rampway 0.3.0 → 0.4.0

package/README.md

@@ -22,12 +22,30 @@ This initial scaffold includes:
 - JSONL deploy reports at `shared/log/rampway-deployments.jsonl`
 - secret redaction helpers
 - basic runtime adapter interface with `none` and Rollbridge validate/deploy/status/logs/recover helpers
+- optional Rampway-owned authenticated Velocious deployment API at `rampway/velocious`
 
 SSH transport command execution supports both local-copy and remote-git deployments. `remote-git` prepares each release checkout on the target host, so the target needs `git` and access to the configured repository.
 
 Full config reference: [docs/config-reference.md](docs/config-reference.md)
 Migrating from Capistrano: [docs/migration-from-capistrano.md](docs/migration-from-capistrano.md)
 
+## Docker development environment
+
+Rampway's canonical development environment is one persistent `dev` service built from the root `Dockerfile`: digest-pinned Ubuntu 26.04 LTS, exact signed/checksummed NodeSource Node 24, the universal coding/debugging baseline, and the current OpenCode, Codex, Claude Code, and official Kimi Code CLIs. The image is source-independent and installs no project dependencies or Threadwire.
+
+Copy the portable environment template, prepare mount-target directories, start the service, and install locked dependencies inside it:
+
+```bash
+cp .env.example .env
+scripts/prepare-dev-home.sh
+docker compose up --build --detach dev
+scripts/docker-run.sh npm ci
+```
+
+The complete dedicated development home is mounted at `/home/dev`; GitHub CLI configuration and the narrow Codex auth file are required read-only mounts. `scripts/docker-run.sh` executes project commands through the already-running service. Use a distinct `COMPOSE_PROJECT_NAME` and `DEV_HOME_PATH` for each concurrent instance.
+
+Setup, credential boundaries, isolation, static checks, and Docker-capable coordinator validation are documented in [docs/docker-development-environment.md](docs/docker-development-environment.md).
+
 ## Commands
 
 ```bash
@@ -169,6 +187,19 @@ Task groups run in config order. Required task failures stop the deploy before p
 
 Standalone operational tasks are configured separately under `operationalTasks` and run only when explicitly selected with `rampway <stage> task <exact-name>`. Rampway acquires the shared deploy lock, strictly resolves the active release, and runs every required entry against that immutable release path. `forwardEnv` names caller-supplied environment variables that must be present; their values are transported separately from ordinary `env` and redacted from output and errors. Operational tasks do not run during deploy, accept no command arguments or `--force`, and are not included in the plural `tasks` deploy-task inventory.
 
+## Callable deployments from Velocious
+
+Velocious applications can mount the authenticated control plane exported as
+`rampway/velocious`. The HTTP API accepts only allowlisted Rampway config/stage
+targets, full Git commit SHAs reachable from an approved release branch, and
+idempotency keys. Each admitted run is handed to a detached package-owned Node
+worker, which reconstructs the backend Velocious context and executes Rampway's
+existing deploy/rollback/status lifecycle; Velocious remains the framework and
+persistence runtime. See
+[Velocious callable deployment API](docs/velocious-deployment-api.md) for
+mounting, client calls, durable recovery behavior, and token
+rotation/revocation.
+
 ## Deployment reports
 
 Every successful deploy or rollback appends one JSON object per line to `shared/log/rampway-deployments.jsonl`. Deploy events include:

package/build/src/velocious/auth.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Compares two token strings without content-dependent timing once their
+ * byte lengths match.
+ *
+ * @param {string} left - Candidate token.
+ * @param {string} right - Configured token.
+ * @returns {boolean} Whether the values match.
+ */
+export function constantTimeEqual(left: string, right: string): boolean;
+/**
+ * Extracts a bearer token from an Authorization header.
+ *
+ * @param {unknown} authorization - Header value.
+ * @returns {string|null} Token or null.
+ */
+export function bearerToken(authorization: unknown): string | null;
+//# sourceMappingURL=auth.d.ts.map

package/build/src/velocious/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/velocious/auth.js"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,wCAJW,MAAM,SACN,MAAM,GACJ,OAAO,CAQnB;AAED;;;;;GAKG;AACH,2CAHW,OAAO,GACL,MAAM,GAAC,IAAI,CAQvB"}

package/build/src/velocious/auth.js

@@ -0,0 +1,30 @@
+// @ts-check
+import crypto from "node:crypto";
+/**
+ * Compares two token strings without content-dependent timing once their
+ * byte lengths match.
+ *
+ * @param {string} left - Candidate token.
+ * @param {string} right - Configured token.
+ * @returns {boolean} Whether the values match.
+ */
+export function constantTimeEqual(left, right) {
+    // Compare fixed-length digests so even differently sized candidates reach
+    // timingSafeEqual instead of taking a length-mismatch branch.
+    const leftDigest = crypto.createHash("sha256").update(String(left)).digest();
+    const rightDigest = crypto.createHash("sha256").update(String(right)).digest();
+    return crypto.timingSafeEqual(leftDigest, rightDigest);
+}
+/**
+ * Extracts a bearer token from an Authorization header.
+ *
+ * @param {unknown} authorization - Header value.
+ * @returns {string|null} Token or null.
+ */
+export function bearerToken(authorization) {
+    if (typeof authorization !== "string")
+        return null;
+    const match = authorization.match(/^Bearer\s+([^\s].*)$/i);
+    return match ? match[1].trim() : null;
+}
+//# sourceMappingURL=auth.js.map

package/build/src/velocious/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/velocious/auth.js"],"names":[],"mappings":"AAAA,YAAY;AAEZ,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAI,EAAE,KAAK;IAC3C,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IAC9E,OAAO,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,aAAa;IACvC,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAElD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAE1D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC"}

package/build/src/velocious/control-plane.d.ts

@@ -0,0 +1,177 @@
+/**
+ * @typedef {object} DeploymentTarget
+ * @property {string} configPath - Backend-held Rampway config path.
+ * @property {string} releaseBranch - Approved release branch.
+ */
+/**
+ * @typedef {object} DeploymentMountOptions
+ * @property {string[]} accessTokens - Accepted tokens.
+ * @property {string} workerBootstrapPath - Backend-owned worker bootstrap module.
+ * @property {string} workerPath - Immutable package worker entry path.
+ * @property {string} mountIdentifier - Stable mount scope.
+ * @property {Record<string, any>} projects - Normalized allowlist.
+ * @property {number} staleRunTimeoutMs - Lease timeout.
+ */
+/**
+ * Looks up only explicit allowlist properties.
+ *
+ * @param {Record<string, any>} projects - Normalized project allowlist.
+ * @param {string} project - Project identifier.
+ * @param {string} stage - Stage identifier.
+ * @returns {DeploymentTarget|undefined} Target configuration.
+ */
+export function lookupTarget(projects: Record<string, any>, project: string, stage: string): DeploymentTarget | undefined;
+/**
+ * Framework-neutral deployment API behavior used by the Velocious controller.
+ *
+ * @template {import('./run-store.js').DeploymentRunStoreContract} TStore
+ */
+export class DeploymentControlPlane<TStore extends import("./run-store.js").DeploymentRunStoreContract> {
+    /**
+     * @param {object} args - Dependencies.
+     * @param {(args: {onFailure: (error: unknown) => Promise<void>, runId: string}) => Promise<void>} args.detachedExecution - Starts the package-owned worker.
+     * @param {(payload: {context: string, error: unknown}) => void} args.emitFrameworkError - Reports internal failures.
+     * @param {import('./executor.js').RampwayDeploymentExecutor} args.executor - Rampway lifecycle executor.
+     * @param {() => number} [args.now] - Clock.
+     * @param {DeploymentMountOptions} args.options - Validated mount options.
+     * @param {TStore} args.store - Durable run store.
+     */
+    constructor({ detachedExecution, emitFrameworkError, executor, now, options, store }: {
+        detachedExecution: (args: {
+            onFailure: (error: unknown) => Promise<void>;
+            runId: string;
+        }) => Promise<void>;
+        emitFrameworkError: (payload: {
+            context: string;
+            error: unknown;
+        }) => void;
+        executor: import("./executor.js").RampwayDeploymentExecutor;
+        now?: (() => number) | undefined;
+        options: DeploymentMountOptions;
+        store: TStore;
+    });
+    detachedExecution: (args: {
+        onFailure: (error: unknown) => Promise<void>;
+        runId: string;
+    }) => Promise<void>;
+    emitFrameworkError: (payload: {
+        context: string;
+        error: unknown;
+    }) => void;
+    executor: import("./executor.js").RampwayDeploymentExecutor;
+    now: () => number;
+    options: DeploymentMountOptions;
+    store: TStore;
+    /**
+     * @param {unknown} authorization - Authorization header.
+     * @returns {boolean} Whether request is authorized.
+     */
+    _authorized(authorization: unknown): boolean;
+    /**
+     * @param {string} candidate - Value to compare with configured access tokens.
+     * @returns {boolean} Whether the value is an accepted access token.
+     */
+    _matchesAccessToken(candidate: string): boolean;
+    /**
+     * @param {string} candidate - Idempotency key candidate.
+     * @returns {boolean} Whether the key contains a configured access token.
+     */
+    _containsAccessToken(candidate: string): boolean;
+    /**
+     * Creates a deployment run.
+     *
+     * @param {{authorization: unknown, input: unknown}} args - Request data.
+     * @returns {Promise<{body: Record<string, any>, status: number}>} HTTP response.
+     */
+    create({ authorization, input }: {
+        authorization: unknown;
+        input: unknown;
+    }): Promise<{
+        body: Record<string, any>;
+        status: number;
+    }>;
+    /**
+     * @param {{authorization: unknown, id: string}} args - Request data.
+     * @returns {Promise<{body: Record<string, any>, status: number}>} HTTP response.
+     */
+    show({ authorization, id }: {
+        authorization: unknown;
+        id: string;
+    }): Promise<{
+        body: Record<string, any>;
+        status: number;
+    }>;
+    /**
+     * @param {{existing: import('./run-store.js').DeploymentRunRow, project: string, revision: string, stage: string}} args - Replay data.
+     * @returns {{body: Record<string, any>, status: number}} Response.
+     */
+    _existingResponse({ existing, project, revision, stage }: {
+        existing: import("./run-store.js").DeploymentRunRow;
+        project: string;
+        revision: string;
+        stage: string;
+    }): {
+        body: Record<string, any>;
+        status: number;
+    };
+    /**
+     * @param {{claimed?: boolean, run: import('./run-store.js').DeploymentRunRow, target: DeploymentTarget}} args - Execution data.
+     * @returns {Promise<void>} Resolves after durable outcome.
+     */
+    _executeRun({ claimed, run, target }: {
+        claimed?: boolean;
+        run: import("./run-store.js").DeploymentRunRow;
+        target: DeploymentTarget;
+    }): Promise<void>;
+    /**
+     * @param {{event: string, payload: Record<string, unknown>, runId: string|null}} args - Event.
+     * @returns {Promise<void>} Resolves after persistence or reporting.
+     */
+    _audit({ event, payload, runId }: {
+        event: string;
+        payload: Record<string, unknown>;
+        runId: string | null;
+    }): Promise<void>;
+    /**
+     * @param {import('./run-store.js').DeploymentRunRow} run - Run.
+     * @returns {Record<string, any>} Public representation.
+     */
+    _serializeRun(run: import("./run-store.js").DeploymentRunRow): Record<string, any>;
+}
+export type DeploymentTarget = {
+    /**
+     * - Backend-held Rampway config path.
+     */
+    configPath: string;
+    /**
+     * - Approved release branch.
+     */
+    releaseBranch: string;
+};
+export type DeploymentMountOptions = {
+    /**
+     * - Accepted tokens.
+     */
+    accessTokens: string[];
+    /**
+     * - Backend-owned worker bootstrap module.
+     */
+    workerBootstrapPath: string;
+    /**
+     * - Immutable package worker entry path.
+     */
+    workerPath: string;
+    /**
+     * - Stable mount scope.
+     */
+    mountIdentifier: string;
+    /**
+     * - Normalized allowlist.
+     */
+    projects: Record<string, any>;
+    /**
+     * - Lease timeout.
+     */
+    staleRunTimeoutMs: number;
+};
+//# sourceMappingURL=control-plane.d.ts.map

package/build/src/velocious/control-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../../src/velocious/control-plane.js"],"names":[],"mappings":"AASA;;;;GAIG;AAEH;;;;;;;;GAQG;AAEH;;;;;;;GAOG;AACH,uCALW,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WACnB,MAAM,SACN,MAAM,GACJ,gBAAgB,GAAC,SAAS,CAOtC;AAED;;;;GAIG;AACH,oCAFmE,MAAM,SAA5D,OAAQ,gBAAgB,EAAE,0BAA2B;IAGhE;;;;;;;;OAQG;IACH,sFAPG;QAAqG,iBAAiB,EAA9G,CAAC,IAAI,EAAE;YAAC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAC,KAAK,OAAO,CAAC,IAAI,CAAC;QAC3B,kBAAkB,EAA7E,CAAC,OAAO,EAAE;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAC,KAAK,IAAI;QACI,QAAQ,EAAhE,OAAO,eAAe,EAAE,yBAAyB;QAC7B,GAAG,UAAjB,MAAM;QACiB,OAAO,EAApC,sBAAsB;QACT,KAAK,EAAlB,MAAM;KAChB,EAQA;IANC,0BARgB;QAAC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAQrD;IAC1C,8BARmB;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAC,KAAK,IAAI,CAQjB;IAC5C,4DAAwB;IACxB,WARe,MAAM,CAQP;IACd,gCAAsB;IACtB,cAAkB;IAGpB;;;OAGG;IACH,2BAHW,OAAO,GACL,OAAO,CAKnB;IAED;;;OAGG;IACH,+BAHW,MAAM,GACJ,OAAO,CASnB;IAED;;;OAGG;IACH,gCAHW,MAAM,GACJ,OAAO,CAQnB;IAED;;;;;OAKG;IACH,iCAHW;QAAC,aAAa,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAC,GACtC,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,CA4DhE;IAED;;;OAGG;IACH,4BAHW;QAAC,aAAa,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,GAClC,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC,CAyBhE;IAED;;;OAGG;IACH,0DAHW;QAAC,QAAQ,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GACrG;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAOvD;IAED;;;OAGG;IACH,sCAHW;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAC,GAC3F,OAAO,CAAC,IAAI,CAAC,CAsDzB;IAED;;;OAGG;IACH,kCAHW;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,GAAC,IAAI,CAAA;KAAC,GACnE,OAAO,CAAC,IAAI,CAAC,CAQzB;IAED;;;OAGG;IACH,mBAHW,OAAO,gBAAgB,EAAE,gBAAgB,GACvC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgB/B;CACF;;;;;gBA1Ra,MAAM;;;;mBACN,MAAM;;;;;;kBAKN,MAAM,EAAE;;;;yBACR,MAAM;;;;gBACN,MAAM;;;;qBACN,MAAM;;;;cACN,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;;;;uBACnB,MAAM"}

package/build/src/velocious/control-plane.js

@@ -0,0 +1,290 @@
+// @ts-check
+import { bearerToken, constantTimeEqual } from "./auth.js";
+import { heartbeatIntervalMs, registerActiveDeploymentRun, unregisterActiveDeploymentRun } from "./run-store.js";
+import { sanitizeAdapterValue, sanitizeErrorPayload } from "./sanitize.js";
+const REVISION_PATTERN = /^[0-9a-f]{40}$/;
+const MAX_IDEMPOTENCY_KEY_LENGTH = 255;
+/**
+ * @typedef {object} DeploymentTarget
+ * @property {string} configPath - Backend-held Rampway config path.
+ * @property {string} releaseBranch - Approved release branch.
+ */
+/**
+ * @typedef {object} DeploymentMountOptions
+ * @property {string[]} accessTokens - Accepted tokens.
+ * @property {string} workerBootstrapPath - Backend-owned worker bootstrap module.
+ * @property {string} workerPath - Immutable package worker entry path.
+ * @property {string} mountIdentifier - Stable mount scope.
+ * @property {Record<string, any>} projects - Normalized allowlist.
+ * @property {number} staleRunTimeoutMs - Lease timeout.
+ */
+/**
+ * Looks up only explicit allowlist properties.
+ *
+ * @param {Record<string, any>} projects - Normalized project allowlist.
+ * @param {string} project - Project identifier.
+ * @param {string} stage - Stage identifier.
+ * @returns {DeploymentTarget|undefined} Target configuration.
+ */
+export function lookupTarget(projects, project, stage) {
+    if (!Object.hasOwn(projects, project))
+        return undefined;
+    const stages = projects[project].stages;
+    if (!Object.hasOwn(stages, stage))
+        return undefined;
+    return stages[stage];
+}
+/**
+ * Framework-neutral deployment API behavior used by the Velocious controller.
+ *
+ * @template {import('./run-store.js').DeploymentRunStoreContract} TStore
+ */
+export class DeploymentControlPlane {
+    /**
+     * @param {object} args - Dependencies.
+     * @param {(args: {onFailure: (error: unknown) => Promise<void>, runId: string}) => Promise<void>} args.detachedExecution - Starts the package-owned worker.
+     * @param {(payload: {context: string, error: unknown}) => void} args.emitFrameworkError - Reports internal failures.
+     * @param {import('./executor.js').RampwayDeploymentExecutor} args.executor - Rampway lifecycle executor.
+     * @param {() => number} [args.now] - Clock.
+     * @param {DeploymentMountOptions} args.options - Validated mount options.
+     * @param {TStore} args.store - Durable run store.
+     */
+    constructor({ detachedExecution, emitFrameworkError, executor, now = Date.now, options, store }) {
+        this.detachedExecution = detachedExecution;
+        this.emitFrameworkError = emitFrameworkError;
+        this.executor = executor;
+        this.now = now;
+        this.options = options;
+        this.store = store;
+    }
+    /**
+     * @param {unknown} authorization - Authorization header.
+     * @returns {boolean} Whether request is authorized.
+     */
+    _authorized(authorization) {
+        const token = bearerToken(authorization);
+        return token ? this._matchesAccessToken(token) : false;
+    }
+    /**
+     * @param {string} candidate - Value to compare with configured access tokens.
+     * @returns {boolean} Whether the value is an accepted access token.
+     */
+    _matchesAccessToken(candidate) {
+        let matches = false;
+        for (const accessToken of this.options.accessTokens) {
+            // Do every configured comparison instead of exposing which rotation token matched.
+            matches = constantTimeEqual(candidate, accessToken) || matches;
+        }
+        return matches;
+    }
+    /**
+     * @param {string} candidate - Idempotency key candidate.
+     * @returns {boolean} Whether the key contains a configured access token.
+     */
+    _containsAccessToken(candidate) {
+        let contains = false;
+        for (const accessToken of this.options.accessTokens) {
+            contains = candidate.includes(accessToken) || contains;
+        }
+        return contains;
+    }
+    /**
+     * Creates a deployment run.
+     *
+     * @param {{authorization: unknown, input: unknown}} args - Request data.
+     * @returns {Promise<{body: Record<string, any>, status: number}>} HTTP response.
+     */
+    async create({ authorization, input }) {
+        if (!this._authorized(authorization))
+            return { body: { error: "unauthorized" }, status: 401 };
+        const params = input && typeof input === "object" ? /** @type {Record<string, unknown>} */ (input) : {};
+        const revision = typeof params.revision === "string" ? params.revision : null;
+        const idempotencyKey = typeof params.idempotencyKey === "string" ? params.idempotencyKey : null;
+        const invalidFields = [];
+        if (!revision || !REVISION_PATTERN.test(revision))
+            invalidFields.push("revision");
+        if (!idempotencyKey || idempotencyKey.length > MAX_IDEMPOTENCY_KEY_LENGTH || this._containsAccessToken(idempotencyKey)) {
+            invalidFields.push("idempotencyKey");
+        }
+        if (invalidFields.length > 0)
+            return { body: { error: "invalid_params", fields: invalidFields }, status: 422 };
+        const validRevision = /** @type {string} */ (revision);
+        const validIdempotencyKey = /** @type {string} */ (idempotencyKey);
+        const project = typeof params.project === "string" ? params.project : "";
+        const stage = typeof params.stage === "string" ? params.stage : "";
+        const target = lookupTarget(this.options.projects, project, stage);
+        if (!target)
+            return { body: { error: "not_found" }, status: 404 };
+        const outcome = await this.store.createRunIfPossible({ idempotencyKey: validIdempotencyKey, project, revision: validRevision, stage });
+        if (outcome.outcome === "replay" || outcome.outcome === "conflict") {
+            if (!outcome.run)
+                throw new Error(`Run store returned ${outcome.outcome} without a run`);
+            return this._existingResponse({ existing: outcome.run, project, revision: validRevision, stage });
+        }
+        if (outcome.outcome === "in_progress") {
+            return { body: { error: "deployment_in_progress", runId: outcome.run?.id }, status: 409 };
+        }
+        if (outcome.outcome === "reconciliation_required") {
+            if (!outcome.run)
+                throw new Error("Run store returned reconciliation_required without a run");
+            return { body: { error: "deployment_reconciliation_required", runId: outcome.run.id }, status: 409 };
+        }
+        if (!outcome.run)
+            throw new Error("Run store returned created without a run");
+        const run = outcome.run;
+        await this._audit({ event: "run_requested", payload: { project, revision: validRevision, stage }, runId: run.id });
+        const failLaunch = async (/** @type {unknown} */ error) => {
+            const safeError = sanitizeErrorPayload(error, this.options.accessTokens);
+            try {
+                await this.store.markPendingFailed({ error: safeError, finishedAtMs: this.now(), id: run.id, ownerToken: run.ownerToken ?? "" });
+                await this._audit({ event: "run_failed", payload: { message: safeError.message, phase: "worker_launch", project, revision: validRevision, stage }, runId: run.id });
+            }
+            catch (recordingError) {
+                this.emitFrameworkError({ context: "rampway-deployment-api-record-launch-failure", error: recordingError });
+            }
+        };
+        try {
+            await this.detachedExecution({ runId: run.id, onFailure: failLaunch });
+        }
+        catch (error) {
+            await failLaunch(error);
+            const safeError = sanitizeErrorPayload(error, this.options.accessTokens);
+            const failed = (await this.store.findRunById(run.id)) ?? { ...run, error: safeError, finishedAtMs: this.now(), status: "failed" };
+            return { body: { run: this._serializeRun(failed) }, status: 503 };
+        }
+        return { body: { run: this._serializeRun(run) }, status: 202 };
+    }
+    /**
+     * @param {{authorization: unknown, id: string}} args - Request data.
+     * @returns {Promise<{body: Record<string, any>, status: number}>} HTTP response.
+     */
+    async show({ authorization, id }) {
+        if (!this._authorized(authorization))
+            return { body: { error: "unauthorized" }, status: 401 };
+        const run = await this.store.findRunById(id);
+        if (!run)
+            return { body: { error: "not_found" }, status: 404 };
+        const target = lookupTarget(this.options.projects, run.project, run.stage);
+        if (!target)
+            return { body: { error: "not_found" }, status: 404 };
+        /** @type {Record<string, any>} */
+        const body = { run: this._serializeRun(run) };
+        if (this.executor.readStatus) {
+            try {
+                const current = await this.executor.readStatus({ project: run.project, stage: run.stage, target });
+                body.current = sanitizeAdapterValue(current, this.options.accessTokens) ?? null;
+            }
+            catch (error) {
+                const liveStatusError = sanitizeErrorPayload(error, this.options.accessTokens);
+                body.live_status = null;
+                body.live_status_error = liveStatusError;
+                this.emitFrameworkError({ context: "rampway-deployment-api-live-status", error: liveStatusError });
+            }
+        }
+        return { body, status: 200 };
+    }
+    /**
+     * @param {{existing: import('./run-store.js').DeploymentRunRow, project: string, revision: string, stage: string}} args - Replay data.
+     * @returns {{body: Record<string, any>, status: number}} Response.
+     */
+    _existingResponse({ existing, project, revision, stage }) {
+        const same = existing.project === project && existing.stage === stage && existing.revision === revision;
+        return same
+            ? { body: { replayed: true, run: this._serializeRun(existing) }, status: 200 }
+            : { body: { error: "idempotency_conflict", runId: existing.id }, status: 409 };
+    }
+    /**
+     * @param {{claimed?: boolean, run: import('./run-store.js').DeploymentRunRow, target: DeploymentTarget}} args - Execution data.
+     * @returns {Promise<void>} Resolves after durable outcome.
+     */
+    async _executeRun({ claimed = false, run, target }) {
+        if (!run.ownerToken)
+            throw new Error(`Deployment run ${run.id} has no owner token`);
+        const ownerToken = run.ownerToken;
+        registerActiveDeploymentRun(run.id);
+        /** @type {ReturnType<typeof setInterval>|null} */
+        let heartbeat = null;
+        try {
+            if (!claimed)
+                await this.store.markRunning({ id: run.id, startedAtMs: this.now() });
+            heartbeat = setInterval(() => {
+                this.store.heartbeat({ heartbeatAtMs: this.now(), id: run.id }).catch(error => {
+                    this.emitFrameworkError({ context: "rampway-deployment-api-heartbeat", error });
+                });
+            }, heartbeatIntervalMs(this.options.staleRunTimeoutMs));
+            heartbeat.unref();
+            await this._audit({ event: "run_started", payload: { project: run.project, revision: run.revision, stage: run.stage }, runId: run.id });
+            let report;
+            try {
+                const reachable = await this.executor.validateRevision({ project: run.project, revision: run.revision, stage: run.stage, target });
+                if (!reachable)
+                    throw new Error(`Revision ${run.revision} is not reachable from approved release branch ${target.releaseBranch}`);
+                report = await this.executor.deploy({ project: run.project, revision: run.revision, runId: run.id, stage: run.stage, target });
+            }
+            catch (error) {
+                const safeError = sanitizeErrorPayload(error, this.options.accessTokens);
+                try {
+                    await this.store.markFailed({ error: safeError, finishedAtMs: this.now(), id: run.id, ownerToken });
+                    await this._audit({ event: "run_failed", payload: { message: safeError.message, project: run.project, revision: run.revision, stage: run.stage }, runId: run.id });
+                }
+                catch (storeError) {
+                    this.emitFrameworkError({ context: "rampway-deployment-api-record-failure", error: storeError });
+                }
+                return;
+            }
+            try {
+                const result = sanitizeAdapterValue(report ?? {}, this.options.accessTokens) ?? {};
+                await this.store.markSucceeded({ finishedAtMs: this.now(), id: run.id, ownerToken, result });
+                await this._audit({ event: "run_succeeded", payload: { project: run.project, revision: run.revision, stage: run.stage }, runId: run.id });
+            }
+            catch (error) {
+                this.emitFrameworkError({ context: "rampway-deployment-api-record-success", error });
+                const reconciliationError = { message: "Deployment activation succeeded, but its result could not be persisted; operator reconciliation is required" };
+                try {
+                    await this.store.markReconciliationRequired({ error: reconciliationError, finishedAtMs: this.now(), id: run.id, ownerToken });
+                    await this._audit({ event: "run_reconciliation_required", payload: { ...reconciliationError, project: run.project, revision: run.revision, stage: run.stage }, runId: run.id });
+                }
+                catch (persistenceError) {
+                    this.emitFrameworkError({ context: "rampway-deployment-api-record-reconciliation-required", error: persistenceError });
+                }
+            }
+        }
+        finally {
+            if (heartbeat)
+                clearInterval(heartbeat);
+            unregisterActiveDeploymentRun(run.id);
+        }
+    }
+    /**
+     * @param {{event: string, payload: Record<string, unknown>, runId: string|null}} args - Event.
+     * @returns {Promise<void>} Resolves after persistence or reporting.
+     */
+    async _audit({ event, payload, runId }) {
+        try {
+            await this.store.addAuditEvent({ event, payload: sanitizeAdapterValue(payload, this.options.accessTokens) ?? {}, runId });
+        }
+        catch (error) {
+            this.emitFrameworkError({ context: "rampway-deployment-api-audit", error });
+        }
+    }
+    /**
+     * @param {import('./run-store.js').DeploymentRunRow} run - Run.
+     * @returns {Record<string, any>} Public representation.
+     */
+    _serializeRun(run) {
+        return {
+            error: run.error,
+            finishedAtMs: run.finishedAtMs,
+            id: run.id,
+            idempotencyKey: run.idempotencyKey,
+            project: run.project,
+            requestedAtMs: run.requestedAtMs,
+            result: run.result,
+            revision: run.revision,
+            stage: run.stage,
+            startedAtMs: run.startedAtMs,
+            status: run.status
+        };
+    }
+}
+//# sourceMappingURL=control-plane.js.map

package/build/src/velocious/control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../../../src/velocious/control-plane.js"],"names":[],"mappings":"AAAA,YAAY;AAEZ,OAAO,EAAC,WAAW,EAAE,iBAAiB,EAAC,MAAM,WAAW,CAAA;AACxD,OAAO,EAAC,mBAAmB,EAAE,2BAA2B,EAAE,6BAA6B,EAAC,MAAM,gBAAgB,CAAA;AAC9G,OAAO,EAAC,oBAAoB,EAAE,oBAAoB,EAAC,MAAM,eAAe,CAAA;AAExE,MAAM,gBAAgB,GAAG,gBAAgB,CAAA;AACzC,MAAM,0BAA0B,GAAG,GAAG,CAAA;AAEtC;;;;GAIG;AAEH;;;;;;;;GAQG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK;IACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;IACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACnD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IACjC;;;;;;;;OAQG;IACH,YAAY,EAAC,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAC;QAC3F,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QAC1C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAA;QAC5C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,aAAa;QACvB,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,CAAA;QACxC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACxD,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,SAAS;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACpD,mFAAmF;YACnF,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,OAAO,CAAA;QAChE,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,SAAS;QAC5B,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACpD,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAA;QACxD,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,EAAC,aAAa,EAAE,KAAK,EAAC;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;YAAE,OAAO,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,cAAc,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QAEzF,MAAM,MAAM,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACvG,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7E,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/F,MAAM,aAAa,GAAG,EAAE,CAAA;QAExB,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjF,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,0BAA0B,IAAI,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;YACvH,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACtC,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QAC1G,MAAM,aAAa,GAAG,qBAAqB,CAAC,CAAC,QAAQ,CAAC,CAAA;QACtD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,CAAC,cAAc,CAAC,CAAA;QAElE,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QACxE,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAClE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,WAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QAE7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAC,CAAC,CAAA;QACpI,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACnE,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,OAAO,gBAAgB,CAAC,CAAA;YACxF,OAAO,IAAI,CAAC,iBAAiB,CAAC,EAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAC,CAAC,CAAA;QACjG,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACtC,OAAO,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,yBAAyB,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;YAC7F,OAAO,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,oCAAoC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QAClG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAE7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACvB,MAAM,IAAI,CAAC,MAAM,CAAC,EAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,EAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAC,CAAC,CAAA;QAE9G,MAAM,UAAU,GAAG,KAAK,EAAE,sBAAsB,CAAC,KAAK,EAAE,EAAE;YACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YACxE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,EAAC,CAAC,CAAA;gBAC9H,MAAM,IAAI,CAAC,MAAM,CAAC,EAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAC,CAAC,CAAA;YACjK,CAAC;YAAC,OAAO,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,kBAAkB,CAAC,EAAC,OAAO,EAAE,8CAA8C,EAAE,KAAK,EAAE,cAAc,EAAC,CAAC,CAAA;YAC3G,CAAC;QACH,CAAC,CAAA;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAC,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;YACvB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAC,GAAG,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAC,CAAA;YAC/H,OAAO,EAAC,IAAI,EAAE,EAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QAC/D,CAAC;QAED,OAAO,EAAC,IAAI,EAAE,EAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;IAC5D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,EAAC,aAAa,EAAE,EAAE,EAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;YAAE,OAAO,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,cAAc,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QACzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,WAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QAE1D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1E,IAAI,CAAC,MAAM;YAAE,OAAO,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,WAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;QAC7D,kCAAkC;QAClC,MAAM,IAAI,GAAG,EAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAC,CAAA;QAE3C,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAC,CAAC,CAAA;gBAChG,IAAI,CAAC,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,IAAI,CAAA;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAC9E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;gBACvB,IAAI,CAAC,iBAAiB,GAAG,eAAe,CAAA;gBACxC,IAAI,CAAC,kBAAkB,CAAC,EAAC,OAAO,EAAE,oCAAoC,EAAE,KAAK,EAAE,eAAe,EAAC,CAAC,CAAA;YAClG,CAAC;QACH,CAAC;QAED,OAAO,EAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;IAC5B,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,EAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAC;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAA;QACvG,OAAO,IAAI;YACT,CAAC,CAAC,EAAC,IAAI,EAAE,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC;YAC1E,CAAC,CAAC,EAAC,IAAI,EAAE,EAAC,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAC,EAAE,MAAM,EAAE,GAAG,EAAC,CAAA;IAC9E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,EAAC,OAAO,GAAG,KAAK,EAAE,GAAG,EAAE,MAAM,EAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAA;QACnF,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAA;QACjC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnC,kDAAkD;QAClD,IAAI,SAAS,GAAG,IAAI,CAAA;QAEpB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAC,CAAC,CAAA;YACjF,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC3B,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;oBAC1E,IAAI,CAAC,kBAAkB,CAAC,EAAC,OAAO,EAAE,kCAAkC,EAAE,KAAK,EAAC,CAAC,CAAA;gBAC/E,CAAC,CAAC,CAAA;YACJ,CAAC,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAA;YACvD,SAAS,CAAC,KAAK,EAAE,CAAA;YAEjB,MAAM,IAAI,CAAC,MAAM,CAAC,EAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,EAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAC,CAAC,CAAA;YAEnI,IAAI,MAAM,CAAA;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAC,CAAC,CAAA;gBAChI,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,QAAQ,kDAAkD,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;gBACjI,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAC,CAAC,CAAA;YAC9H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBACxE,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAC,CAAC,CAAA;oBACjG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAC,CAAC,CAAA;gBAChK,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,kBAAkB,CAAC,EAAC,OAAO,EAAE,uCAAuC,EAAE,KAAK,EAAE,UAAU,EAAC,CAAC,CAAA;gBAChG,CAAC;gBACD,OAAM;YACR,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;gBAClF,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAC,CAAC,CAAA;gBAC1F,MAAM,IAAI,CAAC,MAAM,CAAC,EAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,EAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAC,CAAC,CAAA;YACvI,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,kBAAkB,CAAC,EAAC,OAAO,EAAE,uCAAuC,EAAE,KAAK,EAAC,CAAC,CAAA;gBAClF,MAAM,mBAAmB,GAAG,EAAC,OAAO,EAAE,6GAA6G,EAAC,CAAA;gBACpJ,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAC,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAC,CAAC,CAAA;oBAC3H,MAAM,IAAI,CAAC,MAAM,CAAC,EAAC,KAAK,EAAE,6BAA6B,EAAE,OAAO,EAAE,EAAC,GAAG,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAC,CAAC,CAAA;gBAC7K,CAAC;gBAAC,OAAO,gBAAgB,EAAE,CAAC;oBAC1B,IAAI,CAAC,kBAAkB,CAAC,EAAC,OAAO,EAAE,uDAAuD,EAAE,KAAK,EAAE,gBAAgB,EAAC,CAAC,CAAA;gBACtH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,SAAS;gBAAE,aAAa,CAAC,SAAS,CAAC,CAAA;YACvC,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,EAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,KAAK,EAAC,CAAC,CAAA;QACzH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,EAAC,OAAO,EAAE,8BAA8B,EAAE,KAAK,EAAC,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,GAAG;QACf,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAA;IACH,CAAC;CACF"}