@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/release/layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CA4BjF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,GACjB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAY/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAGnH"}

package/dist/release/layout.js

@@ -0,0 +1,114 @@
+/**
+ * Where a release is built, so the lockfile's links land on the omni clone.
+ *
+ * Until the registry migration the project declares every omni package as a
+ * `link:` to a checkout on the developer's disk, and the lockfile records it
+ * RELATIVE to each importer — `link:../../luxquant/omnitron-dev/omni/apps/omnitron`
+ * from the project root. `pnpm install --frozen-lockfile` follows that
+ * relative path. So a clean clone of the project placed anywhere else either
+ * links nothing (measured 2026-09-22: 97 of 97 links dangling, install exit 0)
+ * or, placed at the same depth as the working checkout, links the DEVELOPER'S
+ * omni — dirty tree and all — into a build that claims to be a commit.
+ *
+ * A release is therefore built inside a root that reproduces the relative
+ * layout, with a clean clone of omni exactly where the links point. The
+ * layout is read from the lockfile rather than written down here, because the
+ * lockfile is what pnpm will follow.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/** `importer → link targets`, from the lockfile's `importers:` section. */
+function importerLinks(lockfile) {
+    const out = [];
+    let inImporters = false;
+    let importer = null;
+    for (const line of lockfile.split('\n')) {
+        if (/^importers:\s*$/.test(line)) {
+            inImporters = true;
+            continue;
+        }
+        if (!inImporters)
+            continue;
+        if (/^\S/.test(line))
+            break; // the next top-level key
+        const key = /^ {2}([^\s].*?):\s*$/.exec(line);
+        if (key) {
+            importer = key[1].replace(/^['"]|['"]$/g, '');
+            continue;
+        }
+        const link = /^\s+version: link:(\S+)\s*$/.exec(line);
+        if (link && importer !== null)
+            out.push({ importer, rel: link[1] });
+    }
+    return out;
+}
+/**
+ * Read the layout the lockfile implies, or say why there is none.
+ *
+ * A link that leaves the project root is an omni link; its target minus the
+ * trailing `packages/<name>` or `apps/<name>` is omni's root. All of them
+ * must agree on that root: links into two outside checkouts cannot be laid
+ * out by one clone, and guessing which one is "omni" would build from the
+ * wrong one.
+ */
+export function readLinkLayout(lockfile) {
+    const roots = new Set();
+    const dirs = new Set();
+    const strays = [];
+    for (const { importer, rel } of importerLinks(lockfile)) {
+        const target = path.posix.normalize(path.posix.join(importer === '.' ? '' : importer, rel));
+        if (!target.startsWith('../'))
+            continue; // inside the project: its own workspace
+        const parts = target.split('/');
+        const kind = parts[parts.length - 2];
+        if (parts.length < 3 || (kind !== 'packages' && kind !== 'apps')) {
+            strays.push(target);
+            continue;
+        }
+        roots.add(parts.slice(0, -2).join('/'));
+        dirs.add(parts.slice(-2).join('/'));
+    }
+    if (strays.length > 0) {
+        return { refusal: `the lockfile links outside the project to something that is not a workspace package: ${strays.slice(0, 3).join(', ')}` };
+    }
+    if (roots.size === 0) {
+        return { refusal: 'the lockfile links nothing outside the project — there is no omni checkout to lay out' };
+    }
+    if (roots.size > 1) {
+        return { refusal: `the lockfile links into ${roots.size} outside checkouts (${[...roots].join(', ')}) — one clone cannot stand in for them` };
+    }
+    const omniRel = [...roots][0];
+    const climbs = omniRel.split('/').filter((p) => p === '..').length;
+    return { omniRel, climbs, linkedDirs: [...dirs].sort() };
+}
+/**
+ * The two checkouts inside `srcRoot`: the project where its own last
+ * `climbs` path segments put it, and omni where its links then land.
+ */
+export function planBuildRoot(srcRoot, projectPath, layout) {
+    const segments = path.resolve(projectPath).split(path.sep).filter(Boolean);
+    if (layout.climbs < 1 || layout.climbs > segments.length) {
+        return { refusal: `the links climb ${layout.climbs} directories above a project at ${projectPath}` };
+    }
+    const projectDir = path.join(srcRoot, ...segments.slice(-layout.climbs));
+    const omniDir = path.resolve(projectDir, layout.omniRel);
+    const inside = omniDir.startsWith(path.resolve(srcRoot) + path.sep);
+    if (!inside) {
+        return { refusal: `omni would land at ${omniDir}, outside the build root ${srcRoot}` };
+    }
+    return { projectDir, omniDir };
+}
+/**
+ * The project's real directory and the omni checkout its links point to.
+ *
+ * From the REAL path, because that is where pnpm resolves a relative link
+ * from. The registry holds `omni/internal/daos`, a symlink to
+ * `~/projects/dao/daos`; resolved from the symlink, `../../luxquant/…` named
+ * a directory that does not exist, and the first `git` run there failed with
+ * a bare `spawn git ENOENT`.
+ */
+export function resolveCheckouts(projectPath, layout) {
+    const projectReal = fs.realpathSync(projectPath);
+    return { projectReal, omniPath: path.resolve(projectReal, layout.omniRel) };
+}
+//# sourceMappingURL=layout.js.map

package/dist/release/layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B,2EAA2E;AAC3E,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,GAAG,GAA6C,EAAE,CAAC;IACzD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,yBAAyB;QACtD,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,GAAG,EAAE,CAAC;YACR,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,wCAAwC;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9I,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC;IAChJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,WAAmB,EACnB,MAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,mBAAmB,MAAM,CAAC,MAAM,mCAAmC,WAAW,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,4BAA4B,OAAO,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,MAAkB;IACtE,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/release/load.d.ts

@@ -0,0 +1,44 @@
+/**
+ * A release as a deployment takes it: read, and checked, before anything
+ * moves.
+ *
+ * The manifest says what the release is; the files beside it are what would
+ * be shipped. They are compared here, by size and sha256, on the master —
+ * the node compares them again when they arrive (`release/delivered.ts`), and
+ * the two checks answer different questions: this one, whether the release on
+ * this disk is still the one that was built; that one, whether the transfer
+ * delivered it.
+ */
+import type { ReleaseManifest } from './manifest.js';
+export interface LoadedRelease {
+    readonly id: string;
+    readonly root: string;
+    readonly manifest: ReleaseManifest;
+    /** Each artifact's tarball on this machine, checked against the manifest. */
+    readonly files: ReadonlyArray<{
+        app: string;
+        version: string;
+        path: string;
+        sha256: string;
+        bytes: number;
+        inputs: string;
+    }>;
+    /** The static bundle's directory, when the release carries one. */
+    readonly staticsDir: string | null;
+}
+export declare function releasesRoot(): string;
+export declare function loadRelease(id: string, root?: string): Promise<LoadedRelease>;
+/**
+ * Is this directory's tracked content exactly `commit`, with nothing
+ * untracked beside it? Ignored files — machine-local state such as a
+ * generated dev secret — are not the commit's business and are not counted.
+ */
+export declare function treeEqualsCommit(dir: string, commit: string, 
+/** Only these paths (relative to `dir`); the whole tree when absent. */
+paths?: readonly string[]): Promise<{
+    equal: true;
+} | {
+    equal: false;
+    files: string[];
+}>;
+//# sourceMappingURL=load.d.ts.map

package/dist/release/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/release/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7H,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAeD,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAgCnG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM;AACd,wEAAwE;AACxE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAS9D"}

package/dist/release/load.js

@@ -0,0 +1,84 @@
+/**
+ * A release as a deployment takes it: read, and checked, before anything
+ * moves.
+ *
+ * The manifest says what the release is; the files beside it are what would
+ * be shipped. They are compared here, by size and sha256, on the master —
+ * the node compares them again when they arrive (`release/delivered.ts`), and
+ * the two checks answer different questions: this one, whether the release on
+ * this disk is still the one that was built; that one, whether the transfer
+ * delivered it.
+ */
+import { execFile } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { OMNITRON_HOME } from '../config/defaults.js';
+const exec = promisify(execFile);
+export function releasesRoot() {
+    return path.join(OMNITRON_HOME, 'releases');
+}
+function sha256Of(file) {
+    return new Promise((resolve, reject) => {
+        const hash = crypto.createHash('sha256');
+        fs.createReadStream(file)
+            .on('data', (chunk) => hash.update(chunk))
+            .on('error', reject)
+            .on('end', () => resolve(hash.digest('hex')));
+    });
+}
+/** A release id names a directory; it may not name one anywhere else. */
+const RELEASE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export async function loadRelease(id, root = releasesRoot()) {
+    if (!RELEASE_ID.test(id) || id.includes('..'))
+        throw new Error(`'${id}' is not a release id`);
+    const dir = path.join(root, id);
+    const manifestPath = path.join(dir, 'manifest.json');
+    if (!fs.existsSync(manifestPath)) {
+        throw new Error(`No release '${id}' on this machine — ${manifestPath} does not exist. \`ls ${root}\` lists what was built.`);
+    }
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    if (manifest.id !== id)
+        throw new Error(`${manifestPath} names release '${manifest.id}', not '${id}'`);
+    const files = [];
+    for (const a of manifest.artifacts) {
+        const file = path.join(dir, 'artifacts', `${a.app}-${a.version}.tar.gz`);
+        if (!fs.existsSync(file))
+            throw new Error(`Release ${id} names ${a.app}@${a.version}, and ${file} is not there`);
+        // Size first: it tells a truncated copy from a different file, which a
+        // checksum mismatch alone does not.
+        const bytes = fs.statSync(file).size;
+        if (bytes !== a.bytes) {
+            throw new Error(`Release ${id}: ${a.app}'s tarball is ${bytes} bytes, and the manifest recorded ${a.bytes}`);
+        }
+        const sum = await sha256Of(file);
+        if (sum !== a.sha256) {
+            throw new Error(`Release ${id}: ${a.app}'s tarball hashes to ${sum.slice(0, 12)}…, and the manifest recorded ${a.sha256.slice(0, 12) || '(nothing)'}…`);
+        }
+        files.push({ app: a.app, version: a.version, path: file, sha256: sum, bytes, inputs: a.inputs ?? sum });
+    }
+    const staticsDir = manifest.statics ? path.join(dir, 'statics') : null;
+    if (staticsDir && !fs.existsSync(staticsDir)) {
+        throw new Error(`Release ${id} records a static bundle for ${manifest.statics.stack}, and ${staticsDir} is not there`);
+    }
+    return { id, root: dir, manifest, files, staticsDir };
+}
+/**
+ * Is this directory's tracked content exactly `commit`, with nothing
+ * untracked beside it? Ignored files — machine-local state such as a
+ * generated dev secret — are not the commit's business and are not counted.
+ */
+export async function treeEqualsCommit(dir, commit, 
+/** Only these paths (relative to `dir`); the whole tree when absent. */
+paths) {
+    if (paths && paths.length === 0)
+        return { equal: true };
+    const run = async (args) => (await exec('git', args, { cwd: dir, maxBuffer: 16 * 1024 * 1024 })).stdout.split('\n').filter(Boolean);
+    const scope = paths ? ['--', ...paths] : ['--'];
+    const changed = await run(['diff', '--name-only', commit, ...scope]);
+    const untracked = await run(['ls-files', '--others', '--exclude-standard', ...(paths ? ['--', ...paths] : [])]);
+    const files = [...changed, ...untracked.map((f) => `${f} (untracked)`)];
+    return files.length === 0 ? { equal: true } : { equal: false, files };
+}
+//# sourceMappingURL=load.js.map

package/dist/release/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/release/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAYjC,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;aACtB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACzC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;aACnB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,IAAI,GAAW,YAAY,EAAE;IACzE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,uBAAuB,YAAY,yBAAyB,IAAI,0BAA0B,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAoB,CAAC;IACtF,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,mBAAmB,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAEvG,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,SAAS,IAAI,eAAe,CAAC,CAAC;QACjH,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,iBAAiB,KAAK,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,wBAAwB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC;QAC1J,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,gCAAgC,QAAQ,CAAC,OAAQ,CAAC,KAAK,SAAS,UAAU,eAAe,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,MAAc;AACd,wEAAwE;AACxE,KAAyB;IAEzB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,KAAK,EAAE,IAAc,EAAE,EAAE,CACnC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACxE,CAAC"}

package/dist/release/manifest.d.ts

@@ -0,0 +1,299 @@
+/**
+ * What a release is, and what earns one the right to reach a stack.
+ *
+ * There is one test server and one production estate, and any number of
+ * development machines. Today a deployment is whichever developer's disk
+ * reached the node last: the artifacts are compiled from that machine's
+ * working tree, by that machine's toolchain, and the only thing recorded
+ * afterwards is the project's commit. Measured over one day, that produced
+ * every failure this file exists to make impossible —
+ *
+ *   - two deployments ran concurrently and one emptied a package's `dist`
+ *     while the other compiled against it;
+ *   - an artifact's inputs included the deploying machine's own checkout of
+ *     `@omnitron-dev/omnitron`, which the trail does not record at all, so
+ *     «what is running there» cannot be answered from the row that says a
+ *     deployment happened;
+ *   - `daos` carries a 310-line GitHub Actions workflow and lives on a
+ *     GitLab server, with no runner and no `.gitlab-ci.yml`, so the guard
+ *     rail its own docblock describes — typecheck, lint, unit and
+ *     integration — has never run anywhere but on somebody's laptop, when
+ *     they remembered.
+ *
+ * A release is the answer to all three: one object, built from a named
+ * commit of BOTH repositories in a clean clone, carrying the artifacts by
+ * checksum, the outcome of every gate that was asked to run, and what it was
+ * built with. A stack accepts a release or refuses it; nothing else reaches
+ * test or production.
+ *
+ * The rule this file is built around, and the reason it is a module of its
+ * own with a suite of its own: **a gate that did not run is not a gate that
+ * passed.** «No gate failed» is satisfied by a scanner that was deleted, a
+ * suite whose runner exited before collecting, and a CI file for a forge the
+ * repository does not live on. «Every required gate ran and passed» is
+ * satisfied by none of those.
+ */
+/** One packed application, identified by content rather than by name. */
+export interface ReleaseArtifact {
+    readonly app: string;
+    readonly version: string;
+    /** sha256 of the tarball, as the receiving side will recompute it. */
+    readonly sha256: string;
+    /**
+     * Size in bytes, carried BESIDE the checksum rather than instead of it.
+     *
+     * A zero-length file with the right sum is impossible; a truncated one
+     * with the wrong sum is ordinary, and `sha mismatch` alone does not say
+     * whether anything arrived. Both numbers travel so the refusal can name
+     * both.
+     */
+    readonly bytes: number;
+    /**
+     * The hash of the build INPUTS, as a working-tree deployment records it on
+     * the node — what `decideRedeploy` compares to tell an app that changed from
+     * one that did not. Carried so a release deployed over the same code leaves
+     * the app running, as a deployment of the tree would.
+     */
+    readonly inputs?: string;
+}
+/**
+ * What one gate answered.
+ *
+ * `not-run` exists so that absence is a value rather than a hole. A gate
+ * missing from this list and a gate listed as `not-run` are the same
+ * refusal, and both differ from `passed`.
+ *
+ * `timed-out` is a third thing and not a fourth spelling of `failed`. A
+ * gate that answered «no» judged the code; a gate that did not answer in
+ * time judged the machine it ran on. Measured 2026-09-22: one scanner that
+ * walks 3502 files finishes in under a second alone and twice blew a
+ * 180-second limit while other work ran beside it, and a full unit suite
+ * failed one test at load average 41.7 and passed it alone. Recording both
+ * as `failed` would attribute the machine's hour to the commit.
+ */
+export interface GateOutcome {
+    readonly name: string;
+    /**
+     * `killed` is the machine as well: a signal from outside — the OS
+     * reclaiming memory — ended the gate before it answered. `gates.mjs`
+     * reports it apart from its own timeout, and so does this.
+     */
+    readonly status: 'passed' | 'failed' | 'not-run' | 'timed-out' | 'killed';
+    /** The gate's own words — an exit code and a line, not a paraphrase. */
+    readonly detail?: string;
+    /**
+     * The last of what a probe printed, when the producer sends it: a finding
+     * in its own words — which column, which value — that `detail`, one line,
+     * cannot carry. Without it a probe that found something on a node reported
+     * a verdict and kept the evidence on the node (2026-09-22:
+     * `a-state-no-path-produced-live` on test, «something writes a word the
+     * declared vocabulary lacks», and nowhere to read which). At most
+     * `OUTPUT_TAIL_CHARS` from the end.
+     */
+    readonly output?: string;
+    readonly durationMs?: number;
+    /**
+     * How many checks this gate is made of, when it is made of several.
+     *
+     * `run-checks` discovers its gates by reading a directory, so a new
+     * scanner becomes a gate by existing — which is right, and means a
+     * DISAPPEARED one is equally silent. A release whose `scans` ran 61
+     * checks where the last ran 78 passed the same way and guarded less; the
+     * number travels so that the difference is visible without re-running
+     * anything.
+     */
+    readonly checks?: number;
+}
+/**
+ * What the release was built WITH, as opposed to what it was built FROM.
+ *
+ * Measured 2026-09-22: of three fixes committed together, two reached the
+ * stand and one did not, because the daemon started sixteen seconds before
+ * the package holding the third was rebuilt. The commit was identical in
+ * all three cases; the `dist` that was packed was not. A release that names
+ * only its commits therefore names something that was true of two of them.
+ */
+export interface BuiltWith {
+    /** The omnitron that packed this, by its own version string. */
+    readonly omnitron: string;
+    /** Each linked package, and when the `dist` that went in was produced. */
+    readonly packages: ReadonlyArray<{
+        readonly name: string;
+        readonly distBuiltAt: string;
+    }>;
+}
+/** A repository and the commit taken from it. */
+export interface ReleaseSource {
+    readonly repo: string;
+    readonly commit: string;
+    /**
+     * Whether a remote-tracking branch contains the commit — null when the
+     * checkout has no remote refs to ask. A release built from a commit that
+     * exists on one laptop cannot be rebuilt by anyone else.
+     */
+    readonly onRemote?: boolean | null;
+}
+export interface ReleaseManifest {
+    readonly id: string;
+    /** The project's repository and the commit this was built from. */
+    readonly project: ReleaseSource;
+    /**
+     * And omni's, because its packages are vendored into every artifact.
+     *
+     * The two live in different systems — omni on GitHub, the project on a
+     * self-hosted GitLab — which is why neither forge's CI can produce this
+     * object and the master can.
+     */
+    readonly omni: ReleaseSource;
+    readonly artifacts: readonly ReleaseArtifact[];
+    /**
+     * Applications whose artifact did not build, with the builder's words. A
+     * release carrying them is still written — it is evidence — and a stack
+     * that requires the app refuses it by the missing artifact.
+     */
+    readonly artifactFailures?: ReadonlyArray<{
+        readonly app: string;
+        readonly error: string;
+    }>;
+    /**
+     * The static bundle a stack's gateway serves, built in the clone with that
+     * stack's `staticEnv`. Per stack, because the build is: a frontend bundle
+     * bakes its environment in. Absent when the release was not built for a
+     * stack that serves one — and a stack that does refuses the release.
+     */
+    readonly statics?: {
+        readonly stack: string;
+        /** The stack's `staticDir`, relative to the project, as declared. */
+        readonly dir: string;
+        readonly files: number;
+        readonly bytes: number;
+    };
+    /**
+     * sha256 of every migration file the release carries, by repository path.
+     * Admission compares them with the release running on the stack: a file
+     * that ran there and changed since is refused — see `release/migrations.ts`.
+     * Absent from a release built by an omnitron that did not record them;
+     * admission then says it did not compare.
+     */
+    readonly migrations?: Readonly<Record<string, string>>;
+    readonly gates: readonly GateOutcome[];
+    /**
+     * What the machine was doing while the gates ran.
+     *
+     * Measured 2026-09-22: three builds of the same commit, on one laptop,
+     * gave 21/21, 16/21 and 16/21 — with a DIFFERENT five red each time, and
+     * in every red gate either zero failing tests or a `connect ETIMEDOUT` to
+     * a container that was up. The fifteen-minute load average was 38, then
+     * 56; the CPU belonged to another project's arenas, not to anything here.
+     *
+     * A verdict that changes run to run is not a fact about the code, and the
+     * manifest is where that has to be visible — otherwise the next reader
+     * spends an hour in a diff looking for a regression that was a loaded
+     * machine. Two readings, because one at the end cannot show a spike that
+     * has passed.
+     */
+    readonly machine?: {
+        readonly cpus: number;
+        readonly loadAtGateStart: readonly [number, number, number];
+        readonly loadAtGateEnd: readonly [number, number, number];
+    };
+    readonly builtWith: BuiltWith;
+    readonly builtAt: string;
+    readonly builtBy: string;
+}
+/**
+ * What one stack verified about one release, after it was deployed there.
+ *
+ * Some gates cannot run in a clean clone: the live probes exercise a
+ * DEPLOYED system — revocation, token binding, paywall, dead-drop location
+ * — and there is nowhere to run them before a stack is carrying the
+ * release. So they are attached to the pair, not to the build.
+ */
+export interface StackAttestation {
+    readonly stack: string;
+    readonly release: string;
+    readonly gates: readonly GateOutcome[];
+}
+/** What a stack demands of a release before it will take it. */
+export interface StackReleasePolicy {
+    /** Gates that must have RUN and PASSED at build time. Absence is refusal. */
+    readonly requiredGates: readonly string[];
+    /** Applications the stack expects to receive. */
+    readonly requiredApps: readonly string[];
+    /**
+     * Gates that another stack must have run against this release, and passed.
+     *
+     * Production does not take what compiled; it takes what a running system
+     * was measured to do. «Deployed to test» and «verified on test» are
+     * different claims, and only the second is evidence — the same distinction
+     * that separated «Left running» in a log from six changed pids on a node.
+     */
+    readonly verifiedOn?: {
+        readonly stack: string;
+        readonly gates: readonly string[];
+    };
+}
+export type ReleaseDecision = {
+    readonly action: 'promote';
+    readonly because: string;
+} | {
+    readonly action: 'refuse';
+    readonly because: string;
+};
+/**
+ * May this release reach this stack?
+ *
+ * Every answer is a refusal until the last one, and each refusal names the
+ * single fact that produced it — the gate, the application, the field —
+ * because «policy not satisfied» sends the reader to re-derive what this
+ * already knows.
+ */
+export declare function decideRelease(manifest: ReleaseManifest, policy: StackReleasePolicy, 
+/** What other stacks have verified about this release. */
+attestations?: readonly StackAttestation[]): ReleaseDecision;
+/**
+ * What a stack declares about the releases it takes — `release` in its
+ * config.
+ *
+ * `required`: the stack takes releases only, and a `stack start` without one
+ * is refused. Every gate the release RECORDED must have passed; the gates
+ * listed here must additionally be among them — a floor, so a gate that
+ * disappears from the build is noticed rather than silently not run. The
+ * number of gates is not fixed (they are derived from the manifests), which
+ * is why the rule is "all that ran, and at least these", not a list.
+ */
+export interface StackReleaseRequirements {
+    readonly mode: 'required' | 'optional';
+    readonly requiredGates?: readonly string[];
+    /** Refuse a release whose commits no remote branch contains. */
+    readonly requireOnRemote?: boolean;
+    readonly verifiedOn?: {
+        readonly stack: string;
+        readonly gates: readonly string[];
+    };
+    /**
+     * How a release's probes may run on this stack's node.
+     *
+     * `provision`: the run creates the accounts its probes sign in with —
+     * an admin among them, raised through the stack's own Postgres — and
+     * removes them at the end (`attest.mjs --provision`). A stand seeded with
+     * nobody's accounts, like test, measures nothing that needs a signed-in
+     * person without it: on 2026-09-22 ten probes there failed on the dev
+     * passwords and three more could not start. Declared per stack and off
+     * unless declared, because a temporary superadmin is not something a
+     * production stack should get from a flag nobody chose.
+     */
+    readonly attest?: {
+        readonly provision?: boolean;
+    };
+}
+/**
+ * May this release reach this stack, under what the stack declares?
+ *
+ * Absent requirements are the weakest honest reading, not a pass-through:
+ * every gate the release recorded must still have passed, and every app the
+ * stack runs must be in it. A stack that wants less must say so in its
+ * config, where a reader can see it.
+ */
+export declare function decideStackRelease(manifest: ReleaseManifest, requirements: StackReleaseRequirements | undefined, stackApps: readonly string[], attestations?: readonly StackAttestation[]): ReleaseDecision;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/release/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1E,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,qEAAqE;QACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5D,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACrF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAa5D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,kBAAkB;AAC1B,0DAA0D;AAC1D,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CA6FjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gEAAgE;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACpF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CA2BjB"}