@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/shared/release-reading.d.ts

@@ -1,29 +1,29 @@
-/**
- * How a release reads — its gates, and which stacks run it: one reading for
- * the CLI and the console.
- *
- * They read releases apart, and came apart:
- *
- *   - A build with `--skip-gates` records one outcome, `gates: not-run`, and
- *     as `passed/total` that is «0/1» — what one failed gate reads as too.
- *     The CLI learnt to say «skipped» (70b988a6); the console still drew
- *     «0/1».
- *   - A gate that timed out or was killed counted in `notRun` until 70b988a6
- *     gave each its own count. The console coloured by `failed` and `notRun`
- *     alone, so sample-202609230557, whose one gate that did not pass timed
- *     out, would have read a green «20/21».
- *   - A daemon whose database did not come up runs with no audit trail and
- *     serves `deployments()` as `[]` — the shape of «no stack has taken a
- *     release». The CLI learnt that in 70b988a6 and will not prune on it; the
- *     console read `[]` as it came, protected nothing, and a stack's card
- *     said «No recorded deployment of this stack yet» about a stack it could
- *     not ask about.
- *
- * Imported by the console through `@omnitron-dev/omnitron/release-reading`,
- * so nothing here may need Node.
- */
-import type { GateOutcome } from '../release/manifest.js';
-import type { ReleaseDeploymentDto } from './dto/services.js';
+/** Shared, browser-safe readings of release gates, Git provenance and deployment evidence. */
+import type { GateOutcome, ReleaseManifest } from '../release/manifest.js';
+import type { DeployProgressRecord, ReleaseDeploymentDto } from './dto/services.js';
+import type { IProjectInfo, IStackInfo } from './dto/project.js';
+/** Retried and concurrent builds can carry a private-directory suffix. */
+export declare function readReleaseId(id: string): {
+    project: string;
+    projectCommit: string | null;
+    omniCommit: string | null;
+};
+/** Interpret the daemon's start reply consistently for interactive and scripted callers. */
+export declare function readStackStart(stack: Pick<IStackInfo, 'status' | 'apps' | 'notUp'>): {
+    readonly confirmed: boolean;
+    readonly outcome: "confirmed" | "failed" | "partial";
+    readonly online: number;
+    readonly total: number;
+    readonly issues: string[];
+};
+export declare function deploymentProgressKey(record: Pick<DeployProgressRecord, 'project' | 'stack' | 'node' | 'app'>): string;
+/** Current observations, including imported stack names and earlier controllers with no attribution. */
+export declare function readDeploymentProgress(records: readonly DeployProgressRecord[], project: Pick<IProjectInfo, 'name' | 'configurations'>, stack?: string | null): {
+    transfers: DeployProgressRecord[];
+    unscoped: DeployProgressRecord[];
+};
+export declare function releaseTargetLabel(target?: import('../release/target-runtime.js').TargetRuntime): string;
+export declare function frameworkSourceLabel(manifest: ReleaseManifest): string;
 /**
  * The part of a release summary its gates are read from. Not the per-outcome
  * counts beyond `failed`: what did not pass and did not fail is unfinished,
@@ -32,6 +32,7 @@ import type { ReleaseDeploymentDto } from './dto/services.js';
  */
 export interface ReleaseGates {
     readonly complete: boolean;
+    readonly manifestError?: string;
     readonly gates: {
         readonly total: number;
         readonly passed: number;
@@ -51,9 +52,14 @@ export interface GatesReading {
 /** The single outcome a build records when it ran no gate at all, or null. */
 export declare function noGateRan(gates: readonly GateOutcome[]): GateOutcome | null;
 export declare function readGates(release: ReleaseGates): GatesReading;
+/** Finishing the archive step does not imply successful checks or deployment admission. */
+export declare function readBuildChecks(manifest: Pick<ReleaseManifest, 'gates' | 'artifactFailures'>): {
+    exitCode: 0 | 1 | 2;
+    reason: string | null;
+};
 /**
- * Which release each stack runs, or why that cannot be said. `known: false`
- * is not «nothing is deployed», and nothing may read it as that.
+ * The latest recorded deployment per stack, not an observation of its processes.
+ * An unavailable audit trail is distinct from an empty history.
  */
 export type DeploymentsAnswer = {
     readonly known: true;
@@ -62,8 +68,8 @@ export type DeploymentsAnswer = {
     readonly known: false;
     readonly why: string;
 };
-/** Why a daemon without its audit trail cannot say which release a stack runs. */
-export declare const NO_AUDIT_TRAIL = "the daemon has no audit trail, and its `stack.start` rows are what say which release a stack runs";
+/** Missing deployment history does not imply an unused release. */
+export declare const NO_AUDIT_TRAIL = "the daemon cannot read the deployment audit history; current execution is a separate observation";
 /**
  * The daemon's `deployments()` rows as an answer: known only when its audit
  * trail is there to have written them.
@@ -78,8 +84,94 @@ export declare function stacksByRelease(deployments: readonly ReleaseDeploymentD
  */
 export declare function unnamedStacks(deployments: readonly ReleaseDeploymentDto[]): string[];
 /**
- * Why a prune cannot tell which releases the stacks run, or `null` when it
- * can. A prune that goes ahead regardless may remove the one a stack runs.
+ * Why audit-based retention cannot identify its protected releases. A null
+ * result only establishes readable history, not current process provenance.
  */
 export declare function pruneBlindness(answer: DeploymentsAnswer): string | null;
+/** Git provenance captured by the build, never an execution location. */
+export declare function readSourcePublication(onRemote: {
+    project: boolean | null;
+    omni: boolean | null;
+}, project: string): {
+    state: "missing" | "recorded" | "unknown";
+    label: string;
+    detail: string;
+};
+export type StackDeploymentHistory = {
+    known: true;
+    last: ReleaseDeploymentDto | null;
+} | {
+    known: false;
+    why: string;
+};
+/** Resolve retained runtime namespaces without creating another project model. */
+export declare function stackDeploymentHistory(project: string, stack: Pick<IStackInfo, 'name' | 'runtimeScope'>, answer: DeploymentsAnswer): StackDeploymentHistory;
+export interface ReleaseStackObservation {
+    project: string;
+    stack: string;
+    type: IStackInfo['type'];
+    status: IStackInfo['status'];
+    apps: {
+        online: number;
+        total: number;
+        unknown: number;
+    };
+    nodes: Array<{
+        host: string;
+        port: number;
+        endpoint: string;
+        label: string | null;
+        connected: boolean;
+    }>;
+    history: StackDeploymentHistory;
+    /** Launch provenance is distinct from deployment history and continuous code integrity. */
+    runningRelease: 'not-running' | 'confirmed' | 'mixed' | 'modified' | 'unreported';
+    releaseEvidence: StackReleaseEvidence;
+}
+export interface StackReleaseEvidence {
+    verified: number;
+    total: number;
+    releases: Array<{
+        releaseId: string;
+        manifestSha256: string;
+    }>;
+    observations: Array<{
+        app: string;
+        node: string | null;
+        pid: number | null;
+        generation?: string;
+        state: 'confirmed' | 'unreported' | 'modified' | 'unavailable';
+        releaseId?: string;
+        /** Original producer remains releaseId; this is the separately verified installed selection. */
+        consumer?: {
+            releaseId: string;
+            manifestSha256: string;
+            app: string;
+        };
+        reason?: string;
+        observedAt?: string;
+        launchId?: string;
+    }>;
+}
+/** Read every physical replica; a healthy peer cannot attest for an unreachable one. */
+export declare function readStackRelease(stack: IStackInfo): Pick<ReleaseStackObservation, 'runningRelease' | 'releaseEvidence'>;
+/** Shared wording for human CLI output and Console. */
+export declare function runningReleaseLabel(row: Pick<ReleaseStackObservation, 'runningRelease' | 'releaseEvidence'>): string;
+export interface ReleaseDeploymentState {
+    project: string;
+    observedAt: string;
+    inventory: {
+        known: true;
+    } | {
+        known: false;
+        why: string;
+    };
+    history: DeploymentsAnswer;
+    stacks: ReleaseStackObservation[];
+}
+/** One read model used by CLI, Console and callers of the public package. No mutations. */
+export declare function readReleaseDeploymentState(project: string, ports: {
+    stacks(): Promise<IStackInfo[]>;
+    deployments(): Promise<DeploymentsAnswer>;
+}): Promise<ReleaseDeploymentState>;
 //# sourceMappingURL=release-reading.d.ts.map

package/dist/shared/release-reading.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-reading.d.ts","sourceRoot":"","sources":["../../src/shared/release-reading.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7F,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;CAC5D;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,GAAG,IAAI,CAG3E;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAU7D;AAMD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,kFAAkF;AAClF,eAAO,MAAM,cAAc,sGAC0E,CAAC;AAEtG;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,oBAAoB,EAAE,GAAG,iBAAiB,CAEnH;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAOjH;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAEpF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAIvE"}
+{"version":3,"file":"release-reading.d.ts","sourceRoot":"","sources":["../../src/shared/release-reading.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAE9F,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGjE,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM;IAE7B,OAAO;IAAoB,aAAa;IAAsB,UAAU;EAClF;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;;;;;;EASlF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,CAEtH;AAED,wGAAwG;AACxG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;;;EAa7J;AAED,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,OAAO,8BAA8B,EAAE,aAAa,GAAG,MAAM,CAExG;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAMtE;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7F,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;CAC5D;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,GAAG,IAAI,CAG3E;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAW7D;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,kBAAkB,CAAC,GAAG;IAC9F,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAUA;AAMD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,mEAAmE;AACnE,eAAO,MAAM,cAAc,qGACyE,CAAC;AAErG;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,oBAAoB,EAAE,GAAG,iBAAiB,CAEnH;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAOjH;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAEpF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,EAAE,OAAO,EAAE,MAAM;;;;EAWjH;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAA;CAAE,GAClD;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,iBAAiB,GAAG,sBAAsB,CAa3J;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzG,OAAO,EAAE,sBAAsB,CAAC;IAChC,2FAA2F;IAC3F,cAAc,EAAE,aAAa,GAAG,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,YAAY,CAAC;IAClF,eAAe,EAAE,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,YAAY,EAAE,KAAK,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,aAAa,CAAC;QAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gGAAgG;QAChG,QAAQ,CAAC,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACtE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC,uBAAuB,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,CAmEvH;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,uBAAuB,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,MAAM,CAQpH;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,uBAAuB,EAAE,CAAC;CACnC;AAED,2FAA2F;AAC3F,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;IACvE,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAChC,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqBlC"}

package/dist/shared/release-reading.js

@@ -1,33 +1,61 @@
-/**
- * How a release reads — its gates, and which stacks run it: one reading for
- * the CLI and the console.
- *
- * They read releases apart, and came apart:
- *
- *   - A build with `--skip-gates` records one outcome, `gates: not-run`, and
- *     as `passed/total` that is «0/1» — what one failed gate reads as too.
- *     The CLI learnt to say «skipped» (70b988a6); the console still drew
- *     «0/1».
- *   - A gate that timed out or was killed counted in `notRun` until 70b988a6
- *     gave each its own count. The console coloured by `failed` and `notRun`
- *     alone, so sample-202609230557, whose one gate that did not pass timed
- *     out, would have read a green «20/21».
- *   - A daemon whose database did not come up runs with no audit trail and
- *     serves `deployments()` as `[]` — the shape of «no stack has taken a
- *     release». The CLI learnt that in 70b988a6 and will not prune on it; the
- *     console read `[]` as it came, protected nothing, and a stack's card
- *     said «No recorded deployment of this stack yet» about a stack it could
- *     not ask about.
- *
- * Imported by the console through `@omnitron-dev/omnitron/release-reading`,
- * so nothing here may need Node.
- */
+/** Shared, browser-safe readings of release gates, Git provenance and deployment evidence. */
+/** Retried and concurrent builds can carry a private-directory suffix. */
+export function readReleaseId(id) {
+    const parts = /^(.*)-\d{12}-([0-9a-f]{8})-([0-9a-f]{8})(?:-[A-Za-z0-9]{6})?$/.exec(id);
+    return { project: parts?.[1] ?? id, projectCommit: parts?.[2] ?? null, omniCommit: parts?.[3] ?? null };
+}
+/** Interpret the daemon's start reply consistently for interactive and scripted callers. */
+export function readStackStart(stack) {
+    const down = stack.apps.filter(app => app.status !== 'online').map(app => `${app.name} (${app.status})`);
+    const total = stack.apps.length;
+    const online = total - down.length;
+    const reported = stack.notUp ?? [];
+    const issues = [...new Set([...reported, ...down.filter(app => !reported.some(issue => issue.startsWith(app + ': ')))])];
+    if (stack.status !== 'running')
+        issues.push(`stack state: ${stack.status}`);
+    const outcome = issues.length === 0 ? 'confirmed' : stack.status === 'error' ? 'failed' : 'partial';
+    return { confirmed: outcome === 'confirmed', outcome, online, total, issues };
+}
+export function deploymentProgressKey(record) {
+    return JSON.stringify([record.project, record.stack, record.node, record.app]);
+}
+/** Current observations, including imported stack names and earlier controllers with no attribution. */
+export function readDeploymentProgress(records, project, stack) {
+    const transfers = [];
+    const unscoped = [];
+    for (const record of records) {
+        if (!record.project || !record.stack) {
+            unscoped.push(record);
+            continue;
+        }
+        const source = project.configurations?.find(item => item.runtimeProject === record.project);
+        const publicName = source?.stacks[record.stack] ?? (record.project === project.name ? record.stack : undefined);
+        if (publicName && (!stack || publicName === stack)) {
+            transfers.push(record.project === project.name && record.stack === publicName
+                ? record : { ...record, project: project.name, stack: publicName });
+        }
+    }
+    return { transfers, unscoped };
+}
+export function releaseTargetLabel(target) {
+    return target ? `${target.platform}/${target.arch} · Node ${target.node} · ABI ${target.abi}` : 'Target not recorded';
+}
+export function frameworkSourceLabel(manifest) {
+    const reproduced = manifest.omni.reproduced;
+    const packages = reproduced?.packages ?? manifest.omni.registry?.packages;
+    const count = packages?.length ?? manifest.builtWith?.packages?.length;
+    if (count === undefined)
+        return 'Framework source not recorded';
+    return `${reproduced ? 'Reproduced archives' : packages ? 'npm registry' : 'Linked checkout'} · ${count} framework package${count === 1 ? '' : 's'}`;
+}
 /** The single outcome a build records when it ran no gate at all, or null. */
 export function noGateRan(gates) {
     const only = gates.length === 1 ? gates[0] : null;
     return only && only.name === 'gates' && only.status === 'not-run' ? only : null;
 }
 export function readGates(release) {
+    if (release.manifestError)
+        return { text: 'invalid manifest', tone: 'failed' };
     if (!release.complete)
         return { text: 'no manifest', tone: 'none' };
     const none = noGateRan(release.gateList);
@@ -41,8 +69,20 @@ export function readGates(release) {
         return { text: '—', tone: 'none' };
     return { text: `${passed}/${total}`, tone: failed > 0 ? 'failed' : passed < total ? 'unfinished' : 'passed' };
 }
-/** Why a daemon without its audit trail cannot say which release a stack runs. */
-export const NO_AUDIT_TRAIL = 'the daemon has no audit trail, and its `stack.start` rows are what say which release a stack runs';
+/** Finishing the archive step does not imply successful checks or deployment admission. */
+export function readBuildChecks(manifest) {
+    const incomplete = manifest.gates.filter(gate => gate.status !== 'passed');
+    const artifacts = manifest.artifactFailures ?? [];
+    const failed = artifacts.length > 0 || incomplete.some(gate => gate.status === 'failed');
+    const reasons = [
+        ...(manifest.gates.length === 0 ? ['No release checks were recorded'] : []),
+        ...incomplete.map(gate => `${gate.name}: ${gate.status}${gate.detail ? ` (${gate.detail})` : ''}`),
+        ...artifacts.map(artifact => `${artifact.app}: ${artifact.error}`),
+    ];
+    return { exitCode: failed ? 1 : reasons.length > 0 ? 2 : 0, reason: reasons.length > 0 ? reasons.join('; ') : null };
+}
+/** Missing deployment history does not imply an unused release. */
+export const NO_AUDIT_TRAIL = 'the daemon cannot read the deployment audit history; current execution is a separate observation';
 /**
  * The daemon's `deployments()` rows as an answer: known only when its audit
  * trail is there to have written them.
@@ -69,8 +109,8 @@ export function unnamedStacks(deployments) {
     return deployments.filter((d) => d.releaseUnnamed).map((d) => `${d.project}/${d.stack}`);
 }
 /**
- * Why a prune cannot tell which releases the stacks run, or `null` when it
- * can. A prune that goes ahead regardless may remove the one a stack runs.
+ * Why audit-based retention cannot identify its protected releases. A null
+ * result only establishes readable history, not current process provenance.
  */
 export function pruneBlindness(answer) {
     if (!answer.known)
@@ -78,4 +118,144 @@ export function pruneBlindness(answer) {
     const unnamed = unnamedStacks(answer.deployments);
     return unnamed.length > 0 ? `${unnamed.join(', ')} last took a release whose name the trail did not record` : null;
 }
+/** Git provenance captured by the build, never an execution location. */
+export function readSourcePublication(onRemote, project) {
+    const missing = [onRemote.project === false ? project : null, onRemote.omni === false ? 'omni' : null].filter(Boolean);
+    const unknown = [onRemote.project == null ? project : null, onRemote.omni == null ? 'omni' : null].filter(Boolean);
+    return {
+        state: missing.length ? 'missing' : unknown.length ? 'unknown' : 'recorded',
+        label: missing.length ? 'Git: unpublished source' : unknown.length ? 'Git: unverified' : 'Git: publication recorded',
+        detail: missing.length
+            ? `This release records unpublished source for ${missing.join(' and ')}. Source publication is separate from where applications are deployed or running.`
+            : unknown.length ? `Git publication could not be verified for ${unknown.join(' and ')} when this release was built. This does not establish that the source is unpublished.`
+                : 'This release records both source commits as published at build time. This saved observation does not check current availability or identify running deployments.',
+    };
+}
+/** Resolve retained runtime namespaces without creating another project model. */
+export function stackDeploymentHistory(project, stack, answer) {
+    if (!answer.known)
+        return answer;
+    const scope = stack.runtimeScope ?? { project, stack: stack.name };
+    const rows = answer.deployments.filter(row => (row.project === project && row.stack === stack.name) || (row.project === scope.project && row.stack === scope.stack));
+    if (rows.length === 0)
+        return { known: true, last: null };
+    if (rows.some(row => !Number.isFinite(Date.parse(row.at))))
+        return { known: false, why: 'Deployment history contains an invalid timestamp' };
+    const latestAt = Math.max(...rows.map(row => Date.parse(row.at)));
+    const latest = rows.filter(row => Date.parse(row.at) === latestAt);
+    if (new Set(latest.map(row => JSON.stringify([row.release, row.releaseUnnamed, row.projectCommit, row.omniCommit]))).size > 1) {
+        return { known: false, why: 'Conflicting deployment records have the same timestamp' };
+    }
+    return { known: true, last: latest[0] };
+}
+/** Read every physical replica; a healthy peer cannot attest for an unreachable one. */
+export function readStackRelease(stack) {
+    const observations = [];
+    const releases = new Map();
+    const producerManifests = new Map();
+    const inspect = (app, node, available = true) => {
+        if (available && app.status === 'stopped')
+            return;
+        const base = { app: app.name, node, pid: app.pid ?? null,
+            ...(typeof app.generation === 'string' && { generation: app.generation }) };
+        if (!available || app.status === 'unknown') {
+            observations.push({ ...base, state: 'unavailable', reason: 'Application inventory unavailable; launch identity is unknown' });
+            return;
+        }
+        const evidence = app.release;
+        // Threads, pools and worker-only topologies need not have one main PID.
+        // Bind the receipt to the owner's existing application generation instead.
+        // A conflicting/malformed generation never falls back to a surviving PID.
+        const hasGeneration = app.generation !== undefined;
+        const validGeneration = typeof app.generation === 'string' && app.generation.length > 0 &&
+            evidence?.state === 'confirmed' && app.generation === evidence.launchId;
+        const validPid = Number.isSafeInteger(app.pid) && app.pid > 0;
+        const validIdentity = hasGeneration ? validGeneration && (app.pid == null || validPid) : validPid;
+        const consumer = evidence?.state === 'confirmed' ? evidence.consumer : undefined;
+        const validConsumer = consumer === undefined || (consumer && typeof consumer === 'object' && !Array.isArray(consumer) &&
+            Object.keys(consumer).sort().join(',') === 'app,manifestSha256,releaseId' &&
+            typeof consumer.releaseId === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/.test(consumer.releaseId) && !consumer.releaseId.includes('..') &&
+            /^[a-f0-9]{64}$/.test(consumer.manifestSha256) && consumer.app === app.name.split('/').at(-1));
+        if (evidence?.state === 'confirmed' && app.status === 'online' && validIdentity &&
+            evidence.basis === 'verified-launch' && typeof evidence.releaseId === 'string' && evidence.releaseId.length > 0 &&
+            /^[a-f0-9]{64}$/.test(evidence.manifestSha256) && /^[a-f0-9]{64}$/.test(evidence.artifactSha256) &&
+            typeof evidence.launchId === 'string' && evidence.launchId.length > 0 && Number.isFinite(Date.parse(evidence.observedAt)) && validConsumer) {
+            observations.push({ ...base, state: 'confirmed', releaseId: evidence.releaseId, observedAt: evidence.observedAt, launchId: evidence.launchId,
+                ...(consumer && { consumer: { ...consumer } }) });
+            const selected = consumer ?? evidence;
+            releases.set(`${selected.releaseId}:${selected.manifestSha256}`, { releaseId: selected.releaseId, manifestSha256: selected.manifestSha256 });
+            const producer = producerManifests.get(evidence.releaseId) ?? new Set();
+            producer.add(evidence.manifestSha256);
+            producerManifests.set(evidence.releaseId, producer);
+        }
+        else if (evidence?.state === 'modified') {
+            observations.push({ ...base, state: 'modified', ...(evidence.releaseId && { releaseId: evidence.releaseId }), reason: evidence.reason });
+        }
+        else {
+            observations.push({ ...base, state: 'unreported', reason: app.status !== 'online'
+                    ? `Application is ${app.status}; no active launch is confirmed`
+                    : evidence?.state === 'confirmed' && hasGeneration && !validGeneration ? 'Application generation is invalid or differs from its launch receipt; request a fresh owner observation'
+                        : evidence?.state === 'confirmed' && !validIdentity ? 'Application is online but its process identity is unavailable; the launch receipt cannot be bound to this instance'
+                            : !validConsumer ? 'Runtime launch consumer does not match this application or has invalid identity'
+                                : evidence?.state === 'unreported' ? evidence.reason : evidence ? 'Runtime launch evidence is incomplete or invalid' : 'Runtime does not report a verified launch receipt' });
+        }
+    };
+    if (stack.type !== 'local' && stack.placements?.length) {
+        for (const node of stack.placements) {
+            for (const app of node.apps)
+                inspect(app.process ?? { name: app.name, status: node.appsObserved ? 'stopped' : 'unknown' }, node.nodeKey, node.appsObserved);
+            if (!node.appsObserved && node.apps.length === 0)
+                inspect({ name: 'inventory', status: 'unknown' }, node.nodeKey, false);
+        }
+    }
+    else {
+        for (const app of stack.apps)
+            inspect(app, null);
+        if (stack.type !== 'local') {
+            for (const node of stack.nodes.filter(peer => !peer.connected))
+                inspect({ name: 'inventory', status: 'unknown' }, `${node.host}:${node.port}`, false);
+        }
+    }
+    const releaseEvidence = { verified: observations.filter(row => row.state === 'confirmed').length,
+        total: observations.length, releases: [...releases.values()], observations };
+    const conflictingManifests = new Set(releaseEvidence.releases.map(row => row.releaseId)).size !== releases.size ||
+        [...producerManifests.values()].some(manifests => manifests.size > 1);
+    const runningRelease = observations.length === 0 && stack.status === 'stopped' ? 'not-running'
+        : conflictingManifests || observations.some(row => row.state === 'modified') ? 'modified'
+            : observations.length === 0 || observations.some(row => row.state !== 'confirmed') ? 'unreported'
+                : releases.size > 1 ? 'mixed' : 'confirmed';
+    return { runningRelease, releaseEvidence };
+}
+/** Shared wording for human CLI output and Console. */
+export function runningReleaseLabel(row) {
+    switch (row.runningRelease) {
+        case 'not-running': return 'No applications running';
+        case 'confirmed': return 'Launch release verified';
+        case 'mixed': return 'Different releases are running';
+        case 'modified': return 'Runtime differs from its release evidence';
+        default: return 'Current release not reported';
+    }
+}
+/** One read model used by CLI, Console and callers of the public package. No mutations. */
+export async function readReleaseDeploymentState(project, ports) {
+    const [inventory, trail] = await Promise.allSettled([ports.stacks(), ports.deployments()]);
+    const rawHistory = trail.status === 'fulfilled' ? trail.value
+        : { known: false, why: 'Deployment history could not be read' };
+    const scopes = inventory.status === 'fulfilled' ? inventory.value.flatMap(stack => stack.runtimeScope ? [stack.runtimeScope] : []) : [];
+    const history = rawHistory.known ? { known: true, deployments: rawHistory.deployments.filter(row => row.project === project || scopes.some(scope => row.project === scope.project && row.stack === scope.stack)) } : rawHistory;
+    return {
+        project, observedAt: new Date().toISOString(), history,
+        inventory: inventory.status === 'fulfilled' ? { known: true } : { known: false, why: 'Stack inventory could not be read; execution state is unknown' },
+        stacks: inventory.status === 'fulfilled' ? inventory.value.map(stack => ({
+            project, stack: stack.name, type: stack.type, status: stack.status,
+            apps: { online: stack.apps.filter(app => app.status === 'online').length, total: stack.apps.length,
+                unknown: stack.apps.filter(app => app.status === 'unknown').length },
+            nodes: stack.nodes.map(({ host, port, label, connected }) => ({ host, port, label, connected,
+                endpoint: `${host.includes(':') && !host.startsWith('[') ? `[${host}]` : host}:${port}`,
+            })),
+            history: stackDeploymentHistory(project, stack, history),
+            ...readStackRelease(stack),
+        })) : [],
+    };
+}
 //# sourceMappingURL=release-reading.js.map

package/dist/shared/release-reading.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-reading.js","sourceRoot":"","sources":["../../src/shared/release-reading.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA2BH,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,KAA6B;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAqB;IAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9G,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChH,CAAC;AAcD,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GACzB,mGAAmG,CAAC;AAEtG;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAuB,EAAE,IAAqC;IAC9F,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AACrG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,WAA4C;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAA4C;IACxE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,CAAC,IAAI,CAAC;AACrH,CAAC"}
+{"version":3,"file":"release-reading.js","sourceRoot":"","sources":["../../src/shared/release-reading.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAO9F,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,MAAM,KAAK,GAAG,+DAA+D,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAC1G,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,KAAoD;IACjF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzH,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,OAAO,EAAE,SAAS,EAAE,OAAO,KAAK,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAW,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAwE;IAC5G,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,sBAAsB,CAAC,OAAwC,EAAE,OAAsD,EAAE,KAAqB;IAC5J,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChH,IAAI,UAAU,IAAI,CAAC,CAAC,KAAK,IAAI,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC;YACnD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU;gBAC3E,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA6D;IAC9F,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACxH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAyB;IAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;IAC5C,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC1E,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,+BAA+B,CAAC;IAChE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,MAAM,KAAK,qBAAqB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACvJ,CAAC;AAyBD,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,KAA6B;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAqB;IAC7C,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/E,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9G,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,QAA6D;IAI3F,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAClG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;KACnE,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACvH,CAAC;AAcD,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GACzB,kGAAkG,CAAC;AAErG;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAuB,EAAE,IAAqC;IAC9F,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AACrG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,WAA4C;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAA4C;IACxE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,CAAC,IAAI,CAAC;AACrH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,QAA2D,EAAE,OAAe;IAChH,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvH,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnH,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,UAAmB;QACtG,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,2BAA2B;QACpH,MAAM,EAAE,OAAO,CAAC,MAAM;YACpB,CAAC,CAAC,+CAA+C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mFAAmF;YACzJ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uFAAuF;gBAC1K,CAAC,CAAC,kKAAkK;KACzK,CAAC;AACJ,CAAC;AAMD,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAgD,EAAE,MAAyB;IACjI,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3C,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACzH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,kDAAkD,EAAE,CAAC;IAC7I,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC9H,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,wDAAwD,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC;AAC3C,CAAC;AAkCD,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,MAAM,YAAY,GAAyC,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC7E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,GAAiH,EAAE,IAAmB,EAAE,SAAS,GAAG,IAAI,EAAE,EAAE;QAC3K,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QAClD,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;YACtD,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3C,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC,CAAC;YAC9H,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC;QAC7B,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC;QACnD,MAAM,eAAe,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrF,QAAQ,EAAE,KAAK,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,QAAQ,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAI,GAAG,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClG,MAAM,QAAQ,GAAG,QAAQ,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YACnH,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,8BAA8B;YACzE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7I,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,IAAI,QAAQ,EAAE,KAAK,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,aAAa;YAC7E,QAAQ,CAAC,KAAK,KAAK,iBAAiB,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAC/G,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAChG,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC;YAC7I,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC1I,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;YAC7I,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAChF,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7F,CAAC;aAAM,IAAI,QAAQ,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1C,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3I,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,QAAQ;oBAC/E,CAAC,CAAC,kBAAkB,GAAG,CAAC,MAAM,iCAAiC;oBAC/D,CAAC,CAAC,QAAQ,EAAE,KAAK,KAAK,WAAW,IAAI,aAAa,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,yGAAyG;wBAClL,CAAC,CAAC,QAAQ,EAAE,KAAK,KAAK,WAAW,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,oHAAoH;4BAC1K,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iFAAiF;gCACpG,CAAC,CAAC,QAAQ,EAAE,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,mDAAmD,EAAE,CAAC,CAAC;QAClL,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5J,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACxJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAyB,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,MAAM;QACpH,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC7G,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa;QAC5F,CAAC,CAAC,oBAAoB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU;YACvF,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY;gBAC/F,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IAClD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAC7C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,mBAAmB,CAAC,GAAwE;IAC1G,QAAQ,GAAG,CAAC,cAAc,EAAE,CAAC;QAC3B,KAAK,aAAa,EAAE,OAAO,yBAAyB,CAAC;QACrD,KAAK,WAAW,EAAE,OAAO,yBAAyB,CAAC;QACnD,KAAK,OAAO,EAAE,OAAO,gCAAgC,CAAC;QACtD,KAAK,UAAU,EAAE,OAAO,2CAA2C,CAAC;QACpE,SAAS,OAAO,8BAA8B,CAAC;IACjD,CAAC;AACH,CAAC;AAUD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAAe,EAAE,KAGjE;IACC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAsB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;QAC9E,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,sCAAsC,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxI,MAAM,OAAO,GAAsB,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpH,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IAC9H,OAAO;QACL,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO;QACtD,SAAS,EAAE,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,+DAA+D,EAAE;QACtJ,MAAM,EAAE,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;YAClE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;gBAChG,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,EAAE;YACtE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;gBAC1F,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE;aACxF,CAAC,CAAC;YACH,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;YACxD,GAAG,gBAAgB,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;KACT,CAAC;AACJ,CAAC"}

package/dist/shared/roles.d.ts

@@ -7,8 +7,9 @@
  *   viewer   → read-only access (list, status, logs, metrics, health)
  *
  * The user's role is stored in omnitron_users.role and included in JWT claims.
- * The Netron auth middleware extracts roles from the JWT payload and sets
- * them in AuthContext.roles — service decorators then enforce access.
+ * The Netron token validator resolves human roles from the live account and
+ * session; JWT role claims cannot preserve revoked privileges. Service
+ * decorators then enforce AuthContext.roles.
  */
 /** All valid daemon roles, ordered by privilege level (highest first). */
 export declare const ROLES: {
@@ -17,23 +18,23 @@ export declare const ROLES: {
     readonly VIEWER: 'viewer';
 };
 export type OmnitronRole = (typeof ROLES)[keyof typeof ROLES];
+export declare function isOmnitronRole(value: unknown): value is OmnitronRole;
+export declare const ROLE_DESCRIPTIONS: readonly [{
+    readonly role: 'viewer';
+    readonly label: 'Viewer';
+    readonly description: 'Read operational status, logs, metrics and health.';
+}, {
+    readonly role: 'operator';
+    readonly label: 'Operator';
+    readonly description: 'Viewer access plus application and deployment operations.';
+}, {
+    readonly role: 'admin';
+    readonly label: 'Administrator';
+    readonly description: 'Control-plane configuration, accounts, secrets and SSH terminals.';
+}];
 /**
- * Check if a user's roles satisfy the minimum required role.
- * Uses hierarchical comparison: admin satisfies operator, operator satisfies viewer, etc.
- */
-/**
- * Whether any of `userRoles` ranks at or above `minimumRole`.
- *
- * NOT on the request path, and deliberately kept: `@Public({ auth: { roles }})`
- * takes an explicit list, and the three lists below are what every method
- * declares. This function is the only place the rank order is written down,
- * which makes it useful for reading — and a trap for anyone who assumes the
- * wire enforces a minimum. It does not: it enforces membership of a list.
- *
- * The difference shows when a role is added. `service_role` — named on
- * `OmnitronSync`'s methods — has no entry in ROLE_HIERARCHY, so it ranks 0
- * here, and it is absent from all three lists, so it is permitted nowhere.
- * Both answers happen to be safe; neither is a decision anyone made.
+ * Minimum-rank helper for daemon human roles. Wire gates still use the explicit
+ * lists below. Service identity is never inferred from human rank.
  */
 export declare function hasMinimumRole(userRoles: string[], minimumRole: OmnitronRole): boolean;
 /** Roles that can view (read-only) — admin + operator + viewer */

package/dist/shared/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/shared/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,KAAK;aAChB,KAAK,EAAE,OAAO;aACd,QAAQ,EAAE,UAAU;aACpB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC;AAS9D;;;GAGG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,GAAG,OAAO,CAGtF;AAED,kEAAkE;AAClE,eAAO,MAAM,YAAY,EAAE,YAAY,EAAoC,CAAC;AAC5E,oEAAoE;AACpE,eAAO,MAAM,cAAc,EAAE,YAAY,EAA0B,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAA0C,CAAC;AAEnF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,EAAoD,CAAC;AAClG,yEAAyE;AACzE,eAAO,MAAM,WAAW,EAAE,YAAY,EAAc,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/shared/roles.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,KAAK;aAChB,KAAK,EAAE,OAAO;aACd,QAAQ,EAAE,UAAU;aACpB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC;AAE9D,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,eAAO,MAAM,iBAAiB;aAC1B,IAAI,EAAE,QAAQ;aAAE,KAAK,EAAE,QAAQ;aAAE,WAAW,EAAE,oDAAoD;;aAClG,IAAI,EAAE,UAAU;aAAE,KAAK,EAAE,UAAU;aAAE,WAAW,EAAE,2DAA2D;;aAC7G,IAAI,EAAE,OAAO;aAAE,KAAK,EAAE,eAAe;aAAE,WAAW,EAAE,mEAAmE;EACjH,CAAC;AASX;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,GAAG,OAAO,CAEtF;AAED,kEAAkE;AAClE,eAAO,MAAM,YAAY,EAAE,YAAY,EAAoC,CAAC;AAC5E,oEAAoE;AACpE,eAAO,MAAM,cAAc,EAAE,YAAY,EAA0B,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAA0C,CAAC;AAEnF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,EAAoD,CAAC;AAClG,yEAAyE;AACzE,eAAO,MAAM,WAAW,EAAE,YAAY,EAAc,CAAC"}