@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/publish/release-consumer-proof.js

@@ -0,0 +1,397 @@
+import { chmodChecked, resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { z } from "zod/v4";
+import { runRuntimeCommand } from "../../shared/runtime-execution.js";
+import { runPublisherConsumerSmoke } from "./consumer-smoke.js";
+import { planReleaseConsumerRootImports, runReleaseConsumerRootImports, runReleaseConsumerSurfaceProof, } from "./consumer-surfaces.js";
+import { effectiveExternalSelector, } from "./external-requirements.js";
+import { isolatedNpmPackEnv, npmTarballFilename, releaseConsumerNpmInstallFailure, runNpm, } from "./npm-exec.js";
+import { acquireExternalProofClosure, externalProofPackageNames, internalOptionalPeerRequirements, releaseConsumerPlanRecord, } from "./proof-external-closure.js";
+import { verifyInstalledReleaseGraph } from "./proof-installed-graph.js";
+import { readProofArtifactManifest, startProofLocalRegistry, writeReleaseConsumerSourceNpmrc, } from "./proof-registry.js";
+import { createProofSourceCredentials } from "./proof-source-credentials.js";
+import { PUBLIC_NPM_REGISTRY } from "./registry-credentials.js";
+import { cleanupSensitiveTempRoot, createReleaseTempRoot, SENSITIVE_TEMP_ROOT_PREFIXES, } from "./sensitive-temp.js";
+import { parsePublisherManifest, parseWorkspaceRootManifest, publisherManifestSchema, } from "./publisher-manifest.js";
+import { hostPlatformFacts, isPackagePlatformCompatible } from "./workspace-discovery.js";
+// Manifest admission permits nested overrides; this proof supports only nonempty
+// flat selectors and must refuse other admitted forms before installation.
+const rootOverrideSelectorSchema = publisherManifestSchema.shape.overrides
+    .unwrap().valueType.pipe(z.string().refine((selector) => selector.trim().length > 0));
+// Owner profiles certify artifact usability on every release, independently of
+// the optional Registry authority lease/replay/expiry exercises.
+export async function runSealedReleaseConsumerChecks(options) {
+    const members = options.sealed
+        .filter((result) => !result.skipped && Boolean(result.tarball))
+        .map(({ name, version, tarball }) => ({ name, version, tarball }));
+    const consumerSmoke = await runPublisherConsumerSmoke({
+        ...options.smoke,
+        members,
+    });
+    if (!options.smoke.quiet && members.length > 0) {
+        options.smoke.ui.success(`Publisher consumer smoke installed ${consumerSmoke.installed} package(s) and imported ${consumerSmoke.imports.length} export(s) in ${consumerSmoke.durationMs}ms.`);
+    }
+    if (!options.smoke.quiet)
+        options.smoke.ui.info("Proving the packed artifacts install as a consumer...");
+    const consumerProof = await runReleaseConsumerProof(options.proof);
+    return { consumerSmoke, consumerProof };
+}
+/**
+ * Install the sealed release set, plus its exact external closure, into a
+ * clean consumer from a local proof registry and verify the result: every
+ * resolution, profile import, declared surface, SSR probe, bin and withhold.
+ */
+export async function runReleaseConsumerProof(options) {
+    // Validate every profile owner even when the profile only carries SSR or
+    // withhold probes and therefore has no direct import specifiers.
+    const rootImportPlans = planReleaseConsumerRootImports({
+        profiles: options.plan.profiles,
+        workspace: options.workspace,
+    });
+    const binNames = options.plan.publishNodes.flatMap((node) => {
+        const manifest = parsePublisherManifest(options.workspace.get(node.name)?.manifest ?? {});
+        const bin = publisherManifestSchema.shape.bin.unwrap();
+        return z.union([
+            bin.options[0].transform(() => [node.name.split("/").at(-1)]),
+            bin.options[1].transform((entries) => Object.keys(entries)),
+        ]).parse(manifest.bin ?? {}).sort();
+    });
+    const sourceRegistry = options.sourceRegistry ?? {
+        defaultRegistry: PUBLIC_NPM_REGISTRY,
+    };
+    let npmrcPath = "";
+    const credentials = createProofSourceCredentials({
+        runtime: options.runtime,
+        sourceRegistry,
+        npmrcPath: () => npmrcPath,
+        now: options.now,
+    });
+    const proofRoot = await createReleaseTempRoot(options.runtime, options.workspaceRoot, SENSITIVE_TEMP_ROOT_PREFIXES.consumer);
+    const paths = await getRuntimePath(options.runtime);
+    const hostFiles = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    const workspaceFiles = await resolveFileSystemAdapter(options.runtime);
+    const externalRoot = paths.join(proofRoot, "external");
+    const consumerDir = paths.join(proofRoot, "consumer");
+    const cacheDir = paths.join(proofRoot, "cache");
+    const homeDir = paths.join(proofRoot, "home");
+    npmrcPath = paths.join(proofRoot, "npmrc");
+    const npmPaths = { homeDir, cacheDir, npmrcPath };
+    const cleanupRedactValues = credentials.redactValues;
+    let closeProofRegistry = async () => { };
+    let primaryFailure;
+    try {
+        const rootManifest = parseWorkspaceRootManifest(JSON.parse(z.string().parse(await workspaceFiles.readFile(paths.join(options.workspaceRoot, "package.json"), "utf8"))));
+        const rootOverrides = rootManifest.overrides ?? {};
+        for (const [name, selector] of Object.entries(rootOverrides)) {
+            if (!rootOverrideSelectorSchema.safeParse(selector).success) {
+                throw new Error(`Offline release proof does not support nested or non-string root override ${name}`);
+            }
+        }
+        await Promise.all([
+            hostFiles.mkdir(externalRoot, { recursive: true }),
+            hostFiles.mkdir(consumerDir, { recursive: true }),
+            hostFiles.mkdir(cacheDir, { recursive: true }),
+            hostFiles.mkdir(homeDir, { recursive: true }),
+            options.sourceRegistry
+                ? writeReleaseConsumerSourceNpmrc(npmrcPath, credentials.sourceRegistryWithCurrentTokens(), options.runtime)
+                : hostFiles.writeFile(npmrcPath, `registry=${PUBLIC_NPM_REGISTRY}\n`, {
+                    mode: 0o600,
+                }),
+        ]);
+        await chmodChecked(hostFiles, npmrcPath, 0o600);
+        const internalArtifacts = await readSealedReleaseArtifacts({
+            artifactDir: options.artifactDir,
+            plan: options.plan,
+            execution: options.execution,
+            runtime: options.runtime,
+            reusedTarballs: options.reusedTarballs,
+        });
+        const internalNames = new Set(options.plan.publishNodes.map((node) => node.name));
+        const internalVersions = new Map(options.plan.publishNodes.map((node) => [node.name, node.version]));
+        const optionalPeerRequirements = internalOptionalPeerRequirements({
+            artifacts: internalArtifacts,
+            internalVersions,
+            rootOverrides,
+        });
+        if ((options.plan.externalRequirements.length > 0 ||
+            optionalPeerRequirements.length > 0) &&
+            !options.sourceRegistry) {
+            throw new Error("Offline release proof requires an explicit source Registry for external packages");
+        }
+        const closure = await acquireExternalProofClosure({
+            plan: options.plan,
+            workspace: options.workspace,
+            rootOverrides,
+            internalNames,
+            internalVersions,
+            optionalPeerRequirements,
+            sealedWorkspaceInputs: options.sealedWorkspaceInputs,
+            sourceRegistry,
+            credentials,
+            proofRoot,
+            externalRoot,
+            env: isolatedNpmPackEnv(npmPaths),
+            execution: options.execution,
+            runtime: options.runtime,
+        });
+        const externalArtifacts = [...closure.nodes.values()]
+            .filter((node) => {
+            const host = hostPlatformFacts(options.runtime);
+            return isPackagePlatformCompatible(node.manifest, host.platform, host.architecture);
+        })
+            .map((node) => ({ manifest: node.manifest, tarball: node.tarball }));
+        const proofRegistry = await startProofLocalRegistry(options.runtime, [...internalArtifacts, ...externalArtifacts], { upstreamRegistry: PUBLIC_NPM_REGISTRY });
+        closeProofRegistry = proofRegistry.close;
+        await hostFiles.writeFile(npmrcPath, `registry=${proofRegistry.origin}\naudit=false\nfund=false\n`);
+        const proofDependencies = profileProofDependencies(options.plan, rootOverrides);
+        const externalPackageNames = externalProofPackageNames(options.plan, closure);
+        const proofOverrides = Object.fromEntries(Object.entries(rootOverrides).filter(([name]) => externalPackageNames.has(name)));
+        const internalInstallRoots = [
+            ...new Set([
+                ...options.plan.roots,
+                ...options.plan.publishNodes
+                    .filter((node) => node.roles.includes("proof"))
+                    .map((node) => node.name),
+            ]),
+        ].sort();
+        const internalProofDependencies = Object.fromEntries(internalInstallRoots.map((name) => {
+            const node = options.plan.publishNodes.find((candidate) => candidate.name === name);
+            if (!node)
+                throw new Error(`Release proof cannot install unplanned root ${name}`);
+            return [name, node.version];
+        }));
+        const consumerManifest = `${JSON.stringify({ private: true, type: "module", dependencies: { ...proofDependencies, ...internalProofDependencies }, overrides: proofOverrides }, null, 2)}\n`;
+        await hostFiles.writeFile(paths.join(options.artifactDir, "release-consumer-plan.json"), `${JSON.stringify(releaseConsumerPlanRecord({
+            internalInstallRoots,
+            consumerOverrides: proofOverrides,
+            closure,
+        }), null, 2)}\n`);
+        await hostFiles.writeFile(paths.join(consumerDir, "package.json"), consumerManifest);
+        await installReleaseConsumer({
+            consumerDir,
+            registryOrigin: proofRegistry.origin,
+            npmPaths,
+            redactValues: cleanupRedactValues,
+            execution: options.execution,
+            runtime: options.runtime,
+        });
+        const graph = await verifyInstalledReleaseGraph({
+            runtime: options.runtime,
+            consumerDir,
+            plan: options.plan,
+            internalProofDependencies,
+            rootOverrides,
+            sourceRegistry,
+            closure,
+        });
+        await runReleaseConsumerRootImports({
+            plans: rootImportPlans,
+            consumerDir,
+            execution: options.execution,
+            runtime: options.runtime,
+        });
+        const imports = await runReleaseConsumerSurfaceProof({
+            plan: options.plan,
+            consumerDir,
+            internalNames,
+            execution: options.execution,
+            runtime: options.runtime,
+        });
+        const bins = await proveReleaseConsumerBins({
+            names: binNames,
+            consumerDir,
+            execution: options.execution,
+            runtime: options.runtime,
+        });
+        const withheld = await proveReleaseConsumerWithholds({
+            plan: options.plan,
+            proofRoot,
+            consumerManifest,
+            artifacts: [...internalArtifacts, ...externalArtifacts],
+            npmPaths,
+            execution: options.execution,
+            runtime: options.runtime,
+        });
+        return {
+            installed: internalArtifacts.length + closure.nodes.size,
+            imports,
+            bins,
+            withheld,
+            ...graph,
+        };
+    }
+    catch (error) {
+        primaryFailure = { error };
+        throw error;
+    }
+    finally {
+        await cleanupSensitiveTempRoot({
+            runtime: options.runtime,
+            root: proofRoot,
+            npmrcPath,
+            expectedPrefix: SENSITIVE_TEMP_ROOT_PREFIXES.consumer,
+            workspaceRoot: options.workspaceRoot,
+            primaryFailure,
+            close: [closeProofRegistry],
+            redactValues: cleanupRedactValues,
+        });
+    }
+}
+/** npm environment for installing from the local proof registry, never a proxy. */
+function proofInstallEnv(paths) {
+    return {
+        ...isolatedNpmPackEnv(paths),
+        HTTP_PROXY: "",
+        HTTPS_PROXY: "",
+        NO_PROXY: "127.0.0.1,localhost",
+    };
+}
+const PROOF_INSTALL_ARGS = [
+    "--ignore-scripts",
+    "--no-audit",
+    "--no-fund",
+    "--package-lock=false",
+];
+/**
+ * Tarballs in `artifactDir` that the release plan does not account for.
+ *
+ * `artifactDir` holds one tarball per publish node (packed, or a reused version
+ * the availability step moved in) plus reused versions of packages outside the
+ * plan, which the proof installs as inputs. Anything else — a leftover run, a
+ * superseded published version — is unexpected and fails the proof.
+ */
+export function unexpectedReleaseTarballEntries(entries, plannedTarballs, reusedTarballs = new Set()) {
+    return entries
+        .filter((entry) => entry.endsWith(".tgz") &&
+        !plannedTarballs.has(entry) &&
+        !reusedTarballs.has(entry))
+        .sort();
+}
+/** Every planned artifact in `artifactDir`, exactly one per publish node. */
+async function readSealedReleaseArtifacts(options) {
+    const plannedTarballs = new Set(options.plan.publishNodes.map((node) => npmTarballFilename(node.name, node.version)));
+    const paths = await getRuntimePath(options.runtime);
+    const files = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    const unexpected = unexpectedReleaseTarballEntries((await files.list(options.artifactDir)).map((entry) => entry.name), plannedTarballs, options.reusedTarballs);
+    if (unexpected.length > 0) {
+        throw new Error(`Release proof found ${unexpected.length} artifact(s) outside the ${plannedTarballs.size}-package plan: ${unexpected.join(", ")}`);
+    }
+    const internalArtifacts = await Promise.all(options.plan.publishNodes.map(async (node) => {
+        const tarball = paths.join(options.artifactDir, npmTarballFilename(node.name, node.version));
+        const manifest = await readProofArtifactManifest(options.execution, options.runtime, tarball);
+        if (manifest.name !== node.name || manifest.version !== node.version) {
+            throw new Error(`Release proof expected ${node.name}@${node.version}, artifact contains ${manifest.name}@${manifest.version}`);
+        }
+        return { manifest, tarball };
+    }));
+    return internalArtifacts;
+}
+/** Root selectors the profiles require of external packages. */
+function profileProofDependencies(plan, rootOverrides) {
+    const proofDependencies = {};
+    for (const requirement of plan.externalRequirements) {
+        if (requirement.requiredByProfiles.length === 0)
+            continue;
+        const selector = effectiveExternalSelector(rootOverrides, requirement.name, requirement.selector);
+        const existing = proofDependencies[requirement.name];
+        if (existing && existing !== selector) {
+            throw new Error(`Release proof profiles require incompatible root selectors for ${requirement.name}: ${existing}, ${selector}`);
+        }
+        proofDependencies[requirement.name] = selector;
+    }
+    return proofDependencies;
+}
+/**
+ * Install the consumer once with the declared proof-install arguments.
+ * Failures remain fatal, with a redacted message and the original cause.
+ */
+async function installReleaseConsumer(options) {
+    const proofInstallArgs = [
+        "install",
+        "--registry",
+        options.registryOrigin,
+        ...PROOF_INSTALL_ARGS,
+    ];
+    try {
+        await runNpm(options.execution, proofInstallArgs, {
+            runtime: options.runtime,
+            cwd: options.consumerDir,
+            env: proofInstallEnv(options.npmPaths),
+            quiet: true,
+            redactValues: options.redactValues,
+        });
+    }
+    catch (error) {
+        throw new Error(releaseConsumerNpmInstallFailure(error, options.redactValues).message, { cause: error });
+    }
+}
+/** Run every declared bin of the release set with `--help`. */
+async function proveReleaseConsumerBins(options) {
+    const paths = await getRuntimePath(options.runtime);
+    const bins = [];
+    for (const name of options.names) {
+        const binPath = paths.join(options.consumerDir, "node_modules", ".bin", name);
+        const result = await runRuntimeCommand({
+            runtime: options.runtime,
+            execution: options.execution,
+            command: "bun",
+            args: [binPath, "--help"],
+            cwd: options.consumerDir,
+        });
+        if (result.code !== 0)
+            throw new Error(`Installed release bin ${name} failed: ${result.stderr}`);
+        bins.push(name);
+    }
+    return bins;
+}
+/**
+ * Prove each profile's withheld packages are load-bearing: the same consumer
+ * must fail to install, naming them, when only they are missing.
+ */
+async function proveReleaseConsumerWithholds(options) {
+    const withheld = [
+        ...new Set(options.plan.profiles.flatMap((profile) => profile.withholdPackages ?? [])),
+    ].sort();
+    if (withheld.length === 0)
+        return withheld;
+    const paths = await getRuntimePath(options.runtime);
+    const files = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    const withholdDir = paths.join(options.proofRoot, "withhold-consumer");
+    await files.mkdir(withholdDir, { recursive: true });
+    await files.writeFile(paths.join(withholdDir, "package.json"), options.consumerManifest);
+    const withheldNames = new Set(withheld);
+    for (const name of withheldNames) {
+        if (!options.plan.publishNodes.some((candidate) => candidate.name === name) &&
+            !options.plan.externalRequirements.some((candidate) => candidate.name === name)) {
+            throw new Error(`Release proof cannot withhold unplanned package ${name}`);
+        }
+    }
+    // Public packages proxy upstream exactly as in the real proof, so the
+    // only thing this install lacks is the withheld set.
+    const withheldRegistry = await startProofLocalRegistry(options.runtime, options.artifacts.filter((artifact) => !withheldNames.has(artifact.manifest.name)), { upstreamRegistry: PUBLIC_NPM_REGISTRY, withhold: withheldNames });
+    let result;
+    try {
+        result = await runNpm(options.execution, ["install", "--registry", withheldRegistry.origin, ...PROOF_INSTALL_ARGS], {
+            runtime: options.runtime,
+            cwd: withholdDir,
+            env: proofInstallEnv(options.npmPaths),
+            quiet: true,
+            allowFailure: true,
+        });
+    }
+    finally {
+        await withheldRegistry.close();
+    }
+    if (result.status === 0) {
+        throw new Error(`Release proof unexpectedly installed without ${withheld.join(", ")}`);
+    }
+    const failure = `${result.stdout}\n${result.stderr}`.toLowerCase();
+    for (const name of withheld) {
+        if (!failure.includes(name.toLowerCase()) &&
+            !failure.includes(name.replace("/", "%2f").toLowerCase())) {
+            throw new Error(`Release proof failed for an unrelated reason while withholding ${name}:\n${`${result.stdout}\n${result.stderr}`.trim().slice(-2000)}`);
+        }
+    }
+    return withheld;
+}
+//# sourceMappingURL=release-consumer-proof.js.map

package/dist/cli/npm/publish/release-consumer-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-consumer-proof.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-consumer-proof.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAM3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,GAE1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gCAAgC,EAChC,MAAM,GACP,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EACL,yBAAyB,EAEzB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAE1F,iFAAiF;AACjF,2EAA2E;AAC3E,MAAM,0BAA0B,GAAG,uBAAuB,CAAC,KAAK,CAAC,SAAS;KACvE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAExF,+EAA+E;AAC/E,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAIpD;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM;SAC3B,MAAM,CACL,CAAC,MAAM,EAAiD,EAAE,CACxD,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAC7C;SACA,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC;QACpD,GAAG,OAAO,CAAC,KAAK;QAChB,OAAO;KACR,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CACtB,sCAAsC,aAAa,CAAC,SAAS,4BAA4B,aAAa,CAAC,OAAO,CAAC,MAAM,iBAAiB,aAAa,CAAC,UAAU,KAAK,CACpK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QACtB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAiB7C;IASC,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,eAAe,GAAG,8BAA8B,CAAC;QACrD,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1D,MAAM,QAAQ,GAAG,sBAAsB,CACrC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,IAAI,EAAE,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,CAAC,KAAK,CAAC;YACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAC5D,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI;QAC/C,eAAe,EAAE,mBAAmB;KACrC,CAAC;IACF,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,MAAM,WAAW,GAAG,4BAA4B,CAAC;QAC/C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;QAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EACrB,4BAA4B,CAAC,QAAQ,CACtC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClD,MAAM,mBAAmB,GAAG,WAAW,CAAC,YAAY,CAAC;IACrD,IAAI,kBAAkB,GAAwB,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAC7D,IAAI,cAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,0BAA0B,CAC7C,IAAI,CAAC,KAAK,CACR,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CACd,MAAM,cAAc,CAAC,QAAQ,CAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EACjD,MAAM,CACP,CACF,CACF,CACF,CAAC;QACF,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAClD,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACjD,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC9C,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,cAAc;gBACpB,CAAC,CAAC,+BAA+B,CAC7B,SAAS,EACT,WAAW,CAAC,+BAA+B,EAAE,EAC7C,OAAO,CAAC,OAAO,CAChB;gBACH,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,YAAY,mBAAmB,IAAI,EAAE;oBAClE,IAAI,EAAE,KAAK;iBACZ,CAAC;SACP,CAAC,CAAC;QACH,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CAAC;YACzD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CACnD,CAAC;QACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAC3B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAU,CAC7C,CACF,CAAC;QACF,MAAM,wBAAwB,GAAG,gCAAgC,CAAC;YAChE,SAAS,EAAE,iBAAiB;YAC5B,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QACH,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;YAC3C,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC;YACtC,CAAC,OAAO,CAAC,cAAc,EACvB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa;YACb,aAAa;YACb,gBAAgB;YAChB,wBAAwB;YACxB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;YACpD,cAAc;YACd,WAAW;YACX,SAAS;YACT,YAAY;YACZ,GAAG,EAAE,kBAAkB,CAAC,QAAQ,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aAClD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,2BAA2B,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtF,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,CAAC,OAAO,EACf,CAAC,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,EAC5C,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAC1C,CAAC;QACF,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC;QACzC,MAAM,SAAS,CAAC,SAAS,CACvB,SAAS,EACT,YAAY,aAAa,CAAC,MAAM,6BAA6B,CAC9D,CAAC;QACF,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,OAAO,CAAC,IAAI,EACZ,aAAa,CACd,CAAC;QACF,MAAM,oBAAoB,GAAG,yBAAyB,CACpD,OAAO,CAAC,IAAI,EACZ,OAAO,CACR,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAC9C,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAC/B,CACF,CAAC;QACF,MAAM,oBAAoB,GAAG;YAC3B,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK;gBACrB,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY;qBACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;qBAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aAC5B,CAAC;SACH,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,yBAAyB,GAAG,MAAM,CAAC,WAAW,CAClD,oBAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CACzC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CACvC,CAAC;YACF,IAAI,CAAC,IAAI;gBACP,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,EAAE,CACtD,CAAC;YACJ,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAC,CACH,CAAC;QACF,MAAM,gBAAgB,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,iBAAiB,EAAE,GAAG,yBAAyB,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC5L,MAAM,SAAS,CAAC,SAAS,CACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,4BAA4B,CAAC,EAC7D,GAAG,IAAI,CAAC,SAAS,CACf,yBAAyB,CAAC;YACxB,oBAAoB;YACpB,iBAAiB,EAAE,cAAc;YACjC,OAAO;SACR,CAAC,EACF,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;QACF,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrF,MAAM,sBAAsB,CAAC;YAC3B,WAAW;YACX,cAAc,EAAE,aAAa,CAAC,MAAM;YACpC,QAAQ;YACR,YAAY,EAAE,mBAAmB;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;YAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW;YACX,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,yBAAyB;YACzB,aAAa;YACb,cAAc;YACd,OAAO;SACR,CAAC,CAAC;QACH,MAAM,6BAA6B,CAAC;YAClC,KAAK,EAAE,eAAe;YACtB,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;YACnD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW;YACX,aAAa;YACb,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;YAC1C,KAAK,EAAE,QAAQ;YACf,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC;YACnD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS;YACT,gBAAgB;YAChB,SAAS,EAAE,CAAC,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC;YACvD,QAAQ;YACR,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,iBAAiB,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI;YACxD,OAAO;YACP,IAAI;YACJ,QAAQ;YACR,GAAG,KAAK;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,GAAG,EAAE,KAAK,EAAE,CAAC;QAC3B,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,wBAAwB,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,SAAS;YACf,SAAS;YACT,cAAc,EAAE,4BAA4B,CAAC,QAAQ;YACrD,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,KAAK,EAAE,CAAC,kBAAkB,CAAC;YAC3B,YAAY,EAAE,mBAAmB;SAClC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAID,mFAAmF;AACnF,SAAS,eAAe,CAAC,KAAoB;IAC3C,OAAO;QACL,GAAG,kBAAkB,CAAC,KAAK,CAAC;QAC5B,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,qBAAqB;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG;IACzB,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,sBAAsB;CACd,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA0B,EAC1B,eAAoC,EACpC,iBAAsC,IAAI,GAAG,EAAE;IAE/C,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;QAC3B,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAC7B;SACA,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,0BAA0B,CAAC,OAOzC;IACC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAC5C,CACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,+BAA+B,CAChD,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAClE,eAAe,EACf,OAAO,CAAC,cAAc,CACvB,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,4BAA4B,eAAe,CAAC,IAAI,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClI,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,GAAG,CACzC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,OAAO,CAAC,WAAW,EACnB,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAC5C,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,EACf,OAAO,CACR,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,uBAAuB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAC9G,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,CACH,CAAC;IACF,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,gEAAgE;AAChE,SAAS,wBAAwB,CAC/B,IAA4B,EAC5B,aAAoE;IAEpE,MAAM,iBAAiB,GAAmD,EAAE,CAAC;IAC7E,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACpD,IAAI,WAAW,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,MAAM,QAAQ,GAAG,yBAAyB,CACxC,aAAa,EACb,WAAW,CAAC,IAAI,EAChB,WAAW,CAAC,QAAQ,CACrB,CAAC;QACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,kEAAkE,WAAW,CAAC,IAAI,KAAK,QAAQ,KAAK,QAAQ,EAAE,CAC/G,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjD,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CAAC,OAQrC;IACC,MAAM,gBAAgB,GAAG;QACvB,SAAS;QACT,YAAY;QACZ,OAAO,CAAC,cAAc;QACtB,GAAG,kBAAkB;KACtB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,OAAO,CAAC,WAAW;YACxB,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtC,KAAK,EAAE,IAAI;YACX,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gCAAgC,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EACrE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,KAAK,UAAU,wBAAwB,CAAC,OAMvC;IACC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;YACzB,GAAG,EAAE,OAAO,CAAC,WAAW;SACzB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,6BAA6B,CAAC,OAS5C;IACC,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CACR,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAC3B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAC5C,CACF;KACF,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACvE,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC;YACvE,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CACrC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CACvC,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,qDAAqD;IACrD,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CACpD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,CAAC,MAAM,CACtB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CACzD,EACD,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,aAAa,EAAE,CACnE,CAAC;IACF,IAAI,MAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CACnB,OAAO,CAAC,SAAS,EACjB,CAAC,SAAS,EAAE,YAAY,EAAE,gBAAgB,CAAC,MAAM,EAAE,GAAG,kBAAkB,CAAC,EACzE;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,WAAW;YAChB,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtC,KAAK,EAAE,IAAI;YACX,YAAY,EAAE,IAAI;SACnB,CACF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gDAAgD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACrC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,EACzD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CACvI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/cli/npm/publish/release-executor.d.ts

@@ -0,0 +1,46 @@
+import { type RuntimeRef } from "@vibesdotdev/kernel";
+import { type ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+/** The sealed release executor, relative to the developer workspace. */
+export declare const RELEASE_EXECUTOR_PATH = "repos/platform/framework/infra-deploy/src/cli/npm/infra-npm-publish.cli-command.impl.ts";
+/**
+ * The Registry package the sealed executor must load, relative to the workspace.
+ */
+export declare const RELEASE_REGISTRY_PATH = "repos/platform/framework/registry";
+/** The framework repository a sealed release executor must come from. */
+export declare const CANONICAL_FRAMEWORK_REPOSITORY = "ssh://git@git.vibes.dev/vibesdotdev/framework.git";
+/**
+ * Proves that the code performing a sealed release comes from the same exact
+ * workspace as its manifest and lock. The ambient CLI may dispatch here, but
+ * neither its Infra Deploy implementation nor its Registry package may do the
+ * release work.
+ */
+export declare function assertRegistryReleaseExecutorProvenance(options: {
+    runtime: ChildEnvRuntime;
+    workspaceRoot: string;
+    infraDeployModuleUrl: string;
+    registryModuleUrl: string;
+}): Promise<{
+    workspaceRoot: string;
+    infraDeployModulePath: string;
+    registryModulePath: string;
+}>;
+/** The repository URL a framework package.json declares. */
+export declare function frameworkRepositoryUrlFromManifest(manifest: unknown): string;
+/** The release executor, relative to the framework checkout. */
+export declare const FRAMEWORK_EXECUTOR_RELATIVE_PATH = "infra-deploy/src/cli/npm/infra-npm-publish.cli-command.impl.ts";
+/** The Registry package, relative to the framework checkout. */
+export declare const FRAMEWORK_REGISTRY_RELATIVE_PATH = "registry";
+/** Throw unless the manifest declares the canonical framework repository. */
+export declare function assertCanonicalFrameworkExecutorIdentity(manifest: unknown): void;
+/**
+ * The framework checkout a sealed follow uses: nested under the workspace, else the workspace.
+ */
+export declare function resolveFollowedFrameworkCheckout(runtime: ChildEnvRuntime, workspaceRoot: string): Promise<string>;
+/**
+ * Throw unless the followed checkout is its own Git top-level with the canonical
+ * framework Forge remote.
+ */
+export declare function assertFollowedFrameworkExecutorIdentity(workspaceRoot: string, 
+/** The runtime whose logger reports a remote that is not a Forge identity. */
+runtime: RuntimeRef): Promise<void>;
+//# sourceMappingURL=release-executor.d.ts.map

package/dist/cli/npm/publish/release-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-executor.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-executor.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAQ3C,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,4FACyD,CAAC;AAC5F;;GAEG;AACH,eAAO,MAAM,qBAAqB,sCAAsC,CAAC;AACzE,yEAAyE;AACzE,eAAO,MAAM,8BAA8B,sDACU,CAAC;AAqCtD;;;;;GAKG;AACH,wBAAsB,uCAAuC,CAAC,OAAO,EAAE;IACrE,OAAO,EAAE,eAAe,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC;IACV,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC,CAqCD;AAED,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CA4B5E;AAED,gEAAgE;AAChE,eAAO,MAAM,gCAAgC,mEACqB,CAAC;AACnE,gEAAgE;AAChE,eAAO,MAAM,gCAAgC,aAAa,CAAC;AA2C3D,6EAA6E;AAC7E,wBAAgB,wCAAwC,CACtD,QAAQ,EAAE,OAAO,GAChB,IAAI,CAkBN;AAED;;GAEG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,eAAe,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;GAGG;AACH,wBAAsB,uCAAuC,CAC3D,aAAa,EAAE,MAAM;AACrB,8EAA8E;AAC9E,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CAwEf"}

package/dist/cli/npm/publish/release-executor.js

@@ -0,0 +1,181 @@
+/**
+ * Sealed release executor identity: the canonical framework checkout that is
+ * allowed to perform Registry release work, and proof that the running modules
+ * are that checkout's.
+ */
+import { realpathChecked, resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { GIT_CHILD_ENV } from "@vibesdotdev/git-operations/core";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { CapabilityError, settleNow, valueFreeFailure, } from "@vibesdotdev/kernel";
+import { getRuntimeExecution } from "@vibesdotdev/kernel/execution";
+import { JsonObjectSchema } from "@vibesdotdev/kernel/schemas/json";
+import { z } from "zod/v4";
+import { infraDeployLogger } from "../../../logger.js";
+import { runRuntimeCommand, } from "../../shared/runtime-execution.js";
+import { canonicalForgeRepositoryIdentity } from "./forge-source-identity.js";
+import { isWithinDirectory, pathExists, resolveOnDiskPath, } from "./fs-paths.js";
+/** The sealed release executor, relative to the developer workspace. */
+export const RELEASE_EXECUTOR_PATH = "repos/platform/framework/infra-deploy/src/cli/npm/infra-npm-publish.cli-command.impl.ts";
+/**
+ * The Registry package the sealed executor must load, relative to the workspace.
+ */
+export const RELEASE_REGISTRY_PATH = "repos/platform/framework/registry";
+/** The framework repository a sealed release executor must come from. */
+export const CANONICAL_FRAMEWORK_REPOSITORY = "ssh://git@git.vibes.dev/vibesdotdev/framework.git";
+function executorRefusal(message, code, reason, details) {
+    if (details === undefined) {
+        return new CapabilityError(message, code, { reason });
+    }
+    return new CapabilityError(message, code, { reason, details });
+}
+/**
+ * Proves that the code performing a sealed release comes from the same exact
+ * workspace as its manifest and lock. The ambient CLI may dispatch here, but
+ * neither its Infra Deploy implementation nor its Registry package may do the
+ * release work.
+ */
+export async function assertRegistryReleaseExecutorProvenance(options) {
+    const pathOwner = await getRuntimePath(options.runtime);
+    const files = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    const workspaceRoot = await realpathChecked(files, options.workspaceRoot);
+    const expectedInfraDeployPath = await realpathChecked(files, pathOwner.join(workspaceRoot, RELEASE_EXECUTOR_PATH));
+    const expectedRegistryRoot = await realpathChecked(files, pathOwner.join(workspaceRoot, RELEASE_REGISTRY_PATH));
+    const infraDeployModulePath = await resolveOnDiskPath(options.runtime, pathOwner.fileURLToPath(options.infraDeployModuleUrl));
+    const registryModulePath = await resolveOnDiskPath(options.runtime, pathOwner.fileURLToPath(options.registryModuleUrl));
+    if (infraDeployModulePath !== expectedInfraDeployPath) {
+        throw executorRefusal(`Release executor escaped the sealed workspace: expected ${expectedInfraDeployPath}, received ${infraDeployModulePath}`, "PERMISSION_DENIED", "release-executor-escaped", { expected: expectedInfraDeployPath, received: infraDeployModulePath });
+    }
+    if (!(await isWithinDirectory(options.runtime, expectedRegistryRoot, registryModulePath))) {
+        throw executorRefusal(`Registry executor escaped the sealed workspace: expected a module under ${expectedRegistryRoot}, received ${registryModulePath}`, "PERMISSION_DENIED", "registry-executor-escaped", { expected: expectedRegistryRoot, received: registryModulePath });
+    }
+    return { workspaceRoot, infraDeployModulePath, registryModulePath };
+}
+/** The repository URL a framework package.json declares. */
+export function frameworkRepositoryUrlFromManifest(manifest) {
+    const parsed = JsonObjectSchema.safeParse(manifest);
+    if (!parsed.success || Array.isArray(parsed.data)) {
+        throw executorRefusal("Sealed publish follow requires a framework package.json object", "INVALID_INPUT", "framework-manifest-not-object");
+    }
+    const asText = z.string().safeParse(parsed.data.repository);
+    let url;
+    if (asText.success) {
+        url = asText.data;
+    }
+    else {
+        const record = JsonObjectSchema.safeParse(parsed.data.repository);
+        if (record.success && !Array.isArray(record.data)) {
+            const field = z.string().safeParse(record.data.url);
+            if (field.success)
+                url = field.data;
+        }
+    }
+    if (!url) {
+        throw executorRefusal("Sealed publish follow requires a Forge repository identity on the framework checkout", "INVALID_INPUT", "framework-repository-missing");
+    }
+    return canonicalForgeRepositoryIdentity(url).repository;
+}
+/** The release executor, relative to the framework checkout. */
+export const FRAMEWORK_EXECUTOR_RELATIVE_PATH = "infra-deploy/src/cli/npm/infra-npm-publish.cli-command.impl.ts";
+/** The Registry package, relative to the framework checkout. */
+export const FRAMEWORK_REGISTRY_RELATIVE_PATH = "registry";
+async function runFrameworkGit(runtime, cwd, args, acceptedExitCodes = [0]) {
+    const execution = await getRuntimeExecution(runtime);
+    const result = await runRuntimeCommand({
+        runtime,
+        execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: [...args],
+        cwd,
+    });
+    const code = result.code ?? -1;
+    const stdout = result.stdout.trim();
+    const stderr = result.stderr.trim();
+    if (!acceptedExitCodes.includes(code)) {
+        throw executorRefusal(`Sealed publish follow git ${args.join(" ")} failed in ${cwd} (exit ${code})`, "UNAVAILABLE", "framework-git-failed", { cwd, exitCode: String(code) });
+    }
+    return { code, stdout, stderr };
+}
+function parseGitRemoteUrls(configOutput) {
+    const urls = [];
+    for (const line of configOutput.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const separator = trimmed.search(/\s+/);
+        if (separator <= 0)
+            continue;
+        urls.push(trimmed.slice(separator).trim());
+    }
+    return urls;
+}
+/** Throw unless the manifest declares the canonical framework repository. */
+export function assertCanonicalFrameworkExecutorIdentity(manifest) {
+    const parsed = JsonObjectSchema.safeParse(manifest);
+    if (!parsed.success || Array.isArray(parsed.data)) {
+        throw executorRefusal("Sealed publish follow requires a framework package.json object", "INVALID_INPUT", "framework-manifest-not-object");
+    }
+    const repository = frameworkRepositoryUrlFromManifest(parsed.data);
+    if (repository !== CANONICAL_FRAMEWORK_REPOSITORY) {
+        throw executorRefusal(`Sealed publish follow requires framework Forge identity ${CANONICAL_FRAMEWORK_REPOSITORY}, received ${repository}`, "INVALID_INPUT", "framework-repository-identity", { expected: CANONICAL_FRAMEWORK_REPOSITORY, received: repository });
+    }
+}
+/**
+ * The framework checkout a sealed follow uses: nested under the workspace, else the workspace.
+ */
+export async function resolveFollowedFrameworkCheckout(runtime, workspaceRoot) {
+    const pathOwner = await getRuntimePath(runtime);
+    const files = await resolveFileSystemAdapter(runtime, { binding: false });
+    const nested = pathOwner.join(workspaceRoot, "repos/platform/framework");
+    if (await pathExists(runtime, nested, { binding: false })) {
+        return realpathChecked(files, nested);
+    }
+    return realpathChecked(files, workspaceRoot);
+}
+/**
+ * Throw unless the followed checkout is its own Git top-level with the canonical
+ * framework Forge remote.
+ */
+export async function assertFollowedFrameworkExecutorIdentity(workspaceRoot, 
+/** The runtime whose logger reports a remote that is not a Forge identity. */
+runtime) {
+    const frameworkRoot = await resolveFollowedFrameworkCheckout(runtime, workspaceRoot);
+    const files = await resolveFileSystemAdapter(runtime, { binding: false });
+    const topLevel = await realpathChecked(files, (await runFrameworkGit(runtime, frameworkRoot, ["rev-parse", "--show-toplevel"])).stdout);
+    if (topLevel !== frameworkRoot) {
+        throw executorRefusal(`Sealed publish follow requires nested framework Git top-level ${frameworkRoot}, received ${topLevel}`, "INVALID_INPUT", "framework-git-toplevel", { expected: frameworkRoot, received: topLevel });
+    }
+    const remoteConfig = await runFrameworkGit(runtime, frameworkRoot, ["config", "--get-regexp", String.raw `^remote\..*\.url$`], [0, 1]);
+    const remotes = parseGitRemoteUrls(remoteConfig.stdout);
+    const identities = remotes.flatMap((url) => {
+        const identity = settleNow(() => canonicalForgeRepositoryIdentity(url).repository);
+        if (!identity.ok) {
+            // A remote that is not a Forge URL cannot satisfy the canonical-remote check.
+            infraDeployLogger(runtime).debug("Framework remote is not a Forge repository identity", {
+                url,
+                reason: valueFreeFailure(identity.cause).name,
+            });
+            return [];
+        }
+        return [identity.value];
+    });
+    if (!identities.includes(CANONICAL_FRAMEWORK_REPOSITORY)) {
+        throw executorRefusal(`Sealed publish follow requires framework Forge remote ${CANONICAL_FRAMEWORK_REPOSITORY}`, "UNAVAILABLE", "framework-remote-missing", { repository: CANONICAL_FRAMEWORK_REPOSITORY });
+    }
+    const dirty = (await runFrameworkGit(runtime, frameworkRoot, [
+        "status",
+        "--porcelain",
+        "--untracked-files=no",
+        "--",
+        FRAMEWORK_EXECUTOR_RELATIVE_PATH,
+        FRAMEWORK_REGISTRY_RELATIVE_PATH,
+    ])).stdout;
+    if (dirty) {
+        throw executorRefusal(`Sealed publish follow requires a clean framework executor and registry; dirty pathspecs:\n${dirty}`, "PERMISSION_DENIED", "framework-executor-dirty", { pathspecs: dirty });
+    }
+    const landed = await runFrameworkGit(runtime, frameworkRoot, ["merge-base", "--is-ancestor", "HEAD", "forge/main"], [0, 1, 128]);
+    if (landed.code !== 0) {
+        throw executorRefusal("Sealed publish follow requires framework HEAD reachable from canonical forge/main", "UNAVAILABLE", "framework-head-unlanded", { repository: CANONICAL_FRAMEWORK_REPOSITORY });
+    }
+}
+//# sourceMappingURL=release-executor.js.map