@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/services/release.rpc-service.js

@@ -0,0 +1,395 @@
+/**
+ * Release RPC Service — what the console can ask about releases.
+ *
+ * Master-only, like the builds themselves: a release is built from two
+ * checkouts, and only the master has both. A slave exposes nothing here
+ * rather than exposing methods that would refuse.
+ *
+ * The split of roles follows what each call DOES. Reading what was built is
+ * a viewer's business; starting or stopping a fifteen-minute build that will
+ * be deployed is an operator's; deleting one is an administrator's, because
+ * it is the only call that destroys evidence.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Service, Public } from '@omnitron-dev/titan/decorators';
+import { buildEnv, missingTools } from '../release/build-run.js';
+import { ADMIN_ROLES, OPERATOR_ROLES, VIEWER_ROLES } from '../shared/roles.js';
+/** The most builds or rows one call may ask for. */
+const MAX_DEPLOYMENTS = 200;
+let ReleaseRpcService = class ReleaseRpcService {
+    releases;
+    audit;
+    projects;
+    constructor(releases, audit, 
+    /** The transport to a stack's node, for attestations run there. */
+    projects) {
+        this.releases = releases;
+        this.audit = audit;
+        this.projects = projects;
+    }
+    /**
+     * Whether this master can build at all, before anyone presses Build.
+     *
+     * A daemon started by launchd has the system PATH, and `pnpm` is not on
+     * it. Answering that here turns a fifteen-minute failure into a disabled
+     * button with a reason on it.
+     */
+    async preflight() {
+        // The PATH a build would actually run with, not the daemon's own: the
+        // two differ, and answering from the daemon's would disable the button
+        // over a tool the build would have found.
+        const env = buildEnv(process.env);
+        const missing = missingTools(env);
+        const os = await import('node:os');
+        return {
+            root: this.releases.root(),
+            canBuild: missing.length === 0,
+            missingTools: missing,
+            path: (env['PATH'] ?? '').split(':').filter(Boolean),
+            // Read BEFORE anyone presses Build. Tonight three builds of one commit
+            // went red three different ways on a machine at load 38-56 on 16 cores,
+            // and each cost a quarter of an hour to find out. The console shows
+            // this beside the button; it refuses nothing — the operator may know
+            // the load is about to drop.
+            load: os.loadavg(),
+            cpus: os.cpus().length,
+        };
+    }
+    async list() {
+        return { releases: this.releases.list(), root: this.releases.root() };
+    }
+    async get(data) {
+        return this.releases.get(data.id);
+    }
+    /**
+     * The tail of one of a build's logs.
+     *
+     * Operator, not viewer: these are the raw outputs of installs and gates,
+     * and a project's test output is not something a read-only console account
+     * is given by default.
+     */
+    async getLog(data) {
+        return this.releases.log(data.id, data.name, data.lines);
+    }
+    async builds() {
+        return this.releases.builds();
+    }
+    async getBuild(data) {
+        return this.releases.build(data.buildId);
+    }
+    /**
+     * Start a build. Returns as soon as it has started, with the id to watch.
+     *
+     * `env` carries what the gates need and the daemon does not have — daos's
+     * want `TEST_DATABASE__PORT`. The names are checked and the values never
+     * recorded: the audit row keeps the keys, which is what an operator needs
+     * to see when a gate fails for want of one.
+     */
+    async build(data) {
+        if (!data?.project || typeof data.project !== 'string')
+            throw new Error('A build needs a project name');
+        const { currentActor } = await import('./audit.service.js');
+        const actor = currentActor();
+        const record = this.releases.start(data, actor.actorId);
+        await this.audit?.record({
+            action: 'release.build',
+            resourceType: 'release',
+            resourceId: record.buildId,
+            details: {
+                project: data.project,
+                ...(data.projectCommit ? { projectCommit: data.projectCommit } : {}),
+                ...(data.omniCommit ? { omniCommit: data.omniCommit } : {}),
+                ...(data.forStack ? { forStack: data.forStack } : {}),
+                ...(data.skipGates ? { skipGates: true } : {}),
+                envKeys: Object.keys(data.env ?? {}).sort().join(',') || '(none)',
+            },
+        });
+        return record;
+    }
+    async stopBuild(data) {
+        const record = this.releases.stop(data.buildId);
+        await this.audit?.record({
+            action: 'release.stop',
+            resourceType: 'release',
+            resourceId: data.buildId,
+            details: { project: record.request.project, release: record.releaseId ?? '(not yet named)', percent: record.percent },
+        });
+        return record;
+    }
+    /**
+     * Remove all but the newest `keep`, and never a release a stack runs.
+     *
+     * `apply` is what deletes; without it this answers what WOULD go, which is
+     * what the console shows before asking.
+     *
+     * Which releases the stacks run is decided HERE, from this daemon's own
+     * audit trail (`deploymentProtection`). It used to be whatever the caller
+     * sent as `protect`: the console built that list from `deployments()`,
+     * which answers `[]` on a daemon with no audit trail — so the console sent
+     * `protect: []` and its second click removed the release a stack was
+     * running; a direct call with admin rights and no `protect` did the same.
+     * `protect` from the caller now only ADDS to the daemon's list. When the
+     * daemon cannot know — no trail, or a stack that took a release whose name
+     * was not recorded — `apply` is refused unless the caller says, with
+     * `allowUnprotected`, that it accepts removing without knowing.
+     */
+    async prune(data) {
+        const known = await this.deploymentProtection();
+        if (data?.apply && known.unknown && data.allowUnprotected !== true) {
+            throw new Error(`Refusing to remove releases: ${known.unknown}. Pass allowUnprotected to remove them without knowing which a stack runs.`);
+        }
+        const protect = [...new Set([...known.protect, ...(data?.protect ?? [])])];
+        const result = this.releases.prune({
+            ...(data?.keep !== undefined ? { keep: data.keep } : {}),
+            ...(data?.apply ? { apply: true } : {}),
+            protect,
+        });
+        if (data?.apply && result.removed.length > 0) {
+            await this.audit?.record({
+                action: 'release.prune',
+                resourceType: 'release',
+                resourceId: null,
+                details: { removed: result.removed.join(','), kept: result.kept, megabytes: Math.round(result.freedBytes / 1024 / 1024) },
+            });
+        }
+        return { ...result, protectedByDeployment: known.protect, unknown: known.unknown };
+    }
+    /**
+     * The releases the stacks run, by this daemon's own trail — and, when it
+     * cannot say, why not.
+     */
+    async deploymentProtection() {
+        if (!this.audit?.available) {
+            return { protect: [], unknown: 'this daemon has no audit trail, so it cannot say which releases the stacks run' };
+        }
+        const protect = [];
+        const unnamed = [];
+        for (const d of await this.deployments()) {
+            if (d.release)
+                protect.push(d.release);
+            else if (d.releaseUnnamed)
+                unnamed.push(`${d.project}/${d.stack}`);
+        }
+        return {
+            protect,
+            unknown: unnamed.length > 0 ? `${unnamed.join(', ')} took a release whose name was not recorded` : null,
+        };
+    }
+    /**
+     * Take an attestation a stack produced about this release.
+     *
+     * The caller hands over what the producer printed, whole; this side
+     * decides whether to keep it (`release/attest.ts`), and refuses in four
+     * named ways. The one refusal that needs this layer is freshness: «older
+     * than the deployment it claims to be about» can only be checked against
+     * the audit trail, which is here and not in the file that does the rest.
+     */
+    async attest(data) {
+        if (!data?.release || !data?.stack || typeof data.stdout !== 'string') {
+            throw new Error('An attestation needs a release, a stack, and what the producer printed');
+        }
+        const { storeAttestation } = await import('../release/attest.js');
+        const deployedAt = await this.lastDeployedAt(data.release, data.stack);
+        const stored = await storeAttestation(data.release, data.stack, data.stdout, {
+            ...(deployedAt ? { deployedAt } : {}),
+        });
+        const passed = stored.attestation.gates.filter((g) => g.status === 'passed').length;
+        await this.audit?.record({
+            action: 'release.attest',
+            resourceType: 'release',
+            resourceId: data.release,
+            details: {
+                stack: data.stack,
+                probes: stored.attestation.gates.length,
+                passed,
+                at: stored.attestation.at,
+                onNode: stored.attestation.onNode.matched === null ? 'unconfirmed' : String(stored.attestation.onNode.matched),
+            },
+        });
+        return {
+            path: stored.path,
+            gates: stored.attestation.gates.length,
+            passed,
+            ...(stored.attestation.cleanup ? { cleanup: stored.attestation.cleanup } : {}),
+            ...(stored.attestation.legalTextsUnread ? { legalTextsUnread: stored.attestation.legalTextsUnread } : {}),
+        };
+    }
+    /**
+     * Run this release's probes on the node of the stack carrying it, and keep
+     * the result if it is one to keep.
+     *
+     * Exit 0 and exit 1 are both stored — a probe that refused is a fact about
+     * the release on that stack, and dropping it would let the next run look
+     * like the first. Exit 2 is the producer failing to measure anything, and
+     * its own words are the refusal. The four refusals of the door itself
+     * (`release/attest.ts`) apply on top, freshness included.
+     *
+     * Long by nature — an upload and a probe suite over SSH — and the console
+     * reaches the daemon through a gateway that cuts a request at 120 s, so the
+     * console calls this with a deadline and says so while it waits.
+     */
+    async attestOnNode(data) {
+        if (!data?.release || !data?.stack)
+            throw new Error('An attestation needs a release and a stack');
+        if (!this.projects)
+            throw new Error('This daemon has no project service to reach a node with');
+        const { projectOfId } = await import('../release/store.js');
+        const { interpretRun } = await import('../release/attest-on-node.js');
+        const run = await this.projects.attestOnNode(projectOfId(data.release), data.stack, data.release);
+        const verdict = interpretRun(run);
+        if (!verdict.keep)
+            throw new Error(`Nothing stored for ${data.release} on ${data.stack} (${run.node}): ${verdict.because}`);
+        const stored = await this.attest({ release: data.release, stack: data.stack, stdout: verdict.stdout });
+        return { ...stored, node: run.node, scriptsFrom: run.scriptsFrom, sourceFiles: run.sourceFiles, accounts: run.accounts };
+    }
+    /** When this stack last took this exact release, from the trail. */
+    async lastDeployedAt(release, stack) {
+        if (!this.audit)
+            return null;
+        const rows = await this.audit.list({ action: 'stack.start', limit: MAX_DEPLOYMENTS });
+        for (const row of rows) {
+            if (!row.resourceId?.endsWith(`/${stack}`))
+                continue;
+            if ((row.details ?? {})['release'] !== release)
+                continue;
+            return row.createdAt;
+        }
+        return null;
+    }
+    /**
+     * What each stack was last started with, from the audit trail.
+     *
+     * The running state lives in memory and a daemon restart empties it; the
+     * `stack.start` rows do not. So «which release is test running» is
+     * answered by the last recorded deployment of it, and the console says
+     * exactly that rather than implying it read the node.
+     */
+    async deployments(_data) {
+        if (!this.audit)
+            return [];
+        // The newest `stack.start` of EVERY stack, however long ago — not the
+        // newest 200 rows (see `AuditService.latestPerResource`). `limit` is
+        // kept for callers that still send it; one row per stack needs none.
+        const rows = await this.audit.latestPerResource('stack.start');
+        const latest = new Map();
+        for (const row of rows) {
+            const details = row.details ?? {};
+            // `project` and `stack` are NOT in `details` — measured on the live
+            // trail, where every `stack.start` row carries them only in
+            // `resourceId`, as `<project>/<stack>`. Reading a key the writer never
+            // writes made this method answer «nothing has ever been deployed» for
+            // a stack that had been deployed forty minutes earlier.
+            const slash = (row.resourceId ?? '').indexOf('/');
+            const project = slash > 0 ? row.resourceId.slice(0, slash) : null;
+            const stack = slash > 0 ? row.resourceId.slice(slash + 1) : null;
+            if (!project || !stack)
+                continue;
+            const key = `${project}/${stack}`;
+            // Rows are newest first: the first one seen for a stack is its latest.
+            if (latest.has(key))
+                continue;
+            latest.set(key, {
+                project,
+                stack,
+                at: row.createdAt,
+                actorId: row.actorId,
+                source: typeof details['source'] === 'string' ? details['source'] : null,
+                // Rows written before the audit trail learned to flatten this field
+                // hold the literal `[object]` — `scrubDetails` replaces a nested
+                // object with that word. It is not an id, and showing it as one
+                // would put a release on the screen that does not exist.
+                release: typeof details['release'] === 'string' && details['release'] !== '[object]' ? details['release'] : null,
+                releaseUnnamed: details['release'] === '[object]',
+                projectCommit: typeof details['releaseProjectCommit'] === 'string' ? details['releaseProjectCommit'] : null,
+                omniCommit: typeof details['releaseOmniCommit'] === 'string' ? details['releaseOmniCommit'] : null,
+            });
+        }
+        return [...latest.values()];
+    }
+};
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "preflight", null);
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "list", null);
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "get", null);
+__decorate([
+    Public({ auth: { roles: OPERATOR_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "getLog", null);
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "builds", null);
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "getBuild", null);
+__decorate([
+    Public({ auth: { roles: OPERATOR_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "build", null);
+__decorate([
+    Public({ auth: { roles: OPERATOR_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "stopBuild", null);
+__decorate([
+    Public({ auth: { roles: ADMIN_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "prune", null);
+__decorate([
+    Public({ auth: { roles: OPERATOR_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "attest", null);
+__decorate([
+    Public({ auth: { roles: OPERATOR_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "attestOnNode", null);
+__decorate([
+    Public({ auth: { roles: VIEWER_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ReleaseRpcService.prototype, "deployments", null);
+ReleaseRpcService = __decorate([
+    Service({ name: 'OmnitronRelease' }),
+    __metadata("design:paramtypes", [Function, Object, Object])
+], ReleaseRpcService);
+export { ReleaseRpcService };
+//# sourceMappingURL=release.rpc-service.js.map

package/dist/services/release.rpc-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.rpc-service.js","sourceRoot":"","sources":["../../src/services/release.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK/E,oDAAoD;AACpD,MAAM,eAAe,GAAG,GAAG,CAAC;AAGrB,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET,QAAQ;IACR,KAAK;IAEL,QAAQ;IAJ3B,YACmB,QAAwB,EACxB,KAAgC;IACjD,mEAAmE;IAClD,QAAoE;wBAHpE,QAAQ;qBACR,KAAK;wBAEL,QAAQ;IACxB,CAAC;IAEJ;;;;;;OAMG;IAEG,AAAN,KAAK,CAAC,SAAS;QACb,sEAAsE;QACtE,uEAAuE;QACvE,0CAA0C;QAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC1B,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YAC9B,YAAY,EAAE,OAAO;YACrB,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACpD,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,6BAA6B;YAC7B,IAAI,EAAE,EAAE,CAAC,OAAO,EAA8B;YAC9C,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM;SACvB,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IACxE,CAAC;IAGK,AAAN,KAAK,CAAC,GAAG,CAAC,IAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,IAAkD;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAC,IAAyB;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,KAAK,CAAC,IAQX;QACC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACxG,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ;aAClE;SACF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAGK,AAAN,KAAK,CAAC,SAAS,CAAC,IAAyB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,MAAM,EAAE,cAAc;YACtB,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,IAAI,CAAC,OAAO;YACxB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,IAAI,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;SACtH,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IAEG,AAAN,KAAK,CAAC,KAAK,CAAC,IAKX;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAChD,IAAI,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,CAAC,OAAO,4EAA4E,CAC1H,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO;SACR,CAAC,CAAC;QACH,IAAI,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;gBACvB,MAAM,EAAE,eAAe;gBACvB,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE;aAC1H,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACrF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB;QAChC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC;QACpH,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;iBAClC,IAAI,CAAC,CAAC,cAAc;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;YACL,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC,CAAC,IAAI;SACxG,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,IAAwD;QACnE,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;YAC3E,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACpF,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,IAAI,CAAC,OAAO;YACxB,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM;gBACvC,MAAM;gBACN,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE;gBACzB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/G;SACF,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM;YACtC,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1G,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IAEG,AAAN,KAAK,CAAC,YAAY,CAAC,IAAwC;QAMzD,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClG,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC/F,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC5D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClG,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3H,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,KAAa;QACzD,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACtF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;gBAAE,SAAS;YACrD,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,OAAO;gBAAE,SAAS;YACzD,OAAO,GAAG,CAAC,SAAS,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,WAAW,CAAC,KAA0B;QAC1C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QAC3B,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;YAClC,oEAAoE;YACpE,4DAA4D;YAC5D,uEAAuE;YACvE,sEAAsE;YACtE,wDAAwD;YACxD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;gBAAE,SAAS;YACjC,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC;YAClC,uEAAuE;YACvE,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;gBACd,OAAO;gBACP,KAAK;gBACL,EAAE,EAAE,GAAG,CAAC,SAAS;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBACxE,oEAAoE;gBACpE,iEAAiE;gBACjE,gEAAgE;gBAChE,yDAAyD;gBACzD,OAAO,EAAE,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;gBAChH,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,UAAU;gBACjD,aAAa,EAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC3G,UAAU,EAAE,OAAO,OAAO,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI;aACnG,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;CACF,CAAA;AAhTO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;kDAqBzC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;6CAGzC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;4CAGzC;AAUK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;;;;+CAG3C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;+CAGzC;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;iDAGzC;AAWK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;;;;8CA4B3C;AAGK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;;;;kDAU3C;AAoBK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;8CA4BxC;AAgCK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;;;;+CA8B3C;AAiBK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;;;;qDAgB3C;AAuBK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;;;;oDAuCzC;AA/TU,iBAAiB;IAD7B,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;;GACxB,iBAAiB,CAgU7B"}

package/dist/services/release.service.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Releases, as the daemon holds them.
+ *
+ * A release build takes a quarter of an hour, two `pnpm install`s and the
+ * whole gate suite. That is fine in a terminal, where the operator watches
+ * the lines go by; through an RPC call it is impossible — no console waits
+ * fifteen minutes for one answer, and a browser tab that is closed halfway
+ * must not stop the build. So the call STARTS a build and returns its id,
+ * and everything about it is then read from here: the phase, the percent,
+ * the gates as they answer, and the error if it failed.
+ *
+ * The records live in memory only. A daemon restart therefore loses them —
+ * and it also kills the build, which is why an unfinished build leaves a
+ * directory with no manifest and `release list` shows exactly that. The disk
+ * is the durable record; this is the live one.
+ */
+import type { ILogger } from '@omnitron-dev/titan/module/logger';
+import { type BuildPhase } from '../release/build-run.js';
+import { type PruneResult, type ReleaseDetail, type ReleaseSummary } from '../release/store.js';
+import type { GateOutcome } from '../release/manifest.js';
+/** What the caller asked for, as it is shown back to them. */
+export interface BuildRequest {
+    readonly project: string;
+    readonly projectCommit?: string | undefined;
+    readonly omniCommit?: string | undefined;
+    readonly forStack?: string | undefined;
+    readonly skipGates?: boolean | undefined;
+    readonly keepSource?: boolean | undefined;
+    /** Names only — a value here would be in every console's memory. */
+    readonly envKeys?: readonly string[] | undefined;
+}
+export interface BuildRecord {
+    readonly buildId: string;
+    readonly request: BuildRequest;
+    /** Known once the two commits are resolved, a few seconds in. */
+    releaseId: string | null;
+    state: 'running' | 'done' | 'failed' | 'stopped';
+    phase: string;
+    percent: number;
+    startedAt: string;
+    finishedAt: string | null;
+    durationMs: number;
+    gates: GateOutcome[];
+    error: string | null;
+    /** Who asked, as the request proved it. */
+    readonly requestedBy: string | null;
+    /** Every phase line, in order — the console's live log. */
+    readonly history: BuildPhase[];
+}
+export declare class ReleaseService {
+    private readonly logger;
+    private readonly records;
+    private readonly running;
+    constructor(logger: ILogger);
+    root(): string;
+    list(): ReleaseSummary[];
+    get(id: string): ReleaseDetail;
+    log(id: string, name: string, lines?: number): {
+        name: string;
+        bytes: number;
+        tail: string;
+    };
+    /**
+     * Remove old releases — never one that is being built right now.
+     *
+     * A build in progress is a directory with no manifest, and an unfinished
+     * release sorts to the END of the list: with `keep: 5` and six directories,
+     * the sixth is the one the daemon is writing into. Deleting it would take
+     * the clones out from under `pnpm` mid-install and leave the build failing
+     * on a path that stopped existing. The store cannot know this — only the
+     * service holds the live records — so the protection is added here.
+     */
+    prune(options: {
+        keep?: number;
+        apply?: boolean;
+        protect?: readonly string[];
+    }): PruneResult;
+    /** Every build this daemon has run since it started, newest first. */
+    builds(): BuildRecord[];
+    build(buildId: string): BuildRecord | null;
+    /**
+     * Start a build, and refuse a second one.
+     *
+     * Two builds at once would be two `pnpm install`s, two gate suites and two
+     * copies of the same store on one machine; the second would not fail, it
+     * would just make both take three times as long and leave the operator
+     * unable to tell which set of gate failures belonged to which. One at a
+     * time, and the refusal names the one that is running.
+     */
+    start(request: BuildRequest & {
+        env?: Record<string, string>;
+    }, requestedBy: string | null): BuildRecord;
+    /**
+     * Stop a running build.
+     *
+     * The step that is running is ended by its process group, as a timeout
+     * ends one, and the build then refuses to go on to the next step. What it
+     * has written stays on disk with no manifest — a release directory without
+     * a manifest is an unfinished build, which is what this is.
+     */
+    stop(buildId: string): BuildRecord;
+    /**
+     * Stop every running build, for a daemon that is going down.
+     *
+     * Every step runs detached, in its own process group, so without this a
+     * shutdown leaves `pnpm install` and the gate suite running for another
+     * quarter of an hour under no supervision at all.
+     */
+    stopAll(): string[];
+    private onPhase;
+    /** Keep the running ones and the newest finished; drop the rest. */
+    private forget;
+}
+//# sourceMappingURL=release.service.d.ts.map

package/dist/services/release.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.service.d.ts","sourceRoot":"","sources":["../../src/services/release.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAEjE,OAAO,EAAmB,KAAK,UAAU,EAA4B,MAAM,yBAAyB,CAAC;AACrG,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,iEAAiE;IACjE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;CAChC;AAKD,qBAAa,cAAc;IAIb,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAE9D,YAA6B,MAAM,EAAE,OAAO,EAAI;IAEhD,IAAI,IAAI,MAAM,CAEb;IAED,IAAI,IAAI,cAAc,EAAE,CAEvB;IAED,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,CAE7B;IAED,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAE3F;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,WAAW,CAK3F;IAED,sEAAsE;IACtE,MAAM,IAAI,WAAW,EAAE,CAEtB;IAED,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAEzC;IAED;;;;;;;;OAQG;IACH,KAAK,CACH,OAAO,EAAE,YAAY,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,EACxD,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,WAAW,CAoFb;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAOjC;IAED;;;;;;OAMG;IACH,OAAO,IAAI,MAAM,EAAE,CAYlB;IAED,OAAO,CAAC,OAAO;IAWf,oEAAoE;IACpE,OAAO,CAAC,MAAM;CAMf"}