@omnitron-dev/omnitron 0.3.3 → 0.3.5

package/dist/project/stack-diagnosis.js.map

@@ -1 +1 @@
-{"version":3,"file":"stack-diagnosis.js","sourceRoot":"","sources":["../../src/project/stack-diagnosis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAwB,MAAM,wCAAwC,CAAC;AAGvI,sGAAsG;AACtG,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACrD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACpD,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,SAAS,EAAE,mBAAmB;IAC9B,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,KAAK,EAAE,IAAY,EAA8C,EAAE;QACxE,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC;YAAC,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAAC,CAAC;IACtG,CAAC;CACF,CAAC;AAEF,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAwC,EACxC,MAAM,GAAG,oBAAoB;IAE7B,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACjJ,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IAAC,CAAC;IAC7C,MAAM,CAAC;QACL,OAAO,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,+EAA+E,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC,CAAC;IACnQ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;IAClJ,MAAM,QAAQ,GAA6D,EAAE,CAAC;IAC9E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAmC,EAAE,OAAe,EAAE,MAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChL,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;aACpG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9G,IAAI,OAAO,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,mBAAmB,EAAE,SAAS,EAAE,kEAAkE,EAAE,qEAAqE,CAAC,CAAC;aACjM,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,kBAAkB,EAAE,QAAQ,EAAE,8CAA8C,CAAC,CAAC;aAChG,IAAI,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,iBAAiB,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,oBAAoB,EAAE,QAAQ,EAAE,wEAAwE,EAAE,iDAAiD,CAAC,CAAC;aACvO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,wDAAwD,CAAC,CAAC;aACjH,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,GAAG,CAAC,qBAAqB,EAAE,SAAS,EAAE,uCAAuC,EAAE,iFAAiF,CAAC,CAAC;aACtM,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAAE,GAAG,CAAC,oBAAoB,EAAE,SAAS,EAAE,6CAA6C,EAAE,wCAAwC,CAAC,CAAC;;YACjK,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;QAChK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,oEAAoE,EAAE,8EAA8E,CAAC,CAAC;QACnO,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC/C,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,mBAAmB,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,KAAK,CAAC,MAAM,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,EAAE,oFAAoF,CAAC,CAAC;YAC3Q,CAAC;iBAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,gBAAgB,KAAK,CAAC,MAAM,yBAAyB,EAAE,2EAA2E,CAAC,CAAC;QAC3N,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,OAA4C,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAC3F,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3K,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7H,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC3C,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,GAAG,CAAC,eAAe,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC,IAAI,mBAAmB,SAAS,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,GAAG,EAAE,gDAAgD,CAAC,CAAC;YAClK,CAAC;iBAAM,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;gBAC3E,IAAI,SAAS,KAAK,IAAI;oBAAE,GAAG,CAAC,kBAAkB,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,IAAI,CAAC,IAAI,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,sBAAsB,GAAG,EAAE,mDAAmD,CAAC,CAAC;YAC7O,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"stack-diagnosis.js","sourceRoot":"","sources":["../../src/project/stack-diagnosis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAwB,MAAM,wCAAwC,CAAC;AAGzJ,sGAAsG;AACtG,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACrD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACpD,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,SAAS,EAAE,mBAAmB;IAC9B,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,KAAK,EAAE,IAAY,EAA8C,EAAE;QACxE,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC;YAAC,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAAC,CAAC;IACtG,CAAC;CACF,CAAC;AAEF,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAwC,EACxC,MAAM,GAAG,oBAAoB;IAE7B,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACjJ,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IAAC,CAAC;IAC7C,MAAM,CAAC;QACL,OAAO,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,+EAA+E,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC,CAAC;IACnQ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;IAClJ,MAAM,QAAQ,GAA6D,EAAE,CAAC;IAC9E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAmC,EAAE,OAAe,EAAE,MAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChL,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;aACpG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9G,IAAI,OAAO,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,mBAAmB,EAAE,SAAS,EAAE,kEAAkE,EAAE,qEAAqE,CAAC,CAAC;aACjM,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,kBAAkB,EAAE,QAAQ,EAAE,8CAA8C,CAAC,CAAC;aAChG,IAAI,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,iBAAiB,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,oBAAoB,EAAE,QAAQ,EAAE,wEAAwE,EAAE,iDAAiD,CAAC,CAAC;aACvO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,wDAAwD,CAAC,CAAC;aACjH,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,GAAG,CAAC,qBAAqB,EAAE,SAAS,EAAE,uCAAuC,EAAE,iFAAiF,CAAC,CAAC;aACtM,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAAE,GAAG,CAAC,oBAAoB,EAAE,SAAS,EAAE,6CAA6C,EAAE,wCAAwC,CAAC,CAAC;;YACjK,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;QAChK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,oEAAoE,EAAE,8EAA8E,CAAC,CAAC;QACnO,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC/C,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,mBAAmB,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,KAAK,CAAC,MAAM,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,EAAE,oFAAoF,CAAC,CAAC;YAC3Q,CAAC;iBAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,gBAAgB,KAAK,CAAC,MAAM,yBAAyB,EAAE,2EAA2E,CAAC,CAAC;QAC3N,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,OAA4C,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnG,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7H,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC3C,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,GAAG,CAAC,eAAe,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC,IAAI,mBAAmB,SAAS,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,GAAG,EAAE,gDAAgD,CAAC,CAAC;YAClK,CAAC;iBAAM,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;gBAC3E,IAAI,SAAS,KAAK,IAAI;oBAAE,GAAG,CAAC,kBAAkB,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,IAAI,CAAC,IAAI,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,sBAAsB,GAAG,EAAE,mDAAmD,CAAC,CAAC;YAC7O,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/release/artifact-store.d.ts

@@ -99,6 +99,7 @@
  * today is 8.3 MB.
  */
 import type { SecretRef } from '../infrastructure/types.js';
+export { isReleaseId } from './load.js';
 /** `releaseStore` in `~/.omnitron/config.json`, as an operator writes it. */
 export interface ReleaseStoreConfig {
     /** `https://s3.<provider>` — or `http://127.0.0.1:9000`: plain http is taken on loopback only. */
@@ -114,9 +115,29 @@ export interface ReleaseStoreConfig {
     readonly forcePathStyle?: boolean;
     /** Where in the bucket releases live, for a bucket that holds other things too. */
     readonly prefix?: string;
+    readonly ssh?: StoreSshConfig;
     readonly accessKey: SecretRef;
     readonly secretKey: SecretRef;
 }
+export interface StoreSshConfig {
+    readonly host: string;
+    readonly port: number;
+    readonly username: string;
+    readonly hostFingerprint: string;
+    readonly privateKey: SecretRef;
+    readonly passphrase?: SecretRef;
+}
+export declare function releaseStoreLocation(config: {
+    endpoint: string | URL;
+    bucket: string;
+    prefix?: string;
+    ssh?: StoreSshConfig;
+}): string;
+export interface StoreConnection {
+    readonly port: number;
+    readonly closed: Promise<void>;
+    close(): Promise<void>;
+}
 export interface StoreCredentials {
     readonly accessKeyId: string;
     readonly secretAccessKey: string;
@@ -130,6 +151,7 @@ export interface ResolvedStore {
     /** Without leading or trailing slashes; empty for the bucket's root. */
     readonly prefix: string;
     readonly credentials: StoreCredentials;
+    readonly ssh?: StoreSshConfig;
     /** Which vault keys the pair came from — what a refusal names instead of the values. */
     readonly credentialKeys: {
         readonly accessKey: string;
@@ -203,7 +225,9 @@ export interface ObjectSum {
 export interface ObjectStore {
     readonly location: string;
     /** Write `source` — a file, or bytes — whose sum is already known. */
-    put(key: string, source: string | Buffer, sum: ObjectSum): Promise<void>;
+    put(key: string, source: string | Buffer, sum: ObjectSum, condition?: {
+        etag: string | null;
+    }): Promise<void>;
     /**
      * Stream an object into `into`, hashing it on the way; null when there is
      * no such object. Stops, and refuses, past `recordedBytes`: what the index
@@ -212,6 +236,10 @@ export interface ObjectStore {
     get(key: string, into: string, recordedBytes: number): Promise<ObjectSum | null>;
     /** A small object whole, or null when there is none. */
     read(key: string, limitBytes: number): Promise<Buffer | null>;
+    readVersion(key: string, limitBytes: number): Promise<{
+        body: Buffer;
+        etag: string;
+    } | null>;
 }
 /**
  * An S3-compatible bucket, reached with `node:http(s)` and SigV4.
@@ -226,12 +254,19 @@ export declare class S3ObjectStore implements ObjectStore {
     constructor(store: ResolvedStore, options?: {
         idleTimeoutMs?: number;
         sockets?: number;
+        route?: StoreConnection;
     });
-    /** Keep-alive sockets hold the process open; a command closes the store when it is done. */
-    close(): void;
-    put(key: string, source: string | Buffer, sum: ObjectSum): Promise<void>;
+    close(): Promise<void>;
+    put(key: string, source: string | Buffer, sum: ObjectSum, condition?: {
+        etag: string | null;
+    }): Promise<void>;
     get(key: string, into: string, recordedBytes: number): Promise<ObjectSum | null>;
     read(key: string, limitBytes: number): Promise<Buffer | null>;
+    readVersion(key: string, limitBytes: number): Promise<{
+        body: Buffer;
+        etag: string;
+    } | null>;
+    private readObject;
     /**
      * One signed request; resolves with the response once its headers arrive.
      *
@@ -240,6 +275,7 @@ export declare class S3ObjectStore implements ObjectStore {
      * reaches the response too, so a stream being read does not wait forever.
      */
     private send;
+    private request;
     /** A refusal in the store's own words, and what it usually means here. */
     private failure;
 }
@@ -256,13 +292,12 @@ export interface IndexEntry {
     readonly at?: string;
 }
 export interface StoreIndex {
-    readonly format: 1;
+    readonly format: 1 | 2;
     readonly release: string;
     readonly pushedAt: string;
     readonly pushedBy: string;
     readonly files: readonly IndexEntry[];
 }
-export declare function isReleaseId(id: string): boolean;
 /**
  * Why a path may not be a file of a release — or null.
  *
@@ -293,6 +328,7 @@ export interface KeptAttestation {
     readonly offered: string | null;
 }
 export interface TransferOptions {
+    readonly signal?: AbortSignal;
     /** Where releases live on this machine. Default `~/.omnitron/releases`. */
     readonly root?: string;
     /** Objects in flight at once. Default 8: 548 statics files one by one is a minute on a remote store. */
@@ -356,5 +392,4 @@ export declare function pushRelease(id: string, store: ObjectStore, options?: Tr
  * and only an attestation that measured later is taken.
  */
 export declare function pullRelease(id: string, store: ObjectStore, options?: TransferOptions): Promise<PullResult>;
-export {};
 //# sourceMappingURL=artifact-store.d.ts.map

package/dist/release/artifact-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-store.d.ts","sourceRoot":"","sources":["../../src/release/artifact-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAWH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAS5D,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,cAAc,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAID,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,QASrB,CAAC;AAOb;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAgGjF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC,aAAa,CAAC,CA8BxB;AAYD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA2C/F;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAC3B,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,QAAQ,GAAG,gBAAgB,GAAG,QAAQ,CAAC,EAC/E,GAAG,EAAE,MAAM,GACV;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAiB7H;AAMD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACjF,wDAAwD;IACxD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC/D;AAoCD;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,WAAW;;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,YAAY,KAAK,EAAE,aAAa,EAAE,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,EAQ3F;IAED,4FAA4F;IAC5F,KAAK,IAAI,IAAI,CAEZ;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7E;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA4BrF;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAI;IAoDZ,0EAA0E;IAC1E,OAAO,CAAC,OAAO;CAqBhB;AASD,QAAA,MAAM,eAAe,YAAI,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAU,CAAC;AAErF,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAKD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAc1D;AAkFD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CA2ClF;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAmGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAiFD,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,wGAAwG;IACxG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA+CxH;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgHpH"}
+{"version":3,"file":"artifact-store.d.ts","sourceRoot":"","sources":["../../src/release/artifact-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAaH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAOxC,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;CACjC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,cAAc,CAAA;CAAE,GAAG,MAAM,CAMtI;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,cAAc,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAID,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,QASrB,CAAC;AAOb;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAoHjF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC,aAAa,CAAC,CA+BxB;AAYD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA2C/F;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAC3B,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,QAAQ,GAAG,gBAAgB,GAAG,QAAQ,CAAC,EAC/E,GAAG,EAAE,MAAM,GACV;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAiB7H;AAMD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9G;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACjF,wDAAwD;IACxD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9D,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC9F;AAsCD;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,WAAW;;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAS1B,YAAY,KAAK,EAAE,aAAa,EAAE,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,eAAe,CAAA;KAAO,EAUpH;IAED,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAIrB;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlH;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA4BrF;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAElE;IAEK,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAKjG;YAEa,UAAU;IAoBxB;;;;;;OAMG;YACW,IAAI;IAalB,OAAO,CAAC,OAAO;IAsDf,0EAA0E;IAC1E,OAAO,CAAC,OAAO;CAqBhB;AASD,QAAA,MAAM,eAAe,YAAI,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAU,CAAC;AAErF,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAc1D;AAkFD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CA2ClF;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAmGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAqFD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,wGAAwG;IACxG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuFxH;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgHpH"}

package/dist/release/artifact-store.js

@@ -103,12 +103,22 @@ import fs from 'node:fs';
 import http from 'node:http';
 import https from 'node:https';
 import os from 'node:os';
+import { isIP } from 'node:net';
 import path from 'node:path';
 import { Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
+import { isSshHostFingerprint } from '../services/node-host-key.js';
 import { resolveSecretRefs } from '../project/config-resolver.js';
-import { loadRelease, releasesRoot } from './load.js';
-const CONFIG_FIELDS = new Set(['endpoint', 'bucket', 'region', 'forcePathStyle', 'prefix', 'accessKey', 'secretKey']);
+import { isReleaseId, loadRelease, releasesRoot } from './load.js';
+export { isReleaseId } from './load.js';
+export function releaseStoreLocation(config) {
+    const url = new URL(config.endpoint);
+    const prefix = (config.prefix ?? '').replace(/^\/+|\/+$/g, '');
+    const base = url.origin + url.pathname.replace(/\/+$/, '');
+    return 's3://' + config.bucket + (prefix ? '/' + prefix : '') + ' at ' + base +
+        (config.ssh ? ' via SSH ' + config.ssh.host + ':' + config.ssh.port : '');
+}
+const CONFIG_FIELDS = new Set(['endpoint', 'bucket', 'region', 'forcePathStyle', 'prefix', 'accessKey', 'secretKey', 'ssh']);
 /** What a store looks like in the config, for a refusal to show — references, never values. */
 export const STORE_CONFIG_EXAMPLE = [
     '"releaseStore": {',
@@ -144,8 +154,7 @@ export function parseStoreConfig(raw, source) {
     if (unknown.length > 0) {
         throw new Error(`'releaseStore' in ${source} has ${unknown.map((k) => `'${k}'`).join(', ')}, which it does not read — it reads ${[...CONFIG_FIELDS].join(', ')}`);
     }
-    const reference = (field) => {
-        const value = o[field];
+    const reference = (field, value = o[field]) => {
         if (typeof value === 'string') {
             throw new Error(`'releaseStore.${field}' in ${source} is a literal credential. The key lives in the daemon's vault and the config names it: ` +
                 `"${field}": { "secret": "<vault key>" }`);
@@ -208,9 +217,31 @@ export function parseStoreConfig(raw, source) {
             throw new Error(`'releaseStore.prefix' in ${source} must be a path inside the bucket, of A-Z, a-z, 0-9, '.', '_' and '-'`);
         }
     }
+    let ssh;
+    if (o['ssh'] !== undefined) {
+        const route = o['ssh'];
+        if (!route || typeof route !== 'object' || Array.isArray(route) ||
+            Object.keys(route).some(key => !['host', 'port', 'username', 'hostFingerprint', 'privateKey', 'passphrase'].includes(key)))
+            throw new Error('Invalid releaseStore.ssh configuration in ' + source);
+        if (url.protocol !== 'http:' || !['127.0.0.1', '[::1]'].includes(url.hostname) || forcePathStyle === false)
+            throw new Error('releaseStore.ssh requires an HTTP endpoint on numeric loopback and path-style addressing');
+        const { host, username, hostFingerprint } = route;
+        const port = route['port'] ?? 22;
+        if (typeof host !== 'string' || (!isIP(host) && !(host.length <= 253 && host.split('.').every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label)))))
+            throw new Error('Invalid releaseStore.ssh.host in ' + source);
+        if (typeof port !== 'number' || !Number.isInteger(port) || port < 1 || port > 65535)
+            throw new Error('Invalid releaseStore.ssh.port in ' + source);
+        if (typeof username !== 'string' || !/^[a-z_][a-z0-9_.-]{0,63}$/i.test(username))
+            throw new Error('Invalid releaseStore.ssh.username in ' + source);
+        if (!isSshHostFingerprint(hostFingerprint))
+            throw new Error('releaseStore.ssh requires an independently verified SHA256 host fingerprint');
+        ssh = { host, port, username, hostFingerprint, privateKey: reference('ssh.privateKey', route['privateKey']),
+            ...(route['passphrase'] !== undefined && { passphrase: reference('ssh.passphrase', route['passphrase']) }) };
+    }
     return {
         endpoint,
         bucket,
+        ...(ssh && { ssh }),
         ...(typeof region === 'string' ? { region } : {}),
         ...(typeof forcePathStyle === 'boolean' ? { forcePathStyle } : {}),
         ...(typeof prefix === 'string' ? { prefix } : {}),
@@ -246,6 +277,7 @@ export async function resolveStore(config, getSecret) {
     }
     return {
         endpoint: new URL(config.endpoint),
+        ...(config.ssh && { ssh: config.ssh }),
         bucket: config.bucket,
         region: config.region ?? 'us-east-1',
         forcePathStyle: config.forcePathStyle ?? true,
@@ -336,6 +368,8 @@ export function objectAddress(store, key) {
         path: `${basePath}/${encoded}`,
     };
 }
+class StoreConflict extends Error {
+}
 /** S3 refuses a single PUT above this; a multipart upload is the way past it. */
 const SINGLE_PUT_LIMIT = 5 * 1024 ** 3;
 /** An S3 error document is a few hundred bytes; this is how much of one is read. */
@@ -383,25 +417,35 @@ export class S3ObjectStore {
     #store;
     #agent;
     #idleMs;
+    #closed = false;
+    #closing;
+    #route;
     constructor(store, options = {}) {
+        if (Boolean(store.ssh) !== Boolean(options.route))
+            throw new Error('The configured S3 transport is unavailable');
+        this.#route = options.route;
         this.#store = store;
         this.#credentials = store.credentials;
         this.#idleMs = options.idleTimeoutMs ?? 60_000;
         const agentOptions = { keepAlive: true, maxSockets: options.sockets ?? 8 };
         this.#agent = store.endpoint.protocol === 'https:' ? new https.Agent(agentOptions) : new http.Agent(agentOptions);
-        const base = `${store.endpoint.origin}${store.endpoint.pathname.replace(/\/+$/, '')}`;
-        this.location = `s3://${store.bucket}${store.prefix ? `/${store.prefix}` : ''} at ${base}`;
+        this.location = releaseStoreLocation(store);
+        void this.#route?.closed.then(() => { this.#closed = true; this.#agent.destroy(); });
     }
-    /** Keep-alive sockets hold the process open; a command closes the store when it is done. */
     close() {
+        this.#closed = true;
         this.#agent.destroy();
+        return this.#closing ??= this.#route?.close() ?? Promise.resolve();
     }
-    async put(key, source, sum) {
+    async put(key, source, sum, condition) {
         if (sum.bytes > SINGLE_PUT_LIMIT) {
             throw new Error(`${key} is ${sum.bytes} bytes; one PUT carries at most ${SINGLE_PUT_LIMIT}, and this store does not split uploads`);
         }
-        const res = await this.send('PUT', key, { source, sum });
+        const precondition = condition ? condition.etag === null ? { 'if-none-match': '*' } : { 'if-match': condition.etag } : undefined;
+        const res = await this.send('PUT', key, { source, sum }, precondition);
         const body = await readCapped(res, ERROR_BODY_LIMIT);
+        if (condition && (res.statusCode === 412 || (res.statusCode === 409 && xmlField(body.toString('utf8'), 'Code') === 'ConditionalRequestConflict')))
+            throw new StoreConflict('A concurrent publisher changed the store index for ' + key);
         if (res.statusCode !== 200)
             throw this.failure('PUT', key, res.statusCode ?? 0, body.toString('utf8'));
     }
@@ -436,6 +480,17 @@ export class S3ObjectStore {
         return { sha256: hash.digest('hex'), bytes };
     }
     async read(key, limitBytes) {
+        return (await this.readObject(key, limitBytes))?.body ?? null;
+    }
+    async readVersion(key, limitBytes) {
+        const object = await this.readObject(key, limitBytes);
+        if (!object)
+            return null;
+        if (!object.etag || !/^"[^"\r\n]+"$/.test(object.etag))
+            throw new Error('The release store did not supply a strong ETag for ' + key);
+        return { body: object.body, etag: object.etag };
+    }
+    async readObject(key, limitBytes) {
         const res = await this.send('GET', key, null);
         if (res.statusCode !== 200) {
             const body = (await readCapped(res, ERROR_BODY_LIMIT)).toString('utf8');
@@ -453,7 +508,7 @@ export class S3ObjectStore {
             }
             chunks.push(chunk);
         }
-        return Buffer.concat(chunks);
+        return { body: Buffer.concat(chunks), etag: res.headers.etag };
     }
     /**
      * One signed request; resolves with the response once its headers arrive.
@@ -462,25 +517,39 @@ export class S3ObjectStore {
      * is never cut, one that has said nothing for a minute is — and the error
      * reaches the response too, so a stream being read does not wait forever.
      */
-    send(method, key, body) {
+    async send(method, key, body, precondition) {
+        const request = () => this.request(method, key, body, precondition);
+        try {
+            return await request();
+        }
+        catch (error) {
+            // Reopen the upload stream and keep the original index precondition if the reply was lost.
+            if (this.#closed || !['ECONNRESET', 'EPIPE'].includes(error.code ?? ''))
+                throw error;
+            return request();
+        }
+    }
+    request(method, key, body, precondition) {
+        if (this.#closed)
+            throw new Error('The release store connection was closed');
         const address = objectAddress(this.#store, key);
         const signed = signV4({
             method,
             canonicalUri: address.path,
-            headers: { host: address.host },
+            headers: { host: address.host, ...precondition },
             payloadSha256: body ? body.sum.sha256 : EMPTY_SHA256,
             region: this.#store.region,
             credentials: this.#credentials,
             now: new Date(),
         });
-        const headers = { host: address.host, ...signed.headers };
+        const headers = { host: address.host, ...precondition, ...signed.headers };
         if (body)
             headers['content-length'] = String(body.sum.bytes);
         return new Promise((resolve, reject) => {
             let response = null;
             const req = (address.https ? https : http).request({
-                hostname: address.hostname,
-                ...(address.port ? { port: Number(address.port) } : {}),
+                hostname: this.#route ? '127.0.0.1' : address.hostname,
+                port: this.#route?.port ?? (address.port ? Number(address.port) : undefined),
                 path: address.path,
                 method,
                 headers,
@@ -535,11 +604,6 @@ const INDEX_NAME = 'index.json';
 /** The 555 objects of sample-202609221654-8d2f51e0-225cde48 make a 95 536-byte index; this is a bound, not an estimate. */
 const INDEX_LIMIT = 16 * 1024 * 1024;
 const DIRECTORY_PARTS = ['artifacts', 'statics', 'scripts', 'attestations'];
-/** The same rule `loadRelease` applies — the court holds the two to one answer. */
-const RELEASE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-export function isReleaseId(id) {
-    return RELEASE_ID.test(id) && !id.includes('..');
-}
 /**
  * Why a path may not be a file of a release — or null.
  *
@@ -671,8 +735,8 @@ export function parseIndex(bytes, id, location) {
     const o = raw;
     if (!o || typeof o !== 'object')
         throw new Error(`${where} is not an object`);
-    if (o.format !== 1)
-        throw new Error(`${where} is format ${String(o.format)}; this omnitron reads format 1`);
+    if (o.format !== 1 && o.format !== 2)
+        throw new Error(`${where} uses unsupported release index format ${String(o.format)}`);
     if (o.release !== id)
         throw new Error(`${where} describes release '${String(o.release)}', not '${id}'`);
     if (!Array.isArray(o.files))
@@ -703,7 +767,7 @@ export function parseIndex(bytes, id, location) {
     if (!seen.has('manifest.json'))
         throw new Error(`${where} has no manifest.json`);
     return {
-        format: 1,
+        format: o.format,
         release: id,
         pushedAt: typeof o.pushedAt === 'string' ? o.pushedAt : '',
         pushedBy: typeof o.pushedBy === 'string' ? o.pushedBy : '',
@@ -842,10 +906,13 @@ function placeOf(dir, rel) {
  * as against «a different file», and a twelve-character prefix is not what
  * an operator can paste into `grep`.
  */
-async function fetchVerified(store, id, entry, file, consequence) {
+function payloadKey(id, entry, format) {
+    return format === 1 ? `${id}/${entry.path}` : `${id}/objects/${entry.sha256}`;
+}
+async function fetchVerified(store, id, entry, file, consequence, format) {
     let got;
     try {
-        got = await store.get(`${id}/${entry.path}`, file, entry.bytes);
+        got = await store.get(payloadKey(id, entry, format), file, entry.bytes);
     }
     catch (err) {
         throw new Error(`Release ${id}: ${err.message}. ${consequence}`, { cause: err });
@@ -879,43 +946,90 @@ export async function pushRelease(id, store, options = {}) {
     const local = await walkRelease(loaded.root);
     checkAgainstManifest(id, loaded.manifest, local, 'on this disk');
     const indexKey = `${id}/${INDEX_NAME}`;
-    const existing = await store.read(indexKey, INDEX_LIMIT);
-    const remote = existing ? parseIndex(existing, id, store.location) : null;
-    let send = local;
-    let files = local;
-    let keptNewer = [];
-    if (remote) {
-        const differences = compareBuilds(local, remote.files);
-        if (differences.length > 0)
-            throw new Error(differentBuild(id, differences, 'this machine', store.location));
-        const plan = planAttestations(local.filter(isAttestation), remote.files.filter(isAttestation));
-        const kept = new Set(plan.kept.map((k) => k.path));
-        send = options.repair ? local.filter((e) => !kept.has(e.path)) : plan.copy;
-        keptNewer = plan.kept;
-        files = [...remote.files.filter((e) => !isAttestation(e)), ...plan.merged].sort(byPath);
-        if (send.length === 0) {
-            return { id, location: store.location, parts: tallyParts(remote.files), moved: tally([]), indexSha256: sha256Hex(existing), keptNewer };
+    const uploaded = new Set();
+    let moved = { files: 0, bytes: 0 };
+    return publishIndex(0);
+    async function publishIndex(attempt) {
+        options.signal?.throwIfAborted();
+        const version = await store.readVersion(indexKey, INDEX_LIMIT);
+        const existing = version?.body;
+        const remote = existing ? parseIndex(existing, id, store.location) : null;
+        let send = local;
+        let files = local;
+        let keptNewer = [];
+        if (remote) {
+            const differences = compareBuilds(local, remote.files);
+            if (differences.length > 0)
+                throw new Error(differentBuild(id, differences, 'this machine', store.location));
+            const plan = planAttestations(local.filter(isAttestation), remote.files.filter(isAttestation));
+            const kept = new Set(plan.kept.map((k) => k.path));
+            send = options.repair ? local.filter((e) => !kept.has(e.path)) : plan.copy;
+            keptNewer = plan.kept;
+            files = [...remote.files.filter((e) => !isAttestation(e)), ...plan.merged].sort(byPath);
+            if (send.length === 0) {
+                return { id, location: store.location, parts: tallyParts(remote.files), moved, indexSha256: sha256Hex(existing), keptNewer };
+            }
         }
+        // When extending a legacy index, copy its complete verified snapshot before switching the pointer.
+        // Immutable objects keep both competing publishers' snapshots readable until the index chooses one.
+        if (remote?.format === 1)
+            send = files;
+        const localByPath = new Map(local.map(entry => [entry.path, entry]));
+        const total = tally(send);
+        let done = { files: 0, bytes: 0 };
+        await eachLimited(send, options.concurrency ?? 8, async (entry) => {
+            options.signal?.throwIfAborted();
+            let source = placeOf(loaded.root, entry.path);
+            if (localByPath.get(entry.path)?.sha256 !== entry.sha256) {
+                if (remote?.format !== 1 || !isAttestation(entry) || entry.bytes > INDEX_LIMIT)
+                    throw Error('Cannot migrate release object ' + entry.path);
+                const data = await store.read(payloadKey(id, entry, 1), entry.bytes);
+                if (!data || data.length !== entry.bytes || sha256Hex(data) !== entry.sha256)
+                    throw Error('Legacy attestation failed verification: ' + entry.path);
+                source = data;
+            }
+            if (!uploaded.has(entry.sha256)) {
+                await store.put(payloadKey(id, entry, 2), source, entry);
+                uploaded.add(entry.sha256);
+                moved = { bytes: moved.bytes + entry.bytes, files: moved.files + 1 };
+            }
+            done = { files: done.files + 1, bytes: done.bytes + entry.bytes };
+            options.onProgress?.(done, total);
+        });
+        // Last, and only now: the index is what makes the release exist in the store.
+        const index = {
+            format: 2,
+            release: id,
+            pushedAt: new Date().toISOString(),
+            pushedBy: `${os.userInfo().username}@${os.hostname()}`,
+            files,
+        };
+        const body = Buffer.from(`${JSON.stringify(index, null, 2)}\n`);
+        const indexSha256 = sha256Hex(body);
+        options.signal?.throwIfAborted();
+        try {
+            await store.put(indexKey, body, { sha256: indexSha256, bytes: body.length }, { etag: version?.etag ?? null });
+        }
+        catch (error) {
+            if (!(error instanceof StoreConflict))
+                throw error;
+            const winner = await store.read(indexKey, INDEX_LIMIT);
+            if (!winner)
+                throw error;
+            const committed = parseIndex(winner, id, store.location);
+            const differences = compareBuilds(local, committed.files);
+            if (differences.length)
+                throw new Error(differentBuild(id, differences, 'this machine', store.location), { cause: error });
+            const plan = planAttestations(local.filter(isAttestation), committed.files.filter(isAttestation));
+            if (plan.copy.length) {
+                if (attempt >= 4)
+                    throw new Error(`Release ${id} changed during five publication attempts. Repeat release push to merge the outstanding measurements.`, { cause: error });
+                return publishIndex(attempt + 1);
+            }
+            return { id, location: store.location, parts: tallyParts(committed.files), moved, indexSha256: sha256Hex(winner), keptNewer: plan.kept };
+        }
+        return { id, location: store.location, parts: tallyParts(files), moved, indexSha256, keptNewer };
     }
-    const total = tally(send);
-    let done = { files: 0, bytes: 0 };
-    await eachLimited(send, options.concurrency ?? 8, async (entry) => {
-        await store.put(`${id}/${entry.path}`, placeOf(loaded.root, entry.path), entry);
-        done = { files: done.files + 1, bytes: done.bytes + entry.bytes };
-        options.onProgress?.(done, total);
-    });
-    // Last, and only now: the index is what makes the release exist in the store.
-    const index = {
-        format: 1,
-        release: id,
-        pushedAt: new Date().toISOString(),
-        pushedBy: `${os.userInfo().username}@${os.hostname()}`,
-        files,
-    };
-    const body = Buffer.from(`${JSON.stringify(index, null, 2)}\n`);
-    const indexSha256 = sha256Hex(body);
-    await store.put(indexKey, body, { sha256: indexSha256, bytes: body.length });
-    return { id, location: store.location, parts: tallyParts(files), moved: total, indexSha256, keptNewer };
 }
 /**
  * Take a release out of the store onto this machine.
@@ -954,7 +1068,7 @@ export async function pullRelease(id, store, options = {}) {
             // `*.json`, so a half-written one is never read as evidence.
             const partial = `${file}.pull-${process.pid}`;
             try {
-                await fetchVerified(store, id, entry, partial, `${file} was left as it was.`);
+                await fetchVerified(store, id, entry, partial, `${file} was left as it was.`, index.format);
                 fs.renameSync(partial, file);
             }
             finally {
@@ -985,7 +1099,7 @@ export async function pullRelease(id, store, options = {}) {
         await eachLimited(index.files, options.concurrency ?? 8, async (entry) => {
             const file = placeOf(staged, entry.path);
             fs.mkdirSync(path.dirname(file), { recursive: true });
-            await fetchVerified(store, id, entry, file, consequence);
+            await fetchVerified(store, id, entry, file, consequence, index.format);
             done = { files: done.files + 1, bytes: done.bytes + entry.bytes };
             options.onProgress?.(done, total);
         });