@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/release/layout.js

@@ -1,46 +1,100 @@
 /**
- * Where a release is built, so the lockfile's links land on the omni clone.
- *
- * Until the registry migration the project declares every omni package as a
- * `link:` to a checkout on the developer's disk, and the lockfile records it
- * RELATIVE to each importer — `link:../../luxquant/omnitron-dev/omni/apps/omnitron`
- * from the project root. `pnpm install --frozen-lockfile` follows that
- * relative path. So a clean clone of the project placed anywhere else either
- * links nothing (measured 2026-09-22: 97 of 97 links dangling, install exit 0)
- * or, placed at the same depth as the working checkout, links the DEVELOPER'S
- * omni — dirty tree and all — into a build that claims to be a commit.
- *
- * A release is therefore built inside a root that reproduces the relative
- * layout, with a clean clone of omni exactly where the links point. The
- * layout is read from the lockfile rather than written down here, because the
- * lockfile is what pnpm will follow.
+ * Resolve framework inputs from the project commit's pnpm lock. External
+ * workspace links have to land on an isolated checkout at the same relative
+ * path. Archive inputs pin the SHA-512 of either a configured registry tarball or
+ * a regular file committed in the project.
  */
 import fs from 'node:fs';
 import path from 'node:path';
-/** `importer → link targets`, from the lockfile's `importers:` section. */
-function importerLinks(lockfile) {
-    const out = [];
-    let inImporters = false;
-    let importer = null;
-    for (const line of lockfile.split('\n')) {
-        if (/^importers:\s*$/.test(line)) {
-            inImporters = true;
+import { parseAllDocuments } from 'yaml';
+const sections = ['dependencies', 'devDependencies', 'optionalDependencies'];
+const VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)?(?:\+[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)?$/;
+const INTEGRITY = /^sha512-[A-Za-z0-9+/]{85}[AQgw]==$/;
+function externalFile(importer, dependency) {
+    const file = dependency.slice('file:'.length);
+    const target = path.posix.normalize(path.posix.join(importer, file));
+    return path.posix.isAbsolute(file) || file.includes('\\') || target === '..' || target.startsWith('../');
+}
+function readGraph(lockfile) {
+    const links = [], packages = [], importers = [];
+    const vendored = [], frameworkInputs = [];
+    const snapshots = new Set();
+    for (const document of parseAllDocuments(lockfile)) {
+        if (document.errors.length)
+            throw Error('Invalid pnpm-lock.yaml: ' + document.errors[0].message);
+        const graph = document.toJS();
+        if (!graph)
             continue;
+        for (const key of Object.keys(graph.snapshots ?? {})) {
+            if (key.startsWith('@omnitron-dev/'))
+                snapshots.add(key);
         }
-        if (!inImporters)
-            continue;
-        if (/^\S/.test(line))
-            break; // the next top-level key
-        const key = /^ {2}([^\s].*?):\s*$/.exec(line);
-        if (key) {
-            importer = key[1].replace(/^['"]|['"]$/g, '');
-            continue;
+        for (const [importer, dependencies] of Object.entries(graph.importers ?? {})) {
+            if (importer !== '.' && (path.posix.normalize(importer) !== importer || importer.startsWith('/') ||
+                importer.split('/').includes('..') || importer.includes('\\')))
+                throw Error('Unsafe lockfile importer: ' + importer);
+            importers.push(importer);
+            for (const section of sections)
+                for (const [name, entry] of Object.entries(dependencies[section] ?? {})) {
+                    if (typeof entry?.version !== 'string')
+                        throw Error('Unsupported pnpm lockfile dependency: ' + name);
+                    if (entry.version.startsWith('file:') && externalFile(importer, entry.version))
+                        throw Error('File dependency resolves outside the committed project: ' + name);
+                    if (entry.version.startsWith('link:'))
+                        links.push({ importer, name, rel: entry.version.slice(5) });
+                    if (name.startsWith('@omnitron-dev/'))
+                        frameworkInputs.push({ importer, name, dependency: entry });
+                }
+        }
+        for (const [key, pkg] of Object.entries(graph.packages ?? {})) {
+            const filePrefix = key.indexOf('@file:');
+            if (filePrefix !== -1 && externalFile('.', key.slice(filePrefix + 1)))
+                throw Error('File dependency resolves outside the committed project: ' + key);
+            if (!key.startsWith('@omnitron-dev/'))
+                continue;
+            const match = /^(@omnitron-dev\/[a-z0-9][a-z0-9._-]*)@(.+)$/.exec(key);
+            const resolution = pkg.resolution;
+            if (!match || !resolution || typeof resolution.integrity !== 'string' || !INTEGRITY.test(resolution.integrity) || resolution.type)
+                throw Error('Framework dependency requires an exact archive with SHA-512: ' + key);
+            const name = match[1], locator = match[2], integrity = resolution.integrity;
+            if (locator.startsWith('file:')) {
+                const file = locator.slice(5);
+                if (!file.endsWith('.tgz') || !file.split('/').every(part => /^[A-Za-z0-9_@.-]+$/.test(part) && part !== '.' && part !== '..')) {
+                    throw Error('Unsafe committed framework archive path: ' + file);
+                }
+                if (resolution.tarball !== locator || Object.keys(resolution).some(field => field !== 'tarball' && field !== 'integrity') ||
+                    typeof pkg.version !== 'string' || !VERSION.test(pkg.version)) {
+                    throw Error('Vendored framework package requires a matching file tarball and an exact version: ' + key);
+                }
+                vendored.push({ name, version: pkg.version, file, integrity });
+            }
+            else {
+                if (!VERSION.test(locator)) {
+                    throw Error('Framework dependency must resolve to an exact registry archive with SHA-512: ' + name);
+                }
+                if (resolution.tarball !== undefined) {
+                    if (typeof resolution.tarball !== 'string')
+                        throw Error('Invalid locked framework archive URL: ' + name);
+                    let url;
+                    try {
+                        url = new URL(resolution.tarball);
+                    }
+                    catch {
+                        throw Error('Invalid locked framework archive URL: ' + name);
+                    }
+                    // Credentials belong to pnpm's operator auth configuration, never to
+                    // a committed lockfile or the public release source receipt.
+                    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash ||
+                        resolution.tarball.length > 8192)
+                        throw Error('Locked framework archive URL must be credential-free HTTP(S): ' + name);
+                }
+                packages.push({ name, version: locator, integrity, ...(resolution.tarball === undefined ? {} : { tarball: resolution.tarball }) });
+            }
         }
-        const link = /^\s+version: link:(\S+)\s*$/.exec(line);
-        if (link && importer !== null)
-            out.push({ importer, rel: link[1] });
+        if (Object.keys(graph.patchedDependencies ?? {}).some(key => key.startsWith('@omnitron-dev/')))
+            throw Error('Local patches of framework packages cannot be attested');
     }
-    return out;
+    return { links, packages, vendored, frameworkInputs, snapshots, importers: [...new Set(importers)] };
 }
 /**
  * Read the layout the lockfile implies, or say why there is none.
@@ -51,17 +105,19 @@ function importerLinks(lockfile) {
  * out by one clone, and guessing which one is "omni" would build from the
  * wrong one.
  */
-export function readLinkLayout(lockfile) {
+function layoutOf(links) {
     const roots = new Set();
     const dirs = new Set();
     const strays = [];
-    for (const { importer, rel } of importerLinks(lockfile)) {
+    for (const { importer, name, rel } of links) {
+        if (path.posix.isAbsolute(rel) || rel.includes('\\'))
+            return { refusal: 'nonportable lockfile link: ' + rel };
         const target = path.posix.normalize(path.posix.join(importer === '.' ? '' : importer, rel));
-        if (!target.startsWith('../'))
+        if (target !== '..' && !target.startsWith('../'))
             continue; // inside the project: its own workspace
         const parts = target.split('/');
         const kind = parts[parts.length - 2];
-        if (parts.length < 3 || (kind !== 'packages' && kind !== 'apps')) {
+        if (!name.startsWith('@omnitron-dev/') || parts.length < 3 || (kind !== 'packages' && kind !== 'apps')) {
             strays.push(target);
             continue;
         }
@@ -71,9 +127,8 @@ export function readLinkLayout(lockfile) {
     if (strays.length > 0) {
         return { refusal: `the lockfile links outside the project to something that is not a workspace package: ${strays.slice(0, 3).join(', ')}` };
     }
-    if (roots.size === 0) {
-        return { refusal: 'the lockfile links nothing outside the project — there is no omni checkout to lay out' };
-    }
+    if (roots.size === 0)
+        return null;
     if (roots.size > 1) {
         return { refusal: `the lockfile links into ${roots.size} outside checkouts (${[...roots].join(', ')}) — one clone cannot stand in for them` };
     }
@@ -81,29 +136,85 @@ export function readLinkLayout(lockfile) {
     const climbs = omniRel.split('/').filter((p) => p === '..').length;
     return { omniRel, climbs, linkedDirs: [...dirs].sort() };
 }
-/**
- * The two checkouts inside `srcRoot`: the project where its own last
- * `climbs` path segments put it, and omni where its links then land.
- */
-export function planBuildRoot(srcRoot, projectPath, layout) {
+/** Compatibility API for projects which explicitly reproduce a linked checkout. */
+export function readLinkLayout(lockfile) {
+    try {
+        return layoutOf(readGraph(lockfile).links) ?? { refusal: 'the lockfile links nothing outside the project — there is no omni checkout to lay out' };
+    }
+    catch (error) {
+        return { refusal: error.message };
+    }
+}
+export function readFrameworkLayout(lockfile) {
+    const graph = readGraph(lockfile);
+    const linked = layoutOf(graph.links);
+    if (linked && 'refusal' in linked)
+        throw Error(linked.refusal);
+    if (graph.vendored.length) {
+        if (linked || graph.packages.length)
+            throw Error('Cannot combine local framework archives with a linked checkout or npm release inputs');
+        if (new Set(graph.vendored.map(pkg => pkg.file)).size !== graph.vendored.length)
+            throw Error('A committed framework archive must identify a single package');
+        const byName = new Map(graph.vendored.map(pkg => [pkg.name, pkg]));
+        for (const { importer, name, dependency } of graph.frameworkInputs) {
+            const pkg = byName.get(name);
+            const suffix = dependency.version.indexOf('(');
+            const base = suffix === -1 ? dependency.version : dependency.version.slice(0, suffix);
+            if (!pkg || base !== 'file:' + pkg.file || (suffix !== -1 && !graph.snapshots.has(name + '@' + dependency.version)))
+                throw Error('Framework importer must resolve to its committed archive and exact peer snapshot: ' + importer + ' / ' + name);
+            if (dependency.specifier?.startsWith('file:') && dependency.specifier.slice(5) !== path.posix.relative(importer, pkg.file))
+                throw Error('Importer file specifier differs from its committed framework archive: ' + importer + ' / ' + name);
+        }
+    }
+    else {
+        if (linked && !graph.packages.length && !graph.frameworkInputs.some(input => input.dependency.version.startsWith('file:')))
+            return { kind: 'linked', layout: linked };
+        if (linked || graph.frameworkInputs.some(input => /^(?:link:|file:|workspace:)/.test(input.dependency.version)))
+            throw Error('Cannot combine local framework packages and npm release inputs');
+    }
+    const archives = graph.vendored.length ? graph.vendored : graph.packages;
+    if (!archives.some(pkg => pkg.name === '@omnitron-dev/omnitron'))
+        throw Error('The lockfile must include @omnitron-dev/omnitron with a verifiable archive or checkout');
+    if (new Set(archives.map(pkg => pkg.name)).size !== archives.length)
+        throw Error('Multiple versions of the same framework package cannot identify one release');
+    const byName = (a, b) => a.name.localeCompare(b.name);
+    return graph.vendored.length
+        ? { kind: 'vendored', packages: graph.vendored.sort(byName), importers: graph.importers }
+        : { kind: 'registry', packages: graph.packages.sort(byName), importers: graph.importers };
+}
+/** Lay out complete checkouts while preserving the registered project's location inside Git. */
+export function planBuildRoot(srcRoot, projectPath, layout, repositoryPath = projectPath) {
+    const subdirectory = path.relative(repositoryPath, projectPath);
+    if (subdirectory === '..' || subdirectory.startsWith('..' + path.sep) || path.isAbsolute(subdirectory)) {
+        return { refusal: `project ${projectPath} is outside its Git checkout ${repositoryPath}` };
+    }
+    if (!layout) {
+        const repositoryDir = path.join(srcRoot, 'project');
+        return { repositoryDir, projectDir: path.join(repositoryDir, subdirectory), omniDir: null };
+    }
     const segments = path.resolve(projectPath).split(path.sep).filter(Boolean);
     if (layout.climbs < 1 || layout.climbs > segments.length) {
         return { refusal: `the links climb ${layout.climbs} directories above a project at ${projectPath}` };
     }
-    const projectDir = path.join(srcRoot, ...segments.slice(-layout.climbs));
+    const prefixDepth = subdirectory.split(path.sep).filter(Boolean).length;
+    const retained = Math.max(layout.climbs, prefixDepth + 1);
+    const projectDir = path.join(srcRoot, ...segments.slice(-retained));
+    const repositoryDir = path.resolve(projectDir, path.relative(projectPath, repositoryPath));
     const omniDir = path.resolve(projectDir, layout.omniRel);
-    const inside = omniDir.startsWith(path.resolve(srcRoot) + path.sep);
-    if (!inside) {
+    if (!omniDir.startsWith(path.resolve(srcRoot) + path.sep)) {
         return { refusal: `omni would land at ${omniDir}, outside the build root ${srcRoot}` };
     }
-    return { projectDir, omniDir };
+    if (omniDir === repositoryDir || omniDir.startsWith(repositoryDir + path.sep) || repositoryDir.startsWith(omniDir + path.sep)) {
+        return { refusal: 'project and framework need separate Git checkouts in the build root' };
+    }
+    return { repositoryDir, projectDir, omniDir };
 }
 /**
  * The project's real directory and the omni checkout its links point to.
  *
  * From the REAL path, because that is where pnpm resolves a relative link
- * from. The registry holds `omni/internal/daos`, a symlink to
- * `~/projects/dao/daos`; resolved from the symlink, `../../luxquant/…` named
+ * from. The registry holds `omni/internal/sample`, a symlink to
+ * `~/projects/examples/sample`; resolved from the symlink, `../../luxquant/…` named
  * a directory that does not exist, and the first `git` run there failed with
  * a bare `spawn git ENOENT`.
  */

package/dist/release/layout.js.map

@@ -1 +1 @@
-{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B,2EAA2E;AAC3E,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,GAAG,GAA6C,EAAE,CAAC;IACzD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,yBAAyB;QACtD,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,GAAG,EAAE,CAAC;YACR,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,wCAAwC;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9I,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC;IAChJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,WAAmB,EACnB,MAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,mBAAmB,MAAM,CAAC,MAAM,mCAAmC,WAAW,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,4BAA4B,OAAO,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,MAAkB;IACtE,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAkBzC,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAU,CAAC;AAGtF,MAAM,OAAO,GAAG,iIAAiI,CAAC;AAClJ,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAKvD,SAAS,YAAY,CAAC,QAAgB,EAAE,UAAkB;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,KAAK,GAAW,EAAE,EAAE,QAAQ,GAAsB,EAAE,EAAE,SAAS,GAAa,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAsB,EAAE,EAAE,eAAe,GAAqB,EAAE,CAAC;IAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,0BAA0B,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAyB,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,IAAI,QAAQ,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC5F,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,KAAK,CAAC,4BAA4B,GAAG,QAAQ,CAAC,CAAC;YACzH,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,QAAQ;gBAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBACxG,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;oBACrG,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;wBAC5E,MAAM,KAAK,CAAC,0DAA0D,GAAG,IAAI,CAAC,CAAC;oBACjF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACnG,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;wBAAE,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrG,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,KAAK,CAAC,0DAA0D,GAAG,GAAG,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,SAAS;YAChD,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;YAClC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI;gBAC/H,MAAM,KAAK,CAAC,+DAA+D,GAAG,GAAG,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,EAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,EAAE,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YAC9E,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBAC/H,MAAM,KAAK,CAAC,2CAA2C,GAAG,IAAI,CAAC,CAAC;gBAClE,CAAC;gBACD,IAAI,UAAU,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,CAAC;oBACrH,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClE,MAAM,KAAK,CAAC,oFAAoF,GAAG,GAAG,CAAC,CAAC;gBAC1G,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,MAAM,KAAK,CAAC,+EAA+E,GAAG,IAAI,CAAC,CAAC;gBACtG,CAAC;gBACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBACrC,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;oBACzG,IAAI,GAAQ,CAAC;oBACb,IAAI,CAAC;wBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,MAAM,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;oBAAC,CAAC;oBAClH,qEAAqE;oBACrE,6DAA6D;oBAC7D,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;wBACrG,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI;wBAClC,MAAM,KAAK,CAAC,gEAAgE,GAAG,IAAI,CAAC,CAAC;gBACzF,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YACrI,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC5F,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,GAAG,GAAG,EAAE,CAAC;QAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5F,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,wCAAwC;QACpG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9I,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC;IAChJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC;IACrJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACnE,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACzI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC7E,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACtF,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBACjH,MAAM,KAAK,CAAC,oFAAoF,GAAG,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;YAC9H,IAAI,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;gBACxH,MAAM,KAAK,CAAC,wEAAwE,GAAG,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5C,IAAI,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7G,MAAM,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,wBAAwB,CAAC;QAC9D,MAAM,KAAK,CAAC,wFAAwF,CAAC,CAAC;IACxG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QACjE,MAAM,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,CAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM;QAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;QACzF,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AAC9F,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,WAAmB,EACnB,MAA8B,EAC9B,cAAc,GAAG,WAAW;IAE5B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACvG,OAAO,EAAE,OAAO,EAAE,WAAW,WAAW,gCAAgC,cAAc,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,mBAAmB,MAAM,CAAC,MAAM,mCAAmC,WAAW,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,4BAA4B,OAAO,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9H,OAAO,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,MAAkB;IACtE,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/release/load.d.ts

@@ -14,6 +14,8 @@ export interface LoadedRelease {
     readonly id: string;
     readonly root: string;
     readonly manifest: ReleaseManifest;
+    /** Digest of the exact manifest bytes admitted with these artifacts. */
+    readonly manifestSha256: string;
     /** Each artifact's tarball on this machine, checked against the manifest. */
     readonly files: ReadonlyArray<{
         app: string;
@@ -27,6 +29,7 @@ export interface LoadedRelease {
     readonly staticsDir: string | null;
 }
 export declare function releasesRoot(): string;
+export declare function assertReleaseId(id: string): void;
 export declare function loadRelease(id: string, root?: string): Promise<LoadedRelease>;
 /**
  * Is this directory's tracked content exactly `commit`, with nothing

package/dist/release/load.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/release/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7H,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAeD,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAgCnG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM;AACd,wEAAwE;AACxE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAS9D"}
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/release/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAMrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7H,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAeD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqDnG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM;AACd,wEAAwE;AACxE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgB9D"}

package/dist/release/load.js

@@ -15,6 +15,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import { OMNITRON_HOME } from '../config/defaults.js';
+import { MAX_RELEASE_MANIFEST_BYTES, isReadableReleaseManifest, validateReleaseOrigins } from './origin.js';
+import { assertReleaseRepositoryIdentities } from './repository-identity.js';
 const exec = promisify(execFile);
 export function releasesRoot() {
     return path.join(OMNITRON_HOME, 'releases');
@@ -30,25 +32,58 @@ function sha256Of(file) {
 }
 /** A release id names a directory; it may not name one anywhere else. */
 const RELEASE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-export async function loadRelease(id, root = releasesRoot()) {
+export function assertReleaseId(id) {
     if (!RELEASE_ID.test(id) || id.includes('..'))
         throw new Error(`'${id}' is not a release id`);
+}
+export async function loadRelease(id, root = releasesRoot()) {
+    assertReleaseId(id);
     const dir = path.join(root, id);
     const manifestPath = path.join(dir, 'manifest.json');
     if (!fs.existsSync(manifestPath)) {
         throw new Error(`No release '${id}' on this machine — ${manifestPath} does not exist. \`ls ${root}\` lists what was built.`);
     }
-    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    if (fs.realpathSync(manifestPath) !== path.join(fs.realpathSync(root), id, 'manifest.json') ||
+        !fs.lstatSync(manifestPath).isFile())
+        throw Error('Release manifest must be a physical file in its store');
+    if (fs.statSync(manifestPath).size > MAX_RELEASE_MANIFEST_BYTES)
+        throw Error('Release manifest exceeds 8 MiB');
+    const manifestBytes = fs.readFileSync(manifestPath);
+    if (manifestBytes.length > MAX_RELEASE_MANIFEST_BYTES)
+        throw Error('Release manifest exceeds 8 MiB');
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestBytes.toString('utf8'));
+    }
+    catch {
+        throw Error('Release manifest is not valid JSON');
+    }
+    assertReleaseRepositoryIdentities(manifest);
+    if (!isReadableReleaseManifest(manifest))
+        throw Error('Invalid or duplicate release artifact or manifest fields');
+    const manifestSha256 = crypto.createHash('sha256').update(manifestBytes).digest('hex');
     if (manifest.id !== id)
         throw new Error(`${manifestPath} names release '${manifest.id}', not '${id}'`);
+    validateReleaseOrigins(manifest);
     const files = [];
+    const seen = new Set();
+    if (!Array.isArray(manifest.artifacts) || manifest.artifacts.length > 256)
+        throw Error('Invalid release artifact inventory');
     for (const a of manifest.artifacts) {
+        if (!a || typeof a.app !== 'string' || !RELEASE_ID.test(a.app) || a.app.includes('..') ||
+            typeof a.version !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(a.version) || a.version.includes('..') ||
+            seen.has(a.app) || !Number.isSafeInteger(a.bytes) || a.bytes <= 0 || !/^[a-f0-9]{64}$/.test(a.sha256))
+            throw Error('Invalid or duplicate release artifact');
+        seen.add(a.app);
         const file = path.join(dir, 'artifacts', `${a.app}-${a.version}.tar.gz`);
         if (!fs.existsSync(file))
             throw new Error(`Release ${id} names ${a.app}@${a.version}, and ${file} is not there`);
         // Size first: it tells a truncated copy from a different file, which a
         // checksum mismatch alone does not.
-        const bytes = fs.statSync(file).size;
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || fs.realpathSync(file) !== path.join(fs.realpathSync(root), id, 'artifacts', path.basename(file)))
+            throw Error('Release artifact must be a physical file in its store');
+        const bytes = stat.size;
         if (bytes !== a.bytes) {
             throw new Error(`Release ${id}: ${a.app}'s tarball is ${bytes} bytes, and the manifest recorded ${a.bytes}`);
         }
@@ -62,7 +97,7 @@ export async function loadRelease(id, root = releasesRoot()) {
     if (staticsDir && !fs.existsSync(staticsDir)) {
         throw new Error(`Release ${id} records a static bundle for ${manifest.statics.stack}, and ${staticsDir} is not there`);
     }
-    return { id, root: dir, manifest, files, staticsDir };
+    return { id, root: dir, manifest, manifestSha256, files, staticsDir };
 }
 /**
  * Is this directory's tracked content exactly `commit`, with nothing
@@ -74,10 +109,17 @@ export async function treeEqualsCommit(dir, commit,
 paths) {
     if (paths && paths.length === 0)
         return { equal: true };
-    const run = async (args) => (await exec('git', args, { cwd: dir, maxBuffer: 16 * 1024 * 1024 })).stdout.split('\n').filter(Boolean);
-    const scope = paths ? ['--', ...paths] : ['--'];
-    const changed = await run(['diff', '--name-only', commit, ...scope]);
-    const untracked = await run(['ls-files', '--others', '--exclude-standard', ...(paths ? ['--', ...paths] : [])]);
+    const repository = (await exec('git', ['rev-parse', '--show-toplevel'], { cwd: dir })).stdout.trimEnd();
+    const selected = paths?.map(file => {
+        const relative = path.relative(repository, path.resolve(dir, file));
+        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+            throw new Error('A compared deployment input is outside the source repository');
+        return relative || '.';
+    });
+    const run = async (args) => (await exec('git', ['--literal-pathspecs', ...args], { cwd: repository, maxBuffer: 16 * 1024 * 1024 })).stdout.split('\0').filter(Boolean);
+    const scope = selected ? ['--', ...selected] : ['--'];
+    const changed = await run(['diff', '--no-ext-diff', '--no-textconv', '--name-only', '-z', commit, ...scope]);
+    const untracked = await run(['ls-files', '--others', '--exclude-standard', '-z', ...scope]);
     const files = [...changed, ...untracked.map((f) => `${f} (untracked)`)];
     return files.length === 0 ? { equal: true } : { equal: false, files };
 }

package/dist/release/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/release/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAYjC,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;aACtB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACzC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;aACnB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,IAAI,GAAW,YAAY,EAAE;IACzE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,uBAAuB,YAAY,yBAAyB,IAAI,0BAA0B,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAoB,CAAC;IACtF,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,mBAAmB,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAEvG,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,SAAS,IAAI,eAAe,CAAC,CAAC;QACjH,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,iBAAiB,KAAK,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,wBAAwB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC;QAC1J,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,gCAAgC,QAAQ,CAAC,OAAQ,CAAC,KAAK,SAAS,UAAU,eAAe,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,MAAc;AACd,wEAAwE;AACxE,KAAyB;IAEzB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,KAAK,EAAE,IAAc,EAAE,EAAE,CACnC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACxE,CAAC"}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/release/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5G,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAE7E,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAcjC,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;aACtB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACzC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;aACnB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAElD,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,IAAI,GAAW,YAAY,EAAE;IACzE,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,uBAAuB,YAAY,yBAAyB,IAAI,0BAA0B,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC;QACvF,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE;QAAE,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC/G,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,GAAG,0BAA0B;QAAE,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,aAAa,CAAC,MAAM,GAAG,0BAA0B;QAAE,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrG,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAC9D,MAAM,CAAC;QAAC,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAAC,CAAC;IAC5D,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QAAE,MAAM,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAClH,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,mBAAmB,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACvG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAEjC,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC7H,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpF,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7G,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACrG,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,SAAS,IAAI,eAAe,CAAC,CAAC;QACjH,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpH,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,IAAI,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,iBAAiB,KAAK,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,GAAG,wBAAwB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC;QAC1J,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,gCAAgC,QAAQ,CAAC,OAAQ,CAAC,KAAK,SAAS,UAAU,eAAe,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,MAAc;AACd,wEAAwE;AACxE,KAAyB;IAEzB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxG,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,OAAO,QAAQ,IAAI,GAAG,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,EAAE,IAAc,EAAE,EAAE,CACnC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACxE,CAAC"}

package/dist/release/local-installation.d.ts

@@ -0,0 +1,20 @@
+import type { IEcosystemAppEntry } from '../config/types.js';
+import type { LoadedRelease } from './load.js';
+import type { ReleaseLaunch } from './manifest.js';
+export declare class LocalReleaseNotPreparedError extends Error {
+}
+/** Preserve the existing remote bootstrap convention. Classic programs must actually publish their entry. */
+export declare function describeReleaseLaunch(staged: string, entry: IEcosystemAppEntry, relativeScript?: string): Promise<ReleaseLaunch | undefined>;
+/** Selection is stored by the caller. This only materializes verified immutable inputs;
+ * it never installs packages, mutates an owner, or rewrites a developer checkout. */
+export declare function inspectLocalReleaseInstallation(release: LoadedRelease, stack: string, entries: readonly IEcosystemAppEntry[], options?: {
+    prepare?: boolean;
+    ownerPid?: number;
+    ownerPackage?: string;
+    requiredFiles?: Readonly<Record<string, readonly string[]>>;
+}): Promise<IEcosystemAppEntry[]>;
+/** Materialize a payload without inventing a process or an execution-owner binding.
+ * Uses the existing release store and origin receipt; the payload's own target is
+ * checked against its closure, not asserted to be this host's execution runtime. */
+export declare function inspectLocalReleasePayloads(release: LoadedRelease, entries: readonly IEcosystemAppEntry[], prepare?: boolean): Promise<Map<string, string>>;
+//# sourceMappingURL=local-installation.d.ts.map

package/dist/release/local-installation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-installation.d.ts","sourceRoot":"","sources":["../../src/release/local-installation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAI7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD,qBAAa,4BAA6B,SAAQ,KAAK;CAAG;AAO1D,6GAA6G;AAC7G,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAUlJ;AA4BD;qFACqF;AACrF,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,kBAAkB,EAAE,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;CAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAyF9S;AAED;;oFAEoF;AACpF,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,kBAAkB,EAAE,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0D/J"}