@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/release/manifest.js

@@ -0,0 +1,176 @@
+/**
+ * What a release is, and what earns one the right to reach a stack.
+ *
+ * There is one test server and one production estate, and any number of
+ * development machines. Today a deployment is whichever developer's disk
+ * reached the node last: the artifacts are compiled from that machine's
+ * working tree, by that machine's toolchain, and the only thing recorded
+ * afterwards is the project's commit. Measured over one day, that produced
+ * every failure this file exists to make impossible —
+ *
+ *   - two deployments ran concurrently and one emptied a package's `dist`
+ *     while the other compiled against it;
+ *   - an artifact's inputs included the deploying machine's own checkout of
+ *     `@omnitron-dev/omnitron`, which the trail does not record at all, so
+ *     «what is running there» cannot be answered from the row that says a
+ *     deployment happened;
+ *   - `sample` carries a 310-line GitHub Actions workflow and lives on a
+ *     GitLab server, with no runner and no `.gitlab-ci.yml`, so the guard
+ *     rail its own docblock describes — typecheck, lint, unit and
+ *     integration — has never run anywhere but on somebody's laptop, when
+ *     they remembered.
+ *
+ * A release is the answer to all three: one object, built from a named
+ * commit of BOTH repositories in a clean clone, carrying the artifacts by
+ * checksum, the outcome of every gate that was asked to run, and what it was
+ * built with. A stack accepts a release or refuses it; nothing else reaches
+ * test or production.
+ *
+ * The rule this file is built around, and the reason it is a module of its
+ * own with a suite of its own: **a gate that did not run is not a gate that
+ * passed.** «No gate failed» is satisfied by a scanner that was deleted, a
+ * suite whose runner exited before collecting, and a CI file for a forge the
+ * repository does not live on. «Every required gate ran and passed» is
+ * satisfied by none of those.
+ */
+const SHA256 = /^[0-9a-f]{64}$/;
+/** How each non-pass reads in a refusal: which one it was is the finding. */
+const OUTCOME_WORDS = {
+    passed: 'passed',
+    failed: 'failed',
+    'not-run': 'did not run',
+    'timed-out': 'did not answer in time',
+    killed: 'was killed before it answered',
+};
+/**
+ * May this release reach this stack?
+ *
+ * Every answer is a refusal until the last one, and each refusal names the
+ * single fact that produced it — the gate, the application, the field —
+ * because «policy not satisfied» sends the reader to re-derive what this
+ * already knows.
+ */
+export function decideRelease(manifest, policy, 
+/** What other stacks have verified about this release. */
+attestations = []) {
+    if (!manifest.project?.commit) {
+        return { action: 'refuse', because: 'the release does not name the project commit it was built from' };
+    }
+    if (!manifest.omni?.commit) {
+        // Not pedantry: omni's packages are inside every artifact, so a release
+        // without this commit cannot be rebuilt and cannot be compared.
+        return { action: 'refuse', because: 'the release does not name the omni commit its packages came from' };
+    }
+    const byName = new Map(manifest.gates.map((g) => [g.name, g]));
+    for (const required of policy.requiredGates) {
+        const gate = byName.get(required);
+        if (!gate) {
+            return { action: 'refuse', because: `the gate '${required}' is not in this release — it did not run` };
+        }
+        if (gate.status === 'not-run') {
+            return {
+                action: 'refuse',
+                because: `the gate '${required}' did not run${gate.detail ? `: ${gate.detail}` : ''}`,
+            };
+        }
+        if (gate.status === 'killed') {
+            return {
+                action: 'refuse',
+                because: `the gate '${required}' was killed before it answered${gate.detail ? `: ${gate.detail}` : ''}`,
+            };
+        }
+        if (gate.status === 'timed-out') {
+            // Refused, like every other non-pass — but named apart, because the
+            // answer to this one is «run it on a quiet machine», not «fix the
+            // code», and a trail that says `failed` sends the reader to the diff.
+            return {
+                action: 'refuse',
+                because: `the gate '${required}' did not answer in time${gate.detail ? `: ${gate.detail}` : ''}`,
+            };
+        }
+        if (gate.status === 'failed') {
+            return {
+                action: 'refuse',
+                because: `the gate '${required}' failed${gate.detail ? `: ${gate.detail}` : ''}`,
+            };
+        }
+    }
+    const artifacts = new Map(manifest.artifacts.map((a) => [a.app, a]));
+    for (const app of policy.requiredApps) {
+        const artifact = artifacts.get(app);
+        if (!artifact) {
+            return { action: 'refuse', because: `the release carries no artifact for '${app}'` };
+        }
+        if (!SHA256.test(artifact.sha256)) {
+            return { action: 'refuse', because: `the artifact for '${app}' carries no usable checksum` };
+        }
+        if (!(artifact.bytes > 0)) {
+            return { action: 'refuse', because: `the artifact for '${app}' is recorded as ${artifact.bytes} bytes` };
+        }
+    }
+    if (policy.verifiedOn) {
+        const { stack, gates } = policy.verifiedOn;
+        const attestation = attestations.find((a) => a.stack === stack && a.release === manifest.id);
+        if (!attestation) {
+            return {
+                action: 'refuse',
+                because: `nothing has been verified about this release on '${stack}' — production takes what a running system was measured to do`,
+            };
+        }
+        const byStack = new Map(attestation.gates.map((g) => [g.name, g]));
+        for (const required of gates) {
+            const gate = byStack.get(required);
+            if (!gate) {
+                return { action: 'refuse', because: `'${required}' has not been run against this release on '${stack}'` };
+            }
+            if (gate.status !== 'passed') {
+                return {
+                    action: 'refuse',
+                    because: `'${required}' ${OUTCOME_WORDS[gate.status]} against this release on '${stack}'` +
+                        (gate.detail ? `: ${gate.detail}` : ''),
+                };
+            }
+        }
+    }
+    return {
+        action: 'promote',
+        because: `${policy.requiredGates.length} gate(s) ran and passed, ` +
+            `${policy.requiredApps.length} artifact(s) present` +
+            (policy.verifiedOn
+                ? `, ${policy.verifiedOn.gates.length} verified on '${policy.verifiedOn.stack}'`
+                : ''),
+    };
+}
+/**
+ * May this release reach this stack, under what the stack declares?
+ *
+ * Absent requirements are the weakest honest reading, not a pass-through:
+ * every gate the release recorded must still have passed, and every app the
+ * stack runs must be in it. A stack that wants less must say so in its
+ * config, where a reader can see it.
+ */
+export function decideStackRelease(manifest, requirements, stackApps, attestations = []) {
+    if (requirements?.requireOnRemote) {
+        const local = [
+            manifest.project.onRemote !== true ? `the project commit ${manifest.project.commit.slice(0, 8)}` : null,
+            manifest.omni.onRemote !== true ? `the omni commit ${manifest.omni.commit.slice(0, 8)}` : null,
+        ].filter(Boolean);
+        if (local.length > 0) {
+            return {
+                action: 'refuse',
+                because: `${local.join(' and ')} ${local.length > 1 ? 'are' : 'is'} on no remote branch — nobody else could rebuild this release`,
+            };
+        }
+    }
+    const recorded = manifest.gates.map((g) => g.name);
+    if (recorded.length === 0) {
+        return { action: 'refuse', because: 'the release recorded no gates at all' };
+    }
+    const requiredGates = [...new Set([...recorded, ...(requirements?.requiredGates ?? [])])];
+    return decideRelease(manifest, {
+        requiredGates,
+        requiredApps: stackApps,
+        ...(requirements?.verifiedOn ? { verifiedOn: requirements.verifiedOn } : {}),
+    }, attestations);
+}
+//# sourceMappingURL=manifest.js.map

package/dist/release/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA4MH,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,aAAa,GAA0C;IAC3D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,WAAW,EAAE,wBAAwB;IACrC,MAAM,EAAE,+BAA+B;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAyB,EACzB,MAA0B;AAC1B,0DAA0D;AAC1D,YAAY,GAAgC,EAAE;IAE9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3B,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,QAAQ,2CAA2C,EAAE,CAAC;QACzG,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,gBAAgB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACtF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,kCAAkC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACxG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,oEAAoE;YACpE,kEAAkE;YAClE,sEAAsE;YACtE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,2BAA2B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wCAAwC,GAAG,GAAG,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,EAAE,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,oDAAoD,KAAK,+DAA+D;aAClI,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,QAAQ,+CAA+C,KAAK,GAAG,EAAE,CAAC;YAC5G,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,IAAI,QAAQ,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,KAAK,GAAG;wBACvF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EACL,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,2BAA2B;YACzD,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,sBAAsB;YACnD,CAAC,MAAM,CAAC,UAAU;gBAChB,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,iBAAiB,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG;gBAChF,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAkCD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,YAAkD,EAClD,SAA4B,EAC5B,YAAY,GAAgC,EAAE;IAE9C,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG;YACZ,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YACvG,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;SAC/F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,+DAA+D;aAClI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,aAAa,CAClB,QAAQ,EACR;QACE,aAAa;QACb,YAAY,EAAE,SAAS;QACvB,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,EACD,YAAY,CACb,CAAC;AACJ,CAAC"}

package/dist/release/migrations.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A migration that ran is history, not source.
+ *
+ * Once a migration has run on a stack, its file is a record of what that
+ * stack's schema went through, and the migrator on the node refuses one whose
+ * checksum moved — at the migration step of a deployment, after the build,
+ * the gates and the artifact transfer. On 2026-09-24 a function body a new
+ * migration recreated came within a commit of changing what an applied one
+ * had installed, and the only thing that would have said so was that step.
+ *
+ * So a release records the sha256 of every migration file it carries, and
+ * admission compares them with the release already running on the stack:
+ * a file that ran there and changed since is refused by name, before any node
+ * is touched. New files are what a release is for, and pass.
+ *
+ * Stricter than the node, on purpose: its migrator hashes the compiled text of
+ * `up` and `down`, this hashes the file — an edited comment the node would let
+ * through is refused here too. An applied file is history either way.
+ *
+ * «Ran there» is the stack's last start that succeeded (`stack.start`). A
+ * start that failed (`stack.start.failed`) may have applied the migrations it
+ * added before it failed; those are not compared here, and the node's
+ * migrator stays their judge.
+ */
+/** Every tracked migration file under `dir`: repository path → sha256 of its bytes. */
+export declare function migrationDigests(dir: string): Promise<Record<string, string>>;
+/**
+ * The migrations that ran with `deployed` and are not the same in
+ * `candidate`: edited, or gone. Added ones are not listed.
+ */
+export declare function changedReleasedMigrations(deployed: Readonly<Record<string, string>>, candidate: Readonly<Record<string, string>>): string[];
+//# sourceMappingURL=migrations.d.ts.map

package/dist/release/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAaH,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,MAAM,EAAE,CAIV"}

package/dist/release/migrations.js

@@ -0,0 +1,51 @@
+/**
+ * A migration that ran is history, not source.
+ *
+ * Once a migration has run on a stack, its file is a record of what that
+ * stack's schema went through, and the migrator on the node refuses one whose
+ * checksum moved — at the migration step of a deployment, after the build,
+ * the gates and the artifact transfer. On 2026-09-24 a function body a new
+ * migration recreated came within a commit of changing what an applied one
+ * had installed, and the only thing that would have said so was that step.
+ *
+ * So a release records the sha256 of every migration file it carries, and
+ * admission compares them with the release already running on the stack:
+ * a file that ran there and changed since is refused by name, before any node
+ * is touched. New files are what a release is for, and pass.
+ *
+ * Stricter than the node, on purpose: its migrator hashes the compiled text of
+ * `up` and `down`, this hashes the file — an edited comment the node would let
+ * through is refused here too. An applied file is history either way.
+ *
+ * «Ran there» is the stack's last start that succeeded (`stack.start`). A
+ * start that failed (`stack.start.failed`) may have applied the migrations it
+ * added before it failed; those are not compared here, and the node's
+ * migrator stays their judge.
+ */
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+/** A tracked file inside a `migrations` directory of an app. */
+const MIGRATION = /^apps\/[^/]+\/(?:.+\/)?migrations\/[^/]+\.(?:ts|mts|js|mjs|sql)$/;
+/** Every tracked migration file under `dir`: repository path → sha256 of its bytes. */
+export async function migrationDigests(dir) {
+    const { stdout } = await exec('git', ['ls-files', '-z', '--', 'apps'], { cwd: dir, maxBuffer: 64 * 1024 * 1024 });
+    const out = {};
+    for (const file of stdout.split('\0').filter((f) => MIGRATION.test(f)).sort()) {
+        out[file] = createHash('sha256').update(fs.readFileSync(path.join(dir, file))).digest('hex');
+    }
+    return out;
+}
+/**
+ * The migrations that ran with `deployed` and are not the same in
+ * `candidate`: edited, or gone. Added ones are not listed.
+ */
+export function changedReleasedMigrations(deployed, candidate) {
+    return Object.keys(deployed)
+        .filter((file) => candidate[file] !== deployed[file])
+        .sort();
+}
+//# sourceMappingURL=migrations.js.map

package/dist/release/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,gEAAgE;AAChE,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAErF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAClH,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA0C,EAC1C,SAA2C;IAE3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;SACpD,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/dist/release/publish.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Publishing the packages a release is built from, without publishing them
+ * to the wrong place.
+ *
+ * `sample` reaches into omni through 112 absolute `link:` paths into one
+ * developer's home directory, committed to the repository, and 122 more in
+ * its lockfile. No other machine can install it, which is why its CI has
+ * never run: there was nothing for a runner to install. The way out is a
+ * registry — the packages get versions, the project depends on versions, and
+ * any machine can build it.
+ *
+ * That makes publishing a thing this daemon does, and publishing is the one
+ * operation here that is irreversible and outward-facing. Three measurements
+ * from 2026-09-22 say what has to be true before it runs:
+ *
+ *   - `@omnitron-dev/titan` and `@omnitron-dev/common` already exist on the
+ *     PUBLIC npm registry, latest 0.2.0, published 2026-05-16;
+ *   - the local packages are also 0.2.0, four months of commits later, so
+ *     one version already names two different trees;
+ *   - `~/.npmrc` on the machine that would run this holds an auth token for
+ *     `registry.npmjs.org`.
+ *
+ * Those three together mean an accidental `pnpm -r publish` here does not
+ * fail — it succeeds, outward, into a scope that is already public, using a
+ * credential that is already loaded. Nothing in the repository prevents it:
+ * no package is `private`, none carries a `publishConfig`, and `.npmrc`
+ * scopes nothing.
+ *
+ * So this module refuses by default and is explicit about what it refuses.
+ */
+/** Where a publish is allowed to go, and what it is allowed to carry. */
+export interface PublishTarget {
+    /** The registry URL, as it will be written into a scoped `.npmrc` line. */
+    readonly registry: string;
+    /** The scope these packages live under, with its leading `@`. */
+    readonly scope: string;
+}
+export type PublishDecision = {
+    readonly action: 'publish';
+    readonly because: string;
+} | {
+    readonly action: 'refuse';
+    readonly because: string;
+};
+export declare function decidePublish(target: PublishTarget): PublishDecision;
+/**
+ * The `.npmrc` a publish runs with, and nothing else.
+ *
+ * Written to the build directory rather than the home one, and handed to npm
+ * through `npm_config_userconfig` so that `~/.npmrc` is not consulted at all
+ * — the machine that will run this has a `registry.npmjs.org` token in it,
+ * and a build that cannot see a credential cannot use it by mistake.
+ *
+ * The token is NOT passed through the environment. Any process of the same
+ * user can read another's environment — `ps eww <pid>` is how the shutdown
+ * window was verified on this very machine today — so an environment
+ * variable holding a publish token is readable for as long as the build
+ * runs.
+ */
+export declare function npmrcFor(target: PublishTarget, token: string): string;
+/**
+ * What a publish command may print.
+ *
+ * `npm config list` and `pnpm config list` print the contents of every
+ * config they loaded, tokens included, and a build log is a file that
+ * outlives the build. Measured today from a different pipe: connection
+ * strings of the form `redis://user:pass@host` reached the daemon log
+ * verbatim, so this is not hypothetical carelessness.
+ */
+export declare function redactTokens(text: string): string;
+//# sourceMappingURL=publish.d.ts.map

package/dist/release/publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/release/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAW5D,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CA2BpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAUrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIjD"}

package/dist/release/publish.js

@@ -0,0 +1,102 @@
+/**
+ * Publishing the packages a release is built from, without publishing them
+ * to the wrong place.
+ *
+ * `sample` reaches into omni through 112 absolute `link:` paths into one
+ * developer's home directory, committed to the repository, and 122 more in
+ * its lockfile. No other machine can install it, which is why its CI has
+ * never run: there was nothing for a runner to install. The way out is a
+ * registry — the packages get versions, the project depends on versions, and
+ * any machine can build it.
+ *
+ * That makes publishing a thing this daemon does, and publishing is the one
+ * operation here that is irreversible and outward-facing. Three measurements
+ * from 2026-09-22 say what has to be true before it runs:
+ *
+ *   - `@omnitron-dev/titan` and `@omnitron-dev/common` already exist on the
+ *     PUBLIC npm registry, latest 0.2.0, published 2026-05-16;
+ *   - the local packages are also 0.2.0, four months of commits later, so
+ *     one version already names two different trees;
+ *   - `~/.npmrc` on the machine that would run this holds an auth token for
+ *     `registry.npmjs.org`.
+ *
+ * Those three together mean an accidental `pnpm -r publish` here does not
+ * fail — it succeeds, outward, into a scope that is already public, using a
+ * credential that is already loaded. Nothing in the repository prevents it:
+ * no package is `private`, none carries a `publishConfig`, and `.npmrc`
+ * scopes nothing.
+ *
+ * So this module refuses by default and is explicit about what it refuses.
+ */
+/**
+ * Hosts that are never a destination for these packages.
+ *
+ * Named rather than derived: «not the configured registry» is already the
+ * rule below, and this list exists so the refusal for the one host that
+ * would actually accept them says WHY rather than «host mismatch».
+ */
+const PUBLIC_REGISTRIES = ['registry.npmjs.org', 'registry.yarnpkg.com'];
+export function decidePublish(target) {
+    let url;
+    try {
+        url = new URL(target.registry);
+    }
+    catch {
+        return { action: 'refuse', because: `'${target.registry}' is not a registry address` };
+    }
+    if (PUBLIC_REGISTRIES.includes(url.host)) {
+        return {
+            action: 'refuse',
+            because: `${url.host} is the public registry, and '${target.scope}' is already published there by someone — ` +
+                `a publish to it replaces public code or adds to it, and neither is what an internal release means`,
+        };
+    }
+    if (url.protocol !== 'https:' && url.hostname !== 'localhost' && url.hostname !== '127.0.0.1') {
+        // A token travels in a header on every request this makes.
+        return { action: 'refuse', because: `${target.registry} is not https, and the publish token travels with each request` };
+    }
+    if (!target.scope.startsWith('@')) {
+        return { action: 'refuse', because: `'${target.scope}' is not a scope — a scoped registry line needs one` };
+    }
+    return { action: 'publish', because: `${url.host} for ${target.scope}` };
+}
+/**
+ * The `.npmrc` a publish runs with, and nothing else.
+ *
+ * Written to the build directory rather than the home one, and handed to npm
+ * through `npm_config_userconfig` so that `~/.npmrc` is not consulted at all
+ * — the machine that will run this has a `registry.npmjs.org` token in it,
+ * and a build that cannot see a credential cannot use it by mistake.
+ *
+ * The token is NOT passed through the environment. Any process of the same
+ * user can read another's environment — `ps eww <pid>` is how the shutdown
+ * window was verified on this very machine today — so an environment
+ * variable holding a publish token is readable for as long as the build
+ * runs.
+ */
+export function npmrcFor(target, token) {
+    const url = new URL(target.registry);
+    const path = url.pathname.endsWith('/') ? url.pathname : `${url.pathname}/`;
+    const bare = `${url.host}${path}`;
+    return [
+        `${target.scope}:registry=${url.protocol}//${bare}`,
+        `//${bare}:_authToken=${token}`,
+        '//' + bare + ':always-auth=true',
+        '',
+    ].join('\n');
+}
+/**
+ * What a publish command may print.
+ *
+ * `npm config list` and `pnpm config list` print the contents of every
+ * config they loaded, tokens included, and a build log is a file that
+ * outlives the build. Measured today from a different pipe: connection
+ * strings of the form `redis://user:pass@host` reached the daemon log
+ * verbatim, so this is not hypothetical carelessness.
+ */
+export function redactTokens(text) {
+    return text
+        .replace(/(_authToken\s*=\s*)\S+/gi, '$1«redacted»')
+        .replace(/(:\/\/[^/\s:]+:)[^@\s]+(@)/g, '$1«redacted»$2');
+}
+//# sourceMappingURL=publish.js.map

package/dist/release/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/release/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAcH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;AAEzE,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,QAAQ,6BAA6B,EAAE,CAAC;IACzF,CAAC;IAED,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EACL,GAAG,GAAG,CAAC,IAAI,iCAAiC,MAAM,CAAC,KAAK,4CAA4C;gBACpG,mGAAmG;SACtG,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9F,2DAA2D;QAC3D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,gEAAgE,EAAE,CAAC;IAC3H,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,KAAK,qDAAqD,EAAE,CAAC;IAC9G,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,QAAQ,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAqB,EAAE,KAAa;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC;IAC5E,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,OAAO;QACL,GAAG,MAAM,CAAC,KAAK,aAAa,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE;QACnD,KAAK,IAAI,eAAe,KAAK,EAAE;QAC/B,IAAI,GAAG,IAAI,GAAG,mBAAmB;QACjC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CAAC,0BAA0B,EAAE,cAAc,CAAC;SACnD,OAAO,CAAC,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;AAC9D,CAAC"}

package/dist/release/store.d.ts

@@ -0,0 +1,174 @@
+/**
+ * What is on this master's disk, as a list.
+ *
+ * `load.ts` opens ONE release and checks every byte of it, because a
+ * deployment is about to ship it. A list is a different question: an operator
+ * looking at twenty releases in a console wants to know what each one is and
+ * what it is worth, and paying a sha256 over two gigabytes to draw a table
+ * would make the page unusable. So this reads manifests and sizes, says
+ * plainly when a directory has no manifest — a build that failed leaves its
+ * logs and nothing else — and leaves the verification to the deployment.
+ *
+ * Both readers use it: `commands/release.ts` prints these rows, and
+ * `services/release.rpc-service.ts` sends them to the console, so the two
+ * never drift into two answers about one disk.
+ */
+import { type StoredAttestation } from './attest.js';
+import { releasesRoot } from './load.js';
+import type { GateOutcome, ReleaseManifest } from './manifest.js';
+export { releasesRoot };
+/** One release, as a list shows it. */
+export interface ReleaseSummary {
+    readonly id: string;
+    /** The project it was built for, read back out of the id. */
+    readonly project: string;
+    /** False when the directory holds no manifest: a build that did not finish. */
+    readonly complete: boolean;
+    readonly builtAt: string | null;
+    readonly builtBy: string | null;
+    /** The omnitron that packed it — version and the omni commit it ran from. */
+    readonly builtWith: string | null;
+    readonly projectCommit: string | null;
+    readonly omniCommit: string | null;
+    readonly projectRepo: string | null;
+    readonly omniRepo: string | null;
+    /** Whether each commit is on a remote branch: `null` — there was no remote to ask. */
+    readonly onRemote: {
+        project: boolean | null;
+        omni: boolean | null;
+    };
+    /**
+     * One count per outcome word. `timedOut` and `killed` are optional in the
+     * TYPE only: the console reads daemons that predate them through a
+     * `Partial` of this shape. This side always writes them.
+     */
+    readonly gates: {
+        total: number;
+        passed: number;
+        failed: number;
+        notRun: number;
+        timedOut?: number;
+        killed?: number;
+    };
+    /**
+     * Every gate, in the order the build recorded them.
+     *
+     * Carried in the LIST and not only in the detail: «19 of 21» is not an
+     * answer to «can I deploy this», and a console that had to open each
+     * release to find out which gate failed would be asking twenty questions
+     * to make one decision.
+     */
+    readonly gateList: readonly GateOutcome[];
+    readonly artifacts: {
+        count: number;
+        bytes: number;
+        apps: string[];
+        failed: string[];
+    };
+    readonly statics: {
+        stack: string;
+        files: number;
+        bytes: number;
+    } | null;
+    /** What the release carries: artifacts, statics, gate logs. Not the clones. */
+    readonly bytes: number;
+    /** The build's clones are still on disk — kept on purpose, or left by a failure. */
+    readonly keptSource: boolean;
+    /**
+     * How loaded the machine was while the gates ran, when the build recorded
+     * it. A red gate on a machine carrying more than its cores is evidence
+     * about the machine first.
+     */
+    readonly machine: ReleaseManifest['machine'] | null;
+    /**
+     * What each stack measured about this release, in one line per stack.
+     *
+     * In the LIST, not only on the release's page: «has this been verified on
+     * test» is the promotion question, and it is asked in front of the list
+     * and of the stack, not after opening each release.
+     */
+    readonly verified: ReadonlyArray<{
+        stack: string;
+        passed: number;
+        total: number;
+        at: string;
+    }>;
+}
+/** A release in full, for one screen: the manifest, plus what is beside it. */
+export interface ReleaseDetail extends ReleaseSummary {
+    readonly manifest: ReleaseManifest | null;
+    readonly logs: ReadonlyArray<{
+        name: string;
+        bytes: number;
+    }>;
+    readonly root: string;
+    /** What each stack measured about this release after carrying it. */
+    readonly attestations: readonly StoredAttestation[];
+}
+/** `sample-202609221432-81c8a074-c64963f6` → `sample`; a name may hold dashes too. */
+export declare function projectOfId(id: string): string;
+/** Bytes under a directory. Unreadable or absent counts as zero, not as a failure. */
+export declare function dirBytes(dir: string): number;
+/** Every release on this machine, newest build first; unfinished ones last. */
+export declare function listReleases(root?: string): ReleaseSummary[];
+/**
+ * One release's manifest, unchecked — or null when there is none: not built
+ * here, pruned, or a build that did not finish.
+ *
+ * For comparing what a release says with what another one says, which needs
+ * neither the sizes of the directory nor a sha256 of its tarballs.
+ */
+export declare function readReleaseManifest(id: string, root?: string): ReleaseManifest | null;
+/** One release, with its manifest and the logs its build left. */
+export declare function readReleaseDetail(id: string, root?: string): ReleaseDetail;
+/**
+ * The tail of one of a release's logs.
+ *
+ * The console shows these while a build runs and after it fails, so the name
+ * is checked against the directory rather than joined blind: a log name is a
+ * file name, never a path.
+ */
+export declare function readReleaseLog(id: string, name: string, lines?: number, root?: string): {
+    name: string;
+    bytes: number;
+    tail: string;
+};
+export interface PruneResult {
+    /**
+     * What would go, oldest first. `bytes` is what the release carries;
+     * `keptSource` says it also holds a build root (two clones with their
+     * `node_modules`) whose size is NOT in `bytes` — measured 2026-09-25, six
+     * such roots were 12 of the 14 GB a prune reported as «2001.9 MB freed».
+     */
+    readonly doomed: ReadonlyArray<{
+        id: string;
+        bytes: number;
+        keptSource: boolean;
+    }>;
+    /** Removed for real, or empty when this was a dry run. */
+    readonly removed: readonly string[];
+    readonly kept: number;
+    readonly freedBytes: number;
+    /**
+     * Old enough to go, and kept because the caller protected it. Said apart
+     * from `kept` so the one who pruned sees WHY the release a stack runs is
+     * still here — and sees it at all.
+     */
+    readonly spared: readonly string[];
+}
+/**
+ * Remove all but the newest `keep` releases.
+ *
+ * Deliberately blunt and deliberately explicit: it does not know which
+ * release a stack is running — the `stack.start` rows do — so it never
+ * decides that for itself, and it deletes nothing unless told to
+ * (`apply`). `protect` is how a caller that DOES know keeps one: the console
+ * and `omnitron release prune` pass the releases their stacks last deployed.
+ */
+export declare function pruneReleases(options?: {
+    keep?: number;
+    apply?: boolean;
+    protect?: readonly string[];
+    root?: string;
+}): PruneResult;
+//# sourceMappingURL=store.d.ts.map

package/dist/release/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/release/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtH;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvF,QAAQ,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzE,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChG;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrD;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C;AA4CD,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuB5C;AA+DD,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAuB,GAAG,cAAc,EAAE,CAW5E;AAOD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,eAAe,GAAG,IAAI,CAErG;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,aAAa,CAe1F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,SAAM,EACX,IAAI,GAAE,MAAuB,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAU/C;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3F,WAAW,CAuBb"}