@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/services/migration-process.js

@@ -0,0 +1,71 @@
+import { ExecutionEngine } from '@xec-sh/core';
+import { shellEscape } from '../shared/shell-escape.js';
+import { prepareMigrationConfiguration } from '../migration/configuration.js';
+import { closureLibraryDirectories, withClosureLibraryPath } from '../release/closure-library-path.js';
+/** The same config adapter on local and remote nodes. The program is resolved from
+ * the admitted application's own dependency closure; it uses the public operation
+ * API, preserving that config's history, lock and connection ownership. */
+export function migrationProcessArguments(target, validate = false) {
+    if (target.mode !== 'config')
+        return [target.script];
+    return ['--input-type=module', '-e', `import {createRequire} from 'node:module';
+import {pathToFileURL} from 'node:url';
+const file=process.argv[1],url=pathToFileURL(file);
+const api=await import(pathToFileURL(createRequire(url).resolve('@omnitron-dev/omnitron/migration')).href);
+const {default:config}=await import(url.href);
+const prepared=await (${prepareMigrationConfiguration.toString()})(config);
+${validate ? "console.log(JSON.stringify({name:prepared.name??null,validated:true}));" : "const result=await api.executeMigrationOperation(prepared,{action:'up'});console.log(JSON.stringify(result));"}`, target.script];
+}
+/** SSH carries credentials on stdin; the remote process receives them only as its environment.
+ * The deployment execution fence owns the timeout and process group. Do not retry this command. */
+export function prepareRemoteMigration(target, env) {
+    const source = `import {spawn} from 'node:child_process';
+    const closureLibraryDirectories=${closureLibraryDirectories.toString()};
+    let size=0;const chunks=[];
+    for await(const chunk of process.stdin){size+=chunk.length;if(size>1024*1024)throw Error('Migration environment input exceeds 1 MiB');chunks.push(chunk)}
+    let env;try{env=JSON.parse(Buffer.concat(chunks).toString('utf8'))}catch{throw Error('Invalid migration environment input')}
+    if(!env||typeof env!=='object'||Array.isArray(env)||Object.entries(env).some(([key,value])=>!/^[_A-Za-z][_A-Za-z0-9]*$/.test(key)||typeof value!=='string'||value.includes('\\0')))throw Error('Invalid migration environment input');
+    const libs=process.platform==='linux'?closureLibraryDirectories([${JSON.stringify(target.cwd)},${JSON.stringify(target.script)}]):[];
+    const ld=libs.length?[...new Set([...libs,...(env.LD_LIBRARY_PATH||'').split(':'),...(process.env.LD_LIBRARY_PATH||'').split(':')].filter(Boolean))].join(':'):undefined;
+    const child=spawn(process.execPath,${JSON.stringify(migrationProcessArguments(target, target.validate))},{
+      cwd:${JSON.stringify(target.cwd)},env:{...process.env,...env,...(ld?{LD_LIBRARY_PATH:ld}:{})},stdio:['ignore','inherit','inherit']});
+    child.once('error',()=>{console.error('Migration process could not start');process.exitCode=1});
+    child.once('close',(code,signal)=>{process.exitCode=code??1;if(signal)console.error('Migration process terminated by '+signal)});`;
+    const runtime = target.node ? `env -u NODE_OPTIONS -u NODE_PATH ${shellEscape(target.node)}` : 'node';
+    return { command: `${runtime} --input-type=module -e ${shellEscape(source)}`, stdin: JSON.stringify(env) };
+}
+/** One execution only: a disconnected DB may have committed already. Readiness can retry before this call.
+ * Xec's internal timeout returns before process close; the owned abort deadline instead waits for the
+ * killed local process/stdio. Explicit empty loader variables override Xec 0.11's inherited environment. */
+export async function executeLocalMigration(target, env, options = {}) {
+    const deadline = AbortSignal.timeout(options.timeoutMs ?? 600_000);
+    const signal = options.signal ? AbortSignal.any([options.signal, deadline]) : deadline;
+    const engine = new ExecutionEngine({ defaultTimeout: 0, adapters: { local: { killSignal: 'SIGKILL' } } });
+    const closureEnv = target.sealed ? withClosureLibraryPath(env, [target.cwd, target.script], process.env) : undefined;
+    try {
+        const result = await engine.execute({ command: process.execPath,
+            args: [...(target.sealed ? [] : ['--import', 'tsx/esm']), ...migrationProcessArguments(target, options.validate)],
+            cwd: target.cwd, shell: false, adapter: 'local', timeout: 0, signal, nothrow: true,
+            maxBuffer: 16 * 1024 * 1024,
+            env: Object.fromEntries(Object.entries({ ...process.env, ...env, ...closureEnv,
+                ...(target.sealed ? { NODE_OPTIONS: target.nodeOptions, NODE_PATH: '' } : {})
+            }).filter((entry) => typeof entry[1] === 'string')),
+        });
+        if (signal.aborted)
+            throw Error('Migration was interrupted');
+        if (result.exitCode !== 0)
+            throw Object.assign(Error('Migration process failed; stack startup refused'), {
+                stderr: result.stderr, exitCode: result.exitCode,
+            });
+        return { stdout: result.stdout, stderr: result.stderr };
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw Error('Migration interrupted or timed out; outcome may be unknown. Inspect the migration ledger before retrying.', { cause: error });
+        throw error;
+    }
+    finally {
+        await engine.dispose();
+    }
+}
+//# sourceMappingURL=migration-process.js.map

package/dist/services/migration-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-process.js","sourceRoot":"","sources":["../../src/services/migration-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAEvG;;2EAE2E;AAC3E,MAAM,UAAU,yBAAyB,CAAC,MAAsD,EAAE,QAAQ,GAAG,KAAK;IAChH,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE;;;;;wBAKf,6BAA6B,CAAC,QAAQ,EAAE;EAC9D,QAAQ,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC,CAAC,+GAA+G,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AAC3N,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,sBAAsB,CAAC,MAAsG,EAAE,GAA2B;IACxK,MAAM,MAAM,GAAG;sCACqB,yBAAyB,CAAC,QAAQ,EAAE;;;;;uEAKH,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;;yCAEzF,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/F,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;;sIAEgG,CAAC;IACrI,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACtG,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,2BAA2B,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;4GAE4G;AAC5G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAA4B,EAAE,GAAsB,EAC9F,OAAO,GAAqE,EAAE;IAC9E,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ;YAC7D,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjH,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI;YAClF,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,UAAU;gBAC5E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;SAC/E,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,EAAE;gBACvG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;aACjD,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,2GAA2G,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/J,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACvC,CAAC"}

package/dist/services/migration-target.d.ts

@@ -0,0 +1,57 @@
+import type { IEcosystemAppEntry } from '../config/types.js';
+import type { IServiceRequirement } from '../infrastructure/types.js';
+/** Compatibility entries; explicit bindings name their own config modules. */
+export declare const COMPILED_MIGRATION_ENTRY = "dist/database/migrate.js";
+export interface MigrationRequest {
+    service: string;
+    database: string;
+    app: string;
+    mode: 'script' | 'config';
+    source: string;
+    release: string;
+}
+export type MigrationRequiredFiles = Readonly<Record<string, readonly string[]>>;
+export type VerifyMigrationEntries = (apps: readonly string[], files: MigrationRequiredFiles) => Promise<IEcosystemAppEntry[]>;
+export declare function migrationEntryPath(value: unknown, field: string): string;
+/** false is also a declaration: it must not fall through to script discovery. */
+export declare function hasMigrationDeclarations(services: Readonly<Record<string, IServiceRequirement>>): boolean;
+/** One opt-in policy for diagnosis, source launch, installed releases and remote deployments.
+ * Keep database/service identity independent of the application's alias and package path. */
+export declare function requestedMigrations(services: Readonly<Record<string, IServiceRequirement>>): MigrationRequest[];
+/** Validate every owner before executing any part of the migration plan. */
+export declare function validateMigrationOwners(requests: readonly MigrationRequest[], entries: readonly IEcosystemAppEntry[]): void;
+/** Existing deployments activate one node at a time. An explicit shared-database
+ * owner must therefore have one placement, visited before its consumers. Multiple
+ * owning nodes need a global migration barrier; refuse rather than choosing a replica. */
+export declare function orderMigrationPlacements<T extends {
+    apps: readonly IEcosystemAppEntry[];
+}>(requests: readonly MigrationRequest[], placements: readonly T[]): T[];
+export declare function requiredMigrationFiles(requests: readonly MigrationRequest[]): MigrationRequiredFiles;
+/** Legacy scripts consume app-prefixed connection fields and cannot preserve URL options.
+ * Config modules receive the complete resolved URL; validation never rewrites their connection. */
+export declare function migrationDatabaseEnvironment(app: string, connectionString: string, expectedDatabase?: string, mode?: 'script' | 'config'): {
+    host: string;
+    port: number;
+    database: string;
+    user: string;
+    password: string;
+    connectionString: string;
+    env: Record<string, string>;
+};
+/** Two named infrastructure services must not silently assign different owners
+ * to the same resolved database. Several registries under one owner are valid. */
+export declare function validateMigrationDestinations(targets: readonly {
+    app: string;
+    database: ReturnType<typeof migrationDatabaseEnvironment>;
+}[]): void;
+export interface LocalMigrationTarget extends MigrationRequest {
+    environmentApp: string;
+    script: string;
+    cwd: string;
+    sealed: boolean;
+    nodeOptions: string;
+}
+/** Admission is delegated to the same manifest/closure/owner verifier as app launch.
+ * A receipt alone is never authority to execute a selected release. No DB or child is touched. */
+export declare function localMigrationTargets(requests: readonly MigrationRequest[], entries: readonly IEcosystemAppEntry[], projectPath: string, verify?: VerifyMigrationEntries): Promise<LocalMigrationTarget[]>;
+//# sourceMappingURL=migration-target.d.ts.map

package/dist/services/migration-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-target.d.ts","sourceRoot":"","sources":["../../src/services/migration-target.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAoB,MAAM,4BAA4B,CAAC;AAIxF,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AACnE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAE/H,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKxE;AAMD,iFAAiF;AACjF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,GAAG,OAAO,CAYzG;AAED;6FAC6F;AAC7F,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,GAAG,gBAAgB,EAAE,CAmC/G;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EAAE,OAAO,EAAE,SAAS,kBAAkB,EAAE,GAAG,IAAI,CAU3H;AAED;;0FAE0F;AAC1F,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAA;CAAE,EAAE,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAUhK;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,sBAAsB,CAIpG;AAED;mGACmG;AACnG,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,QAAQ,GAAG,QAAmB;;;;;;;;EAuBlJ;AAED;kFACkF;AAClF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,SAAS;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAA;CAAE,EAAE,GAAG,IAAI,CAQlJ;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD;kGACkG;AAClG,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EAAE,OAAO,EAAE,SAAS,kBAAkB,EAAE,EACvH,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAoCvF"}

package/dist/services/migration-target.js

@@ -0,0 +1,221 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { resolveAppPath } from '../config/app-path.js';
+import { readInstalledReleaseReceipt } from '../release/installed-origin.js';
+import { releaseOptionsForEnv } from '../release/target-runtime.js';
+/** Compatibility entries; explicit bindings name their own config modules. */
+export const COMPILED_MIGRATION_ENTRY = 'dist/database/migrate.js';
+export function migrationEntryPath(value, field) {
+    if (typeof value !== 'string' || !value || value.length > 4096 || /[\\:\0]/.test(value) ||
+        path.posix.isAbsolute(value) || value.split('/').some(part => !part || part === '.' || part === '..'))
+        throw Error(`Migration ${field} must be a package-relative physical file`);
+    return value;
+}
+function legacy(database, service = 'postgres') {
+    return { service, database, app: database, mode: 'script', source: 'src/database/migrate.ts', release: COMPILED_MIGRATION_ENTRY };
+}
+/** false is also a declaration: it must not fall through to script discovery. */
+export function hasMigrationDeclarations(services) {
+    for (const service of Object.values(services)) {
+        if (service._preset !== 'postgres')
+            continue;
+        const databases = service._presetConfig?.['databases'];
+        if (databases === undefined)
+            continue;
+        if (!databases || typeof databases !== 'object' || Array.isArray(databases))
+            throw Error('Invalid PostgreSQL database declarations');
+        for (const config of Object.values(databases)) {
+            if (!config || typeof config !== 'object' || Array.isArray(config))
+                throw Error('Invalid PostgreSQL database declaration');
+            if (Object.hasOwn(config, 'migrate') || Object.hasOwn(config, 'migrationDir'))
+                return true;
+        }
+    }
+    return false;
+}
+/** One opt-in policy for diagnosis, source launch, installed releases and remote deployments.
+ * Keep database/service identity independent of the application's alias and package path. */
+export function requestedMigrations(services) {
+    const requests = [];
+    const programs = new Map();
+    for (const [service, requirement] of Object.entries(services)) {
+        if (requirement._preset !== 'postgres')
+            continue;
+        const databases = requirement._presetConfig?.['databases'];
+        if (databases === undefined)
+            continue;
+        if (!databases || typeof databases !== 'object' || Array.isArray(databases))
+            throw Error(`Invalid PostgreSQL databases for ${service}`);
+        for (const [database, config] of Object.entries(databases)) {
+            if (!config || typeof config !== 'object' || Array.isArray(config))
+                throw Error(`Invalid migration declaration for ${service}/${database}`);
+            if (Object.hasOwn(config, 'migrationDir'))
+                throw Error(`migrationDir is not an executable migration binding for ${service}/${database}; declare migrate.config and migrate.releaseConfig`);
+            const value = config.migrate;
+            if (value === undefined || value === false)
+                continue;
+            const identity = `${service}/${database}`;
+            const bindings = value === true ? [legacy(database, service)] : (Array.isArray(value) ? value : [value]).map(input => {
+                if (!input || typeof input !== 'object' || Array.isArray(input) ||
+                    Object.keys(input).some(key => !['app', 'config', 'releaseConfig'].includes(key)))
+                    throw Error(`Invalid migration binding for ${identity}`);
+                const binding = input;
+                if (typeof binding.app !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(binding.app))
+                    throw Error(`Invalid migration owner for ${identity}`);
+                const source = migrationEntryPath(binding.config, 'config'), release = migrationEntryPath(binding.releaseConfig, 'releaseConfig');
+                if (!/\.[cm]?js$/.test(release))
+                    throw Error(`Migration releaseConfig for ${identity} must name a compiled JavaScript module`);
+                return { service, database, app: binding.app, mode: 'config', source, release };
+            });
+            if (!bindings.length)
+                throw Error(`Migration binding list is empty for ${identity}`);
+            if (new Set(bindings.map(binding => binding.app)).size !== 1)
+                throw Error(`Database ${identity} must have one migration owner`);
+            for (const binding of bindings) {
+                const key = JSON.stringify([binding.app, binding.source, binding.release]);
+                const previous = programs.get(key);
+                if (previous)
+                    throw Error(`Migration program for ${binding.app} is declared more than once (${previous}, ${identity})`);
+                programs.set(key, identity);
+                requests.push(binding);
+            }
+        }
+    }
+    return requests;
+}
+/** Validate every owner before executing any part of the migration plan. */
+export function validateMigrationOwners(requests, entries) {
+    for (const request of requests) {
+        if (!request || !['script', 'config'].includes(request.mode) || typeof request.database !== 'string' || !request.database ||
+            typeof request.service !== 'string' || !request.service)
+            throw Error('Invalid normalized migration request');
+        migrationEntryPath(request.source, 'source');
+        migrationEntryPath(request.release, 'release');
+        if (!/\.[cm]?js$/.test(request.release))
+            throw Error('A released migration must name a compiled JavaScript module');
+        const owners = entries.filter(entry => entry.name === request.app);
+        if (owners.length !== 1 || owners[0].enabled === false)
+            throw Error(`Migration requested for ${request.service}/${request.database}, but this stack has no unique application ${request.app}`);
+    }
+}
+/** Existing deployments activate one node at a time. An explicit shared-database
+ * owner must therefore have one placement, visited before its consumers. Multiple
+ * owning nodes need a global migration barrier; refuse rather than choosing a replica. */
+export function orderMigrationPlacements(requests, placements) {
+    const owners = new Set();
+    for (const request of requests.filter(candidate => candidate.mode === 'config')) {
+        const matches = placements.flatMap((placement, index) => placement.apps.some(app => app.name === request.app) ? [index] : []);
+        if (matches.length !== 1)
+            throw Error(`Migration owner ${request.app} requires exactly one node placement; configure an unambiguous owner before deployment`);
+        owners.add(matches[0]);
+    }
+    if (owners.size > 1)
+        throw Error('Migration owners on different nodes require a global migration barrier; place the explicit owners on one node before deployment');
+    const first = [...owners][0];
+    return first === undefined ? [...placements] : [placements[first], ...placements.filter((_, index) => index !== first)];
+}
+export function requiredMigrationFiles(requests) {
+    const result = Object.create(null);
+    for (const request of requests)
+        (result[request.app] ??= []).push(request.release);
+    return result;
+}
+/** Legacy scripts consume app-prefixed connection fields and cannot preserve URL options.
+ * Config modules receive the complete resolved URL; validation never rewrites their connection. */
+export function migrationDatabaseEnvironment(app, connectionString, expectedDatabase, mode = 'script') {
+    let url, database, user, password;
+    try {
+        url = new URL(connectionString);
+        database = decodeURIComponent(url.pathname.slice(1));
+        if (!['postgres:', 'postgresql:'].includes(url.protocol) || !url.hostname || !database ||
+            (expectedDatabase !== undefined && database !== expectedDatabase) || !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(app))
+            throw Error();
+        user = decodeURIComponent(url.username);
+        password = decodeURIComponent(url.password);
+    }
+    catch {
+        throw Error(`Migration for ${app} requires its resolved PostgreSQL DATABASE_URL${expectedDatabase ? ' targeting ' + expectedDatabase : ''}`);
+    }
+    if (url.hash || (mode === 'script' && url.search))
+        throw Error(`Migration for ${app} refuses DATABASE_URL options: the standard migration contract cannot guarantee their application. No migration was executed.`);
+    if (mode === 'config' && [...url.searchParams.keys()].some(key => ['host', 'hostaddr', 'port', 'database', 'dbname', 'user', 'password'].includes(key.toLowerCase())))
+        throw Error(`Migration for ${app} refuses connection destination overrides in DATABASE_URL options; declare the destination in the URL authority and path`);
+    const host = url.hostname.replace(/^\[|\]$/g, ''), port = url.port || '5432';
+    const prefix = app.toUpperCase().replace(/-/g, '_');
+    const env = { DATABASE_URL: connectionString };
+    if (mode === 'script')
+        Object.assign(env, {
+            [`${prefix}__DATABASE__HOST`]: host,
+            [`${prefix}__DATABASE__PORT`]: port,
+            [`${prefix}__DATABASE__DATABASE`]: database,
+            [`${prefix}__DATABASE__USER`]: user,
+            [`${prefix}__DATABASE__PASSWORD`]: password,
+        });
+    return { host, port: Number(port), database, user, password, connectionString, env };
+}
+/** Two named infrastructure services must not silently assign different owners
+ * to the same resolved database. Several registries under one owner are valid. */
+export function validateMigrationDestinations(targets) {
+    const owners = new Map();
+    for (const { app, database } of targets) {
+        const identity = JSON.stringify([database.host, database.port, database.database]);
+        const owner = owners.get(identity);
+        if (owner && owner !== app)
+            throw Error(`Resolved migration database ${database.database} has conflicting owners ${owner} and ${app}`);
+        owners.set(identity, app);
+    }
+}
+function contained(root, file) {
+    const relative = path.relative(root, file);
+    return relative !== '' && relative !== '..' && !relative.startsWith('..' + path.sep) && !path.isAbsolute(relative);
+}
+/** Admission is delegated to the same manifest/closure/owner verifier as app launch.
+ * A receipt alone is never authority to execute a selected release. No DB or child is touched. */
+export async function localMigrationTargets(requests, entries, projectPath, verify) {
+    const plan = requests;
+    validateMigrationOwners(plan, entries);
+    const sealed = plan.filter(request => entries.find(entry => entry.name === request.app)?.releaseRoot);
+    if (sealed.length && !verify)
+        throw Error('Requested release migrations require canonical installation verification');
+    const verified = sealed.length ? await verify([...new Set(sealed.map(request => request.app))], requiredMigrationFiles(sealed)) : [];
+    const targets = [];
+    for (const request of plan) {
+        const app = request.app, entry = entries.find(candidate => candidate.name === app);
+        let cwd, script, environmentApp = app, nodeOptions = '';
+        if (entry.releaseRoot) {
+            const checked = verified.find(candidate => candidate.name === app);
+            if (!checked || checked.releaseRoot !== entry.releaseRoot || checked.bootstrap !== entry.bootstrap || checked.script !== entry.script)
+                throw Error(`Migration installation changed for ${app}`);
+            cwd = entry.releaseRoot;
+            script = path.join(cwd, request.release);
+            const receipt = await readInstalledReleaseReceipt(cwd);
+            environmentApp = receipt.origin.runtimeOrigin?.producerApp ?? app;
+            nodeOptions = releaseOptionsForEnv(checked.env);
+        }
+        else {
+            cwd = resolveAppPath(projectPath, entry);
+            // true historically names apps/<database>; the config loader stamps an omitted cwd
+            // to the project root. Preserve that spelling, without a missing-file fallback.
+            if (request.mode === 'script' && cwd === path.resolve(projectPath))
+                cwd = path.join(projectPath, 'apps', app);
+            script = path.join(cwd, request.source);
+        }
+        try {
+            const physicalCwd = await fs.realpath(cwd), physicalScript = await fs.realpath(script);
+            if (!contained(physicalCwd, physicalScript))
+                throw Error();
+            if (entry.releaseRoot && (physicalCwd !== cwd || physicalScript !== script))
+                throw Error();
+            if (!(await fs.lstat(script)).isFile())
+                throw Error();
+            cwd = physicalCwd;
+            script = physicalScript;
+        }
+        catch {
+            throw Error(`Migration requested for ${app}, but its migration script is unavailable or not a physical file within its package`);
+        }
+        targets.push({ ...request, environmentApp, script, cwd, sealed: !!entry.releaseRoot, nodeOptions });
+    }
+    return targets;
+}
+//# sourceMappingURL=migration-target.js.map

package/dist/services/migration-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-target.js","sourceRoot":"","sources":["../../src/services/migration-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAYnE,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,KAAa;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QACnF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACvG,MAAM,KAAK,CAAC,aAAa,KAAK,2CAA2C,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,OAAO,GAAG,UAAU;IACpD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;AACpI,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,QAAuD;IAC9F,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU;YAAE,SAAS;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACrI,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC3H,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,QAAuD;IACzF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,IAAI,WAAW,CAAC,OAAO,KAAK,UAAU;YAAE,SAAS;QACjD,MAAM,SAAS,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;QACxI,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,KAAK,CAAC,qCAAqC,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC;YAC5I,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;gBAAE,MAAM,KAAK,CAAC,2DAA2D,OAAO,IAAI,QAAQ,oDAAoD,CAAC,CAAC;YAC3L,MAAM,KAAK,GAAI,MAAgC,CAAC,OAAO,CAAC;YACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK;gBAAE,SAAS;YACrD,MAAM,QAAQ,GAAG,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;gBACnH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAAE,MAAM,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;gBAChJ,MAAM,OAAO,GAAG,KAAyB,CAAC;gBAC1C,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,MAAM,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;gBAChJ,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;gBAClI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,MAAM,KAAK,CAAC,+BAA+B,QAAQ,yCAAyC,CAAC,CAAC;gBAC/H,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3F,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAAE,MAAM,KAAK,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;YACrF,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC,YAAY,QAAQ,gCAAgC,CAAC,CAAC;YAChI,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,QAAQ;oBAAE,MAAM,KAAK,CAAC,yBAAyB,OAAO,CAAC,GAAG,gCAAgC,QAAQ,KAAK,QAAQ,GAAG,CAAC,CAAC;gBACxH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,QAAqC,EAAE,OAAsC;IACnH,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ;YACrH,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACjH,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,KAAK,KAAK;YACrD,MAAM,KAAK,CAAC,2BAA2B,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,8CAA8C,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3I,CAAC;AACH,CAAC;AAED;;0FAE0F;AAC1F,MAAM,UAAU,wBAAwB,CAAoD,QAAqC,EAAE,UAAwB;IACzJ,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9H,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,wFAAwF,CAAC,CAAC;QAC9J,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,iIAAiI,CAAC,CAAC;IACpK,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAqC;IAC1E,MAAM,MAAM,GAA6B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC;IACzF,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,gBAAwB,EAAE,gBAAyB,EAAE,IAAI,GAAwB,QAAQ;IACjJ,IAAI,GAAQ,EAAE,QAAgB,EAAE,IAAY,EAAE,QAAgB,CAAC;IAC/D,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChC,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAClF,CAAC,gBAAgB,KAAK,SAAS,IAAI,QAAQ,KAAK,gBAAgB,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;QACjI,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAC,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,KAAK,CAAC,iBAAiB,GAAG,iDAAiD,gBAAgB,CAAC,CAAC,CAAC,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IACzJ,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,KAAK,CAAC,iBAAiB,GAAG,+HAA+H,CAAC,CAAC;IACpN,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACnK,MAAM,KAAK,CAAC,iBAAiB,GAAG,0HAA0H,CAAC,CAAC;IAC9J,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,GAAG,GAA2B,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACvE,IAAI,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;YACxC,CAAC,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI;YACnC,CAAC,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI;YACnC,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,QAAQ;YAC3C,CAAC,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI;YACnC,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,QAAQ;SAC5C,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;AACvF,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,6BAA6B,CAAC,OAA8F;IAC1I,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK,IAAI,KAAK,KAAK,GAAG;YAAE,MAAM,KAAK,CAAC,+BAA+B,QAAQ,CAAC,QAAQ,2BAA2B,KAAK,QAAQ,GAAG,EAAE,CAAC,CAAC;QACvI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAUD,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACrH,CAAC;AAED;kGACkG;AAClG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAqC,EAAE,OAAsC,EACvH,WAAmB,EAAE,MAA+B;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACtG,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACtH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAO,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtI,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAE,CAAC;QACpF,IAAI,GAAW,EAAE,MAAc,EAAE,cAAc,GAAG,GAAG,EAAE,WAAW,GAAG,EAAE,CAAC;QACxE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBACnI,MAAM,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;YAC3D,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACvD,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,IAAI,GAAG,CAAC;YAClE,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACzC,mFAAmF;YACnF,gFAAgF;YAChF,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBAAE,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9G,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC;gBAAE,MAAM,KAAK,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,WAAW,KAAK,GAAG,IAAI,cAAc,KAAK,MAAM,CAAC;gBAAE,MAAM,KAAK,EAAE,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,MAAM,KAAK,EAAE,CAAC;YACtD,GAAG,GAAG,WAAW,CAAC;YAAC,MAAM,GAAG,cAAc,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,KAAK,CAAC,2BAA2B,GAAG,qFAAqF,CAAC,CAAC;QAAC,CAAC;QAC7I,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/services/node-deploy-lease.d.ts

@@ -1,7 +1,7 @@
 /**
  * One writer per node.
  *
- * Any number of development machines may run `omnitron stack start daos test`,
+ * Any number of development machines may run `omnitron stack start sample test`,
  * and every one of them is a master that deploys to the SAME node over SSH.
  * Nothing stopped two of them — or two terminals on one of them — from
  * interleaving: one delivering artifacts while the other restarted the apps
@@ -14,7 +14,8 @@
  * within the last `leaseSec` is refused and told who holds it; one that finds
  * it older takes it over, and says so. A laptop closed mid-deployment therefore
  * frees the only test server by itself, `leaseSec` after its last renewal,
- * instead of wedging it until someone logs in to delete a file.
+ * provided its remote command completed. A killed host worker leaves durable
+ * unresolved intent and requires inspected recovery instead of an unsafe takeover.
  *
  * Every read-decide-write of that file runs under `flock` on the node, so two
  * masters deciding at the same instant cannot both win. A node that cannot
@@ -70,6 +71,8 @@ export type ReleaseAnswer = {
 } | {
     kind: 'not-held';
     holder: LeaseRecord | null;
+} | {
+    kind: 'busy';
 };
 /** The node answered, and cannot provide exclusion. Refuse the deployment. */
 export declare class LeaseUnavailableError extends Error {
@@ -85,6 +88,17 @@ export declare class LeaseHeldError extends Error {
     readonly leaseSec: number;
     constructor(node: string, holder: LeaseRecord | null, idleSec: number, leaseSec: number);
 }
+/**
+ * Keep host mutations exclusive for the entire remote command, not just the
+ * controller's pre-step check. The child does not inherit the lock descriptor.
+ * A durable intent survives SIGKILL of the lock holder: it is never treated as
+ * completed merely because a lease or timeout elapsed. Ordinary disconnects
+ * leave the host worker to finish and clear its own record. An unresolved
+ * record requires inspected recovery before another writer can take over.
+ * Commands must synchronously finish their mutations; managed daemon startup
+ * may detach the daemon, but must not detach delayed deployment writes.
+ */
+export declare function guardScript(timing: LeaseTiming, token: string, command: string, timeoutMs?: number): string;
 export declare function acquireScript(timing: LeaseTiming, record: LeaseRecord): string;
 export declare function renewScript(timing: LeaseTiming, token: string): string;
 export declare function releaseScript(timing: LeaseTiming, token: string): string;
@@ -118,6 +132,7 @@ export declare class NodeLease {
      * say, which is not a yes.
      */
     confirm(step: string): Promise<void>;
+    guard(command: string, timeoutMs?: number): string;
     release(): Promise<ReleaseAnswer>;
 }
 export interface LeaseCandidate {
@@ -137,6 +152,8 @@ export interface HeldLeases {
     has(node: string): boolean;
     /** Confirm with the node before a step that changes it; throws if not ours. */
     confirm(node: string, step: string): Promise<void>;
+    /** Host-side exclusion and token validation for the entire remote command. */
+    guard(node: string, command: string, timeoutMs?: number): string;
     /** Nodes that could not be reached to lease them, with the reason. */
     readonly unreachable: ReadonlyMap<string, string>;
 }

package/dist/services/node-deploy-lease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-deploy-lease.d.ts","sourceRoot":"","sources":["../../src/services/node-deploy-lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAIjE,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,GACtF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAC;AAElE,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAC;AAE7F,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAC;AAEpG,8EAA8E;AAC9E,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAFzB,YACW,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EAIxB;CACF;AAED,yCAAyC;AACzC,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJ3B,YACW,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAW1B;CACF;AAuBD,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAe9E;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMtE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMxE;AAoDD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAerE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAOjE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAOrE;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAWtD;AAMD,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9D,qBAAa,SAAS;IAOlB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAEpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,QAAQ,CAAS;IAEzB,YACW,IAAI,EAAE,MAAM,EACJ,GAAG,EAAE,WAAW,EACjC,KAAK,EAAE,MAAM,EACI,MAAM,GAAE,WAAkC,EAC3D,GAAG,GAAE,MAAM,MAAiB,EAS7B;IAEK,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,CAEtC;IAED;;;;OAIG;IACH,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAWpC;YAEa,SAAS;IAWvB;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBzC;IAEK,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,CAItC;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,4EAA4E;IAC5E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,UAAU,EAAE,SAAS,cAAc,EAAE,EACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1C,MAAM,GAAE,WAAkC,GACzC,OAAO,CAAC,CAAC,CAAC,CAoEZ"}
+{"version":3,"file":"node-deploy-lease.d.ts","sourceRoot":"","sources":["../../src/services/node-deploy-lease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAIjE,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,GACtF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAC;AAElE,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAC;AAE7F,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvH,8EAA8E;AAC9E,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAFzB,YACW,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EAIxB;CACF;AAED,yCAAyC;AACzC,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJ3B,YACW,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAW1B;CACF;AAkCD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,SAAU,GAAG,MAAM,CAmC5G;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAgB9E;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMtE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOxE;AAsDD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAerE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAOjE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAQrE;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAWtD;AAMD,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9D,qBAAa,SAAS;IAOlB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAEpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,QAAQ,CAAS;IAEzB,YACW,IAAI,EAAE,MAAM,EACJ,GAAG,EAAE,WAAW,EACjC,KAAK,EAAE,MAAM,EACI,MAAM,GAAE,WAAkC,EAC3D,GAAG,GAAE,MAAM,MAAiB,EAS7B;IAEK,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,CAEtC;IAED;;;;OAIG;IACH,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAWpC;YAEa,SAAS;IAWvB;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBzC;IAED,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAA4E;IAExH,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,CAItC;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,4EAA4E;IAC5E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,8EAA8E;IAC9E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjE,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,UAAU,EAAE,SAAS,cAAc,EAAE,EACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1C,MAAM,GAAE,WAAkC,GACzC,OAAO,CAAC,CAAC,CAAC,CAyEZ"}