@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/release/origin.js

@@ -0,0 +1,253 @@
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { validOrigin } from './installed-origin.js';
+import { assertReleaseRepositoryIdentities, isSafeRepositoryIdentity } from './repository-identity.js';
+import { isFrameworkRef } from '../shared/framework-source.js';
+const SHA = /^[a-f0-9]{64}$/;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const sha256 = (value) => typeof value === 'string' && SHA.test(value);
+const commit = (value) => typeof value === 'string' && COMMIT.test(value);
+/** The outer manifest includes JSON-escaped producer evidence, bounded separately below. */
+export const MAX_RELEASE_MANIFEST_BYTES = 8_388_608;
+const MAX_BYTES = 4_194_304, MAX_IMPORTS = 64, MAX_DEPTH = 8;
+const identifier = (value) => typeof value === 'string' && value.length <= 256 && ID.test(value) && !value.includes('..');
+const relative = (value) => typeof value === 'string' && value.length <= 4096 &&
+    !/[\\:\0]/.test(value) && value.split('/').every(part => part && part !== '.' && part !== '..');
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const outcomes = ['passed', 'failed', 'not-run', 'timed-out', 'killed'];
+/** Safe to display as recorded evidence. Empty checksums and zero-byte artifacts stay
+ * readable so admission can explain their refusal; readability never grants admission. */
+export function isReadableReleaseManifest(value) {
+    if (!object(value) || !identifier(value['id']) || !object(value['project']) || !object(value['omni']) ||
+        [value['project'], value['omni']].some(source => !isSafeRepositoryIdentity(source['repo']) || typeof source['commit'] !== 'string' ||
+            (source['ref'] !== undefined && !isFrameworkRef(source['ref'])) ||
+            (source['onRemote'] !== undefined && source['onRemote'] !== null && typeof source['onRemote'] !== 'boolean')) ||
+        !Array.isArray(value['artifacts']) || value['artifacts'].length > 256 || !Array.isArray(value['gates']) || value['gates'].length > 256 ||
+        !object(value['builtWith']) || typeof value['builtWith']['omnitron'] !== 'string' || !Array.isArray(value['builtWith']['packages']) ||
+        value['builtWith']['packages'].some(pkg => !object(pkg) || typeof pkg['name'] !== 'string' || typeof pkg['distBuiltAt'] !== 'string') ||
+        (value['builtAt'] !== undefined && typeof value['builtAt'] !== 'string') || (value['builtBy'] !== undefined && typeof value['builtBy'] !== 'string'))
+        return false;
+    const apps = new Set(), gates = new Set();
+    for (const artifact of value['artifacts']) {
+        if (!object(artifact) || !identifier(artifact['app']) || apps.has(artifact['app']) || typeof artifact['version'] !== 'string' ||
+            typeof artifact['sha256'] !== 'string' || !Number.isSafeInteger(artifact['bytes']) || artifact['bytes'] < 0)
+            return false;
+        apps.add(artifact['app']);
+    }
+    for (const gate of value['gates']) {
+        if (!object(gate) || typeof gate['name'] !== 'string' || !gate['name'] || gates.has(gate['name']) || !outcomes.includes(gate['status']) ||
+            ['detail', 'output'].some(key => gate[key] !== undefined && typeof gate[key] !== 'string') ||
+            ['durationMs', 'checks'].some(key => gate[key] !== undefined && (typeof gate[key] !== 'number' || !Number.isFinite(gate[key]) || gate[key] < 0)))
+            return false;
+        gates.add(gate['name']);
+    }
+    if (value['artifactFailures'] !== undefined && (!Array.isArray(value['artifactFailures']) || value['artifactFailures'].some(failure => !object(failure) || typeof failure['app'] !== 'string' || typeof failure['error'] !== 'string')))
+        return false;
+    if (value['statics'] !== undefined && (!object(value['statics']) || typeof value['statics']['stack'] !== 'string' || typeof value['statics']['dir'] !== 'string' ||
+        !Number.isSafeInteger(value['statics']['files']) || !Number.isSafeInteger(value['statics']['bytes'])))
+        return false;
+    const machine = value['machine'];
+    if (machine != null && (!object(machine) || typeof machine['cpus'] !== 'number' ||
+        ['loadAtGateStart', 'loadAtGateEnd'].some(key => !Array.isArray(machine[key]) || machine[key].length !== 3 ||
+            machine[key].some((number) => typeof number !== 'number' || !Number.isFinite(number)))))
+        return false;
+    return true;
+}
+export function assertReleaseArtifactReference(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw Error('Expected an exact release artifact reference');
+    const ref = value;
+    if (!identifier(ref.release) || !identifier(ref.app) || !sha256(ref.manifestSha256) ||
+        Object.keys(ref).some(key => !['release', 'app', 'manifestSha256'].includes(key)))
+        throw Error('Expected a release id, application name and full manifest SHA-256');
+}
+/** Validate all embedded evidence once per operation. Exact JSON bytes are retained, not
+ * reserialized approximations. Bounds apply to the whole graph, including unused records. */
+function evidence(root) {
+    const result = new Map();
+    const parsed = new Map();
+    let total = 0;
+    const visit = (manifest, depth, ancestors) => {
+        assertReleaseRepositoryIdentities(manifest);
+        if (depth > MAX_DEPTH)
+            throw Error('Imported release chain exceeds eight levels');
+        if (result.has(manifest))
+            return;
+        const imports = manifest.imports ?? [];
+        if (!Array.isArray(imports) || imports.length > MAX_IMPORTS)
+            throw Error('Invalid imported release inventory');
+        const sources = new Map();
+        result.set(manifest, sources);
+        for (const record of imports) {
+            if (!record || !sha256(record.sha256) || typeof record.manifestJson !== 'string' ||
+                Buffer.byteLength(record.manifestJson) > MAX_BYTES || sources.has(record.sha256))
+                throw Error('Invalid or duplicate imported release manifest');
+            if (ancestors.has(record.sha256))
+                throw Error('Cyclic imported release manifests');
+            let source = parsed.get(record.sha256);
+            if (source) {
+                if (source.raw !== record.manifestJson)
+                    throw Error('Imported release digest identifies conflicting bytes');
+            }
+            else {
+                total += Buffer.byteLength(record.manifestJson);
+                if (total > MAX_BYTES || parsed.size >= MAX_IMPORTS)
+                    throw Error('Imported release evidence exceeds its size limit');
+                if (createHash('sha256').update(record.manifestJson).digest('hex') !== record.sha256)
+                    throw Error('Imported release manifest does not match its pinned digest');
+                let value;
+                try {
+                    value = JSON.parse(record.manifestJson);
+                }
+                catch {
+                    throw Error('Imported release manifest is not valid JSON');
+                }
+                assertReleaseRepositoryIdentities(value);
+                if (!isReadableReleaseManifest(value) || !commit(value.project.commit) || !value.project.repo ||
+                    !commit(value.omni.commit) || !value.omni.repo)
+                    throw Error('Imported release manifest lacks a complete producer identity');
+                source = { raw: record.manifestJson, manifest: value };
+                parsed.set(record.sha256, source);
+            }
+            sources.set(record.sha256, source.manifest);
+            visit(source.manifest, depth + 1, new Set([...ancestors, record.sha256]));
+        }
+    };
+    visit(root, 0, new Set());
+    return result;
+}
+function oneArtifact(manifest, app) {
+    const found = manifest.artifacts.filter(value => value?.app === app);
+    if (found.length !== 1)
+        throw Error('No unique release artifact for ' + manifest.id + '/' + app);
+    return found[0];
+}
+function payload(artifact) {
+    const { app: _app, origin: _origin, ...record } = artifact;
+    return record;
+}
+function validMigrationPrograms(value) {
+    if (value === undefined)
+        return true; // Older producers did not capture declared entries.
+    if (!Array.isArray(value) || value.length > 256)
+        return false;
+    const entries = new Set();
+    return value.every(program => {
+        if (!object(program) || !['script', 'config'].includes(program['mode']) ||
+            !relative(program['source']) || !commit(program['sourceBlob']) || !sha256(program['sourceSha256']) ||
+            !relative(program['release']) || !/\.[cm]?js$/.test(program['release']) || !sha256(program['releaseSha256']) ||
+            entries.has(program['release']))
+            return false;
+        entries.add(program['release']);
+        return true;
+    });
+}
+/** An import is an independently portable application, not a claim inferred from a legacy tar. */
+export function assertImportableArtifact(manifest, artifact) {
+    const launch = artifact.launch, source = artifact.packageSource, target = manifest.builtWith?.target;
+    if (!object(source) || !object(target) || (!object(launch) && !sha256(artifact.closureSha256)))
+        throw Error('Imported application needs a recorded package source, frozen entry or payload closure, and execution target: ' + artifact.app);
+    if ((launch !== undefined && (!object(launch) || !['bootstrap', 'script'].includes(launch.mode) || !relative(launch.file) || !/\.[cm]?js$/.test(launch.file) || !sha256(launch.closureSha256))) ||
+        (artifact.closureSha256 !== undefined && (!sha256(artifact.closureSha256) || (launch && artifact.closureSha256 !== launch.closureSha256))) ||
+        (source.directory !== '.' && !relative(source.directory)) || !commit(source.manifestBlob) ||
+        !object(source.migrations) || !validMigrationPrograms(source.migrationPrograms) ||
+        Object.entries(source.migrations).some(([file, sha]) => !relative(file) || !sha256(sha)) ||
+        !['platform', 'arch', 'node', 'abi'].every(key => typeof target[key] === 'string' && target[key]) ||
+        !sha256(target.executableSha256) || (target.libc !== null && typeof target.libc !== 'string'))
+        throw Error('Imported application has malformed source, launch or execution target: ' + artifact.app);
+}
+function context(manifest, app, records, chain = []) {
+    const artifact = oneArtifact(manifest, app);
+    if (!validMigrationPrograms(artifact.packageSource?.migrationPrograms))
+        throw Error('Invalid declared migration provenance for ' + app);
+    if (!artifact.origin)
+        return { manifest, artifact, chain };
+    assertReleaseArtifactReference(artifact.origin);
+    const source = records.get(manifest)?.get(artifact.origin.manifestSha256);
+    if (!source || source.id !== artifact.origin.release)
+        throw Error('Missing pinned producer manifest for ' + app);
+    const original = oneArtifact(source, artifact.origin.app);
+    if (!isDeepStrictEqual(payload(artifact), payload(original)))
+        throw Error('Imported artifact metadata differs from its producer: ' + app);
+    if (chain.length >= MAX_DEPTH)
+        throw Error('Imported release chain exceeds eight levels');
+    const result = context(source, original.app, records, [...chain, artifact.origin]);
+    assertImportableArtifact(result.manifest, result.artifact);
+    return result;
+}
+/** Shared by build, admission, receipts and diagnostics. No application JavaScript executes. */
+export function artifactReleaseContext(manifest, app) {
+    return context(manifest, app, evidence(manifest));
+}
+/** Every origin must resolve, including artifacts outside the currently selected stack. */
+export function artifactReleaseContexts(manifest) {
+    const records = evidence(manifest);
+    for (const source of records.keys()) {
+        if (source === manifest)
+            continue;
+        for (const artifact of source.artifacts)
+            context(source, artifact.app, records);
+    }
+    return manifest.artifacts.map(artifact => ({ app: artifact.app, ...context(manifest, artifact.app, records) }));
+}
+/** One receipt mapping for local installation and remote delivery. Imported bytes
+ * always retain the original producer; only the launch alias belongs to the consumer. */
+export function releaseArtifactOrigins(manifest, manifestSha256) {
+    if (!sha256(manifestSha256))
+        throw Error('Invalid release manifest digest');
+    return artifactReleaseContexts(manifest).map(source => {
+        const launch = source.artifact.launch;
+        const origin = {
+            releaseId: source.manifest.id,
+            manifestSha256: source.chain.at(-1)?.manifestSha256 ?? manifestSha256,
+            artifactSha256: source.artifact.sha256,
+            artifactBytes: source.artifact.bytes,
+            app: source.app,
+            frameworkCommit: source.manifest.omni.commit,
+            ...(launch && { runtimeOrigin: {
+                    projectCommit: source.manifest.project.commit,
+                    producerApp: source.artifact.app,
+                    consumer: { releaseId: manifest.id, manifestSha256, app: source.app },
+                    entry: { relativeFile: launch.file, mode: launch.mode },
+                } }),
+        };
+        if (!validOrigin(origin))
+            throw Error('Invalid installed artifact origin for ' + source.app);
+        return { ...source, origin };
+    });
+}
+export function validateReleaseOrigins(manifest) {
+    artifactReleaseContexts(manifest);
+}
+/** Dependencies are independent releases: consumer gates never stand in for producer gates. */
+export function importedReleaseRefusal(manifest, apps, requireOnRemote = false) {
+    const records = evidence(manifest), checked = new Set();
+    const visit = (source, app) => {
+        const artifact = oneArtifact(source, app);
+        if (!artifact.origin)
+            return null;
+        context(source, app, records);
+        const producer = records.get(source).get(artifact.origin.manifestSha256);
+        if (!checked.has(producer)) {
+            checked.add(producer);
+            if (!producer.gates.length)
+                return 'imported release ' + producer.id + ' recorded no gates';
+            const failed = producer.gates.find(gate => gate.status !== 'passed');
+            if (failed)
+                return `imported release ${producer.id}: gate '${failed.name}' ${failed.status}`;
+            if (requireOnRemote && (producer.project.onRemote !== true || producer.omni.onRemote !== true))
+                return 'imported release ' + producer.id + ' has unconfirmed source publication; publish its commits and rebuild with a reachable origin';
+        }
+        return visit(producer, artifact.origin.app);
+    };
+    for (const app of apps) {
+        if (!manifest.artifacts.some(artifact => artifact.app === app))
+            continue;
+        const refusal = visit(manifest, app);
+        if (refusal)
+            return refusal;
+    }
+    return null;
+}
+//# sourceMappingURL=origin.js.map

package/dist/release/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/release/origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,WAAW,EAA8B,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,iCAAiC,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAC7B,MAAM,EAAE,GAAG,8BAA8B,CAAC;AAC1C,MAAM,MAAM,GAAG,iCAAiC,CAAC;AACjD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpG,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AACpD,MAAM,SAAS,GAAG,SAAS,EAAE,WAAW,GAAG,EAAE,EAAE,SAAS,GAAG,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpJ,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;IACrG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AAClG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACnI,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAExE;0FAC0F;AAC1F,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;YAChI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC;QAC/G,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG;QACtI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC;QACnI,KAAK,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC;QACrI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACvK,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ;YACzH,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAK,QAAQ,CAAC,OAAO,CAAY,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1I,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAW,CAAC;YAC7I,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;YAC1F,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACnK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACpI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjH,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC5J,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxH,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC3E,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YACxG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC7H,MAAM,GAAG,GAAG,KAA0C,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnF,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;AACrF,CAAC;AAUD;6FAC6F;AAC7F,SAAS,QAAQ,CAAC,IAAqB;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiD,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsD,CAAC;IAC7E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,QAAyB,EAAE,KAAa,EAAE,SAA8B,EAAQ,EAAE;QAC/F,iCAAiC,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW;YAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/G,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;gBAC5E,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpJ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACnF,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,YAAY;oBAAE,MAAM,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC9G,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAChD,IAAI,KAAK,GAAG,SAAS,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW;oBAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACrH,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM;oBAClF,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBAC5E,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC;oBAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAAC,CAAC;gBAChD,MAAM,CAAC;oBAAC,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAAC,CAAC;gBACrE,iCAAiC,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI;oBACzF,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI;oBAChD,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBAC9E,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAyB,EAAE,GAAW;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,iCAAiC,GAAG,QAAQ,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,QAAyB;IACxC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,oDAAoD;IAC1F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAW,CAAC;YAC7E,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAClG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACtH,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAW,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,QAAyB,EAAE,QAAyB;IAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACrG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5F,MAAM,KAAK,CAAC,+GAA+G,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9I,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3L,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1I,CAAC,MAAM,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzF,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC/E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxF,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,GAA0B,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAA0B,CAAC,CAAC;QAC/I,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC/F,MAAM,KAAK,CAAC,yEAAyE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,OAAO,CACd,QAAyB,EAAE,GAAW,EAAE,OAAoC,EAAE,KAAK,GAA+B,EAAE;IAEpH,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAAE,MAAM,KAAK,CAAC,4CAA4C,GAAG,GAAG,CAAC,CAAC;IACxI,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3D,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,GAAG,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,wDAAwD,GAAG,GAAG,CAAC,CAAC;IAC1I,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,QAAyB,EAAE,GAAW;IAC3E,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,QAAyB;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAS;QAClC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;yFACyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,QAAyB,EAAE,cAAsB;IAEtF,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC5E,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtC,MAAM,MAAM,GAA0B;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC7B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,cAAc;YACrE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACtC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YACpC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;YAC5C,GAAG,CAAC,MAAM,IAAI,EAAE,aAAa,EAAE;oBAC7B,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM;oBAC7C,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;oBAChC,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;oBACrE,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBACxD,EAAE,CAAC;SACL,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,wCAAwC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7F,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAyB;IAC9D,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sBAAsB,CAAC,QAAyB,EAAE,IAAuB,EAAE,eAAe,GAAG,KAAK;IAChH,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzE,MAAM,KAAK,GAAG,CAAC,MAAuB,EAAE,GAAW,EAAiB,EAAE;QACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAE,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,mBAAmB,GAAG,QAAQ,CAAC,EAAE,GAAG,oBAAoB,CAAC;YAC5F,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;YACrE,IAAI,MAAM;gBAAE,OAAO,oBAAoB,QAAQ,CAAC,EAAE,WAAW,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7F,IAAI,eAAe,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;gBAC5F,OAAO,mBAAmB,GAAG,QAAQ,CAAC,EAAE,GAAG,8FAA8F,CAAC;QAC9I,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC;YAAE,SAAS;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/release/owner-admission.d.ts

@@ -0,0 +1,15 @@
+import type { IEcosystemAppEntry, IStackConfig } from '../config/types.js';
+import { type ApplicationRuntime } from '../services/host-upgrade.js';
+import type { ReleaseManifest } from './manifest.js';
+/** Native owner evidence obtained through the same authenticated probe as delivery. */
+export interface ReleaseOwnerAnswer {
+    readonly host: string;
+    readonly port?: number;
+    readonly runtime?: ApplicationRuntime;
+    readonly error?: string;
+}
+/** A frozen application owns its SDK. The resident protocol and exact Node
+ * image, not equality of application/owner Git commits, establish compatibility.
+ * Installation repeats this proof and binds the owner identity and grant. */
+export declare function refuseReleaseOwners(manifest: ReleaseManifest, stack: IStackConfig, apps: readonly IEcosystemAppEntry[], owners: readonly ReleaseOwnerAnswer[]): string | null;
+//# sourceMappingURL=owner-admission.d.ts.map

package/dist/release/owner-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-admission.d.ts","sourceRoot":"","sources":["../../src/release/owner-admission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAExG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;6EAE6E;AAC7E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,GAAG,IAAI,CAsB7K"}

package/dist/release/owner-admission.js

@@ -0,0 +1,37 @@
+import { resolveNodePlacements, stackNodeKey } from '../project/stack-placement.js';
+import { assertResidentApplicationRuntime } from '../services/host-upgrade.js';
+import { assertFrozenLaunch } from './frozen-installation.js';
+import { artifactReleaseContexts } from './origin.js';
+import { assertReleaseTarget } from './target-runtime.js';
+/** A frozen application owns its SDK. The resident protocol and exact Node
+ * image, not equality of application/owner Git commits, establish compatibility.
+ * Installation repeats this proof and binds the owner identity and grant. */
+export function refuseReleaseOwners(manifest, stack, apps, owners) {
+    const sources = new Map(artifactReleaseContexts(manifest).map(source => [source.app, source]));
+    for (const placement of resolveNodePlacements(stack, apps)) {
+        if (!placement.apps.length)
+            continue;
+        const key = stackNodeKey(placement.node.host, placement.node.port);
+        const answers = owners.filter(answer => stackNodeKey(answer.host, answer.port) === key);
+        if (answers.length !== 1)
+            return key + ' has no unique authenticated execution owner observation';
+        const answer = answers[0];
+        for (const app of placement.apps) {
+            try {
+                if (answer.error !== undefined)
+                    throw Error('Execution owner verification failed: ' + answer.error);
+                assertResidentApplicationRuntime(answer.runtime);
+                const source = sources.get(app.name);
+                if (!source)
+                    throw Error('No verified release artifact');
+                assertFrozenLaunch(source.artifact.launch);
+                assertReleaseTarget(source.manifest.builtWith.target, answer.runtime.target);
+            }
+            catch (error) {
+                return app.name + ' on ' + key + ': ' + (error instanceof Error ? error.message : String(error));
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=owner-admission.js.map

package/dist/release/owner-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-admission.js","sourceRoot":"","sources":["../../src/release/owner-admission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAA2B,MAAM,6BAA6B,CAAC;AACxG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D;;6EAE6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,QAAyB,EAAE,KAAmB,EAAE,IAAmC,EAAE,MAAqC;IAC5J,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/F,KAAK,MAAM,SAAS,IAAI,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACxF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,GAAG,0DAA0D,CAAC;QAClG,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpG,gCAAgC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM;oBAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACzD,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC3C,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/release/owner-executable.d.ts

@@ -0,0 +1,3 @@
+/** Compare the actual resident owner's executable, not the controller's version string or its service definition. */
+export declare function assertOwnerExecutable(pid: number, expectedSha256: string): Promise<void>;
+//# sourceMappingURL=owner-executable.d.ts.map

package/dist/release/owner-executable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-executable.d.ts","sourceRoot":"","sources":["../../src/release/owner-executable.ts"],"names":[],"mappings":"AAQA,qHAAqH;AACrH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB9F"}

package/dist/release/owner-executable.js

@@ -0,0 +1,40 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { sha256File } from './portable-archive.js';
+const run = promisify(execFile);
+/** Compare the actual resident owner's executable, not the controller's version string or its service definition. */
+export async function assertOwnerExecutable(pid, expectedSha256) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        throw Error('Invalid local execution owner PID');
+    let file;
+    if (process.platform === 'linux')
+        file = '/proc/' + pid + '/exe';
+    else if (process.platform === 'darwin') {
+        const options = { encoding: 'utf8', timeout: 5000, maxBuffer: 2 * 1024 * 1024 };
+        const [{ stdout: name }, { stdout: mappings }] = await Promise.all([
+            run('/bin/ps', ['-p', String(pid), '-o', 'comm='], options),
+            run('/usr/sbin/lsof', ['-nP', '-a', '-p', String(pid), '-d', 'txt', '-FDin'], options),
+        ]);
+        file = name.trim();
+        if (!path.isAbsolute(file) || /[\r\n]/.test(file) || await fs.realpath(file) !== file)
+            throw Error('Cannot identify the execution owner image');
+        const image = await fs.stat(file, { bigint: true });
+        const mapped = mappings.split('\nftxt\n').slice(1).some(record => {
+            const fields = record.trimEnd().split('\n');
+            return fields.includes('n' + file) && fields.includes('i' + image.ino) &&
+                fields.some(f => /^D0x[0-9a-f]+$/i.test(f) && BigInt(f.slice(1)) === image.dev);
+        });
+        if (!mapped)
+            throw Error('The registered owner image is no longer mapped at its original inode');
+    }
+    else
+        throw Error('Local release verification does not support process images on ' + process.platform);
+    const before = await fs.stat(file, { bigint: true });
+    const actual = await sha256File(file);
+    const after = await fs.stat(file, { bigint: true });
+    if (actual !== expectedSha256 || before.dev !== after.dev || before.ino !== after.ino || before.ctimeNs !== after.ctimeNs)
+        throw Error('Execution owner is not running the Node executable selected for this local release');
+}
+//# sourceMappingURL=owner-executable.js.map

package/dist/release/owner-executable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-executable.js","sourceRoot":"","sources":["../../src/release/owner-executable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,cAAsB;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC7F,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,IAAI,GAAG,QAAQ,GAAG,GAAG,GAAG,MAAM,CAAC;SAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACzF,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjE,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAC3D,GAAG,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC;SACvF,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAChJ,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACnG,CAAC;;QAAM,MAAM,KAAK,CAAC,gEAAgE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACvH,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;AACtG,CAAC"}

package/dist/release/package-gates.d.ts

@@ -0,0 +1,9 @@
+import type { GateOutcome } from './manifest.js';
+/** Read the package scripts declared as release gates from the checked-out workspace. */
+export declare function readPackageGates(workspace: string): string[] | undefined;
+/** The build's step runner owns its process group, deadline, cwd and logs. */
+export declare function runPackageGates(names: readonly string[], run: (name: string, index: number) => Promise<{
+    code: number | null;
+    timedOut: boolean;
+}>, signal?: AbortSignal): Promise<GateOutcome[]>;
+//# sourceMappingURL=package-gates.d.ts.map

package/dist/release/package-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-gates.d.ts","sourceRoot":"","sources":["../../src/release/package-gates.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAkBxE;AAED,8EAA8E;AAC9E,wBAAsB,eAAe,CACnC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,EACzF,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,EAAE,CAAC,CAgBxB"}

package/dist/release/package-gates.js

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/** Read the package scripts declared as release gates from the checked-out workspace. */
+export function readPackageGates(workspace) {
+    const manifest = JSON.parse(fs.readFileSync(path.join(workspace, 'package.json'), 'utf8'));
+    const gates = manifest.omnitron?.release?.gates;
+    if (gates === undefined)
+        return undefined;
+    if (fs.existsSync(path.join(workspace, 'scripts/gates.mjs')))
+        throw Error('Choose one release gate definition: package.json omnitron.release.gates or scripts/gates.mjs');
+    if (!Array.isArray(gates) || !gates.length || gates.length > 64)
+        throw Error('omnitron.release.gates must list 1–64 package script names');
+    const seen = new Set();
+    for (const name of gates) {
+        if (typeof name !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,63}$/.test(name) || seen.has(name))
+            throw Error('Release gate script names must be unique, at most 64 characters, and contain no switches, paths or whitespace');
+        if (!manifest.scripts || !Object.hasOwn(manifest.scripts, name) ||
+            typeof manifest.scripts[name] !== 'string' || !manifest.scripts[name].trim())
+            throw Error('Release gate names an undeclared or empty package script: ' + name);
+        seen.add(name);
+    }
+    return [...seen];
+}
+/** The build's step runner owns its process group, deadline, cwd and logs. */
+export async function runPackageGates(names, run, signal) {
+    const gates = [];
+    for (const [index, name] of names.entries()) {
+        if (signal?.aborted) {
+            gates.push({ name, status: 'not-run', detail: 'Build stopped before this package script ran' });
+            continue;
+        }
+        const start = Date.now();
+        const result = await run(name, index);
+        const status = result.timedOut ? 'timed-out' : result.code === null || signal?.aborted ? 'killed'
+            : result.code === 0 ? 'passed' : 'failed';
+        const detail = result.timedOut ? 'Package script exceeded its deadline' : status === 'killed' ? 'Package script was interrupted'
+            : 'pnpm run ' + name + ' exited ' + result.code;
+        gates.push({ name, status, detail, durationMs: Date.now() - start });
+    }
+    return gates;
+}
+//# sourceMappingURL=package-gates.js.map

package/dist/release/package-gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-gates.js","sourceRoot":"","sources":["../../src/release/package-gates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAY,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAC9G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAC7D,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAChG,MAAM,KAAK,CAAC,+GAA+G,CAAC,CAAC;QAC/H,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;YAC3D,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YAC9E,MAAM,KAAK,CAAC,4DAA4D,GAAG,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAwB,EACxB,GAAyF,EACzF,MAAoB;IAEpB,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ;YAC/F,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gCAAgC;YAC9H,CAAC,CAAC,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/release/package-resolution.d.ts

@@ -0,0 +1,4 @@
+/** Look up installed packages without consulting NODE_PATH or user-wide modules.
+ * In a materialized release every dependency has its own explicit link. */
+export declare function resolveInstalledDependency(directory: string, name: string, directOnly?: boolean): Promise<string | undefined>;
+//# sourceMappingURL=package-resolution.d.ts.map

package/dist/release/package-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-resolution.d.ts","sourceRoot":"","sources":["../../src/release/package-resolution.ts"],"names":[],"mappings":"AAAA;2EAC2E;AAC3E,wBAAsB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqBjI"}

package/dist/release/package-resolution.js

@@ -0,0 +1,28 @@
+/** Look up installed packages without consulting NODE_PATH or user-wide modules.
+ * In a materialized release every dependency has its own explicit link. */
+export async function resolveInstalledDependency(directory, name, directOnly = false) {
+    const fs = await import('node:fs/promises');
+    const path = await import('node:path');
+    if (!/^(?:@[\w.-]+\/)?[\w.-]+$/.test(name) || name.split('/').some(part => part.startsWith('.')))
+        throw Error('Invalid dependency name: ' + name);
+    let current = directory;
+    while (true) {
+        if (path.basename(current) !== 'node_modules') {
+            const candidate = path.join(current, 'node_modules', name);
+            try {
+                await fs.access(path.join(candidate, 'package.json'));
+                return candidate;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== 'ENOENT' && code !== 'ENOTDIR')
+                    throw error;
+            }
+        }
+        const parent = path.dirname(current);
+        if (directOnly || parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+//# sourceMappingURL=package-resolution.js.map

package/dist/release/package-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-resolution.js","sourceRoot":"","sources":["../../src/release/package-resolution.ts"],"names":[],"mappings":"AAAA;2EAC2E;AAC3E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,SAAiB,EAAE,IAAY,EAAE,UAAU,GAAG,KAAK;IAClG,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9F,MAAM,KAAK,CAAC,2BAA2B,GAAG,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,cAAc,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;gBACtD,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,UAAU,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACvD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/release/portable-archive.d.ts

@@ -0,0 +1,12 @@
+export declare function sha256File(file: string): Promise<string>;
+/** Deterministic per-file integrity manifest for releases that require a regular-file payload. */
+export declare function releaseFileHashes(directory: string): Promise<Record<string, string>>;
+/** Canonical archive of a staged tree, with executable bits and relative links preserved. */
+export declare function writePortableArchive(directory: string, destination: string, options?: {
+    exclusive?: boolean;
+    preserveExecutableBits?: boolean;
+}): Promise<void>;
+/** pnpm resolves workspace ranges before packing. Canonicalize only unordered
+ * dependency maps; export conditions and all executable bytes keep their order. */
+export declare function normalizePackedWorkspace(archive: string): Promise<void>;
+//# sourceMappingURL=portable-archive.d.ts.map

package/dist/release/portable-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portable-archive.d.ts","sourceRoot":"","sources":["../../src/release/portable-archive.ts"],"names":[],"mappings":"AAqBA,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI9D;AAED,kGAAkG;AAClG,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAO1F;AAED,6FAA6F;AAC7F,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BzK;AAED;mFACmF;AACnF,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe7E"}