@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/local-installation.js

@@ -0,0 +1,298 @@
+import { constants } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { validateReadiness } from '../health/contracts.js';
+import { CLOSURE_FILE } from './application-closure.js';
+import { assertFrozenDirectory as assertDirectory, frozenMember as member, extractFrozenArchive, verifyFrozenApplication, verifyFrozenPayload } from './frozen-installation.js';
+import { assertOwnerExecutable } from './owner-executable.js';
+import { releaseArtifactOrigins, assertImportableArtifact } from './origin.js';
+import { sha256File } from './portable-archive.js';
+import { RELEASE_RECEIPT, releaseTreeDigest } from './runtime-provenance.js';
+import { readInstalledReleaseReceipt, writeInstalledReleaseReceipt } from './installed-origin.js';
+import { assertReleaseTarget, releaseOptionsForEnv, targetRuntime } from './target-runtime.js';
+export class LocalReleaseNotPreparedError extends Error {
+}
+const digest = (s) => /^[a-f0-9]{64}$/.test(s);
+const componentPath = (s) => s.length <= 4096 && !s.includes('\\') && !s.includes(':') &&
+    !s.includes('\0') && s.split('/').every(part => part && part !== '.' && part !== '..');
+const absent = (e) => e.code === 'ENOENT';
+/** Preserve the existing remote bootstrap convention. Classic programs must actually publish their entry. */
+export async function describeReleaseLaunch(staged, entry, relativeScript) {
+    const file = entry.releaseEntry ?? (entry.bootstrap ? 'dist/bootstrap.js' : relativeScript);
+    if (!file || (!entry.releaseEntry && !entry.bootstrap && (!componentPath(file) || !/\.[cm]?js$/.test(file))))
+        return undefined;
+    const root = await fs.realpath(staged);
+    try {
+        await member(root, file);
+    }
+    catch (error) {
+        if (!entry.releaseEntry && !entry.bootstrap && absent(error))
+            return undefined;
+        throw error;
+    }
+    return { mode: entry.bootstrap ? 'bootstrap' : 'script', file, closureSha256: await sha256File(path.join(root, CLOSURE_FILE)) };
+}
+async function privateDirectory(parent, name) {
+    const dir = path.join(parent, name);
+    try {
+        await fs.mkdir(dir, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await assertDirectory(dir);
+    return dir;
+}
+async function verify(root, launch, entry, runtime, installed) {
+    const file = await verifyFrozenApplication(root, launch, runtime, releaseOptionsForEnv(entry.env));
+    // Archives cannot inject operational evidence. A prepared installation must match its exact admitted origin.
+    if (installed) {
+        const receipt = await readInstalledReleaseReceipt(root);
+        if (receipt.version !== 2 || !isDeepStrictEqual(receipt.origin, installed.origin) ||
+            receipt.ownerPackage !== installed.ownerPackage || receipt.nodeOptions !== releaseOptionsForEnv(entry.env) ||
+            !isDeepStrictEqual(receipt.target, runtime) || receipt.artifactPayloadUnchanged !== true ||
+            receipt.frameworkContentUnchanged !== true || receipt.installedFrameworkCommit !== installed.origin.frameworkCommit ||
+            receipt.treeSha256 !== await releaseTreeDigest(root))
+            throw Error('Local installed origin changed');
+    }
+    for (const name of installed ? ['.artifact-sha256'] : [RELEASE_RECEIPT, '.artifact-sha256']) {
+        if (await fs.lstat(path.join(root, name)).then(() => true, error => { if (absent(error))
+            return false; throw error; }))
+            throw Error('Unexpected operational metadata in local release: ' + name);
+    }
+    return file;
+}
+/** Selection is stored by the caller. This only materializes verified immutable inputs;
+ * it never installs packages, mutates an owner, or rewrites a developer checkout. */
+export async function inspectLocalReleaseInstallation(release, stack, entries, options = {}) {
+    if (!digest(release.manifestSha256))
+        throw Error('Invalid local release manifest digest');
+    const runtime = await targetRuntime();
+    const sources = new Map(releaseArtifactOrigins(release.manifest, release.manifestSha256).map(source => [source.app, source]));
+    const selected = entries.map(entry => {
+        const unique = release.manifest.artifacts.filter(a => a.app === entry.name), files = release.files.filter(f => f.app === entry.name);
+        const launch = unique[0]?.launch, artifact = files[0];
+        const source = sources.get(entry.name);
+        if (!source)
+            throw Error('No verified release artifact for ' + entry.name);
+        if (Boolean(unique[0]?.origin) !== Boolean(entry.releaseFrom))
+            throw Error('Configured application source differs from the selected release for ' + entry.name);
+        if (entry.releaseFrom && (unique[0]?.origin?.release !== entry.releaseFrom.release ||
+            unique[0]?.origin?.manifestSha256 !== entry.releaseFrom.manifestSha256 || unique[0]?.origin?.app !== entry.releaseFrom.app))
+            throw Error('The selected release does not carry the configured producer for ' + entry.name);
+        if (unique.length !== 1 || !launch || files.length !== 1 || !artifact || !digest(artifact.sha256) ||
+            artifact.sha256 !== unique[0].sha256 || !digest(launch.closureSha256) ||
+            (entry.releaseFrom ? !!entry.bootstrap || !!entry.script : !!entry.bootstrap === !!entry.script ||
+                launch.mode !== (entry.bootstrap ? 'bootstrap' : 'script')))
+            throw Error('No unique verified local launch for ' + stack + '/' + entry.name + '; rebuild with a packaged entry');
+        if (typeof launch.file !== 'string' || !componentPath(launch.file) || !/\.[cm]?js$/.test(launch.file))
+            throw Error('Expected a package-relative compiled JavaScript entry');
+        if (entry.readiness !== undefined)
+            validateReadiness(entry.readiness, launch.mode);
+        const builtFor = source.manifest.builtWith?.target;
+        try {
+            assertReleaseTarget(builtFor, runtime);
+        }
+        catch (error) {
+            throw Error('The local execution owner does not match the recorded release target for ' + entry.name, { cause: error });
+        }
+        const origin = source.origin;
+        return { launch, artifact, entry, origin };
+    });
+    if (!options.ownerPid)
+        throw Error('An authenticated local execution owner PID is required');
+    if (!options.ownerPackage || !path.isAbsolute(options.ownerPackage) || await fs.realpath(options.ownerPackage) !== options.ownerPackage)
+        throw Error('Verified runtime origin requires a proven physical execution-owner package');
+    const ownerPackage = options.ownerPackage;
+    const result = [];
+    await assertOwnerExecutable(options.ownerPid, runtime.executableSha256);
+    const releases = await fs.realpath(path.dirname(release.root));
+    const store = path.join(releases, '.installed'), group = path.join(store, release.manifestSha256);
+    if (options.prepare) {
+        await privateDirectory(releases, '.installed');
+        await privateDirectory(store, release.manifestSha256);
+    }
+    else {
+        try {
+            await assertDirectory(store);
+            await assertDirectory(group);
+        }
+        catch (error) {
+            if (!absent(error))
+                throw error;
+            throw new LocalReleaseNotPreparedError('Local release has not been prepared: ' + release.id, { cause: error });
+        }
+    }
+    for (const { launch, artifact, entry, origin } of selected) {
+        const binding = createHash('sha256').update(JSON.stringify({ origin, ownerPackage, nodeOptions: releaseOptionsForEnv(entry.env) })).digest('hex');
+        const root = path.join(group, artifact.sha256 + '-' + binding);
+        const exists = await fs.lstat(root).then(() => true, error => { if (!absent(error))
+            throw error; return false; });
+        if (!exists) {
+            if (!options.prepare)
+                throw new LocalReleaseNotPreparedError('Local release has not been prepared: ' + stack + '/' + entry.name);
+            const tmp = await fs.mkdtemp(path.join(group, '.install-'));
+            try {
+                const copied = path.join(tmp, 'archive'), contents = await privateDirectory(tmp, 'payload');
+                await fs.copyFile(artifact.path, copied, constants.COPYFILE_FICLONE);
+                if ((await fs.stat(copied)).size !== artifact.bytes || await sha256File(copied) !== artifact.sha256)
+                    throw Error('Local release archive changed before installation');
+                await extractFrozenArchive(copied, contents);
+                await verify(contents, launch, entry, runtime);
+                try {
+                    await fs.rename(contents, root);
+                }
+                catch (race) {
+                    if (!['EEXIST', 'ENOTEMPTY'].includes(race.code ?? ''))
+                        throw race;
+                }
+            }
+            finally {
+                await fs.rm(tmp, { recursive: true, force: true });
+            }
+        }
+        if (options.prepare && !await fs.lstat(path.join(root, RELEASE_RECEIPT)).then(() => true, error => {
+            if (absent(error))
+                return false;
+            throw error;
+        })) {
+            try {
+                await verify(root, launch, entry, runtime);
+                const receipt = { version: 2, root, origin, ownerPackage, target: runtime,
+                    nodeOptions: releaseOptionsForEnv(entry.env), treeSha256: await releaseTreeDigest(root),
+                    installedFrameworkCommit: origin.frameworkCommit, frameworkContentUnchanged: true, artifactPayloadUnchanged: true };
+                try {
+                    await writeInstalledReleaseReceipt(root, receipt);
+                }
+                catch (error) {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                }
+            }
+            catch (error) {
+                // Publication may race either payload verification or the seal's tree
+                // digest. It changes the directory metadata even though the receipt is
+                // excluded from the digest. Retry once, only against a complete receipt;
+                // exact origin, runtime and both payload digests are still verified.
+                if (!await fs.lstat(path.join(root, RELEASE_RECEIPT)).then(() => true, e => {
+                    if (absent(e))
+                        return false;
+                    throw e;
+                }))
+                    throw error;
+                await verify(root, launch, entry, runtime, { origin, ownerPackage });
+            }
+        }
+        const executable = await verify(root, launch, entry, runtime, { origin, ownerPackage });
+        for (const relative of options.requiredFiles?.[entry.name] ?? []) {
+            try {
+                await member(root, relative);
+            }
+            catch {
+                throw Error(`Requested release file is unavailable or is not a physical compiled member: ${entry.name}/${relative}`);
+            }
+        }
+        const { releaseFrom: _releaseFrom, ...runtimeEntry } = entry;
+        result.push({ ...runtimeEntry, ...(entry.releaseFrom ? { cwd: entry.cwd ?? root } : {}),
+            [launch.mode]: executable, releaseRoot: root, watch: false });
+    }
+    return result;
+}
+/** Materialize a payload without inventing a process or an execution-owner binding.
+ * Uses the existing release store and origin receipt; the payload's own target is
+ * checked against its closure, not asserted to be this host's execution runtime. */
+export async function inspectLocalReleasePayloads(release, entries, prepare = false) {
+    if (!digest(release.manifestSha256))
+        throw Error('Invalid local release manifest digest');
+    const sources = new Map(releaseArtifactOrigins(release.manifest, release.manifestSha256).map(source => [source.app, source]));
+    const selected = entries.map(entry => {
+        const source = sources.get(entry.name), artifacts = release.manifest.artifacts.filter(a => a.app === entry.name), files = release.files.filter(f => f.app === entry.name);
+        const artifact = artifacts[0], file = files[0];
+        if (!source || artifacts.length !== 1 || files.length !== 1 || !artifact || !file || !digest(file.sha256) || file.sha256 !== artifact.sha256 || file.bytes !== artifact.bytes)
+            throw Error('No unique verified local payload for ' + entry.name);
+        if (!isDeepStrictEqual(artifact.origin, entry.releaseFrom))
+            throw Error('Configured payload source differs from the selected release for ' + entry.name);
+        assertImportableArtifact(source.manifest, source.artifact);
+        const closureSha256 = source.artifact.closureSha256 ?? source.artifact.launch?.closureSha256;
+        if (!closureSha256 || !digest(closureSha256))
+            throw Error('Payload lacks an admitted closure: ' + entry.name);
+        return { source, file, closureSha256 };
+    });
+    const roots = new Map();
+    if (!selected.length)
+        return roots;
+    const releases = await fs.realpath(path.dirname(release.root)), store = path.join(releases, '.installed'), group = path.join(store, release.manifestSha256);
+    if (prepare) {
+        await privateDirectory(releases, '.installed');
+        await privateDirectory(store, release.manifestSha256);
+    }
+    else {
+        try {
+            await assertDirectory(store);
+            await assertDirectory(group);
+        }
+        catch (error) {
+            if (!absent(error))
+                throw error;
+            throw new LocalReleaseNotPreparedError('Local payload has not been prepared: ' + release.id, { cause: error });
+        }
+    }
+    for (const { source, file, closureSha256 } of selected) {
+        const { origin } = source;
+        const binding = createHash('sha256').update(JSON.stringify({ origin, use: 'artifact-volume' })).digest('hex');
+        const root = path.join(group, file.sha256 + '-' + binding);
+        const verifyPayload = () => verifyFrozenPayload(root, closureSha256, source.manifest.builtWith.target);
+        const exists = await fs.lstat(root).then(() => true, error => { if (absent(error))
+            return false; throw error; });
+        if (!exists) {
+            if (!prepare)
+                throw new LocalReleaseNotPreparedError('Local payload has not been prepared: ' + source.app);
+            const tmp = await fs.mkdtemp(path.join(group, '.install-'));
+            try {
+                const copied = path.join(tmp, 'archive'), payload = await privateDirectory(tmp, 'payload');
+                await fs.copyFile(file.path, copied, constants.COPYFILE_FICLONE | constants.COPYFILE_EXCL);
+                if ((await fs.stat(copied)).size !== file.bytes || await sha256File(copied) !== file.sha256)
+                    throw Error('Local release archive changed before installation');
+                await extractFrozenArchive(copied, payload);
+                await verifyFrozenPayload(payload, closureSha256, source.manifest.builtWith.target);
+                try {
+                    await fs.rename(payload, root);
+                }
+                catch (error) {
+                    if (!['EEXIST', 'ENOTEMPTY'].includes(error.code ?? ''))
+                        throw error;
+                }
+            }
+            finally {
+                await fs.rm(tmp, { recursive: true, force: true });
+            }
+        }
+        if (prepare && !await fs.lstat(path.join(root, RELEASE_RECEIPT)).then(() => true, error => { if (absent(error))
+            return false; throw error; })) {
+            await verifyPayload();
+            const receipt = { version: 1, root, origin, treeSha256: await releaseTreeDigest(root),
+                installedFrameworkCommit: origin.frameworkCommit, frameworkContentUnchanged: true, artifactPayloadUnchanged: true };
+            try {
+                await writeInstalledReleaseReceipt(root, receipt);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+        }
+        await verifyPayload();
+        const receipt = await readInstalledReleaseReceipt(root);
+        if (receipt.version !== 1 || !isDeepStrictEqual(receipt.origin, origin) || receipt.treeSha256 !== await releaseTreeDigest(root) ||
+            receipt.installedFrameworkCommit !== origin.frameworkCommit || receipt.frameworkContentUnchanged !== true || receipt.artifactPayloadUnchanged !== true)
+            throw Error('Local installed payload origin changed');
+        if (await fs.lstat(path.join(root, '.artifact-sha256')).then(() => true, error => { if (absent(error))
+            return false; throw error; }))
+            throw Error('Unexpected operational metadata in local release');
+        roots.set(source.app, root);
+    }
+    return roots;
+}
+//# sourceMappingURL=local-installation.js.map

package/dist/release/local-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-installation.js","sourceRoot":"","sources":["../../src/release/local-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,qBAAqB,IAAI,eAAe,EAAE,YAAY,IAAI,MAAM,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEhL,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAA8B,MAAM,uBAAuB,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAEnH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;CAAG;AAE1D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC5F,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AACzF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAAE,CAA2B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAE9E,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc,EAAE,KAAyB,EAAE,cAAuB;IAC5G,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/H,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACjC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/E,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AAClI,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,MAAqB,EAAE,KAAyB,EAAE,OAAsB,EAAE,SAAmE;IAC/K,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,6GAA6G;IAC7G,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC;YAC7E,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,IAAI,OAAO,CAAC,WAAW,KAAK,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;YAC1G,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,wBAAwB,KAAK,IAAI;YACxF,OAAO,CAAC,yBAAyB,KAAK,IAAI,IAAI,OAAO,CAAC,wBAAwB,KAAK,SAAS,CAAC,MAAM,CAAC,eAAe;YACnH,OAAO,CAAC,UAAU,KAAK,MAAM,iBAAiB,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC1G,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC5F,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;YACpH,MAAM,KAAK,CAAC,oDAAoD,GAAG,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;qFACqF;AACrF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAAsB,EAAE,KAAa,EAAE,OAAsC,EAAE,OAAO,GAAiI,EAAE;IAC7Q,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9H,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;QACrI,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,mCAAmC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YAC3D,MAAM,KAAK,CAAC,sEAAsE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACnG,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC,WAAW,CAAC,OAAO;YAC9E,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,KAAK,KAAK,CAAC,WAAW,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;YAC7H,MAAM,KAAK,CAAC,kEAAkE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC7F,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;YACtE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM;gBAC7F,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC/D,MAAM,KAAK,CAAC,sCAAsC,GAAG,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,iCAAiC,CAAC,CAAC;QACrH,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACnG,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QACnD,IAAI,CAAC;YAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC;QAC/C,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC,2EAA2E,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC7F,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,YAAY;QACrI,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAAC,CAAC;SAC1H,CAAC;QACJ,IAAI,CAAC;YAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAAC,MAAM,IAAI,4BAA4B,CAAC,uCAAuC,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;IACpK,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,4BAA4B,CAAC,uCAAuC,GAAG,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACjI,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC5F,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM;oBAAE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACtK,MAAM,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC7C,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/C,IAAI,CAAC;oBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAAC,CAAC;gBACxC,OAAO,IAAI,EAAE,CAAC;oBAAC,IAAI,CAAC,CAAC,QAAQ,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAE,IAA8B,CAAC,IAAI,IAAI,EAAE,CAAC;wBAAE,MAAM,IAAI,CAAC;gBAAC,CAAC;YAChH,CAAC;oBAAS,CAAC;gBAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;YAChG,IAAI,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAAC,MAAM,KAAK,CAAC;QAC/C,CAAC,CAAC,EAAE,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,CAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO;oBAChF,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC;oBACvF,wBAAwB,EAAE,MAAM,CAAC,eAAe,EAAE,yBAAyB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;gBACtH,IAAI,CAAC;oBAAC,MAAM,4BAA4B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAAC,CAAC;gBAC1D,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAC;gBAAC,CAAC;YACxF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,sEAAsE;gBACtE,uEAAuE;gBACvE,yEAAyE;gBACzE,qEAAqE;gBACrE,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE;oBACzE,IAAI,MAAM,CAAC,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;oBAAC,MAAM,CAAC,CAAC;gBACvC,CAAC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAChB,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACxF,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjE,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAAC,CAAC;YACrC,MAAM,CAAC;gBAAC,MAAM,KAAK,CAAC,+EAA+E,KAAK,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;YAAC,CAAC;QACjI,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;oFAEoF;AACpF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAsB,EAAE,OAAsC,EAAE,OAAO,GAAG,KAAK;IAC/H,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9H,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1K,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC3K,MAAM,KAAK,CAAC,uCAAuC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC,kEAAkE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACzJ,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7F,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAAE,MAAM,KAAK,CAAC,qCAAqC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9G,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5J,IAAI,OAAO,EAAE,CAAC;QAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAAC,CAAC;SAClH,CAAC;QACJ,IAAI,CAAC;YAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAAC,MAAM,IAAI,4BAA4B,CAAC,uCAAuC,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;IACpK,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,4BAA4B,CAAC,uCAAuC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3G,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC3F,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,gBAAgB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;gBAC3F,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM;oBAAE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAC9J,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC5C,MAAM,mBAAmB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;gBACrF,IAAI,CAAC;oBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAAC,CAAC;gBACvC,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;wBAAE,MAAM,KAAK,CAAC;gBAAC,CAAC;YACpH,CAAC;oBAAS,CAAC;gBAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9I,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,CAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC;gBAC5F,wBAAwB,EAAE,MAAM,CAAC,eAAe,EAAE,yBAAyB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;YACtH,IAAI,CAAC;gBAAC,MAAM,4BAA4B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAAC,CAAC;YAC1D,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;QACxF,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,iBAAiB,CAAC,IAAI,CAAC;YAC3H,OAAO,CAAC,wBAAwB,KAAK,MAAM,CAAC,eAAe,IAAI,OAAO,CAAC,yBAAyB,KAAK,IAAI,IAAI,OAAO,CAAC,wBAAwB,KAAK,IAAI;YACxJ,MAAM,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxD,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;YAClI,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAClE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/release/manifest.d.ts

@@ -14,11 +14,8 @@
  *     `@omnitron-dev/omnitron`, which the trail does not record at all, so
  *     «what is running there» cannot be answered from the row that says a
  *     deployment happened;
- *   - `daos` carries a 310-line GitHub Actions workflow and lives on a
- *     GitLab server, with no runner and no `.gitlab-ci.yml`, so the guard
- *     rail its own docblock describes — typecheck, lint, unit and
- *     integration — has never run anywhere but on somebody's laptop, when
- *     they remembered.
+ *   - a project carries checks for a CI provider it does not use, so the
+ *     expected typecheck, lint and tests never run on its release path.
  *
  * A release is the answer to all three: one object, built from a named
  * commit of BOTH repositories in a clean clone, carrying the artifacts by
@@ -33,6 +30,46 @@
  * repository does not live on. «Every required gate ran and passed» is
  * satisfied by none of those.
  */
+/** A local owner can launch this exact member without resolving anything in a developer checkout. */
+export interface ReleaseLaunch {
+    readonly mode: 'bootstrap' | 'script';
+    readonly file: string;
+    /** Binds the checked payload tree and execution target in .omnitron-closure.json to this manifest. */
+    readonly closureSha256: string;
+}
+/** Git evidence for the package compiled into this artifact. Paths use Git's slash separator. */
+export interface ReleasePackageSource {
+    /** Physical package path within project.commit. A repository-root package uses a single dot. */
+    readonly directory: string;
+    /** Git blob id of its package.json. */
+    readonly manifestBlob: string;
+    /** Package-relative tracked migration source files and SHA-256 of their contents. */
+    readonly migrations: Readonly<Record<string, string>>;
+    /** Declared entry provenance. Registry/configuration modules may evolve when
+     * migrations are added; these records are not an applied-migration ledger. */
+    readonly migrationPrograms?: readonly ReleaseMigrationProgram[];
+}
+export interface ReleaseMigrationProgram {
+    readonly mode: 'script' | 'config';
+    /** Physical package-relative source entry at project.commit. */
+    readonly source: string;
+    readonly sourceBlob: string;
+    readonly sourceSha256: string;
+    /** Physical compiled entry inside this artifact's verified closure. */
+    readonly release: string;
+    readonly releaseSha256: string;
+}
+/** A named application from an exact, independently admitted release. */
+export interface ReleaseArtifactReference {
+    readonly release: string;
+    readonly manifestSha256: string;
+    readonly app: string;
+}
+/** Exact manifest bytes retain their producer's digest across storage and publication. */
+export interface ReleaseManifestImport {
+    readonly sha256: string;
+    readonly manifestJson: string;
+}
 /** One packed application, identified by content rather than by name. */
 export interface ReleaseArtifact {
     readonly app: string;
@@ -55,6 +92,13 @@ export interface ReleaseArtifact {
      * the app running, as a deployment of the tree would.
      */
     readonly inputs?: string;
+    readonly launch?: ReleaseLaunch;
+    /** Payload proof independent of an executable entry. Older applications carry this in launch. */
+    readonly closureSha256?: string;
+    /** Older releases did not attribute migration files to individual packages. */
+    readonly packageSource?: ReleasePackageSource;
+    /** Consumer alias; all other metadata and archive bytes remain those of this producer. */
+    readonly origin?: ReleaseArtifactReference;
 }
 /**
  * What one gate answered.
@@ -114,6 +158,8 @@ export interface GateOutcome {
  * only its commits therefore names something that was true of two of them.
  */
 export interface BuiltWith {
+    /** Exact execution target of the frozen application archives. Absent in legacy manifests. */
+    readonly target?: import('./target-runtime.js').TargetRuntime;
     /** The omnitron that packed this, by its own version string. */
     readonly omnitron: string;
     /** Each linked package, and when the `dist` that went in was produced. */
@@ -124,12 +170,39 @@ export interface BuiltWith {
 }
 /** A repository and the commit taken from it. */
 export interface ReleaseSource {
+    /** Project directory inside this Git commit when the checkout contains multiple projects. */
+    readonly directory?: string;
+    /** Workspace that supplied the lock and gates when the selected config lives deeper in Git. */
+    readonly workspace?: string;
     readonly repo: string;
     readonly commit: string;
+    /** Explicit source constraint, when configured; no provider or branch is implied by its absence. */
+    readonly ref?: string;
+    /** Registry archives whose verified manifests named this exact source commit. */
+    readonly registry?: {
+        readonly packages: ReadonlyArray<{
+            readonly name: string;
+            readonly version: string;
+            readonly integrity: string;
+            readonly tarball?: string;
+        }>;
+    };
+    /** The project committed these archives; each was reproduced byte for byte from this upstream Git tree. */
+    readonly reproduced?: {
+        readonly tree: string;
+        readonly packages: ReadonlyArray<{
+            readonly name: string;
+            readonly version: string;
+            readonly file: string;
+            readonly integrity: string;
+        }>;
+    };
     /**
-     * Whether a remote-tracking branch contains the commit — null when the
-     * checkout has no remote refs to ask. A release built from a commit that
-     * exists on one laptop cannot be rebuilt by anyone else.
+     * Publication observed when building: true only when an origin ref
+     * advertises this commit or a provable descendant; false when unpublished,
+     * null when the remote or its ancestry cannot be verified. Historical
+     * manifests may have recorded cached tracking refs instead of an online
+     * observation. This field never establishes a deployment location.
      */
     readonly onRemote?: boolean | null;
 }
@@ -138,14 +211,16 @@ export interface ReleaseManifest {
     /** The project's repository and the commit this was built from. */
     readonly project: ReleaseSource;
     /**
-     * And omni's, because its packages are vendored into every artifact.
+     * The framework used for this project's own artifacts. Imported artifacts
+     * retain their producer's separate framework through their pinned origin.
      *
-     * The two live in different systems — omni on GitHub, the project on a
-     * self-hosted GitLab — which is why neither forge's CI can produce this
-     * object and the master can.
+     * Project and framework repositories may use different Git hosts. Their
+     * recorded identities and configured checks do not depend on a CI provider.
      */
     readonly omni: ReleaseSource;
     readonly artifacts: readonly ReleaseArtifact[];
+    /** Self-contained source evidence; imported archives do not depend on the producer store remaining present. */
+    readonly imports?: readonly ReleaseManifestImport[];
     /**
      * Applications whose artifact did not build, with the builder's words. A
      * release carrying them is still written — it is evidence — and a stack

package/dist/release/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1E,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,qEAAqE;QACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5D,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACrF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAa5D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,kBAAkB;AAC1B,0DAA0D;AAC1D,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CA6FjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gEAAgE;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACpF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CA2BjB"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACnC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;kFAC8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACjE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,CAAC;CAC5C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1E,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;IAC9D,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oGAAoG;IACpG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC9I,CAAC;IACF,2GAA2G;IAC3G,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC1I,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,qEAAqE;QACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5D,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACrF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAa5D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,kBAAkB;AAC1B,0DAA0D;AAC1D,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CA0GjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gEAAgE;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACpF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,YAAY,GAAE,SAAS,gBAAgB,EAAO,GAC7C,eAAe,CAkCjB"}

package/dist/release/manifest.js

@@ -14,11 +14,8 @@
  *     `@omnitron-dev/omnitron`, which the trail does not record at all, so
  *     «what is running there» cannot be answered from the row that says a
  *     deployment happened;
- *   - `daos` carries a 310-line GitHub Actions workflow and lives on a
- *     GitLab server, with no runner and no `.gitlab-ci.yml`, so the guard
- *     rail its own docblock describes — typecheck, lint, unit and
- *     integration — has never run anywhere but on somebody's laptop, when
- *     they remembered.
+ *   - a project carries checks for a CI provider it does not use, so the
+ *     expected typecheck, lint and tests never run on its release path.
  *
  * A release is the answer to all three: one object, built from a named
  * commit of BOTH repositories in a clean clone, carrying the artifacts by
@@ -33,6 +30,7 @@
  * repository does not live on. «Every required gate ran and passed» is
  * satisfied by none of those.
  */
+import { importedReleaseRefusal } from './origin.js';
 const SHA256 = /^[0-9a-f]{64}$/;
 /** How each non-pass reads in a refusal: which one it was is the finding. */
 const OUTCOME_WORDS = {
@@ -61,6 +59,22 @@ attestations = []) {
         // without this commit cannot be rebuilt and cannot be compared.
         return { action: 'refuse', because: 'the release does not name the omni commit its packages came from' };
     }
+    try {
+        const refusal = importedReleaseRefusal(manifest, policy.requiredApps);
+        if (refusal)
+            return { action: 'refuse', because: refusal };
+    }
+    catch (error) {
+        return { action: 'refuse', because: 'invalid imported release: ' + (error instanceof Error ? error.message : String(error)) };
+    }
+    const names = new Set();
+    if (!Array.isArray(manifest.gates) || manifest.gates.some(gate => {
+        if (!gate || typeof gate.name !== 'string' || !gate.name || names.has(gate.name) || !Object.hasOwn(OUTCOME_WORDS, gate.status))
+            return true;
+        names.add(gate.name);
+        return false;
+    }))
+        return { action: 'refuse', because: 'the release carries invalid or duplicate gate outcomes' };
     const byName = new Map(manifest.gates.map((g) => [g.name, g]));
     for (const required of policy.requiredGates) {
         const gate = byName.get(required);
@@ -150,6 +164,14 @@ attestations = []) {
  * config, where a reader can see it.
  */
 export function decideStackRelease(manifest, requirements, stackApps, attestations = []) {
+    try {
+        const refusal = requirements?.requireOnRemote ? importedReleaseRefusal(manifest, stackApps, true) : null;
+        if (refusal)
+            return { action: 'refuse', because: refusal };
+    }
+    catch (error) {
+        return { action: 'refuse', because: 'invalid imported release: ' + (error instanceof Error ? error.message : String(error)) };
+    }
     if (requirements?.requireOnRemote) {
         const local = [
             manifest.project.onRemote !== true ? `the project commit ${manifest.project.commit.slice(0, 8)}` : null,
@@ -158,11 +180,13 @@ export function decideStackRelease(manifest, requirements, stackApps, attestatio
         if (local.length > 0) {
             return {
                 action: 'refuse',
-                because: `${local.join(' and ')} ${local.length > 1 ? 'are' : 'is'} on no remote branch — nobody else could rebuild this release`,
+                because: `Source publication is not confirmed in this release for ${local.join(' and ')} — publish the commits and rebuild with a reachable origin`,
             };
         }
     }
-    const recorded = manifest.gates.map((g) => g.name);
+    if (!Array.isArray(manifest.gates))
+        return { action: 'refuse', because: 'the release carries invalid gate outcomes' };
+    const recorded = manifest.gates.map((g) => g?.name);
     if (recorded.length === 0) {
         return { action: 'refuse', because: 'the release recorded no gates at all' };
     }

package/dist/release/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA4MH,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,aAAa,GAA0C;IAC3D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,WAAW,EAAE,wBAAwB;IACrC,MAAM,EAAE,+BAA+B;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAyB,EACzB,MAA0B;AAC1B,0DAA0D;AAC1D,YAAY,GAAgC,EAAE;IAE9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3B,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,QAAQ,2CAA2C,EAAE,CAAC;QACzG,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,gBAAgB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACtF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,kCAAkC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACxG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,oEAAoE;YACpE,kEAAkE;YAClE,sEAAsE;YACtE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,2BAA2B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wCAAwC,GAAG,GAAG,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,EAAE,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,oDAAoD,KAAK,+DAA+D;aAClI,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,QAAQ,+CAA+C,KAAK,GAAG,EAAE,CAAC;YAC5G,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,IAAI,QAAQ,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,KAAK,GAAG;wBACvF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EACL,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,2BAA2B;YACzD,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,sBAAsB;YACnD,CAAC,MAAM,CAAC,UAAU;gBAChB,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,iBAAiB,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG;gBAChF,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAkCD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,YAAkD,EAClD,SAA4B,EAC5B,YAAY,GAAgC,EAAE;IAE9C,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG;YACZ,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YACvG,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;SAC/F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,+DAA+D;aAClI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,aAAa,CAClB,QAAQ,EACR;QACE,aAAa;QACb,YAAY,EAAE,SAAS;QACvB,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,EACD,YAAY,CACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/release/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAqRrD,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,aAAa,GAA0C;IAC3D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,WAAW,EAAE,wBAAwB;IACrC,MAAM,EAAE,+BAA+B;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAyB,EACzB,MAA0B;AAC1B,0DAA0D;AAC1D,YAAY,GAAgC,EAAE;IAE9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3B,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IAC3G,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAChI,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC/D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5I,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IACnG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,QAAQ,2CAA2C,EAAE,CAAC;QACzG,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,gBAAgB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACtF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,kCAAkC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACxG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,oEAAoE;YACpE,kEAAkE;YAClE,sEAAsE;YACtE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,2BAA2B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,aAAa,QAAQ,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wCAAwC,GAAG,GAAG,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,EAAE,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,oDAAoD,KAAK,+DAA+D;aAClI,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,QAAQ,+CAA+C,KAAK,GAAG,EAAE,CAAC;YAC5G,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,IAAI,QAAQ,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,KAAK,GAAG;wBACvF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EACL,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,2BAA2B;YACzD,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,sBAAsB;YACnD,CAAC,MAAM,CAAC,UAAU;gBAChB,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,iBAAiB,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG;gBAChF,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC;AAkCD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,YAAkD,EAClD,SAA4B,EAC5B,YAAY,GAAgC,EAAE;IAE9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzG,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG;YACZ,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YACvG,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;SAC/F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,2DAA2D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,4DAA4D;aACpJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACtH,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,aAAa,CAClB,QAAQ,EACR;QACE,aAAa;QACb,YAAY,EAAE,SAAS;QACvB,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,EACD,YAAY,CACb,CAAC;AACJ,CAAC"}

package/dist/release/migration-programs.d.ts

@@ -0,0 +1,12 @@
+import type { IEcosystemConfig } from '../config/types.js';
+import { type MigrationRequest } from '../services/migration-target.js';
+export type MigrationProgramInput = Pick<MigrationRequest, 'mode' | 'source' | 'release'>;
+export type PackedMigrationProgram = MigrationProgramInput & {
+    releaseSha256: string;
+};
+/** Reuse the deployment declaration policy. A file's spelling does not decide
+ * whether it owns a migration registry. No application or migration code runs. */
+export declare function declaredMigrationPrograms(config: IEcosystemConfig, forStack?: string): ReadonlyMap<string, readonly MigrationProgramInput[]>;
+/** Read the actual staged bytes before packing, never a later mutable dist. */
+export declare function packedMigrationPrograms(root: string, programs: readonly MigrationProgramInput[]): Promise<PackedMigrationProgram[]>;
+//# sourceMappingURL=migration-programs.d.ts.map

package/dist/release/migration-programs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-programs.d.ts","sourceRoot":"","sources":["../../src/release/migration-programs.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,EAAgD,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGtH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;AAC1F,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF;kFACkF;AAClF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAqB5I;AAED,+EAA+E;AAC/E,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,qBAAqB,EAAE,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAQzI"}