everything-dev 1.53.2 → 2.0.0-rc.0

package/dist/integrity.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.cjs","names":["fetchResponse","fetchBosConfigFromFastKv"],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\nimport { fetchResponse } from \"./http-client\";\n\nconst DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;\n\ninterface SriUrlOptions {\n  resolveEntryUrl?: boolean;\n  maxBytes?: number;\n}\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nfunction resolveSriTargetUrl(url: string, options?: SriUrlOptions): string {\n  return options?.resolveEntryUrl === false ? url : resolveEntryUrl(url);\n}\n\nfunction getMaxSriResponseBytes(options?: SriUrlOptions): number {\n  return options?.maxBytes ?? DEFAULT_MAX_SRI_RESPONSE_BYTES;\n}\n\nasync function computeSriHashFromResponse(\n  response: Response,\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string> {\n  const maxBytes = getMaxSriResponseBytes(options);\n  const contentLengthHeader = response.headers.get(\"content-length\");\n\n  if (contentLengthHeader) {\n    const contentLength = Number(contentLengthHeader);\n    if (Number.isFinite(contentLength) && contentLength > maxBytes) {\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${contentLength})`,\n      );\n    }\n  }\n\n  if (!response.body) {\n    throw new Error(`[SRI] Missing response body for ${url}`);\n  }\n\n  const hash = createHash(\"sha384\");\n  const reader = response.body.getReader();\n  let totalBytes = 0;\n\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n\n    totalBytes += value.byteLength;\n    if (totalBytes > maxBytes) {\n      await reader.cancel();\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${totalBytes})`,\n      );\n    }\n\n    hash.update(value);\n  }\n\n  return `sha384-${hash.digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string | null> {\n  try {\n    const entryUrl = resolveSriTargetUrl(url, options);\n\n    const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    return await computeSriHashFromResponse(response, entryUrl, options);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport async function verifySriForUrl(\n  url: string,\n  expectedIntegrity: string,\n  options?: SriUrlOptions,\n): Promise<void> {\n  const entryUrl = resolveSriTargetUrl(url, options);\n\n  const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n  if (!response.ok) {\n    console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);\n    return;\n  }\n\n  const computed = await computeSriHashFromResponse(response, entryUrl, options);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  if (app) {\n    for (const [, entry] of Object.entries(app)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  if (plugins) {\n    for (const [, entry] of Object.entries(plugins)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  return hashes;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n\nexport interface DeployResultEntry {\n  url: string;\n  integrity?: string;\n  urlField: string;\n  integrityField?: string;\n}\n\nfunction setNestedPath(obj: Record<string, unknown>, dottedPath: string, value: unknown): void {\n  const keys = dottedPath.split(\".\");\n  let current = obj;\n  for (let i = 0; i < keys.length - 1; i += 1) {\n    const key = keys[i]!;\n    if (current[key] === undefined || current[key] === null || typeof current[key] !== \"object\") {\n      current[key] = {};\n    }\n    current = current[key] as Record<string, unknown>;\n  }\n  current[keys[keys.length - 1]!] = value;\n}\n\nfunction deleteNestedPath(obj: Record<string, unknown>, dottedPath: string): void {\n  const keys = dottedPath.split(\".\");\n  let current = obj;\n  for (let i = 0; i < keys.length - 1; i += 1) {\n    const key = keys[i]!;\n    if (current[key] === undefined || typeof current[key] !== \"object\") return;\n    current = current[key] as Record<string, unknown>;\n  }\n  delete current[keys[keys.length - 1]!];\n}\n\nexport function reportDeployResult(opts: {\n  url: string;\n  integrity?: string | null;\n  bosConfigPath: string;\n  urlField: string;\n  integrityField?: string;\n}): void {\n  console.log(\n    `[BOS_DEPLOY] url=${opts.url} urlField=${opts.urlField} integrityField=${opts.integrityField ?? \"\"} integrity=${opts.integrity ?? \"\"}`,\n  );\n\n  try {\n    const config = JSON.parse(readFileSync(opts.bosConfigPath, \"utf8\")) as Record<string, unknown>;\n    setNestedPath(config, opts.urlField, opts.url);\n    if (opts.integrityField) {\n      if (opts.integrity) {\n        setNestedPath(config, opts.integrityField, opts.integrity);\n      } else {\n        deleteNestedPath(config, opts.integrityField);\n      }\n    }\n    writeFileSync(opts.bosConfigPath, `${JSON.stringify(config, null, 2)}\\n`);\n    console.log(`   ✅ Updated bos.config.json: ${opts.urlField}`);\n    if (opts.integrityField && opts.integrity) {\n      console.log(`   ✅ Updated bos.config.json: ${opts.integrityField}`);\n    }\n  } catch (err) {\n    console.error(\"   ❌ Failed to update bos.config.json:\", (err as Error).message);\n  }\n}\n\nexport function parseDeployLines(output: string): DeployResultEntry[] {\n  const results: DeployResultEntry[] = [];\n  for (const line of output.split(\"\\n\")) {\n    if (!line.includes(\"[BOS_DEPLOY]\")) continue;\n    const urlMatch = line.match(/url=(\\S+)/);\n    const urlFieldMatch = line.match(/urlField=(\\S+)/);\n    if (!urlMatch || !urlFieldMatch) continue;\n    const integrityFieldMatch = line.match(/integrityField=(\\S+)/);\n    const integrityMatch = line.match(/integrity=(\\S+)/);\n    results.push({\n      url: urlMatch[1],\n      urlField: urlFieldMatch[1],\n      integrityField: integrityFieldMatch?.[1] || undefined,\n      integrity: integrityMatch?.[1] || undefined,\n    });\n  }\n  return results;\n}\n\nexport function applyDeployResults(\n  config: Record<string, unknown>,\n  results: DeployResultEntry[],\n): Record<string, unknown> {\n  const merged = structuredClone(config);\n  for (const result of results) {\n    setNestedPath(merged, result.urlField, result.url);\n    if (result.integrityField) {\n      if (result.integrity) {\n        setNestedPath(merged, result.integrityField, result.integrity);\n      } else {\n        deleteNestedPath(merged, result.integrityField);\n      }\n    }\n  }\n  return merged;\n}\n\nexport function findPluginKey(bosConfigPath: string, pluginDir: string): string | null {\n  const config = JSON.parse(readFileSync(bosConfigPath, \"utf8\")) as Record<string, unknown>;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n  if (!plugins) return null;\n  const configRoot = join(bosConfigPath, \"..\");\n  const normalizedPluginDir = pluginDir.replace(/\\\\/g, \"/\").replace(/\\/+$/, \"\");\n  for (const [key, plugin] of Object.entries(plugins)) {\n    const dev = plugin?.development;\n    if (typeof dev !== \"string\" || !dev.startsWith(\"local:\")) continue;\n    const resolved = join(configRoot, dev.slice(\"local:\".length))\n      .replace(/\\\\/g, \"/\")\n      .replace(/\\/+$/, \"\");\n    if (resolved === normalizedPluginDir) return key;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;AAMA,MAAM,iCAAiC,KAAK,OAAO;AAOnD,SAAgB,eAAe,SAAkC;CAC/D,OAAO,sCAAqB,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,QAAQ;AACvE;AAEA,SAAS,oBAAoB,KAAa,SAAiC;CACzE,OAAO,SAAS,oBAAoB,QAAQ,MAAM,gBAAgB,GAAG;AACvE;AAEA,SAAS,uBAAuB,SAAiC;CAC/D,OAAO,SAAS,YAAY;AAC9B;AAEA,eAAe,2BACb,UACA,KACA,SACiB;CACjB,MAAM,WAAW,uBAAuB,OAAO;CAC/C,MAAM,sBAAsB,SAAS,QAAQ,IAAI,gBAAgB;CAEjE,IAAI,qBAAqB;EACvB,MAAM,gBAAgB,OAAO,mBAAmB;EAChD,IAAI,OAAO,SAAS,aAAa,KAAK,gBAAgB,UACpD,MAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,cAAc,EACpF;CAEJ;CAEA,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,mCAAmC,KAAK;CAG1D,MAAM,mCAAkB,QAAQ;CAChC,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,IAAI,aAAa;CAEjB,OAAO,MAAM;EACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;EAC1C,IAAI,MACF;EAGF,cAAc,MAAM;EACpB,IAAI,aAAa,UAAU;GACzB,MAAM,OAAO,OAAO;GACpB,MAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,WAAW,EACjF;EACF;EAEA,KAAK,OAAO,KAAK;CACnB;CAEA,OAAO,UAAU,KAAK,OAAO,QAAQ;AACvC;AAEA,eAAsB,qBACpB,KACA,SACwB;CACxB,IAAI;EACF,MAAM,WAAW,oBAAoB,KAAK,OAAO;EAEjD,MAAM,WAAW,MAAMA,kCAAc,UAAU,EAAE,SAAS,aAAa,CAAC;EACxE,IAAI,CAAC,SAAS,IAAI;GAChB,QAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,YAAY;GAC3F,OAAO;EACT;EACA,OAAO,MAAM,2BAA2B,UAAU,UAAU,OAAO;CACrE,SAAS,OAAO;EACd,QAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,KAC3C;EACA,OAAO;CACT;AACF;AAEA,SAAgB,gBAAgB,KAAqB;CACnD,IAAI,IAAI,SAAS,iBAAiB,GAAG,OAAO;CAC5C,IAAI,IAAI,SAAS,mBAAmB,GAClC,OAAO,GAAG,IAAI,QAAQ,wBAAwB,EAAE,EAAE;CACpD,OAAO,GAAG,IAAI,QAAQ,OAAO,EAAE,EAAE;AACnC;AAEA,eAAsB,gBACpB,KACA,mBACA,SACe;CACf,MAAM,WAAW,oBAAoB,KAAK,OAAO;CAEjD,MAAM,WAAW,MAAMA,kCAAc,UAAU,EAAE,SAAS,aAAa,CAAC;CACxE,IAAI,CAAC,SAAS,IAAI;EAChB,QAAQ,KAAK,yBAAyB,SAAS,qBAAqB,SAAS,QAAQ;EACrF;CACF;CAEA,MAAM,WAAW,MAAM,2BAA2B,UAAU,UAAU,OAAO;CAE7E,IAAI,aAAa,mBACf,MAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,UACjG;AAEJ;AAEA,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,IAAoB;CAEzC,SAAS,KAAa,WAAyB;EAC7C,KAAK,OAAO,IAAI,KAAK,SAAS;CAChC;CAEA,cAAc,SAAiB,WAAyB;EACtD,KAAK,OAAO,IAAI,gBAAgB,OAAO,GAAG,SAAS;CACrD;CAEA,IAAI,KAAiC;EACnC,OAAO,KAAK,OAAO,IAAI,GAAG;CAC5B;CAEA,IAAI,KAAsB;EACxB,OAAO,KAAK,OAAO,IAAI,GAAG;CAC5B;CAEA,UAA8C;EAC5C,OAAO,KAAK,OAAO,QAAQ;CAC7B;AACF;AAEA,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,IAAoB;CACvC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;CAEvB,IAAI,KACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,GAAG,GACxC,IAAI,OAAO,aAAa,OAAO,YAC7B,OAAO,IAAI,gBAAgB,MAAM,UAAoB,GAAG,MAAM,SAAmB;CAErF;CAGF,IAAI,SACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,OAAO,GAC5C,IAAI,OAAO,aAAa,OAAO,YAC7B,OAAO,IAAI,gBAAgB,MAAM,UAAoB,GAAG,MAAM,SAAmB;CAErF;CAGF,OAAO;AACT;AAEA,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,CAAC;CAE9B,IAAI;CACJ,IAAI;EACF,cAAc,MAAMC,wCAAkD,MAAM;CAC9E,SAAS,OAAO;EACd,QAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACzG;EACA,OAAO;GAAE,UAAU;GAAO,YAAY,CAAC,oBAAoB;EAAE;CAC/D;CAEA,MAAM,cAAc,uBAAuB,WAAW;CACtD,MAAM,cAAc,uBAAuB,WAAW;CAEtD,KAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,GAAG;EACrC,IAAI,aAAa,cAAc,WAAW;GACxC,WAAW,KAAK,GAAG;GACnB,QAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,WAClF;EACF;CACF;CAEA,IAAI,WAAW,WAAW,KAAK,YAAY,OAAO,GAChD,QAAQ,IACN,gEAAgE,YAAY,KAAK,kBACnF;CAGF,OAAO;EAAE,UAAU,WAAW,WAAW;EAAG;CAAW;AACzD;AASA,SAAS,cAAc,KAA8B,YAAoB,OAAsB;CAC7F,MAAM,OAAO,WAAW,MAAM,GAAG;CACjC,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;EAC3C,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,SAAS,UAAa,QAAQ,SAAS,QAAQ,OAAO,QAAQ,SAAS,UACjF,QAAQ,OAAO,CAAC;EAElB,UAAU,QAAQ;CACpB;CACA,QAAQ,KAAK,KAAK,SAAS,MAAO;AACpC;AAEA,SAAS,iBAAiB,KAA8B,YAA0B;CAChF,MAAM,OAAO,WAAW,MAAM,GAAG;CACjC,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;EAC3C,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,SAAS,UAAa,OAAO,QAAQ,SAAS,UAAU;EACpE,UAAU,QAAQ;CACpB;CACA,OAAO,QAAQ,KAAK,KAAK,SAAS;AACpC;AAEA,SAAgB,mBAAmB,MAM1B;CACP,QAAQ,IACN,oBAAoB,KAAK,IAAI,YAAY,KAAK,SAAS,kBAAkB,KAAK,kBAAkB,GAAG,aAAa,KAAK,aAAa,IACpI;CAEA,IAAI;EACF,MAAM,SAAS,KAAK,gCAAmB,KAAK,eAAe,MAAM,CAAC;EAClE,cAAc,QAAQ,KAAK,UAAU,KAAK,GAAG;EAC7C,IAAI,KAAK,gBACP,IAAI,KAAK,WACP,cAAc,QAAQ,KAAK,gBAAgB,KAAK,SAAS;OAEzD,iBAAiB,QAAQ,KAAK,cAAc;EAGhD,2BAAc,KAAK,eAAe,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,GAAG;EACxE,QAAQ,IAAI,iCAAiC,KAAK,UAAU;EAC5D,IAAI,KAAK,kBAAkB,KAAK,WAC9B,QAAQ,IAAI,iCAAiC,KAAK,gBAAgB;CAEtE,SAAS,KAAK;EACZ,QAAQ,MAAM,0CAA2C,IAAc,OAAO;CAChF;AACF;AAEA,SAAgB,iBAAiB,QAAqC;CACpE,MAAM,UAA+B,CAAC;CACtC,KAAK,MAAM,QAAQ,OAAO,MAAM,IAAI,GAAG;EACrC,IAAI,CAAC,KAAK,SAAS,cAAc,GAAG;EACpC,MAAM,WAAW,KAAK,MAAM,WAAW;EACvC,MAAM,gBAAgB,KAAK,MAAM,gBAAgB;EACjD,IAAI,CAAC,YAAY,CAAC,eAAe;EACjC,MAAM,sBAAsB,KAAK,MAAM,sBAAsB;EAC7D,MAAM,iBAAiB,KAAK,MAAM,iBAAiB;EACnD,QAAQ,KAAK;GACX,KAAK,SAAS;GACd,UAAU,cAAc;GACxB,gBAAgB,sBAAsB,MAAM;GAC5C,WAAW,iBAAiB,MAAM;EACpC,CAAC;CACH;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,SACyB;CACzB,MAAM,SAAS,gBAAgB,MAAM;CACrC,KAAK,MAAM,UAAU,SAAS;EAC5B,cAAc,QAAQ,OAAO,UAAU,OAAO,GAAG;EACjD,IAAI,OAAO,gBACT,IAAI,OAAO,WACT,cAAc,QAAQ,OAAO,gBAAgB,OAAO,SAAS;OAE7D,iBAAiB,QAAQ,OAAO,cAAc;CAGpD;CACA,OAAO;AACT;AAEA,SAAgB,cAAc,eAAuB,WAAkC;CAErF,MAAM,UADS,KAAK,gCAAmB,eAAe,MAAM,CACvC,CAAC,CAAC;CACvB,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,iCAAkB,eAAe,IAAI;CAC3C,MAAM,sBAAsB,UAAU,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC5E,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,OAAO,GAAG;EACnD,MAAM,MAAM,QAAQ;EACpB,IAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,WAAW,QAAQ,GAAG;EAI1D,wBAHsB,YAAY,IAAI,MAAM,CAAe,CAAC,CAAC,CAC1D,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,QAAQ,EACR,MAAM,qBAAqB,OAAO;CAC/C;CACA,OAAO;AACT"}
+{"version":3,"file":"integrity.cjs","names":["createHash","fetchResponse","Data","fetchBosConfigFromFastKv"],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { Data } from \"effect\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\nimport { fetchResponse } from \"./http-client\";\n\nconst DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;\n\ninterface SriUrlOptions {\n  resolveEntryUrl?: boolean;\n  maxBytes?: number;\n}\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nfunction resolveSriTargetUrl(url: string, options?: SriUrlOptions): string {\n  return options?.resolveEntryUrl === false ? url : resolveEntryUrl(url);\n}\n\nfunction getMaxSriResponseBytes(options?: SriUrlOptions): number {\n  return options?.maxBytes ?? DEFAULT_MAX_SRI_RESPONSE_BYTES;\n}\n\nasync function computeSriHashFromResponse(\n  response: Response,\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string> {\n  const maxBytes = getMaxSriResponseBytes(options);\n  const contentLengthHeader = response.headers.get(\"content-length\");\n\n  if (contentLengthHeader) {\n    const contentLength = Number(contentLengthHeader);\n    if (Number.isFinite(contentLength) && contentLength > maxBytes) {\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${contentLength})`,\n      );\n    }\n  }\n\n  if (!response.body) {\n    throw new Error(`[SRI] Missing response body for ${url}`);\n  }\n\n  const hash = createHash(\"sha384\");\n  const reader = response.body.getReader();\n  let totalBytes = 0;\n\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n\n    totalBytes += value.byteLength;\n    if (totalBytes > maxBytes) {\n      await reader.cancel();\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${totalBytes})`,\n      );\n    }\n\n    hash.update(value);\n  }\n\n  return `sha384-${hash.digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string | null> {\n  const attempts = 3;\n  for (let attempt = 1; attempt < attempts; attempt++) {\n    const hash = await computeSriHashOnce(url, options);\n    if (hash) return hash;\n    await new Promise((resolve) => setTimeout(resolve, 1000 * attempt));\n  }\n  return computeSriHashOnce(url, options);\n}\n\nasync function computeSriHashOnce(url: string, options?: SriUrlOptions): Promise<string | null> {\n  try {\n    const entryUrl = resolveSriTargetUrl(url, options);\n\n    const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    return await computeSriHashFromResponse(response, entryUrl, options);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport class SriVerificationError extends Data.TaggedError(\"SriVerificationError\")<{\n  readonly detail: string;\n}> {\n  constructor(message: string) {\n    super({ detail: message });\n  }\n\n  override get message() {\n    return this.detail;\n  }\n}\n\nexport async function verifySriForUrl(\n  url: string,\n  expectedIntegrity: string,\n  options?: SriUrlOptions,\n): Promise<void> {\n  const entryUrl = resolveSriTargetUrl(url, options);\n\n  const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n  if (!response.ok) {\n    throw new SriVerificationError(\n      `Failed to fetch ${entryUrl} for verification: ${response.status}`,\n    );\n  }\n\n  const computed = await computeSriHashFromResponse(response, entryUrl, options);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  for (const entry of [...Object.values(app ?? {}), ...Object.values(plugins ?? {})]) {\n    if (!entry) continue;\n    const slotHash = slotHashOf(entry);\n    if (slotHash) hashes.set(slotHash.key, slotHash.hash);\n  }\n\n  return hashes;\n}\n\n/**\n * The integrity anchor a slot contributes to local↔chain attestation: pinned\n * slots anchor at the pinned manifest document (the pin's SRI), unpinned\n * slots at their fixed-name entry (the direct entry SRI).\n */\nfunction slotHashOf(entry: Record<string, unknown>): { key: string; hash: string } | null {\n  const production = entry.production;\n  if (typeof production !== \"string\") return null;\n  const pin = entry.pin as { manifest?: unknown; integrity?: unknown } | undefined;\n  if (pin && typeof pin.manifest === \"string\" && typeof pin.integrity === \"string\") {\n    return {\n      key: `${production.replace(/\\/$/, \"\")}/${pin.manifest.replace(/^\\//, \"\")}`,\n      hash: pin.integrity,\n    };\n  }\n  if (typeof entry.integrity === \"string\") {\n    return { key: resolveEntryUrl(production), hash: entry.integrity };\n  }\n  return null;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n\nexport interface DeployResultEntry {\n  url: string;\n  integrity?: string;\n  urlField: string;\n  integrityField?: string;\n  /** A plain pipeline-state value (e.g. the built MF container name). */\n  value?: string;\n  valueField?: string;\n  /** Dotted paths deleted after applying this entry — clears stale\n   * pipeline-state fields (e.g. the retired flat `manifest` pointer). */\n  removeFields?: string[];\n}\n\nfunction setNestedPath(obj: Record<string, unknown>, dottedPath: string, value: unknown): void {\n  const keys = dottedPath.split(\".\");\n  let current = obj;\n  for (let i = 0; i < keys.length - 1; i += 1) {\n    const key = keys[i]!;\n    if (current[key] === undefined || current[key] === null || typeof current[key] !== \"object\") {\n      current[key] = {};\n    }\n    current = current[key] as Record<string, unknown>;\n  }\n  current[keys[keys.length - 1]!] = value;\n}\n\nfunction deleteNestedPath(obj: Record<string, unknown>, dottedPath: string): void {\n  const keys = dottedPath.split(\".\");\n  let current = obj;\n  for (let i = 0; i < keys.length - 1; i += 1) {\n    const key = keys[i]!;\n    if (current[key] === undefined || typeof current[key] !== \"object\") return;\n    current = current[key] as Record<string, unknown>;\n  }\n  delete current[keys[keys.length - 1]!];\n}\n\nexport function applyDeployResults(\n  config: Record<string, unknown>,\n  results: DeployResultEntry[],\n): Record<string, unknown> {\n  const merged = structuredClone(config);\n  for (const result of results) {\n    setNestedPath(merged, result.urlField, result.url);\n    if (result.integrityField) {\n      if (result.integrity) {\n        setNestedPath(merged, result.integrityField, result.integrity);\n      } else {\n        deleteNestedPath(merged, result.integrityField);\n      }\n    }\n    if (result.valueField && result.value !== undefined && result.value !== null) {\n      setNestedPath(merged, result.valueField, result.value);\n    }\n    for (const field of result.removeFields ?? []) {\n      deleteNestedPath(merged, field);\n    }\n  }\n  return merged;\n}\n"],"mappings":";;;;;;;AAKA,MAAM,iCAAiC;AAOvC,SAAgB,eAAe,SAAkC;CAC/D,OAAO,cAAUA,wBAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,QAAQ;AACvE;AAEA,SAAS,oBAAoB,KAAa,SAAiC;CACzE,OAAO,SAAS,oBAAoB,QAAQ,MAAM,gBAAgB,GAAG;AACvE;AAEA,SAAS,uBAAuB,SAAiC;CAC/D,OAAO,SAAS,YAAY;AAC9B;AAEA,eAAe,2BACb,UACA,KACA,SACiB;CACjB,MAAM,WAAW,uBAAuB,OAAO;CAC/C,MAAM,sBAAsB,SAAS,QAAQ,IAAI,gBAAgB;CAEjE,IAAI,qBAAqB;EACvB,MAAM,gBAAgB,OAAO,mBAAmB;EAChD,IAAI,OAAO,SAAS,aAAa,KAAK,gBAAgB,UACpD,MAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,cAAc,EACpF;CAEJ;CAEA,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,mCAAmC,KAAK;CAG1D,MAAM,WAAOA,wBAAW,QAAQ;CAChC,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,IAAI,aAAa;CAEjB,OAAO,MAAM;EACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;EAC1C,IAAI,MACF;EAGF,cAAc,MAAM;EACpB,IAAI,aAAa,UAAU;GACzB,MAAM,OAAO,OAAO;GACpB,MAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,WAAW,EACjF;EACF;EAEA,KAAK,OAAO,KAAK;CACnB;CAEA,OAAO,UAAU,KAAK,OAAO,QAAQ;AACvC;AAEA,eAAsB,qBACpB,KACA,SACwB;CACxB,MAAM,WAAW;CACjB,KAAK,IAAI,UAAU,GAAG,UAAU,UAAU,WAAW;EACnD,MAAM,OAAO,MAAM,mBAAmB,KAAK,OAAO;EAClD,IAAI,MAAM,OAAO;EACjB,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,MAAO,OAAO,CAAC;CACpE;CACA,OAAO,mBAAmB,KAAK,OAAO;AACxC;AAEA,eAAe,mBAAmB,KAAa,SAAiD;CAC9F,IAAI;EACF,MAAM,WAAW,oBAAoB,KAAK,OAAO;EAEjD,MAAM,WAAW,MAAMC,kCAAc,UAAU,EAAE,SAAS,aAAa,CAAC;EACxE,IAAI,CAAC,SAAS,IAAI;GAChB,QAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,YAAY;GAC3F,OAAO;EACT;EACA,OAAO,MAAM,2BAA2B,UAAU,UAAU,OAAO;CACrE,SAAS,OAAO;EACd,QAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,KAC3C;EACA,OAAO;CACT;AACF;AAEA,SAAgB,gBAAgB,KAAqB;CACnD,IAAI,IAAI,SAAS,iBAAiB,GAAG,OAAO;CAC5C,IAAI,IAAI,SAAS,mBAAmB,GAClC,OAAO,GAAG,IAAI,QAAQ,wBAAwB,EAAE,EAAE;CACpD,OAAO,GAAG,IAAI,QAAQ,OAAO,EAAE,EAAE;AACnC;AAEA,IAAa,uBAAb,cAA0CC,YAAK,YAAY,sBAAsB,CAAC,CAE/E;CACD,YAAY,SAAiB;EAC3B,MAAM,EAAE,QAAQ,QAAQ,CAAC;CAC3B;CAEA,IAAa,UAAU;EACrB,OAAO,KAAK;CACd;AACF;AAEA,eAAsB,gBACpB,KACA,mBACA,SACe;CACf,MAAM,WAAW,oBAAoB,KAAK,OAAO;CAEjD,MAAM,WAAW,MAAMD,kCAAc,UAAU,EAAE,SAAS,aAAa,CAAC;CACxE,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,qBACR,mBAAmB,SAAS,qBAAqB,SAAS,QAC5D;CAGF,MAAM,WAAW,MAAM,2BAA2B,UAAU,UAAU,OAAO;CAE7E,IAAI,aAAa,mBACf,MAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,UACjG;AAEJ;AAEA,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,IAAoB;CAEzC,SAAS,KAAa,WAAyB;EAC7C,KAAK,OAAO,IAAI,KAAK,SAAS;CAChC;CAEA,cAAc,SAAiB,WAAyB;EACtD,KAAK,OAAO,IAAI,gBAAgB,OAAO,GAAG,SAAS;CACrD;CAEA,IAAI,KAAiC;EACnC,OAAO,KAAK,OAAO,IAAI,GAAG;CAC5B;CAEA,IAAI,KAAsB;EACxB,OAAO,KAAK,OAAO,IAAI,GAAG;CAC5B;CAEA,UAA8C;EAC5C,OAAO,KAAK,OAAO,QAAQ;CAC7B;AACF;AAEA,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,IAAoB;CACvC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;CAEvB,KAAK,MAAM,SAAS,CAAC,GAAG,OAAO,OAAO,OAAO,CAAC,CAAC,GAAG,GAAG,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG;EAClF,IAAI,CAAC,OAAO;EACZ,MAAM,WAAW,WAAW,KAAK;EACjC,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK,SAAS,IAAI;CACtD;CAEA,OAAO;AACT;;;;;;AAOA,SAAS,WAAW,OAAsE;CACxF,MAAM,aAAa,MAAM;CACzB,IAAI,OAAO,eAAe,UAAU,OAAO;CAC3C,MAAM,MAAM,MAAM;CAClB,IAAI,OAAO,OAAO,IAAI,aAAa,YAAY,OAAO,IAAI,cAAc,UACtE,OAAO;EACL,KAAK,GAAG,WAAW,QAAQ,OAAO,EAAE,EAAE,GAAG,IAAI,SAAS,QAAQ,OAAO,EAAE;EACvE,MAAM,IAAI;CACZ;CAEF,IAAI,OAAO,MAAM,cAAc,UAC7B,OAAO;EAAE,KAAK,gBAAgB,UAAU;EAAG,MAAM,MAAM;CAAU;CAEnE,OAAO;AACT;AAEA,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,CAAC;CAE9B,IAAI;CACJ,IAAI;EACF,cAAc,MAAME,wCAAkD,MAAM;CAC9E,SAAS,OAAO;EACd,QAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACzG;EACA,OAAO;GAAE,UAAU;GAAO,YAAY,CAAC,oBAAoB;EAAE;CAC/D;CAEA,MAAM,cAAc,uBAAuB,WAAW;CACtD,MAAM,cAAc,uBAAuB,WAAW;CAEtD,KAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,GAAG;EACrC,IAAI,aAAa,cAAc,WAAW;GACxC,WAAW,KAAK,GAAG;GACnB,QAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,WAClF;EACF;CACF;CAEA,IAAI,WAAW,WAAW,KAAK,YAAY,OAAO,GAChD,QAAQ,IACN,gEAAgE,YAAY,KAAK,kBACnF;CAGF,OAAO;EAAE,UAAU,WAAW,WAAW;EAAG;CAAW;AACzD;AAeA,SAAS,cAAc,KAA8B,YAAoB,OAAsB;CAC7F,MAAM,OAAO,WAAW,MAAM,GAAG;CACjC,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;EAC3C,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,SAAS,UAAa,QAAQ,SAAS,QAAQ,OAAO,QAAQ,SAAS,UACjF,QAAQ,OAAO,CAAC;EAElB,UAAU,QAAQ;CACpB;CACA,QAAQ,KAAK,KAAK,SAAS,MAAO;AACpC;AAEA,SAAS,iBAAiB,KAA8B,YAA0B;CAChF,MAAM,OAAO,WAAW,MAAM,GAAG;CACjC,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;EAC3C,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,SAAS,UAAa,OAAO,QAAQ,SAAS,UAAU;EACpE,UAAU,QAAQ;CACpB;CACA,OAAO,QAAQ,KAAK,KAAK,SAAS;AACpC;AAEA,SAAgB,mBACd,QACA,SACyB;CACzB,MAAM,SAAS,gBAAgB,MAAM;CACrC,KAAK,MAAM,UAAU,SAAS;EAC5B,cAAc,QAAQ,OAAO,UAAU,OAAO,GAAG;EACjD,IAAI,OAAO,gBAAgB;GACzB,IAAI,OAAO,WACT,cAAc,QAAQ,OAAO,gBAAgB,OAAO,SAAS;QAE7D,iBAAiB,QAAQ,OAAO,cAAc;EAElD;EACA,IAAI,OAAO,cAAc,OAAO,UAAU,UAAa,OAAO,UAAU,MACtE,cAAc,QAAQ,OAAO,YAAY,OAAO,KAAK;EAEvD,KAAK,MAAM,SAAS,OAAO,gBAAgB,CAAC,GAC1C,iBAAiB,QAAQ,KAAK;CAElC;CACA,OAAO;AACT"}

package/dist/integrity.d.cts

@@ -6,6 +6,15 @@ interface SriUrlOptions {
 declare function computeSriHash(content: string | Buffer): string;
 declare function computeSriHashForUrl(url: string, options?: SriUrlOptions): Promise<string | null>;
 declare function resolveEntryUrl(url: string): string;
+declare const SriVerificationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SriVerificationError";
+} & Readonly<A>;
+declare class SriVerificationError extends SriVerificationError_base<{
+  readonly detail: string;
+}> {
+  constructor(message: string);
+  get message(): string;
+}
 declare function verifySriForUrl(url: string, expectedIntegrity: string, options?: SriUrlOptions): Promise<void>;
 declare class IntegrityRegistry {
   private hashes;
@@ -24,17 +33,14 @@ interface DeployResultEntry {
   integrity?: string;
   urlField: string;
   integrityField?: string;
+  /** A plain pipeline-state value (e.g. the built MF container name). */
+  value?: string;
+  valueField?: string;
+  /** Dotted paths deleted after applying this entry — clears stale
+   * pipeline-state fields (e.g. the retired flat `manifest` pointer). */
+  removeFields?: string[];
 }
-declare function reportDeployResult(opts: {
-  url: string;
-  integrity?: string | null;
-  bosConfigPath: string;
-  urlField: string;
-  integrityField?: string;
-}): void;
-declare function parseDeployLines(output: string): DeployResultEntry[];
 declare function applyDeployResults(config: Record<string, unknown>, results: DeployResultEntry[]): Record<string, unknown>;
-declare function findPluginKey(bosConfigPath: string, pluginDir: string): string | null;
 //#endregion
-export { DeployResultEntry, IntegrityRegistry, applyDeployResults, computeSriHash, computeSriHashForUrl, findPluginKey, parseDeployLines, reportDeployResult, resolveEntryUrl, verifyConfigAgainstChain, verifySriForUrl };
+export { DeployResultEntry, IntegrityRegistry, SriVerificationError, applyDeployResults, computeSriHash, computeSriHashForUrl, resolveEntryUrl, verifyConfigAgainstChain, verifySriForUrl };
 //# sourceMappingURL=integrity.d.cts.map

package/dist/integrity.d.mts

@@ -6,6 +6,15 @@ interface SriUrlOptions {
 declare function computeSriHash(content: string | Buffer): string;
 declare function computeSriHashForUrl(url: string, options?: SriUrlOptions): Promise<string | null>;
 declare function resolveEntryUrl(url: string): string;
+declare const SriVerificationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SriVerificationError";
+} & Readonly<A>;
+declare class SriVerificationError extends SriVerificationError_base<{
+  readonly detail: string;
+}> {
+  constructor(message: string);
+  get message(): string;
+}
 declare function verifySriForUrl(url: string, expectedIntegrity: string, options?: SriUrlOptions): Promise<void>;
 declare class IntegrityRegistry {
   private hashes;
@@ -24,17 +33,14 @@ interface DeployResultEntry {
   integrity?: string;
   urlField: string;
   integrityField?: string;
+  /** A plain pipeline-state value (e.g. the built MF container name). */
+  value?: string;
+  valueField?: string;
+  /** Dotted paths deleted after applying this entry — clears stale
+   * pipeline-state fields (e.g. the retired flat `manifest` pointer). */
+  removeFields?: string[];
 }
-declare function reportDeployResult(opts: {
-  url: string;
-  integrity?: string | null;
-  bosConfigPath: string;
-  urlField: string;
-  integrityField?: string;
-}): void;
-declare function parseDeployLines(output: string): DeployResultEntry[];
 declare function applyDeployResults(config: Record<string, unknown>, results: DeployResultEntry[]): Record<string, unknown>;
-declare function findPluginKey(bosConfigPath: string, pluginDir: string): string | null;
 //#endregion
-export { DeployResultEntry, IntegrityRegistry, applyDeployResults, computeSriHash, computeSriHashForUrl, findPluginKey, parseDeployLines, reportDeployResult, resolveEntryUrl, verifyConfigAgainstChain, verifySriForUrl };
+export { DeployResultEntry, IntegrityRegistry, SriVerificationError, applyDeployResults, computeSriHash, computeSriHashForUrl, resolveEntryUrl, verifyConfigAgainstChain, verifySriForUrl };
 //# sourceMappingURL=integrity.d.mts.map

package/dist/integrity.mjs

@@ -1,11 +1,10 @@
 import { fetchResponse } from "./http-client.mjs";
 import { fetchBosConfigFromFastKv } from "./fastkv.mjs";
-import { readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { Data } from "effect";
 import { createHash } from "node:crypto";
 
 //#region src/integrity.ts
-const DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;
+const DEFAULT_MAX_SRI_RESPONSE_BYTES = 20971520;
 function computeSriHash(content) {
 	return `sha384-${createHash("sha384").update(content).digest("base64")}`;
 }
@@ -39,6 +38,15 @@ async function computeSriHashFromResponse(response, url, options) {
 	return `sha384-${hash.digest("base64")}`;
 }
 async function computeSriHashForUrl(url, options) {
+	const attempts = 3;
+	for (let attempt = 1; attempt < attempts; attempt++) {
+		const hash = await computeSriHashOnce(url, options);
+		if (hash) return hash;
+		await new Promise((resolve) => setTimeout(resolve, 1e3 * attempt));
+	}
+	return computeSriHashOnce(url, options);
+}
+async function computeSriHashOnce(url, options) {
 	try {
 		const entryUrl = resolveSriTargetUrl(url, options);
 		const response = await fetchResponse(entryUrl, { timeout: "30 seconds" });
@@ -57,13 +65,18 @@ function resolveEntryUrl(url) {
 	if (url.endsWith("/mf-manifest.json")) return `${url.replace(/\/mf-manifest\.json$/, "")}/remoteEntry.js`;
 	return `${url.replace(/\/$/, "")}/remoteEntry.js`;
 }
+var SriVerificationError = class extends Data.TaggedError("SriVerificationError") {
+	constructor(message) {
+		super({ detail: message });
+	}
+	get message() {
+		return this.detail;
+	}
+};
 async function verifySriForUrl(url, expectedIntegrity, options) {
 	const entryUrl = resolveSriTargetUrl(url, options);
 	const response = await fetchResponse(entryUrl, { timeout: "30 seconds" });
-	if (!response.ok) {
-		console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);
-		return;
-	}
+	if (!response.ok) throw new SriVerificationError(`Failed to fetch ${entryUrl} for verification: ${response.status}`);
 	const computed = await computeSriHashFromResponse(response, entryUrl, options);
 	if (computed !== expectedIntegrity) throw new Error(`[SRI] Integrity check failed for ${entryUrl}\n  Expected: ${expectedIntegrity}\n  Computed: ${computed}`);
 }
@@ -89,14 +102,32 @@ function extractIntegrityHashes(config) {
 	const hashes = /* @__PURE__ */ new Map();
 	const app = config.app;
 	const plugins = config.plugins;
-	if (app) {
-		for (const [, entry] of Object.entries(app)) if (entry?.integrity && entry?.production) hashes.set(resolveEntryUrl(entry.production), entry.integrity);
-	}
-	if (plugins) {
-		for (const [, entry] of Object.entries(plugins)) if (entry?.integrity && entry?.production) hashes.set(resolveEntryUrl(entry.production), entry.integrity);
+	for (const entry of [...Object.values(app ?? {}), ...Object.values(plugins ?? {})]) {
+		if (!entry) continue;
+		const slotHash = slotHashOf(entry);
+		if (slotHash) hashes.set(slotHash.key, slotHash.hash);
 	}
 	return hashes;
 }
+/**
+* The integrity anchor a slot contributes to local↔chain attestation: pinned
+* slots anchor at the pinned manifest document (the pin's SRI), unpinned
+* slots at their fixed-name entry (the direct entry SRI).
+*/
+function slotHashOf(entry) {
+	const production = entry.production;
+	if (typeof production !== "string") return null;
+	const pin = entry.pin;
+	if (pin && typeof pin.manifest === "string" && typeof pin.integrity === "string") return {
+		key: `${production.replace(/\/$/, "")}/${pin.manifest.replace(/^\//, "")}`,
+		hash: pin.integrity
+	};
+	if (typeof entry.integrity === "string") return {
+		key: resolveEntryUrl(production),
+		hash: entry.integrity
+	};
+	return null;
+}
 async function verifyConfigAgainstChain(localConfig, bosUrl) {
 	const mismatches = [];
 	let chainConfig;
@@ -144,60 +175,20 @@ function deleteNestedPath(obj, dottedPath) {
 	}
 	delete current[keys[keys.length - 1]];
 }
-function reportDeployResult(opts) {
-	console.log(`[BOS_DEPLOY] url=${opts.url} urlField=${opts.urlField} integrityField=${opts.integrityField ?? ""} integrity=${opts.integrity ?? ""}`);
-	try {
-		const config = JSON.parse(readFileSync(opts.bosConfigPath, "utf8"));
-		setNestedPath(config, opts.urlField, opts.url);
-		if (opts.integrityField) if (opts.integrity) setNestedPath(config, opts.integrityField, opts.integrity);
-		else deleteNestedPath(config, opts.integrityField);
-		writeFileSync(opts.bosConfigPath, `${JSON.stringify(config, null, 2)}\n`);
-		console.log(`   ✅ Updated bos.config.json: ${opts.urlField}`);
-		if (opts.integrityField && opts.integrity) console.log(`   ✅ Updated bos.config.json: ${opts.integrityField}`);
-	} catch (err) {
-		console.error("   ❌ Failed to update bos.config.json:", err.message);
-	}
-}
-function parseDeployLines(output) {
-	const results = [];
-	for (const line of output.split("\n")) {
-		if (!line.includes("[BOS_DEPLOY]")) continue;
-		const urlMatch = line.match(/url=(\S+)/);
-		const urlFieldMatch = line.match(/urlField=(\S+)/);
-		if (!urlMatch || !urlFieldMatch) continue;
-		const integrityFieldMatch = line.match(/integrityField=(\S+)/);
-		const integrityMatch = line.match(/integrity=(\S+)/);
-		results.push({
-			url: urlMatch[1],
-			urlField: urlFieldMatch[1],
-			integrityField: integrityFieldMatch?.[1] || void 0,
-			integrity: integrityMatch?.[1] || void 0
-		});
-	}
-	return results;
-}
 function applyDeployResults(config, results) {
 	const merged = structuredClone(config);
 	for (const result of results) {
 		setNestedPath(merged, result.urlField, result.url);
-		if (result.integrityField) if (result.integrity) setNestedPath(merged, result.integrityField, result.integrity);
-		else deleteNestedPath(merged, result.integrityField);
+		if (result.integrityField) {
+			if (result.integrity) setNestedPath(merged, result.integrityField, result.integrity);
+			else deleteNestedPath(merged, result.integrityField);
+		}
+		if (result.valueField && result.value !== void 0 && result.value !== null) setNestedPath(merged, result.valueField, result.value);
+		for (const field of result.removeFields ?? []) deleteNestedPath(merged, field);
 	}
 	return merged;
 }
-function findPluginKey(bosConfigPath, pluginDir) {
-	const plugins = JSON.parse(readFileSync(bosConfigPath, "utf8")).plugins;
-	if (!plugins) return null;
-	const configRoot = join(bosConfigPath, "..");
-	const normalizedPluginDir = pluginDir.replace(/\\/g, "/").replace(/\/+$/, "");
-	for (const [key, plugin] of Object.entries(plugins)) {
-		const dev = plugin?.development;
-		if (typeof dev !== "string" || !dev.startsWith("local:")) continue;
-		if (join(configRoot, dev.slice(6)).replace(/\\/g, "/").replace(/\/+$/, "") === normalizedPluginDir) return key;
-	}
-	return null;
-}
 
 //#endregion
-export { IntegrityRegistry, applyDeployResults, computeSriHash, computeSriHashForUrl, findPluginKey, parseDeployLines, reportDeployResult, resolveEntryUrl, verifyConfigAgainstChain, verifySriForUrl };
+export { IntegrityRegistry, SriVerificationError, applyDeployResults, computeSriHash, computeSriHashForUrl, resolveEntryUrl, verifyConfigAgainstChain, verifySriForUrl };
 //# sourceMappingURL=integrity.mjs.map

package/dist/integrity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.mjs","names":[],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\nimport { fetchResponse } from \"./http-client\";\n\nconst DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;\n\ninterface SriUrlOptions {\n  resolveEntryUrl?: boolean;\n  maxBytes?: number;\n}\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nfunction resolveSriTargetUrl(url: string, options?: SriUrlOptions): string {\n  return options?.resolveEntryUrl === false ? url : resolveEntryUrl(url);\n}\n\nfunction getMaxSriResponseBytes(options?: SriUrlOptions): number {\n  return options?.maxBytes ?? DEFAULT_MAX_SRI_RESPONSE_BYTES;\n}\n\nasync function computeSriHashFromResponse(\n  response: Response,\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string> {\n  const maxBytes = getMaxSriResponseBytes(options);\n  const contentLengthHeader = response.headers.get(\"content-length\");\n\n  if (contentLengthHeader) {\n    const contentLength = Number(contentLengthHeader);\n    if (Number.isFinite(contentLength) && contentLength > maxBytes) {\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${contentLength})`,\n      );\n    }\n  }\n\n  if (!response.body) {\n    throw new Error(`[SRI] Missing response body for ${url}`);\n  }\n\n  const hash = createHash(\"sha384\");\n  const reader = response.body.getReader();\n  let totalBytes = 0;\n\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n\n    totalBytes += value.byteLength;\n    if (totalBytes > maxBytes) {\n      await reader.cancel();\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${totalBytes})`,\n      );\n    }\n\n    hash.update(value);\n  }\n\n  return `sha384-${hash.digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string | null> {\n  try {\n    const entryUrl = resolveSriTargetUrl(url, options);\n\n    const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    return await computeSriHashFromResponse(response, entryUrl, options);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport async function verifySriForUrl(\n  url: string,\n  expectedIntegrity: string,\n  options?: SriUrlOptions,\n): Promise<void> {\n  const entryUrl = resolveSriTargetUrl(url, options);\n\n  const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n  if (!response.ok) {\n    console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);\n    return;\n  }\n\n  const computed = await computeSriHashFromResponse(response, entryUrl, options);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  if (app) {\n    for (const [, entry] of Object.entries(app)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  if (plugins) {\n    for (const [, entry] of Object.entries(plugins)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  return hashes;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n\nexport interface DeployResultEntry {\n  url: string;\n  integrity?: string;\n  urlField: string;\n  integrityField?: string;\n}\n\nfunction setNestedPath(obj: Record<string, unknown>, dottedPath: string, value: unknown): void {\n  const keys = dottedPath.split(\".\");\n  let current = obj;\n  for (let i = 0; i < keys.length - 1; i += 1) {\n    const key = keys[i]!;\n    if (current[key] === undefined || current[key] === null || typeof current[key] !== \"object\") {\n      current[key] = {};\n    }\n    current = current[key] as Record<string, unknown>;\n  }\n  current[keys[keys.length - 1]!] = value;\n}\n\nfunction deleteNestedPath(obj: Record<string, unknown>, dottedPath: string): void {\n  const keys = dottedPath.split(\".\");\n  let current = obj;\n  for (let i = 0; i < keys.length - 1; i += 1) {\n    const key = keys[i]!;\n    if (current[key] === undefined || typeof current[key] !== \"object\") return;\n    current = current[key] as Record<string, unknown>;\n  }\n  delete current[keys[keys.length - 1]!];\n}\n\nexport function reportDeployResult(opts: {\n  url: string;\n  integrity?: string | null;\n  bosConfigPath: string;\n  urlField: string;\n  integrityField?: string;\n}): void {\n  console.log(\n    `[BOS_DEPLOY] url=${opts.url} urlField=${opts.urlField} integrityField=${opts.integrityField ?? \"\"} integrity=${opts.integrity ?? \"\"}`,\n  );\n\n  try {\n    const config = JSON.parse(readFileSync(opts.bosConfigPath, \"utf8\")) as Record<string, unknown>;\n    setNestedPath(config, opts.urlField, opts.url);\n    if (opts.integrityField) {\n      if (opts.integrity) {\n        setNestedPath(config, opts.integrityField, opts.integrity);\n      } else {\n        deleteNestedPath(config, opts.integrityField);\n      }\n    }\n    writeFileSync(opts.bosConfigPath, `${JSON.stringify(config, null, 2)}\\n`);\n    console.log(`   ✅ Updated bos.config.json: ${opts.urlField}`);\n    if (opts.integrityField && opts.integrity) {\n      console.log(`   ✅ Updated bos.config.json: ${opts.integrityField}`);\n    }\n  } catch (err) {\n    console.error(\"   ❌ Failed to update bos.config.json:\", (err as Error).message);\n  }\n}\n\nexport function parseDeployLines(output: string): DeployResultEntry[] {\n  const results: DeployResultEntry[] = [];\n  for (const line of output.split(\"\\n\")) {\n    if (!line.includes(\"[BOS_DEPLOY]\")) continue;\n    const urlMatch = line.match(/url=(\\S+)/);\n    const urlFieldMatch = line.match(/urlField=(\\S+)/);\n    if (!urlMatch || !urlFieldMatch) continue;\n    const integrityFieldMatch = line.match(/integrityField=(\\S+)/);\n    const integrityMatch = line.match(/integrity=(\\S+)/);\n    results.push({\n      url: urlMatch[1],\n      urlField: urlFieldMatch[1],\n      integrityField: integrityFieldMatch?.[1] || undefined,\n      integrity: integrityMatch?.[1] || undefined,\n    });\n  }\n  return results;\n}\n\nexport function applyDeployResults(\n  config: Record<string, unknown>,\n  results: DeployResultEntry[],\n): Record<string, unknown> {\n  const merged = structuredClone(config);\n  for (const result of results) {\n    setNestedPath(merged, result.urlField, result.url);\n    if (result.integrityField) {\n      if (result.integrity) {\n        setNestedPath(merged, result.integrityField, result.integrity);\n      } else {\n        deleteNestedPath(merged, result.integrityField);\n      }\n    }\n  }\n  return merged;\n}\n\nexport function findPluginKey(bosConfigPath: string, pluginDir: string): string | null {\n  const config = JSON.parse(readFileSync(bosConfigPath, \"utf8\")) as Record<string, unknown>;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n  if (!plugins) return null;\n  const configRoot = join(bosConfigPath, \"..\");\n  const normalizedPluginDir = pluginDir.replace(/\\\\/g, \"/\").replace(/\\/+$/, \"\");\n  for (const [key, plugin] of Object.entries(plugins)) {\n    const dev = plugin?.development;\n    if (typeof dev !== \"string\" || !dev.startsWith(\"local:\")) continue;\n    const resolved = join(configRoot, dev.slice(\"local:\".length))\n      .replace(/\\\\/g, \"/\")\n      .replace(/\\/+$/, \"\");\n    if (resolved === normalizedPluginDir) return key;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;AAMA,MAAM,iCAAiC,KAAK,OAAO;AAOnD,SAAgB,eAAe,SAAkC;CAC/D,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,QAAQ;AACvE;AAEA,SAAS,oBAAoB,KAAa,SAAiC;CACzE,OAAO,SAAS,oBAAoB,QAAQ,MAAM,gBAAgB,GAAG;AACvE;AAEA,SAAS,uBAAuB,SAAiC;CAC/D,OAAO,SAAS,YAAY;AAC9B;AAEA,eAAe,2BACb,UACA,KACA,SACiB;CACjB,MAAM,WAAW,uBAAuB,OAAO;CAC/C,MAAM,sBAAsB,SAAS,QAAQ,IAAI,gBAAgB;CAEjE,IAAI,qBAAqB;EACvB,MAAM,gBAAgB,OAAO,mBAAmB;EAChD,IAAI,OAAO,SAAS,aAAa,KAAK,gBAAgB,UACpD,MAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,cAAc,EACpF;CAEJ;CAEA,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,mCAAmC,KAAK;CAG1D,MAAM,OAAO,WAAW,QAAQ;CAChC,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,IAAI,aAAa;CAEjB,OAAO,MAAM;EACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;EAC1C,IAAI,MACF;EAGF,cAAc,MAAM;EACpB,IAAI,aAAa,UAAU;GACzB,MAAM,OAAO,OAAO;GACpB,MAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,WAAW,EACjF;EACF;EAEA,KAAK,OAAO,KAAK;CACnB;CAEA,OAAO,UAAU,KAAK,OAAO,QAAQ;AACvC;AAEA,eAAsB,qBACpB,KACA,SACwB;CACxB,IAAI;EACF,MAAM,WAAW,oBAAoB,KAAK,OAAO;EAEjD,MAAM,WAAW,MAAM,cAAc,UAAU,EAAE,SAAS,aAAa,CAAC;EACxE,IAAI,CAAC,SAAS,IAAI;GAChB,QAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,YAAY;GAC3F,OAAO;EACT;EACA,OAAO,MAAM,2BAA2B,UAAU,UAAU,OAAO;CACrE,SAAS,OAAO;EACd,QAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,KAC3C;EACA,OAAO;CACT;AACF;AAEA,SAAgB,gBAAgB,KAAqB;CACnD,IAAI,IAAI,SAAS,iBAAiB,GAAG,OAAO;CAC5C,IAAI,IAAI,SAAS,mBAAmB,GAClC,OAAO,GAAG,IAAI,QAAQ,wBAAwB,EAAE,EAAE;CACpD,OAAO,GAAG,IAAI,QAAQ,OAAO,EAAE,EAAE;AACnC;AAEA,eAAsB,gBACpB,KACA,mBACA,SACe;CACf,MAAM,WAAW,oBAAoB,KAAK,OAAO;CAEjD,MAAM,WAAW,MAAM,cAAc,UAAU,EAAE,SAAS,aAAa,CAAC;CACxE,IAAI,CAAC,SAAS,IAAI;EAChB,QAAQ,KAAK,yBAAyB,SAAS,qBAAqB,SAAS,QAAQ;EACrF;CACF;CAEA,MAAM,WAAW,MAAM,2BAA2B,UAAU,UAAU,OAAO;CAE7E,IAAI,aAAa,mBACf,MAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,UACjG;AAEJ;AAEA,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,IAAoB;CAEzC,SAAS,KAAa,WAAyB;EAC7C,KAAK,OAAO,IAAI,KAAK,SAAS;CAChC;CAEA,cAAc,SAAiB,WAAyB;EACtD,KAAK,OAAO,IAAI,gBAAgB,OAAO,GAAG,SAAS;CACrD;CAEA,IAAI,KAAiC;EACnC,OAAO,KAAK,OAAO,IAAI,GAAG;CAC5B;CAEA,IAAI,KAAsB;EACxB,OAAO,KAAK,OAAO,IAAI,GAAG;CAC5B;CAEA,UAA8C;EAC5C,OAAO,KAAK,OAAO,QAAQ;CAC7B;AACF;AAEA,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,IAAoB;CACvC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;CAEvB,IAAI,KACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,GAAG,GACxC,IAAI,OAAO,aAAa,OAAO,YAC7B,OAAO,IAAI,gBAAgB,MAAM,UAAoB,GAAG,MAAM,SAAmB;CAErF;CAGF,IAAI,SACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,OAAO,GAC5C,IAAI,OAAO,aAAa,OAAO,YAC7B,OAAO,IAAI,gBAAgB,MAAM,UAAoB,GAAG,MAAM,SAAmB;CAErF;CAGF,OAAO;AACT;AAEA,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,CAAC;CAE9B,IAAI;CACJ,IAAI;EACF,cAAc,MAAM,yBAAkD,MAAM;CAC9E,SAAS,OAAO;EACd,QAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACzG;EACA,OAAO;GAAE,UAAU;GAAO,YAAY,CAAC,oBAAoB;EAAE;CAC/D;CAEA,MAAM,cAAc,uBAAuB,WAAW;CACtD,MAAM,cAAc,uBAAuB,WAAW;CAEtD,KAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,GAAG;EACrC,IAAI,aAAa,cAAc,WAAW;GACxC,WAAW,KAAK,GAAG;GACnB,QAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,WAClF;EACF;CACF;CAEA,IAAI,WAAW,WAAW,KAAK,YAAY,OAAO,GAChD,QAAQ,IACN,gEAAgE,YAAY,KAAK,kBACnF;CAGF,OAAO;EAAE,UAAU,WAAW,WAAW;EAAG;CAAW;AACzD;AASA,SAAS,cAAc,KAA8B,YAAoB,OAAsB;CAC7F,MAAM,OAAO,WAAW,MAAM,GAAG;CACjC,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;EAC3C,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,SAAS,UAAa,QAAQ,SAAS,QAAQ,OAAO,QAAQ,SAAS,UACjF,QAAQ,OAAO,CAAC;EAElB,UAAU,QAAQ;CACpB;CACA,QAAQ,KAAK,KAAK,SAAS,MAAO;AACpC;AAEA,SAAS,iBAAiB,KAA8B,YAA0B;CAChF,MAAM,OAAO,WAAW,MAAM,GAAG;CACjC,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;EAC3C,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,SAAS,UAAa,OAAO,QAAQ,SAAS,UAAU;EACpE,UAAU,QAAQ;CACpB;CACA,OAAO,QAAQ,KAAK,KAAK,SAAS;AACpC;AAEA,SAAgB,mBAAmB,MAM1B;CACP,QAAQ,IACN,oBAAoB,KAAK,IAAI,YAAY,KAAK,SAAS,kBAAkB,KAAK,kBAAkB,GAAG,aAAa,KAAK,aAAa,IACpI;CAEA,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,aAAa,KAAK,eAAe,MAAM,CAAC;EAClE,cAAc,QAAQ,KAAK,UAAU,KAAK,GAAG;EAC7C,IAAI,KAAK,gBACP,IAAI,KAAK,WACP,cAAc,QAAQ,KAAK,gBAAgB,KAAK,SAAS;OAEzD,iBAAiB,QAAQ,KAAK,cAAc;EAGhD,cAAc,KAAK,eAAe,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,GAAG;EACxE,QAAQ,IAAI,iCAAiC,KAAK,UAAU;EAC5D,IAAI,KAAK,kBAAkB,KAAK,WAC9B,QAAQ,IAAI,iCAAiC,KAAK,gBAAgB;CAEtE,SAAS,KAAK;EACZ,QAAQ,MAAM,0CAA2C,IAAc,OAAO;CAChF;AACF;AAEA,SAAgB,iBAAiB,QAAqC;CACpE,MAAM,UAA+B,CAAC;CACtC,KAAK,MAAM,QAAQ,OAAO,MAAM,IAAI,GAAG;EACrC,IAAI,CAAC,KAAK,SAAS,cAAc,GAAG;EACpC,MAAM,WAAW,KAAK,MAAM,WAAW;EACvC,MAAM,gBAAgB,KAAK,MAAM,gBAAgB;EACjD,IAAI,CAAC,YAAY,CAAC,eAAe;EACjC,MAAM,sBAAsB,KAAK,MAAM,sBAAsB;EAC7D,MAAM,iBAAiB,KAAK,MAAM,iBAAiB;EACnD,QAAQ,KAAK;GACX,KAAK,SAAS;GACd,UAAU,cAAc;GACxB,gBAAgB,sBAAsB,MAAM;GAC5C,WAAW,iBAAiB,MAAM;EACpC,CAAC;CACH;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,SACyB;CACzB,MAAM,SAAS,gBAAgB,MAAM;CACrC,KAAK,MAAM,UAAU,SAAS;EAC5B,cAAc,QAAQ,OAAO,UAAU,OAAO,GAAG;EACjD,IAAI,OAAO,gBACT,IAAI,OAAO,WACT,cAAc,QAAQ,OAAO,gBAAgB,OAAO,SAAS;OAE7D,iBAAiB,QAAQ,OAAO,cAAc;CAGpD;CACA,OAAO;AACT;AAEA,SAAgB,cAAc,eAAuB,WAAkC;CAErF,MAAM,UADS,KAAK,MAAM,aAAa,eAAe,MAAM,CACvC,CAAC,CAAC;CACvB,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,aAAa,KAAK,eAAe,IAAI;CAC3C,MAAM,sBAAsB,UAAU,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC5E,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,OAAO,GAAG;EACnD,MAAM,MAAM,QAAQ;EACpB,IAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,WAAW,QAAQ,GAAG;EAI1D,IAHiB,KAAK,YAAY,IAAI,MAAM,CAAe,CAAC,CAAC,CAC1D,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,QAAQ,EACR,MAAM,qBAAqB,OAAO;CAC/C;CACA,OAAO;AACT"}
+{"version":3,"file":"integrity.mjs","names":[],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { Data } from \"effect\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\nimport { fetchResponse } from \"./http-client\";\n\nconst DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;\n\ninterface SriUrlOptions {\n  resolveEntryUrl?: boolean;\n  maxBytes?: number;\n}\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nfunction resolveSriTargetUrl(url: string, options?: SriUrlOptions): string {\n  return options?.resolveEntryUrl === false ? url : resolveEntryUrl(url);\n}\n\nfunction getMaxSriResponseBytes(options?: SriUrlOptions): number {\n  return options?.maxBytes ?? DEFAULT_MAX_SRI_RESPONSE_BYTES;\n}\n\nasync function computeSriHashFromResponse(\n  response: Response,\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string> {\n  const maxBytes = getMaxSriResponseBytes(options);\n  const contentLengthHeader = response.headers.get(\"content-length\");\n\n  if (contentLengthHeader) {\n    const contentLength = Number(contentLengthHeader);\n    if (Number.isFinite(contentLength) && contentLength > maxBytes) {\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${contentLength})`,\n      );\n    }\n  }\n\n  if (!response.body) {\n    throw new Error(`[SRI] Missing response body for ${url}`);\n  }\n\n  const hash = createHash(\"sha384\");\n  const reader = response.body.getReader();\n  let totalBytes = 0;\n\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n\n    totalBytes += value.byteLength;\n    if (totalBytes > maxBytes) {\n      await reader.cancel();\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${totalBytes})`,\n      );\n    }\n\n    hash.update(value);\n  }\n\n  return `sha384-${hash.digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string | null> {\n  const attempts = 3;\n  for (let attempt = 1; attempt < attempts; attempt++) {\n    const hash = await computeSriHashOnce(url, options);\n    if (hash) return hash;\n    await new Promise((resolve) => setTimeout(resolve, 1000 * attempt));\n  }\n  return computeSriHashOnce(url, options);\n}\n\nasync function computeSriHashOnce(url: string, options?: SriUrlOptions): Promise<string | null> {\n  try {\n    const entryUrl = resolveSriTargetUrl(url, options);\n\n    const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    return await computeSriHashFromResponse(response, entryUrl, options);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport class SriVerificationError extends Data.TaggedError(\"SriVerificationError\")<{\n  readonly detail: string;\n}> {\n  constructor(message: string) {\n    super({ detail: message });\n  }\n\n  override get message() {\n    return this.detail;\n  }\n}\n\nexport async function verifySriForUrl(\n  url: string,\n  expectedIntegrity: string,\n  options?: SriUrlOptions,\n): Promise<void> {\n  const entryUrl = resolveSriTargetUrl(url, options);\n\n  const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n  if (!response.ok) {\n    throw new SriVerificationError(\n      `Failed to fetch ${entryUrl} for verification: ${response.status}`,\n    );\n  }\n\n  const computed = await computeSriHashFromResponse(response, entryUrl, options);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  for (const entry of [...Object.values(app ?? {}), ...Object.values(plugins ?? {})]) {\n    if (!entry) continue;\n    const slotHash = slotHashOf(entry);\n    if (slotHash) hashes.set(slotHash.key, slotHash.hash);\n  }\n\n  return hashes;\n}\n\n/**\n * The integrity anchor a slot contributes to local↔chain attestation: pinned\n * slots anchor at the pinned manifest document (the pin's SRI), unpinned\n * slots at their fixed-name entry (the direct entry SRI).\n */\nfunction slotHashOf(entry: Record<string, unknown>): { key: string; hash: string } | null {\n  const production = entry.production;\n  if (typeof production !== \"string\") return null;\n  const pin = entry.pin as { manifest?: unknown; integrity?: unknown } | undefined;\n  if (pin && typeof pin.manifest === \"string\" && typeof pin.integrity === \"string\") {\n    return {\n      key: `${production.replace(/\\/$/, \"\")}/${pin.manifest.replace(/^\\//, \"\")}`,\n      hash: pin.integrity,\n    };\n  }\n  if (typeof entry.integrity === \"string\") {\n    return { key: resolveEntryUrl(production), hash: entry.integrity };\n  }\n  return null;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n\nexport interface DeployResultEntry {\n  url: string;\n  integrity?: string;\n  urlField: string;\n  integrityField?: string;\n  /** A plain pipeline-state value (e.g. the built MF container name). */\n  value?: string;\n  valueField?: string;\n  /** Dotted paths deleted after applying this entry — clears stale\n   * pipeline-state fields (e.g. the retired flat `manifest` pointer). */\n  removeFields?: string[];\n}\n\nfunction setNestedPath(obj: Record<string, unknown>, dottedPath: string, value: unknown): void {\n  const keys = dottedPath.split(\".\");\n  let current = obj;\n  for (let i = 0; i < keys.length - 1; i += 1) {\n    const key = keys[i]!;\n    if (current[key] === undefined || current[key] === null || typeof current[key] !== \"object\") {\n      current[key] = {};\n    }\n    current = current[key] as Record<string, unknown>;\n  }\n  current[keys[keys.length - 1]!] = value;\n}\n\nfunction deleteNestedPath(obj: Record<string, unknown>, dottedPath: string): void {\n  const keys = dottedPath.split(\".\");\n  let current = obj;\n  for (let i = 0; i < keys.length - 1; i += 1) {\n    const key = keys[i]!;\n    if (current[key] === undefined || typeof current[key] !== \"object\") return;\n    current = current[key] as Record<string, unknown>;\n  }\n  delete current[keys[keys.length - 1]!];\n}\n\nexport function applyDeployResults(\n  config: Record<string, unknown>,\n  results: DeployResultEntry[],\n): Record<string, unknown> {\n  const merged = structuredClone(config);\n  for (const result of results) {\n    setNestedPath(merged, result.urlField, result.url);\n    if (result.integrityField) {\n      if (result.integrity) {\n        setNestedPath(merged, result.integrityField, result.integrity);\n      } else {\n        deleteNestedPath(merged, result.integrityField);\n      }\n    }\n    if (result.valueField && result.value !== undefined && result.value !== null) {\n      setNestedPath(merged, result.valueField, result.value);\n    }\n    for (const field of result.removeFields ?? []) {\n      deleteNestedPath(merged, field);\n    }\n  }\n  return merged;\n}\n"],"mappings":";;;;;;AAKA,MAAM,iCAAiC;AAOvC,SAAgB,eAAe,SAAkC;CAC/D,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,QAAQ;AACvE;AAEA,SAAS,oBAAoB,KAAa,SAAiC;CACzE,OAAO,SAAS,oBAAoB,QAAQ,MAAM,gBAAgB,GAAG;AACvE;AAEA,SAAS,uBAAuB,SAAiC;CAC/D,OAAO,SAAS,YAAY;AAC9B;AAEA,eAAe,2BACb,UACA,KACA,SACiB;CACjB,MAAM,WAAW,uBAAuB,OAAO;CAC/C,MAAM,sBAAsB,SAAS,QAAQ,IAAI,gBAAgB;CAEjE,IAAI,qBAAqB;EACvB,MAAM,gBAAgB,OAAO,mBAAmB;EAChD,IAAI,OAAO,SAAS,aAAa,KAAK,gBAAgB,UACpD,MAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,cAAc,EACpF;CAEJ;CAEA,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,MAAM,mCAAmC,KAAK;CAG1D,MAAM,OAAO,WAAW,QAAQ;CAChC,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,IAAI,aAAa;CAEjB,OAAO,MAAM;EACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;EAC1C,IAAI,MACF;EAGF,cAAc,MAAM;EACpB,IAAI,aAAa,UAAU;GACzB,MAAM,OAAO,OAAO;GACpB,MAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,WAAW,EACjF;EACF;EAEA,KAAK,OAAO,KAAK;CACnB;CAEA,OAAO,UAAU,KAAK,OAAO,QAAQ;AACvC;AAEA,eAAsB,qBACpB,KACA,SACwB;CACxB,MAAM,WAAW;CACjB,KAAK,IAAI,UAAU,GAAG,UAAU,UAAU,WAAW;EACnD,MAAM,OAAO,MAAM,mBAAmB,KAAK,OAAO;EAClD,IAAI,MAAM,OAAO;EACjB,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,MAAO,OAAO,CAAC;CACpE;CACA,OAAO,mBAAmB,KAAK,OAAO;AACxC;AAEA,eAAe,mBAAmB,KAAa,SAAiD;CAC9F,IAAI;EACF,MAAM,WAAW,oBAAoB,KAAK,OAAO;EAEjD,MAAM,WAAW,MAAM,cAAc,UAAU,EAAE,SAAS,aAAa,CAAC;EACxE,IAAI,CAAC,SAAS,IAAI;GAChB,QAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,YAAY;GAC3F,OAAO;EACT;EACA,OAAO,MAAM,2BAA2B,UAAU,UAAU,OAAO;CACrE,SAAS,OAAO;EACd,QAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,KAC3C;EACA,OAAO;CACT;AACF;AAEA,SAAgB,gBAAgB,KAAqB;CACnD,IAAI,IAAI,SAAS,iBAAiB,GAAG,OAAO;CAC5C,IAAI,IAAI,SAAS,mBAAmB,GAClC,OAAO,GAAG,IAAI,QAAQ,wBAAwB,EAAE,EAAE;CACpD,OAAO,GAAG,IAAI,QAAQ,OAAO,EAAE,EAAE;AACnC;AAEA,IAAa,uBAAb,cAA0C,KAAK,YAAY,sBAAsB,CAAC,CAE/E;CACD,YAAY,SAAiB;EAC3B,MAAM,EAAE,QAAQ,QAAQ,CAAC;CAC3B;CAEA,IAAa,UAAU;EACrB,OAAO,KAAK;CACd;AACF;AAEA,eAAsB,gBACpB,KACA,mBACA,SACe;CACf,MAAM,WAAW,oBAAoB,KAAK,OAAO;CAEjD,MAAM,WAAW,MAAM,cAAc,UAAU,EAAE,SAAS,aAAa,CAAC;CACxE,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,qBACR,mBAAmB,SAAS,qBAAqB,SAAS,QAC5D;CAGF,MAAM,WAAW,MAAM,2BAA2B,UAAU,UAAU,OAAO;CAE7E,IAAI,aAAa,mBACf,MAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,UACjG;AAEJ;AAEA,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,IAAoB;CAEzC,SAAS,KAAa,WAAyB;EAC7C,KAAK,OAAO,IAAI,KAAK,SAAS;CAChC;CAEA,cAAc,SAAiB,WAAyB;EACtD,KAAK,OAAO,IAAI,gBAAgB,OAAO,GAAG,SAAS;CACrD;CAEA,IAAI,KAAiC;EACnC,OAAO,KAAK,OAAO,IAAI,GAAG;CAC5B;CAEA,IAAI,KAAsB;EACxB,OAAO,KAAK,OAAO,IAAI,GAAG;CAC5B;CAEA,UAA8C;EAC5C,OAAO,KAAK,OAAO,QAAQ;CAC7B;AACF;AAEA,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,IAAoB;CACvC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;CAEvB,KAAK,MAAM,SAAS,CAAC,GAAG,OAAO,OAAO,OAAO,CAAC,CAAC,GAAG,GAAG,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG;EAClF,IAAI,CAAC,OAAO;EACZ,MAAM,WAAW,WAAW,KAAK;EACjC,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK,SAAS,IAAI;CACtD;CAEA,OAAO;AACT;;;;;;AAOA,SAAS,WAAW,OAAsE;CACxF,MAAM,aAAa,MAAM;CACzB,IAAI,OAAO,eAAe,UAAU,OAAO;CAC3C,MAAM,MAAM,MAAM;CAClB,IAAI,OAAO,OAAO,IAAI,aAAa,YAAY,OAAO,IAAI,cAAc,UACtE,OAAO;EACL,KAAK,GAAG,WAAW,QAAQ,OAAO,EAAE,EAAE,GAAG,IAAI,SAAS,QAAQ,OAAO,EAAE;EACvE,MAAM,IAAI;CACZ;CAEF,IAAI,OAAO,MAAM,cAAc,UAC7B,OAAO;EAAE,KAAK,gBAAgB,UAAU;EAAG,MAAM,MAAM;CAAU;CAEnE,OAAO;AACT;AAEA,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,CAAC;CAE9B,IAAI;CACJ,IAAI;EACF,cAAc,MAAM,yBAAkD,MAAM;CAC9E,SAAS,OAAO;EACd,QAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACzG;EACA,OAAO;GAAE,UAAU;GAAO,YAAY,CAAC,oBAAoB;EAAE;CAC/D;CAEA,MAAM,cAAc,uBAAuB,WAAW;CACtD,MAAM,cAAc,uBAAuB,WAAW;CAEtD,KAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,GAAG;EACrC,IAAI,aAAa,cAAc,WAAW;GACxC,WAAW,KAAK,GAAG;GACnB,QAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,WAClF;EACF;CACF;CAEA,IAAI,WAAW,WAAW,KAAK,YAAY,OAAO,GAChD,QAAQ,IACN,gEAAgE,YAAY,KAAK,kBACnF;CAGF,OAAO;EAAE,UAAU,WAAW,WAAW;EAAG;CAAW;AACzD;AAeA,SAAS,cAAc,KAA8B,YAAoB,OAAsB;CAC7F,MAAM,OAAO,WAAW,MAAM,GAAG;CACjC,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;EAC3C,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,SAAS,UAAa,QAAQ,SAAS,QAAQ,OAAO,QAAQ,SAAS,UACjF,QAAQ,OAAO,CAAC;EAElB,UAAU,QAAQ;CACpB;CACA,QAAQ,KAAK,KAAK,SAAS,MAAO;AACpC;AAEA,SAAS,iBAAiB,KAA8B,YAA0B;CAChF,MAAM,OAAO,WAAW,MAAM,GAAG;CACjC,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG;EAC3C,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,SAAS,UAAa,OAAO,QAAQ,SAAS,UAAU;EACpE,UAAU,QAAQ;CACpB;CACA,OAAO,QAAQ,KAAK,KAAK,SAAS;AACpC;AAEA,SAAgB,mBACd,QACA,SACyB;CACzB,MAAM,SAAS,gBAAgB,MAAM;CACrC,KAAK,MAAM,UAAU,SAAS;EAC5B,cAAc,QAAQ,OAAO,UAAU,OAAO,GAAG;EACjD,IAAI,OAAO,gBAAgB;GACzB,IAAI,OAAO,WACT,cAAc,QAAQ,OAAO,gBAAgB,OAAO,SAAS;QAE7D,iBAAiB,QAAQ,OAAO,cAAc;EAElD;EACA,IAAI,OAAO,cAAc,OAAO,UAAU,UAAa,OAAO,UAAU,MACtE,cAAc,QAAQ,OAAO,YAAY,OAAO,KAAK;EAEvD,KAAK,MAAM,SAAS,OAAO,gBAAgB,CAAC,GAC1C,iBAAiB,QAAQ,KAAK;CAElC;CACA,OAAO;AACT"}

package/dist/internal/manifest-normalizer.cjs

@@ -1,3 +1,4 @@
+const require_workspace_catalog = require('../workspace-catalog.cjs');
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let glob = require("glob");
@@ -28,7 +29,7 @@ function writeJson(filePath, value) {
 	(0, node_fs.writeFileSync)(filePath, `${JSON.stringify(value, null, 2)}\n`);
 }
 function loadManifestNormalizationSpec(sourceRootDir) {
-	const rootCatalog = { ...readJson((0, node_path.join)(sourceRootDir, "package.json")).workspaces?.catalog ?? {} };
+	const rootCatalog = require_workspace_catalog.readWorkspaceCatalog(sourceRootDir);
 	const frameworkVersions = {};
 	for (const packageName of FRAMEWORK_PACKAGES) {
 		const sourcePackagePath = (0, node_path.join)(sourceRootDir, "packages", packageName, "package.json");
@@ -54,7 +55,7 @@ function normalizeDependencyMap(map, spec, options) {
 			}
 			continue;
 		}
-		if (version === "workspace:*") {
+		if (version.startsWith("workspace:")) {
 			const frameworkVersion = spec.frameworkVersions[name];
 			if (frameworkVersion) {
 				map[name] = `^${frameworkVersion}`;
@@ -64,6 +65,11 @@ function normalizeDependencyMap(map, spec, options) {
 			if (options.removeWorkspaceDeps?.includes(name)) {
 				delete map[name];
 				modified = true;
+				continue;
+			}
+			if (spec.rootCatalog[name]) {
+				map[name] = options.preserveCatalogRefs ? "catalog:" : spec.rootCatalog[name];
+				modified = true;
 			}
 			continue;
 		}

package/dist/internal/manifest-normalizer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-normalizer.cjs","names":[],"sources":["../../src/internal/manifest-normalizer.ts"],"sourcesContent":["import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join, relative, sep } from \"node:path\";\nimport { glob } from \"glob\";\n\nconst FRAMEWORK_PACKAGES = [\"every-plugin\", \"everything-dev\"] as const;\n\nconst CATALOG_TOOL_PACKAGES = [\n  \"@rspack/core\",\n  \"@rspack/cli\",\n  \"@rsbuild/core\",\n  \"@rsbuild/plugin-react\",\n  \"@module-federation/enhanced\",\n  \"@module-federation/node\",\n  \"@module-federation/rsbuild-plugin\",\n  \"@module-federation/runtime-core\",\n  \"@module-federation/sdk\",\n  \"@module-federation/dts-plugin\",\n] as const;\n\ntype PackageJson = Record<string, unknown>;\n\ntype NormalizationSpec = {\n  rootCatalog: Record<string, string>;\n  frameworkVersions: Record<string, string>;\n};\n\ntype NormalizeManifestOptions = {\n  resolveCatalogRefs: boolean;\n  preserveCatalogRefs?: boolean;\n  excludeFrameworkWorkspaces?: boolean;\n  removeWorkspaceDeps?: string[];\n  removeWorkspaces?: boolean;\n  removePublishScripts?: boolean;\n};\n\nexport type NormalizeTreeOptions = NormalizeManifestOptions & {\n  sourceRootDir: string;\n  targetDir: string;\n};\n\nfunction readJson<T>(filePath: string): T {\n  return JSON.parse(readFileSync(filePath, \"utf-8\")) as T;\n}\n\nfunction extractExactVersion(input: string | undefined): string | null {\n  if (!input) return null;\n  const match = input.match(/\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?/);\n  return match ? match[0] : null;\n}\n\nfunction writeJson(filePath: string, value: PackageJson) {\n  writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function loadManifestNormalizationSpec(sourceRootDir: string): NormalizationSpec {\n  const rootPackage = readJson<PackageJson>(join(sourceRootDir, \"package.json\"));\n  const rootCatalog = {\n    ...(((rootPackage.workspaces as { catalog?: Record<string, string> } | undefined)?.catalog ??\n      {}) as Record<string, string>),\n  };\n  const frameworkVersions: Record<string, string> = {};\n\n  for (const packageName of FRAMEWORK_PACKAGES) {\n    const sourcePackagePath = join(sourceRootDir, \"packages\", packageName, \"package.json\");\n    const localPackagePath = join(import.meta.dirname, \"..\", \"..\", packageName, \"package.json\");\n    const packageVersion = existsSync(localPackagePath)\n      ? readJson<{ version: string }>(localPackagePath).version\n      : existsSync(sourcePackagePath)\n        ? readJson<{ version: string }>(sourcePackagePath).version\n        : extractExactVersion(rootCatalog[packageName]);\n\n    if (!packageVersion) {\n      throw new Error(`Could not resolve version for ${packageName}`);\n    }\n\n    frameworkVersions[packageName] = packageVersion;\n    rootCatalog[packageName] = `^${packageVersion}`;\n  }\n\n  return { rootCatalog, frameworkVersions };\n}\n\nfunction normalizeDependencyMap(\n  map: Record<string, string>,\n  spec: NormalizationSpec,\n  options: NormalizeManifestOptions,\n) {\n  const catalogPackages = new Set<string>([...FRAMEWORK_PACKAGES, ...CATALOG_TOOL_PACKAGES]);\n\n  let modified = false;\n\n  for (const [name, version] of Object.entries(map)) {\n    if (options.preserveCatalogRefs && catalogPackages.has(name)) {\n      if (version !== \"catalog:\") {\n        map[name] = \"catalog:\";\n        modified = true;\n      }\n      continue;\n    }\n\n    if (version === \"workspace:*\") {\n      const frameworkVersion = spec.frameworkVersions[name];\n      if (frameworkVersion) {\n        map[name] = `^${frameworkVersion}`;\n        modified = true;\n        continue;\n      }\n\n      if (options.removeWorkspaceDeps?.includes(name)) {\n        delete map[name];\n        modified = true;\n      }\n      continue;\n    }\n\n    if (options.resolveCatalogRefs && version.startsWith(\"catalog:\")) {\n      const resolved = spec.rootCatalog[name];\n      if (resolved) {\n        map[name] = resolved;\n        modified = true;\n      }\n    }\n  }\n\n  return modified;\n}\n\nexport function normalizePackageManifest(\n  pkg: PackageJson,\n  spec: NormalizationSpec,\n  options: NormalizeManifestOptions,\n) {\n  let modified = false;\n\n  for (const depField of [\"dependencies\", \"devDependencies\", \"peerDependencies\"]) {\n    const deps = pkg[depField];\n    if (!deps || typeof deps !== \"object\") continue;\n    if (normalizeDependencyMap(deps as Record<string, string>, spec, options)) {\n      modified = true;\n    }\n  }\n\n  if (pkg.workspaces && typeof pkg.workspaces === \"object\") {\n    const workspaces = pkg.workspaces as {\n      packages?: string[];\n      catalog?: Record<string, string>;\n    };\n\n    if (options.excludeFrameworkWorkspaces && Array.isArray(workspaces.packages)) {\n      const nextPackages = workspaces.packages.filter(\n        (entry) => !FRAMEWORK_PACKAGES.some((name) => entry === `packages/${name}`),\n      );\n      if (nextPackages.length !== workspaces.packages.length) {\n        workspaces.packages = nextPackages;\n        modified = true;\n      }\n    }\n\n    if (workspaces.catalog && typeof workspaces.catalog === \"object\") {\n      for (const [name, version] of Object.entries(workspaces.catalog)) {\n        const resolved = spec.rootCatalog[name];\n        if (resolved && resolved !== version) {\n          workspaces.catalog[name] = resolved;\n          modified = true;\n          continue;\n        }\n\n        if (version === \"workspace:*\" && spec.frameworkVersions[name]) {\n          workspaces.catalog[name] = `^${spec.frameworkVersions[name]}`;\n          modified = true;\n        }\n      }\n    }\n  }\n\n  if (options.removeWorkspaces && \"workspaces\" in pkg) {\n    delete pkg.workspaces;\n    modified = true;\n  }\n\n  if (options.removePublishScripts && pkg.scripts && typeof pkg.scripts === \"object\") {\n    const scripts = pkg.scripts as Record<string, string>;\n    let scriptsModified = false;\n    for (const key of [\"prepublishOnly\", \"prepack\", \"prepare\", \"postpack\"]) {\n      if (key in scripts) {\n        delete scripts[key];\n        scriptsModified = true;\n      }\n    }\n    if (scriptsModified) {\n      modified = true;\n      if (Object.keys(scripts).length === 0) {\n        delete pkg.scripts;\n      }\n    }\n  }\n\n  return modified;\n}\n\nexport async function normalizePackageManifestsInTree(opts: NormalizeTreeOptions) {\n  const spec = loadManifestNormalizationSpec(opts.sourceRootDir);\n  const files = await glob(\"**/package.json\", {\n    cwd: opts.targetDir,\n    nodir: true,\n    dot: false,\n    absolute: true,\n    ignore: [\"**/node_modules/**\"],\n  });\n\n  const updatedFiles: string[] = [];\n\n  for (const filePath of files) {\n    const pkg = readJson<PackageJson>(filePath);\n    if (normalizePackageManifest(pkg, spec, opts)) {\n      writeJson(filePath, pkg);\n      updatedFiles.push(filePath);\n    }\n  }\n\n  return updatedFiles;\n}\n\nfunction shouldCopyPackageFile(sourceDir: string, filePath: string) {\n  const relPath = relative(sourceDir, filePath);\n  if (!relPath) return true;\n  const segments = relPath.split(sep);\n  return !segments.includes(\"node_modules\") && !segments.includes(\"tests\");\n}\n\nfunction stripDevelopmentExports(pkg: PackageJson) {\n  const exports = pkg.exports;\n  if (!exports || typeof exports !== \"object\") return;\n\n  for (const key of Object.keys(exports as Record<string, unknown>)) {\n    const entry = (exports as Record<string, unknown>)[key];\n    if (entry && typeof entry === \"object\") {\n      delete (entry as Record<string, unknown>).development;\n    }\n  }\n}\n\nexport function stageReleasePackage(opts: {\n  repoRoot: string;\n  packageName: string;\n  outDir: string;\n}) {\n  const sourceDir = join(opts.repoRoot, \"packages\", opts.packageName);\n\n  rmSync(opts.outDir, { recursive: true, force: true });\n  mkdirSync(dirname(opts.outDir), { recursive: true });\n  cpSync(sourceDir, opts.outDir, {\n    recursive: true,\n    filter: (filePath) => shouldCopyPackageFile(sourceDir, filePath),\n  });\n  rmSync(join(opts.outDir, \"tests\"), { recursive: true, force: true });\n\n  const packageJsonPath = join(opts.outDir, \"package.json\");\n  const spec = loadManifestNormalizationSpec(opts.repoRoot);\n  const pkg = readJson<PackageJson>(packageJsonPath);\n\n  normalizePackageManifest(pkg, spec, {\n    resolveCatalogRefs: true,\n    preserveCatalogRefs: false,\n    removeWorkspaces: true,\n    removePublishScripts: true,\n  });\n\n  stripDevelopmentExports(pkg);\n\n  writeJson(packageJsonPath, pkg);\n}\n\nexport function stageReleasePackages(opts: {\n  repoRoot: string;\n  outDir: string;\n  packageNames?: string[];\n}) {\n  const packageNames = opts.packageNames ?? [...FRAMEWORK_PACKAGES];\n  rmSync(opts.outDir, { recursive: true, force: true });\n  mkdirSync(opts.outDir, { recursive: true });\n\n  for (const packageName of packageNames) {\n    stageReleasePackage({\n      repoRoot: opts.repoRoot,\n      packageName,\n      outDir: join(opts.outDir, packageName),\n    });\n  }\n}\n"],"mappings":";;;;;AAIA,MAAM,qBAAqB,CAAC,gBAAgB,gBAAgB;AAE5D,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAuBA,SAAS,SAAY,UAAqB;CACxC,OAAO,KAAK,gCAAmB,UAAU,OAAO,CAAC;AACnD;AAEA,SAAS,oBAAoB,OAA0C;CACrE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,QAAQ,MAAM,MAAM,mCAAmC;CAC7D,OAAO,QAAQ,MAAM,KAAK;AAC5B;AAEA,SAAS,UAAU,UAAkB,OAAoB;CACvD,2BAAc,UAAU,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AAC/D;AAEA,SAAgB,8BAA8B,eAA0C;CAEtF,MAAM,cAAc,EAClB,GAFkB,6BAA2B,eAAe,cAAc,CAE1D,CAAC,CAAC,YAAiE,WACjF,CAAC,EACL;CACA,MAAM,oBAA4C,CAAC;CAEnD,KAAK,MAAM,eAAe,oBAAoB;EAC5C,MAAM,wCAAyB,eAAe,YAAY,aAAa,cAAc;EACrF,MAAM,kDAA6C,MAAM,MAAM,aAAa,cAAc;EAC1F,MAAM,yCAA4B,gBAAgB,IAC9C,SAA8B,gBAAgB,CAAC,CAAC,kCACrC,iBAAiB,IAC1B,SAA8B,iBAAiB,CAAC,CAAC,UACjD,oBAAoB,YAAY,YAAY;EAElD,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,iCAAiC,aAAa;EAGhE,kBAAkB,eAAe;EACjC,YAAY,eAAe,IAAI;CACjC;CAEA,OAAO;EAAE;EAAa;CAAkB;AAC1C;AAEA,SAAS,uBACP,KACA,MACA,SACA;CACA,MAAM,kCAAkB,IAAI,IAAY,CAAC,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;CAEzF,IAAI,WAAW;CAEf,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,QAAQ,uBAAuB,gBAAgB,IAAI,IAAI,GAAG;GAC5D,IAAI,YAAY,YAAY;IAC1B,IAAI,QAAQ;IACZ,WAAW;GACb;GACA;EACF;EAEA,IAAI,YAAY,eAAe;GAC7B,MAAM,mBAAmB,KAAK,kBAAkB;GAChD,IAAI,kBAAkB;IACpB,IAAI,QAAQ,IAAI;IAChB,WAAW;IACX;GACF;GAEA,IAAI,QAAQ,qBAAqB,SAAS,IAAI,GAAG;IAC/C,OAAO,IAAI;IACX,WAAW;GACb;GACA;EACF;EAEA,IAAI,QAAQ,sBAAsB,QAAQ,WAAW,UAAU,GAAG;GAChE,MAAM,WAAW,KAAK,YAAY;GAClC,IAAI,UAAU;IACZ,IAAI,QAAQ;IACZ,WAAW;GACb;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,yBACd,KACA,MACA,SACA;CACA,IAAI,WAAW;CAEf,KAAK,MAAM,YAAY;EAAC;EAAgB;EAAmB;CAAkB,GAAG;EAC9E,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;EACvC,IAAI,uBAAuB,MAAgC,MAAM,OAAO,GACtE,WAAW;CAEf;CAEA,IAAI,IAAI,cAAc,OAAO,IAAI,eAAe,UAAU;EACxD,MAAM,aAAa,IAAI;EAKvB,IAAI,QAAQ,8BAA8B,MAAM,QAAQ,WAAW,QAAQ,GAAG;GAC5E,MAAM,eAAe,WAAW,SAAS,QACtC,UAAU,CAAC,mBAAmB,MAAM,SAAS,UAAU,YAAY,MAAM,CAC5E;GACA,IAAI,aAAa,WAAW,WAAW,SAAS,QAAQ;IACtD,WAAW,WAAW;IACtB,WAAW;GACb;EACF;EAEA,IAAI,WAAW,WAAW,OAAO,WAAW,YAAY,UACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,WAAW,OAAO,GAAG;GAChE,MAAM,WAAW,KAAK,YAAY;GAClC,IAAI,YAAY,aAAa,SAAS;IACpC,WAAW,QAAQ,QAAQ;IAC3B,WAAW;IACX;GACF;GAEA,IAAI,YAAY,iBAAiB,KAAK,kBAAkB,OAAO;IAC7D,WAAW,QAAQ,QAAQ,IAAI,KAAK,kBAAkB;IACtD,WAAW;GACb;EACF;CAEJ;CAEA,IAAI,QAAQ,oBAAoB,gBAAgB,KAAK;EACnD,OAAO,IAAI;EACX,WAAW;CACb;CAEA,IAAI,QAAQ,wBAAwB,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;EAClF,MAAM,UAAU,IAAI;EACpB,IAAI,kBAAkB;EACtB,KAAK,MAAM,OAAO;GAAC;GAAkB;GAAW;GAAW;EAAU,GACnE,IAAI,OAAO,SAAS;GAClB,OAAO,QAAQ;GACf,kBAAkB;EACpB;EAEF,IAAI,iBAAiB;GACnB,WAAW;GACX,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAClC,OAAO,IAAI;EAEf;CACF;CAEA,OAAO;AACT;AAEA,eAAsB,gCAAgC,MAA4B;CAChF,MAAM,OAAO,8BAA8B,KAAK,aAAa;CAC7D,MAAM,QAAQ,qBAAW,mBAAmB;EAC1C,KAAK,KAAK;EACV,OAAO;EACP,KAAK;EACL,UAAU;EACV,QAAQ,CAAC,oBAAoB;CAC/B,CAAC;CAED,MAAM,eAAyB,CAAC;CAEhC,KAAK,MAAM,YAAY,OAAO;EAC5B,MAAM,MAAM,SAAsB,QAAQ;EAC1C,IAAI,yBAAyB,KAAK,MAAM,IAAI,GAAG;GAC7C,UAAU,UAAU,GAAG;GACvB,aAAa,KAAK,QAAQ;EAC5B;CACF;CAEA,OAAO;AACT"}
+{"version":3,"file":"manifest-normalizer.cjs","names":["readFileSync","readWorkspaceCatalog","join","existsSync"],"sources":["../../src/internal/manifest-normalizer.ts"],"sourcesContent":["import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join, relative, sep } from \"node:path\";\nimport { glob } from \"glob\";\nimport { readWorkspaceCatalog } from \"../workspace-catalog\";\n\nconst FRAMEWORK_PACKAGES = [\"every-plugin\", \"everything-dev\"] as const;\n\nconst CATALOG_TOOL_PACKAGES = [\n  \"@rspack/core\",\n  \"@rspack/cli\",\n  \"@rsbuild/core\",\n  \"@rsbuild/plugin-react\",\n  \"@module-federation/enhanced\",\n  \"@module-federation/node\",\n  \"@module-federation/rsbuild-plugin\",\n  \"@module-federation/runtime-core\",\n  \"@module-federation/sdk\",\n  \"@module-federation/dts-plugin\",\n] as const;\n\ntype PackageJson = Record<string, unknown>;\n\ntype NormalizationSpec = {\n  rootCatalog: Record<string, string>;\n  frameworkVersions: Record<string, string>;\n};\n\ntype NormalizeManifestOptions = {\n  resolveCatalogRefs: boolean;\n  preserveCatalogRefs?: boolean;\n  excludeFrameworkWorkspaces?: boolean;\n  removeWorkspaceDeps?: string[];\n  removeWorkspaces?: boolean;\n  removePublishScripts?: boolean;\n};\n\nexport type NormalizeTreeOptions = NormalizeManifestOptions & {\n  sourceRootDir: string;\n  targetDir: string;\n};\n\nfunction readJson<T>(filePath: string): T {\n  return JSON.parse(readFileSync(filePath, \"utf-8\")) as T;\n}\n\nfunction extractExactVersion(input: string | undefined): string | null {\n  if (!input) return null;\n  const match = input.match(/\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?/);\n  return match ? match[0] : null;\n}\n\nfunction writeJson(filePath: string, value: PackageJson) {\n  writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function loadManifestNormalizationSpec(sourceRootDir: string): NormalizationSpec {\n  const rootCatalog = readWorkspaceCatalog(sourceRootDir);\n  const frameworkVersions: Record<string, string> = {};\n\n  for (const packageName of FRAMEWORK_PACKAGES) {\n    const sourcePackagePath = join(sourceRootDir, \"packages\", packageName, \"package.json\");\n    const localPackagePath = join(import.meta.dirname, \"..\", \"..\", packageName, \"package.json\");\n    const packageVersion = existsSync(localPackagePath)\n      ? readJson<{ version: string }>(localPackagePath).version\n      : existsSync(sourcePackagePath)\n        ? readJson<{ version: string }>(sourcePackagePath).version\n        : extractExactVersion(rootCatalog[packageName]);\n\n    if (!packageVersion) {\n      throw new Error(`Could not resolve version for ${packageName}`);\n    }\n\n    frameworkVersions[packageName] = packageVersion;\n    rootCatalog[packageName] = `^${packageVersion}`;\n  }\n\n  return { rootCatalog, frameworkVersions };\n}\n\nfunction normalizeDependencyMap(\n  map: Record<string, string>,\n  spec: NormalizationSpec,\n  options: NormalizeManifestOptions,\n) {\n  const catalogPackages = new Set<string>([...FRAMEWORK_PACKAGES, ...CATALOG_TOOL_PACKAGES]);\n\n  let modified = false;\n\n  for (const [name, version] of Object.entries(map)) {\n    if (options.preserveCatalogRefs && catalogPackages.has(name)) {\n      if (version !== \"catalog:\") {\n        map[name] = \"catalog:\";\n        modified = true;\n      }\n      continue;\n    }\n\n    if (version.startsWith(\"workspace:\")) {\n      const frameworkVersion = spec.frameworkVersions[name];\n      if (frameworkVersion) {\n        map[name] = `^${frameworkVersion}`;\n        modified = true;\n        continue;\n      }\n\n      if (options.removeWorkspaceDeps?.includes(name)) {\n        delete map[name];\n        modified = true;\n        continue;\n      }\n\n      // A workspace dep on a non-framework member (e.g. better-near-auth)\n      // cannot resolve in a generated child — the member does not exist\n      // there. Children keep the catalog: protocol (the catalog pins the\n      // published version); release staging resolves the real range.\n      if (spec.rootCatalog[name]) {\n        map[name] = options.preserveCatalogRefs ? \"catalog:\" : spec.rootCatalog[name];\n        modified = true;\n      }\n      continue;\n    }\n\n    if (options.resolveCatalogRefs && version.startsWith(\"catalog:\")) {\n      const resolved = spec.rootCatalog[name];\n      if (resolved) {\n        map[name] = resolved;\n        modified = true;\n      }\n    }\n  }\n\n  return modified;\n}\n\nexport function normalizePackageManifest(\n  pkg: PackageJson,\n  spec: NormalizationSpec,\n  options: NormalizeManifestOptions,\n) {\n  let modified = false;\n\n  for (const depField of [\"dependencies\", \"devDependencies\", \"peerDependencies\"]) {\n    const deps = pkg[depField];\n    if (!deps || typeof deps !== \"object\") continue;\n    if (normalizeDependencyMap(deps as Record<string, string>, spec, options)) {\n      modified = true;\n    }\n  }\n\n  if (pkg.workspaces && typeof pkg.workspaces === \"object\") {\n    const workspaces = pkg.workspaces as {\n      packages?: string[];\n      catalog?: Record<string, string>;\n    };\n\n    if (options.excludeFrameworkWorkspaces && Array.isArray(workspaces.packages)) {\n      const nextPackages = workspaces.packages.filter(\n        (entry) => !FRAMEWORK_PACKAGES.some((name) => entry === `packages/${name}`),\n      );\n      if (nextPackages.length !== workspaces.packages.length) {\n        workspaces.packages = nextPackages;\n        modified = true;\n      }\n    }\n\n    if (workspaces.catalog && typeof workspaces.catalog === \"object\") {\n      for (const [name, version] of Object.entries(workspaces.catalog)) {\n        const resolved = spec.rootCatalog[name];\n        if (resolved && resolved !== version) {\n          workspaces.catalog[name] = resolved;\n          modified = true;\n          continue;\n        }\n\n        if (version === \"workspace:*\" && spec.frameworkVersions[name]) {\n          workspaces.catalog[name] = `^${spec.frameworkVersions[name]}`;\n          modified = true;\n        }\n      }\n    }\n  }\n\n  if (options.removeWorkspaces && \"workspaces\" in pkg) {\n    delete pkg.workspaces;\n    modified = true;\n  }\n\n  if (options.removePublishScripts && pkg.scripts && typeof pkg.scripts === \"object\") {\n    const scripts = pkg.scripts as Record<string, string>;\n    let scriptsModified = false;\n    for (const key of [\"prepublishOnly\", \"prepack\", \"prepare\", \"postpack\"]) {\n      if (key in scripts) {\n        delete scripts[key];\n        scriptsModified = true;\n      }\n    }\n    if (scriptsModified) {\n      modified = true;\n      if (Object.keys(scripts).length === 0) {\n        delete pkg.scripts;\n      }\n    }\n  }\n\n  return modified;\n}\n\nexport async function normalizePackageManifestsInTree(opts: NormalizeTreeOptions) {\n  const spec = loadManifestNormalizationSpec(opts.sourceRootDir);\n  const files = await glob(\"**/package.json\", {\n    cwd: opts.targetDir,\n    nodir: true,\n    dot: false,\n    absolute: true,\n    ignore: [\"**/node_modules/**\"],\n  });\n\n  const updatedFiles: string[] = [];\n\n  for (const filePath of files) {\n    const pkg = readJson<PackageJson>(filePath);\n    if (normalizePackageManifest(pkg, spec, opts)) {\n      writeJson(filePath, pkg);\n      updatedFiles.push(filePath);\n    }\n  }\n\n  return updatedFiles;\n}\n\nfunction shouldCopyPackageFile(sourceDir: string, filePath: string) {\n  const relPath = relative(sourceDir, filePath);\n  if (!relPath) return true;\n  const segments = relPath.split(sep);\n  return !segments.includes(\"node_modules\") && !segments.includes(\"tests\");\n}\n\nfunction stripDevelopmentExports(pkg: PackageJson) {\n  const exports = pkg.exports;\n  if (!exports || typeof exports !== \"object\") return;\n\n  for (const key of Object.keys(exports as Record<string, unknown>)) {\n    const entry = (exports as Record<string, unknown>)[key];\n    if (entry && typeof entry === \"object\") {\n      delete (entry as Record<string, unknown>).development;\n    }\n  }\n}\n\nexport function stageReleasePackage(opts: {\n  repoRoot: string;\n  packageName: string;\n  outDir: string;\n}) {\n  const sourceDir = join(opts.repoRoot, \"packages\", opts.packageName);\n\n  rmSync(opts.outDir, { recursive: true, force: true });\n  mkdirSync(dirname(opts.outDir), { recursive: true });\n  cpSync(sourceDir, opts.outDir, {\n    recursive: true,\n    filter: (filePath) => shouldCopyPackageFile(sourceDir, filePath),\n  });\n  rmSync(join(opts.outDir, \"tests\"), { recursive: true, force: true });\n\n  const packageJsonPath = join(opts.outDir, \"package.json\");\n  const spec = loadManifestNormalizationSpec(opts.repoRoot);\n  const pkg = readJson<PackageJson>(packageJsonPath);\n\n  normalizePackageManifest(pkg, spec, {\n    resolveCatalogRefs: true,\n    preserveCatalogRefs: false,\n    removeWorkspaces: true,\n    removePublishScripts: true,\n  });\n\n  stripDevelopmentExports(pkg);\n\n  writeJson(packageJsonPath, pkg);\n}\n\nexport function stageReleasePackages(opts: {\n  repoRoot: string;\n  outDir: string;\n  packageNames?: string[];\n}) {\n  const packageNames = opts.packageNames ?? [...FRAMEWORK_PACKAGES];\n  rmSync(opts.outDir, { recursive: true, force: true });\n  mkdirSync(opts.outDir, { recursive: true });\n\n  for (const packageName of packageNames) {\n    stageReleasePackage({\n      repoRoot: opts.repoRoot,\n      packageName,\n      outDir: join(opts.outDir, packageName),\n    });\n  }\n}\n"],"mappings":";;;;;;AAKA,MAAM,qBAAqB,CAAC,gBAAgB,gBAAgB;AAE5D,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAuBA,SAAS,SAAY,UAAqB;CACxC,OAAO,KAAK,UAAMA,sBAAa,UAAU,OAAO,CAAC;AACnD;AAEA,SAAS,oBAAoB,OAA0C;CACrE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,QAAQ,MAAM,MAAM,mCAAmC;CAC7D,OAAO,QAAQ,MAAM,KAAK;AAC5B;AAEA,SAAS,UAAU,UAAkB,OAAoB;CACvD,2BAAc,UAAU,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AAC/D;AAEA,SAAgB,8BAA8B,eAA0C;CACtF,MAAM,cAAcC,+CAAqB,aAAa;CACtD,MAAM,oBAA4C,CAAC;CAEnD,KAAK,MAAM,eAAe,oBAAoB;EAC5C,MAAM,wBAAoBC,gBAAK,eAAe,YAAY,aAAa,cAAc;EACrF,MAAM,uBAAmBA,2BAA0B,MAAM,MAAM,aAAa,cAAc;EAC1F,MAAM,qBAAiBC,oBAAW,gBAAgB,IAC9C,SAA8B,gBAAgB,CAAC,CAAC,cAChDA,oBAAW,iBAAiB,IAC1B,SAA8B,iBAAiB,CAAC,CAAC,UACjD,oBAAoB,YAAY,YAAY;EAElD,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,iCAAiC,aAAa;EAGhE,kBAAkB,eAAe;EACjC,YAAY,eAAe,IAAI;CACjC;CAEA,OAAO;EAAE;EAAa;CAAkB;AAC1C;AAEA,SAAS,uBACP,KACA,MACA,SACA;CACA,MAAM,kCAAkB,IAAI,IAAY,CAAC,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;CAEzF,IAAI,WAAW;CAEf,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,QAAQ,uBAAuB,gBAAgB,IAAI,IAAI,GAAG;GAC5D,IAAI,YAAY,YAAY;IAC1B,IAAI,QAAQ;IACZ,WAAW;GACb;GACA;EACF;EAEA,IAAI,QAAQ,WAAW,YAAY,GAAG;GACpC,MAAM,mBAAmB,KAAK,kBAAkB;GAChD,IAAI,kBAAkB;IACpB,IAAI,QAAQ,IAAI;IAChB,WAAW;IACX;GACF;GAEA,IAAI,QAAQ,qBAAqB,SAAS,IAAI,GAAG;IAC/C,OAAO,IAAI;IACX,WAAW;IACX;GACF;GAMA,IAAI,KAAK,YAAY,OAAO;IAC1B,IAAI,QAAQ,QAAQ,sBAAsB,aAAa,KAAK,YAAY;IACxE,WAAW;GACb;GACA;EACF;EAEA,IAAI,QAAQ,sBAAsB,QAAQ,WAAW,UAAU,GAAG;GAChE,MAAM,WAAW,KAAK,YAAY;GAClC,IAAI,UAAU;IACZ,IAAI,QAAQ;IACZ,WAAW;GACb;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,yBACd,KACA,MACA,SACA;CACA,IAAI,WAAW;CAEf,KAAK,MAAM,YAAY;EAAC;EAAgB;EAAmB;CAAkB,GAAG;EAC9E,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;EACvC,IAAI,uBAAuB,MAAgC,MAAM,OAAO,GACtE,WAAW;CAEf;CAEA,IAAI,IAAI,cAAc,OAAO,IAAI,eAAe,UAAU;EACxD,MAAM,aAAa,IAAI;EAKvB,IAAI,QAAQ,8BAA8B,MAAM,QAAQ,WAAW,QAAQ,GAAG;GAC5E,MAAM,eAAe,WAAW,SAAS,QACtC,UAAU,CAAC,mBAAmB,MAAM,SAAS,UAAU,YAAY,MAAM,CAC5E;GACA,IAAI,aAAa,WAAW,WAAW,SAAS,QAAQ;IACtD,WAAW,WAAW;IACtB,WAAW;GACb;EACF;EAEA,IAAI,WAAW,WAAW,OAAO,WAAW,YAAY,UACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,WAAW,OAAO,GAAG;GAChE,MAAM,WAAW,KAAK,YAAY;GAClC,IAAI,YAAY,aAAa,SAAS;IACpC,WAAW,QAAQ,QAAQ;IAC3B,WAAW;IACX;GACF;GAEA,IAAI,YAAY,iBAAiB,KAAK,kBAAkB,OAAO;IAC7D,WAAW,QAAQ,QAAQ,IAAI,KAAK,kBAAkB;IACtD,WAAW;GACb;EACF;CAEJ;CAEA,IAAI,QAAQ,oBAAoB,gBAAgB,KAAK;EACnD,OAAO,IAAI;EACX,WAAW;CACb;CAEA,IAAI,QAAQ,wBAAwB,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;EAClF,MAAM,UAAU,IAAI;EACpB,IAAI,kBAAkB;EACtB,KAAK,MAAM,OAAO;GAAC;GAAkB;GAAW;GAAW;EAAU,GACnE,IAAI,OAAO,SAAS;GAClB,OAAO,QAAQ;GACf,kBAAkB;EACpB;EAEF,IAAI,iBAAiB;GACnB,WAAW;GACX,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAClC,OAAO,IAAI;EAEf;CACF;CAEA,OAAO;AACT;AAEA,eAAsB,gCAAgC,MAA4B;CAChF,MAAM,OAAO,8BAA8B,KAAK,aAAa;CAC7D,MAAM,QAAQ,UAAM,WAAK,mBAAmB;EAC1C,KAAK,KAAK;EACV,OAAO;EACP,KAAK;EACL,UAAU;EACV,QAAQ,CAAC,oBAAoB;CAC/B,CAAC;CAED,MAAM,eAAyB,CAAC;CAEhC,KAAK,MAAM,YAAY,OAAO;EAC5B,MAAM,MAAM,SAAsB,QAAQ;EAC1C,IAAI,yBAAyB,KAAK,MAAM,IAAI,GAAG;GAC7C,UAAU,UAAU,GAAG;GACvB,aAAa,KAAK,QAAQ;EAC5B;CACF;CAEA,OAAO;AACT"}

package/dist/internal/manifest-normalizer.mjs

@@ -1,5 +1,6 @@
+import { readWorkspaceCatalog } from "../workspace-catalog.mjs";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, relative } from "node:path";
+import { dirname, join, relative, sep } from "node:path";
 import { glob } from "glob";
 
 //#region src/internal/manifest-normalizer.ts
@@ -28,7 +29,7 @@ function writeJson(filePath, value) {
 	writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
 }
 function loadManifestNormalizationSpec(sourceRootDir) {
-	const rootCatalog = { ...readJson(join(sourceRootDir, "package.json")).workspaces?.catalog ?? {} };
+	const rootCatalog = readWorkspaceCatalog(sourceRootDir);
 	const frameworkVersions = {};
 	for (const packageName of FRAMEWORK_PACKAGES) {
 		const sourcePackagePath = join(sourceRootDir, "packages", packageName, "package.json");
@@ -54,7 +55,7 @@ function normalizeDependencyMap(map, spec, options) {
 			}
 			continue;
 		}
-		if (version === "workspace:*") {
+		if (version.startsWith("workspace:")) {
 			const frameworkVersion = spec.frameworkVersions[name];
 			if (frameworkVersion) {
 				map[name] = `^${frameworkVersion}`;
@@ -64,6 +65,11 @@ function normalizeDependencyMap(map, spec, options) {
 			if (options.removeWorkspaceDeps?.includes(name)) {
 				delete map[name];
 				modified = true;
+				continue;
+			}
+			if (spec.rootCatalog[name]) {
+				map[name] = options.preserveCatalogRefs ? "catalog:" : spec.rootCatalog[name];
+				modified = true;
 			}
 			continue;
 		}

package/dist/internal/manifest-normalizer.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-normalizer.mjs","names":[],"sources":["../../src/internal/manifest-normalizer.ts"],"sourcesContent":["import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join, relative, sep } from \"node:path\";\nimport { glob } from \"glob\";\n\nconst FRAMEWORK_PACKAGES = [\"every-plugin\", \"everything-dev\"] as const;\n\nconst CATALOG_TOOL_PACKAGES = [\n  \"@rspack/core\",\n  \"@rspack/cli\",\n  \"@rsbuild/core\",\n  \"@rsbuild/plugin-react\",\n  \"@module-federation/enhanced\",\n  \"@module-federation/node\",\n  \"@module-federation/rsbuild-plugin\",\n  \"@module-federation/runtime-core\",\n  \"@module-federation/sdk\",\n  \"@module-federation/dts-plugin\",\n] as const;\n\ntype PackageJson = Record<string, unknown>;\n\ntype NormalizationSpec = {\n  rootCatalog: Record<string, string>;\n  frameworkVersions: Record<string, string>;\n};\n\ntype NormalizeManifestOptions = {\n  resolveCatalogRefs: boolean;\n  preserveCatalogRefs?: boolean;\n  excludeFrameworkWorkspaces?: boolean;\n  removeWorkspaceDeps?: string[];\n  removeWorkspaces?: boolean;\n  removePublishScripts?: boolean;\n};\n\nexport type NormalizeTreeOptions = NormalizeManifestOptions & {\n  sourceRootDir: string;\n  targetDir: string;\n};\n\nfunction readJson<T>(filePath: string): T {\n  return JSON.parse(readFileSync(filePath, \"utf-8\")) as T;\n}\n\nfunction extractExactVersion(input: string | undefined): string | null {\n  if (!input) return null;\n  const match = input.match(/\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?/);\n  return match ? match[0] : null;\n}\n\nfunction writeJson(filePath: string, value: PackageJson) {\n  writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function loadManifestNormalizationSpec(sourceRootDir: string): NormalizationSpec {\n  const rootPackage = readJson<PackageJson>(join(sourceRootDir, \"package.json\"));\n  const rootCatalog = {\n    ...(((rootPackage.workspaces as { catalog?: Record<string, string> } | undefined)?.catalog ??\n      {}) as Record<string, string>),\n  };\n  const frameworkVersions: Record<string, string> = {};\n\n  for (const packageName of FRAMEWORK_PACKAGES) {\n    const sourcePackagePath = join(sourceRootDir, \"packages\", packageName, \"package.json\");\n    const localPackagePath = join(import.meta.dirname, \"..\", \"..\", packageName, \"package.json\");\n    const packageVersion = existsSync(localPackagePath)\n      ? readJson<{ version: string }>(localPackagePath).version\n      : existsSync(sourcePackagePath)\n        ? readJson<{ version: string }>(sourcePackagePath).version\n        : extractExactVersion(rootCatalog[packageName]);\n\n    if (!packageVersion) {\n      throw new Error(`Could not resolve version for ${packageName}`);\n    }\n\n    frameworkVersions[packageName] = packageVersion;\n    rootCatalog[packageName] = `^${packageVersion}`;\n  }\n\n  return { rootCatalog, frameworkVersions };\n}\n\nfunction normalizeDependencyMap(\n  map: Record<string, string>,\n  spec: NormalizationSpec,\n  options: NormalizeManifestOptions,\n) {\n  const catalogPackages = new Set<string>([...FRAMEWORK_PACKAGES, ...CATALOG_TOOL_PACKAGES]);\n\n  let modified = false;\n\n  for (const [name, version] of Object.entries(map)) {\n    if (options.preserveCatalogRefs && catalogPackages.has(name)) {\n      if (version !== \"catalog:\") {\n        map[name] = \"catalog:\";\n        modified = true;\n      }\n      continue;\n    }\n\n    if (version === \"workspace:*\") {\n      const frameworkVersion = spec.frameworkVersions[name];\n      if (frameworkVersion) {\n        map[name] = `^${frameworkVersion}`;\n        modified = true;\n        continue;\n      }\n\n      if (options.removeWorkspaceDeps?.includes(name)) {\n        delete map[name];\n        modified = true;\n      }\n      continue;\n    }\n\n    if (options.resolveCatalogRefs && version.startsWith(\"catalog:\")) {\n      const resolved = spec.rootCatalog[name];\n      if (resolved) {\n        map[name] = resolved;\n        modified = true;\n      }\n    }\n  }\n\n  return modified;\n}\n\nexport function normalizePackageManifest(\n  pkg: PackageJson,\n  spec: NormalizationSpec,\n  options: NormalizeManifestOptions,\n) {\n  let modified = false;\n\n  for (const depField of [\"dependencies\", \"devDependencies\", \"peerDependencies\"]) {\n    const deps = pkg[depField];\n    if (!deps || typeof deps !== \"object\") continue;\n    if (normalizeDependencyMap(deps as Record<string, string>, spec, options)) {\n      modified = true;\n    }\n  }\n\n  if (pkg.workspaces && typeof pkg.workspaces === \"object\") {\n    const workspaces = pkg.workspaces as {\n      packages?: string[];\n      catalog?: Record<string, string>;\n    };\n\n    if (options.excludeFrameworkWorkspaces && Array.isArray(workspaces.packages)) {\n      const nextPackages = workspaces.packages.filter(\n        (entry) => !FRAMEWORK_PACKAGES.some((name) => entry === `packages/${name}`),\n      );\n      if (nextPackages.length !== workspaces.packages.length) {\n        workspaces.packages = nextPackages;\n        modified = true;\n      }\n    }\n\n    if (workspaces.catalog && typeof workspaces.catalog === \"object\") {\n      for (const [name, version] of Object.entries(workspaces.catalog)) {\n        const resolved = spec.rootCatalog[name];\n        if (resolved && resolved !== version) {\n          workspaces.catalog[name] = resolved;\n          modified = true;\n          continue;\n        }\n\n        if (version === \"workspace:*\" && spec.frameworkVersions[name]) {\n          workspaces.catalog[name] = `^${spec.frameworkVersions[name]}`;\n          modified = true;\n        }\n      }\n    }\n  }\n\n  if (options.removeWorkspaces && \"workspaces\" in pkg) {\n    delete pkg.workspaces;\n    modified = true;\n  }\n\n  if (options.removePublishScripts && pkg.scripts && typeof pkg.scripts === \"object\") {\n    const scripts = pkg.scripts as Record<string, string>;\n    let scriptsModified = false;\n    for (const key of [\"prepublishOnly\", \"prepack\", \"prepare\", \"postpack\"]) {\n      if (key in scripts) {\n        delete scripts[key];\n        scriptsModified = true;\n      }\n    }\n    if (scriptsModified) {\n      modified = true;\n      if (Object.keys(scripts).length === 0) {\n        delete pkg.scripts;\n      }\n    }\n  }\n\n  return modified;\n}\n\nexport async function normalizePackageManifestsInTree(opts: NormalizeTreeOptions) {\n  const spec = loadManifestNormalizationSpec(opts.sourceRootDir);\n  const files = await glob(\"**/package.json\", {\n    cwd: opts.targetDir,\n    nodir: true,\n    dot: false,\n    absolute: true,\n    ignore: [\"**/node_modules/**\"],\n  });\n\n  const updatedFiles: string[] = [];\n\n  for (const filePath of files) {\n    const pkg = readJson<PackageJson>(filePath);\n    if (normalizePackageManifest(pkg, spec, opts)) {\n      writeJson(filePath, pkg);\n      updatedFiles.push(filePath);\n    }\n  }\n\n  return updatedFiles;\n}\n\nfunction shouldCopyPackageFile(sourceDir: string, filePath: string) {\n  const relPath = relative(sourceDir, filePath);\n  if (!relPath) return true;\n  const segments = relPath.split(sep);\n  return !segments.includes(\"node_modules\") && !segments.includes(\"tests\");\n}\n\nfunction stripDevelopmentExports(pkg: PackageJson) {\n  const exports = pkg.exports;\n  if (!exports || typeof exports !== \"object\") return;\n\n  for (const key of Object.keys(exports as Record<string, unknown>)) {\n    const entry = (exports as Record<string, unknown>)[key];\n    if (entry && typeof entry === \"object\") {\n      delete (entry as Record<string, unknown>).development;\n    }\n  }\n}\n\nexport function stageReleasePackage(opts: {\n  repoRoot: string;\n  packageName: string;\n  outDir: string;\n}) {\n  const sourceDir = join(opts.repoRoot, \"packages\", opts.packageName);\n\n  rmSync(opts.outDir, { recursive: true, force: true });\n  mkdirSync(dirname(opts.outDir), { recursive: true });\n  cpSync(sourceDir, opts.outDir, {\n    recursive: true,\n    filter: (filePath) => shouldCopyPackageFile(sourceDir, filePath),\n  });\n  rmSync(join(opts.outDir, \"tests\"), { recursive: true, force: true });\n\n  const packageJsonPath = join(opts.outDir, \"package.json\");\n  const spec = loadManifestNormalizationSpec(opts.repoRoot);\n  const pkg = readJson<PackageJson>(packageJsonPath);\n\n  normalizePackageManifest(pkg, spec, {\n    resolveCatalogRefs: true,\n    preserveCatalogRefs: false,\n    removeWorkspaces: true,\n    removePublishScripts: true,\n  });\n\n  stripDevelopmentExports(pkg);\n\n  writeJson(packageJsonPath, pkg);\n}\n\nexport function stageReleasePackages(opts: {\n  repoRoot: string;\n  outDir: string;\n  packageNames?: string[];\n}) {\n  const packageNames = opts.packageNames ?? [...FRAMEWORK_PACKAGES];\n  rmSync(opts.outDir, { recursive: true, force: true });\n  mkdirSync(opts.outDir, { recursive: true });\n\n  for (const packageName of packageNames) {\n    stageReleasePackage({\n      repoRoot: opts.repoRoot,\n      packageName,\n      outDir: join(opts.outDir, packageName),\n    });\n  }\n}\n"],"mappings":";;;;;AAIA,MAAM,qBAAqB,CAAC,gBAAgB,gBAAgB;AAE5D,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAuBA,SAAS,SAAY,UAAqB;CACxC,OAAO,KAAK,MAAM,aAAa,UAAU,OAAO,CAAC;AACnD;AAEA,SAAS,oBAAoB,OAA0C;CACrE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,QAAQ,MAAM,MAAM,mCAAmC;CAC7D,OAAO,QAAQ,MAAM,KAAK;AAC5B;AAEA,SAAS,UAAU,UAAkB,OAAoB;CACvD,cAAc,UAAU,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AAC/D;AAEA,SAAgB,8BAA8B,eAA0C;CAEtF,MAAM,cAAc,EAClB,GAFkB,SAAsB,KAAK,eAAe,cAAc,CAE1D,CAAC,CAAC,YAAiE,WACjF,CAAC,EACL;CACA,MAAM,oBAA4C,CAAC;CAEnD,KAAK,MAAM,eAAe,oBAAoB;EAC5C,MAAM,oBAAoB,KAAK,eAAe,YAAY,aAAa,cAAc;EACrF,MAAM,mBAAmB,KAAK,OAAO,KAAK,SAAS,MAAM,MAAM,aAAa,cAAc;EAC1F,MAAM,iBAAiB,WAAW,gBAAgB,IAC9C,SAA8B,gBAAgB,CAAC,CAAC,UAChD,WAAW,iBAAiB,IAC1B,SAA8B,iBAAiB,CAAC,CAAC,UACjD,oBAAoB,YAAY,YAAY;EAElD,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,iCAAiC,aAAa;EAGhE,kBAAkB,eAAe;EACjC,YAAY,eAAe,IAAI;CACjC;CAEA,OAAO;EAAE;EAAa;CAAkB;AAC1C;AAEA,SAAS,uBACP,KACA,MACA,SACA;CACA,MAAM,kCAAkB,IAAI,IAAY,CAAC,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;CAEzF,IAAI,WAAW;CAEf,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,QAAQ,uBAAuB,gBAAgB,IAAI,IAAI,GAAG;GAC5D,IAAI,YAAY,YAAY;IAC1B,IAAI,QAAQ;IACZ,WAAW;GACb;GACA;EACF;EAEA,IAAI,YAAY,eAAe;GAC7B,MAAM,mBAAmB,KAAK,kBAAkB;GAChD,IAAI,kBAAkB;IACpB,IAAI,QAAQ,IAAI;IAChB,WAAW;IACX;GACF;GAEA,IAAI,QAAQ,qBAAqB,SAAS,IAAI,GAAG;IAC/C,OAAO,IAAI;IACX,WAAW;GACb;GACA;EACF;EAEA,IAAI,QAAQ,sBAAsB,QAAQ,WAAW,UAAU,GAAG;GAChE,MAAM,WAAW,KAAK,YAAY;GAClC,IAAI,UAAU;IACZ,IAAI,QAAQ;IACZ,WAAW;GACb;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,yBACd,KACA,MACA,SACA;CACA,IAAI,WAAW;CAEf,KAAK,MAAM,YAAY;EAAC;EAAgB;EAAmB;CAAkB,GAAG;EAC9E,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;EACvC,IAAI,uBAAuB,MAAgC,MAAM,OAAO,GACtE,WAAW;CAEf;CAEA,IAAI,IAAI,cAAc,OAAO,IAAI,eAAe,UAAU;EACxD,MAAM,aAAa,IAAI;EAKvB,IAAI,QAAQ,8BAA8B,MAAM,QAAQ,WAAW,QAAQ,GAAG;GAC5E,MAAM,eAAe,WAAW,SAAS,QACtC,UAAU,CAAC,mBAAmB,MAAM,SAAS,UAAU,YAAY,MAAM,CAC5E;GACA,IAAI,aAAa,WAAW,WAAW,SAAS,QAAQ;IACtD,WAAW,WAAW;IACtB,WAAW;GACb;EACF;EAEA,IAAI,WAAW,WAAW,OAAO,WAAW,YAAY,UACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,WAAW,OAAO,GAAG;GAChE,MAAM,WAAW,KAAK,YAAY;GAClC,IAAI,YAAY,aAAa,SAAS;IACpC,WAAW,QAAQ,QAAQ;IAC3B,WAAW;IACX;GACF;GAEA,IAAI,YAAY,iBAAiB,KAAK,kBAAkB,OAAO;IAC7D,WAAW,QAAQ,QAAQ,IAAI,KAAK,kBAAkB;IACtD,WAAW;GACb;EACF;CAEJ;CAEA,IAAI,QAAQ,oBAAoB,gBAAgB,KAAK;EACnD,OAAO,IAAI;EACX,WAAW;CACb;CAEA,IAAI,QAAQ,wBAAwB,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;EAClF,MAAM,UAAU,IAAI;EACpB,IAAI,kBAAkB;EACtB,KAAK,MAAM,OAAO;GAAC;GAAkB;GAAW;GAAW;EAAU,GACnE,IAAI,OAAO,SAAS;GAClB,OAAO,QAAQ;GACf,kBAAkB;EACpB;EAEF,IAAI,iBAAiB;GACnB,WAAW;GACX,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAClC,OAAO,IAAI;EAEf;CACF;CAEA,OAAO;AACT;AAEA,eAAsB,gCAAgC,MAA4B;CAChF,MAAM,OAAO,8BAA8B,KAAK,aAAa;CAC7D,MAAM,QAAQ,MAAM,KAAK,mBAAmB;EAC1C,KAAK,KAAK;EACV,OAAO;EACP,KAAK;EACL,UAAU;EACV,QAAQ,CAAC,oBAAoB;CAC/B,CAAC;CAED,MAAM,eAAyB,CAAC;CAEhC,KAAK,MAAM,YAAY,OAAO;EAC5B,MAAM,MAAM,SAAsB,QAAQ;EAC1C,IAAI,yBAAyB,KAAK,MAAM,IAAI,GAAG;GAC7C,UAAU,UAAU,GAAG;GACvB,aAAa,KAAK,QAAQ;EAC5B;CACF;CAEA,OAAO;AACT"}
+{"version":3,"file":"manifest-normalizer.mjs","names":[],"sources":["../../src/internal/manifest-normalizer.ts"],"sourcesContent":["import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { dirname, join, relative, sep } from \"node:path\";\nimport { glob } from \"glob\";\nimport { readWorkspaceCatalog } from \"../workspace-catalog\";\n\nconst FRAMEWORK_PACKAGES = [\"every-plugin\", \"everything-dev\"] as const;\n\nconst CATALOG_TOOL_PACKAGES = [\n  \"@rspack/core\",\n  \"@rspack/cli\",\n  \"@rsbuild/core\",\n  \"@rsbuild/plugin-react\",\n  \"@module-federation/enhanced\",\n  \"@module-federation/node\",\n  \"@module-federation/rsbuild-plugin\",\n  \"@module-federation/runtime-core\",\n  \"@module-federation/sdk\",\n  \"@module-federation/dts-plugin\",\n] as const;\n\ntype PackageJson = Record<string, unknown>;\n\ntype NormalizationSpec = {\n  rootCatalog: Record<string, string>;\n  frameworkVersions: Record<string, string>;\n};\n\ntype NormalizeManifestOptions = {\n  resolveCatalogRefs: boolean;\n  preserveCatalogRefs?: boolean;\n  excludeFrameworkWorkspaces?: boolean;\n  removeWorkspaceDeps?: string[];\n  removeWorkspaces?: boolean;\n  removePublishScripts?: boolean;\n};\n\nexport type NormalizeTreeOptions = NormalizeManifestOptions & {\n  sourceRootDir: string;\n  targetDir: string;\n};\n\nfunction readJson<T>(filePath: string): T {\n  return JSON.parse(readFileSync(filePath, \"utf-8\")) as T;\n}\n\nfunction extractExactVersion(input: string | undefined): string | null {\n  if (!input) return null;\n  const match = input.match(/\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?/);\n  return match ? match[0] : null;\n}\n\nfunction writeJson(filePath: string, value: PackageJson) {\n  writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function loadManifestNormalizationSpec(sourceRootDir: string): NormalizationSpec {\n  const rootCatalog = readWorkspaceCatalog(sourceRootDir);\n  const frameworkVersions: Record<string, string> = {};\n\n  for (const packageName of FRAMEWORK_PACKAGES) {\n    const sourcePackagePath = join(sourceRootDir, \"packages\", packageName, \"package.json\");\n    const localPackagePath = join(import.meta.dirname, \"..\", \"..\", packageName, \"package.json\");\n    const packageVersion = existsSync(localPackagePath)\n      ? readJson<{ version: string }>(localPackagePath).version\n      : existsSync(sourcePackagePath)\n        ? readJson<{ version: string }>(sourcePackagePath).version\n        : extractExactVersion(rootCatalog[packageName]);\n\n    if (!packageVersion) {\n      throw new Error(`Could not resolve version for ${packageName}`);\n    }\n\n    frameworkVersions[packageName] = packageVersion;\n    rootCatalog[packageName] = `^${packageVersion}`;\n  }\n\n  return { rootCatalog, frameworkVersions };\n}\n\nfunction normalizeDependencyMap(\n  map: Record<string, string>,\n  spec: NormalizationSpec,\n  options: NormalizeManifestOptions,\n) {\n  const catalogPackages = new Set<string>([...FRAMEWORK_PACKAGES, ...CATALOG_TOOL_PACKAGES]);\n\n  let modified = false;\n\n  for (const [name, version] of Object.entries(map)) {\n    if (options.preserveCatalogRefs && catalogPackages.has(name)) {\n      if (version !== \"catalog:\") {\n        map[name] = \"catalog:\";\n        modified = true;\n      }\n      continue;\n    }\n\n    if (version.startsWith(\"workspace:\")) {\n      const frameworkVersion = spec.frameworkVersions[name];\n      if (frameworkVersion) {\n        map[name] = `^${frameworkVersion}`;\n        modified = true;\n        continue;\n      }\n\n      if (options.removeWorkspaceDeps?.includes(name)) {\n        delete map[name];\n        modified = true;\n        continue;\n      }\n\n      // A workspace dep on a non-framework member (e.g. better-near-auth)\n      // cannot resolve in a generated child — the member does not exist\n      // there. Children keep the catalog: protocol (the catalog pins the\n      // published version); release staging resolves the real range.\n      if (spec.rootCatalog[name]) {\n        map[name] = options.preserveCatalogRefs ? \"catalog:\" : spec.rootCatalog[name];\n        modified = true;\n      }\n      continue;\n    }\n\n    if (options.resolveCatalogRefs && version.startsWith(\"catalog:\")) {\n      const resolved = spec.rootCatalog[name];\n      if (resolved) {\n        map[name] = resolved;\n        modified = true;\n      }\n    }\n  }\n\n  return modified;\n}\n\nexport function normalizePackageManifest(\n  pkg: PackageJson,\n  spec: NormalizationSpec,\n  options: NormalizeManifestOptions,\n) {\n  let modified = false;\n\n  for (const depField of [\"dependencies\", \"devDependencies\", \"peerDependencies\"]) {\n    const deps = pkg[depField];\n    if (!deps || typeof deps !== \"object\") continue;\n    if (normalizeDependencyMap(deps as Record<string, string>, spec, options)) {\n      modified = true;\n    }\n  }\n\n  if (pkg.workspaces && typeof pkg.workspaces === \"object\") {\n    const workspaces = pkg.workspaces as {\n      packages?: string[];\n      catalog?: Record<string, string>;\n    };\n\n    if (options.excludeFrameworkWorkspaces && Array.isArray(workspaces.packages)) {\n      const nextPackages = workspaces.packages.filter(\n        (entry) => !FRAMEWORK_PACKAGES.some((name) => entry === `packages/${name}`),\n      );\n      if (nextPackages.length !== workspaces.packages.length) {\n        workspaces.packages = nextPackages;\n        modified = true;\n      }\n    }\n\n    if (workspaces.catalog && typeof workspaces.catalog === \"object\") {\n      for (const [name, version] of Object.entries(workspaces.catalog)) {\n        const resolved = spec.rootCatalog[name];\n        if (resolved && resolved !== version) {\n          workspaces.catalog[name] = resolved;\n          modified = true;\n          continue;\n        }\n\n        if (version === \"workspace:*\" && spec.frameworkVersions[name]) {\n          workspaces.catalog[name] = `^${spec.frameworkVersions[name]}`;\n          modified = true;\n        }\n      }\n    }\n  }\n\n  if (options.removeWorkspaces && \"workspaces\" in pkg) {\n    delete pkg.workspaces;\n    modified = true;\n  }\n\n  if (options.removePublishScripts && pkg.scripts && typeof pkg.scripts === \"object\") {\n    const scripts = pkg.scripts as Record<string, string>;\n    let scriptsModified = false;\n    for (const key of [\"prepublishOnly\", \"prepack\", \"prepare\", \"postpack\"]) {\n      if (key in scripts) {\n        delete scripts[key];\n        scriptsModified = true;\n      }\n    }\n    if (scriptsModified) {\n      modified = true;\n      if (Object.keys(scripts).length === 0) {\n        delete pkg.scripts;\n      }\n    }\n  }\n\n  return modified;\n}\n\nexport async function normalizePackageManifestsInTree(opts: NormalizeTreeOptions) {\n  const spec = loadManifestNormalizationSpec(opts.sourceRootDir);\n  const files = await glob(\"**/package.json\", {\n    cwd: opts.targetDir,\n    nodir: true,\n    dot: false,\n    absolute: true,\n    ignore: [\"**/node_modules/**\"],\n  });\n\n  const updatedFiles: string[] = [];\n\n  for (const filePath of files) {\n    const pkg = readJson<PackageJson>(filePath);\n    if (normalizePackageManifest(pkg, spec, opts)) {\n      writeJson(filePath, pkg);\n      updatedFiles.push(filePath);\n    }\n  }\n\n  return updatedFiles;\n}\n\nfunction shouldCopyPackageFile(sourceDir: string, filePath: string) {\n  const relPath = relative(sourceDir, filePath);\n  if (!relPath) return true;\n  const segments = relPath.split(sep);\n  return !segments.includes(\"node_modules\") && !segments.includes(\"tests\");\n}\n\nfunction stripDevelopmentExports(pkg: PackageJson) {\n  const exports = pkg.exports;\n  if (!exports || typeof exports !== \"object\") return;\n\n  for (const key of Object.keys(exports as Record<string, unknown>)) {\n    const entry = (exports as Record<string, unknown>)[key];\n    if (entry && typeof entry === \"object\") {\n      delete (entry as Record<string, unknown>).development;\n    }\n  }\n}\n\nexport function stageReleasePackage(opts: {\n  repoRoot: string;\n  packageName: string;\n  outDir: string;\n}) {\n  const sourceDir = join(opts.repoRoot, \"packages\", opts.packageName);\n\n  rmSync(opts.outDir, { recursive: true, force: true });\n  mkdirSync(dirname(opts.outDir), { recursive: true });\n  cpSync(sourceDir, opts.outDir, {\n    recursive: true,\n    filter: (filePath) => shouldCopyPackageFile(sourceDir, filePath),\n  });\n  rmSync(join(opts.outDir, \"tests\"), { recursive: true, force: true });\n\n  const packageJsonPath = join(opts.outDir, \"package.json\");\n  const spec = loadManifestNormalizationSpec(opts.repoRoot);\n  const pkg = readJson<PackageJson>(packageJsonPath);\n\n  normalizePackageManifest(pkg, spec, {\n    resolveCatalogRefs: true,\n    preserveCatalogRefs: false,\n    removeWorkspaces: true,\n    removePublishScripts: true,\n  });\n\n  stripDevelopmentExports(pkg);\n\n  writeJson(packageJsonPath, pkg);\n}\n\nexport function stageReleasePackages(opts: {\n  repoRoot: string;\n  outDir: string;\n  packageNames?: string[];\n}) {\n  const packageNames = opts.packageNames ?? [...FRAMEWORK_PACKAGES];\n  rmSync(opts.outDir, { recursive: true, force: true });\n  mkdirSync(opts.outDir, { recursive: true });\n\n  for (const packageName of packageNames) {\n    stageReleasePackage({\n      repoRoot: opts.repoRoot,\n      packageName,\n      outDir: join(opts.outDir, packageName),\n    });\n  }\n}\n"],"mappings":";;;;;;AAKA,MAAM,qBAAqB,CAAC,gBAAgB,gBAAgB;AAE5D,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAuBA,SAAS,SAAY,UAAqB;CACxC,OAAO,KAAK,MAAM,aAAa,UAAU,OAAO,CAAC;AACnD;AAEA,SAAS,oBAAoB,OAA0C;CACrE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,QAAQ,MAAM,MAAM,mCAAmC;CAC7D,OAAO,QAAQ,MAAM,KAAK;AAC5B;AAEA,SAAS,UAAU,UAAkB,OAAoB;CACvD,cAAc,UAAU,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AAC/D;AAEA,SAAgB,8BAA8B,eAA0C;CACtF,MAAM,cAAc,qBAAqB,aAAa;CACtD,MAAM,oBAA4C,CAAC;CAEnD,KAAK,MAAM,eAAe,oBAAoB;EAC5C,MAAM,oBAAoB,KAAK,eAAe,YAAY,aAAa,cAAc;EACrF,MAAM,mBAAmB,KAAK,YAAY,SAAS,MAAM,MAAM,aAAa,cAAc;EAC1F,MAAM,iBAAiB,WAAW,gBAAgB,IAC9C,SAA8B,gBAAgB,CAAC,CAAC,UAChD,WAAW,iBAAiB,IAC1B,SAA8B,iBAAiB,CAAC,CAAC,UACjD,oBAAoB,YAAY,YAAY;EAElD,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,iCAAiC,aAAa;EAGhE,kBAAkB,eAAe;EACjC,YAAY,eAAe,IAAI;CACjC;CAEA,OAAO;EAAE;EAAa;CAAkB;AAC1C;AAEA,SAAS,uBACP,KACA,MACA,SACA;CACA,MAAM,kCAAkB,IAAI,IAAY,CAAC,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;CAEzF,IAAI,WAAW;CAEf,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,QAAQ,uBAAuB,gBAAgB,IAAI,IAAI,GAAG;GAC5D,IAAI,YAAY,YAAY;IAC1B,IAAI,QAAQ;IACZ,WAAW;GACb;GACA;EACF;EAEA,IAAI,QAAQ,WAAW,YAAY,GAAG;GACpC,MAAM,mBAAmB,KAAK,kBAAkB;GAChD,IAAI,kBAAkB;IACpB,IAAI,QAAQ,IAAI;IAChB,WAAW;IACX;GACF;GAEA,IAAI,QAAQ,qBAAqB,SAAS,IAAI,GAAG;IAC/C,OAAO,IAAI;IACX,WAAW;IACX;GACF;GAMA,IAAI,KAAK,YAAY,OAAO;IAC1B,IAAI,QAAQ,QAAQ,sBAAsB,aAAa,KAAK,YAAY;IACxE,WAAW;GACb;GACA;EACF;EAEA,IAAI,QAAQ,sBAAsB,QAAQ,WAAW,UAAU,GAAG;GAChE,MAAM,WAAW,KAAK,YAAY;GAClC,IAAI,UAAU;IACZ,IAAI,QAAQ;IACZ,WAAW;GACb;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,yBACd,KACA,MACA,SACA;CACA,IAAI,WAAW;CAEf,KAAK,MAAM,YAAY;EAAC;EAAgB;EAAmB;CAAkB,GAAG;EAC9E,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;EACvC,IAAI,uBAAuB,MAAgC,MAAM,OAAO,GACtE,WAAW;CAEf;CAEA,IAAI,IAAI,cAAc,OAAO,IAAI,eAAe,UAAU;EACxD,MAAM,aAAa,IAAI;EAKvB,IAAI,QAAQ,8BAA8B,MAAM,QAAQ,WAAW,QAAQ,GAAG;GAC5E,MAAM,eAAe,WAAW,SAAS,QACtC,UAAU,CAAC,mBAAmB,MAAM,SAAS,UAAU,YAAY,MAAM,CAC5E;GACA,IAAI,aAAa,WAAW,WAAW,SAAS,QAAQ;IACtD,WAAW,WAAW;IACtB,WAAW;GACb;EACF;EAEA,IAAI,WAAW,WAAW,OAAO,WAAW,YAAY,UACtD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,WAAW,OAAO,GAAG;GAChE,MAAM,WAAW,KAAK,YAAY;GAClC,IAAI,YAAY,aAAa,SAAS;IACpC,WAAW,QAAQ,QAAQ;IAC3B,WAAW;IACX;GACF;GAEA,IAAI,YAAY,iBAAiB,KAAK,kBAAkB,OAAO;IAC7D,WAAW,QAAQ,QAAQ,IAAI,KAAK,kBAAkB;IACtD,WAAW;GACb;EACF;CAEJ;CAEA,IAAI,QAAQ,oBAAoB,gBAAgB,KAAK;EACnD,OAAO,IAAI;EACX,WAAW;CACb;CAEA,IAAI,QAAQ,wBAAwB,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;EAClF,MAAM,UAAU,IAAI;EACpB,IAAI,kBAAkB;EACtB,KAAK,MAAM,OAAO;GAAC;GAAkB;GAAW;GAAW;EAAU,GACnE,IAAI,OAAO,SAAS;GAClB,OAAO,QAAQ;GACf,kBAAkB;EACpB;EAEF,IAAI,iBAAiB;GACnB,WAAW;GACX,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAClC,OAAO,IAAI;EAEf;CACF;CAEA,OAAO;AACT;AAEA,eAAsB,gCAAgC,MAA4B;CAChF,MAAM,OAAO,8BAA8B,KAAK,aAAa;CAC7D,MAAM,QAAQ,MAAM,KAAK,mBAAmB;EAC1C,KAAK,KAAK;EACV,OAAO;EACP,KAAK;EACL,UAAU;EACV,QAAQ,CAAC,oBAAoB;CAC/B,CAAC;CAED,MAAM,eAAyB,CAAC;CAEhC,KAAK,MAAM,YAAY,OAAO;EAC5B,MAAM,MAAM,SAAsB,QAAQ;EAC1C,IAAI,yBAAyB,KAAK,MAAM,IAAI,GAAG;GAC7C,UAAU,UAAU,GAAG;GACvB,aAAa,KAAK,QAAQ;EAC5B;CACF;CAEA,OAAO;AACT"}