@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/release/installed-release.js

@@ -0,0 +1,141 @@
+import { constants } from 'node:fs';
+import { open, opendir } from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { artifactReleaseContext, validateReleaseOrigins, MAX_RELEASE_MANIFEST_BYTES } from './origin.js';
+import { projectOfId } from './store.js';
+export async function installedReadDeadline(read, timeout = 55_000) {
+    let timer;
+    try {
+        return await Promise.race([read(), new Promise((_resolve, reject) => { timer = setTimeout(() => reject(new Error('Installed-file inspection timed out')), timeout); })]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+export async function boundedInstalledNodeRead(read) {
+    const value = await installedReadDeadline(read);
+    const digest = (input) => typeof input === 'string' && /^[a-f0-9]{64}$/.test(input);
+    if (!Array.isArray(value) || value.length > 32 || value.some(item => !item || typeof item.app !== 'string' || item.app.length > 256 ||
+        !['observed', 'unavailable', 'changed-during-inspection'].includes(item.state) || typeof item.observedAt !== 'string' ||
+        !(item.entrySha256 === null || digest(item.entrySha256)) || !(item.frameworkCommit === null || typeof item.frameworkCommit === 'string' && /^[a-f0-9]{7,40}$/.test(item.frameworkCommit)) ||
+        !Array.isArray(item.archives) || item.archives.length > 8 || item.archives.some((archive) => !archive || !digest(archive.sha256) || !Number.isSafeInteger(archive.bytes) || archive.bytes <= 0 || !(archive.entrySha256 === null || digest(archive.entrySha256))) ||
+        !Array.isArray(item.reasons) || item.reasons.length > 32 || item.reasons.some((reason) => typeof reason !== 'string' || reason.length > 1024)))
+        throw new Error('Invalid inspection response');
+    return value;
+}
+export function installedNodeFailure(error) {
+    const value = error;
+    if (value?.code === 'METHOD_NOT_FOUND' || value?.code === 404 || typeof value?.message === 'string' && /not a function|method.*(not found|does not exist|unknown)|unknown.*method/i.test(value.message))
+        return 'Node backend does not support installed-file inspection; update its backend. Applications were not changed';
+    if (typeof value?.message === 'string' && /timed out/i.test(value.message))
+        return 'Node did not finish installed-file inspection within the time limit';
+    return 'Node inspection is unavailable or busy; applications were not changed';
+}
+/** Only bounded manifest reads; neither audit rows nor directory names establish an installed release. */
+export async function installedReleaseCatalog(root, project) {
+    const catalog = { complete: true, reasons: [], releases: [] };
+    try {
+        let scanned = 0;
+        for await (const directory of await opendir(root)) {
+            if (++scanned > 2048)
+                throw new Error('Release catalog exceeds the inspection limit');
+            if (!directory.isDirectory() || projectOfId(directory.name) !== project)
+                continue;
+            const handle = await open(path.join(root, directory.name, 'manifest.json'), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK).catch(error => {
+                if (error.code !== 'ENOENT') {
+                    catalog.complete = false;
+                    catalog.reasons.push(`Release ${directory.name} manifest is unreadable`);
+                }
+                return null;
+            });
+            // Incomplete build directories do not participate in the release catalog.
+            if (!handle)
+                continue;
+            try {
+                const stat = await handle.stat();
+                if (!stat.isFile() || stat.size > MAX_RELEASE_MANIFEST_BYTES)
+                    throw new Error('Invalid release manifest');
+                const bytes = await handle.readFile();
+                const after = await handle.stat();
+                if (stat.size !== after.size || stat.ctimeMs !== after.ctimeMs)
+                    throw new Error('Release manifest changed while being read');
+                const manifest = JSON.parse(bytes.toString('utf8'));
+                if (manifest.id !== directory.name || !Array.isArray(manifest.artifacts) || manifest.artifacts.length > 256 ||
+                    typeof manifest.omni?.commit !== 'string' || !/^[a-f0-9]{7,40}$/.test(manifest.omni.commit) ||
+                    manifest.artifacts.some(a => typeof a.app !== 'string' || !/^[a-f0-9]{64}$/.test(a.sha256) || !Number.isSafeInteger(a.bytes) || a.bytes <= 0))
+                    throw new Error('Invalid release manifest');
+                validateReleaseOrigins(manifest);
+                catalog.releases.push({ manifest, sha256: createHash('sha256').update(bytes).digest('hex') });
+            }
+            catch {
+                catalog.complete = false;
+                catalog.reasons.push(`Release ${directory.name} has an invalid or changing manifest`);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            catalog.complete = false;
+            catalog.reasons.push('Release catalog could not be read completely within its inspection limits');
+        }
+    }
+    return catalog;
+}
+/** Every hash-and-byte match is reported; a reused artifact cannot silently choose a release. */
+export function installedReleaseCandidates(observation, catalog) {
+    if (observation.state !== 'observed')
+        return [];
+    const app = observation.app.split('/').at(-1);
+    return catalog.releases.flatMap(({ manifest, sha256 }) => {
+        const matches = manifest.artifacts.filter(artifact => artifact.app === app).flatMap(artifact => observation.archives.filter(archive => archive.sha256 === artifact.sha256 && archive.bytes === artifact.bytes));
+        if (!matches.length)
+            return [];
+        const reasons = [];
+        let framework;
+        try {
+            framework = artifactReleaseContext(manifest, app).manifest.omni;
+        }
+        catch {
+            return [{ releaseId: manifest.id, manifestSha256: sha256, state: 'incomplete', reasons: ['The artifact producer could not be verified from the retained release manifest'] }];
+        }
+        let modified = false;
+        let incomplete = false;
+        for (const match of matches) {
+            if (!match.entrySha256 || !observation.entrySha256) {
+                incomplete = true;
+                reasons.push('Entry point could not be compared with the retained archive');
+            }
+            else if (match.entrySha256 !== observation.entrySha256) {
+                modified = true;
+                reasons.push('Installed entry point differs from the retained release archive');
+            }
+        }
+        if (!observation.frameworkCommit) {
+            incomplete = true;
+            reasons.push('Installed framework build identity is unavailable');
+        }
+        else if (!framework.commit.startsWith(observation.frameworkCommit) && !observation.frameworkCommit.startsWith(framework.commit)) {
+            modified = true;
+            reasons.push(`Installed framework reports ${observation.frameworkCommit}; artifact producer records ${framework.commit}`);
+        }
+        else if ((framework.registry || framework.reproduced) && (observation.frameworkCommit.length !== 40 || observation.frameworkCommit !== framework.commit)) {
+            incomplete = true;
+            reasons.push('An archive-backed release requires the full framework commit for an exact comparison');
+        }
+        return [{ releaseId: manifest.id, manifestSha256: sha256, state: modified ? 'modified' : incomplete ? 'incomplete' : 'entry-matches', reasons: [...new Set(reasons)] }];
+    });
+}
+export function installedReleaseReport(project, stack, catalog, nodes) {
+    return { project, stack, observedAt: new Date().toISOString(), catalogComplete: catalog.complete, catalogReasons: catalog.reasons,
+        apps: nodes.flatMap(node => (node.observations ?? []).map(observation => ({ ...observation, node: node.node, candidates: installedReleaseCandidates(observation, catalog) }))),
+        nodes: nodes.filter(node => node.error).map(node => ({ node: node.node, error: node.error })),
+        limitations: ['Installed files were inspected now; this does not prove what a running process loaded.',
+            'Archive matches require SHA-256 and byte count. All matching catalog releases are shown; multiple matches are ambiguous.',
+            'Only the entry point and reported framework build are compared. A matching entry is not a full installation integrity check.'] };
+}
+//# sourceMappingURL=installed-release.js.map

package/dist/release/installed-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-release.js","sourceRoot":"","sources":["../../src/release/installed-release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASzC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAI,IAAsB,EAAE,OAAO,GAAG,MAAM;IACrF,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClL,CAAC;YAAS,CAAC;QAAC,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAA4B;IACzE,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;QACjI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,2BAA2B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACrH,CAAC,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzL,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAyD,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACnT,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1M,OAAO,KAAuC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,KAAK,GAAG,KAAqD,CAAC;IACpE,IAAI,KAAK,EAAE,IAAI,KAAK,kBAAkB,IAAI,KAAK,EAAE,IAAI,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,4EAA4E,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,4GAA4G,CAAC;IAC7T,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,qEAAqE,CAAC;IACzJ,OAAO,uEAAuE,CAAC;AACjF,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,OAAe;IACzE,MAAM,OAAO,GAA4B,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,EAAE,MAAM,SAAS,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,EAAE,OAAO,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACtF,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,OAAO;gBAAE,SAAS;YAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBAC1J,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;oBACzB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,IAAI,yBAAyB,CAAC,CAAC;gBAC3E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,0EAA0E;YAC1E,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,0BAA0B;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC1G,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC7H,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAoB,CAAC;gBACvE,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;oBACzG,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;oBAC3F,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC7L,sBAAsB,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACzB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,IAAI,sCAAsC,CAAC,CAAC;YACxF,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,0BAA0B,CAAC,WAAyC,EAAE,OAAgC;IACpH,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAChN,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,SAAkC,CAAC;QACvC,IAAI,CAAC;YAAC,SAAS,GAAG,sBAAsB,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAC,CAAC;QACzE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,YAAqB,EAAE,OAAO,EAAE,CAAC,gFAAgF,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACjM,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBACnD,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC9E,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;gBACzD,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;YACjC,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAClI,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,+BAA+B,WAAW,CAAC,eAAe,+BAA+B,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5H,CAAC;aAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3J,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAqB,CAAC,CAAC,CAAC,eAAwB,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACrM,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAa,EAAE,OAAgC,EACrG,KAA6F;IAC7F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/H,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,0BAA0B,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9K,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAM,EAAE,CAAC,CAAC;QAC9F,WAAW,EAAE,CAAC,wFAAwF;YACpG,0HAA0H;YAC1H,8HAA8H,CAAC,EAAE,CAAC;AACxI,CAAC"}

package/dist/release/layout.d.ts

@@ -1,20 +1,3 @@
-/**
- * Where a release is built, so the lockfile's links land on the omni clone.
- *
- * Until the registry migration the project declares every omni package as a
- * `link:` to a checkout on the developer's disk, and the lockfile records it
- * RELATIVE to each importer — `link:../../luxquant/omnitron-dev/omni/apps/omnitron`
- * from the project root. `pnpm install --frozen-lockfile` follows that
- * relative path. So a clean clone of the project placed anywhere else either
- * links nothing (measured 2026-09-22: 97 of 97 links dangling, install exit 0)
- * or, placed at the same depth as the working checkout, links the DEVELOPER'S
- * omni — dirty tree and all — into a build that claims to be a commit.
- *
- * A release is therefore built inside a root that reproduces the relative
- * layout, with a clean clone of omni exactly where the links point. The
- * layout is read from the lockfile rather than written down here, because the
- * lockfile is what pnpm will follow.
- */
 export interface LinkLayout {
     /** omni's checkout relative to the project root, as the lockfile implies it. */
     readonly omniRel: string;
@@ -23,25 +6,37 @@ export interface LinkLayout {
     /** The omni workspace directories the project links, relative to omni's root. */
     readonly linkedDirs: readonly string[];
 }
-/**
- * Read the layout the lockfile implies, or say why there is none.
- *
- * A link that leaves the project root is an omni link; its target minus the
- * trailing `packages/<name>` or `apps/<name>` is omni's root. All of them
- * must agree on that root: links into two outside checkouts cannot be laid
- * out by one clone, and guessing which one is "omni" would build from the
- * wrong one.
- */
+export type RegistryPackage = {
+    name: string;
+    version: string;
+    integrity: string;
+    tarball?: string;
+};
+export type VendoredPackage = RegistryPackage & {
+    file: string;
+};
+/** Compatibility API for projects which explicitly reproduce a linked checkout. */
 export declare function readLinkLayout(lockfile: string): LinkLayout | {
     refusal: string;
 };
-/**
- * The two checkouts inside `srcRoot`: the project where its own last
- * `climbs` path segments put it, and omni where its links then land.
- */
-export declare function planBuildRoot(srcRoot: string, projectPath: string, layout: LinkLayout): {
+export type FrameworkLayout = {
+    kind: 'linked';
+    layout: LinkLayout;
+} | {
+    kind: 'registry';
+    packages: RegistryPackage[];
+    importers: string[];
+} | {
+    kind: 'vendored';
+    packages: VendoredPackage[];
+    importers: string[];
+};
+export declare function readFrameworkLayout(lockfile: string): FrameworkLayout;
+/** Lay out complete checkouts while preserving the registered project's location inside Git. */
+export declare function planBuildRoot(srcRoot: string, projectPath: string, layout: LinkLayout | undefined, repositoryPath?: string): {
+    repositoryDir: string;
     projectDir: string;
-    omniDir: string;
+    omniDir: string | null;
 } | {
     refusal: string;
 };

package/dist/release/layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CA4BjF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,GACjB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAY/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAGnH"}
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAUD,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACrG,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAoHjE,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAIjF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE3E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAiCrE;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,cAAc,SAAc,GAC3B;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CA0B7F;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAGnH"}

package/dist/release/layout.js

@@ -1,46 +1,100 @@
 /**
- * Where a release is built, so the lockfile's links land on the omni clone.
- *
- * Until the registry migration the project declares every omni package as a
- * `link:` to a checkout on the developer's disk, and the lockfile records it
- * RELATIVE to each importer — `link:../../luxquant/omnitron-dev/omni/apps/omnitron`
- * from the project root. `pnpm install --frozen-lockfile` follows that
- * relative path. So a clean clone of the project placed anywhere else either
- * links nothing (measured 2026-09-22: 97 of 97 links dangling, install exit 0)
- * or, placed at the same depth as the working checkout, links the DEVELOPER'S
- * omni — dirty tree and all — into a build that claims to be a commit.
- *
- * A release is therefore built inside a root that reproduces the relative
- * layout, with a clean clone of omni exactly where the links point. The
- * layout is read from the lockfile rather than written down here, because the
- * lockfile is what pnpm will follow.
+ * Resolve framework inputs from the project commit's pnpm lock. External
+ * workspace links have to land on an isolated checkout at the same relative
+ * path. Archive inputs pin the SHA-512 of either a configured registry tarball or
+ * a regular file committed in the project.
  */
 import fs from 'node:fs';
 import path from 'node:path';
-/** `importer → link targets`, from the lockfile's `importers:` section. */
-function importerLinks(lockfile) {
-    const out = [];
-    let inImporters = false;
-    let importer = null;
-    for (const line of lockfile.split('\n')) {
-        if (/^importers:\s*$/.test(line)) {
-            inImporters = true;
+import { parseAllDocuments } from 'yaml';
+const sections = ['dependencies', 'devDependencies', 'optionalDependencies'];
+const VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)?(?:\+[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)?$/;
+const INTEGRITY = /^sha512-[A-Za-z0-9+/]{85}[AQgw]==$/;
+function externalFile(importer, dependency) {
+    const file = dependency.slice('file:'.length);
+    const target = path.posix.normalize(path.posix.join(importer, file));
+    return path.posix.isAbsolute(file) || file.includes('\\') || target === '..' || target.startsWith('../');
+}
+function readGraph(lockfile) {
+    const links = [], packages = [], importers = [];
+    const vendored = [], frameworkInputs = [];
+    const snapshots = new Set();
+    for (const document of parseAllDocuments(lockfile)) {
+        if (document.errors.length)
+            throw Error('Invalid pnpm-lock.yaml: ' + document.errors[0].message);
+        const graph = document.toJS();
+        if (!graph)
             continue;
+        for (const key of Object.keys(graph.snapshots ?? {})) {
+            if (key.startsWith('@omnitron-dev/'))
+                snapshots.add(key);
         }
-        if (!inImporters)
-            continue;
-        if (/^\S/.test(line))
-            break; // the next top-level key
-        const key = /^ {2}([^\s].*?):\s*$/.exec(line);
-        if (key) {
-            importer = key[1].replace(/^['"]|['"]$/g, '');
-            continue;
+        for (const [importer, dependencies] of Object.entries(graph.importers ?? {})) {
+            if (importer !== '.' && (path.posix.normalize(importer) !== importer || importer.startsWith('/') ||
+                importer.split('/').includes('..') || importer.includes('\\')))
+                throw Error('Unsafe lockfile importer: ' + importer);
+            importers.push(importer);
+            for (const section of sections)
+                for (const [name, entry] of Object.entries(dependencies[section] ?? {})) {
+                    if (typeof entry?.version !== 'string')
+                        throw Error('Unsupported pnpm lockfile dependency: ' + name);
+                    if (entry.version.startsWith('file:') && externalFile(importer, entry.version))
+                        throw Error('File dependency resolves outside the committed project: ' + name);
+                    if (entry.version.startsWith('link:'))
+                        links.push({ importer, name, rel: entry.version.slice(5) });
+                    if (name.startsWith('@omnitron-dev/'))
+                        frameworkInputs.push({ importer, name, dependency: entry });
+                }
+        }
+        for (const [key, pkg] of Object.entries(graph.packages ?? {})) {
+            const filePrefix = key.indexOf('@file:');
+            if (filePrefix !== -1 && externalFile('.', key.slice(filePrefix + 1)))
+                throw Error('File dependency resolves outside the committed project: ' + key);
+            if (!key.startsWith('@omnitron-dev/'))
+                continue;
+            const match = /^(@omnitron-dev\/[a-z0-9][a-z0-9._-]*)@(.+)$/.exec(key);
+            const resolution = pkg.resolution;
+            if (!match || !resolution || typeof resolution.integrity !== 'string' || !INTEGRITY.test(resolution.integrity) || resolution.type)
+                throw Error('Framework dependency requires an exact archive with SHA-512: ' + key);
+            const name = match[1], locator = match[2], integrity = resolution.integrity;
+            if (locator.startsWith('file:')) {
+                const file = locator.slice(5);
+                if (!file.endsWith('.tgz') || !file.split('/').every(part => /^[A-Za-z0-9_@.-]+$/.test(part) && part !== '.' && part !== '..')) {
+                    throw Error('Unsafe committed framework archive path: ' + file);
+                }
+                if (resolution.tarball !== locator || Object.keys(resolution).some(field => field !== 'tarball' && field !== 'integrity') ||
+                    typeof pkg.version !== 'string' || !VERSION.test(pkg.version)) {
+                    throw Error('Vendored framework package requires a matching file tarball and an exact version: ' + key);
+                }
+                vendored.push({ name, version: pkg.version, file, integrity });
+            }
+            else {
+                if (!VERSION.test(locator)) {
+                    throw Error('Framework dependency must resolve to an exact registry archive with SHA-512: ' + name);
+                }
+                if (resolution.tarball !== undefined) {
+                    if (typeof resolution.tarball !== 'string')
+                        throw Error('Invalid locked framework archive URL: ' + name);
+                    let url;
+                    try {
+                        url = new URL(resolution.tarball);
+                    }
+                    catch {
+                        throw Error('Invalid locked framework archive URL: ' + name);
+                    }
+                    // Credentials belong to pnpm's operator auth configuration, never to
+                    // a committed lockfile or the public release source receipt.
+                    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash ||
+                        resolution.tarball.length > 8192)
+                        throw Error('Locked framework archive URL must be credential-free HTTP(S): ' + name);
+                }
+                packages.push({ name, version: locator, integrity, ...(resolution.tarball === undefined ? {} : { tarball: resolution.tarball }) });
+            }
         }
-        const link = /^\s+version: link:(\S+)\s*$/.exec(line);
-        if (link && importer !== null)
-            out.push({ importer, rel: link[1] });
+        if (Object.keys(graph.patchedDependencies ?? {}).some(key => key.startsWith('@omnitron-dev/')))
+            throw Error('Local patches of framework packages cannot be attested');
     }
-    return out;
+    return { links, packages, vendored, frameworkInputs, snapshots, importers: [...new Set(importers)] };
 }
 /**
  * Read the layout the lockfile implies, or say why there is none.
@@ -51,17 +105,19 @@ function importerLinks(lockfile) {
  * out by one clone, and guessing which one is "omni" would build from the
  * wrong one.
  */
-export function readLinkLayout(lockfile) {
+function layoutOf(links) {
     const roots = new Set();
     const dirs = new Set();
     const strays = [];
-    for (const { importer, rel } of importerLinks(lockfile)) {
+    for (const { importer, name, rel } of links) {
+        if (path.posix.isAbsolute(rel) || rel.includes('\\'))
+            return { refusal: 'nonportable lockfile link: ' + rel };
         const target = path.posix.normalize(path.posix.join(importer === '.' ? '' : importer, rel));
-        if (!target.startsWith('../'))
+        if (target !== '..' && !target.startsWith('../'))
             continue; // inside the project: its own workspace
         const parts = target.split('/');
         const kind = parts[parts.length - 2];
-        if (parts.length < 3 || (kind !== 'packages' && kind !== 'apps')) {
+        if (!name.startsWith('@omnitron-dev/') || parts.length < 3 || (kind !== 'packages' && kind !== 'apps')) {
             strays.push(target);
             continue;
         }
@@ -71,9 +127,8 @@ export function readLinkLayout(lockfile) {
     if (strays.length > 0) {
         return { refusal: `the lockfile links outside the project to something that is not a workspace package: ${strays.slice(0, 3).join(', ')}` };
     }
-    if (roots.size === 0) {
-        return { refusal: 'the lockfile links nothing outside the project — there is no omni checkout to lay out' };
-    }
+    if (roots.size === 0)
+        return null;
     if (roots.size > 1) {
         return { refusal: `the lockfile links into ${roots.size} outside checkouts (${[...roots].join(', ')}) — one clone cannot stand in for them` };
     }
@@ -81,22 +136,78 @@ export function readLinkLayout(lockfile) {
     const climbs = omniRel.split('/').filter((p) => p === '..').length;
     return { omniRel, climbs, linkedDirs: [...dirs].sort() };
 }
-/**
- * The two checkouts inside `srcRoot`: the project where its own last
- * `climbs` path segments put it, and omni where its links then land.
- */
-export function planBuildRoot(srcRoot, projectPath, layout) {
+/** Compatibility API for projects which explicitly reproduce a linked checkout. */
+export function readLinkLayout(lockfile) {
+    try {
+        return layoutOf(readGraph(lockfile).links) ?? { refusal: 'the lockfile links nothing outside the project — there is no omni checkout to lay out' };
+    }
+    catch (error) {
+        return { refusal: error.message };
+    }
+}
+export function readFrameworkLayout(lockfile) {
+    const graph = readGraph(lockfile);
+    const linked = layoutOf(graph.links);
+    if (linked && 'refusal' in linked)
+        throw Error(linked.refusal);
+    if (graph.vendored.length) {
+        if (linked || graph.packages.length)
+            throw Error('Cannot combine local framework archives with a linked checkout or npm release inputs');
+        if (new Set(graph.vendored.map(pkg => pkg.file)).size !== graph.vendored.length)
+            throw Error('A committed framework archive must identify a single package');
+        const byName = new Map(graph.vendored.map(pkg => [pkg.name, pkg]));
+        for (const { importer, name, dependency } of graph.frameworkInputs) {
+            const pkg = byName.get(name);
+            const suffix = dependency.version.indexOf('(');
+            const base = suffix === -1 ? dependency.version : dependency.version.slice(0, suffix);
+            if (!pkg || base !== 'file:' + pkg.file || (suffix !== -1 && !graph.snapshots.has(name + '@' + dependency.version)))
+                throw Error('Framework importer must resolve to its committed archive and exact peer snapshot: ' + importer + ' / ' + name);
+            if (dependency.specifier?.startsWith('file:') && dependency.specifier.slice(5) !== path.posix.relative(importer, pkg.file))
+                throw Error('Importer file specifier differs from its committed framework archive: ' + importer + ' / ' + name);
+        }
+    }
+    else {
+        if (linked && !graph.packages.length && !graph.frameworkInputs.some(input => input.dependency.version.startsWith('file:')))
+            return { kind: 'linked', layout: linked };
+        if (linked || graph.frameworkInputs.some(input => /^(?:link:|file:|workspace:)/.test(input.dependency.version)))
+            throw Error('Cannot combine local framework packages and npm release inputs');
+    }
+    const archives = graph.vendored.length ? graph.vendored : graph.packages;
+    if (!archives.some(pkg => pkg.name === '@omnitron-dev/omnitron'))
+        throw Error('The lockfile must include @omnitron-dev/omnitron with a verifiable archive or checkout');
+    if (new Set(archives.map(pkg => pkg.name)).size !== archives.length)
+        throw Error('Multiple versions of the same framework package cannot identify one release');
+    const byName = (a, b) => a.name.localeCompare(b.name);
+    return graph.vendored.length
+        ? { kind: 'vendored', packages: graph.vendored.sort(byName), importers: graph.importers }
+        : { kind: 'registry', packages: graph.packages.sort(byName), importers: graph.importers };
+}
+/** Lay out complete checkouts while preserving the registered project's location inside Git. */
+export function planBuildRoot(srcRoot, projectPath, layout, repositoryPath = projectPath) {
+    const subdirectory = path.relative(repositoryPath, projectPath);
+    if (subdirectory === '..' || subdirectory.startsWith('..' + path.sep) || path.isAbsolute(subdirectory)) {
+        return { refusal: `project ${projectPath} is outside its Git checkout ${repositoryPath}` };
+    }
+    if (!layout) {
+        const repositoryDir = path.join(srcRoot, 'project');
+        return { repositoryDir, projectDir: path.join(repositoryDir, subdirectory), omniDir: null };
+    }
     const segments = path.resolve(projectPath).split(path.sep).filter(Boolean);
     if (layout.climbs < 1 || layout.climbs > segments.length) {
         return { refusal: `the links climb ${layout.climbs} directories above a project at ${projectPath}` };
     }
-    const projectDir = path.join(srcRoot, ...segments.slice(-layout.climbs));
+    const prefixDepth = subdirectory.split(path.sep).filter(Boolean).length;
+    const retained = Math.max(layout.climbs, prefixDepth + 1);
+    const projectDir = path.join(srcRoot, ...segments.slice(-retained));
+    const repositoryDir = path.resolve(projectDir, path.relative(projectPath, repositoryPath));
     const omniDir = path.resolve(projectDir, layout.omniRel);
-    const inside = omniDir.startsWith(path.resolve(srcRoot) + path.sep);
-    if (!inside) {
+    if (!omniDir.startsWith(path.resolve(srcRoot) + path.sep)) {
         return { refusal: `omni would land at ${omniDir}, outside the build root ${srcRoot}` };
     }
-    return { projectDir, omniDir };
+    if (omniDir === repositoryDir || omniDir.startsWith(repositoryDir + path.sep) || repositoryDir.startsWith(omniDir + path.sep)) {
+        return { refusal: 'project and framework need separate Git checkouts in the build root' };
+    }
+    return { repositoryDir, projectDir, omniDir };
 }
 /**
  * The project's real directory and the omni checkout its links point to.

package/dist/release/layout.js.map

@@ -1 +1 @@
-{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B,2EAA2E;AAC3E,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,GAAG,GAA6C,EAAE,CAAC;IACzD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,yBAAyB;QACtD,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,GAAG,EAAE,CAAC;YACR,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,wCAAwC;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9I,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC;IAChJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,WAAmB,EACnB,MAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,mBAAmB,MAAM,CAAC,MAAM,mCAAmC,WAAW,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,4BAA4B,OAAO,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,MAAkB;IACtE,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/release/layout.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAkBzC,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAU,CAAC;AAGtF,MAAM,OAAO,GAAG,iIAAiI,CAAC;AAClJ,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAKvD,SAAS,YAAY,CAAC,QAAgB,EAAE,UAAkB;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,KAAK,GAAW,EAAE,EAAE,QAAQ,GAAsB,EAAE,EAAE,SAAS,GAAa,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAsB,EAAE,EAAE,eAAe,GAAqB,EAAE,CAAC;IAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,0BAA0B,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAyB,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,IAAI,QAAQ,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC5F,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,KAAK,CAAC,4BAA4B,GAAG,QAAQ,CAAC,CAAC;YACzH,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,QAAQ;gBAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBACxG,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;oBACrG,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;wBAC5E,MAAM,KAAK,CAAC,0DAA0D,GAAG,IAAI,CAAC,CAAC;oBACjF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACnG,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;wBAAE,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrG,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,KAAK,CAAC,0DAA0D,GAAG,GAAG,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,SAAS;YAChD,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;YAClC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI;gBAC/H,MAAM,KAAK,CAAC,+DAA+D,GAAG,GAAG,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,EAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,EAAE,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YAC9E,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBAC/H,MAAM,KAAK,CAAC,2CAA2C,GAAG,IAAI,CAAC,CAAC;gBAClE,CAAC;gBACD,IAAI,UAAU,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,CAAC;oBACrH,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClE,MAAM,KAAK,CAAC,oFAAoF,GAAG,GAAG,CAAC,CAAC;gBAC1G,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,MAAM,KAAK,CAAC,+EAA+E,GAAG,IAAI,CAAC,CAAC;gBACtG,CAAC;gBACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBACrC,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;oBACzG,IAAI,GAAQ,CAAC;oBACb,IAAI,CAAC;wBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,MAAM,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;oBAAC,CAAC;oBAClH,qEAAqE;oBACrE,6DAA6D;oBAC7D,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;wBACrG,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI;wBAClC,MAAM,KAAK,CAAC,gEAAgE,GAAG,IAAI,CAAC,CAAC;gBACzF,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YACrI,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC5F,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,GAAG,GAAG,EAAE,CAAC;QAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5F,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,wCAAwC;QACpG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9I,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC;IAChJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC;IACrJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACnE,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACzI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC7E,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACtF,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBACjH,MAAM,KAAK,CAAC,oFAAoF,GAAG,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;YAC9H,IAAI,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;gBACxH,MAAM,KAAK,CAAC,wEAAwE,GAAG,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5C,IAAI,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7G,MAAM,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,wBAAwB,CAAC;QAC9D,MAAM,KAAK,CAAC,wFAAwF,CAAC,CAAC;IACxG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QACjE,MAAM,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,CAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM;QAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;QACzF,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AAC9F,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,WAAmB,EACnB,MAA8B,EAC9B,cAAc,GAAG,WAAW;IAE5B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACvG,OAAO,EAAE,OAAO,EAAE,WAAW,WAAW,gCAAgC,cAAc,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,mBAAmB,MAAM,CAAC,MAAM,mCAAmC,WAAW,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,4BAA4B,OAAO,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9H,OAAO,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,MAAkB;IACtE,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/release/load.d.ts

@@ -14,6 +14,8 @@ export interface LoadedRelease {
     readonly id: string;
     readonly root: string;
     readonly manifest: ReleaseManifest;
+    /** Digest of the exact manifest bytes admitted with these artifacts. */
+    readonly manifestSha256: string;
     /** Each artifact's tarball on this machine, checked against the manifest. */
     readonly files: ReadonlyArray<{
         app: string;
@@ -27,6 +29,7 @@ export interface LoadedRelease {
     readonly staticsDir: string | null;
 }
 export declare function releasesRoot(): string;
+export declare function assertReleaseId(id: string): void;
 export declare function loadRelease(id: string, root?: string): Promise<LoadedRelease>;
 /**
  * Is this directory's tracked content exactly `commit`, with nothing

package/dist/release/load.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/release/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7H,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAeD,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAgCnG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM;AACd,wEAAwE;AACxE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAS9D"}
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/release/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAMrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7H,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAeD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqDnG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM;AACd,wEAAwE;AACxE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgB9D"}