@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/migration-programs.js

@@ -0,0 +1,45 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs/promises';
+import { expandServiceDeclarations } from '../infrastructure/config-normalizer.js';
+import { mergeInfrastructure } from '../infrastructure/merge-config.js';
+import { createDefaultRegistry } from '../infrastructure/presets/index.js';
+import { requestedMigrations, validateMigrationOwners } from '../services/migration-target.js';
+import { frozenMember } from './frozen-installation.js';
+/** Reuse the deployment declaration policy. A file's spelling does not decide
+ * whether it owns a migration registry. No application or migration code runs. */
+export function declaredMigrationPrograms(config, forStack) {
+    const stacks = config.stacks ?? {};
+    if (forStack && !Object.hasOwn(stacks, forStack))
+        throw Error('Unknown release migration stack: ' + forStack);
+    const scopes = forStack ? [stacks[forStack]] : Object.values(stacks);
+    if (!scopes.length)
+        scopes.push({ type: 'local', apps: 'all' });
+    const result = new Map();
+    for (const stack of scopes) {
+        const services = expandServiceDeclarations(mergeInfrastructure(config, stack) ?? {}, createDefaultRegistry());
+        const requests = requestedMigrations(services);
+        const apps = config.apps.filter(app => app.enabled !== false && (!Array.isArray(stack.apps) || stack.apps.includes(app.name)));
+        validateMigrationOwners(requests, apps);
+        for (const { app, mode, source, release } of requests) {
+            const programs = result.get(app) ?? [];
+            const prior = programs.find(p => p.release === release);
+            if (prior && (prior.source !== source || prior.mode !== mode))
+                throw Error('Conflicting declared migration source for ' + app + '/' + release);
+            if (!prior)
+                programs.push({ mode, source, release });
+            result.set(app, programs);
+        }
+    }
+    return result;
+}
+/** Read the actual staged bytes before packing, never a later mutable dist. */
+export async function packedMigrationPrograms(root, programs) {
+    const result = [];
+    for (const program of programs) {
+        const file = await frozenMember(root, program.release);
+        const bytes = await fs.readFile(file);
+        result.push({ ...program, releaseSha256: createHash('sha256').update(bytes).digest('hex') });
+    }
+    return result;
+}
+//# sourceMappingURL=migration-programs.js.map

package/dist/release/migration-programs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-programs.js","sourceRoot":"","sources":["../../src/release/migration-programs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAyB,MAAM,iCAAiC,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD;kFACkF;AAClF,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAiB;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,MAAM,KAAK,CAAC,mCAAmC,GAAG,QAAQ,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/H,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;gBAC3D,MAAM,KAAK,CAAC,4CAA4C,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,QAA0C;IACpG,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/release/migrations.d.ts

@@ -22,11 +22,22 @@
  * added before it failed; those are not compared here, and the node's
  * migrator stays their judge.
  */
-/** Every tracked migration file under `dir`: repository path → sha256 of its bytes. */
+import type { ReleaseManifest, ReleasePackageSource } from './manifest.js';
+import type { PackedMigrationProgram } from './migration-programs.js';
+export declare function releaseMigrationSources(workspace: string, commit: string, packageDirectories: readonly string[], programs?: readonly (PackedMigrationProgram & {
+    directory: string;
+})[]): Promise<{
+    migrations: Record<string, string>;
+    packages: Map<string, ReleasePackageSource>;
+}>;
+/** Existing workspace inventory, also used by release admission for older releases. */
 export declare function migrationDigests(dir: string): Promise<Record<string, string>>;
 /**
  * The migrations that ran with `deployed` and are not the same in
  * `candidate`: edited, or gone. Added ones are not listed.
  */
 export declare function changedReleasedMigrations(deployed: Readonly<Record<string, string>>, candidate: Readonly<Record<string, string>>): string[];
+/** A consumer's workspace migration map cannot describe another producer's
+ * schema history. Compare the physical package that supplied each retained app. */
+export declare function changedImportedMigrations(deployed: ReleaseManifest, candidate: ReleaseManifest, apps: readonly string[]): string[];
 //# sourceMappingURL=migrations.d.ts.map

package/dist/release/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAaH,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,MAAM,EAAE,CAIV"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAoBtE,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACpH,QAAQ,GAAE,SAAS,CAAC,sBAAsB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAAO,GAAG,OAAO,CAAC;IACrF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CACjF,CAAC,CAoED;AAED,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAGnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,MAAM,EAAE,CAIV;AAED;mFACmF;AACnF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAqBlI"}

package/dist/release/migrations.js

@@ -27,17 +27,107 @@ import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
+import { artifactReleaseContexts } from './origin.js';
+import { migrationEntryPath } from '../services/migration-target.js';
 const exec = promisify(execFile);
-/** A tracked file inside a `migrations` directory of an app. */
-const MIGRATION = /^apps\/[^/]+\/(?:.+\/)?migrations\/[^/]+\.(?:ts|mts|js|mjs|sql)$/;
-/** Every tracked migration file under `dir`: repository path → sha256 of its bytes. */
-export async function migrationDigests(dir) {
-    const { stdout } = await exec('git', ['ls-files', '-z', '--', 'apps'], { cwd: dir, maxBuffer: 64 * 1024 * 1024 });
-    const out = {};
-    for (const file of stdout.split('\0').filter((f) => MIGRATION.test(f)).sort()) {
-        out[file] = createHash('sha256').update(fs.readFileSync(path.join(dir, file))).digest('hex');
+/** Migration filenames the existing stack admission policy recognizes. */
+const MIGRATION = /(?:^|\/)migrations\/[^/]+\.(?:ts|mts|js|mjs|sql)$/;
+/** Read a tracked regular file as it exists in the checked-out package, and prove
+ * its bytes against the named Git object. Gates and builds can change a checkout. */
+function checkedBlob(root, file, mode, object) {
+    const full = path.join(root, file);
+    if (!/^100(?:644|755)$/.test(mode) || fs.realpathSync(full) !== full || !fs.lstatSync(full).isFile())
+        throw Error('Release source must be a physical tracked file: ' + file);
+    const bytes = fs.readFileSync(full);
+    const oid = createHash(object.length === 64 ? 'sha256' : 'sha1')
+        .update('blob ' + bytes.length + '\0').update(bytes).digest('hex');
+    if (oid !== object)
+        throw Error('Release source differs from its Git commit: ' + file);
+    return bytes;
+}
+export async function releaseMigrationSources(workspace, commit, packageDirectories, programs = []) {
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(commit))
+        throw Error('Expected the full release source commit');
+    const root = fs.realpathSync((await exec('git', ['rev-parse', '--show-toplevel'], { cwd: workspace })).stdout.trimEnd());
+    const physicalWorkspace = fs.realpathSync(workspace);
+    const prefix = path.relative(root, physicalWorkspace).split(path.sep).join('/');
+    const declared = new Set();
+    for (const program of programs) {
+        if (!packageDirectories.includes(program.directory) || !['config', 'script'].includes(program.mode) ||
+            typeof program.releaseSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(program.releaseSha256))
+            throw Error('Invalid packed migration program');
+        migrationEntryPath(program.source, 'source');
+        migrationEntryPath(program.release, 'release');
+        if (!/\.[cm]?js$/.test(program.release))
+            throw Error('A released migration must name a compiled JavaScript module');
+        declared.add(path.posix.join(prefix, program.directory, program.source));
+    }
+    const { stdout } = await exec('git', ['--no-replace-objects', '--literal-pathspecs', 'ls-tree', '-r', '-z', '--full-tree',
+        commit, '--', prefix || '.'], { cwd: root, maxBuffer: 64 * 1024 * 1024 });
+    const files = new Map();
+    for (const record of stdout.split('\0').filter(Boolean)) {
+        const tab = record.indexOf('\t'), [mode, kind, oid] = record.slice(0, tab).split(' ');
+        const file = record.slice(tab + 1);
+        if (kind === 'blob' && (path.posix.basename(file) === 'package.json' || MIGRATION.test(file) || declared.has(file)))
+            files.set(file, { mode: mode, oid: oid });
+    }
+    const packages = new Map();
+    const owned = new Map();
+    for (const input of new Set(packageDirectories)) {
+        const directory = input.split(path.sep).join('/');
+        if (directory !== '.' && directory.split('/').some(p => !p || p === '.' || p === '..' || /[\\:\0]/.test(p)))
+            throw Error('Invalid release package directory: ' + input);
+        const pkg = path.posix.join(prefix, directory), file = path.posix.join(pkg, 'package.json'), tracked = files.get(file);
+        if (!tracked)
+            throw Error('Compiled package has no tracked package.json: ' + file);
+        checkedBlob(root, file, tracked.mode, tracked.oid);
+        const migrations = {};
+        owned.set(pkg, migrations);
+        packages.set(input, { directory: pkg, manifestBlob: tracked.oid, migrations });
+    }
+    const migrations = {};
+    const packageOf = (file) => {
+        let owner = path.posix.dirname(file);
+        while (owner !== '.' && !files.has(path.posix.join(owner, 'package.json')))
+            owner = path.posix.dirname(owner);
+        return owner;
+    };
+    for (const [file, blob] of files) {
+        if (!MIGRATION.test(file))
+            continue;
+        // Attribute a file to its nearest tracked package, even if that nested
+        // package is not among the applications selected for this release.
+        const owner = packageOf(file);
+        const scoped = owned.get(owner);
+        const workspaceFile = prefix ? file.slice(prefix.length + 1) : file;
+        const stackFile = /^apps\/[^/]+\/(?:.+\/)?migrations\//.test(workspaceFile);
+        if (!scoped && !stackFile)
+            continue;
+        const digest = createHash('sha256').update(checkedBlob(root, file, blob.mode, blob.oid)).digest('hex');
+        if (scoped)
+            scoped[path.posix.relative(owner, file)] = digest;
+        migrations[workspaceFile] = digest;
     }
-    return out;
+    for (const program of programs) {
+        const source = packages.get(program.directory);
+        const file = path.posix.join(source.directory, program.source), blob = files.get(file);
+        if (!blob || packageOf(file) !== source.directory)
+            throw Error('Declared migration source is not tracked by its owning package: ' + file);
+        const sourceSha256 = createHash('sha256').update(checkedBlob(root, file, blob.mode, blob.oid)).digest('hex');
+        const entry = { mode: program.mode, source: program.source, sourceBlob: blob.oid, sourceSha256,
+            release: program.release, releaseSha256: program.releaseSha256 };
+        const previous = source.migrationPrograms?.find(p => p.release === entry.release);
+        if (previous && JSON.stringify(previous) !== JSON.stringify(entry))
+            throw Error('Conflicting migration program provenance: ' + file);
+        if (!previous)
+            packages.set(program.directory, { ...source, migrationPrograms: [...(source.migrationPrograms ?? []), entry] });
+    }
+    return { migrations, packages };
+}
+/** Existing workspace inventory, also used by release admission for older releases. */
+export async function migrationDigests(dir) {
+    const { stdout } = await exec('git', ['rev-parse', 'HEAD'], { cwd: dir });
+    return (await releaseMigrationSources(dir, stdout.trim(), [])).migrations;
 }
 /**
  * The migrations that ran with `deployed` and are not the same in
@@ -48,4 +138,29 @@ export function changedReleasedMigrations(deployed, candidate) {
         .filter((file) => candidate[file] !== deployed[file])
         .sort();
 }
+/** A consumer's workspace migration map cannot describe another producer's
+ * schema history. Compare the physical package that supplied each retained app. */
+export function changedImportedMigrations(deployed, candidate, apps) {
+    const changes = [];
+    const oldSources = new Map(artifactReleaseContexts(deployed).map(source => [source.app, source]));
+    const newSources = new Map(artifactReleaseContexts(candidate).map(source => [source.app, source]));
+    for (const app of apps) {
+        const previous = deployed.artifacts.find(artifact => artifact.app === app);
+        const next = candidate.artifacts.find(artifact => artifact.app === app);
+        if (!previous || !next || (!previous.origin && !next.origin))
+            continue;
+        const before = oldSources.get(app), after = newSources.get(app);
+        const oldPackage = before.artifact.packageSource, newPackage = after.artifact.packageSource;
+        if (!oldPackage || !newPackage) {
+            changes.push(app + ': migration provenance is unavailable for one of the producer packages');
+            continue;
+        }
+        if (Object.keys(oldPackage.migrations).length && (before.manifest.project.repo !== after.manifest.project.repo || oldPackage.directory !== newPackage.directory)) {
+            changes.push(app + ': the package that owns existing migrations changed');
+            continue;
+        }
+        changes.push(...changedReleasedMigrations(oldPackage.migrations, newPackage.migrations).map(file => app + '/' + file));
+    }
+    return changes;
+}
 //# sourceMappingURL=migrations.js.map

package/dist/release/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,gEAAgE;AAChE,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAErF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAClH,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA0C,EAC1C,SAA2C;IAE3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;SACpD,IAAI,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/release/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,SAAS,GAAG,mDAAmD,CAAC;AAEtE;qFACqF;AACrF,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,MAAc;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;QAClG,MAAM,KAAK,CAAC,kDAAkD,GAAG,IAAI,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;SAC7D,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,KAAK,CAAC,8CAA8C,GAAG,IAAI,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB,EAAE,MAAc,EAAE,kBAAqC,EACpH,QAAQ,GAAgE,EAAE;IAG1E,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzH,MAAM,iBAAiB,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAC/F,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5F,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACpH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa;QACvH,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,cAAc,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAK,EAAE,GAAG,EAAE,GAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzG,MAAM,KAAK,CAAC,qCAAqC,GAAG,KAAK,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvH,IAAI,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,gDAAgD,GAAG,IAAI,CAAC,CAAC;QACnF,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,MAAM,SAAS,GAAG,qCAAqC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,SAAS;QACpC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvG,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;QAC9D,UAAU,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS;YAC/C,MAAM,KAAK,CAAC,kEAAkE,GAAG,IAAI,CAAC,CAAC;QACzF,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7G,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY;YAC5F,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;QAClF,IAAI,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;QACrI,IAAI,CAAC,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA0C,EAC1C,SAA2C;IAE3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;SACpD,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,yBAAyB,CAAC,QAAyB,EAAE,SAA0B,EAAE,IAAuB;IACtH,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,EAAE,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAClE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5F,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,wEAAwE,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjK,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,qDAAqD,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/release/origin.d.ts

@@ -0,0 +1,33 @@
+import type { ReleaseArtifact, ReleaseArtifactReference, ReleaseManifest } from './manifest.js';
+import { type ReleaseArtifactOrigin } from './installed-origin.js';
+/** The outer manifest includes JSON-escaped producer evidence, bounded separately below. */
+export declare const MAX_RELEASE_MANIFEST_BYTES = 8388608;
+/** Safe to display as recorded evidence. Empty checksums and zero-byte artifacts stay
+ * readable so admission can explain their refusal; readability never grants admission. */
+export declare function isReadableReleaseManifest(value: unknown): value is ReleaseManifest;
+export declare function assertReleaseArtifactReference(value: unknown): asserts value is ReleaseArtifactReference;
+export interface ArtifactReleaseContext {
+    /** The actual producer of these bytes, never the consumer's source or SDK. */
+    readonly manifest: ReleaseManifest;
+    readonly artifact: ReleaseArtifact;
+    /** Ordered from the direct dependency to the original producer. */
+    readonly chain: readonly ReleaseArtifactReference[];
+}
+/** An import is an independently portable application, not a claim inferred from a legacy tar. */
+export declare function assertImportableArtifact(manifest: ReleaseManifest, artifact: ReleaseArtifact): void;
+/** Shared by build, admission, receipts and diagnostics. No application JavaScript executes. */
+export declare function artifactReleaseContext(manifest: ReleaseManifest, app: string): ArtifactReleaseContext;
+/** Every origin must resolve, including artifacts outside the currently selected stack. */
+export declare function artifactReleaseContexts(manifest: ReleaseManifest): ReadonlyArray<ArtifactReleaseContext & {
+    readonly app: string;
+}>;
+/** One receipt mapping for local installation and remote delivery. Imported bytes
+ * always retain the original producer; only the launch alias belongs to the consumer. */
+export declare function releaseArtifactOrigins(manifest: ReleaseManifest, manifestSha256: string): ReadonlyArray<ArtifactReleaseContext & {
+    readonly app: string;
+    readonly origin: ReleaseArtifactOrigin;
+}>;
+export declare function validateReleaseOrigins(manifest: ReleaseManifest): void;
+/** Dependencies are independent releases: consumer gates never stand in for producer gates. */
+export declare function importedReleaseRefusal(manifest: ReleaseManifest, apps: readonly string[], requireOnRemote?: boolean): string | null;
+//# sourceMappingURL=origin.d.ts.map

package/dist/release/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/release/origin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChG,OAAO,EAAe,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAShF,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,UAAY,CAAC;AAQpD;0FAC0F;AAC1F,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CA8BlF;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,wBAAwB,CAMxG;AAED,MAAM,WAAW,sBAAsB;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACrD;AAuED,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAYnG;AAmBD,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAErG;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,aAAa,CAAC,sBAAsB,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAOnI;AAED;yFACyF;AACzF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,GACtF,aAAa,CAAC,sBAAsB,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAqBzG;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,eAAe,UAAQ,GAAG,MAAM,GAAG,IAAI,CAuBjI"}

package/dist/release/origin.js

@@ -0,0 +1,253 @@
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { validOrigin } from './installed-origin.js';
+import { assertReleaseRepositoryIdentities, isSafeRepositoryIdentity } from './repository-identity.js';
+import { isFrameworkRef } from '../shared/framework-source.js';
+const SHA = /^[a-f0-9]{64}$/;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const sha256 = (value) => typeof value === 'string' && SHA.test(value);
+const commit = (value) => typeof value === 'string' && COMMIT.test(value);
+/** The outer manifest includes JSON-escaped producer evidence, bounded separately below. */
+export const MAX_RELEASE_MANIFEST_BYTES = 8_388_608;
+const MAX_BYTES = 4_194_304, MAX_IMPORTS = 64, MAX_DEPTH = 8;
+const identifier = (value) => typeof value === 'string' && value.length <= 256 && ID.test(value) && !value.includes('..');
+const relative = (value) => typeof value === 'string' && value.length <= 4096 &&
+    !/[\\:\0]/.test(value) && value.split('/').every(part => part && part !== '.' && part !== '..');
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const outcomes = ['passed', 'failed', 'not-run', 'timed-out', 'killed'];
+/** Safe to display as recorded evidence. Empty checksums and zero-byte artifacts stay
+ * readable so admission can explain their refusal; readability never grants admission. */
+export function isReadableReleaseManifest(value) {
+    if (!object(value) || !identifier(value['id']) || !object(value['project']) || !object(value['omni']) ||
+        [value['project'], value['omni']].some(source => !isSafeRepositoryIdentity(source['repo']) || typeof source['commit'] !== 'string' ||
+            (source['ref'] !== undefined && !isFrameworkRef(source['ref'])) ||
+            (source['onRemote'] !== undefined && source['onRemote'] !== null && typeof source['onRemote'] !== 'boolean')) ||
+        !Array.isArray(value['artifacts']) || value['artifacts'].length > 256 || !Array.isArray(value['gates']) || value['gates'].length > 256 ||
+        !object(value['builtWith']) || typeof value['builtWith']['omnitron'] !== 'string' || !Array.isArray(value['builtWith']['packages']) ||
+        value['builtWith']['packages'].some(pkg => !object(pkg) || typeof pkg['name'] !== 'string' || typeof pkg['distBuiltAt'] !== 'string') ||
+        (value['builtAt'] !== undefined && typeof value['builtAt'] !== 'string') || (value['builtBy'] !== undefined && typeof value['builtBy'] !== 'string'))
+        return false;
+    const apps = new Set(), gates = new Set();
+    for (const artifact of value['artifacts']) {
+        if (!object(artifact) || !identifier(artifact['app']) || apps.has(artifact['app']) || typeof artifact['version'] !== 'string' ||
+            typeof artifact['sha256'] !== 'string' || !Number.isSafeInteger(artifact['bytes']) || artifact['bytes'] < 0)
+            return false;
+        apps.add(artifact['app']);
+    }
+    for (const gate of value['gates']) {
+        if (!object(gate) || typeof gate['name'] !== 'string' || !gate['name'] || gates.has(gate['name']) || !outcomes.includes(gate['status']) ||
+            ['detail', 'output'].some(key => gate[key] !== undefined && typeof gate[key] !== 'string') ||
+            ['durationMs', 'checks'].some(key => gate[key] !== undefined && (typeof gate[key] !== 'number' || !Number.isFinite(gate[key]) || gate[key] < 0)))
+            return false;
+        gates.add(gate['name']);
+    }
+    if (value['artifactFailures'] !== undefined && (!Array.isArray(value['artifactFailures']) || value['artifactFailures'].some(failure => !object(failure) || typeof failure['app'] !== 'string' || typeof failure['error'] !== 'string')))
+        return false;
+    if (value['statics'] !== undefined && (!object(value['statics']) || typeof value['statics']['stack'] !== 'string' || typeof value['statics']['dir'] !== 'string' ||
+        !Number.isSafeInteger(value['statics']['files']) || !Number.isSafeInteger(value['statics']['bytes'])))
+        return false;
+    const machine = value['machine'];
+    if (machine != null && (!object(machine) || typeof machine['cpus'] !== 'number' ||
+        ['loadAtGateStart', 'loadAtGateEnd'].some(key => !Array.isArray(machine[key]) || machine[key].length !== 3 ||
+            machine[key].some((number) => typeof number !== 'number' || !Number.isFinite(number)))))
+        return false;
+    return true;
+}
+export function assertReleaseArtifactReference(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw Error('Expected an exact release artifact reference');
+    const ref = value;
+    if (!identifier(ref.release) || !identifier(ref.app) || !sha256(ref.manifestSha256) ||
+        Object.keys(ref).some(key => !['release', 'app', 'manifestSha256'].includes(key)))
+        throw Error('Expected a release id, application name and full manifest SHA-256');
+}
+/** Validate all embedded evidence once per operation. Exact JSON bytes are retained, not
+ * reserialized approximations. Bounds apply to the whole graph, including unused records. */
+function evidence(root) {
+    const result = new Map();
+    const parsed = new Map();
+    let total = 0;
+    const visit = (manifest, depth, ancestors) => {
+        assertReleaseRepositoryIdentities(manifest);
+        if (depth > MAX_DEPTH)
+            throw Error('Imported release chain exceeds eight levels');
+        if (result.has(manifest))
+            return;
+        const imports = manifest.imports ?? [];
+        if (!Array.isArray(imports) || imports.length > MAX_IMPORTS)
+            throw Error('Invalid imported release inventory');
+        const sources = new Map();
+        result.set(manifest, sources);
+        for (const record of imports) {
+            if (!record || !sha256(record.sha256) || typeof record.manifestJson !== 'string' ||
+                Buffer.byteLength(record.manifestJson) > MAX_BYTES || sources.has(record.sha256))
+                throw Error('Invalid or duplicate imported release manifest');
+            if (ancestors.has(record.sha256))
+                throw Error('Cyclic imported release manifests');
+            let source = parsed.get(record.sha256);
+            if (source) {
+                if (source.raw !== record.manifestJson)
+                    throw Error('Imported release digest identifies conflicting bytes');
+            }
+            else {
+                total += Buffer.byteLength(record.manifestJson);
+                if (total > MAX_BYTES || parsed.size >= MAX_IMPORTS)
+                    throw Error('Imported release evidence exceeds its size limit');
+                if (createHash('sha256').update(record.manifestJson).digest('hex') !== record.sha256)
+                    throw Error('Imported release manifest does not match its pinned digest');
+                let value;
+                try {
+                    value = JSON.parse(record.manifestJson);
+                }
+                catch {
+                    throw Error('Imported release manifest is not valid JSON');
+                }
+                assertReleaseRepositoryIdentities(value);
+                if (!isReadableReleaseManifest(value) || !commit(value.project.commit) || !value.project.repo ||
+                    !commit(value.omni.commit) || !value.omni.repo)
+                    throw Error('Imported release manifest lacks a complete producer identity');
+                source = { raw: record.manifestJson, manifest: value };
+                parsed.set(record.sha256, source);
+            }
+            sources.set(record.sha256, source.manifest);
+            visit(source.manifest, depth + 1, new Set([...ancestors, record.sha256]));
+        }
+    };
+    visit(root, 0, new Set());
+    return result;
+}
+function oneArtifact(manifest, app) {
+    const found = manifest.artifacts.filter(value => value?.app === app);
+    if (found.length !== 1)
+        throw Error('No unique release artifact for ' + manifest.id + '/' + app);
+    return found[0];
+}
+function payload(artifact) {
+    const { app: _app, origin: _origin, ...record } = artifact;
+    return record;
+}
+function validMigrationPrograms(value) {
+    if (value === undefined)
+        return true; // Older producers did not capture declared entries.
+    if (!Array.isArray(value) || value.length > 256)
+        return false;
+    const entries = new Set();
+    return value.every(program => {
+        if (!object(program) || !['script', 'config'].includes(program['mode']) ||
+            !relative(program['source']) || !commit(program['sourceBlob']) || !sha256(program['sourceSha256']) ||
+            !relative(program['release']) || !/\.[cm]?js$/.test(program['release']) || !sha256(program['releaseSha256']) ||
+            entries.has(program['release']))
+            return false;
+        entries.add(program['release']);
+        return true;
+    });
+}
+/** An import is an independently portable application, not a claim inferred from a legacy tar. */
+export function assertImportableArtifact(manifest, artifact) {
+    const launch = artifact.launch, source = artifact.packageSource, target = manifest.builtWith?.target;
+    if (!object(source) || !object(target) || (!object(launch) && !sha256(artifact.closureSha256)))
+        throw Error('Imported application needs a recorded package source, frozen entry or payload closure, and execution target: ' + artifact.app);
+    if ((launch !== undefined && (!object(launch) || !['bootstrap', 'script'].includes(launch.mode) || !relative(launch.file) || !/\.[cm]?js$/.test(launch.file) || !sha256(launch.closureSha256))) ||
+        (artifact.closureSha256 !== undefined && (!sha256(artifact.closureSha256) || (launch && artifact.closureSha256 !== launch.closureSha256))) ||
+        (source.directory !== '.' && !relative(source.directory)) || !commit(source.manifestBlob) ||
+        !object(source.migrations) || !validMigrationPrograms(source.migrationPrograms) ||
+        Object.entries(source.migrations).some(([file, sha]) => !relative(file) || !sha256(sha)) ||
+        !['platform', 'arch', 'node', 'abi'].every(key => typeof target[key] === 'string' && target[key]) ||
+        !sha256(target.executableSha256) || (target.libc !== null && typeof target.libc !== 'string'))
+        throw Error('Imported application has malformed source, launch or execution target: ' + artifact.app);
+}
+function context(manifest, app, records, chain = []) {
+    const artifact = oneArtifact(manifest, app);
+    if (!validMigrationPrograms(artifact.packageSource?.migrationPrograms))
+        throw Error('Invalid declared migration provenance for ' + app);
+    if (!artifact.origin)
+        return { manifest, artifact, chain };
+    assertReleaseArtifactReference(artifact.origin);
+    const source = records.get(manifest)?.get(artifact.origin.manifestSha256);
+    if (!source || source.id !== artifact.origin.release)
+        throw Error('Missing pinned producer manifest for ' + app);
+    const original = oneArtifact(source, artifact.origin.app);
+    if (!isDeepStrictEqual(payload(artifact), payload(original)))
+        throw Error('Imported artifact metadata differs from its producer: ' + app);
+    if (chain.length >= MAX_DEPTH)
+        throw Error('Imported release chain exceeds eight levels');
+    const result = context(source, original.app, records, [...chain, artifact.origin]);
+    assertImportableArtifact(result.manifest, result.artifact);
+    return result;
+}
+/** Shared by build, admission, receipts and diagnostics. No application JavaScript executes. */
+export function artifactReleaseContext(manifest, app) {
+    return context(manifest, app, evidence(manifest));
+}
+/** Every origin must resolve, including artifacts outside the currently selected stack. */
+export function artifactReleaseContexts(manifest) {
+    const records = evidence(manifest);
+    for (const source of records.keys()) {
+        if (source === manifest)
+            continue;
+        for (const artifact of source.artifacts)
+            context(source, artifact.app, records);
+    }
+    return manifest.artifacts.map(artifact => ({ app: artifact.app, ...context(manifest, artifact.app, records) }));
+}
+/** One receipt mapping for local installation and remote delivery. Imported bytes
+ * always retain the original producer; only the launch alias belongs to the consumer. */
+export function releaseArtifactOrigins(manifest, manifestSha256) {
+    if (!sha256(manifestSha256))
+        throw Error('Invalid release manifest digest');
+    return artifactReleaseContexts(manifest).map(source => {
+        const launch = source.artifact.launch;
+        const origin = {
+            releaseId: source.manifest.id,
+            manifestSha256: source.chain.at(-1)?.manifestSha256 ?? manifestSha256,
+            artifactSha256: source.artifact.sha256,
+            artifactBytes: source.artifact.bytes,
+            app: source.app,
+            frameworkCommit: source.manifest.omni.commit,
+            ...(launch && { runtimeOrigin: {
+                    projectCommit: source.manifest.project.commit,
+                    producerApp: source.artifact.app,
+                    consumer: { releaseId: manifest.id, manifestSha256, app: source.app },
+                    entry: { relativeFile: launch.file, mode: launch.mode },
+                } }),
+        };
+        if (!validOrigin(origin))
+            throw Error('Invalid installed artifact origin for ' + source.app);
+        return { ...source, origin };
+    });
+}
+export function validateReleaseOrigins(manifest) {
+    artifactReleaseContexts(manifest);
+}
+/** Dependencies are independent releases: consumer gates never stand in for producer gates. */
+export function importedReleaseRefusal(manifest, apps, requireOnRemote = false) {
+    const records = evidence(manifest), checked = new Set();
+    const visit = (source, app) => {
+        const artifact = oneArtifact(source, app);
+        if (!artifact.origin)
+            return null;
+        context(source, app, records);
+        const producer = records.get(source).get(artifact.origin.manifestSha256);
+        if (!checked.has(producer)) {
+            checked.add(producer);
+            if (!producer.gates.length)
+                return 'imported release ' + producer.id + ' recorded no gates';
+            const failed = producer.gates.find(gate => gate.status !== 'passed');
+            if (failed)
+                return `imported release ${producer.id}: gate '${failed.name}' ${failed.status}`;
+            if (requireOnRemote && (producer.project.onRemote !== true || producer.omni.onRemote !== true))
+                return 'imported release ' + producer.id + ' has unconfirmed source publication; publish its commits and rebuild with a reachable origin';
+        }
+        return visit(producer, artifact.origin.app);
+    };
+    for (const app of apps) {
+        if (!manifest.artifacts.some(artifact => artifact.app === app))
+            continue;
+        const refusal = visit(manifest, app);
+        if (refusal)
+            return refusal;
+    }
+    return null;
+}
+//# sourceMappingURL=origin.js.map

package/dist/release/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/release/origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,WAAW,EAA8B,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,iCAAiC,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAC7B,MAAM,EAAE,GAAG,8BAA8B,CAAC;AAC1C,MAAM,MAAM,GAAG,iCAAiC,CAAC;AACjD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpG,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AACpD,MAAM,SAAS,GAAG,SAAS,EAAE,WAAW,GAAG,EAAE,EAAE,SAAS,GAAG,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpJ,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;IACrG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AAClG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACnI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAExE;0FAC0F;AAC1F,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;YAChI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC;QAC/G,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG;QACtI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC;QACnI,KAAK,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC;QACrI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACvK,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ;YACzH,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAK,QAAQ,CAAC,OAAO,CAAY,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1I,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAW,CAAC;YAC7I,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;YAC1F,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACnK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACpI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjH,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC5J,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxH,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC3E,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YACxG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC7H,MAAM,GAAG,GAAG,KAA0C,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnF,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;AACrF,CAAC;AAUD;6FAC6F;AAC7F,SAAS,QAAQ,CAAC,IAAqB;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiD,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsD,CAAC;IAC7E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,QAAyB,EAAE,KAAa,EAAE,SAA8B,EAAQ,EAAE;QAC/F,iCAAiC,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW;YAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/G,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;gBAC5E,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpJ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACnF,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,YAAY;oBAAE,MAAM,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC9G,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAChD,IAAI,KAAK,GAAG,SAAS,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW;oBAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACrH,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM;oBAClF,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBAC5E,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC;oBAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAAC,CAAC;gBAChD,MAAM,CAAC;oBAAC,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAAC,CAAC;gBACrE,iCAAiC,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI;oBACzF,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI;oBAChD,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBAC9E,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAyB,EAAE,GAAW;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,iCAAiC,GAAG,QAAQ,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,QAAyB;IACxC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,oDAAoD;IAC1F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAW,CAAC;YAC7E,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAClG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACtH,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAW,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,QAAyB,EAAE,QAAyB;IAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACrG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5F,MAAM,KAAK,CAAC,+GAA+G,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9I,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3L,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1I,CAAC,MAAM,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzF,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC/E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxF,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,GAA0B,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAA0B,CAAC,CAAC;QAC/I,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC/F,MAAM,KAAK,CAAC,yEAAyE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,OAAO,CACd,QAAyB,EAAE,GAAW,EAAE,OAAoC,EAAE,KAAK,GAA+B,EAAE;IAEpH,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAAE,MAAM,KAAK,CAAC,4CAA4C,GAAG,GAAG,CAAC,CAAC;IACxI,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3D,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,GAAG,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,wDAAwD,GAAG,GAAG,CAAC,CAAC;IAC1I,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,QAAyB,EAAE,GAAW;IAC3E,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,QAAyB;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAS;QAClC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;yFACyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,QAAyB,EAAE,cAAsB;IAEtF,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC5E,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtC,MAAM,MAAM,GAA0B;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC7B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,cAAc;YACrE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACtC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YACpC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;YAC5C,GAAG,CAAC,MAAM,IAAI,EAAE,aAAa,EAAE;oBAC7B,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM;oBAC7C,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;oBAChC,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;oBACrE,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBACxD,EAAE,CAAC;SACL,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,wCAAwC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7F,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAyB;IAC9D,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sBAAsB,CAAC,QAAyB,EAAE,IAAuB,EAAE,eAAe,GAAG,KAAK;IAChH,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzE,MAAM,KAAK,GAAG,CAAC,MAAuB,EAAE,GAAW,EAAiB,EAAE;QACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAE,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,mBAAmB,GAAG,QAAQ,CAAC,EAAE,GAAG,oBAAoB,CAAC;YAC5F,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;YACrE,IAAI,MAAM;gBAAE,OAAO,oBAAoB,QAAQ,CAAC,EAAE,WAAW,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7F,IAAI,eAAe,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;gBAC5F,OAAO,mBAAmB,GAAG,QAAQ,CAAC,EAAE,GAAG,8FAA8F,CAAC;QAC9I,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC;YAAE,SAAS;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/release/owner-admission.d.ts

@@ -0,0 +1,15 @@
+import type { IEcosystemAppEntry, IStackConfig } from '../config/types.js';
+import { type ApplicationRuntime } from '../services/host-upgrade.js';
+import type { ReleaseManifest } from './manifest.js';
+/** Native owner evidence obtained through the same authenticated probe as delivery. */
+export interface ReleaseOwnerAnswer {
+    readonly host: string;
+    readonly port?: number;
+    readonly runtime?: ApplicationRuntime;
+    readonly error?: string;
+}
+/** A frozen application owns its SDK. The resident protocol and exact Node
+ * image, not equality of application/owner Git commits, establish compatibility.
+ * Installation repeats this proof and binds the owner identity and grant. */
+export declare function refuseReleaseOwners(manifest: ReleaseManifest, stack: IStackConfig, apps: readonly IEcosystemAppEntry[], owners: readonly ReleaseOwnerAnswer[]): string | null;
+//# sourceMappingURL=owner-admission.d.ts.map

package/dist/release/owner-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-admission.d.ts","sourceRoot":"","sources":["../../src/release/owner-admission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAExG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;6EAE6E;AAC7E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,GAAG,IAAI,CAsB7K"}