create-principles-disciple 1.134.8 → 1.135.0

package/dist/update/release-metadata-publisher.js

@@ -0,0 +1,340 @@
+/**
+ * Release metadata publisher (PRI-727) — the production supply side of the
+ * read contracts in release-metadata-source.ts / trust-metadata.ts.
+ *
+ * For one release this module emits EXACTLY the byte set ReleaseManager
+ * already consumes (see apply-payload.ts and release-manager.ts):
+ *
+ *   root.json / timestamp.json / snapshot.json / targets.json       TUF chain
+ *   targets/channels/<channel>.json                                 signed channel pointer payload
+ *   targets/releases/<releaseId>/metadata.json                      release metadata payload
+ *   targets/releases/<releaseId>/release-asset-<platform>-<arch>.tar.gz
+ *
+ * No second release identity: releaseId and the canonical digests come from
+ * deriveReleaseId/buildReleaseMetadata, and both produced documents are
+ * re-validated with the SAME strict parsers the ReleaseManager uses, so a
+ * publisher-side defect fails here instead of at an install. Publication is
+ * byte-deterministic: the same identity inputs, the same signing key and the
+ * same previous-state TUF versions re-emit identical files (idempotent
+ * re-publish of one release is a no-op, not a mutation).
+ *
+ * Advance discipline: the channel pointer is only produced together with the
+ * artifact target whose sha256 is bound into the release metadata — there is
+ * no API shape that advances the pointer without the verifiable artifact
+ * existing in the same file set. Monotonicity against the currently
+ * published channel pointer (`previous`) is enforced here, fail-loud, before
+ * any bytes are emitted.
+ *
+ * Trust material: one ed25519 key signs all four TUF roles — the same
+ * single-key shape the ReleaseManager test suite verifies against. The
+ * install side pins root.json at install time, so this module never rotates
+ * the root (root version stays 1; rotation is separate governance work).
+ */
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign as cryptoSign } from 'node:crypto';
+import { gzipSync } from 'node:zlib';
+import { Key, MetaFile, Metadata, Root, Signature, Snapshot, TargetFile, Targets, Timestamp, } from '@tufjs/models';
+import { parseChannelMetadata } from './channel-metadata.js';
+import { buildReleaseMetadata, } from './release-metadata.js';
+import { isReleaseChannelName, } from './product-identity.js';
+import { canonicalJson } from './release-identity.js';
+export const RELEASE_PUBLICATION_TUF_SPEC_VERSION = '1.0.31';
+export class ReleasePublicationError extends Error {
+    code;
+    field;
+    nextAction;
+    // eslint-disable-next-line @typescript-eslint/max-params -- (code, field, message, nextAction) mirrors the four fields of the consumer refusal contract (same shape as ReleaseManagerError / ReleaseTrustError)
+    constructor(code, field, message, nextAction) {
+        super(message);
+        this.name = 'ReleasePublicationError';
+        this.code = code;
+        this.field = field;
+        this.nextAction = nextAction;
+    }
+}
+const RFC3339_UTC_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function requirePositiveInteger(value, field) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
+        throw new ReleasePublicationError('invalid_input', field, `${field} must be a positive safe integer, got: ${JSON.stringify(value)}`, 'Pass an explicit monotonic value and retry the publication.');
+    }
+    return value;
+}
+function requireExpiresAt(value) {
+    if (typeof value !== 'string' || !RFC3339_UTC_PATTERN.test(value) || Number.isNaN(Date.parse(value))) {
+        throw new ReleasePublicationError('invalid_input', 'expiresAt', `expiresAt must be an RFC3339 UTC timestamp ending in Z, got: ${JSON.stringify(value)}`, 'Pass an explicit expiry (for example 2026-12-01T00:00:00Z); implicit defaults would break reproducible re-publication.');
+    }
+    if (Date.parse(value) <= Date.now()) {
+        throw new ReleasePublicationError('expires_not_future', 'expiresAt', `expiresAt must be in the future, got: ${value}`, 'Publish with an expiry ahead of the release window; clients refuse expired metadata.');
+    }
+    return value;
+}
+function requireSigner(signingKeyPem) {
+    if (typeof signingKeyPem !== 'string' || signingKeyPem.trim().length === 0) {
+        throw new ReleasePublicationError('signing_key_invalid', 'signingKeyPem', 'The release signing key is empty.', 'Provide the ed25519 private key PEM (CI secret) that matches the pinned trust root.');
+    }
+    let privateKey;
+    try {
+        privateKey = createPrivateKey(signingKeyPem);
+    }
+    catch (error) {
+        throw new ReleasePublicationError('signing_key_invalid', 'signingKeyPem', `The release signing key is not a parseable private key: ${error instanceof Error ? error.message : String(error)}`, 'Provide a PEM-encoded ed25519 private key.');
+    }
+    if (privateKey.asymmetricKeyType !== 'ed25519') {
+        throw new ReleasePublicationError('signing_key_invalid', 'signingKeyPem', `The release signing key must be an ed25519 key, got: ${String(privateKey.asymmetricKeyType)}`, 'Generate an ed25519 key for the release trust material.');
+    }
+    const publicKeyPem = createPublicKey(privateKey).export({ type: 'spki', format: 'pem' }).toString();
+    // Deterministic key id derived from the public key material, so the same
+    // key always produces the same root.json bytes (reproducibility).
+    const keyId = createHash('sha256').update(publicKeyPem).digest('hex');
+    return { keyId, privateKey };
+}
+function signedTufMetadata(signed, signer) {
+    const metadata = new Metadata(signed);
+    metadata.sign((data) => new Signature({ keyID: signer.keyId, sig: cryptoSign(null, data, signer.privateKey).toString('hex') }), false);
+    return Buffer.from(JSON.stringify(metadata.toJSON()), 'utf8');
+}
+function deterministicJsonBytes(value) {
+    return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
+}
+function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+function withFileDigests(files) {
+    return files.map((file) => ({ path: file.path, sha256: sha256Hex(file.bytes), sizeBytes: file.bytes.length }));
+}
+/**
+ * Gzip wrapper for a built release archive. Node's zlib emits a deterministic
+ * gzip header (no embedded mtime or file name), so the same archive bytes
+ * always produce the same published artifact bytes — the CLI `gzip` would not
+ * (it stores name + mtime in the header).
+ */
+export function gzipReleaseArchive(archiveBytes) {
+    return gzipSync(archiveBytes);
+}
+/**
+ * Parses a `sha256sum`-style digest file (`<hex>` or `<hex>  <name>`) into
+ * the lowercase hex digest, failing loud on anything else.
+ */
+export function parseSha256DigestFile(content) {
+    const firstToken = content.trim().split(/\s+/, 1)[0] ?? '';
+    if (!/^[a-f0-9]{64}$/i.test(firstToken)) {
+        throw new ReleasePublicationError('invalid_input', 'digestFile', `The release archive digest file does not contain a sha256 hex digest: ${JSON.stringify(firstToken.slice(0, 72))}`, 'Regenerate the release asset so its .sha256 sidecar exists, then retry.');
+    }
+    return firstToken.toLowerCase();
+}
+/**
+ * True when the input is a syntactically valid RFC3339 UTC timestamp
+ * (`...Z`). Exported for CLI argument validation before any IO happens.
+ */
+export function isRfc3339UtcTimestamp(value) {
+    return typeof value === 'string' && RFC3339_UTC_PATTERN.test(value) && !Number.isNaN(Date.parse(value));
+}
+function resolvePreviousState(input, channelPayload) {
+    const { previous } = input;
+    if (previous === undefined || previous === null) {
+        return { previousChannel: null, versions: { root: 1, timestamp: 1, snapshot: 1, targets: 1 } };
+    }
+    if (previous.channelPayload !== undefined && previous.channelPayload !== null) {
+        if (!isPlainObject(previous.channelPayload)) {
+            throw new ReleasePublicationError('invalid_input', 'previous.channelPayload', 'The previously published channel payload is not a JSON object.', 'Inspect the published metadata repository; a corrupt pointer must be repaired before publishing.');
+        }
+        // A published pointer without its TUF versions would let this publication
+        // emit metadata versions the published repository already superseded —
+        // a rollback clients must reject. Require the full previous state.
+        const versions = previous.tufVersions;
+        if (versions === undefined || versions.root === undefined || versions.timestamp === undefined
+            || versions.snapshot === undefined || versions.targets === undefined) {
+            throw new ReleasePublicationError('invalid_input', 'previous.tufVersions', 'Publishing over an existing metadata repository requires the published TUF metadata versions (root/timestamp/snapshot/targets).', 'Read the versions from the currently published repository and pass them as the previous state.');
+        }
+        // Strict parse: a corrupt previous pointer fails the publication instead
+        // of being silently treated as absent (rc-3).
+        const previousChannel = parseChannelMetadata(previous.channelPayload);
+        if (previousChannel.channel !== input.channel) {
+            throw new ReleasePublicationError('invalid_input', 'previous.channelPayload', `The previously published pointer is for channel "${previousChannel.channel}", not "${input.channel}".`, 'Read the previous state of the channel being published.');
+        }
+        const sameRelease = previousChannel.releaseId === channelPayload.releaseId;
+        if (sameRelease) {
+            // Re-publishing one release is only legitimate as an exact no-op: any
+            // content change (sequence, pointer version, expiry) would mutate an
+            // immutable release identity. Equality is checked on the canonical
+            // channel payload so formatting cannot fake or break it.
+            if (canonicalJson(previous.channelPayload) !== canonicalJson(channelPayload)) {
+                throw new ReleasePublicationError('publication_conflict', 'releaseId', `Release ${channelPayload.releaseId.slice(0, 12)} is already published with different pointer content (publicationSequence ${previousChannel.publicationSequence} vs ${channelPayload.publicationSequence}, pointer version ${previousChannel.version} vs ${channelPayload.version}).`, 'Re-publish with the identical inputs that produced the published release, or publish a NEW release with a strictly higher publication sequence.');
+            }
+        }
+        else {
+            if (channelPayload.publicationSequence <= previousChannel.publicationSequence) {
+                throw new ReleasePublicationError('publication_not_monotonic', 'publicationSequence', `The new publicationSequence (${channelPayload.publicationSequence}) must be strictly greater than the published one (${previousChannel.publicationSequence}).`, 'Advance the publication sequence; the channel pointer must never move backwards.');
+            }
+            if (channelPayload.version <= previousChannel.version) {
+                throw new ReleasePublicationError('publication_not_monotonic', 'channelVersion', `The new channel pointer version (${channelPayload.version}) must be strictly greater than the published one (${previousChannel.version}).`, 'Advance the channel pointer version; signed pointer versions must never repeat or regress.');
+            }
+        }
+        return {
+            previousChannel,
+            versions: {
+                root: versions.root,
+                // An identical re-publish keeps the SAME TUF metadata versions (the
+                // emitted bytes must stay identical); an advance bumps every
+                // non-root role so clients see fresh metadata.
+                timestamp: sameRelease ? versions.timestamp : versions.timestamp + 1,
+                snapshot: sameRelease ? versions.snapshot : versions.snapshot + 1,
+                targets: sameRelease ? versions.targets : versions.targets + 1,
+            },
+        };
+    }
+    const versions = previous.tufVersions ?? {};
+    return {
+        previousChannel: null,
+        versions: { root: versions.root ?? 1, timestamp: (versions.timestamp ?? 0) + 1, snapshot: (versions.snapshot ?? 0) + 1, targets: (versions.targets ?? 0) + 1 },
+    };
+}
+/**
+ * Builds the complete signed release publication. Pure: no filesystem or
+ * network IO — callers (the publish script / CI) own byte transport.
+ */
+export function buildReleasePublication(input) {
+    if (!isReleaseChannelName(input.channel)) {
+        throw new ReleasePublicationError('invalid_input', 'channel', `channel must be "stable" or "candidate", got: ${JSON.stringify(input.channel)}`, 'Publish to a configured release channel.');
+    }
+    requirePositiveInteger(input.channelVersion, 'channelVersion');
+    requirePositiveInteger(input.publicationSequence, 'publicationSequence');
+    requireExpiresAt(input.expiresAt);
+    if (!Buffer.isBuffer(input.archive.bytes) || input.archive.bytes.length === 0) {
+        throw new ReleasePublicationError('invalid_input', 'archive.bytes', 'The release archive is empty or missing.', 'Build the self-contained release asset first; nothing is published without the artifact bytes.');
+    }
+    const signer = requireSigner(input.signingKeyPem);
+    const artifactBytes = input.archive.bytes;
+    const artifactSha256 = sha256Hex(artifactBytes);
+    // Artifact bytes are finalized FIRST: the release metadata binds their
+    // digest, the channel binds the metadata digest. By construction the
+    // emitted channel pointer can never reference an artifact that is not part
+    // of the same publication.
+    const releaseMetadata = buildReleaseMetadata({
+        productVersion: input.productVersion,
+        sourceCommit: input.sourceCommit,
+        minBootstrapVersion: input.minBootstrapVersion,
+        publicationSequence: input.publicationSequence,
+        expiresAt: input.expiresAt,
+        assets: [{
+                platform: input.archive.platform,
+                arch: input.archive.arch,
+                nodeAbi: input.archive.nodeAbi,
+                archiveSha256: artifactSha256,
+                archiveSizeBytes: artifactBytes.length,
+            }],
+        dataSchemaForwardReadableFrom: input.dataSchemaForwardReadableFrom,
+    });
+    const channelPayload = {
+        schemaVersion: 1,
+        channel: input.channel,
+        version: input.channelVersion,
+        expiresAt: input.expiresAt,
+        releaseMetadataDigest: releaseMetadata.metadataDigest,
+        releaseId: releaseMetadata.releaseId,
+        productVersion: releaseMetadata.productVersion,
+        publicationSequence: releaseMetadata.publicationSequence,
+    };
+    // Consume-side strict re-validation: if the publisher ever produces a
+    // document the ReleaseManager would refuse, refuse here instead.
+    parseChannelMetadata(channelPayload);
+    const { versions } = resolvePreviousState(input, channelPayload);
+    const channelTargetPath = `channels/${input.channel}.json`;
+    const metadataTargetPath = `releases/${releaseMetadata.releaseId}/metadata.json`;
+    const artifactTargetPath = `releases/${releaseMetadata.releaseId}/release-asset-${input.archive.platform}-${input.archive.arch}.tar.gz`;
+    const channelPayloadBytes = deterministicJsonBytes(channelPayload);
+    const releaseMetadataBytes = deterministicJsonBytes(releaseMetadata);
+    const targets = new Targets({
+        version: versions.targets,
+        specVersion: RELEASE_PUBLICATION_TUF_SPEC_VERSION,
+        expires: input.expiresAt,
+        targets: {
+            [channelTargetPath]: new TargetFile({
+                path: channelTargetPath,
+                length: channelPayloadBytes.length,
+                hashes: { sha256: sha256Hex(channelPayloadBytes) },
+                unrecognizedFields: {
+                    custom: { releaseId: releaseMetadata.releaseId, channel: input.channel, platform: 'metadata' },
+                },
+            }),
+            [metadataTargetPath]: new TargetFile({
+                path: metadataTargetPath,
+                length: releaseMetadataBytes.length,
+                hashes: { sha256: sha256Hex(releaseMetadataBytes) },
+                unrecognizedFields: {
+                    custom: { releaseId: releaseMetadata.releaseId, channel: input.channel, platform: 'metadata' },
+                },
+            }),
+            [artifactTargetPath]: new TargetFile({
+                path: artifactTargetPath,
+                length: artifactBytes.length,
+                hashes: { sha256: artifactSha256 },
+                unrecognizedFields: {
+                    custom: { releaseId: releaseMetadata.releaseId, channel: input.channel, platform: input.archive.platform },
+                },
+            }),
+        },
+    });
+    const root = new Root({
+        version: versions.root,
+        specVersion: RELEASE_PUBLICATION_TUF_SPEC_VERSION,
+        expires: input.expiresAt,
+        consistentSnapshot: false,
+    });
+    const signingKey = new Key({
+        keyID: signer.keyId,
+        keyType: 'ed25519',
+        scheme: 'ed25519',
+        keyVal: { public: createPublicKey(signer.privateKey).export({ type: 'spki', format: 'pem' }).toString() },
+    });
+    for (const role of ['root', 'timestamp', 'snapshot', 'targets'])
+        root.addKey(signingKey, role);
+    const files = [
+        { path: 'root.json', bytes: signedTufMetadata(root, signer) },
+        { path: 'timestamp.json', bytes: signedTufMetadata(new Timestamp({
+                version: versions.timestamp,
+                specVersion: RELEASE_PUBLICATION_TUF_SPEC_VERSION,
+                expires: input.expiresAt,
+                snapshotMeta: new MetaFile({ version: versions.snapshot }),
+            }), signer) },
+        { path: 'snapshot.json', bytes: signedTufMetadata(new Snapshot({
+                version: versions.snapshot,
+                specVersion: RELEASE_PUBLICATION_TUF_SPEC_VERSION,
+                expires: input.expiresAt,
+                meta: { 'targets.json': new MetaFile({ version: versions.targets }) },
+            }), signer) },
+        { path: 'targets.json', bytes: signedTufMetadata(targets, signer) },
+        { path: `targets/${channelTargetPath}`, bytes: channelPayloadBytes },
+        { path: `targets/${metadataTargetPath}`, bytes: releaseMetadataBytes },
+        { path: `targets/${artifactTargetPath}`, bytes: artifactBytes },
+    ];
+    const manifest = {
+        releaseId: releaseMetadata.releaseId,
+        productVersion: releaseMetadata.productVersion,
+        channel: input.channel,
+        platform: input.archive.platform,
+        arch: input.archive.arch,
+        nodeAbi: input.archive.nodeAbi,
+        sourceCommit: input.sourceCommit,
+        artifactSha256,
+        artifactSizeBytes: artifactBytes.length,
+        artifactTargetPath,
+        keyId: signer.keyId,
+        signingScheme: 'ed25519',
+        publicationSequence: input.publicationSequence,
+        channelVersion: input.channelVersion,
+        expiresAt: input.expiresAt,
+        files: withFileDigests(files),
+    };
+    return { manifest, releaseMetadata, channelPayload, files };
+}
+/** Ephemeral ed25519 key PEM for dry-run pipelines without configured trust material. */
+export function generateEphemeralSigningKeyPem() {
+    return generateKeyPairSync('ed25519')
+        .privateKey
+        .export({ type: 'pkcs8', format: 'pem' })
+        .toString();
+}
+//# sourceMappingURL=release-metadata-publisher.js.map

package/dist/update/release-metadata-publisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-metadata-publisher.js","sourceRoot":"","sources":["../../src/update/release-metadata-publisher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AACrH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,GAAG,EACH,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,OAAO,EACP,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAwB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,MAAM,CAAC,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAS7D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAA8B;IAClC,KAAK,CAAS;IACd,UAAU,CAAS;IAE5B,gNAAgN;IAChN,YAAY,IAAiC,EAAE,KAAa,EAAE,OAAe,EAAE,UAAkB;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAoFD,MAAM,mBAAmB,GAAG,gDAAgD,CAAC;AAE7E,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,KAAK,EACL,GAAG,KAAK,0CAA0C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EACzE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,WAAW,EACX,gEAAgE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EACvF,wHAAwH,CACzH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,WAAW,EACX,yCAAyC,KAAK,EAAE,EAChD,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,aAAqB;IAC1C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,eAAe,EACf,mCAAmC,EACnC,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,UAA+C,CAAC;IACpD,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,eAAe,EACf,2DAA2D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACnH,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,eAAe,EACf,wDAAwD,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,EAC9F,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpG,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAkD,MAAS,EAAE,MAAqB;IAC1G,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,CACX,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAChH,KAAK,CACN,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,KAAiC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACrD,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,YAAY,EACZ,yEAAyE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAClH,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1G,CAAC;AAOD,SAAS,oBAAoB,CAAC,KAA8B,EAAE,cAA+B;IAC3F,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC9E,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yBAAyB,EACzB,gEAAgE,EAChE,kGAAkG,CACnG,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;eACxF,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sBAAsB,EACtB,iIAAiI,EACjI,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,eAAe,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,yBAAyB,EACzB,oDAAoD,eAAe,CAAC,OAAO,WAAW,KAAK,CAAC,OAAO,IAAI,EACvG,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,KAAK,cAAc,CAAC,SAAS,CAAC;QAC3E,IAAI,WAAW,EAAE,CAAC;YAChB,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,yDAAyD;YACzD,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EACtB,WAAW,EACX,WAAW,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6EAA6E,eAAe,CAAC,mBAAmB,OAAO,cAAc,CAAC,mBAAmB,qBAAqB,eAAe,CAAC,OAAO,OAAO,cAAc,CAAC,OAAO,IAAI,EACtR,iJAAiJ,CAClJ,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,cAAc,CAAC,mBAAmB,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC;gBAC9E,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,EAC3B,qBAAqB,EACrB,gCAAgC,cAAc,CAAC,mBAAmB,sDAAsD,eAAe,CAAC,mBAAmB,IAAI,EAC/J,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,cAAc,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;gBACtD,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,EAC3B,gBAAgB,EAChB,oCAAoC,cAAc,CAAC,OAAO,sDAAsD,eAAe,CAAC,OAAO,IAAI,EAC3I,4FAA4F,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,eAAe;YACf,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,oEAAoE;gBACpE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC;gBACpE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC;gBACjE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC;aAC/D;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;IAC5C,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE;KAC/J,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA8B;IACpE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,SAAS,EACT,iDAAiD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAChF,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,sBAAsB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC/D,sBAAsB,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IACzE,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,eAAe,EACf,0CAA0C,EAC1C,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAElD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,cAAc,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAChD,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,eAAe,GAAG,oBAAoB,CAAC;QAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,CAAC;gBACP,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;gBAChC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;gBAC9B,aAAa,EAAE,cAAc;gBAC7B,gBAAgB,EAAE,aAAa,CAAC,MAAM;aACvC,CAAC;QACF,6BAA6B,EAAE,KAAK,CAAC,6BAA6B;KACnE,CAAC,CAAC;IAEH,MAAM,cAAc,GAAoB;QACtC,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,cAAc;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,qBAAqB,EAAE,eAAe,CAAC,cAAc;QACrD,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;KACzD,CAAC;IACF,sEAAsE;IACtE,iEAAiE;IACjE,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAErC,MAAM,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,YAAY,KAAK,CAAC,OAAO,OAAO,CAAC;IAC3D,MAAM,kBAAkB,GAAG,YAAY,eAAe,CAAC,SAAS,gBAAgB,CAAC;IACjF,MAAM,kBAAkB,GAAG,YAAY,eAAe,CAAC,SAAS,kBAAkB,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACxI,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,OAAO,EAAE;YACP,CAAC,iBAAiB,CAAC,EAAE,IAAI,UAAU,CAAC;gBAClC,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,mBAAmB,CAAC,MAAM;gBAClC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,mBAAmB,CAAC,EAAE;gBAClD,kBAAkB,EAAE;oBAClB,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE;iBAC/F;aACF,CAAC;YACF,CAAC,kBAAkB,CAAC,EAAE,IAAI,UAAU,CAAC;gBACnC,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,oBAAoB,CAAC,MAAM;gBACnC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,oBAAoB,CAAC,EAAE;gBACnD,kBAAkB,EAAE;oBAClB,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE;iBAC/F;aACF,CAAC;YACF,CAAC,kBAAkB,CAAC,EAAE,IAAI,UAAU,CAAC;gBACnC,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;gBAClC,kBAAkB,EAAE;oBAClB,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;iBAC3G;aACF,CAAC;SACH;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,kBAAkB,EAAE,KAAK;KAC1B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;KAC1G,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE/F,MAAM,KAAK,GAAsB;QAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;QAC7D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,SAAS,CAAC;gBAC/D,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,WAAW,EAAE,oCAAoC;gBACjD,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,YAAY,EAAE,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;aAC3D,CAAC,EAAE,MAAM,CAAC,EAAE;QACb,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,QAAQ,CAAC;gBAC7D,OAAO,EAAE,QAAQ,CAAC,QAAQ;gBAC1B,WAAW,EAAE,oCAAoC;gBACjD,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE;aACtE,CAAC,EAAE,MAAM,CAAC,EAAE;QACb,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE;QACnE,EAAE,IAAI,EAAE,WAAW,iBAAiB,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE;QACpE,EAAE,IAAI,EAAE,WAAW,kBAAkB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACtE,EAAE,IAAI,EAAE,WAAW,kBAAkB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;KAChE,CAAC;IAEF,MAAM,QAAQ,GAA+B;QAC3C,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,cAAc,EAAE,eAAe,CAAC,cAAc;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc;QACd,iBAAiB,EAAE,aAAa,CAAC,MAAM;QACvC,kBAAkB;QAClB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,SAAS;QACxB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;KAC9B,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,8BAA8B;IAC5C,OAAO,mBAAmB,CAAC,SAAS,CAAC;SAClC,UAAU;SACV,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACxC,QAAQ,EAAE,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-principles-disciple",
-  "version": "1.134.8",
+  "version": "1.135.0",
   "description": "Interactive CLI installer for Principles Disciple OpenClaw plugin",
   "type": "module",
   "bin": {