPiPublication"
+                ? pyPiPublicationCapability.profile
+                : publication._tag === "PreparedGitHubPublication"
+                    ? githubPublicationCapability.profile
+                    : catalogPublicationCapability.profile, moduleSubjects);
+        const ordered = registered.map((subject) => priorPublicationSubjects.length === 0
+            ? subject
+            : {
+                ...subject,
+                prerequisites: [...new Set([
+                        ...(subject.prerequisites ?? []),
+                        ...priorPublicationSubjects
+                    ])]
+            });
+        subjects.push(...ordered);
+        priorPublicationSubjects.push(...registered.map((subject) => subject.id));
+    }
+    const custom = customProviderSubjects(bundle, adapters, services, new Set([preparedSubject(bundle).toString(), ...priorPublicationSubjects.map((id) => id.toString())])).map((subject) => priorPublicationSubjects.length === 0
+        ? subject
+        : {
+            ...subject,
+            prerequisites: [...new Set([
+                    ...(subject.prerequisites ?? []),
+                    ...priorPublicationSubjects
+                ])]
+        });
+    subjects.push(...custom);
+    return subjects;
+});
+/** Remote, read-only observation through the same provider subjects as publish. */
+export const observePreparedRelease = Effect.fn("observePreparedRelease")(function* (bundle, adapters = []) {
+    const subjects = yield* subjectsForPreparedRelease(bundle, adapters);
+    return yield* observeReleaseSubjects({ prepared: preparedSubject(bundle), subjects });
+});
+/** Dependency-ordered conservative publication through the shared coordinator. */
+export const publishPreparedRelease = Effect.fn("publishPreparedRelease")(function* (bundle, adapters = []) {
+    const subjects = yield* subjectsForPreparedRelease(bundle, adapters);
+    return yield* publishReleaseSubjects({ prepared: preparedSubject(bundle), subjects });
+});
+//# sourceMappingURL=adapter.js.map

package/dist/publication/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/publication/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAClE,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,+BAA+B,EAEhC,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EACjC,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,sBAAsB,EAA8B,MAAM,mCAAmC,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAA;AAE5D,MAAM,gBAAgB,GAAG,CACvB,YAA4C,EAC5C,QAAuC,EACR,EAAE;IACjC,+BAA+B,CAC7B,YAAY,CAAC,EAAE,EACf,YAAY,CAAC,QAAQ,EACrB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAC5C,CAAA;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,MAAsB,EAAa,EAAE,CAAC,SAAS,CAAC,IAAI,CAC3E,mBAAmB,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CACpE,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EACzF,MAAsB,EACtB,WAAiD,EAAE;IAEnD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAA;IAClC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAA;IAClD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAA;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAA;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAA;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,gCAAgC,CAAC,CAAA;IACpF,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,MAAM,wBAAwB,GAAqB,EAAE,CAAA;IACrD,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IACvE,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,KAAK,wBAAwB;YAClE,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YAClE,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,yBAAyB;gBAChD,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;gBACnE,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,2BAA2B;oBAClD,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;oBACrE,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QACxE,MAAM,UAAU,GAAG,gBAAgB,CACjC,WAAW,CAAC,IAAI,KAAK,wBAAwB;YAC3C,CAAC,CAAC,wBAAwB,CAAC,OAAO;YAClC,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,yBAAyB;gBAChD,CAAC,CAAC,yBAAyB,CAAC,OAAO;gBACnC,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,2BAA2B;oBAClD,CAAC,CAAC,2BAA2B,CAAC,OAAO;oBACrC,CAAC,CAAC,4BAA4B,CAAC,OAAO,EACxC,cAAc,CACf,CAAA;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAkB,EAAE,CAAC,wBAAwB,CAAC,MAAM,KAAK,CAAC;YAC/F,CAAC,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,GAAG,OAAO;gBACV,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC;wBACzB,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;wBAChC,GAAG,wBAAwB;qBAC5B,CAAC,CAAC;aACJ,CAAC,CAAA;QACN,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;QACzB,wBAAwB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CACnC,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CACtG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAkB,EAAE,CAAC,wBAAwB,CAAC,MAAM,KAAK,CAAC;QACtE,CAAC,CAAC,OAAO;QACT,CAAC,CAAC;YACE,GAAG,OAAO;YACV,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC;oBACzB,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;oBAChC,GAAG,wBAAwB;iBAC5B,CAAC,CAAC;SACJ,CAAC,CAAA;IACN,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;IACxB,OAAO,QAAyC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EACjF,MAAsB,EACtB,WAAiD,EAAE;IAEnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACvF,CAAC,CAAC,CAAA;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EACjF,MAAsB,EACtB,WAAiD,EAAE;IAEnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACvF,CAAC,CAAC,CAAA"}

package/dist/publication/authority.d.ts

@@ -0,0 +1,137 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import type { CanonicalAudience, CredentialPurpose, CredentialRef, CredentialRequest, EnvironmentName, ProviderId, SubjectId, ResolvedTrustedPublishingAuthStrategy } from "../model/authority.js";
+import type { MutationDecision } from "./report.js";
+declare const CredentialGrantTypeId: unique symbol;
+interface CredentialGrantBase<Tag extends string> {
+    readonly [CredentialGrantTypeId]: Tag;
+    readonly _tag: Tag;
+    readonly subject: SubjectId;
+    readonly provider: ProviderId;
+    readonly audience: CanonicalAudience;
+    readonly purposes: ReadonlySet<CredentialPurpose>;
+}
+/** Observe-only capability. It carries no credential or credential accessor. */
+export interface AnonymousAccess extends CredentialGrantBase<"AnonymousAccess"> {
+}
+/** Capability backed by a host-owned credential reference, never its value. */
+export interface ScopedSecret extends CredentialGrantBase<"ScopedSecret"> {
+    readonly ref: CredentialRef;
+}
+/** Certified workload identity names; token material remains host-owned. */
+export interface WorkloadIdentity extends CredentialGrantBase<"WorkloadIdentity"> {
+    readonly names: ReadonlySet<EnvironmentName>;
+    /** Exact non-secret prepared strategy rechecked by the certified sink. */
+    readonly strategy: ResolvedTrustedPublishingAuthStrategy;
+}
+export type CredentialGrant = AnonymousAccess | ScopedSecret | WorkloadIdentity;
+export type MutationCredentialGrant = ScopedSecret | WorkloadIdentity;
+export type NonEmptyPurposes = readonly [CredentialPurpose, ...Array<CredentialPurpose>];
+export type NonEmptyEnvironmentNames = readonly [EnvironmentName, ...Array<EnvironmentName>];
+/**
+ * Metadata returned by a host acquirer. Secret values never cross this seam.
+ * `makeCredentialProvider` validates it against the exact prepared request
+ * before privately minting an opaque grant.
+ */
+export type CredentialGrantDescriptor = {
+    readonly _tag: "AnonymousAccess";
+    readonly purposes: readonly ["observe"];
+} | {
+    readonly _tag: "ScopedSecret";
+    readonly purposes: NonEmptyPurposes;
+    readonly ref: CredentialRef;
+} | {
+    readonly _tag: "WorkloadIdentity";
+    readonly purposes: NonEmptyPurposes;
+    readonly names: NonEmptyEnvironmentNames;
+};
+declare const CredentialUnavailable_base: Schema.Class<CredentialUnavailable, Schema.TaggedStruct<"CredentialUnavailable", {
+    readonly subject: Schema.String;
+    readonly provider: Schema.String;
+    readonly purpose: Schema.String;
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class CredentialUnavailable extends CredentialUnavailable_base {
+}
+declare const CredentialAudienceMismatch_base: Schema.Class<CredentialAudienceMismatch, Schema.TaggedStruct<"CredentialAudienceMismatch", {
+    readonly subject: Schema.String;
+    readonly expected: Schema.String;
+    readonly observed: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class CredentialAudienceMismatch extends CredentialAudienceMismatch_base {
+}
+declare const CredentialPurposeMismatch_base: Schema.Class<CredentialPurposeMismatch, Schema.TaggedStruct<"CredentialPurposeMismatch", {
+    readonly subject: Schema.String;
+    readonly required: Schema.String;
+    readonly granted: Schema.$Array<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+export declare class CredentialPurposeMismatch extends CredentialPurposeMismatch_base {
+}
+declare const CredentialStrategyUnsupported_base: Schema.Class<CredentialStrategyUnsupported, Schema.TaggedStruct<"CredentialStrategyUnsupported", {
+    readonly subject: Schema.String;
+    readonly provider: Schema.String;
+    readonly strategy: Schema.String;
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class CredentialStrategyUnsupported extends CredentialStrategyUnsupported_base {
+}
+declare const CredentialSubjectMismatch_base: Schema.Class<CredentialSubjectMismatch, Schema.TaggedStruct<"CredentialSubjectMismatch", {
+    readonly expected: Schema.String;
+    readonly observed: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class CredentialSubjectMismatch extends CredentialSubjectMismatch_base {
+}
+declare const PublisherDispatchError_base: Schema.Class<PublisherDispatchError, Schema.TaggedStruct<"PublisherDispatchError", {
+    readonly subject: Schema.String;
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class PublisherDispatchError extends PublisherDispatchError_base {
+}
+export type CredentialAuthorityError = CredentialUnavailable | CredentialAudienceMismatch | CredentialPurposeMismatch | CredentialStrategyUnsupported | CredentialSubjectMismatch;
+export interface CredentialGrantAcquirer {
+    readonly acquire: (request: CredentialRequest) => Effect.Effect<CredentialGrantDescriptor, CredentialUnavailable | CredentialStrategyUnsupported>;
+}
+export interface CredentialProviderShape {
+    readonly acquireForObservation: (request: CredentialRequest) => Effect.Effect<CredentialGrant, CredentialAuthorityError>;
+    readonly acquireForMutation: (request: CredentialRequest, decision: MutationDecision) => Effect.Effect<MutationCredentialGrant, CredentialAuthorityError>;
+}
+declare const CredentialProvider_base: Context.ServiceClass<CredentialProvider, "ts-release/CredentialProvider", CredentialProviderShape>;
+export declare class CredentialProvider extends CredentialProvider_base {
+}
+/** Builds a host-friendly provider without exposing a grant constructor. */
+export declare const makeCredentialProvider: (host: CredentialGrantAcquirer) => CredentialProviderShape;
+export type PublisherOperation = {
+    readonly _tag: "PublishOperation";
+    readonly subject: SubjectId;
+    readonly provider: ProviderId;
+    readonly audience: CanonicalAudience;
+    readonly purpose: "publish";
+    readonly decision: MutationDecision;
+} | {
+    readonly _tag: "CorrectionOperation";
+    readonly subject: SubjectId;
+    readonly provider: ProviderId;
+    readonly audience: CanonicalAudience;
+    readonly purpose: "correct";
+    readonly decision: MutationDecision;
+};
+/**
+ * The publisher is a host-owned elimination boundary. Provider adapters pass
+ * only typed operation data and a capability; no generic command accepts one.
+ */
+export interface PublisherSinkShape {
+    readonly dispatch: (operation: PublisherOperation, grant: MutationCredentialGrant) => Effect.Effect<void, CredentialAuthorityError | PublisherDispatchError>;
+}
+declare const PublisherSink_base: Context.ServiceClass<PublisherSink, "ts-release/PublisherSink", PublisherSinkShape>;
+export declare class PublisherSink extends PublisherSink_base {
+}
+/** Shared sink-side recheck. It trusts private issuance metadata, not fields. */
+export declare const validateGrantForOperation: (operation: PublisherOperation, grant: MutationCredentialGrant) => Effect.Effect<undefined, CredentialUnavailable | CredentialAudienceMismatch | CredentialPurposeMismatch | CredentialSubjectMismatch, never>;
+export interface PublisherDispatcher {
+    readonly dispatch: (operation: PublisherOperation, grant: MutationCredentialGrant) => Effect.Effect<void, PublisherDispatchError>;
+}
+/** Wraps a host dispatcher so every mutation rechecks opaque authority first. */
+export declare const makePublisherSink: (host: PublisherDispatcher) => PublisherSinkShape;
+export {};
+//# sourceMappingURL=authority.d.ts.map

package/dist/publication/authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../src/publication/authority.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,SAAS,EACT,qCAAqC,EACtC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,QAAA,MAAM,qBAAqB,EAAE,OAAO,MAA6C,CAAA;AAEjF,UAAU,mBAAmB,CAAC,GAAG,SAAS,MAAM;IAC9C,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,GAAG,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;IAClB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAA;CAClD;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAgB,SAAQ,mBAAmB,CAAC,iBAAiB,CAAC;CAAG;AAElF,+EAA+E;AAC/E,MAAM,WAAW,YAAa,SAAQ,mBAAmB,CAAC,cAAc,CAAC;IACvE,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;CAC5B;AAED,4EAA4E;AAC5E,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB,CAAC,kBAAkB,CAAC;IAC/E,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC,CAAA;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,qCAAqC,CAAA;CACzD;AAED,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,YAAY,GAAG,gBAAgB,CAAA;AAC/E,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG,gBAAgB,CAAA;AAErE,MAAM,MAAM,gBAAgB,GAAG,SAAS,CAAC,iBAAiB,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;AACxF,MAAM,MAAM,wBAAwB,GAAG,SAAS,CAAC,eAAe,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAA;AAE5F;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;CAAE,GACnG;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;CAAE,CAAA;;;;;;;AAExH,qBAAa,qBACX,SAAQ,0BAKN;CAAG;;;;;;AAEP,qBAAa,0BACX,SAAQ,+BAIN;CAAG;;;;;;AAEP,qBAAa,yBACX,SAAQ,8BAIN;CAAG;;;;;;;AAEP,qBAAa,6BACX,SAAQ,kCAKN;CAAG;;;;;AAEP,qBAAa,yBACX,SAAQ,8BAGN;CAAG;;;;;AAEP,qBAAa,sBACX,SAAQ,2BAGN;CAAG;AAEP,MAAM,MAAM,wBAAwB,GAChC,qBAAqB,GACrB,0BAA0B,GAC1B,yBAAyB,GACzB,6BAA6B,GAC7B,yBAAyB,CAAA;AAE7B,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,CAChB,OAAO,EAAE,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,qBAAqB,GAAG,6BAA6B,CAAC,CAAA;CACrG;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,OAAO,EAAE,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAA;IAC7D,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,gBAAgB,KACvB,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,wBAAwB,CAAC,CAAA;CACtE;;AAED,qBAAa,kBACX,SAAQ,uBAEP;CAAG;AA6IN,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,GAAI,MAAM,uBAAuB,KAAG,uBAsCtE,CAAA;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACA,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CACpC,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CACpC,CAAA;AAEH;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,CACjB,SAAS,EAAE,kBAAkB,EAC7B,KAAK,EAAE,uBAAuB,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,sBAAsB,CAAC,CAAA;CAC5E;;AAED,qBAAa,aACX,SAAQ,kBAEP;CAAG;AAEN,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,gNAuCpC,CAAA;AAEF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,CACjB,SAAS,EAAE,kBAAkB,EAC7B,KAAK,EAAE,uBAAuB,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;CACjD;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,GAAI,MAAM,mBAAmB,KAAG,kBAK5D,CAAA"}