@omnitron-dev/omnitron 0.3.1 → 0.3.3

package/dist/release/owner-admission.js

@@ -0,0 +1,37 @@
+import { resolveNodePlacements, stackNodeKey } from '../project/stack-placement.js';
+import { assertResidentApplicationRuntime } from '../services/host-upgrade.js';
+import { assertFrozenLaunch } from './frozen-installation.js';
+import { artifactReleaseContexts } from './origin.js';
+import { assertReleaseTarget } from './target-runtime.js';
+/** A frozen application owns its SDK. The resident protocol and exact Node
+ * image, not equality of application/owner Git commits, establish compatibility.
+ * Installation repeats this proof and binds the owner identity and grant. */
+export function refuseReleaseOwners(manifest, stack, apps, owners) {
+    const sources = new Map(artifactReleaseContexts(manifest).map(source => [source.app, source]));
+    for (const placement of resolveNodePlacements(stack, apps)) {
+        if (!placement.apps.length)
+            continue;
+        const key = stackNodeKey(placement.node.host, placement.node.port);
+        const answers = owners.filter(answer => stackNodeKey(answer.host, answer.port) === key);
+        if (answers.length !== 1)
+            return key + ' has no unique authenticated execution owner observation';
+        const answer = answers[0];
+        for (const app of placement.apps) {
+            try {
+                if (answer.error !== undefined)
+                    throw Error('Execution owner verification failed: ' + answer.error);
+                assertResidentApplicationRuntime(answer.runtime);
+                const source = sources.get(app.name);
+                if (!source)
+                    throw Error('No verified release artifact');
+                assertFrozenLaunch(source.artifact.launch);
+                assertReleaseTarget(source.manifest.builtWith.target, answer.runtime.target);
+            }
+            catch (error) {
+                return app.name + ' on ' + key + ': ' + (error instanceof Error ? error.message : String(error));
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=owner-admission.js.map

package/dist/release/owner-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-admission.js","sourceRoot":"","sources":["../../src/release/owner-admission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAA2B,MAAM,6BAA6B,CAAC;AACxG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D;;6EAE6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,QAAyB,EAAE,KAAmB,EAAE,IAAmC,EAAE,MAAqC;IAC5J,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/F,KAAK,MAAM,SAAS,IAAI,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACxF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,GAAG,0DAA0D,CAAC;QAClG,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC,uCAAuC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpG,gCAAgC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM;oBAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACzD,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC3C,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/release/owner-executable.d.ts

@@ -0,0 +1,3 @@
+/** Compare the actual resident owner's executable, not the controller's version string or its service definition. */
+export declare function assertOwnerExecutable(pid: number, expectedSha256: string): Promise<void>;
+//# sourceMappingURL=owner-executable.d.ts.map

package/dist/release/owner-executable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-executable.d.ts","sourceRoot":"","sources":["../../src/release/owner-executable.ts"],"names":[],"mappings":"AAQA,qHAAqH;AACrH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB9F"}

package/dist/release/owner-executable.js

@@ -0,0 +1,40 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { sha256File } from './portable-archive.js';
+const run = promisify(execFile);
+/** Compare the actual resident owner's executable, not the controller's version string or its service definition. */
+export async function assertOwnerExecutable(pid, expectedSha256) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        throw Error('Invalid local execution owner PID');
+    let file;
+    if (process.platform === 'linux')
+        file = '/proc/' + pid + '/exe';
+    else if (process.platform === 'darwin') {
+        const options = { encoding: 'utf8', timeout: 5000, maxBuffer: 2 * 1024 * 1024 };
+        const [{ stdout: name }, { stdout: mappings }] = await Promise.all([
+            run('/bin/ps', ['-p', String(pid), '-o', 'comm='], options),
+            run('/usr/sbin/lsof', ['-nP', '-a', '-p', String(pid), '-d', 'txt', '-FDin'], options),
+        ]);
+        file = name.trim();
+        if (!path.isAbsolute(file) || /[\r\n]/.test(file) || await fs.realpath(file) !== file)
+            throw Error('Cannot identify the execution owner image');
+        const image = await fs.stat(file, { bigint: true });
+        const mapped = mappings.split('\nftxt\n').slice(1).some(record => {
+            const fields = record.trimEnd().split('\n');
+            return fields.includes('n' + file) && fields.includes('i' + image.ino) &&
+                fields.some(f => /^D0x[0-9a-f]+$/i.test(f) && BigInt(f.slice(1)) === image.dev);
+        });
+        if (!mapped)
+            throw Error('The registered owner image is no longer mapped at its original inode');
+    }
+    else
+        throw Error('Local release verification does not support process images on ' + process.platform);
+    const before = await fs.stat(file, { bigint: true });
+    const actual = await sha256File(file);
+    const after = await fs.stat(file, { bigint: true });
+    if (actual !== expectedSha256 || before.dev !== after.dev || before.ino !== after.ino || before.ctimeNs !== after.ctimeNs)
+        throw Error('Execution owner is not running the Node executable selected for this local release');
+}
+//# sourceMappingURL=owner-executable.js.map

package/dist/release/owner-executable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-executable.js","sourceRoot":"","sources":["../../src/release/owner-executable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,cAAsB;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC7F,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,IAAI,GAAG,QAAQ,GAAG,GAAG,GAAG,MAAM,CAAC;SAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,MAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACzF,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjE,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAC3D,GAAG,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC;SACvF,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAChJ,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACnG,CAAC;;QAAM,MAAM,KAAK,CAAC,gEAAgE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QACvH,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;AACtG,CAAC"}

package/dist/release/package-gates.d.ts

@@ -0,0 +1,9 @@
+import type { GateOutcome } from './manifest.js';
+/** Read the package scripts declared as release gates from the checked-out workspace. */
+export declare function readPackageGates(workspace: string): string[] | undefined;
+/** The build's step runner owns its process group, deadline, cwd and logs. */
+export declare function runPackageGates(names: readonly string[], run: (name: string, index: number) => Promise<{
+    code: number | null;
+    timedOut: boolean;
+}>, signal?: AbortSignal): Promise<GateOutcome[]>;
+//# sourceMappingURL=package-gates.d.ts.map

package/dist/release/package-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-gates.d.ts","sourceRoot":"","sources":["../../src/release/package-gates.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAkBxE;AAED,8EAA8E;AAC9E,wBAAsB,eAAe,CACnC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,EACzF,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,EAAE,CAAC,CAgBxB"}

package/dist/release/package-gates.js

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/** Read the package scripts declared as release gates from the checked-out workspace. */
+export function readPackageGates(workspace) {
+    const manifest = JSON.parse(fs.readFileSync(path.join(workspace, 'package.json'), 'utf8'));
+    const gates = manifest.omnitron?.release?.gates;
+    if (gates === undefined)
+        return undefined;
+    if (fs.existsSync(path.join(workspace, 'scripts/gates.mjs')))
+        throw Error('Choose one release gate definition: package.json omnitron.release.gates or scripts/gates.mjs');
+    if (!Array.isArray(gates) || !gates.length || gates.length > 64)
+        throw Error('omnitron.release.gates must list 1–64 package script names');
+    const seen = new Set();
+    for (const name of gates) {
+        if (typeof name !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,63}$/.test(name) || seen.has(name))
+            throw Error('Release gate script names must be unique, at most 64 characters, and contain no switches, paths or whitespace');
+        if (!manifest.scripts || !Object.hasOwn(manifest.scripts, name) ||
+            typeof manifest.scripts[name] !== 'string' || !manifest.scripts[name].trim())
+            throw Error('Release gate names an undeclared or empty package script: ' + name);
+        seen.add(name);
+    }
+    return [...seen];
+}
+/** The build's step runner owns its process group, deadline, cwd and logs. */
+export async function runPackageGates(names, run, signal) {
+    const gates = [];
+    for (const [index, name] of names.entries()) {
+        if (signal?.aborted) {
+            gates.push({ name, status: 'not-run', detail: 'Build stopped before this package script ran' });
+            continue;
+        }
+        const start = Date.now();
+        const result = await run(name, index);
+        const status = result.timedOut ? 'timed-out' : result.code === null || signal?.aborted ? 'killed'
+            : result.code === 0 ? 'passed' : 'failed';
+        const detail = result.timedOut ? 'Package script exceeded its deadline' : status === 'killed' ? 'Package script was interrupted'
+            : 'pnpm run ' + name + ' exited ' + result.code;
+        gates.push({ name, status, detail, durationMs: Date.now() - start });
+    }
+    return gates;
+}
+//# sourceMappingURL=package-gates.js.map

package/dist/release/package-gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-gates.js","sourceRoot":"","sources":["../../src/release/package-gates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAY,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAC9G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAC7D,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAChG,MAAM,KAAK,CAAC,+GAA+G,CAAC,CAAC;QAC/H,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;YAC3D,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YAC9E,MAAM,KAAK,CAAC,4DAA4D,GAAG,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAwB,EACxB,GAAyF,EACzF,MAAoB;IAEpB,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ;YAC/F,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gCAAgC;YAC9H,CAAC,CAAC,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/release/package-resolution.d.ts

@@ -0,0 +1,4 @@
+/** Look up installed packages without consulting NODE_PATH or user-wide modules.
+ * In a materialized release every dependency has its own explicit link. */
+export declare function resolveInstalledDependency(directory: string, name: string, directOnly?: boolean): Promise<string | undefined>;
+//# sourceMappingURL=package-resolution.d.ts.map

package/dist/release/package-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-resolution.d.ts","sourceRoot":"","sources":["../../src/release/package-resolution.ts"],"names":[],"mappings":"AAAA;2EAC2E;AAC3E,wBAAsB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqBjI"}

package/dist/release/package-resolution.js

@@ -0,0 +1,28 @@
+/** Look up installed packages without consulting NODE_PATH or user-wide modules.
+ * In a materialized release every dependency has its own explicit link. */
+export async function resolveInstalledDependency(directory, name, directOnly = false) {
+    const fs = await import('node:fs/promises');
+    const path = await import('node:path');
+    if (!/^(?:@[\w.-]+\/)?[\w.-]+$/.test(name) || name.split('/').some(part => part.startsWith('.')))
+        throw Error('Invalid dependency name: ' + name);
+    let current = directory;
+    while (true) {
+        if (path.basename(current) !== 'node_modules') {
+            const candidate = path.join(current, 'node_modules', name);
+            try {
+                await fs.access(path.join(candidate, 'package.json'));
+                return candidate;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== 'ENOENT' && code !== 'ENOTDIR')
+                    throw error;
+            }
+        }
+        const parent = path.dirname(current);
+        if (directOnly || parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+//# sourceMappingURL=package-resolution.js.map

package/dist/release/package-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-resolution.js","sourceRoot":"","sources":["../../src/release/package-resolution.ts"],"names":[],"mappings":"AAAA;2EAC2E;AAC3E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,SAAiB,EAAE,IAAY,EAAE,UAAU,GAAG,KAAK;IAClG,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9F,MAAM,KAAK,CAAC,2BAA2B,GAAG,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,cAAc,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;gBACtD,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,UAAU,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACvD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/release/portable-archive.d.ts

@@ -0,0 +1,12 @@
+export declare function sha256File(file: string): Promise<string>;
+/** Deterministic per-file integrity manifest for releases that require a regular-file payload. */
+export declare function releaseFileHashes(directory: string): Promise<Record<string, string>>;
+/** Canonical archive of a staged tree, with executable bits and relative links preserved. */
+export declare function writePortableArchive(directory: string, destination: string, options?: {
+    exclusive?: boolean;
+    preserveExecutableBits?: boolean;
+}): Promise<void>;
+/** pnpm resolves workspace ranges before packing. Canonicalize only unordered
+ * dependency maps; export conditions and all executable bytes keep their order. */
+export declare function normalizePackedWorkspace(archive: string): Promise<void>;
+//# sourceMappingURL=portable-archive.d.ts.map

package/dist/release/portable-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portable-archive.d.ts","sourceRoot":"","sources":["../../src/release/portable-archive.ts"],"names":[],"mappings":"AAqBA,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI9D;AAED,kGAAkG;AAClG,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAO1F;AAED,6FAA6F;AAC7F,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BzK;AAED;mFACmF;AACnF,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe7E"}

package/dist/release/portable-archive.js

@@ -0,0 +1,96 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { create, extract } from 'tar';
+async function* archiveEntries(root, folder = '') {
+    for (const name of (await fs.readdir(path.join(root, folder))).sort()) {
+        const relative = path.join(folder, name);
+        const file = path.join(root, relative);
+        const stat = await fs.lstat(file);
+        if (stat.isSymbolicLink()) {
+            const target = await fs.realpath(file);
+            if (path.isAbsolute(await fs.readlink(file)) || (target !== root && !target.startsWith(root + path.sep)))
+                throw new Error(`Release archive contains a non-portable link: ${relative}`);
+        }
+        else if (!stat.isFile() && !stat.isDirectory())
+            throw new Error(`Unsupported release archive entry: ${relative}`);
+        yield { relative, file, directory: stat.isDirectory(), link: stat.isSymbolicLink() };
+        if (stat.isDirectory())
+            yield* archiveEntries(root, relative);
+    }
+}
+export async function sha256File(file) {
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(file))
+        hash.update(chunk);
+    return hash.digest('hex');
+}
+/** Deterministic per-file integrity manifest for releases that require a regular-file payload. */
+export async function releaseFileHashes(directory) {
+    const hashes = Object.create(null);
+    for await (const entry of archiveEntries(await fs.realpath(directory))) {
+        if (entry.link)
+            throw Error('Release file manifest cannot contain symbolic links: ' + entry.relative);
+        if (!entry.directory)
+            hashes[entry.relative.split(path.sep).join('/')] = await sha256File(entry.file);
+    }
+    return hashes;
+}
+/** Canonical archive of a staged tree, with executable bits and relative links preserved. */
+export async function writePortableArchive(directory, destination, options = {}) {
+    const cwd = await fs.realpath(directory);
+    const entries = [];
+    for await (const { relative } of archiveEntries(cwd)) {
+        if (entries.length >= 200_000)
+            throw new Error('Release archive exceeds file count limit');
+        entries.push(relative);
+    }
+    if (!entries.length)
+        throw new Error('Cannot pack an empty release');
+    const temporary = path.join(path.dirname(destination), '.archive-' + randomUUID());
+    try {
+        await create({ cwd, file: temporary, gzip: true, portable: true, noMtime: true, strict: true,
+            noDirRecurse: true, jobs: 1, filter: (_name, stat) => {
+                // Readonly vs writable owner is a property of the staging directory.
+                // Preserve executable semantics, never group/other write permission.
+                if ('isFile' in stat) {
+                    const executable = options.preserveExecutableBits ? stat.mode & 0o111 : (stat.mode & 0o111) ? 0o111 : 0;
+                    stat.mode = (stat.mode & ~0o7777) | (stat.isDirectory() ? 0o755 : 0o644 | executable);
+                    // Byte-identical files must not change representation because a package
+                    // store happened to hard-link them on one builder.
+                    stat.nlink = 1;
+                }
+                return true;
+            } }, entries);
+        if (options.exclusive)
+            await fs.link(temporary, destination);
+        else
+            await fs.rename(temporary, destination);
+    }
+    finally {
+        await fs.rm(temporary, { force: true });
+    }
+}
+/** pnpm resolves workspace ranges before packing. Canonicalize only unordered
+ * dependency maps; export conditions and all executable bytes keep their order. */
+export async function normalizePackedWorkspace(archive) {
+    const temp = await fs.mkdtemp(path.join(path.dirname(archive), '.pack-'));
+    try {
+        await extract({ cwd: temp, file: archive, strict: true });
+        const manifest = path.join(temp, 'package/package.json');
+        const meta = JSON.parse(await fs.readFile(manifest, 'utf8'));
+        for (const key of ['dependencies', 'optionalDependencies', 'peerDependencies', 'peerDependenciesMeta', 'devDependencies']) {
+            const map = meta[key];
+            if (map && typeof map === 'object' && !Array.isArray(map)) {
+                meta[key] = Object.fromEntries(Object.keys(map).sort().map(name => [name, map[name]]));
+            }
+        }
+        await fs.writeFile(manifest, JSON.stringify(meta, null, 2) + '\n');
+        await writePortableArchive(temp, archive);
+    }
+    finally {
+        await fs.rm(temp, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=portable-archive.js.map

package/dist/release/portable-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portable-archive.js","sourceRoot":"","sources":["../../src/release/portable-archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEtC,KAAK,SAAS,CAAC,CAAC,cAAc,CAAC,IAAY,EAAE,MAAM,GAAG,EAAE;IACtD,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtG,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,EAAE,CAAC,CAAC;QACjF,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;QACpH,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACrF,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,IAAI;YAAE,MAAM,KAAK,CAAC,uDAAuD,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtG,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,WAAmB,EAAE,OAAO,GAA8D,EAAE;IACxJ,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;YAC5F,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnD,qEAAqE;gBACrE,qEAAqE;gBACrE,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrB,MAAM,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC;oBACtF,wEAAwE;oBACxE,mDAAmD;oBACnD,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;gBACjB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACd,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;;YACxD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACxD,CAAC;AAED;mFACmF;AACnF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAe;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA4B,CAAC;QACxF,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC1H,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAG,GAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACnE,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC"}

package/dist/release/registry-download.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=registry-download.d.ts.map

package/dist/release/registry-download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-download.d.ts","sourceRoot":"","sources":["../../src/release/registry-download.ts"],"names":[],"mappings":""}

package/dist/release/registry-download.js

@@ -0,0 +1,157 @@
+/** Private subprocess: stdout is exclusively the original compressed archive.
+ * Config/auth are read by pnpm itself with this process's cwd and environment. */
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { getConfig } from '@pnpm/config.reader';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
+import { createFetchFromRegistry } from '@pnpm/network.fetch';
+class DownloadFailure extends Error {
+    category;
+    status;
+    constructor(category, status) {
+        super(category);
+        this.category = category;
+        this.status = status;
+    }
+}
+function httpAddress(value) {
+    if (typeof value !== 'string' || value.length > 8192)
+        throw new DownloadFailure('metadata');
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new DownloadFailure('metadata');
+    }
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash)
+        throw new DownloadFailure('metadata');
+    return url.href;
+}
+async function boundedJson(stream, maximum) {
+    const reader = stream.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > maximum)
+                throw new DownloadFailure('metadata');
+            chunks.push(next.value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch (error) {
+        await reader.cancel().catch(() => undefined);
+        if (error instanceof DownloadFailure)
+            throw error;
+        throw new DownloadFailure('metadata');
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+async function download() {
+    // This is a private parent-generated request, but bound it before parsing.
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of process.stdin) {
+        size += chunk.length;
+        if (size > 16384)
+            throw new DownloadFailure('configuration');
+        chunks.push(chunk);
+    }
+    const pkg = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    if (typeof pkg.name !== 'string' || !/^@omnitron-dev\/[a-z0-9][a-z0-9._-]*$/.test(pkg.name) ||
+        typeof pkg.version !== 'string' || pkg.version.length > 128)
+        throw new DownloadFailure('configuration');
+    let config;
+    try {
+        ({ config } = await getConfig({
+            cliOptions: { dir: process.cwd(), 'ignore-pnpmfile': true }, workspaceDir: process.cwd(),
+            packageManager: { name: 'omnitron', version: 'registry-inspection' }, env: process.env,
+        }));
+    }
+    catch {
+        throw new DownloadFailure('configuration');
+    }
+    let getAuth;
+    try {
+        getAuth = createGetAuthHeaderByURI(config.configByUri);
+    }
+    catch {
+        throw new DownloadFailure('authentication');
+    }
+    const timeout = Math.min(config.fetchTimeout && config.fetchTimeout > 0 ? config.fetchTimeout : 60_000, 60_000);
+    const fetchArchive = createFetchFromRegistry({
+        configByUri: config.configByUri, maxSockets: 2, timeout,
+        ...(config.ca === undefined ? {} : { ca: config.ca }),
+        ...(config.cert === undefined ? {} : { cert: config.cert }),
+        ...(config.key === undefined ? {} : { key: config.key }),
+        ...(config.httpProxy === undefined ? {} : { httpProxy: config.httpProxy }),
+        ...(config.httpsProxy === undefined ? {} : { httpsProxy: config.httpsProxy }),
+        ...(config.noProxy === undefined ? {} : { noProxy: config.noProxy }),
+        ...(config.localAddress === undefined ? {} : { localAddress: config.localAddress }),
+        ...(config.strictSsl === undefined ? {} : { strictSsl: config.strictSsl }),
+        ...(config.userAgent === undefined ? {} : { userAgent: config.userAgent }),
+    });
+    const read = async (address) => {
+        let authHeaderValue;
+        try {
+            authHeaderValue = getAuth(address, { pkgName: pkg.name });
+        }
+        catch {
+            throw new DownloadFailure('authentication');
+        }
+        let response;
+        try {
+            response = await fetchArchive(address, {
+                ...(authHeaderValue === undefined ? {} : { authHeaderValue }), retry: { retries: 0 }, timeout,
+                headers: { 'accept-encoding': 'identity' },
+            });
+        }
+        catch (error) {
+            const failure = error;
+            const timeoutCodes = ['ETIMEDOUT', 'UND_ERR_HEADERS_TIMEOUT', 'UND_ERR_BODY_TIMEOUT', 'UND_ERR_CONNECT_TIMEOUT'];
+            throw new DownloadFailure(timeoutCodes.includes(String(failure?.code)) || timeoutCodes.includes(String(failure?.cause?.code))
+                ? 'timeout' : 'network');
+        }
+        if (!response.ok || !response.body) {
+            await response.body?.cancel();
+            throw new DownloadFailure(response.status === 401 || response.status === 403 ? 'authentication' : 'http', response.status);
+        }
+        return response;
+    };
+    let tarball;
+    if (pkg.tarball !== undefined)
+        tarball = httpAddress(pkg.tarball);
+    else {
+        const registry = httpAddress(pickRegistryForPackage(config.registriesByScope, pkg.name));
+        const address = new URL(pkg.name.replace('/', '%2f'), registry.endsWith('/') ? registry : registry + '/').href;
+        const response = await read(address);
+        const metadata = await boundedJson(response.body, 16 * 1024 * 1024);
+        const exact = metadata?.versions?.[pkg.version];
+        if (exact?.name !== pkg.name || exact.version !== pkg.version)
+            throw new DownloadFailure('metadata');
+        tarball = httpAddress(exact.dist?.tarball);
+    }
+    const response = await read(tarball);
+    let received = 0;
+    await pipeline(Readable.fromWeb(response.body), new Transform({ transform(chunk, _encoding, next) {
+            received += chunk.length;
+            next(received > 64 * 1024 * 1024 ? new DownloadFailure('metadata') : null, chunk);
+        } }), process.stdout);
+}
+try {
+    await download();
+}
+catch (error) {
+    const known = error instanceof DownloadFailure ? error : new DownloadFailure('network');
+    process.stderr.write(JSON.stringify({ category: known.category, ...(known.status === undefined ? {} : { status: known.status }) }));
+    process.exitCode = 1;
+}
+//# sourceMappingURL=registry-download.js.map

package/dist/release/registry-download.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-download.js","sourceRoot":"","sources":["../../src/release/registry-download.ts"],"names":[],"mappings":"AAAA;kFACkF;AAClF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAI9D,MAAM,eAAgB,SAAQ,KAAK;IACZ,QAAQ;IAA4B,MAAM;IAA/D,YAAqB,QAAyB,EAAW,MAAe;QAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAAvE,QAAQ;sBAA4B,MAAM;IAA8B,CAAC;CAC/F;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QACzF,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAkC,EAAE,OAAe;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9B,IAAI,IAAI,GAAG,OAAO;gBAAE,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,2EAA2E;IAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAoB,CAAC;IAClF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QACvF,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC5G,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC;YAC5B,UAAU,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE;YACxF,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;SACvF,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IACvD,IAAI,OAAoD,CAAC;IACzD,IAAI,CAAC;QAAC,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChH,MAAM,YAAY,GAAG,uBAAuB,CAAC;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO;QACvD,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAC3E,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAqB,EAAE;QACxD,IAAI,eAAmC,CAAC;QACxC,IAAI,CAAC;YAAC,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAClE,MAAM,CAAC;YAAC,MAAM,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAAC,CAAC;QACtD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE;gBACrC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,OAAO;gBAC7F,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAA8D,CAAC;YAC/E,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,yBAAyB,CAAC,CAAC;YACjH,MAAM,IAAI,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC3H,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,IAAI,OAAe,CAAC;IACpB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SAC7D,CAAC;QACJ,MAAM,QAAQ,GAAG,WAAW,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC;QAC/G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAK,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAE3D,CAAC;QACT,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,KAAK,EAAE,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;QACrG,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAA6D,CAAC,EACrG,IAAI,SAAS,CAAC,EAAE,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,IAAI;YACtD,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpF,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,IAAI,CAAC;IAAC,MAAM,QAAQ,EAAE,CAAC;AAAC,CAAC;AACzB,OAAO,KAAK,EAAE,CAAC;IACb,MAAM,KAAK,GAAG,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC;IACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpI,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/release/registry-framework.d.ts

@@ -0,0 +1,39 @@
+import { Readable } from 'node:stream';
+import type { RegistryPackage } from './layout.js';
+import type { ReleaseSource } from './manifest.js';
+import { type FrameworkSource } from '../shared/framework-source.js';
+import { type FrameworkStep } from './framework-source.js';
+import { type RegistryTransportOptions } from './registry-transport.js';
+type FileEvidence = {
+    digest: string;
+    size: number;
+    executable: boolean;
+};
+type ArchiveNode = {
+    files: Map<string, FileEvidence>;
+    dependencies: Map<string, string>;
+};
+type PackageEvidence = {
+    commit: string;
+    files: Map<string, FileEvidence>;
+    nodes: Map<string, ArchiveNode>;
+    repository?: unknown;
+};
+export interface RegistryFramework {
+    source: ReleaseSource;
+    verifyPackage(name: string, directory: string): Promise<void>;
+}
+/** Compare the exact compressed bytes and record the installed file tree. A
+ * reproduced commit is supplied only after building a clean upstream checkout. */
+export declare function inspectFrameworkArchive(pkg: RegistryPackage, input: Readable, signal?: AbortSignal, reproducedCommit?: string): Promise<PackageEvidence>;
+export interface RegistryFrameworkOptions extends RegistryTransportOptions {
+    readonly requestedCommit?: string;
+    readonly frameworkSource?: FrameworkSource;
+    readonly sourceBase: string;
+    readonly run: FrameworkStep;
+    readonly sourcePhase?: (source: FrameworkSource, commit: string) => void;
+}
+export declare function resolveRegistryFramework(packages: RegistryPackage[], options: RegistryFrameworkOptions): Promise<RegistryFramework>;
+export declare function verifiedFramework(source: ReleaseSource, verified: ReadonlyMap<string, PackageEvidence>): RegistryFramework;
+export {};
+//# sourceMappingURL=registry-framework.d.ts.map

package/dist/release/registry-framework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-framework.d.ts","sourceRoot":"","sources":["../../src/release/registry-framework.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAa,MAAM,aAAa,CAAC;AAKlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAgF,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEzI,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAK7F,KAAK,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC;AAC1E,KAAK,WAAW,GAAG;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAC3F,KAAK,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAuGnI,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,aAAa,CAAC;IACtB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAiBD;kFACkF;AAClF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,MAAM,GACrF,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAwBD,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1E;AAED,wBAAsB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwBzI;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAsB1H"}