@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/services/bundle-overrides.js

@@ -0,0 +1,96 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { resolvePnpm } from '../shared/pnpm.js';
+const exec = promisify(execFile);
+function archiveChecksum(file) {
+    return createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+/** Refuse a dependency changed after planning, before the bundle can be published. */
+export function copyBundleOverride(archive, directory) {
+    const destination = path.join(directory, archive.filename);
+    fs.copyFileSync(archive.source, destination);
+    if (archiveChecksum(destination) !== archive.sha256) {
+        fs.rmSync(destination, { force: true });
+        throw new Error(`Local override ${archive.name} changed while the bundle was being built`);
+    }
+}
+/** Read resolution inputs without translating their package manager semantics.
+ * Checked application releases retain the installed pnpm closure; their build
+ * cache must not require that pnpm rules can also be expressed by npm. */
+export async function readWorkspaceOverrideInputs(roots) {
+    const overrides = {};
+    const archives = [];
+    for (const root of roots) {
+        const { stdout } = await exec(resolvePnpm(), ['config', 'get', 'overrides', '--json'], { cwd: root });
+        const text = stdout.trim();
+        const config = !text || text === 'undefined' ? {} : JSON.parse(text) ?? {};
+        if (!config || typeof config !== 'object' || Array.isArray(config))
+            throw new Error('Invalid workspace overrides');
+        for (const [selector, range] of Object.entries(config)) {
+            if (Object.hasOwn(overrides, selector))
+                continue;
+            if (typeof range !== 'string')
+                throw new Error(`Invalid override for ${selector}`);
+            // The builder gives its primary workspace exact-selector precedence. Preserve
+            // values and order, including aliases, removals and parent-scoped rules.
+            Object.defineProperty(overrides, selector, { value: range, enumerable: true });
+            if (!range.startsWith('file:'))
+                continue;
+            const source = fs.realpathSync(path.resolve(root, range.slice(5)));
+            const relative = path.relative(fs.realpathSync(root), source);
+            if (relative.startsWith(`..${path.sep}`) || relative === '..' || path.isAbsolute(relative))
+                throw new Error(`Local override ${selector} must be inside its source workspace`);
+            if (!fs.statSync(source).isFile() || !/\.(tgz|tar\.gz)$/.test(source))
+                throw new Error(`Local override ${selector} must be a package archive`);
+            const sha256 = archiveChecksum(source);
+            const { stdout: manifest } = await exec('tar', ['-xOf', source, 'package/package.json'], {
+                maxBuffer: 1024 * 1024,
+            });
+            const metadata = JSON.parse(manifest);
+            if (typeof metadata.name !== 'string' || !/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(metadata.name) ||
+                typeof metadata.version !== 'string' || !metadata.version)
+                throw new Error(`Local override ${selector} contains no valid package name or version`);
+            if (archiveChecksum(source) !== sha256)
+                throw new Error(`Local override ${selector} changed while it was being read`);
+            const filename = `${metadata.name.replace(/^@/, '').replace('/', '-')}-${sha256}.tgz`;
+            archives.push({ selector, name: metadata.name, version: metadata.version, source, filename, sha256 });
+        }
+    }
+    return { overrides, archives };
+}
+/** npm bundles are a different output contract from an installed release.
+ * In particular pnpm's parent>child targets an immediate dependency, while npm
+ * nested overrides also affect deeper descendants. Never broaden that rule. */
+export async function readBundleOverrides(roots) {
+    const inputs = await readWorkspaceOverrideInputs(roots);
+    const overrides = {};
+    const refuse = (selector, reason) => {
+        throw new Error(`Cannot create an npm-installable bundle for override ${selector}: ${reason}. ` +
+            'Use omnitron release build <project> to package the verified, target-specific installed dependency graph.');
+    };
+    for (const [name, range] of Object.entries(inputs.overrides)) {
+        // Linked workspace packages are packed by the existing workspace planner.
+        if (range.startsWith('link:') || range.startsWith('workspace:'))
+            continue;
+        if (name.includes('>'))
+            refuse(name, 'this dependency selector is outside the supported npm bundle representation');
+        if (range === '-' || range.startsWith('catalog:') || range.startsWith('$') || name.includes(':') || name.includes('*'))
+            refuse(name, 'this pnpm resolution rule has no supported npm bundle representation');
+        const archive = inputs.archives.find(item => item.selector === name);
+        if (archive) {
+            if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(name))
+                refuse(name, 'version-qualified local archive selection is not supported by the npm bundle');
+            if (archive.name !== name)
+                throw new Error(`Local override ${name} contains a different package`);
+            Object.defineProperty(overrides, name, { value: `file:./vendor/${archive.filename}`, enumerable: true });
+        }
+        else {
+            Object.defineProperty(overrides, name, { value: range, enumerable: true });
+        }
+    }
+    return { overrides, archives: inputs.archives };
+}
+//# sourceMappingURL=bundle-overrides.js.map

package/dist/services/bundle-overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-overrides.js","sourceRoot":"","sources":["../../src/services/bundle-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAUjC,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,OAA8B,EAAE,SAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7C,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACpD,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,2CAA2C,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED;;0EAE0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAwB;IAIxE,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAY,CAAC,IAAI,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACpF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnH,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,SAAS;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;YACnF,8EAA8E;YAC9E,yEAAyE;YACzE,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS;YACzC,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,sCAAsC,CAAC,CAAC;YACpF,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,4BAA4B,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE;gBACvF,SAAS,EAAE,IAAI,GAAG,IAAI;aACvB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwC,CAAC;YAC7E,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9F,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAC3D,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,4CAA4C,CAAC,CAAC;YAC1F,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,kCAAkC,CAAC,CAAC;YACtH,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,MAAM,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;+EAE+E;AAC/E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAwB;IAIhE,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAS,EAAE;QACzD,MAAM,IAAI,KAAK,CAAC,wDAAwD,QAAQ,KAAK,MAAM,IAAI;YAC7F,2GAA2G,CAAC,CAAC;IACjH,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,0EAA0E;QAC1E,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,EAAE,6EAA6E,CAAC,CAAC;QACpH,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpH,MAAM,CAAC,IAAI,EAAE,sEAAsE,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACrE,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClD,MAAM,CAAC,IAAI,EAAE,8EAA8E,CAAC,CAAC;YAC/F,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,+BAA+B,CAAC,CAAC;YAClG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,OAAO,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAClD,CAAC"}

package/dist/services/daemon-authority.d.ts

@@ -0,0 +1,16 @@
+import type { AuthContext } from '@omnitron-dev/titan/netron/auth';
+import type { AuthService } from './auth.service.js';
+type AuthorityStore = Pick<AuthService, 'validateSessionAuthority'>;
+type VerifiedClaims = {
+    sub?: unknown;
+    role?: unknown;
+    sid?: unknown;
+    exp?: unknown;
+    iss?: unknown;
+};
+/** Token verification is supplied by Titan; human authority always comes from its live session. */
+export declare function createDaemonTokenValidator(verify: (token: string) => Promise<VerifiedClaims>, sessions: AuthorityStore | null): (token: string) => Promise<AuthContext>;
+/** Recheck admitted peers on every invocation, including cached HTTP tokens and long-lived sockets. */
+export declare function createDaemonPrincipalValidator(sessions: AuthorityStore | null): (context: AuthContext) => Promise<void>;
+export {};
+//# sourceMappingURL=daemon-authority.d.ts.map

package/dist/services/daemon-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-authority.d.ts","sourceRoot":"","sources":["../../src/services/daemon-authority.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,KAAK,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;AACpE,KAAK,cAAc,GAAG;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAMrG,mGAAmG;AACnG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,WACvG,MAAM,KAAG,OAAO,CAAC,WAAW,CAAC,CAoBnD;AAED,uGAAuG;AACvG,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,aACrD,WAAW,KAAG,OAAO,CAAC,IAAI,CAAC,CAmBnD"}

package/dist/services/daemon-authority.js

@@ -0,0 +1,54 @@
+import { isOmnitronRole } from '../shared/roles.js';
+function denied(message) {
+    return Object.assign(new Error(message), { code: 'SESSION_REVOKED', statusCode: 401 });
+}
+/** Token verification is supplied by Titan; human authority always comes from its live session. */
+export function createDaemonTokenValidator(verify, sessions) {
+    return async (token) => {
+        const claims = await verify(token);
+        if (claims.iss !== 'omnitron' || typeof claims.sub !== 'string' || !claims.sub || claims.sub.length > 150 ||
+            claims.sub.trim() !== claims.sub || typeof claims.exp !== 'number' || !Number.isSafeInteger(claims.exp) ||
+            claims.exp > 8_640_000_000_000 || claims.exp * 1000 <= Date.now()) {
+            throw denied('A bounded, unexpired Omnitron identity is required');
+        }
+        if (claims.role === 'service_role') {
+            if (claims.sid !== undefined)
+                throw denied('A service identity cannot carry a human session');
+            return { userId: claims.sub, roles: ['service_role'], permissions: [], token: { type: 'bearer', expiresAt: new Date(claims.exp * 1000) },
+                metadata: { principalType: 'service', isServiceRole: true, expiresAt: claims.exp * 1000 } };
+        }
+        if (!sessions || !isOmnitronRole(claims.role) || typeof claims.sid !== 'string' || !claims.sid || claims.sid.length > 150) {
+            throw denied('Human access requires an active session on the master');
+        }
+        const current = await sessions.validateSessionAuthority(claims.sub, claims.sid);
+        if (!current || !isOmnitronRole(current.role))
+            throw denied('Session has been revoked or expired');
+        return { userId: current.userId, roles: [current.role], permissions: [], token: { type: 'bearer', expiresAt: new Date(claims.exp * 1000) },
+            metadata: { principalType: 'human', sessionId: current.sessionId, isServiceRole: false, expiresAt: claims.exp * 1000 } };
+    };
+}
+/** Recheck admitted peers on every invocation, including cached HTTP tokens and long-lived sockets. */
+export function createDaemonPrincipalValidator(sessions) {
+    return async (context) => {
+        if (context.userId === 'omnitron-local' && context.metadata?.['source'] === 'local-unix-socket' &&
+            context.roles?.length === 1 && context.roles[0] === 'admin')
+            return;
+        const expiresAt = context.metadata?.['expiresAt'];
+        if (!context.userId || typeof expiresAt !== 'number' || !Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+            throw denied('Authentication expired; reconnect with a current credential');
+        }
+        if (context.metadata?.['principalType'] === 'service' && context.roles?.length === 1 && context.roles[0] === 'service_role')
+            return;
+        const sessionId = context.metadata?.['sessionId'];
+        if (!sessions || context.metadata?.['principalType'] !== 'human' || typeof sessionId !== 'string') {
+            throw denied('An active human session is required');
+        }
+        const current = await sessions.validateSessionAuthority(context.userId, sessionId);
+        // The method gate ran with the peer's admitted role. Never change that role
+        // after the gate: refuse the call and require a freshly authenticated peer.
+        if (!current || !isOmnitronRole(current.role) || context.roles?.length !== 1 || context.roles[0] !== current.role) {
+            throw denied('Session was revoked or its role changed; authenticate again');
+        }
+    };
+}
+//# sourceMappingURL=daemon-authority.js.map

package/dist/services/daemon-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-authority.js","sourceRoot":"","sources":["../../src/services/daemon-authority.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAKpD,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,0BAA0B,CAAC,MAAkD,EAAE,QAA+B;IAC5H,OAAO,KAAK,EAAE,KAAa,EAAwB,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;YACrG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;YACvG,MAAM,CAAC,GAAG,GAAG,iBAAiB,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtE,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;gBAAE,MAAM,MAAM,CAAC,iDAAiD,CAAC,CAAC;YAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE;gBACtI,QAAQ,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1H,MAAM,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACnG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE;YACxI,QAAQ,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC;IAC7H,CAAC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,8BAA8B,CAAC,QAA+B;IAC5E,OAAO,KAAK,EAAE,OAAoB,EAAiB,EAAE;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,KAAK,mBAAmB;YAC3F,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;YAAE,OAAO;QACxE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/G,MAAM,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,cAAc;YAAE,OAAO;QACpI,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,KAAK,OAAO,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,wBAAwB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnF,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;YAClH,MAAM,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/services/daemon-principal.d.ts

@@ -0,0 +1,31 @@
+import { type OmnitronRole } from '../shared/roles.js';
+import type { AuthService } from './auth.service.js';
+/** Revalidate human authority at sensitive boundaries, independently of transport caches. */
+export declare function daemonPrincipal(authService: Pick<AuthService, 'validateSession'>, minimum: OmnitronRole): Promise<{
+    context: import("@omnitron-dev/titan/netron/auth").AuthContext;
+    role: OmnitronRole;
+    sessionId: undefined;
+} | {
+    context: {
+        userId: string;
+        permissions: string[];
+        scopes?: string[];
+        token?: {
+            type: 'bearer' | 'mac' | 'custom';
+            expiresAt?: Date;
+            issuer?: string;
+            audience?: string[];
+        };
+        metadata?: Record<string, any>;
+        claims?: Record<string, unknown>;
+        roles: OmnitronRole[];
+    };
+    role: OmnitronRole;
+    sessionId: string;
+}>;
+/** Evict cached tokens and remove authority from admitted persistent peers. */
+export declare function revokeDaemonAuthority(netron: import('@omnitron-dev/titan/netron').Netron, userId: string, sessions?: {
+    only?: string;
+    except?: string;
+}): void;
+//# sourceMappingURL=daemon-principal.d.ts.map

package/dist/services/daemon-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-principal.d.ts","sourceRoot":"","sources":["../../src/services/daemon-principal.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,6FAA6F;AAC7F,wBAAsB,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,OAAO,EAAE,YAAY;;UAKvE,YAAY;;;;;;;;;;;;;;;;;;;GASlD;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,4BAA4B,EAAE,MAAM,EACnD,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,IAAI,CAWN"}

package/dist/services/daemon-principal.js

@@ -0,0 +1,37 @@
+import { Errors } from '@omnitron-dev/titan/errors';
+import { getCurrentAuth } from './auth-context.js';
+import { hasMinimumRole, isOmnitronRole } from '../shared/roles.js';
+/** Revalidate human authority at sensitive boundaries, independently of transport caches. */
+export async function daemonPrincipal(authService, minimum) {
+    const context = getCurrentAuth();
+    if (!context?.userId || !hasMinimumRole(context.roles ?? [], minimum))
+        throw Errors.forbidden(`Requires ${minimum} access`);
+    if (context.userId === 'omnitron-local' && context.metadata?.['source'] === 'local-unix-socket') {
+        return { context, role: 'admin', sessionId: undefined };
+    }
+    const sessionId = context.metadata?.['sessionId'];
+    if (typeof sessionId !== 'string')
+        throw Errors.forbidden('An active human session is required');
+    const user = await authService.validateSession(sessionId);
+    if (!user || user.id !== context.userId || !isOmnitronRole(user.role) || !hasMinimumRole([user.role], minimum)) {
+        throw Errors.forbidden('Session expired, was revoked, or no longer has the required role');
+    }
+    return { context: { ...context, roles: [user.role] }, role: user.role, sessionId };
+}
+/** Evict cached tokens and remove authority from admitted persistent peers. */
+export function revokeDaemonAuthority(netron, userId, sessions = {}) {
+    netron.revokeUserSessions(userId);
+    for (const peer of netron.peers.values()) {
+        const context = peer.getAuthContext();
+        if (context?.userId !== userId)
+            continue;
+        const sessionId = context.metadata?.['sessionId'];
+        if (sessions.only && sessionId !== sessions.only)
+            continue;
+        if (sessions.except && sessionId === sessions.except)
+            continue;
+        peer.clearAuthContext();
+        void peer.close().catch(() => undefined);
+    }
+}
+//# sourceMappingURL=daemon-principal.js.map

package/dist/services/daemon-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-principal.js","sourceRoot":"","sources":["../../src/services/daemon-principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAqB,MAAM,oBAAoB,CAAC;AAGvF,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAiD,EAAE,OAAqB;IAC5G,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC;QACnE,MAAM,MAAM,CAAC,SAAS,CAAC,YAAY,OAAO,SAAS,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,KAAK,mBAAmB,EAAE,CAAC;QAChG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAuB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,MAAM,MAAM,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/G,MAAM,MAAM,CAAC,SAAS,CAAC,kEAAkE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;AACrF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CACnC,MAAmD,EACnD,MAAc,EACd,QAAQ,GAAuC,EAAE;IAEjD,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,OAAO,EAAE,MAAM,KAAK,MAAM;YAAE,SAAS;QACzC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,IAAI,SAAS,KAAK,QAAQ,CAAC,IAAI;YAAE,SAAS;QAC3D,IAAI,QAAQ,CAAC,MAAM,IAAI,SAAS,KAAK,QAAQ,CAAC,MAAM;YAAE,SAAS;QAC/D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/services/deploy.service.d.ts

@@ -1,75 +1,31 @@
 /**
- * DeployService — Application deployment with strategies
+ * Compatibility reader for the historical per-application deployment table.
  *
- * Wraps @xec-sh/ops Deployer for multi-strategy deployments:
- * - rolling: restart apps one by one with health verification
- * - all-at-once: restart all at once (current behavior, fast but risky)
- * - blue-green: start new, verify, switch, stop old (via xec)
- * - canary: deploy to one instance, verify, roll out (via xec)
- *
- * When @xec-sh/ops is not installed, falls back to basic orchestrator restart
- * without strategy execution or health verification (Phase 1 behavior).
- *
- * Records deployment history in omnitron-pg for audit trail.
+ * The former mutation path restarted the current configuration and labelled it
+ * with an arbitrary version. It could neither select an artifact nor roll back.
+ * Stack release deployment is the supported executor; keep old records readable
+ * without allowing legacy clients to turn an unsupported operation into downtime.
  */
 import type { Kysely } from 'kysely';
-import { type ILoggerModule } from '@omnitron-dev/titan/module/logger';
 import type { OmnitronDatabase } from '../database/schema.js';
-import type { OrchestratorService } from '../orchestrator/orchestrator.service.js';
-import type { HealthCheckService } from './health-check.service.js';
+import type { DeployResult, DeploymentRecord } from '../shared/dto/deploy.js';
+export type { DeployResult, DeploymentRecord } from '../shared/dto/deploy.js';
 export type DeployStrategy = 'rolling' | 'all-at-once' | 'blue-green' | 'canary';
 export interface DeployRequest {
-    /** App to deploy (or '*' for all) */
     app: string;
-    /** Version label (git sha, tag, or custom) */
     version: string;
-    /** Deployment strategy */
     strategy?: DeployStrategy | undefined;
-    /** Who initiated the deployment */
     deployedBy?: string | undefined;
 }
-export type { DeployResult, DeploymentRecord } from '../shared/dto/deploy.js';
-import type { DeployResult, DeploymentRecord } from '../shared/dto/deploy.js';
 export declare class DeployService {
     private readonly db;
-    private readonly orchestrator;
-    private readonly healthCheck?;
-    private readonly logger;
-    constructor(db: Kysely<OmnitronDatabase>, orchestrator: OrchestratorService, loggerModule: ILoggerModule, healthCheck?: HealthCheckService | undefined);
-    /**
-     * Names of the applications this daemon can deploy.
-     *
-     * The console's deploy dialog needs a list to choose from and was calling
-     * a `listDeployableApps()` that did not exist, so the dialog offered
-     * nothing and the page logged a 404 on every load. The orchestrator
-     * already knows the managed set — that is the answer.
-     */
+    constructor(db: Kysely<OmnitronDatabase>);
+    /** No per-application artifact executor is registered. */
     listDeployableApps(): Promise<string[]>;
-    /**
-     * Deploy an application with the specified strategy.
-     */
-    deploy(request: DeployRequest): Promise<DeployResult>;
-    /**
-     * Rollback to previous version (restart with previous config).
-     */
-    rollback(app: string, deployedBy?: string): Promise<DeployResult>;
-    /**
-     * Get deployment history for an app.
-     */
+    /** Refuse before database writes, module loading or application lifecycle calls. */
+    deploy(_request: DeployRequest): Promise<DeployResult>;
+    rollback(_app: string, _deployedBy?: string): Promise<DeployResult>;
+    /** Historical operation labels are not evidence of installed artifact versions. */
     getHistory(app?: string, limit?: number): Promise<DeploymentRecord[]>;
-    /**
-     * Deploy using @xec-sh/ops Deployer with strategy execution,
-     * health verification, and automatic rollback on failure.
-     */
-    private deployWithXec;
-    /**
-     * All-at-once: stop app, start app. Simple but causes downtime.
-     */
-    private deployAllAtOnce;
-    /**
-     * Rolling: for multi-instance apps, restart one at a time with health checks.
-     * Falls back to all-at-once for single-instance apps.
-     */
-    private deployRolling;
 }
 //# sourceMappingURL=deploy.service.d.ts.map

package/dist/services/deploy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.service.d.ts","sourceRoot":"","sources":["../../src/services/deploy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAwB,KAAK,aAAa,EAAgB,MAAM,mCAAmC,CAAC;AAE3G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAMpE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEjF,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO9E,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAM9E,qBACa,aAAa;IAMK,OAAO,CAAC,QAAQ,CAAC,EAAE;IAClB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAET,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAR/E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAIjC,YAC8C,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC3B,YAAY,EAAE,mBAAmB,EAChD,YAAY,EAAE,aAAa,EACQ,WAAW,CAAC,EAAE,kBAAkB,GAAG,SAAS,EAG9G;IAED;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAK5C;IAED;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAoG1D;IAED;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAqBtE;IAED;;OAEG;IACG,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuBtE;IAMD;;;OAGG;YACW,aAAa;IA8D3B;;OAEG;YACW,eAAe;IAiB7B;;;OAGG;YACW,aAAa;CAoC5B"}
+{"version":3,"file":"deploy.service.d.ts","sourceRoot":"","sources":["../../src/services/deploy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;AACjF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,qBACa,aAAa;IACe,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA1D,YAAwD,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAI;IAExF,0DAA0D;IACpD,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAe;IAE5D,oFAAoF;IAC9E,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAE3D;IAEK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAExE;IAED,mFAAmF;IAC7E,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA0BtE;CAEF"}