@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/project/stack-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-env.js","sourceRoot":"","sources":["../../src/project/stack-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAK5C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAOrC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,KAAK,2BAA2B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;YAC/G,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,yCAAyC,CAC5F,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,KAAoC,EAAQ,EAAE;QAC1E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,SAAS,IAAI,8CAA8C,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YACxC,MAAM,GAAG,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9G,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,sDAAsD,CAAC,CAAC;YAC1G,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,mBAAmB,GAAG,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD;gBAC1G,6DAA6D,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;gBACjD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,KAAK,wBAAwB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC9E,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;gBACpG,oGAAoG,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAoC,EAA0B,EAAE,CAC/E,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAE,CAAC,CAAC,CAC3H,CAAC;IACJ,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/project/stand-containers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Project tools may already consume <PROJECT>_*_CONTAINER variables. Derive
+ * that namespace from the registered project, independently of a custom
+ * container prefix, so existing tools continue to work without project names
+ * in the runtime. The fallback supports the conventional <project>-<stack>
+ * prefix for standalone callers; the daemon always supplies projectName.
+ */
+export declare function standContainers(prefix: string, projectName?: string): Readonly<Record<string, string>>;
+/** The same, as shell assignments to put before a command. */
+export declare function standContainerAssignments(prefix: string, projectName?: string): string;
+//# sourceMappingURL=stand-containers.d.ts.map

package/dist/project/stand-containers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stand-containers.d.ts","sourceRoot":"","sources":["../../src/project/stand-containers.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAUtG;AAED,8DAA8D;AAC9D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAItF"}

package/dist/project/stand-containers.js

@@ -0,0 +1,27 @@
+/** Container environment shared by project tools and release probes. */
+import { shellEscape } from '../shared/shell-escape.js';
+/**
+ * Project tools may already consume <PROJECT>_*_CONTAINER variables. Derive
+ * that namespace from the registered project, independently of a custom
+ * container prefix, so existing tools continue to work without project names
+ * in the runtime. The fallback supports the conventional <project>-<stack>
+ * prefix for standalone callers; the daemon always supplies projectName.
+ */
+export function standContainers(prefix, projectName) {
+    const namespace = (projectName ?? prefix.replace(/-[^-]+$/, '')).toUpperCase().replace(/[^A-Z0-9_]/g, '_');
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(namespace)) {
+        throw new Error('A project name must produce a valid environment variable namespace');
+    }
+    return {
+        [`${namespace}_PG_CONTAINER`]: `${prefix}-postgres`,
+        [`${namespace}_REDIS_CONTAINER`]: `${prefix}-redis`,
+        [`${namespace}_GATEWAY_CONTAINER`]: `${prefix}-gateway`,
+    };
+}
+/** The same, as shell assignments to put before a command. */
+export function standContainerAssignments(prefix, projectName) {
+    return Object.entries(standContainers(prefix, projectName))
+        .map(([k, v]) => `${k}=${shellEscape(v)}`)
+        .join(' ');
+}
+//# sourceMappingURL=stand-containers.js.map

package/dist/project/stand-containers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stand-containers.js","sourceRoot":"","sources":["../../src/project/stand-containers.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,WAAoB;IAClE,MAAM,SAAS,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC3G,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,CAAC,GAAG,SAAS,eAAe,CAAC,EAAE,GAAG,MAAM,WAAW;QACnD,CAAC,GAAG,SAAS,kBAAkB,CAAC,EAAE,GAAG,MAAM,QAAQ;QACnD,CAAC,GAAG,SAAS,oBAAoB,CAAC,EAAE,GAAG,MAAM,UAAU;KACxD,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,WAAoB;IAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC"}

package/dist/project/working-tree.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Is this project's working tree the commit it says it is?
+ *
+ * A remote deployment compiles and ships what is ON DISK. Measured over one
+ * night with three sessions in one checkout: a deployment shipped five
+ * artifacts of six because the sixth did not compile from somebody's
+ * half-finished edit; and the set of paths that travel is wider than anyone
+ * guessed twice in a row — not only `apps/**` but the whole gateway config
+ * directory, every file in it, with its modes (`readConfigDirectory`).
+ *
+ * That is why this asks git rather than naming directories. Enumerating the
+ * safe ones is a claim about the mechanism that has to be re-made every time
+ * the mechanism grows, and it was already wrong twice. `git status
+ * --porcelain` answers the question the deployment actually has — «is
+ * anything here different from the commit» — and ignored files do not appear
+ * in it, so a scratch file nobody would commit is not a scratch file anybody
+ * ships.
+ *
+ * When the answer cannot be obtained — no git, not a repository — this says
+ * so rather than passing. A check that cannot run is not a check that
+ * passed, and the caller logs that distinction instead of silently
+ * deploying.
+ */
+export interface WorkingTree {
+    /** False when git could not answer; `dirty` and `head` mean nothing then. */
+    readonly checked: boolean;
+    /** Why it could not be checked, for the log line that says so. */
+    readonly why?: string;
+    /** The commit this tree claims to be, short form. */
+    readonly head?: string;
+    /** Paths that differ from it — `git status --porcelain`, modified or not tracked. */
+    readonly dirty: readonly string[];
+}
+export declare function describeWorkingTree(projectPath: string): Promise<WorkingTree>;
+/**
+ * The refusal a dirty tree earns, or null.
+ *
+ * It names the files, because «the tree is dirty» sends the reader to `git
+ * status` to find out what this command already knew.
+ */
+export declare function refusalForDirtyTree(tree: WorkingTree, stackName: string, shown?: number): string | null;
+/**
+ * Every distinct repository the deployment reads, answered together.
+ *
+ * A project is not the only tree that travels. The portal's bundle INLINES
+ * the sources of the packages it links — prism and netron-browser resolve
+ * through a vite alias to each package's `src` in another repository — so an
+ * uncommitted change there reaches the node inside `dist` while the
+ * project's own tree is spotless. (The backends are different: their
+ * vendored `@omnitron-dev/*` are replaced on the node by symlinks to the
+ * node daemon's copy, so what was packed for them does not run.)
+ *
+ * The inputs are derived from the mechanism — `linkedSourceDirs` is what the
+ * staleness check already uses to decide what the bundle is built from — and
+ * then collapsed to git roots, because two source directories in one
+ * repository are one answer.
+ */
+export declare function describeWorkingTrees(paths: readonly string[]): Promise<Array<{
+    root: string;
+    tree: WorkingTree;
+}>>;
+//# sourceMappingURL=working-tree.d.ts.map

package/dist/project/working-tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"working-tree.d.ts","sourceRoot":"","sources":["../../src/project/working-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBnF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,SAAK,GACT,MAAM,GAAG,IAAI,CAWf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC,CASrD"}

package/dist/project/working-tree.js

@@ -0,0 +1,101 @@
+/**
+ * Is this project's working tree the commit it says it is?
+ *
+ * A remote deployment compiles and ships what is ON DISK. Measured over one
+ * night with three sessions in one checkout: a deployment shipped five
+ * artifacts of six because the sixth did not compile from somebody's
+ * half-finished edit; and the set of paths that travel is wider than anyone
+ * guessed twice in a row — not only `apps/**` but the whole gateway config
+ * directory, every file in it, with its modes (`readConfigDirectory`).
+ *
+ * That is why this asks git rather than naming directories. Enumerating the
+ * safe ones is a claim about the mechanism that has to be re-made every time
+ * the mechanism grows, and it was already wrong twice. `git status
+ * --porcelain` answers the question the deployment actually has — «is
+ * anything here different from the commit» — and ignored files do not appear
+ * in it, so a scratch file nobody would commit is not a scratch file anybody
+ * ships.
+ *
+ * When the answer cannot be obtained — no git, not a repository — this says
+ * so rather than passing. A check that cannot run is not a check that
+ * passed, and the caller logs that distinction instead of silently
+ * deploying.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+export async function describeWorkingTree(projectPath) {
+    try {
+        const { stdout: head } = await exec('git', ['-C', projectPath, 'rev-parse', '--short', 'HEAD'], {
+            timeout: 15_000,
+        });
+        const { stdout: status } = await exec('git', ['-C', projectPath, 'status', '--porcelain'], {
+            timeout: 30_000,
+        });
+        const dirty = status
+            .split('\n')
+            .map((line) => line.trim())
+            .filter(Boolean)
+            // `XY path` — and `R  old -> new`, whose new name is the one on disk.
+            .map((line) => line.replace(/^\S+\s+/, '').replace(/^.*->\s*/, ''));
+        return { checked: true, head: head.trim(), dirty };
+    }
+    catch (err) {
+        return { checked: false, why: err.message.split('\n')[0] ?? 'git did not answer', dirty: [] };
+    }
+}
+/**
+ * The refusal a dirty tree earns, or null.
+ *
+ * It names the files, because «the tree is dirty» sends the reader to `git
+ * status` to find out what this command already knew.
+ */
+export function refusalForDirtyTree(tree, stackName, shown = 10) {
+    if (!tree.checked || tree.dirty.length === 0)
+        return null;
+    const head = tree.head ? ` (HEAD ${tree.head})` : '';
+    const list = tree.dirty.slice(0, shown).map((p) => `  ${p}`).join('\n');
+    const rest = tree.dirty.length > shown ? `\n  …and ${tree.dirty.length - shown} more` : '';
+    return (`Refusing to deploy ${stackName}: ${tree.dirty.length} file(s) differ from the commit${head}, ` +
+        `and a remote deployment ships what is on disk — not only the applications, ` +
+        `but the gateway's whole configuration directory.\n${list}${rest}\n` +
+        `Commit or stash them, or pass --allow-dirty to ship this disk deliberately.`);
+}
+/**
+ * Every distinct repository the deployment reads, answered together.
+ *
+ * A project is not the only tree that travels. The portal's bundle INLINES
+ * the sources of the packages it links — prism and netron-browser resolve
+ * through a vite alias to each package's `src` in another repository — so an
+ * uncommitted change there reaches the node inside `dist` while the
+ * project's own tree is spotless. (The backends are different: their
+ * vendored `@omnitron-dev/*` are replaced on the node by symlinks to the
+ * node daemon's copy, so what was packed for them does not run.)
+ *
+ * The inputs are derived from the mechanism — `linkedSourceDirs` is what the
+ * staleness check already uses to decide what the bundle is built from — and
+ * then collapsed to git roots, because two source directories in one
+ * repository are one answer.
+ */
+export async function describeWorkingTrees(paths) {
+    const roots = new Map();
+    for (const dir of paths) {
+        const root = await gitRootOf(dir);
+        if (root && !roots.has(root))
+            roots.set(root, dir);
+    }
+    const out = [];
+    for (const [root] of roots)
+        out.push({ root, tree: await describeWorkingTree(root) });
+    return out;
+}
+async function gitRootOf(dir) {
+    try {
+        const { stdout } = await exec('git', ['-C', dir, 'rev-parse', '--show-toplevel'], { timeout: 15_000 });
+        return stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=working-tree.js.map

package/dist/project/working-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"working-tree.js","sourceRoot":"","sources":["../../src/project/working-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAajC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;YAC9F,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE;YACzF,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM;aACjB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;YAChB,sEAAsE;aACrE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC3G,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAiB,EACjB,SAAiB,EACjB,KAAK,GAAG,EAAE;IAEV,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,OAAO,CACL,sBAAsB,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,kCAAkC,IAAI,IAAI;QAC/F,6EAA6E;QAC7E,qDAAqD,IAAI,GAAG,IAAI,IAAI;QACpE,6EAA6E,CAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACvG,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/release/artifact-store.d.ts

@@ -0,0 +1,360 @@
+/**
+ * Where a release goes so that a master which did not build it can deploy it.
+ *
+ * A release exists in one place: `~/.omnitron/releases/<id>` on the master
+ * that built it. `release list`, `stack start --release` and the console all
+ * read that directory, so a second master — the one production will be run
+ * from, or a laptop standing in for a master that died — has none, and the
+ * only way across was a directory copied by hand with nothing checking what
+ * arrived. `omnitron release push <id>` puts the release in an S3-compatible
+ * bucket; `omnitron release pull <id>` takes it out onto any master and holds
+ * it to the checks a deployment makes before it becomes visible there.
+ *
+ * WHAT TRAVELS is the five parts a release is made of — `manifest.json`,
+ * `artifacts/`, `statics/`, `scripts/`, `attestations/` — laid out in the
+ * bucket as on disk, under `<prefix>/<id>/`. Not `logs/`, `gate-logs/` or a
+ * kept `src/`: those are the building master's evidence about its own build,
+ * and a pulled release says it has no logs rather than carrying somebody
+ * else's.
+ *
+ * THE INDEX. The manifest names each artifact by sha256 and the static
+ * bundle by count and size; it says nothing about `scripts/` or
+ * `attestations/`, which are written beside it. So the store keeps its own
+ * record, `<id>/index.json`: every object of the release with its sha256 and
+ * size. A pull hashes each object as it arrives and holds it to that record,
+ * and a refusal names both sums in full. The index is written LAST — a push
+ * that dies halfway leaves objects and no index, and a pull refuses that as a
+ * push that did not finish instead of taking half a release.
+ *
+ * WHAT A PULL CHECKS, in the order it can fail:
+ *
+ *   1. every object against the index — sha256 and size;
+ *   2. the index against the manifest — each artifact's sum, and the static
+ *      bundle's file count and bytes (`loadRelease` only asks whether the
+ *      directory exists);
+ *   3. `loadRelease` itself, on the copy — the check `stack start --release`
+ *      runs, so a pulled release has passed what a deployment will ask.
+ *
+ * Only then is the copy renamed into the releases directory. It is fetched
+ * into a sibling of that directory rather than into it, because `release
+ * list` and `release prune` read every directory there: the console would
+ * show a half-fetched release as a failed build, and a prune could delete it
+ * mid-pull — what 4ca4527c found a prune doing to a build.
+ *
+ * A RELEASE IS IMMUTABLE; WHAT WAS MEASURED ABOUT IT IS NOT. An attestation
+ * arrives after the first push — test is attested once it carries the
+ * release — and production, deployed from another master, asks for it by
+ * name (`verifiedOn`). So a push or a pull of a release that is already
+ * there compares everything else file by file and refuses any difference,
+ * and moves only attestations. A difference means a different build under
+ * the same id, which is not hypothetical: the id has minute resolution, so
+ * two masters building one pair of commits in one minute produce exactly
+ * that. Between two copies of one stack's attestation, the one that measured
+ * later wins — `storeAttestation` keeps the newer run the same way — and the
+ * side that keeps its own says so. Two masters pushing attestations for one
+ * release in the same second: the later index wins, the other's object is in
+ * the bucket, and its next push adds it back. An attestation that travels
+ * was admitted at the door of the master that stored it (`attest.ts`); this
+ * proves it is the same file and nothing more.
+ *
+ * NO SDK. There is no S3 client in this monorepo. The obvious one,
+ * `@aws-sdk/client-s3@3.1137.0`, installs 26 packages — 3 338 files, 8.4 MB,
+ * 18 MB on disk (measured 2026-09-22 into an empty directory) — and it would
+ * install on every node, because a node installs omnitron's dependencies when
+ * the bundle arrives. The size is the lesser half. Its default credential
+ * chain reads `AWS_*` from the environment, `~/.aws/credentials`, the SSO
+ * cache and a credential process, and asks the instance-metadata address:
+ * `credential-provider-{env,ini,sso,process,web-identity,http,login}` and
+ * `credential-provider-imds`, all in that install. The key to this store
+ * comes from the daemon's vault and from nowhere else, and a client that
+ * looks in eight other places when it is handed an empty key has eight other
+ * doors. What this module needs is two verbs, PUT and GET, signed with
+ * Signature Version 4: `node:crypto`, pinned in the court by AWS's own worked
+ * examples and in practice by MinIO, which verifies every signature.
+ *
+ * THE KEY. `~/.omnitron/config.json` names the store and NAMES its key:
+ *
+ *     "releaseStore": { "endpoint", "bucket", "region", "forcePathStyle", "prefix",
+ *                       "accessKey": { "secret": "<vault key>" },
+ *                       "secretKey": { "secret": "<vault key>" } }
+ *
+ * — the `{ secret }` reference `resolveSecretRefs` resolves everywhere else.
+ * The values are read from the daemon's vault through `OmnitronSecrets.get`,
+ * which records each read in the audit trail. A literal credential in the
+ * config is refused, a reference the vault cannot answer is refused by name,
+ * and the pair is never logged and never sent: a signed request carries the
+ * key's id and a signature, not the secret. Plain http is refused anywhere
+ * but loopback — the signature protects the key and not the bytes, and a
+ * release fetched over a network anyone can write to is code from anyone.
+ *
+ * WHAT THIS DOES NOT PROVE. The index lives in the bucket it describes. It
+ * catches a changed byte, a lost object, a truncated upload and a push that
+ * did not finish; it cannot catch someone who can write the bucket and
+ * rewrites an object together with its index entry — the manifest then
+ * catches an artifact or the static bundle's size, and nothing catches a
+ * script or an attestation. Both commands print the index's sha256 so two
+ * masters can compare it out of band; a signature over the index is the step
+ * after that, and it needs a key decision nobody has made. Each object goes
+ * up in one PUT, so a single file may be up to 5 GiB; the largest artifact
+ * today is 8.3 MB.
+ */
+import type { SecretRef } from '../infrastructure/types.js';
+/** `releaseStore` in `~/.omnitron/config.json`, as an operator writes it. */
+export interface ReleaseStoreConfig {
+    /** `https://s3.<provider>` — or `http://127.0.0.1:9000`: plain http is taken on loopback only. */
+    readonly endpoint: string;
+    readonly bucket: string;
+    /** Default `us-east-1`: MinIO's, and what S3-compatible providers take when they have none. */
+    readonly region?: string;
+    /**
+     * `<endpoint>/<bucket>/<key>` rather than `<bucket>.<endpoint>/<key>`.
+     * Default true, as every S3 address omnitron hands an application: MinIO
+     * needs it, and the providers that prefer the other accept it too.
+     */
+    readonly forcePathStyle?: boolean;
+    /** Where in the bucket releases live, for a bucket that holds other things too. */
+    readonly prefix?: string;
+    readonly accessKey: SecretRef;
+    readonly secretKey: SecretRef;
+}
+export interface StoreCredentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+}
+/** A store with its key read — held by `S3ObjectStore` and by nothing that prints. */
+export interface ResolvedStore {
+    readonly endpoint: URL;
+    readonly bucket: string;
+    readonly region: string;
+    readonly forcePathStyle: boolean;
+    /** Without leading or trailing slashes; empty for the bucket's root. */
+    readonly prefix: string;
+    readonly credentials: StoreCredentials;
+    /** Which vault keys the pair came from — what a refusal names instead of the values. */
+    readonly credentialKeys: {
+        readonly accessKey: string;
+        readonly secretKey: string;
+    };
+}
+/** What a store looks like in the config, for a refusal to show — references, never values. */
+export declare const STORE_CONFIG_EXAMPLE: string;
+/**
+ * Read `releaseStore` as the config holds it, or say what is wrong with it.
+ *
+ * Every refusal names the field and what it should be. Unknown fields are
+ * refused as well: `forcePathStlye: false`, silently ignored, is a store that
+ * answers «NoSuchBucket» for a reason nobody would look for in a spelling.
+ */
+export declare function parseStoreConfig(raw: unknown, source: string): ReleaseStoreConfig;
+/**
+ * The store with its key, read through `getSecret` — the daemon's
+ * `OmnitronSecrets.get` in the command, a fake vault in the court.
+ *
+ * `resolveSecretRefs` turns a reference the vault cannot answer into an empty
+ * string, which a store reports as a bad signature against a key it was never
+ * given. The misses are counted here instead and refused by name, before a
+ * single request is made.
+ */
+export declare function resolveStore(config: ReleaseStoreConfig, getSecret: (key: string) => Promise<string | null>): Promise<ResolvedStore>;
+/**
+ * Percent-encoding as SigV4 defines it: everything but `A-Z a-z 0-9 - _ . ~`.
+ * `encodeURIComponent` leaves `! ' ( ) *` alone, and a statics file named
+ * with one of them would be signed as one path and sent as another.
+ */
+export declare function encodeRfc3986(value: string): string;
+export interface SignInput {
+    readonly method: string;
+    /** The path as it is sent, already encoded. */
+    readonly canonicalUri: string;
+    readonly query?: Readonly<Record<string, string>>;
+    /** Every header that is sent and signed besides the two this adds; `host` among them. */
+    readonly headers: Readonly<Record<string, string>>;
+    /** sha256 of the body — the store recomputes it and refuses a body that does not match. */
+    readonly payloadSha256: string;
+    readonly region: string;
+    readonly credentials: StoreCredentials;
+    readonly now: Date;
+}
+/**
+ * Sign one request; returns the headers to add — `x-amz-date`,
+ * `x-amz-content-sha256` and `authorization`.
+ *
+ * The payload is signed by its real sum rather than as `UNSIGNED-PAYLOAD`:
+ * then the store itself refuses an upload whose bytes changed on the way,
+ * before this side ever reads them back.
+ */
+export declare function signV4(input: SignInput): {
+    headers: Record<string, string>;
+    signature: string;
+};
+/** Where an object is, in either addressing style. */
+export declare function objectAddress(store: Pick<ResolvedStore, 'endpoint' | 'bucket' | 'forcePathStyle' | 'prefix'>, key: string): {
+    readonly https: boolean;
+    readonly hostname: string;
+    readonly port: string;
+    readonly host: string;
+    readonly path: string;
+};
+export interface ObjectSum {
+    readonly sha256: string;
+    readonly bytes: number;
+}
+/** What push and pull need of a store: two verbs, and a name for refusals. */
+export interface ObjectStore {
+    readonly location: string;
+    /** Write `source` — a file, or bytes — whose sum is already known. */
+    put(key: string, source: string | Buffer, sum: ObjectSum): Promise<void>;
+    /**
+     * Stream an object into `into`, hashing it on the way; null when there is
+     * no such object. Stops, and refuses, past `recordedBytes`: what the index
+     * recorded bounds what a pull will write.
+     */
+    get(key: string, into: string, recordedBytes: number): Promise<ObjectSum | null>;
+    /** A small object whole, or null when there is none. */
+    read(key: string, limitBytes: number): Promise<Buffer | null>;
+}
+/**
+ * An S3-compatible bucket, reached with `node:http(s)` and SigV4.
+ *
+ * The key pair is a private field: nothing that prints this object — a log
+ * line, an `inspect`, a `JSON.stringify` of an error that holds it — can
+ * reach it.
+ */
+export declare class S3ObjectStore implements ObjectStore {
+    #private;
+    readonly location: string;
+    constructor(store: ResolvedStore, options?: {
+        idleTimeoutMs?: number;
+        sockets?: number;
+    });
+    /** Keep-alive sockets hold the process open; a command closes the store when it is done. */
+    close(): void;
+    put(key: string, source: string | Buffer, sum: ObjectSum): Promise<void>;
+    get(key: string, into: string, recordedBytes: number): Promise<ObjectSum | null>;
+    read(key: string, limitBytes: number): Promise<Buffer | null>;
+    /**
+     * One signed request; resolves with the response once its headers arrive.
+     *
+     * `setTimeout` is an IDLE timeout on the socket: a transfer that is moving
+     * is never cut, one that has said nothing for a minute is — and the error
+     * reaches the response too, so a stream being read does not wait forever.
+     */
+    private send;
+    /** A refusal in the store's own words, and what it usually means here. */
+    private failure;
+}
+declare const DIRECTORY_PARTS: readonly ['artifacts', 'statics', 'scripts', 'attestations'];
+export type ReleasePart = 'manifest' | (typeof DIRECTORY_PARTS)[number];
+export interface IndexEntry {
+    /** Relative to the release, `/`-separated: `artifacts/main-0.0.1.tar.gz`. */
+    readonly path: string;
+    readonly sha256: string;
+    readonly bytes: number;
+    /** The owner may execute it — 21 of the 117 files of sample's `scripts/` at 8d2f51e0. */
+    readonly executable?: true;
+    /** An attestation's own `at`: which of two differing copies measured later. */
+    readonly at?: string;
+}
+export interface StoreIndex {
+    readonly format: 1;
+    readonly release: string;
+    readonly pushedAt: string;
+    readonly pushedBy: string;
+    readonly files: readonly IndexEntry[];
+}
+export declare function isReleaseId(id: string): boolean;
+/**
+ * Why a path may not be a file of a release — or null.
+ *
+ * Applied on both sides: a pull reads paths from the store, which is input
+ * from outside, and a path that climbs would write wherever it points; a
+ * push applies the same rule so it never writes an index a pull would
+ * refuse.
+ */
+export declare function entryPathProblem(p: unknown): string | null;
+/**
+ * The index as the store holds it — read as input from outside.
+ *
+ * Every path is checked before anything is written, every sum and size is
+ * checked for shape, and the index must describe the release it was asked
+ * for: an index copied from another release's prefix is refused here rather
+ * than by a sum three hundred objects later.
+ */
+export declare function parseIndex(bytes: Buffer, id: string, location: string): StoreIndex;
+export interface PartTally {
+    readonly files: number;
+    readonly bytes: number;
+}
+export interface KeptAttestation {
+    readonly path: string;
+    /** When the copy that stays measured. */
+    readonly kept: string | null;
+    /** When the copy that was offered and not taken measured. */
+    readonly offered: string | null;
+}
+export interface TransferOptions {
+    /** Where releases live on this machine. Default `~/.omnitron/releases`. */
+    readonly root?: string;
+    /** Objects in flight at once. Default 8: 548 statics files one by one is a minute on a remote store. */
+    readonly concurrency?: number;
+    /**
+     * Push only: write every object again even where the store's index already
+     * agrees with this disk.
+     *
+     * A push compares this disk with the store's INDEX, not with its objects —
+     * reading 60 MB back to learn that nothing changed would make every push a
+     * pull. So a store whose object was damaged after the push answers «already
+     * there» to a plain push, and the pull that found the damage had nobody to
+     * send the operator to. This is the repair: the index was just proved to
+     * describe the build on this disk, so rewriting the objects from it cannot
+     * put a different build in their place. An attestation the store holds a
+     * later copy of is still left alone.
+     */
+    readonly repair?: boolean;
+    /** After each object moves: how far, of how much. */
+    readonly onProgress?: (done: PartTally, total: PartTally) => void;
+}
+export interface TransferResult {
+    readonly id: string;
+    readonly location: string;
+    /** What the release in the store is made of now, part by part. */
+    readonly parts: Readonly<Record<ReleasePart, PartTally>>;
+    /** What this run moved. Nothing, when both sides already agreed. */
+    readonly moved: PartTally;
+    /** sha256 of the index the store holds after this run: the number two masters compare. */
+    readonly indexSha256: string;
+    /** Attestations left as they were, because the copy already there measured later. */
+    readonly keptNewer: readonly KeptAttestation[];
+}
+export interface PullResult extends TransferResult {
+    /** The release's directory on this machine. */
+    readonly root: string;
+    /** It was here before this pull, so only attestations could move. */
+    readonly alreadyHere: boolean;
+    /** What the manifest and `loadRelease` confirmed. */
+    readonly checked: {
+        readonly artifacts: number;
+        readonly statics: PartTally | null;
+    };
+}
+/**
+ * Put a release in the store.
+ *
+ * `loadRelease` first — a release that no longer matches its own manifest on
+ * this disk is not put anywhere else — and the static bundle against the
+ * manifest's count, which `loadRelease` does not check. Then the objects,
+ * each signed with its sum so the store refuses one that changed on the way,
+ * and the index last.
+ */
+export declare function pushRelease(id: string, store: ObjectStore, options?: TransferOptions): Promise<TransferResult>;
+/**
+ * Take a release out of the store onto this machine.
+ *
+ * Into a directory beside the releases root, checked three ways, then renamed
+ * into place: the release appears whole and checked, or not at all. When it
+ * is already here, everything but the attestations must be the same build,
+ * and only an attestation that measured later is taken.
+ */
+export declare function pullRelease(id: string, store: ObjectStore, options?: TransferOptions): Promise<PullResult>;
+export {};
+//# sourceMappingURL=artifact-store.d.ts.map

package/dist/release/artifact-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-store.d.ts","sourceRoot":"","sources":["../../src/release/artifact-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAWH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAS5D,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,cAAc,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAID,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,QASrB,CAAC;AAOb;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAgGjF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC,aAAa,CAAC,CA8BxB;AAYD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA2C/F;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAC3B,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,QAAQ,GAAG,gBAAgB,GAAG,QAAQ,CAAC,EAC/E,GAAG,EAAE,MAAM,GACV;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAiB7H;AAMD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACjF,wDAAwD;IACxD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC/D;AAoCD;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,WAAW;;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,YAAY,KAAK,EAAE,aAAa,EAAE,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,EAQ3F;IAED,4FAA4F;IAC5F,KAAK,IAAI,IAAI,CAEZ;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7E;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA4BrF;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAI;IAoDZ,0EAA0E;IAC1E,OAAO,CAAC,OAAO;CAqBhB;AASD,QAAA,MAAM,eAAe,YAAI,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAU,CAAC;AAErF,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAKD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAc1D;AAkFD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CA2ClF;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAmGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAiFD,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,wGAAwG;IACxG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA+CxH;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgHpH"}