@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/publish/publish-package.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Publishing one package: seal it (stage at its assigned version, pack,
+ * verify), prove the Registry does not already hold different bytes at that
+ * version, then publish it directly or through a managed lease.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { UIContext } from "@vibesdotdev/cli/providers";
+import { CapabilityError, type CaughtFailure } from "@vibesdotdev/kernel";
+import type { JobExecutionContext } from "@vibesdotdev/kernel/kinds";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import type { PlatformRegistryClient } from "./platform-registry.ts";
+import type { ReleaseConsumerSourceRegistry } from "./proof-registry.ts";
+import type { ReleasePublishRetryState } from "../../../schemas/release-jobs.ts";
+import type { ManagedRegistryReleaseWorkspaceWire } from "./release-workspace.ts";
+import type { PublishResult, RegistryReleasePublishTarget, RegistryWorkspaceProvenance } from "./types.ts";
+export declare class ReleasePublishRetryRequested extends CapabilityError {
+    readonly reason: "transient" | "rate-limit";
+    readonly failure: CaughtFailure;
+    constructor(reason: "transient" | "rate-limit", failure: CaughtFailure);
+}
+/**
+ * Seal and publish one package at `version` (its assigned release version;
+ * defaults to the source manifest's). With `sealedArtifact`, publishes those
+ * exact sealed bytes instead of re-packing. A version the Registry already
+ * holds is reused only when its bytes and provenance match; otherwise refused.
+ */
+export declare function publishPackage(options: {
+    /** The release run's Platform Registry client, bound to the command's runtime. */
+    platformRegistry: PlatformRegistryClient;
+    /** Absolute package directory. */
+    packageDir: string;
+    /** The publish workspace root; release temporary roots live under it. */
+    workspaceRoot: string;
+    registry?: string;
+    scope?: string;
+    tag?: string;
+    otp?: string;
+    provenance: boolean;
+    dryRun: boolean;
+    token?: string;
+    resolveToken?: () => Promise<string | undefined>;
+    rateLimitRetries: number;
+    rateLimitDelayMs: number;
+    retry?: ReleasePublishRetryState;
+    signal?: AbortSignal;
+    park?: JobExecutionContext<unknown>["park"];
+    ui: Pick<UIContext, "info" | "warn" | "log">;
+    versions: Map<string, string>;
+    sourceRegistry?: ReleaseConsumerSourceRegistry;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    quiet: boolean;
+    build?: boolean;
+    managedLease: boolean;
+    authorityVerify: boolean;
+    artifactDir?: string;
+    workspaceProvenance: RegistryWorkspaceProvenance;
+    expectedGitHead: string;
+    releaseWorkspace?: ManagedRegistryReleaseWorkspaceWire;
+    publishTargets?: readonly RegistryReleasePublishTarget[];
+    sealedArtifact?: PublishResult;
+    /** Assigned release version; defaults to the source manifest version. */
+    version?: string;
+}): Promise<PublishResult>;
+//# sourceMappingURL=publish-package.d.ts.map

package/dist/cli/npm/publish/publish-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-package.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/publish-package.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAKzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAO5D,OAAO,EACL,eAAe,EAEf,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAStE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAarE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAKzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAOjF,OAAO,KAAK,EACV,mCAAmC,EACpC,MAAM,wBAAwB,CAAC;AAchC,OAAO,KAAK,EACV,aAAa,EACb,4BAA4B,EAC5B,2BAA2B,EAE5B,MAAM,YAAY,CAAC;AAKpB,qBAAa,4BAA6B,SAAQ,eAAe;IAE7D,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY;IAC3C,QAAQ,CAAC,OAAO,EAAE,aAAa;gBADtB,MAAM,EAAE,WAAW,GAAG,YAAY,EAClC,OAAO,EAAE,aAAa;CAUlC;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,kFAAkF;IAClF,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,IAAI,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;IAC7C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,2BAA2B,CAAC;IACjD,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,mCAAmC,CAAC;IACvD,cAAc,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACzD,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CA0jBzB"}

package/dist/cli/npm/publish/publish-package.js

@@ -0,0 +1,544 @@
+import { GIT_CHILD_ENV } from "@vibesdotdev/git-operations/core";
+import { hashBase64 } from "@vibesdotdev/crypto";
+import { resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { z } from "zod/v4";
+import { classifyRegistryReleaseAvailability, publishAccessForManifest, } from "@vibesdotdev/registry";
+import { CapabilityError, CaughtFailureSchema, } from "@vibesdotdev/kernel";
+import { infraDeployLogger } from "../../../logger.js";
+import { runRuntimeCommand } from "../../shared/runtime-execution.js";
+import { defaultDistTagForVersion, putAttestedPackument } from "../put-attested-packument.js";
+import { readPackageJson } from "./fs-paths.js";
+import { assertAuthorityLeaseRejected, mintManagedPublishLease, revokeManagedPublishLease, } from "./managed-lease.js";
+import { isNpmExistingVersionError, isNpmRateLimitError, isTransientPublishError, isolatedNpmPackEnv, NpmCommandError, publishArgs, runNpm, versionSpec, writeTempNpmrc, } from "./npm-exec.js";
+import { sealPackageArtifact, sealedPublishMetadata } from "./package-artifact.js";
+import { MANAGED_LEASE_POLL_DEADLINE_MS, } from "./platform-registry.js";
+import { npmPublishedArtifactIdentity } from "./registry-reads.js";
+import { normalizeRegistryUrl, resolvePublishRegistry, registryServiceOrigin, } from "./registry-credentials.js";
+import { cleanupSensitiveTempRoot, createReleaseTempRoot, SENSITIVE_TEMP_ROOT_PREFIXES, } from "./sensitive-temp.js";
+import { assertRegistryReleaseSourceCommit, assertManagedSourceClean, registryReleaseStatusBlocksSnapshot, REGISTRY_RELEASE_STATUS_ARGS, resolveSourceCommit, } from "./source-snapshot.js";
+/** Bound on the authority-lease expiry wait; the delay itself is 1.25s. */
+const AUTHORITY_LEASE_EXPIRY_WAIT_TIMEOUT_MS = 30_000;
+export class ReleasePublishRetryRequested extends CapabilityError {
+    reason;
+    failure;
+    constructor(reason, failure) {
+        super(`Registry publish failed with a retryable ${reason} outcome.`, "UNAVAILABLE", {
+            reason: "release-publish-retry-requested",
+            retryable: true,
+            details: { retryReason: reason },
+            cause: failure,
+        });
+        this.reason = reason;
+        this.failure = failure;
+        this.name = "ReleasePublishRetryRequested";
+    }
+}
+/**
+ * Seal and publish one package at `version` (its assigned release version;
+ * defaults to the source manifest's). With `sealedArtifact`, publishes those
+ * exact sealed bytes instead of re-packing. A version the Registry already
+ * holds is reused only when its bytes and provenance match; otherwise refused.
+ */
+export async function publishPackage(options) {
+    const retry = options.retry ?? {
+        attempts: 0,
+        transientRetries: 0,
+        rateLimitRetries: 0,
+        leaseDeadlineAt: options.runtime.lifecycle.now() + MANAGED_LEASE_POLL_DEADLINE_MS,
+        grantReadLagAttempt: 0,
+        leasePolls: 0,
+    };
+    const publishAttempt = retry.attempts + 1;
+    const paths = await getRuntimePath(options.runtime);
+    const files = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    if (!paths.isAbsolute(options.packageDir)) {
+        throw new CapabilityError(`Package directory must be absolute: ${options.packageDir}`, "INVALID_INPUT", { reason: "path-relative", details: { packageDir: options.packageDir } });
+    }
+    const packageDir = paths.resolve(options.packageDir);
+    const tempWorkspaceRoot = options.workspaceRoot;
+    const pkg = await readPackageJson(options.runtime, packageDir);
+    // The tier is the one access fact; a disagreeing manifest refuses before build.
+    const access = publishAccessForManifest(pkg);
+    const sourceVersion = pkg.version;
+    const version = options.version ?? sourceVersion;
+    const registry = resolvePublishRegistry(pkg, options.registry);
+    const tag = options.tag ?? pkg.publishConfig?.tag;
+    const provenance = options.workspaceProvenance;
+    // Key order is part of the sealed-metadata comparison, so the live metadata
+    // is built by the same constructor the seal uses.
+    const livePublishMetadata = sealedPublishMetadata({
+        registry,
+        access,
+        tag,
+        provenance,
+    });
+    const registryOrigin = await registryServiceOrigin(options.runtime);
+    let publishMetadata = livePublishMetadata;
+    const tempRoot = await createReleaseTempRoot(options.runtime, tempWorkspaceRoot, SENSITIVE_TEMP_ROOT_PREFIXES.publish);
+    const npmrcPath = paths.join(tempRoot, ".npmrc");
+    const homeDir = paths.join(tempRoot, "home");
+    const cacheDir = paths.join(tempRoot, "cache");
+    let lease;
+    let expiryLease;
+    let resolvedToken;
+    let verifiedExpiryLeaseId;
+    let primaryFailure;
+    try {
+        if (options.managedLease) {
+            await assertManagedSourceClean({
+                pkg,
+                packageDir,
+                execution: options.execution,
+                runtime: options.runtime,
+            });
+        }
+        else {
+            const packageStatus = await runRuntimeCommand({
+                runtime: options.runtime,
+                execution: options.execution,
+                command: "git",
+                inheritEnv: GIT_CHILD_ENV,
+                args: [...REGISTRY_RELEASE_STATUS_ARGS, "--untracked-files=all", "--", "."],
+                cwd: packageDir,
+            });
+            if (packageStatus.code === 0 &&
+                registryReleaseStatusBlocksSnapshot(packageStatus.stdout)) {
+                throw new Error(`Registry publish refuses dirty package source for ${pkg.name}@${version}; dirty paths:\n${packageStatus.stdout}`);
+            }
+        }
+        const gitHead = await resolveSourceCommit({
+            pkg,
+            packageDir,
+            execution: options.execution,
+            runtime: options.runtime,
+        });
+        assertRegistryReleaseSourceCommit({
+            expected: options.expectedGitHead,
+            observed: gitHead,
+            message: `Registry release source commit changed for ${pkg.name}@${version}: expected ${options.expectedGitHead}, found ${gitHead}`,
+        });
+        await files.mkdir(homeDir, { recursive: true });
+        await files.mkdir(cacheDir, { recursive: true });
+        await files.writeFile(npmrcPath, "");
+        let tarball;
+        let verifiedFiles;
+        let verifiedExports;
+        let retainedTarball;
+        if (options.sealedArtifact) {
+            const sealed = options.sealedArtifact;
+            if (!sealed.publishMetadata) {
+                throw new Error(`Sealed publish metadata is unavailable for ${pkg.name}@${version}`);
+            }
+            if (JSON.stringify(sealed.publishMetadata) !==
+                JSON.stringify(livePublishMetadata)) {
+                throw new Error(`Sealed publish metadata changed for ${pkg.name}@${version}`);
+            }
+            publishMetadata = sealed.publishMetadata;
+            if (sealed.name !== pkg.name ||
+                sealed.version !== version ||
+                sealed.packageDir !== packageDir) {
+                throw new Error(`Sealed release artifact identity does not match ${pkg.name}@${version}`);
+            }
+            if (!sealed.tarball || !paths.isAbsolute(sealed.tarball)) {
+                throw new Error(`Sealed release artifact path is unavailable for ${pkg.name}@${version}`);
+            }
+            if (!sealed.artifactIntegrity) {
+                throw new Error(`Sealed release evidence is incomplete for ${pkg.name}@${version}`);
+            }
+            assertRegistryReleaseSourceCommit({
+                expected: sealed.gitHead,
+                observed: gitHead,
+                message: `Sealed release evidence is incomplete for ${pkg.name}@${version}`,
+            });
+            await files.stat(sealed.tarball);
+            tarball = sealed.tarball;
+            verifiedFiles = sealed.verifiedFiles;
+            verifiedExports = sealed.verifiedExports;
+            retainedTarball = sealed.tarball;
+        }
+        else {
+            const fresh = await sealPackageArtifact({
+                pkg,
+                version,
+                packageDir,
+                tempRoot,
+                versions: options.versions,
+                gitHead,
+                workspaceProvenance: options.workspaceProvenance,
+                registry: options.registry,
+                tag: options.tag,
+                artifactDir: options.artifactDir,
+                build: options.build,
+                npmEnv: isolatedNpmPackEnv({ homeDir, cacheDir, npmrcPath }),
+                sourceRegistry: options.sourceRegistry,
+                execution: options.execution,
+                runtime: options.runtime,
+                quiet: options.quiet,
+                ui: options.ui,
+            });
+            tarball = fresh.tarball;
+            verifiedFiles = fresh.verification.verifiedFiles;
+            verifiedExports = fresh.verification.verifiedExports;
+            retainedTarball = fresh.retainedTarball;
+            publishMetadata = fresh.publishMetadata;
+        }
+        const candidate = {
+            name: pkg.name,
+            version,
+            integrity: `sha512-${await hashBase64(options.runtime, "sha512", z.instanceof(Uint8Array).parse(await files.readFile(tarball)))}`,
+            repository: publishMetadata.provenance.repository,
+            gitHead,
+        };
+        if (options.sealedArtifact &&
+            options.sealedArtifact.artifactIntegrity !== candidate.integrity) {
+            throw new Error(`Sealed release artifact bytes changed for ${pkg.name}@${version}`);
+        }
+        const availability = classifyRegistryReleaseAvailability(candidate, await npmPublishedArtifactIdentity({
+            name: pkg.name,
+            version,
+            registry: publishMetadata.registry,
+            scope: options.scope,
+            cwd: tempRoot,
+            env: isolatedNpmPackEnv({ homeDir, cacheDir, npmrcPath }),
+            execution: options.execution,
+            runtime: options.runtime,
+        }));
+        if (availability.action === "conflict") {
+            throw new Error(`${pkg.name}@${version} is immutable and differs from the published artifact (${availability.mismatches.join(", ")}); the Registry changed after version assignment, so rerun the release to assign a new version`);
+        }
+        if (availability.action === "reuse") {
+            if (!options.quiet)
+                options.ui.info(`Reusing verified-identical ${pkg.name}@${version}.`);
+            const reused = {
+                name: pkg.name,
+                version,
+                sourceVersion,
+                packageDir,
+                tarball: retainedTarball ?? tarball,
+                dryRun: options.dryRun,
+                ok: true,
+                skipped: true,
+                reason: "already-published",
+                attempts: 0,
+                artifactIntegrity: candidate.integrity,
+                gitHead,
+                publishMetadata,
+            };
+            if (verifiedFiles !== undefined)
+                reused.verifiedFiles = verifiedFiles;
+            if (verifiedExports !== undefined)
+                reused.verifiedExports = verifiedExports;
+            return reused;
+        }
+        if (options.authorityVerify &&
+            (!options.managedLease || !gitHead || !options.releaseWorkspace || !options.publishTargets)) {
+            throw new Error("Authority verification requires a managed lease and sealed release evidence");
+        }
+        if (options.managedLease &&
+            (!gitHead || !options.releaseWorkspace || !options.publishTargets)) {
+            throw new Error(`Managed Registry publish requires sealed release evidence for ${pkg.name}`);
+        }
+        const mintLease = (ttlSeconds) => {
+            const request = {
+                runtime: options.runtime,
+                request: options.platformRegistry.raw,
+                pkg: {
+                    ...pkg,
+                    version,
+                    repository: publishMetadata.provenance.repository,
+                    vibes: {
+                        ...pkg.vibes,
+                        registry: {
+                            repositoryId: publishMetadata.provenance.repositoryId,
+                            directory: publishMetadata.provenance.directory,
+                        },
+                    },
+                },
+                gitHead: gitHead,
+                integrity: candidate.integrity,
+                releaseWorkspace: options.releaseWorkspace,
+                registry: publishMetadata.registry,
+                deadlineAt: retry.leaseDeadlineAt,
+                signal: options.signal,
+                park: options.park,
+            };
+            if (ttlSeconds !== undefined)
+                request.ttlSeconds = ttlSeconds;
+            return mintManagedPublishLease(request);
+        };
+        if (options.managedLease) {
+            lease = await mintLease();
+        }
+        if (options.authorityVerify) {
+            expiryLease = await mintLease(1);
+            verifiedExpiryLeaseId = expiryLease.id;
+        }
+        // If either lease request needs a delayed Workers continuation, the
+        // cleanup below revokes every issued lease before this attempt returns.
+        resolvedToken = lease?.token ?? await options.resolveToken?.() ?? options.token;
+        await writeTempNpmrc({
+            runtime: options.runtime,
+            path: npmrcPath,
+            registry: publishMetadata.registry,
+            scope: options.scope,
+            token: resolvedToken,
+            homeDir,
+        });
+        const env = {
+            NPM_CONFIG_USERCONFIG: npmrcPath,
+            HOME: homeDir,
+            USERPROFILE: homeDir,
+        };
+        const publishEnv = options.otp === undefined
+            ? env
+            : { ...env, NPM_CONFIG_OTP: options.otp };
+        const args = publishArgs({
+            tarball,
+            registry: publishMetadata.registry,
+            access: publishMetadata.access,
+            tag: publishMetadata.tag ?? (defaultDistTagForVersion(version) === "rc" ? "rc" : undefined),
+            provenance: options.provenance &&
+                normalizeRegistryUrl(publishMetadata.registry) !== registryOrigin,
+            dryRun: options.dryRun,
+        });
+        if (options.authorityVerify) {
+            if (!lease || !expiryLease || !verifiedExpiryLeaseId)
+                throw new Error("Authority verification leases were not created");
+            await writeTempNpmrc({
+                runtime: options.runtime,
+                path: npmrcPath,
+                registry: publishMetadata.registry,
+                scope: options.scope,
+                token: expiryLease.token,
+                homeDir,
+            });
+            await options.runtime.lifecycle.wait(() => options.runtime.lifecycle.delay(1_250), {
+                timeoutMs: AUTHORITY_LEASE_EXPIRY_WAIT_TIMEOUT_MS,
+                signal: options.signal,
+                reason: "authority lease expiry verification",
+            });
+            const expired = await runNpm(options.execution, args, {
+                runtime: options.runtime,
+                cwd: tempRoot,
+                env,
+                quiet: true,
+                allowFailure: true,
+                redactValues: [expiryLease.token],
+            });
+            assertAuthorityLeaseRejected(expired, "Expired publish lease");
+            await writeTempNpmrc({
+                runtime: options.runtime,
+                path: npmrcPath,
+                registry: publishMetadata.registry,
+                scope: options.scope,
+                token: lease.token,
+                homeDir,
+            });
+        }
+        if (!options.quiet) {
+            options.ui.info(`${options.dryRun ? "Dry-running publish" : "Publishing"} ${pkg.name}@${version} to ${publishMetadata.registry}`);
+        }
+        const publishOnce = async () => {
+            try {
+                const attestedToken = resolvedToken;
+                if (!options.dryRun &&
+                    normalizeRegistryUrl(publishMetadata.registry) === registryOrigin) {
+                    if (!attestedToken) {
+                        throw new Error(`Attested publish to ${registryOrigin} requires a bearer token for ${pkg.name}@${version}`);
+                    }
+                    const put = await putAttestedPackument({
+                        runtime: options.runtime,
+                        tarball: { path: tarball },
+                        registry: publishMetadata.registry,
+                        token: attestedToken,
+                        tag: publishMetadata.tag,
+                        access: publishMetadata.access,
+                    });
+                    if (put.latestTag.state === "unread") {
+                        const { code, reason } = put.latestTag.failure;
+                        options.ui.warn(`${pkg.name}@${version} is published on ${publishMetadata.tag ?? defaultDistTagForVersion(version)}, but its dist-tags could not be read ` +
+                            `(${code ?? "error"}${reason ? ` ${reason}` : ""}), so a prerelease latest tag was not advanced.`);
+                    }
+                    return { ok: true };
+                }
+                const npmResult = await runNpm(options.execution, args, {
+                    runtime: options.runtime,
+                    cwd: tempRoot,
+                    env: publishEnv,
+                    quiet: options.quiet,
+                    allowFailure: true,
+                    onLine: (_stream, line) => options.ui.log(line),
+                    redactValues: [
+                        ...(lease ? [lease.token] : []),
+                        ...(options.otp ? [options.otp] : []),
+                    ],
+                });
+                if (npmResult.status !== 0) {
+                    return {
+                        ok: false,
+                        cause: new NpmCommandError(args, npmResult),
+                    };
+                }
+                return { ok: true };
+            }
+            catch (error) {
+                return { ok: false, cause: CaughtFailureSchema.parse(error) };
+            }
+        };
+        const attempts = publishAttempt;
+        const outcome = await publishOnce();
+        if (!outcome.ok) {
+            if (isNpmExistingVersionError(outcome.cause)) {
+                const winner = await npmPublishedArtifactIdentity({
+                    name: pkg.name,
+                    version,
+                    registry: publishMetadata.registry,
+                    scope: options.scope,
+                    cwd: tempRoot,
+                    env: isolatedNpmPackEnv({ homeDir, cacheDir, npmrcPath }),
+                    execution: options.execution,
+                    runtime: options.runtime,
+                });
+                const racedAvailability = classifyRegistryReleaseAvailability(candidate, winner);
+                if (racedAvailability.action !== "reuse") {
+                    throw new Error(`${pkg.name}@${version} appeared during publication but its published identity could not be verified as identical`, { cause: outcome.cause });
+                }
+                if (!options.quiet)
+                    options.ui.info(`${pkg.name}@${version} is already published; skipping.`);
+                const skipped = {
+                    name: pkg.name,
+                    version,
+                    sourceVersion,
+                    packageDir,
+                    tarball: retainedTarball ?? tarball,
+                    dryRun: options.dryRun,
+                    ok: true,
+                    skipped: true,
+                    reason: "already-published",
+                    attempts,
+                    artifactIntegrity: candidate.integrity,
+                    gitHead,
+                    publishMetadata,
+                };
+                if (verifiedFiles !== undefined)
+                    skipped.verifiedFiles = verifiedFiles;
+                if (verifiedExports !== undefined)
+                    skipped.verifiedExports = verifiedExports;
+                return skipped;
+            }
+            if (isTransientPublishError(outcome.cause)) {
+                throw new ReleasePublishRetryRequested("transient", CaughtFailureSchema.parse(outcome.cause));
+            }
+            if (isNpmRateLimitError(outcome.cause)) {
+                throw new ReleasePublishRetryRequested("rate-limit", CaughtFailureSchema.parse(outcome.cause));
+            }
+            throw outcome.cause;
+        }
+        let authority;
+        if (options.authorityVerify) {
+            if (!lease || !gitHead)
+                throw new Error("Authority verification requires a managed publish lease");
+            if (!verifiedExpiryLeaseId)
+                throw new Error("Authority verification expiry lease was not created");
+            const replay = await runNpm(options.execution, [...args, "--force"], {
+                runtime: options.runtime,
+                cwd: tempRoot,
+                env,
+                quiet: true,
+                allowFailure: true,
+                redactValues: [lease.token],
+            });
+            assertAuthorityLeaseRejected(replay, "Consumed publish lease replay");
+            const installDir = paths.join(tempRoot, "install");
+            await files.mkdir(installDir, { recursive: true });
+            await files.writeFile(paths.join(installDir, "package.json"), '{"private":true}\n');
+            await runNpm(options.execution, [
+                "install",
+                versionSpec(pkg.name, version),
+                "--registry",
+                publishMetadata.registry,
+                "--no-audit",
+                "--no-fund",
+            ], {
+                runtime: options.runtime,
+                cwd: installDir,
+                env,
+                quiet: true,
+                redactValues: [lease.token],
+            });
+            authority = {
+                publish: "passed",
+                install: "passed",
+                replay: "rejected",
+                expiry: "rejected",
+                leaseId: lease.id,
+                expiryLeaseId: verifiedExpiryLeaseId,
+            };
+        }
+        const published = {
+            name: pkg.name,
+            version,
+            sourceVersion,
+            packageDir,
+            tarball: retainedTarball ?? paths.basename(tarball),
+            dryRun: options.dryRun,
+            ok: true,
+            attempts,
+            artifactIntegrity: candidate.integrity,
+            publishMetadata,
+            gitHead,
+        };
+        if (verifiedFiles !== undefined)
+            published.verifiedFiles = verifiedFiles;
+        if (verifiedExports !== undefined)
+            published.verifiedExports = verifiedExports;
+        if (options.provenance) {
+            published.provenance =
+                normalizeRegistryUrl(publishMetadata.registry) === registryOrigin
+                    ? "source-commit"
+                    : "npm-attestation";
+        }
+        if (authority !== undefined)
+            published.authority = authority;
+        return published;
+    }
+    catch (error) {
+        primaryFailure = { error };
+        throw error;
+    }
+    finally {
+        const afterRemove = [];
+        const revokeLease = async (id) => {
+            const revoked = await revokeManagedPublishLease(options.platformRegistry, id, publishMetadata?.registry);
+            if (revoked.ok)
+                return;
+            infraDeployLogger(options.runtime).warn("Publish lease revoke failed; the one-use lease expires on its own.", { error: revoked.cause });
+        };
+        if (expiryLease) {
+            const expiryLeaseId = expiryLease.id;
+            afterRemove.push(() => revokeLease(expiryLeaseId));
+        }
+        if (lease) {
+            const leaseId = lease.id;
+            afterRemove.push(() => revokeLease(leaseId));
+        }
+        const cleanupRedactValues = [
+            options.token,
+            resolvedToken,
+            lease?.token,
+            expiryLease?.token,
+        ].filter((value) => Boolean(value));
+        await cleanupSensitiveTempRoot({
+            runtime: options.runtime,
+            root: tempRoot,
+            npmrcPath,
+            expectedPrefix: SENSITIVE_TEMP_ROOT_PREFIXES.publish,
+            workspaceRoot: tempWorkspaceRoot,
+            primaryFailure,
+            afterRemove,
+            redactValues: cleanupRedactValues,
+        });
+    }
+}
+//# sourceMappingURL=publish-package.js.map

package/dist/cli/npm/publish/publish-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-package.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/publish-package.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EACL,mCAAmC,EACnC,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,MAAM,EACN,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnF,OAAO,EACL,8BAA8B,GAE/B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAInC,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,mCAAmC,EACnC,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAQ9B,2EAA2E;AAC3E,MAAM,sCAAsC,GAAG,MAAM,CAAC;AAEtD,MAAM,OAAO,4BAA6B,SAAQ,eAAe;IAEpD;IACA;IAFX,YACW,MAAkC,EAClC,OAAsB;QAE/B,KAAK,CAAC,4CAA4C,MAAM,WAAW,EAAE,aAAa,EAAE;YAClF,MAAM,EAAE,iCAAiC;YACzC,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE;YAChC,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QARM,WAAM,GAAN,MAAM,CAA4B;QAClC,YAAO,GAAP,OAAO,CAAe;QAQ/B,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAsCpC;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI;QAC7B,QAAQ,EAAE,CAAC;QACX,gBAAgB,EAAE,CAAC;QACnB,gBAAgB,EAAE,CAAC;QACnB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,8BAA8B;QACjF,mBAAmB,EAAE,CAAC;QACtB,UAAU,EAAE,CAAC;KACd,CAAC;IACF,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CACvB,uCAAuC,OAAO,CAAC,UAAU,EAAE,EAC3D,eAAe,EACf,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/D,gFAAgF;IAChF,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC;IACjD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAC/C,4EAA4E;IAC5E,kDAAkD;IAClD,MAAM,mBAAmB,GAA0B,qBAAqB,CAAC;QACvE,QAAQ;QACR,MAAM;QACN,GAAG;QACH,UAAU;KACX,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,eAAe,GAAG,mBAAmB,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,OAAO,CAAC,OAAO,EACf,iBAAiB,EACjB,4BAA4B,CAAC,OAAO,CACrC,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,KAAsC,CAAC;IAC3C,IAAI,WAA4C,CAAC;IACjD,IAAI,aAAiC,CAAC;IACtC,IAAI,qBAAyC,CAAC;IAC9C,IAAI,cAAuD,CAAC;IAE5D,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,wBAAwB,CAAC;gBAC7B,GAAG;gBACH,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC;gBAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,aAAa;gBACzB,IAAI,EAAE,CAAC,GAAG,4BAA4B,EAAE,uBAAuB,EAAE,IAAI,EAAE,GAAG,CAAC;gBAC3E,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;YACH,IACE,aAAa,CAAC,IAAI,KAAK,CAAC;gBACxB,mCAAmC,CAAC,aAAa,CAAC,MAAM,CAAC,EACzD,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,qDAAqD,GAAG,CAAC,IAAI,IAAI,OAAO,mBAAmB,aAAa,CAAC,MAAM,EAAE,CAClH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,GAAG;YACH,UAAU;YACV,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,iCAAiC,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,eAAe;YACjC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,8CAA8C,GAAG,CAAC,IAAI,IAAI,OAAO,cAAc,OAAO,CAAC,eAAe,WAAW,OAAO,EAAE;SACpI,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,OAAe,CAAC;QACpB,IAAI,aAAiC,CAAC;QACtC,IAAI,eAAmC,CAAC;QACxC,IAAI,eAAmC,CAAC;QACxC,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CACpE,CAAC;YACJ,CAAC;YACD,IACE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC;gBACtC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EACnC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,uCAAuC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAC7D,CAAC;YACJ,CAAC;YACD,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;YACzC,IACE,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;gBACxB,MAAM,CAAC,OAAO,KAAK,OAAO;gBAC1B,MAAM,CAAC,UAAU,KAAK,UAAU,EAChC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,mDAAmD,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CACzE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,mDAAmD,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CACzE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CACnE,CAAC;YACJ,CAAC;YACD,iCAAiC,CAAC;gBAChC,QAAQ,EAAE,MAAM,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,6CAA6C,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE;aAC5E,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;YACzC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;gBACtC,GAAG;gBACH,OAAO;gBACP,UAAU;gBACV,QAAQ;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO;gBACP,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;gBAC5D,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,EAAE,EAAE,OAAO,CAAC,EAAE;aACf,CAAC,CAAC;YACH,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACxB,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC;YACjD,eAAe,GAAG,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC;YACrD,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;YACxC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC1C,CAAC;QACD,MAAM,SAAS,GAAoC;YACjD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO;YACP,SAAS,EAAE,UAAU,MAAM,UAAU,CACnC,OAAO,CAAC,OAAO,EACf,QAAQ,EACR,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAC9D,EAAE;YACH,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,UAAU;YACjD,OAAO;SACR,CAAC;QACF,IACE,OAAO,CAAC,cAAc;YACtB,OAAO,CAAC,cAAc,CAAC,iBAAiB,KAAK,SAAS,CAAC,SAAS,EAChE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,mCAAmC,CACtD,SAAS,EACT,MAAM,4BAA4B,CAAC;YACjC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO;YACP,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YACzD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CACH,CAAC;QACF,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,0DAA0D,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gGAAgG,CACnN,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,KAAK;gBAChB,OAAO,CAAC,EAAE,CAAC,IAAI,CACb,8BAA8B,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CACrD,CAAC;YACJ,MAAM,MAAM,GAAkB;gBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO;gBACP,aAAa;gBACb,UAAU;gBACV,OAAO,EAAE,eAAe,IAAI,OAAO;gBACnC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,CAAC;gBACX,iBAAiB,EAAE,SAAS,CAAC,SAAS;gBACtC,OAAO;gBACP,eAAe;aAChB,CAAC;YACF,IAAI,aAAa,KAAK,SAAS;gBAAE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YACtE,IAAI,eAAe,KAAK,SAAS;gBAAE,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;YAC5E,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IACE,OAAO,CAAC,eAAe;YACvB,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAC3F,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,IACE,OAAO,CAAC,YAAY;YACpB,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAClE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,UAAmB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAkD;gBAC7D,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG;gBACrC,GAAG,EAAE;oBACH,GAAG,GAAG;oBACN,OAAO;oBACP,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,UAAU;oBACjD,KAAK,EAAE;wBACL,GAAG,GAAG,CAAC,KAAK;wBACZ,QAAQ,EAAE;4BACR,YAAY,EAAE,eAAe,CAAC,UAAU,CAAC,YAAY;4BACrD,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,SAAS;yBAChD;qBACF;iBACF;gBACD,OAAO,EAAE,OAAQ;gBACjB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAiB;gBAC3C,QAAQ,EAAE,eAAe,CAAC,QAAQ;gBAClC,UAAU,EAAE,KAAK,CAAC,eAAe;gBACjC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC;YACF,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;YAC9D,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,WAAW,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;YACjC,qBAAqB,GAAG,WAAW,CAAC,EAAE,CAAC;QACzC,CAAC;QACD,oEAAoE;QACpE,wEAAwE;QACxE,aAAa,GAAG,KAAK,EAAE,KAAK,IAAI,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC;QAChF,MAAM,cAAc,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,aAAa;YACpB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,GAAG,GAAG;YACV,qBAAqB,EAAE,SAAS;YAChC,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,OAAO;SACrB,CAAC;QACF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS;YAC1C,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC;YACvB,OAAO;YACP,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,GAAG,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,UAAU,EACR,OAAO,CAAC,UAAU;gBAClB,oBAAoB,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,cAAc;YACnE,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,qBAAqB;gBAClD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,MAAM,cAAc,CAAC;gBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,eAAe,CAAC,QAAQ;gBAClC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,OAAO;aACR,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAClC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAC5C;gBACE,SAAS,EAAE,sCAAsC;gBACjD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,qCAAqC;aAC9C,CACF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;gBACpD,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,EAAE,QAAQ;gBACb,GAAG;gBACH,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,4BAA4B,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;YAC/D,MAAM,cAAc,CAAC;gBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,eAAe,CAAC,QAAQ;gBAClC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,CAAC,EAAE,CAAC,IAAI,CACb,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,OAAO,eAAe,CAAC,QAAQ,EAAE,CACjH,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,aAAa,CAAC;gBACpC,IACE,CAAC,OAAO,CAAC,MAAM;oBACf,oBAAoB,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,cAAc,EACjE,CAAC;oBACD,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,cAAc,gCAAgC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAC3F,CAAC;oBACJ,CAAC;oBACD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;wBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;wBAC1B,QAAQ,EAAE,eAAe,CAAC,QAAQ;wBAClC,KAAK,EAAE,aAAa;wBACpB,GAAG,EAAE,eAAe,CAAC,GAAG;wBACxB,MAAM,EAAE,eAAe,CAAC,MAAM;qBAC/B,CAAC,CAAC;oBACH,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACrC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;wBAC/C,OAAO,CAAC,EAAE,CAAC,IAAI,CACb,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,oBAAoB,eAAe,CAAC,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,wCAAwC;4BACxI,IAAI,IAAI,IAAI,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,iDAAiD,CACpG,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;oBACtD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,GAAG,EAAE,QAAQ;oBACb,GAAG,EAAE,UAAU;oBACf,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,YAAY,EAAE,IAAI;oBAClB,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC/C,YAAY,EAAE;wBACZ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC/B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;qBACtC;iBACF,CAAC,CAAC;gBACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACL,EAAE,EAAE,KAAc;wBAClB,KAAK,EAAE,IAAI,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;qBAC5C,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,cAAc,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;oBAChD,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO;oBACP,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,GAAG,EAAE,QAAQ;oBACb,GAAG,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;oBACzD,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;gBACH,MAAM,iBAAiB,GAAG,mCAAmC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACjF,IAAI,iBAAiB,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,4FAA4F,EAClH,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,KAAK;oBAChB,OAAO,CAAC,EAAE,CAAC,IAAI,CACb,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,kCAAkC,CACzD,CAAC;gBACJ,MAAM,OAAO,GAAkB;oBAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO;oBACP,aAAa;oBACb,UAAU;oBACV,OAAO,EAAE,eAAe,IAAI,OAAO;oBACnC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ;oBACR,iBAAiB,EAAE,SAAS,CAAC,SAAS;oBACtC,OAAO;oBACP,eAAe;iBAChB,CAAC;gBACF,IAAI,aAAa,KAAK,SAAS;oBAAE,OAAO,CAAC,aAAa,GAAG,aAAa,CAAC;gBACvE,IAAI,eAAe,KAAK,SAAS;oBAAE,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC;gBAC7E,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAA4B,CACpC,WAAW,EACX,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,4BAA4B,CACpC,YAAY,EACZ,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CACzC,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,IAAI,SAAqC,CAAC;QAC1C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBACpB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,IAAI,CAAC,qBAAqB;gBACxB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE;gBACnE,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,EAAE,QAAQ;gBACb,GAAG;gBACH,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;aAC5B,CAAC,CAAC;YACH,4BAA4B,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;YACtE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,oBAAoB,CAAC,CAAC;YACpF,MAAM,MAAM,CACV,OAAO,CAAC,SAAS,EACjB;gBACE,SAAS;gBACT,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;gBAC9B,YAAY;gBACZ,eAAe,CAAC,QAAQ;gBACxB,YAAY;gBACZ,WAAW;aACZ,EACD;gBACE,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,EAAE,UAAU;gBACf,GAAG;gBACH,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;aAC5B,CACF,CAAC;YACF,SAAS,GAAG;gBACV,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,aAAa,EAAE,qBAAqB;aACrC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAkB;YAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO;YACP,aAAa;YACb,UAAU;YACV,OAAO,EAAE,eAAe,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YACnD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,EAAE,EAAE,IAAI;YACR,QAAQ;YACR,iBAAiB,EAAE,SAAS,CAAC,SAAS;YACtC,eAAe;YACf,OAAO;SACR,CAAC;QACF,IAAI,aAAa,KAAK,SAAS;YAAE,SAAS,CAAC,aAAa,GAAG,aAAa,CAAC;QACzE,IAAI,eAAe,KAAK,SAAS;YAAE,SAAS,CAAC,eAAe,GAAG,eAAe,CAAC;QAC/E,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,SAAS,CAAC,UAAU;gBAClB,oBAAoB,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,cAAc;oBAC/D,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,iBAAiB,CAAC;QAC1B,CAAC;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,GAAG,EAAE,KAAK,EAAE,CAAC;QAC3B,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,KAAK,EAAE,EAAU,EAAiB,EAAE;YACtD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAC7C,OAAO,CAAC,gBAAgB,EACxB,EAAE,EACF,eAAe,EAAE,QAAQ,CAC1B,CAAC;YACF,IAAI,OAAO,CAAC,EAAE;gBAAE,OAAO;YACvB,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACrC,oEAAoE,EACpE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC;YACrC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,mBAAmB,GAAG;YAC1B,OAAO,CAAC,KAAK;YACb,aAAa;YACb,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,KAAK;SACnB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,MAAM,wBAAwB,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,QAAQ;YACd,SAAS;YACT,cAAc,EAAE,4BAA4B,CAAC,OAAO;YACpD,aAAa,EAAE,iBAAiB;YAChC,cAAc;YACd,WAAW;YACX,YAAY,EAAE,mBAAmB;SAClC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}