jonahbeckford/ocamlearlybird · dk1-quick-setup vs master · net diff 1f77823fb..60739ee81 · 28 files · generated 2026-09-20 21:50Z

Branch Review: dk1-quick-setup

Read the full CLO.md adoption guide →

Description

What this branch does

Adds dk, a Windows-friendly, incremental, remote cacheable build system, as a build path for ocamlearlybird. This is the Quick Setup branch: a from-source build of the full opam dependency closure. The OCaml toolchain (compiler, Dune, opam, build utilities) is prebuilt, and ocamlearlybird's own 53-package closure (lwt, dap, menhir, ppxlib, …) plus the in-tree earlybird package compile locally, each as its own cached dk object.

After cloning, a user needs one command (the vendored launcher self-installs):

./dk1 run-object NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6 \
  -s Release.execution_abi -m bin/ocamlearlybird.exe -- --help=plain

See CLO.md for the fully worked adoption guide (Users and Maintainers), including the six-command adoption sequence, the pin table delta, and the reason dap is held at {>= "1.0.6" & < "1.1.0"} on the 4.14.3 toolchain.

Provenance

The dk packages this build depends on have been 100% AI generated and maintained since June 2026, and the dk build tool itself was hand built but AI assisted since June 2026.

Performance

Performance was measured on GitHub Actions runners with dk 2.4.3.22 and opam 2.5.2 (.github/workflows/measure-performance.yml, which also measures a conventional opam switch create + opam install . --deps-only + dune build on the same runners, compiler install included). The ± is the sample standard deviation over the mean; the dk numbers are the mean over 8 runs, and each opam and High Performance number the mean over 4:

Step	dk Quick Setup	opam nocache + dune (desktop)	opam cache + dune
Linux: fresh checkout to a runnable binary	~2 m 55 s ±6%	~5 m 12 s ±10%	~2 m 53 s ±3%
Linux: re-run the built binary	~5 s ±17%	~0.1 s ±10%	~0.1 s ±10%
Linux: edit one file, rebuild	~20 s ±12%	~0.2 s ±8%	~0.2 s ±8%
Windows: fresh checkout to a runnable binary	~8 m 35 s ±9%	~13 m 7 s ±15%	~6 m 32 s ±3%
Windows: re-run the built binary	~10 s ±9%	~1.0 s ±19%	~1.0 s ±19%
Windows: edit one file, rebuild	~45 s ±11%	~1.2 s ±18%	~1.2 s ±18%

What each fresh checkout figure includes. The columns reach a runnable binary through different work, and they also stop in different places, so the numbers are comparable only once both are named. The dk figure is one command, ./dk1 run-object ... -- --help=plain, and its timed region covers the vendored launcher self-installing the engine pinned in dk.u, the lazy fetch of the prebuilt toolchain objects, the build of the 53-package locked closure and the earlybird package, and then RUNNING the produced binary. Both opam figures run from a stamp taken after checkout, through setup-ocaml (switch create and compiler install) and opam install . --deps-only, to the end of dune build @install.

setup-ocaml has a cache: true mode (the default) which caches a portion of the opam state in a GitHub Actions cache. The nocache measurements disable the GitHub Actions cache, mimicking desktops that also do not have access to that cache.

The four rows that are not a fresh checkout repeat across both opam columns, and are pooled over all eight runs. The cache holds the compiler and the switch, not this project's dependencies, so opam install . --deps-only costs about the same either way. Splitting those rows would publish noise as a distinction. The dk1-high-performance branch stacks on this one and requires GitHub Actions to maintain a per-ABI datastore of built objects for the 53-package closure, so a consumer fetches every opam package object prebuilt:

Step	dk High Performance (dk1-high-performance)	Quick Setup, for comparison
Linux: fresh checkout to a runnable binary	~1 m 31 s ±20%	~2 m 55 s ±6%
Linux: re-run the built binary	~5 s ±12%	~5 s ±17%
Windows: fresh checkout to a runnable binary	~2 m 31 s ±13%	~8 m 35 s ±9%
Windows: re-run the built binary	~12 s ±6%	~10 s ±9%

What's in the diff

dk0/dk1/dk0.cmd/dk1.cmd: vendored self-installing launchers, pinned to dk engine 2.4.3.22
dk.u: workspace script with the pinned CommonsLang_OCaml toolchain import and source-tree asset checksums
dune-project, earlybird.opam: the build inputs the dk recipe consumes
dk-opam-pins.txt, dk.opam-lock.jsonc: the solver pin table and the solved per-slot dependency lock
dk-src/dune-workspace: the dune workspace root marker staged into the assembled source
src/adapter/state_initialized.ml: the one source adjustment the build needs
etc/dk/v/NotHackwaly_Ocamlearlybird/*.values.jsonc: the generated localized-source form, the generated one-line closure driver (OpamBuild F_BuildLockedClosure), and the generated thin final form exposing bin/ocamlearlybird
etc/dk/t/: trust records (acceptances and capability grants) recorded by the quickstart from the recipe's declared trust statements
etc/dk/i/: verified import records and the closure manifest
.github/workflows/measure-performance.yml: the dk-and-opam timing matrix behind the table above
.github/workflows/repin-engine.yml: repins the engine and CommonsLang_OCaml on a hosted runner
scripts/check-measurement-complete.mjs, scripts/expected-measurement.json: the gate that fails the workflow if any expected slot's measurement is missing
.gitattributes: LF policy on the dk assets. dk hashes raw bytes, so a CRLF checkout on Windows would break asset verification.
CLO.md: the adoption guide

The change is additive. The existing dune/opam/esy workflows continue to work unchanged.

Changed files (open the full file on GitHub)

Files changed (28) hide show

.gitattributes +49 -0
.github/workflows/measure-performance.yml +251 -0
.github/workflows/repin-engine.yml +303 -0
.gitignore +5 -0
CLO.md +207 -0
dk-opam-pins.txt +32 -0
dk-src/dune-workspace +1 -0
dk.opam-lock.jsonc +2256 -0
dk.u +54 -0
dk0 +864 -0
dk0.cmd +211 -0
dk1 +864 -0
dk1.cmd +211 -0
dune-project +1 -1
earlybird.opam +1 -1
etc/dk/i/.gitignore +5 -0
etc/dk/i/CommonsBase_Std.2.6.20260920144347.values.json +229 -0
etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json +815 -0
etc/dk/i/dk-closure-manifest.tsv +29 -0
etc/dk/t/.gitignore +5 -0
etc/dk/t/acceptances.json +9 -0
etc/dk/t/capabilities.json +10 -0
etc/dk/v/NotHackwaly_Ocamlearlybird/Ocamlearlybird.Closure.values.jsonc +47 -0
etc/dk/v/NotHackwaly_Ocamlearlybird/Ocamlearlybird.Src.values.jsonc +66 -0
etc/dk/v/NotHackwaly_Ocamlearlybird/Ocamlearlybird.values.jsonc +77 -0
scripts/check-measurement-complete.mjs +160 -0
scripts/expected-measurement.json +15 -0
src/adapter/state_initialized.ml +1 -2

.gitattributes CHANGED Viewed

@@ -1,2 +1,51 @@
 *.webp filter=lfs diff=lfs merge=lfs -text
 *.gif filter=lfs diff=lfs merge=lfs -text

+# Line-ending policy.
+#
+# Every workspace asset (the dune files, the
+# src/ tree, the opam lock, the *.u scripts) is hashed by its raw bytes and that
+# hash is pinned in dk.u and etc/dk. The hashes are computed with LF endings, so
+# the working tree must check out LF on every platform. Without this file a
+# Windows checkout with core.autocrlf=true rewrites the assets to CRLF and
+# `dk1 run-object` fails asset verification (unexpected SHA256). The Windows
+# launchers (*.cmd/*.bat/*.ps1) must stay CRLF.
+# Normalize text in the repository; native endings on checkout unless overridden.
+* text=auto
+# Git LFS media.
 *.webp filter=lfs diff=lfs merge=lfs -text
 *.gif filter=lfs diff=lfs merge=lfs -text
+# Always LF on checkout: the dk-hashed assets plus OCaml/dune sources.
+dune            text eol=lf
+dune-project    text eol=lf
+dune-workspace  text eol=lf
+*.dune          text eol=lf
+*.ml            text eol=lf
+*.mli           text eol=lf
+*.mll           text eol=lf
+*.mly           text eol=lf
+opam            text eol=lf
+*.opam          text eol=lf
+*.opam.template text eol=lf
+*.json          text eol=lf
+*.jsonc         text eol=lf
+*.u             text eol=lf
+*.t             text eol=lf
+*.sh            text eol=lf
+*.patch         text eol=lf
+*.sexp          text eol=lf
+*.pub           text eol=lf
+*.sec           text eol=lf
+*.sig           text eol=lf
+dk              text eol=lf
+dk0             text eol=lf
+dk1             text eol=lf
+configure       text eol=lf
+Makefile        text eol=lf
+# Always CRLF on checkout: Windows launchers/scripts.
+*.bat  text eol=crlf
+*.cmd  text eol=crlf
+*.ps1  text working-tree-encoding=UTF-8 eol=crlf
+*.psm1 text working-tree-encoding=UTF-8 eol=crlf
+*.sln  text eol=crlf

.github/workflows/measure-performance.yml ADDED Viewed

	@@ -0,0 +1,251 @@

+name: measure-performance
+# Head-to-head opam-vs-dk timing for the Quick Setup tier, which builds the
+# dependency closure from source, on Linux_x86_64 (ubuntu-latest) and
+# Windows_x86_64 (windows-latest). Each runner measures the host ABI natively.
+# Trigger from the Actions tab (workflow_dispatch) or by pushing a perf-* tag;
+# the perf workflow never runs on push or pull_request, so it stays off the PR
+# status checks.
+#
+# Every timed step prints `PHASE <name> ms=<n>` lines and a final SUMMARY line.
+# The dk track and the opam track produce the same runnable binary, so their
+# SUMMARY lines are directly comparable:
+#   dk    fresh -> binary : dk_build_cold  (compiles the whole closure)
+#   opam  fresh -> binary : (setup-ocaml step) + opam_deps + opam_build_cold
+#   dk    re-run a binary : dk_run_warm
+#   opam  re-run a binary : opam_run_warm
+#   dk    edit one file    : dk_run_edit    (rebuilds the leaf package object)
+#   opam  edit one file    : opam_build_edit (dune's file-level incremental)
+on:
+  workflow_dispatch:
+    inputs:
+      opam_cache:
+        description: >-
+          Whether setup-ocaml may restore its opam switch from the Actions cache.
+          Leave it at true for an ordinary run. Set it to false to measure the
+          cold-cache side of the opam track: this input is the only thing that
+          separates the two modes, and the published fresh checkout figure differs
+          by roughly a factor of two between them.
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+        default: 'true'
+  push:
+    tags:
+      - 'perf-*'
+jobs:
+  dk:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            slot: Release.Linux_x86_64
+          - os: windows-latest
+            slot: Release.Windows_x86_64
+    runs-on: ${{ matrix.os }}
+    # A cold from-source closure build plus native compilation; give the job
+    # generous headroom over the default and the ci.yml jobs.
+    timeout-minutes: 90
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          lfs: true
+      # Linux uses the POSIX ./dk1 launcher (curl is present) and date-based
+      # millisecond timing.
+      - name: dk cold build + warm run + edit rebuild (timed, Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          now() { date +%s%3N; }
+          slot='${{ matrix.slot }}'
+          run() { ./dk1 run-object NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6 \
+                    -s "$slot" -m ./bin/ocamlearlybird.exe -- --help=plain >/dev/null; }
+          echo "DK MEASURE STARTED $(date -u +%H:%M:%S) slot=$slot"
+          a=$(now); run; b=$(now)
+          echo "PHASE dk_build_cold ms=$((b-a))"
+          c=$(now); run; d=$(now)
+          echo "PHASE dk_run_warm ms=$((d-c))"
+          printf '\n(* perf measurement touch *)\n' >> src/main/main.ml
+          ./dk1 update --no-imports
+          e=$(now); run; f=$(now)
+          echo "PHASE dk_run_edit ms=$((f-e))"
+          echo "DK SUMMARY slot=$slot build_cold_ms=$((b-a)) run_warm_ms=$((d-c)) run_edit_ms=$((f-e))"
+          echo "DK MEASURE DONE $(date -u +%H:%M:%S)"
+          # The same three readings, machine readable, for the gate job. Written
+          # AFTER every stopwatch has stopped and outside the working tree, so it
+          # cannot move a number: an earlier repair to this workflow moved console
+          # writes inside a stopwatch and widened five of six Windows cells.
+          mkdir -p "$RUNNER_TEMP/dk-phases"
+          printf 'dk_build_cold=%s\ndk_run_warm=%s\ndk_run_edit=%s\n' \
+            "$((b-a))" "$((d-c))" "$((f-e))" > "$RUNNER_TEMP/dk-phases/$slot.txt"
+      - name: Upload this slot's readings for the gate
+        if: ${{ always() && runner.os == 'Linux' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: dk-phases-${{ matrix.slot }}
+          path: ${{ runner.temp }}/dk-phases
+          if-no-files-found: ignore
+      # Windows uses the dk1.cmd launcher (bootstraps via PowerShell, no curl
+      # dependency) and Stopwatch timing.
+      - name: dk cold build + warm run + edit rebuild (timed, Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $slot = '${{ matrix.slot }}'
+          # The engine writes its progress stream to stderr. Console writes on
+          # the Windows runner are expensive enough to move the numbers, so it
+          # goes to a file and is printed after the stopwatch stops. The file
+          # sits in the runner temp rather than the working tree, which the
+          # edit rebuild measures a change to.
+          $errlog = Join-Path $env:RUNNER_TEMP 'dk-run.err'
+          function Run {
+            & .\dk1.cmd run-object NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6 `
+              -s $slot -m ./bin/ocamlearlybird.exe -- --help=plain 2> $errlog > $null
+            if ($LASTEXITCODE -ne 0) { Get-Content $errlog; throw "run-object failed ($LASTEXITCODE)" }
+          }
+          Write-Host "DK MEASURE STARTED $(Get-Date -Format HH:mm:ss) slot=$slot"
+          $sw = [System.Diagnostics.Stopwatch]::StartNew(); Run; $cold = $sw.ElapsedMilliseconds
+          Write-Host "PHASE dk_build_cold ms=$cold"
+          $sw.Restart(); Run; $warm = $sw.ElapsedMilliseconds
+          Write-Host "PHASE dk_run_warm ms=$warm"
+          Add-Content -Path src/main/main.ml -Value "`n(* perf measurement touch *)`n"
+          & .\dk1.cmd update --no-imports
+          if ($LASTEXITCODE -ne 0) { throw "update failed ($LASTEXITCODE)" }
+          $sw.Restart(); Run; $edit = $sw.ElapsedMilliseconds
+          Write-Host "PHASE dk_run_edit ms=$edit"
+          Write-Host "DK SUMMARY slot=$slot build_cold_ms=$cold run_warm_ms=$warm run_edit_ms=$edit"
+          Write-Host "DK ENGINE OUTPUT from the last timed run, printed outside the stopwatch"
+          Get-Content $errlog
+          Write-Host "DK MEASURE DONE $(Get-Date -Format HH:mm:ss)"
+          # The same three readings, machine readable, for the gate job. Written
+          # AFTER every stopwatch has stopped and outside the working tree, so it
+          # cannot move a number.
+          $phaseDir = Join-Path $env:RUNNER_TEMP 'dk-phases'
+          New-Item -ItemType Directory -Force -Path $phaseDir | Out-Null
+          "dk_build_cold=$cold`ndk_run_warm=$warm`ndk_run_edit=$edit" |
+            Set-Content -NoNewline -Path (Join-Path $phaseDir "$slot.txt")
+      - name: Upload this slot's readings for the gate
+        if: ${{ always() && runner.os == 'Windows' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: dk-phases-${{ matrix.slot }}
+          path: ${{ runner.temp }}/dk-phases
+          if-no-files-found: ignore
+  # THE MEASUREMENT COVERED EVERY SLOT IT CLAIMS TO COVER, OR THIS FAILS.
+  #
+  # The dk matrix runs fail-fast: false, so a dead leg does not stop the others and
+  # the workflow can finish carrying numbers for only some slots. Those numbers then
+  # refresh CLO.md and both PR descriptions while describing a slot nobody measured.
+  # `needs: dk` with `if: always()` is what makes this reachable when a leg failed,
+  # which is the case it exists for.
+  measurement-gate:
+    needs: dk
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      - name: Download every slot's readings
+        uses: actions/download-artifact@v4
+        with:
+          pattern: dk-phases-*
+          merge-multiple: true
+          path: collected
+      # A check that has only ever been observed passing is evidence about the run
+      # and not about the check. This proves it rejects a missing slot, a missing
+      # phase and a zero reading BEFORE its verdict on real data is believed.
+      - name: Prove the gate fires
+        run: node scripts/check-measurement-complete.mjs --selftest
+      - name: Every declared slot reported every declared phase
+        run: node scripts/check-measurement-complete.mjs --dir collected
+  opam:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          lfs: true
+      # T0 is stamped after checkout but before switch create, so the opam
+      # fresh-to-binary number includes switch create + compiler install
+      # (setup-ocaml), the fair counterpart to dk fetching its toolchain.
+      - name: Stamp opam start time (before switch create)
+        shell: bash
+        run: echo "OPAM_T0=$(date +%s%3N)" >> "$GITHUB_ENV"
+      # Matches the dk-locked compiler (CommonsLang_OCaml.DkML@4.14.3001) so the
+      # opam and dk tracks build the same package set with the same compiler.
+      - name: Set up OCaml 4.14 (switch create + compiler install)
+        uses: ocaml/setup-ocaml@v3
+        with:
+          ocaml-compiler: 4.14.x
+          # Stated explicitly so the two cache modes are selectable. setup-ocaml's own
+          # default is true, which the run logs echo as `cache: true`, so an ordinary
+          # dispatch measures exactly what it measured before this input existed and the
+          # existing cache-mode samples stay valid. A tag-triggered run carries no inputs,
+          # so the expression falls back to 'true' rather than to an empty string.
+          cache: ${{ inputs.opam_cache || 'true' }}
+      - name: opam setup + deps + dune build cold/warm/edit (timed)
+        shell: bash
+        run: |
+          set -euo pipefail
+          now() { date +%s%3N; }
+          t0="$OPAM_T0"
+          echo "OPAM MEASURE STARTED $(date -u +%H:%M:%S) os=${{ matrix.os }}"
+          a=$(now)
+          echo "PHASE opam_setup ms=$((a-t0))"
+          opam install . --deps-only -y; b=$(now)
+          echo "PHASE opam_deps ms=$((b-a))"
+          # @install builds the library + executable (the shipped artifacts) and
+          # skips the test rules, which spawn the debugger and time out on the
+          # Windows runner. This measures the same deliverable the dk track runs.
+          c=$(now); opam exec -- dune build @install; d=$(now)
+          echo "PHASE opam_build_cold ms=$((d-c))"
+          echo "PHASE opam_fresh_to_binary ms=$((d-t0))"
+          e=$(now); opam exec -- dune build @install; f=$(now)
+          echo "PHASE opam_build_warm ms=$((f-e))"
+          g=$(now); opam exec -- dune exec -- ocamlearlybird --help=plain >/dev/null; h=$(now)
+          echo "PHASE opam_run_warm ms=$((h-g))"
+          printf '\n(* perf measurement touch *)\n' >> src/main/main.ml
+          i=$(now); opam exec -- dune build @install; j=$(now)
+          echo "PHASE opam_build_edit ms=$((j-i))"
+          echo "OPAM SUMMARY os=${{ matrix.os }} fresh_to_binary_ms=$((d-t0)) setup_ms=$((a-t0)) deps_ms=$((b-a)) build_cold_ms=$((d-c)) build_warm_ms=$((f-e)) run_warm_ms=$((h-g)) build_edit_ms=$((j-i))"
+          echo "OPAM MEASURE DONE $(date -u +%H:%M:%S)"

.github/workflows/repin-engine.yml ADDED Viewed

	@@ -0,0 +1,303 @@

+name: repin-engine
+# Repin dk.u to a chosen engine and CommonsLang_OCaml release ON A HOSTED RUNNER,
+# regenerate etc/dk/i with the launcher's own update, and regenerate the etc/dk/v
+# closure driver so it names rules the new import actually offers.
+#
+# SPLIT OUT OF measure-performance.yml at cycle 40. That file held this job and the
+# timed measurement jobs behind mutually exclusive `if:` conditions, so a dispatch
+# ran one half and skipped the other while the workflow's name promised a
+# measurement either way. Two costs came with that. A reader could not tell from a
+# run's name whether any figure had been produced, which cost a round of confusion
+# when three jobs reported SKIPPED and no numbers changed. And every edit to this
+# repin path touched the file holding the timed steps, which
+# skills/update-ocamlearlybird-measurements says invalidates the measurement
+# cohort: "samples taken before it describe a workflow that no longer exists".
+#
+# It does NOT commit unless asked. The first dispatch produces the diff as an
+# artifact so it can be READ before anything is pushed; a second dispatch with
+# commit=true lands it. The diff is the point rather than a formality.
+on:
+  workflow_dispatch:
+    inputs:
+      engine_version:
+        description: >-
+          The dk actual_version to repin to. 2.4.3.9 is the earliest published
+          engine clearing the F_BuildLockedClosure object-form floor, and
+          2.4.3.8 itself is 404, so nothing below 2.4.3.9 is a valid choice.
+        type: string
+        default: '2.4.3.15'
+      clo_version:
+        description: >-
+          The CommonsLang_OCaml tag to import. It must match the release that
+          any CommonsBase_Dk object this build imports was itself built
+          against, which is the pin-guard rule in skills/bump-version-train.
+        type: string
+        default: '0.1.20260902235611'
+      commit:
+        description: >-
+          Commit the regenerated material back to this branch. Leave false on
+          the first dispatch so the diff is read before anything lands.
+        type: choice
+        options:
+          - 'false'
+          - 'true'
+        default: 'false'
+jobs:
+  repin:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          lfs: true
+      - name: Record what is pinned before anything is touched
+        run: |
+          set -eu
+          mkdir -p .regen
+          echo "--- dk.u pins BEFORE ---"
+          grep -n 'actual_version' dk.u || true
+          grep -n 'CommonsLang_OCaml' dk.u || true
+          echo "--- etc/dk/i BEFORE ---"
+          ls -1 etc/dk/i/
+          cp -a etc/dk/i .regen/i-before
+          cp dk.u .regen/dk.u.before
+          # The CLO tag before the repin, for the values.json diff after regeneration.
+          sed -n 's/.*repo="dkpkg\/CommonsLang_OCaml", tag="\([^"]*\)".*/\1/p' dk.u | head -1 > .regen/old_clo
+      - name: Repin dk.u to the requested engine and CommonsLang_OCaml
+        env:
+          ENGINE: ${{ inputs.engine_version }}
+          CLO: ${{ inputs.clo_version }}
+        run: |
+          set -eu
+          test -n "$ENGINE" && test -n "$CLO" || { echo "::error::engine_version and clo_version must both be non-empty"; exit 1; }
+          echo "repinning: engine -> $ENGINE, CommonsLang_OCaml -> $CLO"
+          # Repin THROUGH THE ENGINE, never by text-editing dk.u. self-update rewrites
+          # the %% actual_version command and its regenerated output pair; add upserts
+          # the CommonsLang_OCaml import by repo IDENTITY (the tag is excluded from the
+          # match, so a wave timestamp shared by sibling imports is irrelevant) and
+          # clears its output block, so the update step below re-fetches and rewrites
+          # the version + checksums + etc/dk/i. Both are idempotent: re-running at the
+          # same engine/tag is a no-op-safe upsert, so no refresh flag and no
+          # version-uniqueness guard are needed (the old text edit needed both, and
+          # broke when sibling imports shared a wave release timestamp).
+          ./dk1 self-update "$ENGINE"
+          ./dk1 add github-l2 dkpkg/CommonsLang_OCaml@"$CLO"
+          echo "--- dk.u diff ---"
+          git --no-pager diff -- dk.u
+      - name: Run the launcher's update on this runner
+        run: |
+          set -eu
+          # KEEP THE EVIDENCE. A sibling step in this workflow once discarded a
+          # failing run's output and the engine's own error was unreadable.
+          # tee, so a failure is diagnosable from the log alone.
+          set +e
+          ./dk1 update 2>&1 | tee .regen/update.log
+          rc=${PIPESTATUS[0]}
+          set -e
+          echo "update exit code: $rc"
+          if [ "$rc" -ne 0 ]; then
+            echo "::error::./dk1 update failed with exit code $rc; the log above is the evidence"
+            exit "$rc"
+          fi
+      - name: Regenerate the closure driver so it matches the rules the import offers
+        # WHY THIS STEP EXISTS. Repinning the import rewrites etc/dk/i and leaves
+        # etc/dk/v alone, and etc/dk/v holds a GENERATED driver that names a rule
+        # by version. On 2026-09-06 that cost a whole measurement: the driver named
+        # the CommonsLang_OCaml.Dk.OpamBuild.F_BuildLockedClosure rule at a stale
+        # version, while the newly imported CommonsLang_OCaml offered only a newer
+        # one, and
+        # both dk legs died with "Could not get rule ... does not exist" after the
+        # 90-minute matrix had already been dispatched.
+        #
+        # The driver is NOT hand-edited from one version to the other. Its own
+        # header says regenerate rather than hand-edit, the generator itself moved
+        # @1.1.16 to @1.1.20 between those releases, and nothing here can verify the
+        # two rule versions take the same parameters. A silently different build
+        # would corrupt the very number this workflow exists to produce.
+        env:
+          CLO: ${{ inputs.clo_version }}
+        run: |
+          set -eu
+          imp="etc/dk/i/CommonsLang_OCaml.${CLO}.values.json"
+          if [ ! -s "$imp" ]; then
+            echo "::error::$imp is missing or empty, so there is nothing to regenerate against"
+            exit 1
+          fi
+          # THE RULE VERSION IS DISCOVERED, NEVER PINNED HERE. Writing a literal
+          # would reintroduce exactly the defect this step removes: a checked-in
+          # reference to a version the import may no longer offer.
+          ref=$(grep -o 'CommonsLang_OCaml\.Dk\.OpamLock\.Refresh@[0-9][0-9.]*' "$imp" | sort -uV | tail -1)
+          if [ -z "$ref" ]; then
+            echo "::error::the import offers no CommonsLang_OCaml.Dk.OpamLock.Refresh rule, so the driver cannot be regenerated from it"
+            exit 1
+          fi
+          echo "regenerating with $ref"
+          # PROVE THE CHECK FIRES BEFORE TRUSTING THAT IT PASSES. CLO.md:194
+          # documents mode=check as read-only and nonzero when a driver is stale,
+          # so it must go RED here and GREEN below, in this same run. A check only
+          # ever observed passing is evidence about the run, not about the check.
+          set +e
+          ./dk1 dialog "$ref" mode=check > .regen/driver-check-before.log 2>&1
+          before=$?
+          set -e
+          echo "driver staleness BEFORE regeneration: exit $before"
+          cat .regen/driver-check-before.log || true
+          if [ "$before" -eq 0 ]; then
+            echo "NOTE: the driver was already current for this import, so this run does not exercise the stale path."
+          fi
+          ./dk1 dialog "$ref" 2>&1 | tee .regen/driver-refresh.log
+          # KEEP THE EVIDENCE, and fail loudly. A sibling step in this workflow once
+          # discarded a failing run's output and the engine's own error was unreadable.
+          set +e
+          ./dk1 dialog "$ref" mode=check > .regen/driver-check-after.log 2>&1
+          after=$?
+          set -e
+          echo "driver staleness AFTER regeneration: exit $after"
+          cat .regen/driver-check-after.log || true
+          if [ "$after" -ne 0 ]; then
+            echo "::error::the driver is STILL stale after regenerating it; the log above is the evidence"
+            exit "$after"
+          fi
+          # Refresh regenerates ONLY the GenerateDriver (closure/DevPrefix) family.
+          # The Src and Final drivers are owned by the separate GenerateSrc and
+          # GenerateFinal rules; a CLO rule-version bump moves those too, and the
+          # closure refresh-check cannot see it, so they go stale undetected (the
+          # 2026-09-14 measurement hit exactly this). Regenerate both here,
+          # discovering the rule version from the same import and the root package
+          # id from the drivers. GenerateSrc/GenerateFinal self-discover the lock
+          # root from pkg=, so no root=/roots[]= is needed here.
+          srcref=$(grep -o 'CommonsLang_OCaml\.Dk\.OpamLock\.GenerateSrc@[0-9][0-9.]*' "$imp" | sort -uV | tail -1)
+          finalref=$(grep -o 'CommonsLang_OCaml\.Dk\.OpamLock\.GenerateFinal@[0-9][0-9.]*' "$imp" | sort -uV | tail -1)
+          pkgid=$(grep -ohE 'NotHackwaly_Ocamlearlybird\.Ocamlearlybird@[0-9][0-9.]*' etc/dk/v/NotHackwaly_Ocamlearlybird/*.values.jsonc | sort -uV | tail -1)
+          if [ -z "$srcref" ] || [ -z "$finalref" ] || [ -z "$pkgid" ]; then
+            echo "::error::could not discover GenerateSrc/GenerateFinal rule version or the earlybird pkg id"
+            exit 1
+          fi
+          echo "regenerating Src with $srcref and Final with $finalref for $pkgid"
+          ./dk1 dialog "$srcref" pkg="$pkgid"
+          ./dk1 dialog "$finalref" pkg="$pkgid"
+          echo "--- etc/dk/v diff ---"
+          git --no-pager diff -- etc/dk/v/ || true
+      - name: Every rule the driver names must exist in the import
+        # The guard that turns a 90-minute failure into a seconds-long one. It is a
+        # SEPARATE step from the regeneration above on purpose: presence and effect
+        # need separate reports, and this one still fires when the regeneration
+        # silently no-ops.
+        env:
+          CLO: ${{ inputs.clo_version }}
+        run: |
+          set -eu
+          imp="etc/dk/i/CommonsLang_OCaml.${CLO}.values.json"
+          drv=etc/dk/v/NotHackwaly_Ocamlearlybird/Ocamlearlybird.Closure.values.jsonc
+          if [ ! -s "$drv" ]; then
+            echo "::error::$drv is missing or empty after regeneration"
+            exit 1
+          fi
+          named=$(grep -o 'CommonsLang_OCaml\.[A-Za-z0-9_.]*@[0-9][0-9.]*' "$drv" | sort -u)
+          # An empty result must never impersonate a real answer: a driver naming no
+          # CommonsLang_OCaml rule at all would otherwise read as "nothing missing".
+          if [ -z "$named" ]; then
+            echo "::error::the driver names no CommonsLang_OCaml rule at all, which cannot be right"
+            exit 1
+          fi
+          missing=0
+          total=0
+          for r in $named; do
+            total=$((total + 1))
+            if grep -qF "\"$r\"" "$imp"; then
+              echo "  OK      $r"
+            else
+              echo "  MISSING $r"
+              missing=$((missing + 1))
+            fi
+          done
+          echo "checked $total rule(s) named by the driver against $imp"
+          if [ "$missing" -ne 0 ]; then
+            echo "::error::$missing of $total rule(s) named by the driver are absent from the import. This is the 2026-09-06 failure, caught before the measurement instead of after it."
+            exit 1
+          fi
+      - name: The regeneration must have produced something
+        env:
+          CLO: ${{ inputs.clo_version }}
+        run: |
+          set -eu
+          want="etc/dk/i/CommonsLang_OCaml.${CLO}.values.json"
+          echo "--- etc/dk/i AFTER ---"
+          ls -1 etc/dk/i/
+          # An empty result must never impersonate a real answer.
+          if [ ! -s "$want" ]; then
+            echo "::error::$want is missing or empty after update; the regeneration produced nothing"
+            exit 1
+          fi
+          echo "PRESENT $want ($(wc -c < "$want") bytes)"
+          old=$(cat .regen/old_clo)
+          oldf=".regen/i-before/CommonsLang_OCaml.${old}.values.json"
+          echo "--- values.json: ${old} -> ${CLO} ---"
+          if [ -s "$oldf" ]; then
+            # diff exits 1 when the files differ, which is the expected case.
+            diff -u "$oldf" "$want" > .regen/values.diff || true
+            echo "diff lines: $(wc -l < .regen/values.diff)"
+            cat .regen/values.diff
+          else
+            echo "no prior values.json at $oldf to diff against"
+            echo "no prior values.json to diff" > .regen/values.diff
+          fi
+          echo "--- every change in the working tree ---"
+          git status --porcelain
+          git --no-pager diff --stat
+      - name: Upload the regenerated material so the diff can be read before it lands
+        uses: actions/upload-artifact@v4
+        with:
+          name: regenerated-import
+          path: |
+            dk.u
+            etc/dk/i/**
+            etc/dk/v/**
+            .regen/values.diff
+            .regen/update.log
+            .regen/driver-refresh.log
+            .regen/driver-check-before.log
+            .regen/driver-check-after.log
+          if-no-files-found: error
+      - name: Commit and push, only when asked
+        if: ${{ inputs.commit == 'true' }}
+        env:
+          ENGINE: ${{ inputs.engine_version }}
+          CLO: ${{ inputs.clo_version }}
+        run: |
+          set -eu
+          rm -rf .regen
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "::error::commit was requested but the tree is clean; nothing was regenerated"
+            exit 1
+          fi
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add dk.u etc/dk/i etc/dk/v
+          git commit \
+            -m "Regenerate the import on a hosted runner" \
+            -m "+ repin the engine to ${ENGINE}" \
+            -m "+ repin CommonsLang_OCaml to ${CLO}" \
+            -m "+ regenerate etc/dk/i with ./dk1 update" \
+            -m "+ regenerate the etc/dk/v closure driver with the OpamLock.Refresh dialog"
+          git push origin "HEAD:${GITHUB_REF_NAME}"

.gitignore CHANGED Viewed

@@ -2,3 +2,8 @@
 node_modules
 /_build
 .merlin

 node_modules
 /_build
 .merlin
+# dk transient state (see CLO.md). dk writes self-ignoring .gitignore files
+# into the other directories it creates (dk-dist/, opam-venv/, the etc/dk/i
+# scratch download), so only the local store needs an entry here.
+/t/

CLO.md ADDED Viewed

	@@ -0,0 +1,207 @@

+# Building ocamlearlybird with the dk build tool
+This document explains how to build the `ocamlearlybird` OCaml debug adapter
+with [dk](https://diskuv.com/dk), a Windows-friendly, incremental, remote
+cacheable build system. It is
+written for two audiences, people who just want the binary (**Users**) and
+people who maintain this repository's dk integration (**Maintainers**), and it
+is meant to double as a worked, replayable example of adopting dk for an
+existing opam/dune project.
+## Provenance
+The dk packages this build depends on have been **100% AI generated and
+maintained since June 2026**, and the dk build tool itself was **hand built but
+AI assisted since June 2026**.
+---
+## Quick Setup
+The Quick Setup path builds ocamlearlybird from source once on your machine,
+on top of a prebuilt toolchain: the OCaml compiler, Dune, opam, and the
+supporting build utilities arrive as prebuilt
+objects that dk lazily range-fetches from published Diskuv
+package releases. An existing CI-backed dk package (here
+`dkpkg/CommonsLang_OCaml`, which publishes the OCaml toolchain objects) gives
+you that partial caching for free.
+What you build locally in Quick Setup is ocamlearlybird's own opam dependency
+closure (lwt, dap, menhir, ppxlib, …) plus ocamlearlybird itself, each as its
+own cached dk object.
+### Quick Setup for Users
+You need two things: install dk1, then run one object.
+**1. Install dk1** (installs both `dk0` and `dk1` into `~/.local/bin`, verified
+with signify + SHA-256):
+```sh
+curl -fsSL https://diskuv.com/dk/install.sh | sh
+# Windows PowerShell:  irm https://diskuv.com/dk/install.ps1 | iex
+```
+(If you cloned this repository you can skip the install entirely and use the
+vendored `./dk1` launcher, which self-installs the pinned version on first run.)
+**2. Build and run the debug adapter** as a single object:
+```sh
+./dk1 run-object NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6 \
+  -s Release.execution_abi \
+  -m bin/ocamlearlybird.exe \
+  -- --help
+```
+- `-s Release.execution_abi` selects the object built for the host you are on, so the
+  same command works on Linux, macOS and Windows without editing the slot.
+- `-m bin/ocamlearlybird.exe` selects the member of the built object to execute.
+- everything after `--` is passed to the debug adapter.
+### Quick Setup for Maintainers
+Adopting dk for an existing opam/dune project is the command sequence below,
+shown for Linux. On macOS swap the slot in step 6 (`Release.Darwin_arm64`); on
+Windows use PowerShell, `irm https://diskuv.com/dk/vendor.ps1 | iex` for step 1,
+and `.\dk1.cmd` for the rest.
+```sh
+# 1. vendor the dk0/dk1 launchers into the repo
+curl -fsSL https://diskuv.com/dk/vendor.sh | sh
+# 2. scaffold dk.u, seed the pin table and .gitattributes, record the
+#    quickstart's declared trust statements, and import the toolchain
+./dk1 quickstart ocaml opam414
+# 3. fetch and verify the toolchain import
+./dk1 update
+# 4. adopt: solve the lock, generate the build forms, register the assets
+./dk1 dialog CommonsLang_OCaml.Dk.OpamLock.Adopt@1.1.14 version=1.3.6 unit=Ocamlearlybird ns=NotHackwaly_Ocamlearlybird
+# 5. recompute the checksums of the registered workspace assets
+./dk1 update
+# 6. build and run the debug adapter
+./dk1 run-object NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6 \
+  -s Release.execution_abi -m ./bin/ocamlearlybird.exe -- --help
+```
+`ns=` keeps this fork's committed third-party namespace; a maintainer adopting
+their own project omits it and gets a namespace derived from the repository.
+What the above sequence of commands produces:
+| File | Role |
+|---|---|
+| `dk0`, `dk1`, `dk0.cmd`, `dk1.cmd` | vendored self-installing launchers (step 1) |
+| `etc/dk/t/acceptances.json`, `etc/dk/t/capabilities.json` | trust records from the quickstart's declared trust statements (step 2) |
+| `dk.u` | workspace script: pinned imports + registered asset declarations (steps 2, 4, 5) |
+| `dk-opam-pins.txt` | opam solve pin table, seeded by the quickstart (see below) |
+| `dk-src/dune-workspace` | dune workspace root marker staged into the assembled source |
+| `dk.opam-lock.jsonc` | the solved, checked-in per-slot dependency lock (step 4) |
+| `etc/dk/v/…/Ocamlearlybird.Src.values.jsonc` | generated localized-source form (step 4) |
+| `etc/dk/v/…/Ocamlearlybird.Closure.values.jsonc` | generated one-line closure driver (step 4) |
+| `etc/dk/v/…/Ocamlearlybird.values.jsonc` | generated thin final form exposing `bin/ocamlearlybird` (step 4) |
+| `etc/dk/i/*.values.json`, `etc/dk/i/dk-closure-manifest.tsv` | verified import records (steps 2, 3) |
+**Maintenance after adoption.** After a repin or a dependency change, the
+zero-argument `Refresh` regenerates the committed driver from the stamped
+parameters, and `mode=check` validates it read-only (CI-friendly):
+```sh
+./dk1 dialog CommonsLang_OCaml.Dk.OpamLock.Refresh@1.1.14               # regenerate the driver
+./dk1 dialog CommonsLang_OCaml.Dk.OpamLock.Refresh@1.1.14 mode=solve    # re-solve the lock, then the driver
+./dk1 dialog CommonsLang_OCaml.Dk.OpamLock.Refresh@1.1.14 mode=check    # read-only; nonzero if a driver is stale
+./dk1 dialog CommonsLang_OCaml.Dk.OpamLock.Refresh@1.1.14 version=1.3.7 # bump earlybird across the coupled ids
+```
+After editing any workspace asset (`dune`, `dune-project`, `earlybird.opam`,
+`src/`, or the lock) run `./dk1 update --no-imports` to refresh the recorded
+checksums in `dk.u`, then rebuild, see *Editing a file and rebuilding*.
+#### The pin table (`dk-opam-pins.txt`)
+The quickstart seeds the pin table, and the
+[dk for opam users guide](https://diskuv.com/dk/docs/OPAM/) explains its line
+forms and purpose. This repository makes one change to the seeded table: the
+`repo default` line pins the opam-repository to a single commit,
+```
+repo default git+https://github.com/ocaml/opam-repository.git#4f41495f12b15921ce982ac208c41b257d295515
+```
+so every maintainer and every CI run solves against the same package index and
+produces the same lock. Bump the commit deliberately, then re-solve with
+`Refresh mode=solve`.
+---
+<!-- The "## High Performance" section is added on the dk1-high-performance branch. -->
+## Editing a file and rebuilding
+The supported flow after editing a source file:
+```sh
+# edit e.g. src/main/main.ml, then:
+./dk1 update --no-imports          # recompute workspace-asset checksums in dk.u
+./dk1 run-object NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6 \
+  -s Release.execution_abi -m bin/ocamlearlybird.exe -- --help
+```
+dk0/dk1 re-checksum workspace assets **only on `update`**, so `dk1 update` is what
+turns a working-tree edit into a new content hash, so only the objects whose
+inputs actually changed rebuild, here
+the localized-source object and the local `earlybird` package object, while every
+external package object stays cached and is reused untouched.
+## What gets cached
+| Piece | Quick Setup source |
+| --- | --- |
+| OCaml compiler toolchain (`CommonsLang_OCaml.DkML@4.14.3`) | fetched prebuilt from the `dkpkg` release |
+| Dune (`CommonsLang_OCaml.Dune@3.23.1`) | fetched prebuilt from the `dkpkg` release |
+| opam and the build utilities (coreutils, 7-Zip, GNU make) | fetched prebuilt from the `dkpkg` releases |
+| MSYS2 runtime (Windows slots) | fetched prebuilt from the `dkpkg` release |
+| The 53 locked dependency packages (lwt, dap, menhir, ppxlib, …) | built locally once, then cached |
+| The in-tree `earlybird` package | built locally, rebuilt on source edits |
+| Localized source and final executable forms | built locally (copy and archive steps) |
+A dk object id is a hash of the values-file content, the `module@version`, and
+the slot, and the id embeds this project's namespace. A
+project's own prior releases are the cache that pays off for the dependency
+packages, which is what the High Performance CI path sets up.
+## Supported OCaml versions
+This build compiles ocamlearlybird with OCaml 4.14.3 (the
+`CommonsLang_OCaml.DkML@4.14.3` toolchain). A bytecode debugger must be built
+with the same compiler version as the program it debugs, so this build debugs
+programs compiled with OCaml 4.14.x.
+To debug a program compiled with a different OCaml version, build ocamlearlybird
+with that compiler using upstream's opam instructions; the dk pipeline here
+builds with 4.14.3.
+### Why `dap` is held at `{>= "1.0.6" & < "1.1.0"}`
+Upstream ocamlearlybird bumped `earlybird.opam` / `dune-project` to `dap {>= "1.1.0"}`
+(the "dap 1.71 spec" change) and set the RunInTerminal field
+`args_can_be_interpreted_by_shell`. **Do not re-bump `dap` here** while the build
+targets the 4.14.3 toolchain: `dap` 1.1.0's dependency closure does not solve
+against it. The `< "1.1.0"` upper bound is load-bearing on its own: this
+branch's source does not set the RunInTerminal field that `dap` 1.1.0's record
+type requires, so a plain `opam install` that selects `dap` 1.1.0 (which current
+opam-repository permits on many compilers) fails to compile
+(`Some record fields are undefined: args_can_be_interpreted_by_shell`). The
+bound makes the opam metadata state what the source can actually build against.
+Solving the closure per pinned OCaml gives:
+| Pinned solve | Result |
+| --- | --- |
+| `ocaml 4.14.3` | no solution; the closure requires `ocaml (< 4.14.3 \| >= 5.0)` |
+| `ocaml 5.5.0` | no solution; the closure requires `ocaml < 5.4` |
+| `dap 1.1.0` on `ocaml 4.14.3` | no `dap` satisfies |
+So the feasible OCaml window for `dap` 1.1.0 is `< 4.14.3` or `[5.0, 5.4)`, and
+`CommonsLang_OCaml` ships compiler objects only at 4.14.3 / 5.4.1 / 5.5.0. The
+`args_can_be_interpreted_by_shell` field is DAP-optional and was set to `None`
+(the absent/default behaviour), so keeping `dap` at 1.0.6 and dropping that one
+field is behaviour-neutral.

dk-opam-pins.txt ADDED Viewed

	@@ -0,0 +1,32 @@

+# Pin table for CommonsLang_OCaml.Dk.OpamLock.Solve (see CLO.md "Quick Setup
+# for Maintainers"). Every line below is explained in that section.
+#
+# Line forms:
+#   repo NAME URL          opam repository for the solve (pin a commit with #COMMIT)
+#   pin NAME VERSION       hard version lock for one opam package
+#   float NAME             remove a pin inherited from an existing switch
+#   archexclude NAME ARCH  exclude a package on one architecture
+#
+# --- repositories ---
+# Pin ocaml/opam-repository to a single commit so the solved closure is
+# reproducible run-to-run (master on 2026-08-08):
+repo default git+https://github.com/ocaml/opam-repository.git#4f41495f12b15921ce982ac208c41b257d295515
+#
+# --- version locks ---
+# Lock the OCaml compiler to 4.14.3. The per-package build rule
+# (CommonsLang_OCaml.Dk.OpamBuild) compiles every package with the relocatable
+# CommonsLang_OCaml.DkML@4.14.3 toolchain, so the lock MUST resolve the 4.14.x
+# dependency closure. Without this pin the solver picks the newest OCaml (5.x)
+# and selects 5.x-only package versions that would not compile under 4.14.3.
+pin ocaml 4.14.3
+pin ocaml-base-compiler 4.14.3
+#
+# Lock dune to 3.23.1, the version the toolchain provides
+# (CommonsLang_OCaml.Dune@3.23.1). The toolchain lags opam-repository master, so
+# an unpinned solve pulls packages (e.g. dune-configurator 3.24.x) that declare
+# "dune" {>= "3.24"} and ship `(lang dune 3.24)`, which the provided Dune 3.23.1
+# refuses ("Version 3.24 of the dune language is not supported"). Pinning dune to
+# the provided version makes the solver pick dune-3.23-compatible package
+# versions. GENERAL RULE: pin every toolchain-provided tool (ocaml, dune) to the
+# exact version dk ships, so the solved closure matches what actually builds it.
+pin dune 3.23.1

dk-src/dune-workspace ADDED Viewed

	@@ -0,0 +1 @@


1	+ (lang dune 2.8)

dk.opam-lock.jsonc ADDED Viewed

	@@ -0,0 +1,2256 @@

+{
+  "$schema": "https://diskuv.com/dk/schema/dk-opam-lock-1.0.json",
+  "generated": {
+    "opam_version": "2.5.1",
+    "tool": "CommonsLang_OCaml.Dk.OpamLock@1.1.0"
+  },
+  "opam_repositories": [
+    {
+      "commit": null,
+      "name": "default",
+      "url": "git+https://github.com/ocaml/opam-repository.git#4f41495f12b15921ce982ac208c41b257d295515"
+    }
+  ],
+  "packages": {
+    "angstrom-lwt-unix.0.16.1": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\"dune\" \"build\" \"-p\" name \"-j\" jobs]\n[\"dune\" \"runtest\" \"-p\" name \"-j\" jobs] {with-test}",
+      "depends": [
+        "ocaml",
+        "dune",
+        "angstrom",
+        "lwt",
+        "base-unix"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.03.0\"} \"dune\" {>= \"1.8\"} \"angstrom\" \"lwt\" \"base-unix\"",
+      "install": null,
+      "name": "angstrom-lwt-unix",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=a9e096b4b2b8e4e3bb17d472bbccaad0",
+          "sha256=143536fb4d049574c539b9990840615e078ed3dd94e1d24888293f68349a100b"
+        ],
+        "size": 117544,
+        "url": "https://github.com/inhabitedtype/angstrom/archive/0.16.1.tar.gz"
+      },
+      "version": "0.16.1"
+    },
+    "angstrom.0.16.1": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\"dune\" \"build\" \"-p\" name \"-j\" jobs]\n[\"dune\" \"runtest\" \"-p\" name \"-j\" jobs] {with-test}",
+      "depends": [
+        "ocaml",
+        "dune",
+        "bigstringaf",
+        "ocaml-syntax-shims"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.04.0\"}\n\"dune\" {>= \"1.8\"}\n\"alcotest\" {with-test & >= \"0.8.1\"}\n\"bigstringaf\"\n\"ppx_let\" {with-test & >= \"v0.14.0\"}\n\"ocaml-syntax-shims\" {build}",
+      "install": null,
+      "name": "angstrom",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=a9e096b4b2b8e4e3bb17d472bbccaad0",
+          "sha256=143536fb4d049574c539b9990840615e078ed3dd94e1d24888293f68349a100b"
+        ],
+        "size": 117544,
+        "url": "https://github.com/inhabitedtype/angstrom/archive/0.16.1.tar.gz"
+      },
+      "version": "0.16.1"
+    },
+    "arch-x86_64.1": {
+      "build": null,
+      "depends": [
+        "ocaml-base-compiler",
+        "host-arch-x86_64"
+      ],
+      "depends_raw": "(\"ocaml-base-compiler\" {post & >= \"4.13.0~\"} |\n \"ocaml-variants\" {post & >= \"4.13.0~\"})\n\"host-arch-x86_64\" {post}",
+      "install": null,
+      "name": "arch-x86_64",
+      "source": null,
+      "version": "1"
+    },
+    "base-bigarray.base": {
+      "build": null,
+      "depends": [],
+      "depends_raw": null,
+      "install": null,
+      "name": "base-bigarray",
+      "source": null,
+      "version": "base"
+    },
+    "base-bytes.base": {
+      "build": null,
+      "depends": [
+        "ocaml",
+        "ocamlfind"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.02.0\"} \"ocamlfind\" {>= \"1.5.3\"}",
+      "install": null,
+      "name": "base-bytes",
+      "source": null,
+      "version": "base"
+    },
+    "base-threads.base": {
+      "build": null,
+      "depends": [],
+      "depends_raw": null,
+      "install": null,
+      "name": "base-threads",
+      "source": null,
+      "version": "base"
+    },
+    "base-unix.base": {
+      "build": null,
+      "depends": [],
+      "depends_raw": null,
+      "install": null,
+      "name": "base-unix",
+      "source": null,
+      "version": "base"
+    },
+    "base.v0.16.5": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "sexplib0",
+        "dune",
+        "dune-configurator"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"sexplib0\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"dune-configurator\"",
+      "install": null,
+      "name": "base",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=109456ad2350671ad3159cbbca993e3e",
+          "sha512=445d08b965e0d559e4046b874f611c8f36de47fa5c23a047146f48ee638588c1b73789a7adb5ead235c0ad2f44b56fd513a6d60bcb8b6c9f11566d32fd7760f2",
+          "sha256=e34b3e18b404b5b71db599a35fcf32da463b759867981839670aff8b9e8813bc"
+        ],
+        "size": 442654,
+        "url": "https://github.com/janestreet/base/archive/refs/tags/v0.16.5.tar.gz"
+      },
+      "version": "v0.16.5"
+    },
+    "bigstringaf.0.10.0": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "dune-configurator",
+        "ocaml"
+      ],
+      "depends_raw": "\"dune\" {>= \"3.0\"}\n\"dune-configurator\" {>= \"3.0\"}\n\"alcotest\" {with-test}\n\"ocaml\" {>= \"4.08.0\"}",
+      "install": null,
+      "name": "bigstringaf",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha512=b51c756925d7016ffd7eac49e69393a1897391ca2685a8c30c7b6e3917b4d66c9400b49e8986d0f03329197b95ad52e096ff83dea5e03571cb5bc3d9a5170602",
+          "sha256=ed92f5b05fbc11b9defcec734d59b1068f3717a9ae4f9705c16c7f7ac3729f28",
+          "md5=be0a44416840852777651150757a0a3b"
+        ],
+        "size": 12175,
+        "url": "https://github.com/inhabitedtype/bigstringaf/archive/0.10.0.tar.gz"
+      },
+      "version": "0.10.0"
+    },
+    "cmdliner.2.1.1": {
+      "build": "make \"all\" \"PREFIX=%{prefix}%\"",
+      "depends": [
+        "ocaml"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08.0\"}",
+      "install": "[\n  make\n  \"install\"\n  \"BINDIR=%{_:bin}%\"\n  \"LIBDIR=%{_:lib}%\"\n  \"DOCDIR=%{_:doc}%\"\n  \"SHAREDIR=%{share}%\"\n  \"MANDIR=%{man}%\"\n]\n[\n  make\n  \"install-doc\"\n  \"LIBDIR=%{_:lib}%\"\n  \"DOCDIR=%{_:doc}%\"\n  \"SHAREDIR=%{share}%\"\n  \"MANDIR=%{man}%\"\n]",
+      "name": "cmdliner",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha512=cdc338ae2e56a72b7c75dae9564c57cca4e1fbfac454aabbf8303fcb612346284aede5984dfde7e8a7a496cc870bbd57ddf28cab3a38667279b31657f85c15dd",
+          "sha256=05b938d1def4f54c478178f1982822834510431ed98f2ac67cb4d90aa120d6b6"
+        ],
+        "size": 98754,
+        "url": "https://erratique.ch/software/cmdliner/releases/cmdliner-2.1.1.tbz"
+      },
+      "version": "2.1.1"
+    },
+    "conf-mingw-w64-gcc-i686.1": {
+      "build": "[\"i686-w64-mingw32-gcc\" \"--version\"]\n[\n  \"sh\"\n  \"./install-shim.sh\"\n  name\n  \"mingw64-i686-binutils mingw64-i686-gcc-core\"\n  bin\n  \"i686-w64-mingw32-gcc\"\n  \"_shim\"\n  \"cygpath\" {host-arch-x86_32:installed}\n] {os = \"win32\" & os-distribution = \"cygwin\" & mingw-w64-shims:installed}",
+      "depends": [
+        "host-arch-x86_64",
+        "host-arch-x86_32"
+      ],
+      "depends_raw": "\"msys2\" {os-distribution = \"msys2\"}\n\"msys2-mingw32\" {os-distribution = \"msys2\"}\n(\"host-arch-x86_64\" | \"host-arch-x86_32\")",
+      "install": null,
+      "name": "conf-mingw-w64-gcc-i686",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=d29e6141f02500f13534b6a0d77c290f2987c534c660a4f90cdb01618be32507",
+          "sha512=892c4b5d7eaab6ce846fe8fe2756f23c61c654605b6c3bf8698db392725b3be81d015536230dc8305e7d17eb451beae5c21f705237523c79cc11e99c17cbed95"
+        ],
+        "size": 7749,
+        "url": "https://github.com/dra27/mingw-w64-shims/archive/refs/tags/1.0.1.tar.gz"
+      },
+      "version": "1"
+    },
+    "conf-mingw-w64-gcc-x86_64.1": {
+      "build": "[\"x86_64-w64-mingw32-gcc\" \"--version\"]\n[\n  \"sh\"\n  \"./install-shim.sh\"\n  name\n  \"mingw64-x86_64-binutils mingw64-x86_64-gcc-core\"\n  bin\n  \"x86_64-w64-mingw32-gcc\"\n  \"shim\"\n  \"cygpath\" {host-arch-x86_64:installed}\n] {os = \"win32\" & os-distribution = \"cygwin\" & mingw-w64-shims:installed}",
+      "depends": [
+        "host-arch-x86_64",
+        "host-arch-x86_32"
+      ],
+      "depends_raw": "\"msys2\" {os-distribution = \"msys2\"}\n\"msys2-mingw64\" {os-distribution = \"msys2\"}\n(\"host-arch-x86_64\" | \"host-arch-x86_32\")",
+      "install": null,
+      "name": "conf-mingw-w64-gcc-x86_64",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=d29e6141f02500f13534b6a0d77c290f2987c534c660a4f90cdb01618be32507",
+          "sha512=892c4b5d7eaab6ce846fe8fe2756f23c61c654605b6c3bf8698db392725b3be81d015536230dc8305e7d17eb451beae5c21f705237523c79cc11e99c17cbed95"
+        ],
+        "size": 7749,
+        "url": "https://github.com/dra27/mingw-w64-shims/archive/refs/tags/1.0.1.tar.gz"
+      },
+      "version": "1"
+    },
+    "cppo.1.8.0": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test & dune:version < \"3.24\"}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "ocaml",
+        "dune",
+        "base-unix"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.02.3\"} \"dune\" {>= \"2.0\"} \"base-unix\"",
+      "install": null,
+      "name": "cppo",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=a197cb393b84f6b30e0ff55080ac429b",
+          "sha512=3840725b767a0300bdc48f11d26d798bdcae0a764ed6798df3a08dfc8cc76fe124b14a19d47c9b5ea8e229d68b0311510afce77c0e4d9131fbda5116dc2689a2",
+          "sha256=6e62a8ee0217c9cc38d5860110eb18eb8d89c05c420353d298e1431fe8bac00f"
+        ],
+        "size": 43588,
+        "url": "https://github.com/ocaml-community/cppo/archive/v1.8.0.tar.gz"
+      },
+      "version": "1.8.0"
+    },
+    "csexp.1.5.2": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\"dune\" \"build\" \"-p\" name \"-j\" jobs \"@install\" \"@doc\" {with-doc}]",
+      "depends": [
+        "dune",
+        "ocaml"
+      ],
+      "depends_raw": "\"dune\" {>= \"3.4\"} \"ocaml\" {>= \"4.03.0\"} \"odoc\" {with-doc}",
+      "install": null,
+      "name": "csexp",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=1a14dd04bb4379a41990248550628c77913a9c07f3c35c1370b6960e697787ff",
+          "sha512=be281018bcfc20d4db14894ef51c4b836d6338d2fdfe22e63d46f405f8dea7349e16f1c0ecd65f73d4c85a2a80e618cdbb8c9dafcbb9f229f04f1adca5b1973c"
+        ],
+        "size": 11447,
+        "url": "https://github.com/ocaml-dune/csexp/releases/download/1.5.2/csexp-1.5.2.tbz"
+      },
+      "version": "1.5.2"
+    },
+    "dap.1.0.6": {
+      "build": "[\"dune\" \"subst\"] {dev} [\"dune\" \"build\" \"-p\" name \"-j\" jobs]",
+      "depends": [
+        "ocaml",
+        "dune",
+        "yojson",
+        "ppx_here",
+        "ppx_deriving",
+        "ppx_deriving_yojson",
+        "ppx_expect",
+        "lwt",
+        "lwt_ppx",
+        "lwt_react",
+        "react",
+        "angstrom",
+        "angstrom-lwt-unix",
+        "logs"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08\"}\n\"dune\" {>= \"2.7\"}\n\"yojson\"\n\"ppx_here\"\n\"ppx_deriving\"\n\"ppx_deriving_yojson\"\n\"ppx_expect\"\n\"lwt\"\n\"lwt_ppx\" {>= \"2.0.1\"}\n\"lwt_react\"\n\"react\"\n\"angstrom\"\n\"angstrom-lwt-unix\"\n\"logs\"",
+      "install": null,
+      "name": "dap",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=e0b249a3e7382125402ad15d71f4924eef60cfcec326383a5168d424087200ff",
+          "sha512=97805a383ad03ba24f1dabe20798c139678f958dfa2aed1664098f444aaeefd56d6dd7ff3650800eaefe5b17e09098427b78500316699e7267eb1fef233d6a99"
+        ],
+        "size": 58908,
+        "url": "https://github.com/hackwaly/ocaml-dap/releases/download/1.0.6/dap-1.0.6.tbz"
+      },
+      "version": "1.0.6"
+    },
+    "dune-configurator.3.23.1": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\"dune\" \"build\" \"-p\" name \"-j\" jobs \"@install\" \"@doc\" {with-doc}]",
+      "depends": [
+        "dune",
+        "ocaml",
+        "base-unix",
+        "csexp"
+      ],
+      "depends_raw": "\"dune\" {>= \"3.23\"}\n\"ocaml\" {>= \"4.14.0\"}\n\"base-unix\"\n\"csexp\" {>= \"1.5.0\"}\n\"odoc\" {with-doc}",
+      "install": null,
+      "name": "dune-configurator",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=93b4e7157f6ba8feb61cfc5f86008efd2c59037ba78a017d92b4abf30632348f",
+          "sha512=e5566bedc651292ae54d47ba1cdbcfff48962012c1436d0f9ece49a71aa10a674affc092058b0edee56ab2a2405c545b78fde1c472c0b4704c8f58570a2f46cd"
+        ],
+        "size": 2930222,
+        "url": "https://github.com/ocaml/dune/releases/download/3.23.1/dune-3.23.1.tbz"
+      },
+      "version": "3.23.1"
+    },
+    "dune.3.23.1": {
+      "build": "[\"ocaml\" \"boot/bootstrap.ml\" \"-j\" jobs]\n[\n  \"./_boot/dune.exe\"\n  \"build\"\n  \"dune.install\"\n  \"--release\"\n  \"--profile\"\n  \"dune-bootstrap\"\n  \"-j\"\n  jobs\n]",
+      "depends": [
+        "ocaml",
+        "base-unix",
+        "base-threads"
+      ],
+      "depends_raw": "(\"ocaml\" {>= \"4.14\"} |\n (\"ocaml\" {>= \"4.02\" & < \"4.14~~\"} & \"ocamlfind-secondary\" &\n  \"ocaml-secondary-compiler\" {>= \"4.14\"}))\n\"base-unix\"\n\"base-threads\"\n\"lwt\" {with-dev-setup & os != \"win32\"}\n\"cinaps\" {with-dev-setup}\n\"csexp\" {with-dev-setup & >= \"1.3.0\"}\n\"js_of_ocaml\" {with-dev-setup & >= \"6.1.0\" & os != \"win32\"}\n\"js_of_ocaml-compiler\" {with-dev-setup & >= \"6.1.0\" & os != \"win32\"}\n\"mdx\" {with-dev-setup & >= \"2.3.0\" & os != \"win32\"}\n\"menhir\" {with-dev-setup & os != \"win32\"}\n\"ocamlfind\" {with-dev-setup & os != \"win32\"}\n\"odoc\" {with-dev-setup & >= \"2.4.0\" & os != \"win32\"}\n\"ppx_expect\" {with-dev-setup & >= \"v0.17\" & os != \"win32\"}\n\"spawn\" {with-dev-setup}\n\"ppx_inline_test\" {with-dev-setup & os != \"win32\"}\n\"ppxlib\" {with-dev-setup & >= \"0.37.0\" & os != \"win32\"}\n\"ctypes\" {with-dev-setup & os != \"win32\"}\n\"utop\" {with-dev-setup & >= \"2.6.0\" & os != \"win32\"}\n\"melange\" {with-dev-setup & >= \"5.1.0-51\" & os != \"win32\"}\n\"uutf\" {with-dev-setup}\n\"conf-git-daemon\" {with-test}",
+      "install": null,
+      "name": "dune",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=93b4e7157f6ba8feb61cfc5f86008efd2c59037ba78a017d92b4abf30632348f",
+          "sha512=e5566bedc651292ae54d47ba1cdbcfff48962012c1436d0f9ece49a71aa10a674affc092058b0edee56ab2a2405c545b78fde1c472c0b4704c8f58570a2f46cd"
+        ],
+        "size": 2930222,
+        "url": "https://github.com/ocaml/dune/releases/download/3.23.1/dune-3.23.1.tbz"
+      },
+      "version": "3.23.1"
+    },
+    "earlybird.1.3.6": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "ocaml",
+        "ppx_deriving",
+        "ppx_deriving_yojson",
+        "menhir",
+        "menhirLib",
+        "ocaml-compiler-libs",
+        "ppx_optcomp",
+        "iter",
+        "lwt",
+        "lwt_ppx",
+        "lwt_react",
+        "cmdliner",
+        "logs",
+        "fmt",
+        "path_glob",
+        "sexplib",
+        "csexp",
+        "lru",
+        "dap"
+      ],
+      "depends_raw": "\"dune\" {>= \"3.7\"}\n\"ocaml\" {>= \"4.12.0\"}\n\"ppx_deriving\" {>= \"5.1\"}\n\"ppx_deriving_yojson\" {>= \"3.6.1\"}\n\"menhir\" {>= \"20201216\" & build}\n\"menhirLib\" {>= \"20201216\"}\n\"ocaml-compiler-libs\" {>= \"v0.12.3\"}\n\"ppx_optcomp\" {>= \"v0.11\"}\n\"iter\" {>= \"1.2.1\"}\n\"lwt\" {>= \"5.4.0\"}\n\"lwt_ppx\" {>= \"2.0.1\"}\n\"lwt_react\" {>= \"1.1.3\"}\n\"cmdliner\" {>= \"1.1.0\"}\n\"logs\" {>= \"0.7.0\"}\n\"fmt\" {>= \"0.8.9\"}\n\"path_glob\" {>= \"0.2\"}\n\"sexplib\" {>= \"v0.14.0\"}\n\"csexp\" {>= \"1.3.2\"}\n\"lru\" {>= \"0.3.0\"}\n\"dap\" {>= \"1.0.6\" & < \"1.1.0\"}\n\"odoc\" {with-doc}",
+      "install": null,
+      "local": "t",
+      "name": "earlybird",
+      "source": null,
+      "version": "1.3.6"
+    },
+    "flexdll.0.44": {
+      "build": null,
+      "depends": [],
+      "depends_raw": null,
+      "install": null,
+      "name": "flexdll",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=b7c6a92286f1f3065324d51083dcb16eec436a4e6e3b8df7cf836b6d7a8b9491",
+          "sha512=87c5e38810dcf4bba43472e6c4e2ea25081a92664e37269f782ef9412e81d37d53edbbeb0acbf5eb821cc5105085a99337b30e55409057121a68472eb51db7c8"
+        ],
+        "size": 74690,
+        "url": "https://github.com/ocaml/flexdll/archive/refs/tags/0.44.tar.gz"
+      },
+      "version": "0.44"
+    },
+    "fmt.0.11.0": {
+      "build": "\"ocaml\"\n\"pkg/pkg.ml\"\n\"build\"\n\"--dev-pkg\"\n\"%{dev}%\"\n\"--with-base-unix\"\n\"%{base-unix:installed}%\"\n\"--with-cmdliner\"\n\"%{cmdliner:installed}%\"",
+      "depends": [
+        "ocaml",
+        "ocamlfind",
+        "ocamlbuild",
+        "topkg",
+        "base-unix",
+        "cmdliner"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08.0\"}\n\"ocamlfind\" {build}\n\"ocamlbuild\" {build}\n\"topkg\" {build & >= \"1.1.0\"}",
+      "install": null,
+      "name": "fmt",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha512=3f40155fc6a7315202e410585964307d63416c8001fd243667ed9d8d1a02b67deecacb25e9c2feb409c537bbdfb7817d91168de4ddd643532ff51d6c1c696a4a",
+          "sha256=857cfd47a54b52429cd9b3e2665e44173cd1bd3b435bece7172f984ad5376a1b"
+        ],
+        "size": 23336,
+        "url": "https://erratique.ch/software/fmt/releases/fmt-0.11.0.tbz"
+      },
+      "version": "0.11.0"
+    },
+    "host-arch-x86_32.1": {
+      "build": null,
+      "depends": [],
+      "depends_raw": null,
+      "install": null,
+      "name": "host-arch-x86_32",
+      "source": null,
+      "version": "1"
+    },
+    "host-arch-x86_64.1": {
+      "build": null,
+      "depends": [],
+      "depends_raw": null,
+      "install": null,
+      "name": "host-arch-x86_64",
+      "source": null,
+      "version": "1"
+    },
+    "host-system-mingw.1": {
+      "build": null,
+      "depends": [],
+      "depends_raw": null,
+      "install": null,
+      "name": "host-system-mingw",
+      "source": null,
+      "version": "1"
+    },
+    "iter.1.9": {
+      "build": "[\"dune\" \"build\" \"@install\" \"-p\" name \"-j\" jobs]\n[\"dune\" \"build\" \"@doc\" \"-p\" name \"-j\" jobs] {with-doc}\n[\"dune\" \"runtest\" \"-p\" name \"-j\" jobs]\n  {with-test & arch != \"arm32\" & arch != \"x86_32\"}",
+      "depends": [
+        "ocaml",
+        "dune",
+        "base-bigarray"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08.0\"}\n\"dune\" {>= \"2.0\"}\n\"qcheck-core\" {with-test}\n\"ounit2\" {with-test}\n\"mdx\" {with-test & >= \"1.3\"}\n\"odoc\" {with-doc}",
+      "install": null,
+      "name": "iter",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=dba9e5bb152e0d0db0054c36b2a9476747a284a7738f15f1195a3e2035c7e968",
+          "sha512=6c8e0fd57ebca9db642ef6105cb23353fb4f4aa2a37b49ceb61adc9881d0d42e0212326efddea183fae7e27313321680036c3932863004b1853b5fbf37c521de"
+        ],
+        "size": 34177,
+        "url": "https://github.com/c-cube/iter/releases/download/v1.9/iter-1.9.tbz"
+      },
+      "version": "1.9"
+    },
+    "jane-street-headers.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"} \"dune\" {>= \"2.0.0\"}",
+      "install": null,
+      "name": "jane-street-headers",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=876d409feeb495487b10010fb601c64829d2aa15f1b156b704ec141337d360ea"
+        ],
+        "size": 4844,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/jane-street-headers-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "jst-config.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "ppx_assert",
+        "dune",
+        "dune-configurator"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_assert\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"dune-configurator\"",
+      "install": null,
+      "name": "jst-config",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=faead56d8582868cdc099ad54f9bae059cc48710b724600cc64013e73c14d95b"
+        ],
+        "size": 4886,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/jst-config-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "logs.0.10.0": {
+      "build": "\"ocaml\"\n\"pkg/pkg.ml\"\n\"build\"\n\"--dev-pkg\"\n\"%{dev}%\"\n\"--with-js_of_ocaml-compiler\"\n\"%{js_of_ocaml-compiler:installed}%\"\n\"--with-fmt\"\n\"%{fmt:installed}%\"\n\"--with-cmdliner\"\n\"%{cmdliner:installed}%\"\n\"--with-lwt\"\n\"%{lwt:installed}%\"\n\"--with-base-threads\"\n\"%{base-threads:installed}%\"",
+      "depends": [
+        "ocaml",
+        "ocamlfind",
+        "ocamlbuild",
+        "topkg",
+        "cmdliner",
+        "fmt",
+        "lwt",
+        "base-threads"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"ocamlfind\" {build}\n\"ocamlbuild\" {build}\n\"topkg\" {build & >= \"1.1.0\"}\n\"mtime\" {with-test}",
+      "install": null,
+      "name": "logs",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha512=122b7a77bd07aee1e0cb8e07e82b195a12528cf015e72fa0dd5afaae26ce04bad9b29f32a6d3bd3547fe522b8a036608785e8adb900e31580a0d555719bbb7e7",
+          "sha256=760ec291c128d75b74826091337764f925b5ca414b02e2d336a0b37bf30df4ea"
+        ],
+        "size": 20044,
+        "url": "https://erratique.ch/software/logs/releases/logs-0.10.0.tbz"
+      },
+      "version": "0.10.0"
+    },
+    "lru.0.3.1": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\"dune\" \"build\" \"-p\" name \"-j\" jobs]\n[\"dune\" \"runtest\" \"-p\" name] {with-test & ocaml:version >= \"4.07.0\"}",
+      "depends": [
+        "ocaml",
+        "dune",
+        "psq"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.03.0\"}\n\"dune\" {>= \"1.7\"}\n\"psq\" {>= \"0.2.0\"}\n\"qcheck-core\" {with-test}\n\"qcheck-alcotest\" {with-test}\n\"alcotest\" {with-test}",
+      "install": null,
+      "name": "lru",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=6cbe23d27a7d5b244f869c0b88140d47f70f413a6462ef35c0009325d4b236fd",
+          "sha512=81144e258d6e488d4677ade91132401b6f8871c72aadf2f1c190c4dee918c71c5df10c4e690c5bf1ab0f364d87989d44aec3695310a3477f6473eb17c1261734"
+        ],
+        "size": 10201,
+        "url": "https://github.com/pqwy/lru/releases/download/v0.3.1/lru-0.3.1.tbz"
+      },
+      "version": "0.3.1"
+    },
+    "lwt.5.10.1": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"exec\"\n  \"-p\"\n  name\n  \"src/unix/config/discover.exe\"\n  \"--\"\n  \"--save\"\n  \"--use-libev\"\n  \"%{conf-libev:installed}%\"\n]\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "ocaml",
+        "cppo",
+        "ocamlfind",
+        "dune-configurator",
+        "ocplib-endian",
+        "base-threads",
+        "base-unix"
+      ],
+      "depends_raw": "\"dune\" {>= \"3.15\"}\n\"ocaml\" {>= \"4.08\"}\n\"cppo\" {build & >= \"1.1\"}\n\"ocamlfind\" {dev & >= \"1.7.3-1\"}\n\"odoc\" {with-doc & >= \"2.3\"}\n\"dune-configurator\"\n\"ocplib-endian\"",
+      "install": null,
+      "name": "lwt",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=3550f2448bf94379ecd3d480eb8cb070",
+          "sha512=361b4fe8b1613683a0cd89fea08d9ae1615f84e771363ba97843c2dda5c3f45b4a4b6c048c8d79fa58d609c45a7e1dfa2b3e9873d02bac82934fd892f8f4fce1",
+          "sha256=0086b73b57710a6b80deacb6256daee1cf56e24dcb56eb5a49ce4a4516e1b040"
+        ],
+        "size": 312834,
+        "url": "https://github.com/ocsigen/lwt/archive/refs/tags/5.10.1.tar.gz"
+      },
+      "version": "5.10.1"
+    },
+    "lwt_ppx.5.9.1": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "ocaml",
+        "ppxlib",
+        "lwt"
+      ],
+      "depends_raw": "\"dune\" {>= \"2.7\"}\n\"ocaml\" {>= \"4.08\"}\n\"ppxlib\" {>= \"0.16.0\" & < \"0.36\"}\n\"ppx_let\" {with-test}\n\"lwt\" {>= \"5.7.0\" & < \"6.0.0\"}\n\"odoc\" {with-doc}",
+      "install": null,
+      "name": "lwt_ppx",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=18742da8b8fe3618e3fa700b7a884fe7",
+          "sha512=1c51fdb4d0856c89e2df08a1c0095ef28ebd0f613b07b03d0f66501ca5486515562071291e6d0932e57587ed0c9362c8b92c5c9eddb4d2bb2f5e129986b484a7",
+          "sha256=03bf4bae6908a947582485c2a0b8f96428f39f97efd540573a613632be56ad2a"
+        ],
+        "size": 312306,
+        "url": "https://github.com/ocsigen/lwt/archive/refs/tags/5.9.1.tar.gz"
+      },
+      "version": "5.9.1"
+    },
+    "lwt_react.1.2.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "dune",
+        "lwt",
+        "ocaml",
+        "react",
+        "cppo"
+      ],
+      "depends_raw": "\"dune\" {>= \"1.8.0\"}\n\"lwt\" {>= \"3.0.0\"}\n\"ocaml\" {>= \"4.08\"}\n\"react\" {>= \"1.0.0\"}\n\"cppo\" {build & >= \"1.1.0\"}",
+      "install": null,
+      "name": "lwt_react",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=e63979ee40a80d5b9e9e5545f33323b4",
+          "sha512=d616389bc9e0da11f25843ab7541ac2d40c9543700a89455f14115b339bbe58cef2b8acf0ae97fd54e15a4cb93149cfe1ebfda301aa93933045f76b7d9344160",
+          "sha256=1bd4ef42e3c98af4581e53553e42bea0f01c560b9959496949a2d95ca9e4e5e1"
+        ],
+        "size": 315425,
+        "url": "https://github.com/ocsigen/lwt/archive/5.6.0.tar.gz"
+      },
+      "version": "1.2.0"
+    },
+    "menhir.20260209": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "dune",
+        "menhirLib",
+        "menhirSdk",
+        "menhirCST",
+        "menhirGLR"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08\"}\n\"dune\" {>= \"2.8.0\"}\n\"menhirLib\" {= version}\n\"menhirSdk\" {= version}\n\"menhirCST\" {= version}\n\"menhirGLR\" {= version}",
+      "install": null,
+      "name": "menhir",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=e993231085db95ab011ffe0cd606d9dd",
+          "sha512=aafad186f328ae8dd4cc69af0f30c1a0b208cf5148a7a94c150099be03838503c5ec12918de26cd7f794b5a72f114bc1bae8d81058bd0ea10372a3b06818687e",
+          "sha256=69f0414b047d1d5b3507eb8277cd328a60d430bdff51de912b47adb2c25de4f3"
+        ],
+        "size": 1612814,
+        "url": "https://gitlab.inria.fr/fpottier/menhir/-/archive/20260209/archive.tar.gz"
+      },
+      "version": "20260209"
+    },
+    "menhirCST.20260209": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08\"} \"dune\" {>= \"2.8.0\"}",
+      "install": null,
+      "name": "menhirCST",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=e993231085db95ab011ffe0cd606d9dd",
+          "sha512=aafad186f328ae8dd4cc69af0f30c1a0b208cf5148a7a94c150099be03838503c5ec12918de26cd7f794b5a72f114bc1bae8d81058bd0ea10372a3b06818687e",
+          "sha256=69f0414b047d1d5b3507eb8277cd328a60d430bdff51de912b47adb2c25de4f3"
+        ],
+        "size": 1612814,
+        "url": "https://gitlab.inria.fr/fpottier/menhir/-/archive/20260209/archive.tar.gz"
+      },
+      "version": "20260209"
+    },
+    "menhirGLR.20260209": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08\"} \"dune\" {>= \"2.8.0\"}",
+      "install": null,
+      "name": "menhirGLR",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=e993231085db95ab011ffe0cd606d9dd",
+          "sha512=aafad186f328ae8dd4cc69af0f30c1a0b208cf5148a7a94c150099be03838503c5ec12918de26cd7f794b5a72f114bc1bae8d81058bd0ea10372a3b06818687e",
+          "sha256=69f0414b047d1d5b3507eb8277cd328a60d430bdff51de912b47adb2c25de4f3"
+        ],
+        "size": 1612814,
+        "url": "https://gitlab.inria.fr/fpottier/menhir/-/archive/20260209/archive.tar.gz"
+      },
+      "version": "20260209"
+    },
+    "menhirLib.20260209": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08\"} \"dune\" {>= \"2.8.0\"}",
+      "install": null,
+      "name": "menhirLib",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=e993231085db95ab011ffe0cd606d9dd",
+          "sha512=aafad186f328ae8dd4cc69af0f30c1a0b208cf5148a7a94c150099be03838503c5ec12918de26cd7f794b5a72f114bc1bae8d81058bd0ea10372a3b06818687e",
+          "sha256=69f0414b047d1d5b3507eb8277cd328a60d430bdff51de912b47adb2c25de4f3"
+        ],
+        "size": 1612814,
+        "url": "https://gitlab.inria.fr/fpottier/menhir/-/archive/20260209/archive.tar.gz"
+      },
+      "version": "20260209"
+    },
+    "menhirSdk.20260209": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08\"} \"dune\" {>= \"2.8.0\"}",
+      "install": null,
+      "name": "menhirSdk",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=e993231085db95ab011ffe0cd606d9dd",
+          "sha512=aafad186f328ae8dd4cc69af0f30c1a0b208cf5148a7a94c150099be03838503c5ec12918de26cd7f794b5a72f114bc1bae8d81058bd0ea10372a3b06818687e",
+          "sha256=69f0414b047d1d5b3507eb8277cd328a60d430bdff51de912b47adb2c25de4f3"
+        ],
+        "size": 1612814,
+        "url": "https://gitlab.inria.fr/fpottier/menhir/-/archive/20260209/archive.tar.gz"
+      },
+      "version": "20260209"
+    },
+    "num.1.6": {
+      "build": "[\n  make\n  \"PROFILE=release\"\n  \"opam-legacy\" {!ocaml:preinstalled & ocaml:version < \"5.0.0~~\"}\n  \"opam-modern\" {ocaml:preinstalled | ocaml:version >= \"5.0.0~~\"}\n]\n[make \"test\"] {with-test}",
+      "depends": [
+        "ocaml"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.06.0\"}",
+      "install": null,
+      "name": "num",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=b5cce325449aac746d5ca963d84688a627cca5b38d41e636cf71c68b60495b3e",
+          "sha512=5cb32dfa9a9f0ad375bfd89079e9b1422979f3c089f61ef2300ad9cc64fb1fc25ed1f86b0267eb017f12ae41a574a959df5bfa39ab22c2be2f1ac84c3c671bdf"
+        ],
+        "size": 67748,
+        "url": "https://github.com/ocaml/num/archive/refs/tags/v1.6.tar.gz"
+      },
+      "version": "1.6"
+    },
+    "ocaml-base-compiler.4.14.3": {
+      "build": "[\n  \"./configure\"\n  \"--host=x86_64-pc-windows\" {system-msvc:installed & arch-x86_64:installed}\n  \"--host=x86_64-w64-mingw32\"\n    {os-distribution = \"cygwin\" & system-mingw:installed &\n     arch-x86_64:installed}\n  \"--host=i686-pc-windows\" {system-msvc:installed & arch-x86_32:installed}\n  \"--host=i686-w64-mingw32\"\n    {os-distribution = \"cygwin\" & system-mingw:installed &\n     arch-x86_32:installed}\n  \"--prefix=%{prefix}%\"\n  \"--docdir=%{doc}%/ocaml\"\n  \"--with-flexdll=%{flexdll:share}%\" {os = \"win32\" & flexdll:installed}\n  \"-C\"\n  \"CC=cc\" {os = \"openbsd\" | os = \"macos\"}\n  \"ASPP=cc -c\" {os = \"openbsd\" | os = \"macos\"}\n]\n[make \"-j%{jobs}%\"]",
+      "depends": [
+        "ocaml",
+        "base-unix",
+        "base-bigarray",
+        "base-threads",
+        "arch-x86_64",
+        "system-mingw",
+        "ocaml-options-vanilla",
+        "flexdll"
+      ],
+      "depends_raw": "\"ocaml\" {= \"4.14.3\" & post}\n\"base-unix\" {post}\n\"base-bigarray\" {post}\n\"base-threads\" {post}\n((\"arch-x86_64\" {os = \"win32\" & arch = \"x86_64\"} &\n  (\"system-mingw\" | \"system-msvc\")) |\n (\"arch-x86_32\" {os = \"win32\"} & (\"system-mingw\" | \"system-msvc\")) |\n \"base-unix\" {os != \"win32\" & post})\n\"ocaml-options-vanilla\" {post}\n\"flexdll\" {>= \"0.36\" & os = \"win32\"}",
+      "install": "make \"install\"",
+      "name": "ocaml-base-compiler",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=e510689183b2d62b0a7513ea7e47be80ddb9173377a2df436dbc1ca927a64689"
+        ],
+        "size": 5513909,
+        "url": "https://github.com/ocaml/ocaml/archive/4.14.3.tar.gz"
+      },
+      "version": "4.14.3"
+    },
+    "ocaml-compiler-libs.v0.12.4": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "ocaml"
+      ],
+      "depends_raw": "\"dune\" {>= \"2.8\"} \"ocaml\" {>= \"4.04.1\" & < \"5.2.0\"} \"odoc\" {with-doc}",
+      "install": null,
+      "name": "ocaml-compiler-libs",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=4ec9c9ec35cc45c18c7a143761154ef1d7663036a29297f80381f47981a07760",
+          "sha512=978dba8dfa61f98fa24fda7a9c26c2e837081f37d1685fe636dc19cfc3278a940cf01a10293504b185c406706bc1008bc54313d50f023bcdea6d5ac6c0788b35"
+        ],
+        "size": 5160,
+        "url": "https://github.com/janestreet/ocaml-compiler-libs/releases/download/v0.12.4/ocaml-compiler-libs-v0.12.4.tbz"
+      },
+      "version": "v0.12.4"
+    },
+    "ocaml-config.2": {
+      "build": null,
+      "depends": [
+        "ocaml-base-compiler"
+      ],
+      "depends_raw": "\"ocaml-base-compiler\" {>= \"4.12.0~\"} | \"ocaml-variants\" {>= \"4.12.0~\"} |\n\"ocaml-system\" {>= \"4.12.0~\"}",
+      "install": null,
+      "name": "ocaml-config",
+      "source": null,
+      "version": "2"
+    },
+    "ocaml-config.3": {
+      "build": null,
+      "depends": [
+        "ocaml-base-compiler"
+      ],
+      "depends_raw": "\"ocaml-base-compiler\" {>= \"5.0.0~\" | os = \"win32\"} |\n\"ocaml-variants\" {>= \"5.0.0~\" | os = \"win32\"} |\n\"ocaml-system\" {>= \"5.0.0~\" | os = \"win32\"} |\n\"dkml-base-compiler\" {>= \"4.12.0~\"}",
+      "install": null,
+      "name": "ocaml-config",
+      "source": null,
+      "version": "3"
+    },
+    "ocaml-env-mingw32.1": {
+      "build": null,
+      "depends": [
+        "host-system-mingw",
+        "host-arch-x86_32",
+        "conf-mingw-w64-gcc-i686"
+      ],
+      "depends_raw": "\"host-system-mingw\"\n\"host-arch-x86_32\"\n\"conf-mingw-w64-gcc-i686\"\n\"mingw-w64-shims\" {os-distribution = \"cygwin\"}",
+      "install": null,
+      "name": "ocaml-env-mingw32",
+      "source": null,
+      "version": "1"
+    },
+    "ocaml-env-mingw64.1": {
+      "build": null,
+      "depends": [
+        "host-system-mingw",
+        "host-arch-x86_64",
+        "conf-mingw-w64-gcc-x86_64"
+      ],
+      "depends_raw": "\"host-system-mingw\"\n\"host-arch-x86_64\"\n\"conf-mingw-w64-gcc-x86_64\"\n\"mingw-w64-shims\" {os-distribution = \"cygwin\"}",
+      "install": null,
+      "name": "ocaml-env-mingw64",
+      "source": null,
+      "version": "1"
+    },
+    "ocaml-options-vanilla.1": {
+      "build": null,
+      "depends": [
+        "ocaml-base-compiler"
+      ],
+      "depends_raw": "\"ocaml-base-compiler\" {post} | \"ocaml-system\" {post} |\n\"ocaml-variants\" {post & >= \"4.12.0~\"}",
+      "install": null,
+      "name": "ocaml-options-vanilla",
+      "source": null,
+      "version": "1"
+    },
+    "ocaml-syntax-shims.1.0.0": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "ocaml"
+      ],
+      "depends_raw": "\"dune\" {>= \"2.0\"} \"ocaml\" {>= \"4.02.3\"}",
+      "install": null,
+      "name": "ocaml-syntax-shims",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=89b2e193e90a0c168b6ec5ddf6fef09033681bdcb64e11913c97440a2722e8c8",
+          "sha512=75c4c6b0bfa1267a8a49a82ba494d08cf0823fc8350863d6d3d4971528cb09e5a2a29e2981d04c75e76ad0f49360b05a432c9efeff9a4fbc1ec6b28960399852"
+        ],
+        "size": 5435,
+        "url": "https://github.com/ocaml-ppx/ocaml-syntax-shims/releases/download/1.0.0/ocaml-syntax-shims-1.0.0.tbz"
+      },
+      "version": "1.0.0"
+    },
+    "ocaml.4.14.3": {
+      "build": "\"ocaml\" \"%{ocaml-config:share}%/gen_ocaml_config.ml\" _:version _:name",
+      "depends": [
+        "ocaml-config",
+        "ocaml-base-compiler",
+        "ocaml-env-mingw64",
+        "ocaml-env-mingw32"
+      ],
+      "depends_raw": "\"ocaml-config\" {>= \"2\"}\n\"ocaml-base-compiler\" {>= \"4.14.3~\" & < \"4.14.4~\"} |\n\"ocaml-variants\" {>= \"4.14.3~\" & < \"4.14.4~\"} |\n\"ocaml-system\" {>= \"4.14.3\" & < \"4.14.4~\"} |\n\"dkml-base-compiler\" {>= \"4.14.3~\" & < \"4.14.4~\"}\n(\"ocaml-env-mingw64\" {os = \"win32\"} | \"ocaml-env-mingw32\" {os = \"win32\"} |\n \"ocaml-env-msvc64\" {os = \"win32\"} |\n \"ocaml-env-msvc32\" {os = \"win32\"})",
+      "install": null,
+      "name": "ocaml",
+      "source": null,
+      "version": "4.14.3"
+    },
+    "ocamlbuild.0.16.1": {
+      "build": "[\n  make\n  \"-f\"\n  \"configure.make\"\n  \"all\"\n  \"OCAMLBUILD_PREFIX=%{prefix}%\"\n  \"OCAMLBUILD_BINDIR=%{bin}%\"\n  \"OCAMLBUILD_LIBDIR=%{lib}%\"\n  \"OCAMLBUILD_MANDIR=%{man}%\"\n  \"OCAML_NATIVE=%{ocaml:native}%\"\n  \"OCAML_NATIVE_TOOLS=%{ocaml:native}%\"\n]\n[make \"check-if-preinstalled\" \"all\" \"opam-install\"]",
+      "depends": [
+        "ocaml"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08\"} \"ocamlfind\" {with-test} \"menhirLib\" {with-test}",
+      "install": null,
+      "name": "ocamlbuild",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha512=e918b9a0081f271e507c7a4f4d5d5a7cdf818ca51c52acec1bac85ddad5f6cad078cb3c568252fbcf5401c2d75323ed8f50fdd881bda1c9632840320408393ae",
+          "sha256=2ba6857f2991b7f69368e8db818b163d31cf5a367f15f5953bf8f01a77b3d4fc"
+        ],
+        "size": 202416,
+        "url": "https://github.com/ocaml/ocamlbuild/archive/refs/tags/0.16.1.tar.gz"
+      },
+      "version": "0.16.1"
+    },
+    "ocamlfind.1.9.8": {
+      "build": "[\n  \"./configure\"\n  \"-bindir\"\n  bin\n  \"-sitelib\"\n  lib\n  \"-mandir\"\n  man\n  \"-config\"\n  \"%{lib}%/findlib.conf\"\n  \"-no-custom\"\n  \"-no-camlp4\" {!ocaml:preinstalled & ocaml:version >= \"4.02.0\"}\n  \"-no-topfind\" {ocaml:preinstalled}\n]\n[make \"all\"]\n[make \"opt\"] {ocaml:native}",
+      "depends": [
+        "ocaml"
+      ],
+      "depends_raw": "\"ocaml\"\n  {>= \"3.08.0\" & (os != \"cygwin\" & os-distribution != \"msys2\" | < \"5.0\") &\n   < \"5.5.0~\"}",
+      "install": "[make \"install\"]\n[\"install\" \"-m\" \"0755\" \"ocaml-stub\" \"%{bin}%/ocaml\"] {ocaml:preinstalled}",
+      "name": "ocamlfind",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=ca770e5806032a96131b670f6e07f146",
+          "sha512=8967986de2ab4ec5993f437b0a4206742adf37aa7a292a3bba0a04438d78539b84d001191e60b2d5bde98a695b38cba2593b7051f7749adbdb964a0df3c4b661",
+          "sha256=d6899935ccabf67f067a9af3f3f88d94e310075d13c648fa03ff498769ce039d"
+        ],
+        "size": 169953,
+        "url": "https://github.com/ocaml/ocamlfind/archive/refs/tags/findlib-1.9.8.tar.gz"
+      },
+      "version": "1.9.8"
+    },
+    "ocplib-endian.1.2": {
+      "build": "\"dune\"\n\"build\"\n\"-p\"\nname\n\"-j\"\njobs\n\"@install\"\n\"@runtest\" {with-test}\n\"@doc\" {with-doc}",
+      "depends": [
+        "base-bytes",
+        "ocaml",
+        "cppo",
+        "dune"
+      ],
+      "depends_raw": "\"base-bytes\"\n\"ocaml\" {>= \"4.03.0\"}\n\"cppo\" {>= \"1.1.0\" & build}\n\"dune\" {>= \"1.0\"}",
+      "install": null,
+      "name": "ocplib-endian",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=8d5492eeb7c6815ade72a7415ea30949",
+          "sha512=2e70be5f3d6e377485c60664a0e235c3b9b24a8d6b6a03895d092c6e40d53810bfe1f292ee69e5181ce6daa8a582bfe3d59f3af889f417134f658812be5b8b85",
+          "sha256=97ae74e8aeead46a0475df14af637ce78e2372c07258619ad8967506f2d4b320"
+        ],
+        "size": 18061,
+        "url": "https://github.com/OCamlPro/ocplib-endian/archive/refs/tags/1.2.tar.gz"
+      },
+      "version": "1.2"
+    },
+    "parsexp.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "sexplib0",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"} \"sexplib0\" {>= \"v0.16\" & < \"v0.17\"} \"dune\" {>= \"2.0.0\"}",
+      "install": null,
+      "name": "parsexp",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=b6e2572c8e6191a85cb8f9c3276ed87fe00522c81ba7a268179fb08185e55e12"
+        ],
+        "size": 56796,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/parsexp-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "path_glob.0.3": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "ocaml",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.03\"} \"dune\" {>= \"2.7\"} \"odoc\" {with-doc}",
+      "install": null,
+      "name": "path_glob",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=332dae23b700fa050d1fd6e4f3d2e24b8dd1db2c8ea4f76c54e2e54851c9d226",
+          "sha512=205b0bbdf0d36b21e978603e4df264a0b185f3c1e3a20764fb254368977977d076a5b9c53b88110b721651d43a782e45742b14891412460101fb5fa8a5986173"
+        ],
+        "size": 18313,
+        "url": "https://gasche.gitlab.io/path_glob/releases/path_glob-0.3.tgz"
+      },
+      "version": "0.3"
+    },
+    "ppx_assert.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "ppx_cold",
+        "ppx_compare",
+        "ppx_here",
+        "ppx_sexp_conv",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_cold\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_compare\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_here\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_sexp_conv\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\"}",
+      "install": null,
+      "name": "ppx_assert",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=57dc6e241827eb1d5112c958f2f682ddd0addf5a8e9d589f5361ec2669883fd5"
+        ],
+        "size": 7342,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_assert-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_base.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "ppx_cold",
+        "ppx_compare",
+        "ppx_enumerate",
+        "ppx_globalize",
+        "ppx_hash",
+        "ppx_sexp_conv",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"ppx_cold\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_compare\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_enumerate\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_globalize\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_hash\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_sexp_conv\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\"}",
+      "install": null,
+      "name": "ppx_base",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=64835763153d3262a2fa56cf307a351ebfd10cedf504c488ab3bb93f3d9569a3"
+        ],
+        "size": 2928,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_base-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_cold.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\"}",
+      "install": null,
+      "name": "ppx_cold",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=803bdb583b501aa246d8ae34be0c16b892d8ae96852bb593f3e355232e6aa4da"
+        ],
+        "size": 3749,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_cold-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_compare.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\"}",
+      "install": null,
+      "name": "ppx_compare",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=7ac1dd852e62de6c4b6a879b8bd962c0167db822c39e8c972c8a6af4c48f26aa"
+        ],
+        "size": 13953,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_compare-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_derivers.1.2.1": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" \"dune\"",
+      "install": null,
+      "name": "ppx_derivers",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=b6595ee187dea792b31fc54a0e1524ab1e48bc6068d3066c45215a138cc73b95",
+          "md5=5dc2bf130c1db3c731fe0fffc5648b41"
+        ],
+        "size": 2530,
+        "url": "https://github.com/ocaml-ppx/ppx_derivers/archive/1.2.1.tar.gz"
+      },
+      "version": "1.2.1"
+    },
+    "ppx_deriving.6.0.3": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\"dune\" \"build\" \"-p\" name \"-j\" jobs]\n[\"dune\" \"runtest\" \"-p\" name \"-j\" jobs] {with-test}\n[\"dune\" \"build\" \"@doc\" \"-p\" name \"-j\" jobs] {with-doc}",
+      "depends": [
+        "ocaml",
+        "dune",
+        "cppo",
+        "ocamlfind",
+        "ppx_derivers",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.05.0\" & < \"5.4\"}\n\"dune\" {>= \"1.6.3\"}\n\"cppo\" {>= \"1.1.0\" & build}\n\"ocamlfind\"\n\"ppx_derivers\"\n\"ppxlib\" {>= \"0.32.0\" & < \"0.36.0\"}\n\"ounit2\" {with-test}",
+      "install": null,
+      "name": "ppx_deriving",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=374aa97b32c5e01c09a97810a48bfa218c213b5b649e4452101455ac19c94a6d",
+          "sha512=971443a5df0acbdad577360deed8c9af137695bec6d826ef517a382941371f3546aef53456dda7c89d0ed30fefadf45d5dae2a8b1940a75aee7f7382c68cedb0"
+        ],
+        "size": 42216,
+        "url": "https://github.com/ocaml-ppx/ppx_deriving/releases/download/v6.0.3/ppx_deriving-6.0.3.tbz"
+      },
+      "version": "6.0.3"
+    },
+    "ppx_deriving_yojson.3.9.1": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\"dune\" \"build\" \"-p\" name \"-j\" jobs]\n[\"dune\" \"runtest\" \"-p\" name \"-j\" jobs] {with-test}",
+      "depends": [
+        "ocaml",
+        "dune",
+        "yojson",
+        "ppx_deriving",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.05.0\"}\n\"dune\" {>= \"1.0\"}\n\"yojson\" {>= \"1.6.0\"}\n\"yojson\" {with-test & < \"3\"}\n\"ppx_deriving\" {>= \"5.1\"}\n\"ppxlib\" {>= \"0.30.0\" & < \"0.36.0\"}\n\"ounit2\" {with-test}",
+      "install": null,
+      "name": "ppx_deriving_yojson",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=6a3ef7c7bb381f57448853f2a6d2287cf623628162a979587d1e8f7502114f4d",
+          "sha512=df919be7c023cb9ff1b832de333f8d158e88746b4cc33ea5dcf511c64aba186628015b6ca29a0310642531e0640d79834d64b99d542a624168154a11736489a0"
+        ],
+        "size": 20091,
+        "url": "https://github.com/ocaml-ppx/ppx_deriving_yojson/releases/download/v3.9.1/ppx_deriving_yojson-3.9.1.tbz"
+      },
+      "version": "3.9.1"
+    },
+    "ppx_enumerate.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\"}",
+      "install": null,
+      "name": "ppx_enumerate",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=2832635d6d9ac4c63d48ed51d72745cd8a548e226a6110909d5a412d40ef9953"
+        ],
+        "size": 9339,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_enumerate-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_expect.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "ppx_here",
+        "ppx_inline_test",
+        "stdio",
+        "dune",
+        "ppxlib",
+        "re"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_here\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_inline_test\" {>= \"v0.16\" & < \"v0.17\"}\n\"stdio\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\" & < \"0.36.0\"}\n\"re\" {>= \"1.8.0\"}",
+      "install": null,
+      "name": "ppx_expect",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=e0795a0ae2d576758aaaa685440951b28fe75d072d88f5c6bf415fb1a44e423c"
+        ],
+        "size": 48328,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_expect-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_expect.v0.16.2": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "ppx_here",
+        "ppx_inline_test",
+        "stdio",
+        "dune",
+        "ppxlib",
+        "re"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_here\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_inline_test\" {>= \"v0.16\" & < \"v0.17\"}\n\"stdio\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\"}\n\"re\" {>= \"1.8.0\"}",
+      "install": null,
+      "name": "ppx_expect",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=99759b6592f5f3e6207af78884b1f3e5",
+          "sha512=1f1adf2bea04da27e6a2b1b3d2fe07773aed7043f83008018e724fc2c0334ac0e3c962f43fca53394e7954f40083539ad5108ac5aa945d2d6b65f99c7a4ee513",
+          "sha256=1fc15e3842d7544e35a54a902520b146ef299cfee8956db4c300dadbfa71c706"
+        ],
+        "size": 48495,
+        "url": "https://github.com/janestreet/ppx_expect/archive/refs/tags/v0.16.2.tar.gz"
+      },
+      "version": "v0.16.2"
+    },
+    "ppx_globalize.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\" & < \"0.36.0\"}",
+      "install": null,
+      "name": "ppx_globalize",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=9068d7b4b765112974b17dd354cadf007f044afb11d2f99cd45b2e3b99ab491b"
+        ],
+        "size": 8266,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_globalize-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_hash.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "ppx_compare",
+        "ppx_sexp_conv",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_compare\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_sexp_conv\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\"}",
+      "install": null,
+      "name": "ppx_hash",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=9b012546b7b9278bfd536f802fb6da88a11ebb5340d8aa47e9bf49acbf13b6e5"
+        ],
+        "size": 28570,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_hash-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_here.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\"}",
+      "install": null,
+      "name": "ppx_here",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=278198b92500c306fab3411e3dede264d678f203eb3295dd8dd79b70ed9273f0"
+        ],
+        "size": 4964,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_here-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_inline_test.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "time_now",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"time_now\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\" & < \"0.36.0\"}",
+      "install": null,
+      "name": "ppx_inline_test",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=216462f8fe988587d1e90f4a10aeb38664facb6eaeb3df60a32e9fb1a6bfbc67"
+        ],
+        "size": 21826,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_inline_test-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_inline_test.v0.16.1": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "time_now",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"time_now\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"3.11.1\"}\n\"ppxlib\" {>= \"0.28.0\" & < \"0.36.0\"}",
+      "install": null,
+      "name": "ppx_inline_test",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=470acc022eb7015862307dad8fe9bcba",
+          "sha512=f82d6d9fe6d84b837d69eb35cc92e2a0b6d0802079437e291aa350b89af1df54a996d6c7843019d488a3afe1e635da070f7ca80595dfdfd8257b2d0722725bf9",
+          "sha256=ea4e61e50529d76774904752f642e18eaf21dfe11844a084b133ccbc41e4295d"
+        ],
+        "size": 21965,
+        "url": "https://github.com/janestreet/ppx_inline_test/archive/refs/tags/v0.16.1.tar.gz"
+      },
+      "version": "v0.16.1"
+    },
+    "ppx_optcomp.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "stdio",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"stdio\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\" & < \"0.36.0\"}",
+      "install": null,
+      "name": "ppx_optcomp",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=99b209084a5375dafce4c6b128979661ab2ab6bf898a6872d596e65ded590ba2"
+        ],
+        "size": 16720,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_optcomp-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppx_sexp_conv.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "sexplib0",
+        "dune",
+        "ppxlib"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"sexplib0\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"ppxlib\" {>= \"0.28.0\" & < \"0.36.0\"}",
+      "install": null,
+      "name": "ppx_sexp_conv",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=41bcb7a3b33bdf50428408bfaf1dbcede528a488ac8c436ce710681bcd91200d"
+        ],
+        "size": 66899,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/ppx_sexp_conv-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "ppxlib.0.35.0": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "ocaml",
+        "ocaml-compiler-libs",
+        "ppx_derivers",
+        "sexplib0",
+        "stdlib-shims"
+      ],
+      "depends_raw": "\"dune\" {>= \"3.8\"}\n\"ocaml\" {>= \"4.08.0\" & < \"5.4.0\"}\n\"ocaml-compiler-libs\" {>= \"v0.11.0\"}\n\"ppx_derivers\" {>= \"1.0\"}\n\"sexplib0\" {>= \"v0.12\"}\n\"sexplib0\" {with-test & >= \"v0.15\"}\n\"stdlib-shims\"\n\"ocamlfind\" {with-test}\n\"re\" {with-test & >= \"1.9.0\"}\n\"cinaps\" {with-test & >= \"v0.12.1\"}\n\"ocamlformat\" {with-dev-setup & = \"0.26.2\"}\n\"odoc\" {with-doc}",
+      "install": null,
+      "name": "ppxlib",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=d9d959fc9f84260487e45684dc741898a92fc5506b61a7f5cac65d21832db925",
+          "sha512=e428b1e3b89261c7efdaa18016264d1afbf067cb9b0d41124b04796c2487ac7ca8ee9a24a60d56f20d1774cb44aaa9ecf1512f17455812ba8d62d4ef93616ee7"
+        ],
+        "size": 390303,
+        "url": "https://github.com/ocaml-ppx/ppxlib/releases/download/0.35.0/ppxlib-0.35.0.tbz"
+      },
+      "version": "0.35.0"
+    },
+    "psq.0.2.1": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\"dune\" \"build\" \"-p\" name \"-j\" jobs]\n[\"dune\" \"runtest\" \"-p\" name] {with-test & ocaml:version >= \"4.07.0\"}",
+      "depends": [
+        "ocaml",
+        "dune",
+        "seq"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.03.0\"}\n\"dune\" {>= \"1.7\"}\n\"seq\"\n\"qcheck-core\" {with-test}\n\"qcheck-alcotest\" {with-test}\n\"alcotest\" {with-test}",
+      "install": null,
+      "name": "psq",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=42005f533eabe74b1799ee32b8905654cd66a22bed4af2bd266b28d8462cd344",
+          "sha512=8a8dfe20dc77e1cf38a7b1a7fc76f815c71a4ffe04627151b855feaba8f1ae742594739d1b7a45580b5b24a2cd99b58516f6b5c8d858aa314201f4a6422101ee"
+        ],
+        "size": 11341,
+        "url": "https://github.com/pqwy/psq/releases/download/v0.2.1/psq-0.2.1.tbz"
+      },
+      "version": "0.2.1"
+    },
+    "re.1.14.0": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "ocaml"
+      ],
+      "depends_raw": "\"dune\" {>= \"3.17\"}\n\"ocaml\" {>= \"4.13.0\"}\n\"ppx_expect\" {with-test}\n\"ounit2\" {with-test}\n\"js_of_ocaml\" {with-test}\n\"conf-npm\" {with-test}\n\"odoc\" {with-doc}",
+      "install": null,
+      "name": "re",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "md5=03f4a83100cb9229a796b85c698076e1",
+          "sha512=cd2cc39f951ca6b7be631bbb5531ed13bc040e629842671bf6fef3911b20ef1653fa9a1f0aa23b094d252cffc9a9efe7ffca69e50d362ab935bc0cc447548124",
+          "sha256=e32eb4c6f319ff74241da9e1b00032f990241347271baf3adb468faaaa616147"
+        ],
+        "size": 110936,
+        "url": "https://github.com/ocaml/ocaml-re/archive/refs/tags/1.14.0.tar.gz"
+      },
+      "version": "1.14.0"
+    },
+    "react.1.2.2": {
+      "build": "\"ocaml\" \"pkg/pkg.ml\" \"build\" \"--dev-pkg\" \"%{dev}%\"",
+      "depends": [
+        "ocaml",
+        "ocamlfind",
+        "ocamlbuild",
+        "topkg"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08.0\"}\n\"ocamlfind\" {build}\n\"ocamlbuild\" {build}\n\"topkg\" {build & >= \"1.0.3\"}",
+      "install": null,
+      "name": "react",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha512=18cdd544d484222ba02db6bd9351571516532e7a1c107b59bbe39193837298f5c745eab6754f8bc6ff125b387be7018c6d6e6ac99f91925a5e4f53af688522b1",
+          "sha256=c4add315d6f1f153d115ee7ca8dd60c1265ff4d408c266125fcb5124fd228f99"
+        ],
+        "size": 40013,
+        "url": "https://erratique.ch/software/react/releases/react-1.2.2.tbz"
+      },
+      "version": "1.2.2"
+    },
+    "seq.base": {
+      "build": null,
+      "depends": [
+        "ocaml"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.07.0\"}",
+      "install": null,
+      "name": "seq",
+      "source": null,
+      "version": "base"
+    },
+    "sexplib.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "parsexp",
+        "sexplib0",
+        "dune",
+        "num"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"parsexp\" {>= \"v0.16\" & < \"v0.17\"}\n\"sexplib0\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}\n\"num\"",
+      "install": null,
+      "name": "sexplib",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=e564d5d1ca157314ba5fd64b4e89fa12c6cba8efee3becf6d09d7d9dda21ac5b"
+        ],
+        "size": 54920,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/sexplib-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "sexplib0.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08.0\"} \"dune\" {>= \"2.0.0\"}",
+      "install": null,
+      "name": "sexplib0",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=86dba26468194512f789f2fb709063515a9cb4e5c4461c021c239a369590701d"
+        ],
+        "size": 22101,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/sexplib0-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "stdio.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"} \"base\" {>= \"v0.16\" & < \"v0.17\"} \"dune\" {>= \"2.0.0\"}",
+      "install": null,
+      "name": "stdio",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=61f0b75950614ac5378c6ec0d822cce6463402d919d5810b736fc46522b3a73e"
+        ],
+        "size": 7779,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/stdio-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "stdlib-shims.0.3.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "dune",
+        "ocaml"
+      ],
+      "depends_raw": "\"dune\" \"ocaml\" {>= \"4.02.3\"}",
+      "install": null,
+      "name": "stdlib-shims",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=babf72d3917b86f707885f0c5528e36c63fccb698f4b46cf2bab5c7ccdd6d84a",
+          "sha512=1151d7edc8923516e9a36995a3f8938d323aaade759ad349ed15d6d8501db61ffbe63277e97c4d86149cf371306ac23df0f581ec7e02611f58335126e1870980"
+        ],
+        "size": 10163,
+        "url": "https://github.com/ocaml/stdlib-shims/releases/download/0.3.0/stdlib-shims-0.3.0.tbz"
+      },
+      "version": "0.3.0"
+    },
+    "system-mingw.1": {
+      "build": null,
+      "depends": [
+        "ocaml-base-compiler",
+        "ocaml-env-mingw32",
+        "ocaml-env-mingw64"
+      ],
+      "depends_raw": "(\"ocaml-base-compiler\" {post & >= \"4.13.0~\"} |\n \"ocaml-variants\" {post & >= \"4.13.0~\"})\n(\"ocaml-env-mingw32\" | \"ocaml-env-mingw64\")",
+      "install": null,
+      "name": "system-mingw",
+      "source": null,
+      "version": "1"
+    },
+    "time_now.v0.16.0": {
+      "build": "\"dune\" \"build\" \"-p\" name \"-j\" jobs",
+      "depends": [
+        "ocaml",
+        "base",
+        "jane-street-headers",
+        "jst-config",
+        "ppx_base",
+        "ppx_optcomp",
+        "dune"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.14.0\"}\n\"base\" {>= \"v0.16\" & < \"v0.17\"}\n\"jane-street-headers\" {>= \"v0.16\" & < \"v0.17\"}\n\"jst-config\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_base\" {>= \"v0.16\" & < \"v0.17\"}\n\"ppx_optcomp\" {>= \"v0.16\" & < \"v0.17\"}\n\"dune\" {>= \"2.0.0\"}",
+      "install": null,
+      "name": "time_now",
+      "source": {
+        "archive": "tgz",
+        "checksums": [
+          "sha256=5fa084aadee6aaedbb8976e4a2bc0c1dfe69eecdd0576ff901f21eedd46dc3a1"
+        ],
+        "size": 3668,
+        "url": "https://ocaml.janestreet.com/ocaml-core/v0.16/files/time_now-v0.16.0.tar.gz"
+      },
+      "version": "v0.16.0"
+    },
+    "topkg.1.1.1": {
+      "build": "\"ocaml\" \"pkg/pkg.ml\" \"build\" \"--pkg-name\" name \"--dev-pkg\" \"%{dev}%\"",
+      "depends": [
+        "ocaml",
+        "ocamlfind",
+        "ocamlbuild"
+      ],
+      "depends_raw": "\"ocaml\" {>= \"4.08.0\"} \"ocamlfind\" {build & >= \"1.6.1\"} \"ocamlbuild\"",
+      "install": null,
+      "name": "topkg",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha512=c36c549a362ddf5b7fe3f6ff91c79b7ab531c43633bb9737576370bcbd69db7e1625d247c278a869b503d45a175e9753231ccf595e5bfa4e3b7e2602ac3d3b42",
+          "sha256=20da062dc9cea21b5c728f22c986ed3e3d57310e643260160a802d559712f6fc"
+        ],
+        "size": 96571,
+        "url": "https://erratique.ch/software/topkg/releases/topkg-1.1.1.tbz"
+      },
+      "version": "1.1.1"
+    },
+    "yojson.3.0.0": {
+      "build": "[\"dune\" \"subst\"] {dev}\n[\n  \"dune\"\n  \"build\"\n  \"-p\"\n  name\n  \"-j\"\n  jobs\n  \"@install\"\n  \"@runtest\" {with-test}\n  \"@doc\" {with-doc}\n]",
+      "depends": [
+        "dune",
+        "ocaml"
+      ],
+      "depends_raw": "\"dune\" {>= \"2.7\"}\n\"ocaml\" {>= \"4.08\"}\n\"alcotest\" {with-test & >= \"0.8.5\"}\n\"odoc\" {with-doc}",
+      "install": null,
+      "name": "yojson",
+      "source": {
+        "archive": "tbz",
+        "checksums": [
+          "sha256=99414da7609b92a02474ef4b49ecda15edc8cbba5229341b124e7e4695c39610",
+          "sha512=896d0ea829a36ccadba6628800369c1a3ab9e7c64dbda8b76331889c9db481cd64e137f467481ae80a8dd5fca45d748bfa71f58641806cc1bb1a007f8291789f"
+        ],
+        "size": 44166,
+        "url": "https://github.com/ocaml-community/yojson/releases/download/3.0.0/yojson-3.0.0.tbz"
+      },
+      "version": "3.0.0"
+    }
+  },
+  "schema_version": {
+    "major": 1,
+    "minor": 0
+  },
+  "slots": {
+    "Release.Darwin_arm64": {
+      "opam_vars": {
+        "arch": "arm64",
+        "os": "macos"
+      },
+      "solution": [
+        "angstrom-lwt-unix.0.16.1",
+        "angstrom.0.16.1",
+        "base-bigarray.base",
+        "base-bytes.base",
+        "base-threads.base",
+        "base-unix.base",
+        "base.v0.16.5",
+        "bigstringaf.0.10.0",
+        "cmdliner.2.1.1",
+        "cppo.1.8.0",
+        "csexp.1.5.2",
+        "dap.1.0.6",
+        "dune-configurator.3.23.1",
+        "dune.3.23.1",
+        "earlybird.1.3.6",
+        "fmt.0.11.0",
+        "iter.1.9",
+        "jane-street-headers.v0.16.0",
+        "jst-config.v0.16.0",
+        "logs.0.10.0",
+        "lru.0.3.1",
+        "lwt.5.10.1",
+        "lwt_ppx.5.9.1",
+        "lwt_react.1.2.0",
+        "menhir.20260209",
+        "menhirCST.20260209",
+        "menhirGLR.20260209",
+        "menhirLib.20260209",
+        "menhirSdk.20260209",
+        "num.1.6",
+        "ocaml-base-compiler.4.14.3",
+        "ocaml-compiler-libs.v0.12.4",
+        "ocaml-config.2",
+        "ocaml-options-vanilla.1",
+        "ocaml-syntax-shims.1.0.0",
+        "ocaml.4.14.3",
+        "ocamlbuild.0.16.1",
+        "ocamlfind.1.9.8",
+        "ocplib-endian.1.2",
+        "parsexp.v0.16.0",
+        "path_glob.0.3",
+        "ppx_assert.v0.16.0",
+        "ppx_base.v0.16.0",
+        "ppx_cold.v0.16.0",
+        "ppx_compare.v0.16.0",
+        "ppx_derivers.1.2.1",
+        "ppx_deriving.6.0.3",
+        "ppx_deriving_yojson.3.9.1",
+        "ppx_enumerate.v0.16.0",
+        "ppx_expect.v0.16.2",
+        "ppx_globalize.v0.16.0",
+        "ppx_hash.v0.16.0",
+        "ppx_here.v0.16.0",
+        "ppx_inline_test.v0.16.1",
+        "ppx_optcomp.v0.16.0",
+        "ppx_sexp_conv.v0.16.0",
+        "ppxlib.0.35.0",
+        "psq.0.2.1",
+        "re.1.14.0",
+        "react.1.2.2",
+        "seq.base",
+        "sexplib.v0.16.0",
+        "sexplib0.v0.16.0",
+        "stdio.v0.16.0",
+        "stdlib-shims.0.3.0",
+        "time_now.v0.16.0",
+        "topkg.1.1.1",
+        "yojson.3.0.0"
+      ]
+    },
+    "Release.Darwin_x86_64": {
+      "opam_vars": {
+        "arch": "x86_64",
+        "os": "macos"
+      },
+      "solution": [
+        "angstrom-lwt-unix.0.16.1",
+        "angstrom.0.16.1",
+        "base-bigarray.base",
+        "base-bytes.base",
+        "base-threads.base",
+        "base-unix.base",
+        "base.v0.16.5",
+        "bigstringaf.0.10.0",
+        "cmdliner.2.1.1",
+        "cppo.1.8.0",
+        "csexp.1.5.2",
+        "dap.1.0.6",
+        "dune-configurator.3.23.1",
+        "dune.3.23.1",
+        "earlybird.1.3.6",
+        "fmt.0.11.0",
+        "iter.1.9",
+        "jane-street-headers.v0.16.0",
+        "jst-config.v0.16.0",
+        "logs.0.10.0",
+        "lru.0.3.1",
+        "lwt.5.10.1",
+        "lwt_ppx.5.9.1",
+        "lwt_react.1.2.0",
+        "menhir.20260209",
+        "menhirCST.20260209",
+        "menhirGLR.20260209",
+        "menhirLib.20260209",
+        "menhirSdk.20260209",
+        "num.1.6",
+        "ocaml-base-compiler.4.14.3",
+        "ocaml-compiler-libs.v0.12.4",
+        "ocaml-config.2",
+        "ocaml-options-vanilla.1",
+        "ocaml-syntax-shims.1.0.0",
+        "ocaml.4.14.3",
+        "ocamlbuild.0.16.1",
+        "ocamlfind.1.9.8",
+        "ocplib-endian.1.2",
+        "parsexp.v0.16.0",
+        "path_glob.0.3",
+        "ppx_assert.v0.16.0",
+        "ppx_base.v0.16.0",
+        "ppx_cold.v0.16.0",
+        "ppx_compare.v0.16.0",
+        "ppx_derivers.1.2.1",
+        "ppx_deriving.6.0.3",
+        "ppx_deriving_yojson.3.9.1",
+        "ppx_enumerate.v0.16.0",
+        "ppx_expect.v0.16.2",
+        "ppx_globalize.v0.16.0",
+        "ppx_hash.v0.16.0",
+        "ppx_here.v0.16.0",
+        "ppx_inline_test.v0.16.1",
+        "ppx_optcomp.v0.16.0",
+        "ppx_sexp_conv.v0.16.0",
+        "ppxlib.0.35.0",
+        "psq.0.2.1",
+        "re.1.14.0",
+        "react.1.2.2",
+        "seq.base",
+        "sexplib.v0.16.0",
+        "sexplib0.v0.16.0",
+        "stdio.v0.16.0",
+        "stdlib-shims.0.3.0",
+        "time_now.v0.16.0",
+        "topkg.1.1.1",
+        "yojson.3.0.0"
+      ]
+    },
+    "Release.Linux_arm64": {
+      "opam_vars": {
+        "arch": "arm64",
+        "os": "linux"
+      },
+      "solution": [
+        "angstrom-lwt-unix.0.16.1",
+        "angstrom.0.16.1",
+        "base-bigarray.base",
+        "base-bytes.base",
+        "base-threads.base",
+        "base-unix.base",
+        "base.v0.16.5",
+        "bigstringaf.0.10.0",
+        "cmdliner.2.1.1",
+        "cppo.1.8.0",
+        "csexp.1.5.2",
+        "dap.1.0.6",
+        "dune-configurator.3.23.1",
+        "dune.3.23.1",
+        "earlybird.1.3.6",
+        "fmt.0.11.0",
+        "iter.1.9",
+        "jane-street-headers.v0.16.0",
+        "jst-config.v0.16.0",
+        "logs.0.10.0",
+        "lru.0.3.1",
+        "lwt.5.10.1",
+        "lwt_ppx.5.9.1",
+        "lwt_react.1.2.0",
+        "menhir.20260209",
+        "menhirCST.20260209",
+        "menhirGLR.20260209",
+        "menhirLib.20260209",
+        "menhirSdk.20260209",
+        "num.1.6",
+        "ocaml-base-compiler.4.14.3",
+        "ocaml-compiler-libs.v0.12.4",
+        "ocaml-config.2",
+        "ocaml-options-vanilla.1",
+        "ocaml-syntax-shims.1.0.0",
+        "ocaml.4.14.3",
+        "ocamlbuild.0.16.1",
+        "ocamlfind.1.9.8",
+        "ocplib-endian.1.2",
+        "parsexp.v0.16.0",
+        "path_glob.0.3",
+        "ppx_assert.v0.16.0",
+        "ppx_base.v0.16.0",
+        "ppx_cold.v0.16.0",
+        "ppx_compare.v0.16.0",
+        "ppx_derivers.1.2.1",
+        "ppx_deriving.6.0.3",
+        "ppx_deriving_yojson.3.9.1",
+        "ppx_enumerate.v0.16.0",
+        "ppx_expect.v0.16.2",
+        "ppx_globalize.v0.16.0",
+        "ppx_hash.v0.16.0",
+        "ppx_here.v0.16.0",
+        "ppx_inline_test.v0.16.1",
+        "ppx_optcomp.v0.16.0",
+        "ppx_sexp_conv.v0.16.0",
+        "ppxlib.0.35.0",
+        "psq.0.2.1",
+        "re.1.14.0",
+        "react.1.2.2",
+        "seq.base",
+        "sexplib.v0.16.0",
+        "sexplib0.v0.16.0",
+        "stdio.v0.16.0",
+        "stdlib-shims.0.3.0",
+        "time_now.v0.16.0",
+        "topkg.1.1.1",
+        "yojson.3.0.0"
+      ]
+    },
+    "Release.Linux_x86": {
+      "opam_vars": {
+        "arch": "x86_32",
+        "os": "linux"
+      },
+      "solution": [
+        "angstrom-lwt-unix.0.16.1",
+        "angstrom.0.16.1",
+        "base-bigarray.base",
+        "base-bytes.base",
+        "base-threads.base",
+        "base-unix.base",
+        "base.v0.16.5",
+        "bigstringaf.0.10.0",
+        "cmdliner.2.1.1",
+        "cppo.1.8.0",
+        "csexp.1.5.2",
+        "dap.1.0.6",
+        "dune-configurator.3.23.1",
+        "dune.3.23.1",
+        "earlybird.1.3.6",
+        "fmt.0.11.0",
+        "iter.1.9",
+        "jane-street-headers.v0.16.0",
+        "jst-config.v0.16.0",
+        "logs.0.10.0",
+        "lru.0.3.1",
+        "lwt.5.10.1",
+        "lwt_ppx.5.9.1",
+        "lwt_react.1.2.0",
+        "menhir.20260209",
+        "menhirCST.20260209",
+        "menhirGLR.20260209",
+        "menhirLib.20260209",
+        "menhirSdk.20260209",
+        "num.1.6",
+        "ocaml-base-compiler.4.14.3",
+        "ocaml-compiler-libs.v0.12.4",
+        "ocaml-config.2",
+        "ocaml-options-vanilla.1",
+        "ocaml-syntax-shims.1.0.0",
+        "ocaml.4.14.3",
+        "ocamlbuild.0.16.1",
+        "ocamlfind.1.9.8",
+        "ocplib-endian.1.2",
+        "parsexp.v0.16.0",
+        "path_glob.0.3",
+        "ppx_assert.v0.16.0",
+        "ppx_base.v0.16.0",
+        "ppx_cold.v0.16.0",
+        "ppx_compare.v0.16.0",
+        "ppx_derivers.1.2.1",
+        "ppx_deriving.6.0.3",
+        "ppx_deriving_yojson.3.9.1",
+        "ppx_enumerate.v0.16.0",
+        "ppx_expect.v0.16.0",
+        "ppx_globalize.v0.16.0",
+        "ppx_hash.v0.16.0",
+        "ppx_here.v0.16.0",
+        "ppx_inline_test.v0.16.0",
+        "ppx_optcomp.v0.16.0",
+        "ppx_sexp_conv.v0.16.0",
+        "ppxlib.0.35.0",
+        "psq.0.2.1",
+        "re.1.14.0",
+        "react.1.2.2",
+        "seq.base",
+        "sexplib.v0.16.0",
+        "sexplib0.v0.16.0",
+        "stdio.v0.16.0",
+        "stdlib-shims.0.3.0",
+        "time_now.v0.16.0",
+        "topkg.1.1.1",
+        "yojson.3.0.0"
+      ]
+    },
+    "Release.Linux_x86_64": {
+      "opam_vars": {
+        "arch": "x86_64",
+        "os": "linux"
+      },
+      "solution": [
+        "angstrom-lwt-unix.0.16.1",
+        "angstrom.0.16.1",
+        "base-bigarray.base",
+        "base-bytes.base",
+        "base-threads.base",
+        "base-unix.base",
+        "base.v0.16.5",
+        "bigstringaf.0.10.0",
+        "cmdliner.2.1.1",
+        "cppo.1.8.0",
+        "csexp.1.5.2",
+        "dap.1.0.6",
+        "dune-configurator.3.23.1",
+        "dune.3.23.1",
+        "earlybird.1.3.6",
+        "fmt.0.11.0",
+        "iter.1.9",
+        "jane-street-headers.v0.16.0",
+        "jst-config.v0.16.0",
+        "logs.0.10.0",
+        "lru.0.3.1",
+        "lwt.5.10.1",
+        "lwt_ppx.5.9.1",
+        "lwt_react.1.2.0",
+        "menhir.20260209",
+        "menhirCST.20260209",
+        "menhirGLR.20260209",
+        "menhirLib.20260209",
+        "menhirSdk.20260209",
+        "num.1.6",
+        "ocaml-base-compiler.4.14.3",
+        "ocaml-compiler-libs.v0.12.4",
+        "ocaml-config.2",
+        "ocaml-options-vanilla.1",
+        "ocaml-syntax-shims.1.0.0",
+        "ocaml.4.14.3",
+        "ocamlbuild.0.16.1",
+        "ocamlfind.1.9.8",
+        "ocplib-endian.1.2",
+        "parsexp.v0.16.0",
+        "path_glob.0.3",
+        "ppx_assert.v0.16.0",
+        "ppx_base.v0.16.0",
+        "ppx_cold.v0.16.0",
+        "ppx_compare.v0.16.0",
+        "ppx_derivers.1.2.1",
+        "ppx_deriving.6.0.3",
+        "ppx_deriving_yojson.3.9.1",
+        "ppx_enumerate.v0.16.0",
+        "ppx_expect.v0.16.2",
+        "ppx_globalize.v0.16.0",
+        "ppx_hash.v0.16.0",
+        "ppx_here.v0.16.0",
+        "ppx_inline_test.v0.16.1",
+        "ppx_optcomp.v0.16.0",
+        "ppx_sexp_conv.v0.16.0",
+        "ppxlib.0.35.0",
+        "psq.0.2.1",
+        "re.1.14.0",
+        "react.1.2.2",
+        "seq.base",
+        "sexplib.v0.16.0",
+        "sexplib0.v0.16.0",
+        "stdio.v0.16.0",
+        "stdlib-shims.0.3.0",
+        "time_now.v0.16.0",
+        "topkg.1.1.1",
+        "yojson.3.0.0"
+      ]
+    },
+    "Release.Linux_x86_64_musl": {
+      "opam_vars": {
+        "arch": "x86_64",
+        "os": "linux"
+      },
+      "solution": [
+        "angstrom-lwt-unix.0.16.1",
+        "angstrom.0.16.1",
+        "base-bigarray.base",
+        "base-bytes.base",
+        "base-threads.base",
+        "base-unix.base",
+        "base.v0.16.5",
+        "bigstringaf.0.10.0",
+        "cmdliner.2.1.1",
+        "cppo.1.8.0",
+        "csexp.1.5.2",
+        "dap.1.0.6",
+        "dune-configurator.3.23.1",
+        "dune.3.23.1",
+        "earlybird.1.3.6",
+        "fmt.0.11.0",
+        "iter.1.9",
+        "jane-street-headers.v0.16.0",
+        "jst-config.v0.16.0",
+        "logs.0.10.0",
+        "lru.0.3.1",
+        "lwt.5.10.1",
+        "lwt_ppx.5.9.1",
+        "lwt_react.1.2.0",
+        "menhir.20260209",
+        "menhirCST.20260209",
+        "menhirGLR.20260209",
+        "menhirLib.20260209",
+        "menhirSdk.20260209",
+        "num.1.6",
+        "ocaml-base-compiler.4.14.3",
+        "ocaml-compiler-libs.v0.12.4",
+        "ocaml-config.2",
+        "ocaml-options-vanilla.1",
+        "ocaml-syntax-shims.1.0.0",
+        "ocaml.4.14.3",
+        "ocamlbuild.0.16.1",
+        "ocamlfind.1.9.8",
+        "ocplib-endian.1.2",
+        "parsexp.v0.16.0",
+        "path_glob.0.3",
+        "ppx_assert.v0.16.0",
+        "ppx_base.v0.16.0",
+        "ppx_cold.v0.16.0",
+        "ppx_compare.v0.16.0",
+        "ppx_derivers.1.2.1",
+        "ppx_deriving.6.0.3",
+        "ppx_deriving_yojson.3.9.1",
+        "ppx_enumerate.v0.16.0",
+        "ppx_expect.v0.16.2",
+        "ppx_globalize.v0.16.0",
+        "ppx_hash.v0.16.0",
+        "ppx_here.v0.16.0",
+        "ppx_inline_test.v0.16.1",
+        "ppx_optcomp.v0.16.0",
+        "ppx_sexp_conv.v0.16.0",
+        "ppxlib.0.35.0",
+        "psq.0.2.1",
+        "re.1.14.0",
+        "react.1.2.2",
+        "seq.base",
+        "sexplib.v0.16.0",
+        "sexplib0.v0.16.0",
+        "stdio.v0.16.0",
+        "stdlib-shims.0.3.0",
+        "time_now.v0.16.0",
+        "topkg.1.1.1",
+        "yojson.3.0.0"
+      ]
+    },
+    "Release.Windows_x86": {
+      "opam_vars": {
+        "arch": "x86_32",
+        "os": "win32"
+      },
+      "solution": [
+        "angstrom-lwt-unix.0.16.1",
+        "angstrom.0.16.1",
+        "base-bigarray.base",
+        "base-bytes.base",
+        "base-threads.base",
+        "base-unix.base",
+        "base.v0.16.5",
+        "bigstringaf.0.10.0",
+        "cmdliner.2.1.1",
+        "conf-mingw-w64-gcc-i686.1",
+        "cppo.1.8.0",
+        "csexp.1.5.2",
+        "dap.1.0.6",
+        "dune-configurator.3.23.1",
+        "dune.3.23.1",
+        "earlybird.1.3.6",
+        "flexdll.0.44",
+        "fmt.0.11.0",
+        "host-arch-x86_32.1",
+        "host-system-mingw.1",
+        "iter.1.9",
+        "jane-street-headers.v0.16.0",
+        "jst-config.v0.16.0",
+        "logs.0.10.0",
+        "lru.0.3.1",
+        "lwt.5.10.1",
+        "lwt_ppx.5.9.1",
+        "lwt_react.1.2.0",
+        "menhir.20260209",
+        "menhirCST.20260209",
+        "menhirGLR.20260209",
+        "menhirLib.20260209",
+        "menhirSdk.20260209",
+        "num.1.6",
+        "ocaml-base-compiler.4.14.3",
+        "ocaml-compiler-libs.v0.12.4",
+        "ocaml-config.3",
+        "ocaml-env-mingw32.1",
+        "ocaml-options-vanilla.1",
+        "ocaml-syntax-shims.1.0.0",
+        "ocaml.4.14.3",
+        "ocamlbuild.0.16.1",
+        "ocamlfind.1.9.8",
+        "ocplib-endian.1.2",
+        "parsexp.v0.16.0",
+        "path_glob.0.3",
+        "ppx_assert.v0.16.0",
+        "ppx_base.v0.16.0",
+        "ppx_cold.v0.16.0",
+        "ppx_compare.v0.16.0",
+        "ppx_derivers.1.2.1",
+        "ppx_deriving.6.0.3",
+        "ppx_deriving_yojson.3.9.1",
+        "ppx_enumerate.v0.16.0",
+        "ppx_expect.v0.16.0",
+        "ppx_globalize.v0.16.0",
+        "ppx_hash.v0.16.0",
+        "ppx_here.v0.16.0",
+        "ppx_inline_test.v0.16.0",
+        "ppx_optcomp.v0.16.0",
+        "ppx_sexp_conv.v0.16.0",
+        "ppxlib.0.35.0",
+        "psq.0.2.1",
+        "re.1.14.0",
+        "react.1.2.2",
+        "seq.base",
+        "sexplib.v0.16.0",
+        "sexplib0.v0.16.0",
+        "stdio.v0.16.0",
+        "stdlib-shims.0.3.0",
+        "system-mingw.1",
+        "time_now.v0.16.0",
+        "topkg.1.1.1",
+        "yojson.3.0.0"
+      ]
+    },
+    "Release.Windows_x86_64": {
+      "opam_vars": {
+        "arch": "x86_64",
+        "os": "win32"
+      },
+      "solution": [
+        "angstrom-lwt-unix.0.16.1",
+        "angstrom.0.16.1",
+        "arch-x86_64.1",
+        "base-bigarray.base",
+        "base-bytes.base",
+        "base-threads.base",
+        "base-unix.base",
+        "base.v0.16.5",
+        "bigstringaf.0.10.0",
+        "cmdliner.2.1.1",
+        "conf-mingw-w64-gcc-x86_64.1",
+        "cppo.1.8.0",
+        "csexp.1.5.2",
+        "dap.1.0.6",
+        "dune-configurator.3.23.1",
+        "dune.3.23.1",
+        "earlybird.1.3.6",
+        "flexdll.0.44",
+        "fmt.0.11.0",
+        "host-arch-x86_64.1",
+        "host-system-mingw.1",
+        "iter.1.9",
+        "jane-street-headers.v0.16.0",
+        "jst-config.v0.16.0",
+        "logs.0.10.0",
+        "lru.0.3.1",
+        "lwt.5.10.1",
+        "lwt_ppx.5.9.1",
+        "lwt_react.1.2.0",
+        "menhir.20260209",
+        "menhirCST.20260209",
+        "menhirGLR.20260209",
+        "menhirLib.20260209",
+        "menhirSdk.20260209",
+        "num.1.6",
+        "ocaml-base-compiler.4.14.3",
+        "ocaml-compiler-libs.v0.12.4",
+        "ocaml-config.3",
+        "ocaml-env-mingw64.1",
+        "ocaml-options-vanilla.1",
+        "ocaml-syntax-shims.1.0.0",
+        "ocaml.4.14.3",
+        "ocamlbuild.0.16.1",
+        "ocamlfind.1.9.8",
+        "ocplib-endian.1.2",
+        "parsexp.v0.16.0",
+        "path_glob.0.3",
+        "ppx_assert.v0.16.0",
+        "ppx_base.v0.16.0",
+        "ppx_cold.v0.16.0",
+        "ppx_compare.v0.16.0",
+        "ppx_derivers.1.2.1",
+        "ppx_deriving.6.0.3",
+        "ppx_deriving_yojson.3.9.1",
+        "ppx_enumerate.v0.16.0",
+        "ppx_expect.v0.16.2",
+        "ppx_globalize.v0.16.0",
+        "ppx_hash.v0.16.0",
+        "ppx_here.v0.16.0",
+        "ppx_inline_test.v0.16.1",
+        "ppx_optcomp.v0.16.0",
+        "ppx_sexp_conv.v0.16.0",
+        "ppxlib.0.35.0",
+        "psq.0.2.1",
+        "re.1.14.0",
+        "react.1.2.2",
+        "seq.base",
+        "sexplib.v0.16.0",
+        "sexplib0.v0.16.0",
+        "stdio.v0.16.0",
+        "stdlib-shims.0.3.0",
+        "system-mingw.1",
+        "time_now.v0.16.0",
+        "topkg.1.1.1",
+        "yojson.3.0.0"
+      ]
+    }
+  }
+}

dk.u ADDED Viewed

	@@ -0,0 +1,54 @@

+# NotHackwaly_Ocamlearlybird
+## Overview
+Builds the [ocamlearlybird](https://github.com/hackwaly/ocamlearlybird) OCaml
+debug adapter with the dk build system. See CLO.md for setup instructions.
+## License
+MIT
+## workspace
+  %% actual_version("2.4.3.22")
+  'actual_version'
+  '2.4.3.22'
+The workspace assets below are the inputs of the dk build: the dune project
+files, the `src/` tree, and the checked-in opam lock. After editing any of
+them run `./dk1 update --no-imports` to refresh the recorded checksums.
+### NotHackwaly_Ocamlearlybird.Apparatus@1.3.6
+  % unified.asset { name="DuneRoot", file="dune" }
+  \dk.asset(byteSize: "83", checksum: (sha256: "9a38938be58029f13436cf66d626b20b4fa14ecb32428efe123f93b36df96bac"))\;
+  % unified.asset { name="DuneWorkspace", file="dk-src/dune-workspace" }
+  \dk.asset(byteSize: "16", checksum: (sha256: "6dff6804e49533fc19ea7b0fbe988213a210fa7b9a2d5fd5f5b89eed6e380e53"))\;
+  % unified.asset { name="DuneProject", file="dune-project" }
+  \dk.asset(byteSize: "780", checksum: (sha256: "919033718df7d4b1546ef485a7b35d0bcd23a5b97dad73d9f70826d04951e714"))\;
+  % unified.asset { name="Opam", file="earlybird.opam" }
+  \dk.asset(byteSize: "1124", checksum: (sha256: "786504fe6aa5991f03cfa72e5fb830112044f5c76cb42945f51d72ad3f1566f2"))\;
+  % unified.asset { name="Src", dir="src" }
+  \dk.asset(byteSize: "51509", checksum: (sha256: "ca452ef1920f6c630882b146796b3adfbf44bb91f7eeda8a41e2e1656fcd1e1d"))\;
+  % unified.asset { name="Lock", file="dk.opam-lock.jsonc" }
+  \dk.asset(byteSize: "83240", checksum: (sha256: "8b0cbeeb0d8a11845f3cadc288bf4cb22cad3623c0673892d0b85f5256f0d967"))\;
+  %% import { type="github-l2", repo="dkpkg/CommonsBase_Std" }
+  \dk.import(type: "github-l2", library: "CommonsBase_Std",
+    version: "2.6.20260920144347",
+    checksum: (blake2b-256: "8f7d86924c66f6d1778c08214b1adab001f75677cb141c376b837ee6e39f57fa",
+      sha256: "b3c67724e09942596d8af32635b585698f931047e74332bc011a532a430d5438",
+      sha1: "f1d0701257aa61a5fbd480833e464263422a4135"))\;
+  %% import { type="github-l2", repo="dkpkg/CommonsLang_OCaml", tag="0.1.20260920144347" }
+  \dk.import(type: "github-l2", library: "CommonsLang_OCaml",
+    version: "0.1.20260920144347",
+    checksum: (blake2b-256: "f4908c307b22de34d24ae0349481f321cd46d5082cc92a89d99d18a13189d907",
+      sha256: "54c5ccfd53e87797ea4fea161b0fd6c869ba80a45b3b3870848407c6797741a8",
+      sha1: "b018ece3ee445cfd6414cd7f28a3c501b5469898"))\;

dk0 ADDED Viewed

	@@ -0,0 +1,864 @@

+#!/bin/sh
+##########################################################################
+# File: mlfront/dk0                                                      #
+#                                                                        #
+# Copyright 2025 Diskuv, Inc.                                            #
+#                                                                        #
+# Licensed under the Open Software License version 3.0                   #
+# (the "License"); you may not use this file except in compliance        #
+# with the License. You may obtain a copy of the License at              #
+#                                                                        #
+#     https://opensource.org/license/osl-3-0-php/                        #
+#                                                                        #
+##########################################################################
+# Recommendation: Place this file in source control.
+#
+# Invoking: ./dk0
+#   That works in Powershell on Windows, and in Unix. Copy-and-paste works!
+#
+# Purpose: Install dk0 if not present. Then invoke dk0.
+# The cksum_signify_* constants below are read indirectly, through the dynamic
+# eval lookup in dk_verify_manifest that builds the variable name from the host
+# ABI; that reference is invisible to the linter, so the file-wide directive on
+# the next line turns off its unused-variable warning.
+# shellcheck disable=SC2034
+set -euf
+# ===== BAKED TRUST ROOT (rotates rarely; updated only on key/verifier rotation) =====
+# The dk0 version is NOT baked here. It is pinned per project by a
+#   %% actual_version("X.Y.Z.W")
+# line in dk.u's `## workspace` section (or the latest signed manifest if absent).
+# dk0 and its checksum come from a signify-signed manifest verified at runtime:
+#   1. download the pinned mlfront-signify verifier from its GitLab package (by
+#      the baked version below), check it against the SHA-256 baked below (the
+#      anchor -- not the manifest, so no circularity);
+#   2. verify the signify signature over the manifest (manifest.txt) with the
+#      baked public key;
+#   3. only then read the manifest's per-arch dk0 SHA-256.
+# This file never rewrites itself (Windows batch/exe safety); `dk0 --self-update`
+# edits only the dk.u actual_version line, and key rotation is followed at
+# verify-time via the manifest's continuation chain.
+SIGNIFY_PUBKEY_B64="RWTMq/GqeeJ06ACy7By/H05vvtpc3ZPEKlbnDm9fIQxpkgTV92is6YHD"
+# The verifier is pinned by version+checksum and fetched from GitLab (a direct
+# package download, not the throttled listing API); the site serves only the
+# signed manifest and the wrappers.
+signify_pkg_ver="2.4.2.271"
+cksum_signify_linux_x86_64="9701ed5821ea57114890f2d54381ee29742b45292ea0c8a259b0d4187c728a4d"
+cksum_signify_linux_x86="533ec71ef0c6081c57850c840d29df5ca8efd3c2722b54dc77c14224dda0c418"
+cksum_signify_darwin_arm64="89513c94add01ef5e15fa4c3a171755cd3eb783f552b9d4a3dedd009fa89a062"
+cksum_signify_darwin_x86_64="875ba2f6840bb705ed2346c9c3a165ee5fdfde559df4b9adfa0c6f915043eade"
+cksum_signify_windows_x86_64="ebe1aa87a3eb87ed6769782a31916fab72bbdf0ced22d6ddd9a7a455e23e2c68"
+# windows_x86 (32-bit) mlfront-signify is not published at signify_pkg_ver yet.
+# Keep the slot maintained: the __ placeholder trips the not-provisioned guard
+# in dk_verify_manifest until a real checksum is baked here (and dk0.cmd carries
+# the matching x86 slot), so ./dk0 and .\dk0.cmd light up together.
+cksum_signify_windows_x86="__CKSUM_SIGNIFY_WINDOWS_X86__"
+DK_BASE_URL="${DK0_BASE_URL:-https://diskuv.com/dk}"
+# ====================================================================================
+dk_pwd=$PWD
+# Get the dk project tree
+DK_PROJECT_DIR=$(dirname "$0")
+DK_PROJECT_DIR=$(cd "$DK_PROJECT_DIR" && pwd)
+# --- Windows ---
+# There is no shunt to dk0.cmd here. The block that used to live here required
+# [ -x /usr/bin/cmd ], and no MSYS2, Cygwin, or Git Bash layout ships a `cmd` in
+# /usr/bin, so it never fired on any host. This script handles Windows directly
+# instead: autodetect_buildhost_arch resolves windows_x86_64 / windows_x86 via
+# is_unixy_windows_build_machine, dk_extexe adds the .exe suffix, the data home
+# below shares dk0.cmd's store, and MSYS converts POSIX paths in argv when
+# exec'ing the native dk0.exe. A shunt could not be the whole answer anyway: a
+# global install.sh install ships no dk0.cmd to shunt to.
+# --- Quiet mode detection ---
+DKCODER_QUIET=0
+_DKEXE_OPTIONS=
+run_maybe_quiet() {
+  "$@" >&2 # Always redirect stdout to stderr in this script
+}
+printf_maybe_quiet() {
+  # shellcheck disable=SC2059
+  printf "$@" >&2
+}
+# --- Launcher helpers (not from crossplatform-functions.sh) ---
+# [dk_prog_path NAME] prints the path to NAME, or nothing when it is not
+# installed. Absolute locations first, so the hardened Linux/macOS behavior is
+# unchanged, then PATH. Git Bash (Git for Windows) ships curl at
+# /mingw64/bin/curl and has no /usr/bin/curl or /bin/curl, so without the PATH
+# fallback the launcher finds no downloader at all and every fetch fails.
+# ci/dist/install.sh already resolves curl/wget through PATH for the same reason.
+# This does not weaken the trust model: the mlfront-signify verifier is pinned by
+# the SHA-256 baked above, the manifest is signify-verified, and every binary is
+# checked against a signed checksum, so a hostile PATH curl can deny service but
+# cannot substitute an artifact.
+# The `|| true` matters under `set -e`: `command -v` exits nonzero for a missing
+# program, and a bare assignment would propagate that status and abort the script.
+dk_prog_path() {
+  if [ -x "/usr/bin/$1" ]; then printf '%s' "/usr/bin/$1"
+  elif [ -x "/bin/$1" ]; then printf '%s' "/bin/$1"
+  else command -v "$1" 2>/dev/null || true
+  fi
+}
+# Every download path funnels here when neither curl nor wget resolved. Name what
+# was searched and the escape hatch; a bare "not available" leaves the reader with
+# nothing to act on.
+dk_no_downloader() {
+  echo "FATAL: no curl or wget found (searched /usr/bin, /bin, then PATH)" >&2
+  echo "  ...: install curl or wget, or set DKMLSYS_CURL=/full/path/to/curl" >&2
+  exit 107
+}
+# --- Imports of dkml-runtime-common's crossplatform-functions.sh ---
+# Changes:
+# 1. In download_file() use [ "${DKCODER_QUIET:-}" -eq 1 ]
+# 2. In log_trace() replace non-FATAL `printf ... >&2` with `printf_maybe_quiet ...`
+# 3. In sha256check() all shasum/* use --quiet option (this should be upstreamed)
+# 4. In autodetect_system_binaries() curl and wget resolve through dk_prog_path
+#    (above), which falls back to PATH when the absolute locations miss
+# Get standard locations of Unix system binaries like `/usr/bin/mv` (or `/bin/mv`).
+#
+# Will not return anything in `/usr/local/bin` or `/usr/sbin`. Use when you do not
+# know whether the PATH has been set correctly, or when you do not know if the
+# system binary exists.
+#
+# At some point in the future, this function will error out if the required system binaries
+# do not exist. Most system binaries are common to all Unix/Linux/macOS installations but
+# some (like `comm`) may need to be installed for proper functioning of DKML.
+#
+# Outputs:
+# - env:DKMLSYS_MV - Location of `mv`
+# - env:DKMLSYS_CHMOD - Location of `chmod`
+# - env:DKMLSYS_UNAME - Location of `uname`
+# - env:DKMLSYS_ENV - Location of `env`
+# - env:DKMLSYS_AWK - Location of `awk`
+# - env:DKMLSYS_SED - Location of `sed`
+# - env:DKMLSYS_COMM - Location of `comm`
+# - env:DKMLSYS_INSTALL - Location of `install`
+# - env:DKMLSYS_RM - Location of `rm`
+# - env:DKMLSYS_SORT - Location of `sort`
+# - env:DKMLSYS_CAT - Location of `cat`
+# - env:DKMLSYS_STAT - Location of `stat`
+# - env:DKMLSYS_GREP - Location of `grep`
+# - env:DKMLSYS_CURL - Location of `curl` (empty if not found)
+# - env:DKMLSYS_WGET - Location of `wget` (empty if not found)
+# - env:DKMLSYS_TR - Location of `tr`
+autodetect_system_binaries() {
+    if [ -z "${DKMLSYS_MV:-}" ]; then
+        if [ -x /usr/bin/mv ]; then
+            DKMLSYS_MV=/usr/bin/mv
+        else
+            DKMLSYS_MV=/bin/mv
+        fi
+    fi
+    if [ -z "${DKMLSYS_CHMOD:-}" ]; then
+        if [ -x /usr/bin/chmod ]; then
+            DKMLSYS_CHMOD=/usr/bin/chmod
+        else
+            DKMLSYS_CHMOD=/bin/chmod
+        fi
+    fi
+    if [ -z "${DKMLSYS_UNAME:-}" ]; then
+        if [ -x /usr/bin/uname ]; then
+            DKMLSYS_UNAME=/usr/bin/uname
+        else
+            DKMLSYS_UNAME=/bin/uname
+        fi
+    fi
+    if [ -z "${DKMLSYS_ENV:-}" ]; then
+        if [ -x /usr/bin/env ]; then
+            DKMLSYS_ENV=/usr/bin/env
+        else
+            DKMLSYS_ENV=/bin/env
+        fi
+    fi
+    if [ -z "${DKMLSYS_AWK:-}" ]; then
+        if [ -x /usr/bin/awk ]; then
+            DKMLSYS_AWK=/usr/bin/awk
+        else
+            DKMLSYS_AWK=/bin/awk
+        fi
+    fi
+    if [ -z "${DKMLSYS_SED:-}" ]; then
+        if [ -x /usr/bin/sed ]; then
+            DKMLSYS_SED=/usr/bin/sed
+        else
+            DKMLSYS_SED=/bin/sed
+        fi
+    fi
+    if [ -z "${DKMLSYS_COMM:-}" ]; then
+        if [ -x /usr/bin/comm ]; then
+            DKMLSYS_COMM=/usr/bin/comm
+        else
+            DKMLSYS_COMM=/bin/comm
+        fi
+    fi
+    if [ -z "${DKMLSYS_INSTALL:-}" ]; then
+        if [ -x /usr/bin/install ]; then
+            DKMLSYS_INSTALL=/usr/bin/install
+        else
+            DKMLSYS_INSTALL=/bin/install
+        fi
+    fi
+    if [ -z "${DKMLSYS_RM:-}" ]; then
+        if [ -x /usr/bin/rm ]; then
+            DKMLSYS_RM=/usr/bin/rm
+        else
+            DKMLSYS_RM=/bin/rm
+        fi
+    fi
+    if [ -z "${DKMLSYS_SORT:-}" ]; then
+        if [ -x /usr/bin/sort ]; then
+            DKMLSYS_SORT=/usr/bin/sort
+        else
+            DKMLSYS_SORT=/bin/sort
+        fi
+    fi
+    if [ -z "${DKMLSYS_CAT:-}" ]; then
+        if [ -x /usr/bin/cat ]; then
+            DKMLSYS_CAT=/usr/bin/cat
+        else
+            DKMLSYS_CAT=/bin/cat
+        fi
+    fi
+    if [ -z "${DKMLSYS_STAT:-}" ]; then
+        if [ -x /usr/bin/stat ]; then
+            DKMLSYS_STAT=/usr/bin/stat
+        else
+            DKMLSYS_STAT=/bin/stat
+        fi
+    fi
+    if [ -z "${DKMLSYS_GREP:-}" ]; then
+        if [ -x /usr/bin/grep ]; then
+            DKMLSYS_GREP=/usr/bin/grep
+        else
+            DKMLSYS_GREP=/bin/grep
+        fi
+    fi
+    if [ -z "${DKMLSYS_CURL:-}" ]; then DKMLSYS_CURL=$(dk_prog_path curl); fi
+    if [ -z "${DKMLSYS_WGET:-}" ]; then DKMLSYS_WGET=$(dk_prog_path wget); fi
+    if [ -z "${DKMLSYS_TR:-}" ]; then
+        if [ -x /usr/bin/tr ]; then
+            DKMLSYS_TR=/usr/bin/tr
+        else
+            DKMLSYS_TR=/bin/tr
+        fi
+    fi
+    export DKMLSYS_MV DKMLSYS_CHMOD DKMLSYS_UNAME DKMLSYS_ENV DKMLSYS_AWK DKMLSYS_SED DKMLSYS_COMM DKMLSYS_INSTALL
+    export DKMLSYS_RM DKMLSYS_SORT DKMLSYS_CAT DKMLSYS_STAT DKMLSYS_GREP DKMLSYS_CURL DKMLSYS_WGET DKMLSYS_TR
+}
+# Is a Windows build machine if we are in a MSYS2 or Cygwin environment.
+#
+# Better alternatives
+# -------------------
+#
+# 1. If you are checking to see if you should do a cygpath, then just guard it
+#    like so:
+#       if [ -x /usr/bin/cygpath ]; then
+#           do_something $(/usr/bin/cygpath ...) ...
+#       fi
+#    This clearly guards what you are about to do (cygpath) with what you will
+#    need (cygpath).
+# 2. is_arg_windows_platform
+is_unixy_windows_build_machine() {
+    if is_msys2_msys_build_machine || is_cygwin_build_machine; then
+        return 0
+    fi
+    return 1
+}
+# Is a MSYS2 environment with the MSYS or MINGW64 subsystem?
+# * MSYS2 can also do MinGW 32-bit and 64-bit subsystems. Used by Diskuv OCaml
+# * MINGW64 used by Git Bash (aka. GitHub Actions `shell: bash`)
+# https://www.msys2.org/docs/environments/
+is_msys2_msys_build_machine() {
+    if [ -e /usr/bin/msys-2.0.dll ] && {
+        [ "${MSYSTEM:-}" = "MSYS" ] || [ "${MSYSTEM:-}" = "MINGW64" ] || [ "${MSYSTEM:-}" = "UCRT64" ] || [ "${MSYSTEM:-}" = "CLANG64" ] || [ "${MSYSTEM:-}" = "MINGW32" ] || [ "${MSYSTEM:-}" = "CLANG32" ] || [ "${MSYSTEM:-}" = "CLANGARM64" ]
+    }; then
+        return 0
+    fi
+    return 1
+}
+is_cygwin_build_machine() {
+    if [ -e /usr/bin/cygwin1.dll ]; then
+        return 0
+    fi
+    return 1
+}
+# Tries to find the host ABI.
+#
+# Beware: This function uses `uname` probing may be inaccurate for dual-arch
+# CPUs like Apple Silicon with Rosetta.
+#
+# Inputs:
+# - env:DKML_HOST_ABI - Optional but recommended. If set, then BUILDHOST_ARCH will be set to the same.
+#
+# Outputs:
+# - env:BUILDHOST_ARCH will contain the host ABI.
+autodetect_buildhost_arch() {
+    if [ -n "${DKML_HOST_ABI:-}" ]; then
+        BUILDHOST_ARCH=$DKML_HOST_ABI
+    else
+        # Set DKMLSYS_*
+        autodetect_system_binaries
+        autodetect_buildhost_arch_SYSTEM=$("$DKMLSYS_UNAME" -s)
+        autodetect_buildhost_arch_MACHINE=$("$DKMLSYS_UNAME" -m)
+        # list from https://en.wikipedia.org/wiki/Uname and https://stackoverflow.com/questions/45125516/possible-values-for-uname-m
+        case "${autodetect_buildhost_arch_SYSTEM}-${autodetect_buildhost_arch_MACHINE}" in
+            Linux-armv7*)
+                BUILDHOST_ARCH=linux_arm32v7;;
+            Linux-armv6* | Linux-arm)
+                BUILDHOST_ARCH=linux_arm32v6;;
+            Linux-aarch64 | Linux-arm64 | Linux-armv8*)
+                BUILDHOST_ARCH=linux_arm64;;
+            Linux-i386 | Linux-i686)
+                BUILDHOST_ARCH=linux_x86;;
+            Linux-x86_64)
+                BUILDHOST_ARCH=linux_x86_64
+                # uname -m reports the KERNEL machine, so a 32-bit userland on
+                # a 64-bit kernel (ex. an i386 container on an amd64 host)
+                # still says x86_64 -- but a 64-bit dk0 cannot run there. The
+                # userland's own ELF class is the truth: byte 5 of /bin/sh is
+                # 1 for ELFCLASS32. od(1) is POSIX but not guaranteed present;
+                # without it, or on a 64-bit userland, the kernel's answer
+                # stands. test's numeric -eq tolerates od's leading
+                # whitespace; the redirected test guards non-numeric output.
+                autodetect_buildhost_arch_ELFCLASS=
+                if command -v od >/dev/null 2>&1; then
+                    autodetect_buildhost_arch_ELFCLASS=$(od -An -td1 -j4 -N1 /bin/sh 2>/dev/null)
+                fi
+                if [ "${autodetect_buildhost_arch_ELFCLASS:-2}" -eq 1 ] 2>/dev/null; then
+                    BUILDHOST_ARCH=linux_x86
+                # musl-based Linux (ex. alpine) is not a supported dk0 ABI yet;
+                # there is no musl dk0 build. Fail fast with a clear message
+                # instead of reaching a confusing "not provisioned" error later.
+                # A user who knows better can still force DKML_HOST_ABI. The musl
+                # dynamic loader path is the reliable marker; musl's ldd
+                # identifying itself is the fallback.
+                elif [ -e /lib/ld-musl-x86_64.so.1 ] \
+                  || { ldd --version 2>&1 | grep -qi musl; } 2>/dev/null; then
+                    printf "%s\n" "FATAL: musl-based Linux (e.g. Alpine) is not supported yet; dk0 needs a glibc-based distro" >&2
+                    exit 1
+                fi
+                ;;
+            Darwin-arm64)
+                BUILDHOST_ARCH=darwin_arm64;;
+            Darwin-x86_64)
+                BUILDHOST_ARCH=darwin_x86_64;;
+            *-i386 | *-i686)
+                if is_unixy_windows_build_machine; then
+                    BUILDHOST_ARCH=windows_x86
+                else
+                    printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
+                    exit 1
+                fi
+                ;;
+            *-x86_64)
+                if is_unixy_windows_build_machine; then
+                    BUILDHOST_ARCH=windows_x86_64
+                else
+                    printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
+                    exit 1
+                fi
+                ;;
+            *)
+                # Since:
+                # 1) MSYS2 does not run on ARM/ARM64 (https://www.msys2.org/docs/environments/)
+                # 2) MSVC does not use ARM/ARM64 as host machine (https://docs.microsoft.com/en-us/cpp/build/building-on-the-command-line?view=msvc-160)
+                # we do not support Windows ARM/ARM64 as a build machine
+                printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
+                exit 1
+                ;;
+        esac
+    fi
+}
+# A function that will try to print an ISO8601 timestamp, but will fallback to
+# the system default. Always uses UTC timezone.
+try_iso8601_timestamp() {
+    date -u -Iseconds 2>/dev/null || TZ=UTC date
+}
+# A function that will print the command and possibly time it (if and only if it uses a full path to
+# an executable, so that 'time' does not fail on internal shell functions).
+# If --return-error-code is the first argument or LOG_TRACE_RETURN_ERROR_CODE=ON, then instead of exiting the
+# function will return the error code.
+log_trace() {
+    log_trace_RETURN=${LOG_TRACE_RETURN_ERROR_CODE:-OFF}
+    log_trace_1="$1"
+    if [ "$log_trace_1" = "--return-error-code" ]; then
+        shift
+        log_trace_RETURN=ON
+    fi
+    if [ "${DKML_BUILD_TRACE:-OFF}" = ON ]; then
+        printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "+ $*"
+        if [ -x "$1" ]; then
+            time "$@"
+        else
+            "$@"
+        fi
+    else
+        # use judgement so we essentially have log at an INFO level
+        case "$1" in
+        rm|cp)
+            # debug level. only show when DKML_BUILD_TRACE=ON
+            ;;
+        git|make|ocaml_configure|ocaml_make|make_host|make_target)
+            # info level. and can show entire command without polluting the screen
+            printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "$*"
+            ;;
+        *)  printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "$1"
+        esac
+        "$@"
+    fi
+    log_trace_ec="$?"
+    if [ "$log_trace_ec" -ne 0 ]; then
+        if [ "$log_trace_RETURN" = ON ]; then
+            return "$log_trace_ec"
+        else
+            printf "FATAL: Command failed with exit code %s: %s\n" "$log_trace_ec" "$*" >&2
+            exit "$log_trace_ec"
+        fi
+    fi
+}
+# [sha256compute FILE] writes the SHA256 checksum (hex encoded) of file FILE to the standard output.
+sha256compute() {
+    sha256compute_FILE="$1"
+    shift
+    # For reasons unclear doing the following in MSYS2:
+    #   sha256sum 'Z:\source\README.md'
+    # will produce a backslash like:
+    #   \5518c76ed7234a153941fb7bc94b6e91d9cb8f1c4e22daf169a59b5878c3fc8a *Z:\\source\\README.md
+    # So always cygpath the filename if available
+    if [ -x /usr/bin/cygpath ]; then
+        sha256compute_FILE=$(/usr/bin/cygpath -a "$sha256compute_FILE")
+    fi
+    autodetect_system_binaries
+    if [ -x /usr/bin/shasum ]; then # macOS, OpenBSD, Debian
+        # CODESITE #1 (duplicates elsewhere).
+        # On Debian shasum is a perl script, and perl needs locale settings or it will complain.
+        # Confer: https://www.thomas-krenn.com/en/wiki/Perl_warning_Setting_locale_failed_in_Debian
+        # Confer: https://stackoverflow.com/a/52004330/21513816
+        #   shellcheck disable=SC2016
+        LC_ALL=C /usr/bin/shasum -a 256 "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
+    elif [ -x /usr/bin/sha256sum ]; then # Linux, MSYS2
+        #   shellcheck disable=SC2016
+        /usr/bin/sha256sum "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
+    elif [ -x /sbin/sha256 ]; then # FreeBSD
+        #   shellcheck disable=SC2016
+        /sbin/sha256 -r "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
+    else
+        printf "FATAL: %s\n" "No sha256 checksum utility found" >&2
+        exit 107
+    fi
+}
+# [sha256check FILE SUM] checks that the file FILE has a SHA256 checksum (hex encoded) of SUM.
+# The function will return nonzero (and exit with failure if `set -e` is enabled) if the checksum does not match.
+sha256check() {
+    sha256check_FILE="$1"
+    shift
+    sha256check_SUM="$1"
+    shift
+    if [ -x /usr/bin/shasum ]; then # macOS, OpenBSD, Debian
+        # CODESITE #1 (duplicates elsewhere).
+        # On Debian shasum is a perl script, and perl needs locale settings or it will complain.
+        # Confer: https://www.thomas-krenn.com/en/wiki/Perl_warning_Setting_locale_failed_in_Debian
+        # Confer: https://stackoverflow.com/a/52004330/21513816
+        # Note: shasum 5.96 (ex. conanio/gcc7:1.64.1) has no --quiet option.
+        #   shellcheck disable=SC2016
+        printf "%s  %s" "$sha256check_SUM" "$sha256check_FILE" | LC_ALL=C /usr/bin/shasum -a 256 -c >&2
+    elif [ -x /usr/bin/sha256sum ]; then # Linux, MSYS2
+        # Note: BusyBox v1.35.0 sha256sum has no --quiet option.
+        printf "%s  %s" "$sha256check_SUM" "$sha256check_FILE" | /usr/bin/sha256sum -c >&2
+    elif [ -x /sbin/sha256 ]; then # FreeBSD
+        /sbin/sha256 --quiet -c "$sha256check_SUM" "$sha256check_FILE" >&2
+    else
+        printf "FATAL: %s\n" "No sha256 checksum utility found" >&2
+        # REMOVEME!
+        if [ -d /sbin ]; then printf "/sbin:\n" >&2; ls /sbin >&2; fi
+        if [ -d /usr/sbin ]; then printf "/usr/sbin:\n" >&2; ls /usr/sbin >&2; fi
+        if [ -d /bin ]; then printf "/bin:\n" >&2; ls /bin >&2; fi
+        if [ -d /usr/bin ]; then printf "/usr/bin:\n" >&2; ls /usr/bin >&2; fi
+        exit 107
+    fi
+}
+# Echo --https-only if this wget supports it (BusyBox wget does not), so a
+# redirect cannot downgrade the transfer off HTTPS wherever the option exists.
+dk_wget_https_only() {
+  if "$DKMLSYS_WGET" --help 2>&1 | grep -q -- --https-only; then printf '%s' '--https-only'; fi
+}
+# [downloadfile URL FILE SUM] downloads from URL into FILE and verifies the SHA256 checksum of SUM.
+# If the FILE already exists with the correct checksum it is not redownloaded.
+# The function will exit with failure if the checksum does not match.
+# curl pins HTTPS end to end (--proto '=https' + --proto-redir '=https') with a
+# TLS 1.2 floor, and -f fails on an HTTP error page instead of saving it.
+downloadfile() {
+    downloadfile_URL="$1"
+    shift
+    downloadfile_FILE="$1"
+    shift
+    downloadfile_SUM="$1"
+    shift
+    # Set DKMLSYS_*
+    autodetect_system_binaries
+    # Quick exit if exists and checksum verified. Do not display
+    # anything (even the checksum output) since this is the normal scenario
+    # that can run a billion times. The checksum verification for the
+    # download (if this fails) will not be silenced.
+    if [ -e "$downloadfile_FILE" ]; then
+        if sha256check "$downloadfile_FILE" "$downloadfile_SUM" > /dev/null 2>&1; then
+            return 0
+        else
+            $DKMLSYS_RM -f "$downloadfile_FILE"
+        fi
+    fi
+    printf_maybe_quiet "... %s %s\n" "Downloading" "$downloadfile_URL"
+    if [ "${CI:-}" = true ] || [ "${DKCODER_QUIET:-}" -eq 1 ]; then
+        if [ -n "$DKMLSYS_CURL" ]; then
+            log_trace "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL "$downloadfile_URL" -o "$downloadfile_FILE".tmp
+        elif [ -n "$DKMLSYS_WGET" ]; then
+            # shellcheck disable=SC2046 # prints one flag or nothing; must expand to zero words
+            log_trace "$DKMLSYS_WGET" $(dk_wget_https_only) -q -O "$downloadfile_FILE".tmp "$downloadfile_URL"
+        else
+            dk_no_downloader
+        fi
+    else
+        if [ -n "$DKMLSYS_CURL" ]; then
+            log_trace "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fL "$downloadfile_URL" -o "$downloadfile_FILE".tmp
+        elif [ -n "$DKMLSYS_WGET" ]; then
+            # shellcheck disable=SC2046 # prints one flag or nothing; must expand to zero words
+            log_trace "$DKMLSYS_WGET" $(dk_wget_https_only) -O "$downloadfile_FILE".tmp "$downloadfile_URL"
+        else
+            dk_no_downloader
+        fi
+    fi
+    printf_maybe_quiet "\n... %s %s\n" "Verifying" "$downloadfile_URL"
+    if ! sha256check "$downloadfile_FILE".tmp "$downloadfile_SUM"; then
+        printf "%s\n" "FATAL: Encountered a corrupted or compromised download from $downloadfile_URL" >&2
+        exit 1
+    fi
+    printf_maybe_quiet "\n"
+    $DKMLSYS_MV "$downloadfile_FILE".tmp "$downloadfile_FILE"
+}
+# End import
+# ---------------------------------------------------------------------------
+# --- Environment detection ---
+# Set DKMLSYS_*
+autodetect_system_binaries
+# Find host ABI. Set in BUILDHOST_ARCH
+autodetect_buildhost_arch
+# --- data home ---
+tools_dir=
+tools_name=dk0
+#   1. Check DKCODER_DATA_HOME environment variable.
+if [ -z "$tools_dir" ] && [ -n "${DKCODER_DATA_HOME:-}" ]; then
+  install -d "$DKCODER_DATA_HOME"
+  tools_dir="$DKCODER_DATA_HOME"
+fi
+#   2. Check if CI since many CI providers can only cache content in a subdirectory
+#      of the project.
+if [ -z "$tools_dir" ] && [ "${CI:-}" = true ]; then
+  install -d "$DK_PROJECT_DIR/.z-dk/tools"
+  tools_dir="$DK_PROJECT_DIR/.z-dk/tools"
+fi
+#   2b. On Windows (Git Bash / MSYS2 / Cygwin) use the SAME store as dk0.cmd,
+#      %LOCALAPPDATA%\Programs\dk0, so a project driven from both PowerShell and
+#      a POSIX shell shares one cache instead of downloading every build twice.
+#      This sits after the CI check on purpose: dk0.cmd has no CI branch, but a
+#      Windows CI job driving ./dk0 from bash still wants the in-project cache.
+#      LOCALAPPDATA holds a native Windows path (MSYS does not convert
+#      environment variables), so cygpath it; needing cygpath also scopes this
+#      to MSYS/Cygwin.
+if [ -z "$tools_dir" ] && [ -n "${COMSPEC:-}" ] && [ -n "${LOCALAPPDATA:-}" ] && [ -x /usr/bin/cygpath ]; then
+  tools_dir_LOCALAPPDATA=$(/usr/bin/cygpath -au "$LOCALAPPDATA")
+  if [ -w "$tools_dir_LOCALAPPDATA" ]; then
+    install -d "$tools_dir_LOCALAPPDATA/Programs/$tools_name"
+    tools_dir="$tools_dir_LOCALAPPDATA/Programs/$tools_name"
+  fi
+fi
+#   3. Check in locations rooted under /opt/diskuv
+#      We look under a /opt/diskuv early because
+#      - Especially important for WSL2 to use a pure Linux filesystem (ext4) for
+#        best performance.
+#      - Using a canonical location (especially /opt/diskuv/usr/share) makes
+#        it easy to use CMake presets for non-Windows hosts.
+if [ -z "$tools_dir" ] && [ -n "${XDG_DATA_HOME:-}" ] && [ -w "/opt/diskuv/$XDG_DATA_HOME" ]; then
+  install -d "/opt/diskuv/$XDG_DATA_HOME/$tools_name"
+  tools_dir="/opt/diskuv/$XDG_DATA_HOME/$tools_name"
+fi
+if [ -z "$tools_dir" ] && [ -n "${HOME:-}" ] && [ -w "/opt/diskuv/$HOME" ]; then
+  install -d "/opt/diskuv/$HOME/.local/share/$tools_name"
+  tools_dir="/opt/diskuv/$HOME/.local/share/$tools_name"
+fi
+if [ -z "$tools_dir" ] && [ -w "/opt/diskuv/usr/share" ]; then
+  install -d "/opt/diskuv/usr/share/$tools_name"
+  tools_dir="/opt/diskuv/usr/share/$tools_name"
+fi
+#   4. Check in the conventional locations rooted under /
+if [ -z "$tools_dir" ] && [ -n "${XDG_DATA_HOME:-}" ] && [ -w "$XDG_DATA_HOME" ]; then
+  install -d "$XDG_DATA_HOME/$tools_name"
+  tools_dir="$XDG_DATA_HOME/$tools_name"
+fi
+if [ -z "$tools_dir" ] && [ -n "${HOME:-}" ] && [ -w "$HOME" ]; then
+  install -d "$HOME/.local/share/$tools_name"
+  tools_dir="$HOME/.local/share/$tools_name"
+fi
+#   5. Validate
+if [ -z "$tools_dir" ]; then
+  echo "FATAL: Could not find a location to install DkCoder." >&2
+  echo "  ...: Make sure you have a home directory and that it is write-able, or define" >&2
+  echo "  ...: the environment variable XDG_DATA_HOME in a shell profile script after" >&2
+  echo "  ...: creating the \$XDG_DATA_HOME directory." >&2
+  exit 2
+fi
+# --- Tool downloads and installs ---
+# PREREQS
+# -------
+install_linux_prog() {
+  install_linux_prog_NAME=$1
+  shift
+  install_linux_prog_PKG=$1
+  shift
+  install_linux_prog_ALPINE_PKG=$1
+  shift
+  if [ -x "/usr/bin/$install_linux_prog_NAME" ]; then
+    export DK_PROG_INSTALLED_LOCATION="/usr/bin/$install_linux_prog_NAME"
+  elif [ -x "/bin/$install_linux_prog_NAME" ]; then
+    export DK_PROG_INSTALLED_LOCATION="/bin/$install_linux_prog_NAME"
+  else
+    if [ -x /sbin/apk ]; then
+      if [ "$(id -u)" -eq 0 ]; then
+        run_maybe_quiet /sbin/apk add --quiet --no-progress "$install_linux_prog_ALPINE_PKG"
+      else
+        echo "Running: sudo /sbin/apk add --quiet --no-progress  $install_linux_prog_ALPINE_PKG" >&2
+        sudo /sbin/apk add --quiet --no-progress "$install_linux_prog_ALPINE_PKG"
+      fi
+    elif command -v yum > /dev/null 2> /dev/null; then
+      if [ "$(id -u)" -eq 0 ]; then
+        run_maybe_quiet yum install -q -y "$install_linux_prog_PKG"
+      else
+        echo "Running: sudo yum install -q -y $install_linux_prog_PKG" >&2
+        sudo yum install -q -y "$install_linux_prog_PKG"
+      fi
+    else
+      if [ "$(id -u)" -eq 0 ]; then
+        run_maybe_quiet apt-get -qq install -y --no-install-suggests "$install_linux_prog_PKG"
+      else
+        echo "Running: sudo apt-get -qq install -y --no-install-suggests $install_linux_prog_PKG" >&2
+        sudo apt-get -qq install -y --no-install-suggests "$install_linux_prog_PKG"
+      fi
+    fi
+    DK_PROG_INSTALLED_LOCATION=$(command -v "$install_linux_prog_NAME")
+    export DK_PROG_INSTALLED_LOCATION
+  fi
+}
+case "$BUILDHOST_ARCH" in
+  linux_*)
+    #   Need either [wget] or [curl] for [downloadfile]
+    if [ ! -x /usr/bin/wget ] && [ ! -x /bin/wget ] && [ ! -x /usr/bin/curl ] && [ ! -x /bin/curl ]; then
+      install_linux_prog wget wget wget || install_linux_prog curl curl curl
+    fi
+    ;;
+esac
+# -----
+# resolve version + verify the signed manifest
+# -----
+# A checksum-less fetch (the manifest is trusted by SIGNATURE, not a pre-known
+# checksum). curl or wget, matching downloadfile's tool detection.
+dk_fetch() {
+  # shellcheck disable=SC2046 # prints one flag or nothing; must expand to zero words
+  if [ -n "$DKMLSYS_CURL" ]; then "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL "$1" -o "$2"
+  elif [ -n "$DKMLSYS_WGET" ]; then "$DKMLSYS_WGET" $(dk_wget_https_only) -q -O "$2" "$1"
+  else dk_no_downloader; fi
+}
+# Read `%% actual_version("X.Y.Z.W")` from dk.u's workspace section (the pin).
+# The `[(]?` tolerates the parenthesized call form dk0 writes (the workspace Lua
+# grammar rejects the bare `actual_version "X"` string-call sugar); the version
+# is the first double-quoted field either way.
+dk_read_actual_version() {
+  [ -f "$DK_PROJECT_DIR/dk.u" ] || return 0
+  "$DKMLSYS_GREP" -oE '%%[[:space:]]*actual_version[[:space:]]*[(]?[[:space:]]*"[^"]+"' "$DK_PROJECT_DIR/dk.u" 2>/dev/null \
+    | head -1 | "$DKMLSYS_SED" 's/.*"\([^"]*\)".*/\1/'
+}
+# Read a plain key=value field from a verified manifest.
+dk_manifest_str() {
+  "$DKMLSYS_GREP" "^$2=" "$1" | head -1 | cut -d= -f2
+}
+# Defense-in-depth: the dk0 download URL comes from the signify-verified manifest,
+# but still restrict it to known hosts so a signed-but-malicious manifest cannot
+# redirect the fetch off github.com/dkpkg or the legacy GitLab package host.
+dk_allow_host() {
+  case "$1" in
+    https://github.com/dkpkg/*) return 0 ;;
+    https://gitlab.com/api/v4/projects/60486861/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+# On Windows the published dk0 + mlfront-signify binaries carry a `.exe`
+# extension; other platforms have none. Mirrors gen-manifest.sh's extexe.
+dk_extexe() { case "$BUILDHOST_ARCH" in windows_*) printf '.exe' ;; esac; }
+# Fetch + signify-verify the manifest into $1. $2 is the pinned version ("" =
+# latest). Aborts on any verification failure. Trust anchor = the baked
+# mlfront-signify SHA-256, then the baked public key over the manifest.
+dk_verify_manifest() {
+  dvm_out=$1; dvm_ver=$2
+  dvm_sigarch=$BUILDHOST_ARCH
+  eval "dvm_pin=\${cksum_signify_${dvm_sigarch}:-}"
+  # Empty = the arch was never provisioned; a value still starting with `__` is
+  # a maintained-but-unbaked placeholder (e.g. windows_x86 until its signify job
+  # ships). Both are "not provisioned" -- refuse rather than fetch and trust an
+  # unverifiable verifier.
+  # shellcheck disable=SC2154 # dvm_pin is assigned by the eval above
+  case "$dvm_pin" in
+    '' | __*) echo "FATAL: no pinned mlfront-signify checksum for $BUILDHOST_ARCH (launcher not provisioned)" >&2; exit 3 ;;
+  esac
+  install -d "$tools_dir/verifier"
+  dvm_exe=$(dk_extexe)
+  dvm_signify="$tools_dir/verifier/mlfront-signify-$dvm_pin$dvm_exe"
+  downloadfile "https://gitlab.com/api/v4/projects/60486861/packages/generic/mlfront-signify/$signify_pkg_ver/mlfront-signify-$dvm_sigarch$dvm_exe" "$dvm_signify" "$dvm_pin"
+  chmod +x "$dvm_signify"
+  if [ -n "$dvm_ver" ]; then dvm_url="$DK_BASE_URL/manifest-$dvm_ver.txt"; else dvm_url="$DK_BASE_URL/manifest.txt"; fi
+  dk_fetch "$dvm_url" "$dvm_out"
+  dk_fetch "$dvm_url.sig" "$dvm_out.sig"
+  printf 'untrusted comment: dk0 signify public key\n%s\n' "$SIGNIFY_PUBKEY_B64" > "$tools_dir/verifier/dk0.pub"
+  "$dvm_signify" -V -q -p "$tools_dir/verifier/dk0.pub" -m "$dvm_out" -x "$dvm_out.sig" \
+    || { echo "FATAL: manifest signature INVALID for $dvm_url -- refusing to continue" >&2; exit 1; }
+}
+# Resolve the version. `--self-update` ignores the pin and uses the LATEST dk0,
+# which rewrites the dk.u actual_version to its own version -- dk0.exe edits dk.u
+# safely, so this launcher never does file surgery (and stays batch-safe on the
+# Windows side too). Otherwise use the dk.u pin, else the latest.
+dk_selfupdate=0
+[ "${1:-}" = "--self-update" ] && dk_selfupdate=1
+if [ "$dk_selfupdate" = 1 ]; then
+  majminpat_ver=
+else
+  majminpat_ver=$(dk_read_actual_version)
+fi
+dk_manifest="$tools_dir/verifier/manifest"
+dk_verify_manifest "$dk_manifest" "$majminpat_ver"
+if [ -z "$majminpat_ver" ]; then
+  majminpat_ver=$(dk_manifest_str "$dk_manifest" version)
+  [ "$dk_selfupdate" = 0 ] && echo "dk0: no '%% actual_version' pin in dk.u; using latest $majminpat_ver (run './dk0 --self-update' to pin)" >&2
+fi
+[ -n "$majminpat_ver" ] || { echo "FATAL: could not resolve a dk0 version" >&2; exit 1; }
+dk0_cksum=$(dk_manifest_str "$dk_manifest" "dk0_${BUILDHOST_ARCH}")
+[ -n "$dk0_cksum" ] || { echo "FATAL: manifest has no dk0 build for $BUILDHOST_ARCH (version $majminpat_ver)" >&2; exit 3; }
+dk0_url_template=$(dk_manifest_str "$dk_manifest" "dk0_url_template")
+[ -n "$dk0_url_template" ] || { echo "FATAL: manifest has no dk0_url_template (version $majminpat_ver)" >&2; exit 1; }
+# -----
+# single binary executable
+# -----
+DK_EXE=
+destdir=$tools_dir/dk0exe-$majminpat_ver-$BUILDHOST_ARCH
+install -d "$destdir"
+dk0_exe="$destdir/dk0$(dk_extexe)"
+download_helper() {
+  download_helper_CKSUM=$1; shift
+  # Resolve {version}/{arch}/{exe} in the verified manifest's dk0_url_template,
+  # then allowlist the host before fetching.
+  download_helper_URL=$(printf '%s' "$dk0_url_template" | "$DKMLSYS_SED" \
+    -e "s|{version}|$majminpat_ver|g" -e "s|{arch}|$BUILDHOST_ARCH|g" -e "s|{exe}|$(dk_extexe)|g")
+  dk_allow_host "$download_helper_URL" \
+    || { echo "FATAL: dk0 download host not allowlisted: $download_helper_URL" >&2; exit 1; }
+  downloadfile "$download_helper_URL" "$dk0_exe" "$download_helper_CKSUM"
+}
+download_dk() {
+  # dk0 checksum comes from the signify-verified manifest, not a baked value.
+  download_helper "$dk0_cksum"
+}
+# downloadfile skips the download when the cached dk0 already matches the manifest
+# checksum, so this is a no-op on the common (already-cached) path. (A `--version`
+# comparison would not work: dk0 prints "X.Y.Z+rev-W" but the pin is "X.Y.Z.W".)
+download_dk
+chmod +x "$dk0_exe"
+# Set DK_EXE
+DK_EXE="$dk0_exe"
+# -----
+# launcher store GC
+# -----
+# Every dk0 version installs into its own $tools_dir/dk0exe-* directory and
+# old versions accumulate forever. Mark the pinned version as used, then
+# remove version directories (and superseded verifier binaries) that no
+# launcher has used in 30 days. Everything here re-downloads on demand from
+# its signed manifest, so deletion is always safe; pruning must never break
+# the launch, hence the blanket error suppression and the [find] guard
+# (skip pruning entirely on systems without [find]).
+touch "$destdir" "$dvm_signify" 2>/dev/null || true
+if command -v find >/dev/null 2>&1; then
+  find "$tools_dir" -maxdepth 1 -type d -name 'dk0exe-*' -mtime +30 \
+    -exec "$DKMLSYS_RM" -rf {} + 2>/dev/null || true
+  find "$tools_dir/verifier" -maxdepth 1 -type f -name 'mlfront-signify-*' \
+    -mtime +30 -exec "$DKMLSYS_RM" -f {} + 2>/dev/null || true
+fi
+# --- Run executable ---
+#   We already changed to DK_PROJECT_DIR earlier. Change back.
+cd "$dk_pwd"
+export DKCODER_ARG0="$0"
+export DKCODER_PWD="$dk_pwd"
+export DK_PROJECT_DIR
+#   Tell the dk0 binary the real execution host. dkml-c-probe bakes the ABI of
+#   the C compiler that built the binary, so a musl dk0 cross-built on glibc
+#   would otherwise self-identify as linux_x86_64 and resolve the glibc
+#   toolchain on a musl host. BUILDHOST_ARCH is the launcher's own host
+#   detection (honors a pre-set DKML_HOST_ABI, else uname + the musl loader
+#   probe above), so propagate it as DKML_HOST_ABI which the binary honors.
+export DKML_HOST_ABI="$BUILDHOST_ARCH"
+#   shellcheck disable=SC2086
+if [ "$dk_selfupdate" = 1 ]; then
+  # dk0.exe repins the dk.u actual_version line to the resolved (latest) version.
+  exec "$DK_EXE" -isystem "$DK_PROJECT_DIR/etc/dk/i" $_DKEXE_OPTIONS self-update "$majminpat_ver"
+else
+  exec "$DK_EXE" -isystem "$DK_PROJECT_DIR/etc/dk/i" $_DKEXE_OPTIONS "$@"
+fi

dk0.cmd ADDED Viewed

	@@ -0,0 +1,211 @@

+@ECHO OFF
+REM ##########################################################################
+REM # File: dk\dk0.cmd                                                       #
+REM #                                                                        #
+REM # Copyright 2025 Diskuv, Inc.                                            #
+REM #                                                                        #
+REM # Licensed under the Open Software License version 3.0                   #
+REM # (the "License"); you may not use this file except in compliance        #
+REM # with the License. You may obtain a copy of the License at              #
+REM #                                                                        #
+REM #     https://opensource.org/license/osl-3-0-php/                        #
+REM #                                                                        #
+REM ##########################################################################
+REM Recommendation: Place this file in source control.
+REM
+REM Manifest-driven, self-updating dk0 launcher for Windows. Pure batch on the
+REM hot path -- PowerShell is used only as a last-resort download fallback (after
+REM curl and BITSADMIN), never for logic -- so it runs on locked-down machines.
+REM   1. download the pinned mlfront-signify verifier, check it against the
+REM      SHA-256 baked below (the anchor -- not the manifest, so no circularity);
+REM   2. verify the signify signature over the manifest with the baked pubkey;
+REM   3. read the manifest's dk0 SHA-256 (plain key=value, no JSON), download and
+REM      cache dk0.exe, then exec it.
+REM This file never rewrites itself.
+SETLOCAL ENABLEDELAYEDEXPANSION
+SET "DK_PROJECT_DIR=%~dp0"
+SET "DKCODER_PWD=%CD%"
+REM ===== BAKED TRUST ROOT (rotates rarely; updated only on key/verifier rotation) =====
+SET "SIGNIFY_PUBKEY_B64=RWTMq/GqeeJ06ACy7By/H05vvtpc3ZPEKlbnDm9fIQxpkgTV92is6YHD"
+SET "DK_CKSUM_SIGNIFY_WINDOWS_X86_64=ebe1aa87a3eb87ed6769782a31916fab72bbdf0ced22d6ddd9a7a455e23e2c68"
+REM windows_x86 (32-bit) mlfront-signify is not published at SIGNIFY_PKG_VER yet;
+REM the __ placeholder trips the not-provisioned guard below until a real checksum
+REM is baked here (matching the ci/dist/dk0 shell slot) so .\dk0.cmd and ./dk0
+REM light up together.
+SET "DK_CKSUM_SIGNIFY_WINDOWS_X86=__CKSUM_SIGNIFY_WINDOWS_X86__"
+REM The verifier is pinned by version+checksum and fetched from its GitLab package
+REM (a direct download, not the throttled listing API); the site serves only the
+REM signed manifest and the wrappers.
+SET "SIGNIFY_PKG_VER=2.4.2.271"
+IF "%DK0_BASE_URL%"=="" (SET "DK_BASE_URL=https://diskuv.com/dk") ELSE (SET "DK_BASE_URL=%DK0_BASE_URL%")
+REM ====================================================================================
+REM Detect the Windows architecture (WOW64-aware) and select its pinned verifier.
+REM A 32-bit process on 64-bit Windows reports PROCESSOR_ARCHITECTURE=x86 but has
+REM PROCESSOR_ARCHITEW6432 defined; genuine 32-bit Windows does not.
+SET "DK_ARCH=windows_x86_64"
+SET "DK_CKSUM_SIGNIFY=%DK_CKSUM_SIGNIFY_WINDOWS_X86_64%"
+IF /I "%PROCESSOR_ARCHITECTURE%"=="x86" IF NOT DEFINED PROCESSOR_ARCHITEW6432 (
+    SET "DK_ARCH=windows_x86"
+    SET "DK_CKSUM_SIGNIFY=%DK_CKSUM_SIGNIFY_WINDOWS_X86%"
+)
+IF "!DK_CKSUM_SIGNIFY:~0,2!"=="__" (
+    ECHO dk0: no pinned mlfront-signify checksum for !DK_ARCH! ^(launcher not provisioned^) 1>&2
+    EXIT /B 3
+)
+IF "%DKCODER_DATA_HOME%"=="" (SET "DK_DATA_HOME=%LOCALAPPDATA%\Programs\dk0") ELSE (SET "DK_DATA_HOME=%DKCODER_DATA_HOME%")
+SET "DK_VDIR=%DK_DATA_HOME%\verifier"
+IF NOT EXIST "%DK_VDIR%" MKDIR "%DK_VDIR%" >NUL 2>&1
+REM 1. Pinned verifier from GitLab, checked against the baked SHA-256 (the anchor).
+SET "DK_SIGNIFY=%DK_VDIR%\mlfront-signify-%DK_CKSUM_SIGNIFY%.exe"
+IF NOT EXIST "%DK_SIGNIFY%" (
+    CALL :fetch "https://gitlab.com/api/v4/projects/60486861/packages/generic/mlfront-signify/%SIGNIFY_PKG_VER%/mlfront-signify-!DK_ARCH!.exe" "%DK_SIGNIFY%"
+    IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+)
+CALL :sha256 "%DK_SIGNIFY%" DK_SIG_ACTUAL
+IF /I NOT "!DK_SIG_ACTUAL!"=="%DK_CKSUM_SIGNIFY%" (
+    ECHO dk0: mlfront-signify checksum mismatch ^(verifier not trusted^) 1>&2
+    EXIT /B 1
+)
+REM 2. Write the baked public key (pure batch; signify accepts the CRLF form).
+> "%DK_VDIR%\dk0.pub" ECHO untrusted comment: dk0 signify public key
+>> "%DK_VDIR%\dk0.pub" ECHO %SIGNIFY_PUBKEY_B64%
+REM 3. Read the dk.u pin: the version between quotes on the actual_version line.
+SET "DK_PIN="
+IF EXIST "%DK_PROJECT_DIR%dk.u" CALL :readpin
+REM --self-update handled by dk0.exe (it edits dk.u safely); see below after resolve.
+SET "DK_SELFUPDATE=0"
+IF "%~1"=="--self-update" SET "DK_SELFUPDATE=1"
+REM 4. Verify the manifest and resolve the version + dk0 checksum. Self-update and
+REM    an unpinned project both use the latest manifest.
+IF "%DK_SELFUPDATE%"=="1" (SET "DK_WANT=") ELSE (SET "DK_WANT=%DK_PIN%")
+CALL :getmanifest "%DK_WANT%"
+IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+IF "%DK_WANT%"=="" (
+    CALL :mval version DK_VER
+    IF "%DK_SELFUPDATE%"=="0" IF "%DK_PIN%"=="" ECHO dk0: no actual_version pin in dk.u; using latest !DK_VER! ^(run "dk0 --self-update" to pin^) 1>&2
+) ELSE (
+    SET "DK_VER=%DK_PIN%"
+)
+IF "!DK_VER!"=="" (ECHO dk0: could not resolve a dk0 version 1>&2 & EXIT /B 1)
+CALL :mval dk0_!DK_ARCH! DK_CKSUM
+IF "!DK_CKSUM!"=="" (ECHO dk0: manifest has no dk0 build for !DK_ARCH! ^(version !DK_VER!^) 1>&2 & EXIT /B 3)
+CALL :mval dk0_url_template DK_TMPL
+IF "!DK_TMPL!"=="" (ECHO dk0: manifest has no dk0_url_template ^(version !DK_VER!^) 1>&2 & EXIT /B 1)
+REM 5. Cache + download dk0.exe (version-keyed dir; never overwrite a running exe).
+SET "DK_EXEDIR=%DK_DATA_HOME%\dk0exe-!DK_VER!-!DK_ARCH!"
+IF NOT EXIST "!DK_EXEDIR!" MKDIR "!DK_EXEDIR!" >NUL 2>&1
+SET "DK_EXE=!DK_EXEDIR!\dk0.exe"
+SET "DK_NEED_EXE=1"
+IF EXIST "!DK_EXE!" (
+    CALL :sha256 "!DK_EXE!" DK_EXE_ACTUAL
+    IF /I "!DK_EXE_ACTUAL!"=="!DK_CKSUM!" SET "DK_NEED_EXE=0"
+)
+IF !DK_NEED_EXE! EQU 1 (
+    REM Resolve {version}/{arch}/{exe} in the verified dk0_url_template, then
+    REM allowlist the host before downloading.
+    SET "DK_URL=!DK_TMPL!"
+    SET "DK_URL=!DK_URL:{version}=%DK_VER%!"
+    SET "DK_URL=!DK_URL:{arch}=%DK_ARCH%!"
+    SET "DK_URL=!DK_URL:{exe}=.exe!"
+    CALL :allowhost "!DK_URL!"
+    IF !ERRORLEVEL! NEQ 0 (ECHO dk0: download host not allowlisted: !DK_URL! 1>&2 & EXIT /B 1)
+    CALL :fetch "!DK_URL!" "!DK_EXE!"
+    IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+    CALL :sha256 "!DK_EXE!" DK_EXE_ACTUAL
+    IF /I NOT "!DK_EXE_ACTUAL!"=="!DK_CKSUM!" (ECHO dk0: dk0.exe checksum mismatch 1>&2 & EXIT /B 1)
+)
+REM 6. Launcher store GC. Every dk0 version installs into its own dk0exe-*
+REM    directory and old versions accumulate forever. Mark the pinned version
+REM    (and the current verifier) as used, then remove version directories and
+REM    superseded verifier binaries no launcher has used in 30 days. Everything
+REM    here re-downloads on demand from its signed manifest, so deletion is
+REM    always safe; pruning must never break the launch, so every step
+REM    suppresses errors. Pure batch: the mtime bump is a create+delete of a
+REM    marker file (updates the directory timestamp), the verifier bump is the
+REM    batch copy-touch idiom, and the age test is FORFILES /D.
+>"!DK_EXEDIR!\.dk0-touch" ECHO OK
+DEL /Q "!DK_EXEDIR!\.dk0-touch" >NUL 2>&1
+COPY /B "%DK_SIGNIFY%"+,, "%DK_SIGNIFY%" >NUL 2>&1
+FORFILES /P "%DK_DATA_HOME%" /M dk0exe-* /D -30 /C "cmd /c if @isdir==TRUE rd /s /q @path" >NUL 2>&1
+FORFILES /P "%DK_VDIR%" /M mlfront-signify-*.exe /D -30 /C "cmd /c del /q @path" >NUL 2>&1
+REM 7. Run it (same contract as the POSIX wrapper). dk0 --self-update rewrites the
+REM    dk.u actual_version line itself (dk0.exe edits dk.u safely; this launcher
+REM    never does file surgery on dk.u).
+SET "DKCODER_ARG0=dk0"
+IF "%DK_SELFUPDATE%"=="1" (
+    REM dk0.exe repins the dk.u actual_version line to the resolved (latest) version.
+    "!DK_EXE!" -isystem "%DK_PROJECT_DIR%etc\dk\i" self-update !DK_VER!
+) ELSE (
+    "!DK_EXE!" -isystem "%DK_PROJECT_DIR%etc\dk\i" %*
+)
+EXIT /B %ERRORLEVEL%
+REM ================= subroutines =================
+REM :fetch URL DEST  -- download without a checksum (the manifest is verified by
+REM signature). curl first, then BITSADMIN, then PowerShell -- so no PowerShell
+REM dependency on machines that ship curl (Windows 10 1803+).
+:fetch
+IF EXIST "%SystemRoot%\System32\curl.exe" (
+    "%SystemRoot%\System32\curl.exe" -fsSL "%~1" -o "%~2" && EXIT /B 0
+)
+BITSADMIN /TRANSFER dk0fetch /DOWNLOAD /PRIORITY FOREGROUND "%~1" "%~2" >NUL 2>&1 && EXIT /B 0
+powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -UseBasicParsing -Uri '%~1' -OutFile '%~2'" >NUL 2>&1 && EXIT /B 0
+ECHO dk0: could not download %~1 1>&2
+EXIT /B 1
+REM :sha256 FILE OUTVAR  -- set OUTVAR to the lowercased SHA-256 of FILE.
+:sha256
+SET "%~2="
+FOR /F "usebackq tokens=* delims=" %%H IN (`certutil -hashfile "%~1" SHA256 ^| findstr /R "^[0-9a-fA-F][0-9a-fA-F]*$"`) DO (
+    IF NOT DEFINED %~2 SET "%~2=%%H"
+)
+IF DEFINED %~2 SET "%~2=!%~2: =!"
+EXIT /B 0
+REM :getmanifest VER  -- fetch manifest[-VER].txt + .sig into %DK_VDIR%, signify-verify.
+:getmanifest
+IF "%~1"=="" (SET "DK_MURL=%DK_BASE_URL%/manifest.txt") ELSE (SET "DK_MURL=%DK_BASE_URL%/manifest-%~1.txt")
+CALL :fetch "!DK_MURL!" "%DK_VDIR%\manifest"
+IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+CALL :fetch "!DK_MURL!.sig" "%DK_VDIR%\manifest.sig"
+IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+"%DK_SIGNIFY%" -V -q -p "%DK_VDIR%\dk0.pub" -m "%DK_VDIR%\manifest" -x "%DK_VDIR%\manifest.sig"
+IF !ERRORLEVEL! NEQ 0 (ECHO dk0: manifest signature INVALID for !DK_MURL! -- refusing to continue 1>&2 & EXIT /B 1)
+EXIT /B 0
+REM :mval KEY OUTVAR  -- read key=value from the verified %DK_VDIR%\manifest.
+:mval
+SET "%~2="
+FOR /F "usebackq tokens=1,* delims==" %%A IN ("%DK_VDIR%\manifest") DO (
+    IF /I "%%A"=="%~1" SET "%~2=%%B"
+)
+EXIT /B 0
+REM :allowhost URL  -- EXIT /B 0 if URL starts with an allowlisted host prefix,
+REM else 1. Defense-in-depth over the signify-verified template (a signed-but-
+REM malicious manifest still cannot redirect the download off a known host).
+:allowhost
+ECHO %~1| findstr /B /L /C:"https://github.com/dkpkg/" /C:"https://gitlab.com/api/v4/projects/60486861/" >NUL 2>&1
+EXIT /B !ERRORLEVEL!
+REM :readpin  -- set DK_PIN to the version between the quotes on the dk.u
+REM actual_version line. The caret-escaped FOR options are how batch uses a
+REM double-quote as a delimiter (a quoted "delims=^"" options string does not work).
+:readpin
+FOR /F usebackq^ tokens^=2^ delims^=^" %%V IN (`findstr /L /C:"actual_version" "%DK_PROJECT_DIR%dk.u"`) DO SET "DK_PIN=%%V"
+EXIT /B 0

dk1 ADDED Viewed

	@@ -0,0 +1,864 @@

+#!/bin/sh
+##########################################################################
+# File: mlfront/dk1                                                      #
+#                                                                        #
+# Copyright 2025 Diskuv, Inc.                                            #
+#                                                                        #
+# Licensed under the Open Software License version 3.0                   #
+# (the "License"); you may not use this file except in compliance        #
+# with the License. You may obtain a copy of the License at              #
+#                                                                        #
+#     https://opensource.org/license/osl-3-0-php/                        #
+#                                                                        #
+##########################################################################
+# Recommendation: Place this file in source control.
+#
+# Invoking: ./dk1
+#   That works in Powershell on Windows, and in Unix. Copy-and-paste works!
+#
+# Purpose: Install dk1 if not present. Then invoke dk1.
+# The cksum_signify_* constants below are read indirectly, through the dynamic
+# eval lookup in dk_verify_manifest that builds the variable name from the host
+# ABI; that reference is invisible to the linter, so the file-wide directive on
+# the next line turns off its unused-variable warning.
+# shellcheck disable=SC2034
+set -euf
+# ===== BAKED TRUST ROOT (rotates rarely; updated only on key/verifier rotation) =====
+# The dk1 version is NOT baked here. It is pinned per project by a
+#   %% actual_version("X.Y.Z.W")
+# line in dk.u's `## workspace` section (or the latest signed manifest if absent).
+# dk1 and its checksum come from a signify-signed manifest verified at runtime:
+#   1. download the pinned mlfront-signify verifier from its GitLab package (by
+#      the baked version below), check it against the SHA-256 baked below (the
+#      anchor -- not the manifest, so no circularity);
+#   2. verify the signify signature over the manifest (manifest.txt) with the
+#      baked public key;
+#   3. only then read the manifest's per-arch dk1 SHA-256.
+# This file never rewrites itself (Windows batch/exe safety); `dk1 --self-update`
+# edits only the dk.u actual_version line, and key rotation is followed at
+# verify-time via the manifest's continuation chain.
+SIGNIFY_PUBKEY_B64="RWTMq/GqeeJ06ACy7By/H05vvtpc3ZPEKlbnDm9fIQxpkgTV92is6YHD"
+# The verifier is pinned by version+checksum and fetched from GitLab (a direct
+# package download, not the throttled listing API); the site serves only the
+# signed manifest and the wrappers.
+signify_pkg_ver="2.4.2.271"
+cksum_signify_linux_x86_64="9701ed5821ea57114890f2d54381ee29742b45292ea0c8a259b0d4187c728a4d"
+cksum_signify_linux_x86="533ec71ef0c6081c57850c840d29df5ca8efd3c2722b54dc77c14224dda0c418"
+cksum_signify_darwin_arm64="89513c94add01ef5e15fa4c3a171755cd3eb783f552b9d4a3dedd009fa89a062"
+cksum_signify_darwin_x86_64="875ba2f6840bb705ed2346c9c3a165ee5fdfde559df4b9adfa0c6f915043eade"
+cksum_signify_windows_x86_64="ebe1aa87a3eb87ed6769782a31916fab72bbdf0ced22d6ddd9a7a455e23e2c68"
+# windows_x86 (32-bit) mlfront-signify is not published at signify_pkg_ver yet.
+# Keep the slot maintained: the __ placeholder trips the not-provisioned guard
+# in dk_verify_manifest until a real checksum is baked here (and dk1.cmd carries
+# the matching x86 slot), so ./dk1 and .\dk1.cmd light up together.
+cksum_signify_windows_x86="__CKSUM_SIGNIFY_WINDOWS_X86__"
+DK_BASE_URL="${DK1_BASE_URL:-https://diskuv.com/dk}"
+# ====================================================================================
+dk_pwd=$PWD
+# Get the dk project tree
+DK_PROJECT_DIR=$(dirname "$0")
+DK_PROJECT_DIR=$(cd "$DK_PROJECT_DIR" && pwd)
+# --- Windows ---
+# There is no shunt to dk1.cmd here. The block that used to live here required
+# [ -x /usr/bin/cmd ], and no MSYS2, Cygwin, or Git Bash layout ships a `cmd` in
+# /usr/bin, so it never fired on any host. This script handles Windows directly
+# instead: autodetect_buildhost_arch resolves windows_x86_64 / windows_x86 via
+# is_unixy_windows_build_machine, dk_extexe adds the .exe suffix, the data home
+# below shares dk1.cmd's store, and MSYS converts POSIX paths in argv when
+# exec'ing the native dk1.exe. A shunt could not be the whole answer anyway: a
+# global install.sh install ships no dk1.cmd to shunt to.
+# --- Quiet mode detection ---
+DKCODER_QUIET=0
+_DKEXE_OPTIONS=
+run_maybe_quiet() {
+  "$@" >&2 # Always redirect stdout to stderr in this script
+}
+printf_maybe_quiet() {
+  # shellcheck disable=SC2059
+  printf "$@" >&2
+}
+# --- Launcher helpers (not from crossplatform-functions.sh) ---
+# [dk_prog_path NAME] prints the path to NAME, or nothing when it is not
+# installed. Absolute locations first, so the hardened Linux/macOS behavior is
+# unchanged, then PATH. Git Bash (Git for Windows) ships curl at
+# /mingw64/bin/curl and has no /usr/bin/curl or /bin/curl, so without the PATH
+# fallback the launcher finds no downloader at all and every fetch fails.
+# ci/dist/install.sh already resolves curl/wget through PATH for the same reason.
+# This does not weaken the trust model: the mlfront-signify verifier is pinned by
+# the SHA-256 baked above, the manifest is signify-verified, and every binary is
+# checked against a signed checksum, so a hostile PATH curl can deny service but
+# cannot substitute an artifact.
+# The `|| true` matters under `set -e`: `command -v` exits nonzero for a missing
+# program, and a bare assignment would propagate that status and abort the script.
+dk_prog_path() {
+  if [ -x "/usr/bin/$1" ]; then printf '%s' "/usr/bin/$1"
+  elif [ -x "/bin/$1" ]; then printf '%s' "/bin/$1"
+  else command -v "$1" 2>/dev/null || true
+  fi
+}
+# Every download path funnels here when neither curl nor wget resolved. Name what
+# was searched and the escape hatch; a bare "not available" leaves the reader with
+# nothing to act on.
+dk_no_downloader() {
+  echo "FATAL: no curl or wget found (searched /usr/bin, /bin, then PATH)" >&2
+  echo "  ...: install curl or wget, or set DKMLSYS_CURL=/full/path/to/curl" >&2
+  exit 107
+}
+# --- Imports of dkml-runtime-common's crossplatform-functions.sh ---
+# Changes:
+# 1. In download_file() use [ "${DKCODER_QUIET:-}" -eq 1 ]
+# 2. In log_trace() replace non-FATAL `printf ... >&2` with `printf_maybe_quiet ...`
+# 3. In sha256check() all shasum/* use --quiet option (this should be upstreamed)
+# 4. In autodetect_system_binaries() curl and wget resolve through dk_prog_path
+#    (above), which falls back to PATH when the absolute locations miss
+# Get standard locations of Unix system binaries like `/usr/bin/mv` (or `/bin/mv`).
+#
+# Will not return anything in `/usr/local/bin` or `/usr/sbin`. Use when you do not
+# know whether the PATH has been set correctly, or when you do not know if the
+# system binary exists.
+#
+# At some point in the future, this function will error out if the required system binaries
+# do not exist. Most system binaries are common to all Unix/Linux/macOS installations but
+# some (like `comm`) may need to be installed for proper functioning of DKML.
+#
+# Outputs:
+# - env:DKMLSYS_MV - Location of `mv`
+# - env:DKMLSYS_CHMOD - Location of `chmod`
+# - env:DKMLSYS_UNAME - Location of `uname`
+# - env:DKMLSYS_ENV - Location of `env`
+# - env:DKMLSYS_AWK - Location of `awk`
+# - env:DKMLSYS_SED - Location of `sed`
+# - env:DKMLSYS_COMM - Location of `comm`
+# - env:DKMLSYS_INSTALL - Location of `install`
+# - env:DKMLSYS_RM - Location of `rm`
+# - env:DKMLSYS_SORT - Location of `sort`
+# - env:DKMLSYS_CAT - Location of `cat`
+# - env:DKMLSYS_STAT - Location of `stat`
+# - env:DKMLSYS_GREP - Location of `grep`
+# - env:DKMLSYS_CURL - Location of `curl` (empty if not found)
+# - env:DKMLSYS_WGET - Location of `wget` (empty if not found)
+# - env:DKMLSYS_TR - Location of `tr`
+autodetect_system_binaries() {
+    if [ -z "${DKMLSYS_MV:-}" ]; then
+        if [ -x /usr/bin/mv ]; then
+            DKMLSYS_MV=/usr/bin/mv
+        else
+            DKMLSYS_MV=/bin/mv
+        fi
+    fi
+    if [ -z "${DKMLSYS_CHMOD:-}" ]; then
+        if [ -x /usr/bin/chmod ]; then
+            DKMLSYS_CHMOD=/usr/bin/chmod
+        else
+            DKMLSYS_CHMOD=/bin/chmod
+        fi
+    fi
+    if [ -z "${DKMLSYS_UNAME:-}" ]; then
+        if [ -x /usr/bin/uname ]; then
+            DKMLSYS_UNAME=/usr/bin/uname
+        else
+            DKMLSYS_UNAME=/bin/uname
+        fi
+    fi
+    if [ -z "${DKMLSYS_ENV:-}" ]; then
+        if [ -x /usr/bin/env ]; then
+            DKMLSYS_ENV=/usr/bin/env
+        else
+            DKMLSYS_ENV=/bin/env
+        fi
+    fi
+    if [ -z "${DKMLSYS_AWK:-}" ]; then
+        if [ -x /usr/bin/awk ]; then
+            DKMLSYS_AWK=/usr/bin/awk
+        else
+            DKMLSYS_AWK=/bin/awk
+        fi
+    fi
+    if [ -z "${DKMLSYS_SED:-}" ]; then
+        if [ -x /usr/bin/sed ]; then
+            DKMLSYS_SED=/usr/bin/sed
+        else
+            DKMLSYS_SED=/bin/sed
+        fi
+    fi
+    if [ -z "${DKMLSYS_COMM:-}" ]; then
+        if [ -x /usr/bin/comm ]; then
+            DKMLSYS_COMM=/usr/bin/comm
+        else
+            DKMLSYS_COMM=/bin/comm
+        fi
+    fi
+    if [ -z "${DKMLSYS_INSTALL:-}" ]; then
+        if [ -x /usr/bin/install ]; then
+            DKMLSYS_INSTALL=/usr/bin/install
+        else
+            DKMLSYS_INSTALL=/bin/install
+        fi
+    fi
+    if [ -z "${DKMLSYS_RM:-}" ]; then
+        if [ -x /usr/bin/rm ]; then
+            DKMLSYS_RM=/usr/bin/rm
+        else
+            DKMLSYS_RM=/bin/rm
+        fi
+    fi
+    if [ -z "${DKMLSYS_SORT:-}" ]; then
+        if [ -x /usr/bin/sort ]; then
+            DKMLSYS_SORT=/usr/bin/sort
+        else
+            DKMLSYS_SORT=/bin/sort
+        fi
+    fi
+    if [ -z "${DKMLSYS_CAT:-}" ]; then
+        if [ -x /usr/bin/cat ]; then
+            DKMLSYS_CAT=/usr/bin/cat
+        else
+            DKMLSYS_CAT=/bin/cat
+        fi
+    fi
+    if [ -z "${DKMLSYS_STAT:-}" ]; then
+        if [ -x /usr/bin/stat ]; then
+            DKMLSYS_STAT=/usr/bin/stat
+        else
+            DKMLSYS_STAT=/bin/stat
+        fi
+    fi
+    if [ -z "${DKMLSYS_GREP:-}" ]; then
+        if [ -x /usr/bin/grep ]; then
+            DKMLSYS_GREP=/usr/bin/grep
+        else
+            DKMLSYS_GREP=/bin/grep
+        fi
+    fi
+    if [ -z "${DKMLSYS_CURL:-}" ]; then DKMLSYS_CURL=$(dk_prog_path curl); fi
+    if [ -z "${DKMLSYS_WGET:-}" ]; then DKMLSYS_WGET=$(dk_prog_path wget); fi
+    if [ -z "${DKMLSYS_TR:-}" ]; then
+        if [ -x /usr/bin/tr ]; then
+            DKMLSYS_TR=/usr/bin/tr
+        else
+            DKMLSYS_TR=/bin/tr
+        fi
+    fi
+    export DKMLSYS_MV DKMLSYS_CHMOD DKMLSYS_UNAME DKMLSYS_ENV DKMLSYS_AWK DKMLSYS_SED DKMLSYS_COMM DKMLSYS_INSTALL
+    export DKMLSYS_RM DKMLSYS_SORT DKMLSYS_CAT DKMLSYS_STAT DKMLSYS_GREP DKMLSYS_CURL DKMLSYS_WGET DKMLSYS_TR
+}
+# Is a Windows build machine if we are in a MSYS2 or Cygwin environment.
+#
+# Better alternatives
+# -------------------
+#
+# 1. If you are checking to see if you should do a cygpath, then just guard it
+#    like so:
+#       if [ -x /usr/bin/cygpath ]; then
+#           do_something $(/usr/bin/cygpath ...) ...
+#       fi
+#    This clearly guards what you are about to do (cygpath) with what you will
+#    need (cygpath).
+# 2. is_arg_windows_platform
+is_unixy_windows_build_machine() {
+    if is_msys2_msys_build_machine || is_cygwin_build_machine; then
+        return 0
+    fi
+    return 1
+}
+# Is a MSYS2 environment with the MSYS or MINGW64 subsystem?
+# * MSYS2 can also do MinGW 32-bit and 64-bit subsystems. Used by Diskuv OCaml
+# * MINGW64 used by Git Bash (aka. GitHub Actions `shell: bash`)
+# https://www.msys2.org/docs/environments/
+is_msys2_msys_build_machine() {
+    if [ -e /usr/bin/msys-2.0.dll ] && {
+        [ "${MSYSTEM:-}" = "MSYS" ] || [ "${MSYSTEM:-}" = "MINGW64" ] || [ "${MSYSTEM:-}" = "UCRT64" ] || [ "${MSYSTEM:-}" = "CLANG64" ] || [ "${MSYSTEM:-}" = "MINGW32" ] || [ "${MSYSTEM:-}" = "CLANG32" ] || [ "${MSYSTEM:-}" = "CLANGARM64" ]
+    }; then
+        return 0
+    fi
+    return 1
+}
+is_cygwin_build_machine() {
+    if [ -e /usr/bin/cygwin1.dll ]; then
+        return 0
+    fi
+    return 1
+}
+# Tries to find the host ABI.
+#
+# Beware: This function uses `uname` probing may be inaccurate for dual-arch
+# CPUs like Apple Silicon with Rosetta.
+#
+# Inputs:
+# - env:DKML_HOST_ABI - Optional but recommended. If set, then BUILDHOST_ARCH will be set to the same.
+#
+# Outputs:
+# - env:BUILDHOST_ARCH will contain the host ABI.
+autodetect_buildhost_arch() {
+    if [ -n "${DKML_HOST_ABI:-}" ]; then
+        BUILDHOST_ARCH=$DKML_HOST_ABI
+    else
+        # Set DKMLSYS_*
+        autodetect_system_binaries
+        autodetect_buildhost_arch_SYSTEM=$("$DKMLSYS_UNAME" -s)
+        autodetect_buildhost_arch_MACHINE=$("$DKMLSYS_UNAME" -m)
+        # list from https://en.wikipedia.org/wiki/Uname and https://stackoverflow.com/questions/45125516/possible-values-for-uname-m
+        case "${autodetect_buildhost_arch_SYSTEM}-${autodetect_buildhost_arch_MACHINE}" in
+            Linux-armv7*)
+                BUILDHOST_ARCH=linux_arm32v7;;
+            Linux-armv6* | Linux-arm)
+                BUILDHOST_ARCH=linux_arm32v6;;
+            Linux-aarch64 | Linux-arm64 | Linux-armv8*)
+                BUILDHOST_ARCH=linux_arm64;;
+            Linux-i386 | Linux-i686)
+                BUILDHOST_ARCH=linux_x86;;
+            Linux-x86_64)
+                BUILDHOST_ARCH=linux_x86_64
+                # uname -m reports the KERNEL machine, so a 32-bit userland on
+                # a 64-bit kernel (ex. an i386 container on an amd64 host)
+                # still says x86_64 -- but a 64-bit dk1 cannot run there. The
+                # userland's own ELF class is the truth: byte 5 of /bin/sh is
+                # 1 for ELFCLASS32. od(1) is POSIX but not guaranteed present;
+                # without it, or on a 64-bit userland, the kernel's answer
+                # stands. test's numeric -eq tolerates od's leading
+                # whitespace; the redirected test guards non-numeric output.
+                autodetect_buildhost_arch_ELFCLASS=
+                if command -v od >/dev/null 2>&1; then
+                    autodetect_buildhost_arch_ELFCLASS=$(od -An -td1 -j4 -N1 /bin/sh 2>/dev/null)
+                fi
+                if [ "${autodetect_buildhost_arch_ELFCLASS:-2}" -eq 1 ] 2>/dev/null; then
+                    BUILDHOST_ARCH=linux_x86
+                # musl-based Linux (ex. alpine) is not a supported dk1 ABI yet;
+                # there is no musl dk1 build. Fail fast with a clear message
+                # instead of reaching a confusing "not provisioned" error later.
+                # A user who knows better can still force DKML_HOST_ABI. The musl
+                # dynamic loader path is the reliable marker; musl's ldd
+                # identifying itself is the fallback.
+                elif [ -e /lib/ld-musl-x86_64.so.1 ] \
+                  || { ldd --version 2>&1 | grep -qi musl; } 2>/dev/null; then
+                    printf "%s\n" "FATAL: musl-based Linux (e.g. Alpine) is not supported yet; dk1 needs a glibc-based distro" >&2
+                    exit 1
+                fi
+                ;;
+            Darwin-arm64)
+                BUILDHOST_ARCH=darwin_arm64;;
+            Darwin-x86_64)
+                BUILDHOST_ARCH=darwin_x86_64;;
+            *-i386 | *-i686)
+                if is_unixy_windows_build_machine; then
+                    BUILDHOST_ARCH=windows_x86
+                else
+                    printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
+                    exit 1
+                fi
+                ;;
+            *-x86_64)
+                if is_unixy_windows_build_machine; then
+                    BUILDHOST_ARCH=windows_x86_64
+                else
+                    printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
+                    exit 1
+                fi
+                ;;
+            *)
+                # Since:
+                # 1) MSYS2 does not run on ARM/ARM64 (https://www.msys2.org/docs/environments/)
+                # 2) MSVC does not use ARM/ARM64 as host machine (https://docs.microsoft.com/en-us/cpp/build/building-on-the-command-line?view=msvc-160)
+                # we do not support Windows ARM/ARM64 as a build machine
+                printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
+                exit 1
+                ;;
+        esac
+    fi
+}
+# A function that will try to print an ISO8601 timestamp, but will fallback to
+# the system default. Always uses UTC timezone.
+try_iso8601_timestamp() {
+    date -u -Iseconds 2>/dev/null || TZ=UTC date
+}
+# A function that will print the command and possibly time it (if and only if it uses a full path to
+# an executable, so that 'time' does not fail on internal shell functions).
+# If --return-error-code is the first argument or LOG_TRACE_RETURN_ERROR_CODE=ON, then instead of exiting the
+# function will return the error code.
+log_trace() {
+    log_trace_RETURN=${LOG_TRACE_RETURN_ERROR_CODE:-OFF}
+    log_trace_1="$1"
+    if [ "$log_trace_1" = "--return-error-code" ]; then
+        shift
+        log_trace_RETURN=ON
+    fi
+    if [ "${DKML_BUILD_TRACE:-OFF}" = ON ]; then
+        printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "+ $*"
+        if [ -x "$1" ]; then
+            time "$@"
+        else
+            "$@"
+        fi
+    else
+        # use judgement so we essentially have log at an INFO level
+        case "$1" in
+        rm|cp)
+            # debug level. only show when DKML_BUILD_TRACE=ON
+            ;;
+        git|make|ocaml_configure|ocaml_make|make_host|make_target)
+            # info level. and can show entire command without polluting the screen
+            printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "$*"
+            ;;
+        *)  printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "$1"
+        esac
+        "$@"
+    fi
+    log_trace_ec="$?"
+    if [ "$log_trace_ec" -ne 0 ]; then
+        if [ "$log_trace_RETURN" = ON ]; then
+            return "$log_trace_ec"
+        else
+            printf "FATAL: Command failed with exit code %s: %s\n" "$log_trace_ec" "$*" >&2
+            exit "$log_trace_ec"
+        fi
+    fi
+}
+# [sha256compute FILE] writes the SHA256 checksum (hex encoded) of file FILE to the standard output.
+sha256compute() {
+    sha256compute_FILE="$1"
+    shift
+    # For reasons unclear doing the following in MSYS2:
+    #   sha256sum 'Z:\source\README.md'
+    # will produce a backslash like:
+    #   \5518c76ed7234a153941fb7bc94b6e91d9cb8f1c4e22daf169a59b5878c3fc8a *Z:\\source\\README.md
+    # So always cygpath the filename if available
+    if [ -x /usr/bin/cygpath ]; then
+        sha256compute_FILE=$(/usr/bin/cygpath -a "$sha256compute_FILE")
+    fi
+    autodetect_system_binaries
+    if [ -x /usr/bin/shasum ]; then # macOS, OpenBSD, Debian
+        # CODESITE #1 (duplicates elsewhere).
+        # On Debian shasum is a perl script, and perl needs locale settings or it will complain.
+        # Confer: https://www.thomas-krenn.com/en/wiki/Perl_warning_Setting_locale_failed_in_Debian
+        # Confer: https://stackoverflow.com/a/52004330/21513816
+        #   shellcheck disable=SC2016
+        LC_ALL=C /usr/bin/shasum -a 256 "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
+    elif [ -x /usr/bin/sha256sum ]; then # Linux, MSYS2
+        #   shellcheck disable=SC2016
+        /usr/bin/sha256sum "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
+    elif [ -x /sbin/sha256 ]; then # FreeBSD
+        #   shellcheck disable=SC2016
+        /sbin/sha256 -r "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
+    else
+        printf "FATAL: %s\n" "No sha256 checksum utility found" >&2
+        exit 107
+    fi
+}
+# [sha256check FILE SUM] checks that the file FILE has a SHA256 checksum (hex encoded) of SUM.
+# The function will return nonzero (and exit with failure if `set -e` is enabled) if the checksum does not match.
+sha256check() {
+    sha256check_FILE="$1"
+    shift
+    sha256check_SUM="$1"
+    shift
+    if [ -x /usr/bin/shasum ]; then # macOS, OpenBSD, Debian
+        # CODESITE #1 (duplicates elsewhere).
+        # On Debian shasum is a perl script, and perl needs locale settings or it will complain.
+        # Confer: https://www.thomas-krenn.com/en/wiki/Perl_warning_Setting_locale_failed_in_Debian
+        # Confer: https://stackoverflow.com/a/52004330/21513816
+        # Note: shasum 5.96 (ex. conanio/gcc7:1.64.1) has no --quiet option.
+        #   shellcheck disable=SC2016
+        printf "%s  %s" "$sha256check_SUM" "$sha256check_FILE" | LC_ALL=C /usr/bin/shasum -a 256 -c >&2
+    elif [ -x /usr/bin/sha256sum ]; then # Linux, MSYS2
+        # Note: BusyBox v1.35.0 sha256sum has no --quiet option.
+        printf "%s  %s" "$sha256check_SUM" "$sha256check_FILE" | /usr/bin/sha256sum -c >&2
+    elif [ -x /sbin/sha256 ]; then # FreeBSD
+        /sbin/sha256 --quiet -c "$sha256check_SUM" "$sha256check_FILE" >&2
+    else
+        printf "FATAL: %s\n" "No sha256 checksum utility found" >&2
+        # REMOVEME!
+        if [ -d /sbin ]; then printf "/sbin:\n" >&2; ls /sbin >&2; fi
+        if [ -d /usr/sbin ]; then printf "/usr/sbin:\n" >&2; ls /usr/sbin >&2; fi
+        if [ -d /bin ]; then printf "/bin:\n" >&2; ls /bin >&2; fi
+        if [ -d /usr/bin ]; then printf "/usr/bin:\n" >&2; ls /usr/bin >&2; fi
+        exit 107
+    fi
+}
+# Echo --https-only if this wget supports it (BusyBox wget does not), so a
+# redirect cannot downgrade the transfer off HTTPS wherever the option exists.
+dk_wget_https_only() {
+  if "$DKMLSYS_WGET" --help 2>&1 | grep -q -- --https-only; then printf '%s' '--https-only'; fi
+}
+# [downloadfile URL FILE SUM] downloads from URL into FILE and verifies the SHA256 checksum of SUM.
+# If the FILE already exists with the correct checksum it is not redownloaded.
+# The function will exit with failure if the checksum does not match.
+# curl pins HTTPS end to end (--proto '=https' + --proto-redir '=https') with a
+# TLS 1.2 floor, and -f fails on an HTTP error page instead of saving it.
+downloadfile() {
+    downloadfile_URL="$1"
+    shift
+    downloadfile_FILE="$1"
+    shift
+    downloadfile_SUM="$1"
+    shift
+    # Set DKMLSYS_*
+    autodetect_system_binaries
+    # Quick exit if exists and checksum verified. Do not display
+    # anything (even the checksum output) since this is the normal scenario
+    # that can run a billion times. The checksum verification for the
+    # download (if this fails) will not be silenced.
+    if [ -e "$downloadfile_FILE" ]; then
+        if sha256check "$downloadfile_FILE" "$downloadfile_SUM" > /dev/null 2>&1; then
+            return 0
+        else
+            $DKMLSYS_RM -f "$downloadfile_FILE"
+        fi
+    fi
+    printf_maybe_quiet "... %s %s\n" "Downloading" "$downloadfile_URL"
+    if [ "${CI:-}" = true ] || [ "${DKCODER_QUIET:-}" -eq 1 ]; then
+        if [ -n "$DKMLSYS_CURL" ]; then
+            log_trace "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL "$downloadfile_URL" -o "$downloadfile_FILE".tmp
+        elif [ -n "$DKMLSYS_WGET" ]; then
+            # shellcheck disable=SC2046 # prints one flag or nothing; must expand to zero words
+            log_trace "$DKMLSYS_WGET" $(dk_wget_https_only) -q -O "$downloadfile_FILE".tmp "$downloadfile_URL"
+        else
+            dk_no_downloader
+        fi
+    else
+        if [ -n "$DKMLSYS_CURL" ]; then
+            log_trace "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fL "$downloadfile_URL" -o "$downloadfile_FILE".tmp
+        elif [ -n "$DKMLSYS_WGET" ]; then
+            # shellcheck disable=SC2046 # prints one flag or nothing; must expand to zero words
+            log_trace "$DKMLSYS_WGET" $(dk_wget_https_only) -O "$downloadfile_FILE".tmp "$downloadfile_URL"
+        else
+            dk_no_downloader
+        fi
+    fi
+    printf_maybe_quiet "\n... %s %s\n" "Verifying" "$downloadfile_URL"
+    if ! sha256check "$downloadfile_FILE".tmp "$downloadfile_SUM"; then
+        printf "%s\n" "FATAL: Encountered a corrupted or compromised download from $downloadfile_URL" >&2
+        exit 1
+    fi
+    printf_maybe_quiet "\n"
+    $DKMLSYS_MV "$downloadfile_FILE".tmp "$downloadfile_FILE"
+}
+# End import
+# ---------------------------------------------------------------------------
+# --- Environment detection ---
+# Set DKMLSYS_*
+autodetect_system_binaries
+# Find host ABI. Set in BUILDHOST_ARCH
+autodetect_buildhost_arch
+# --- data home ---
+tools_dir=
+tools_name=dk1
+#   1. Check DKCODER_DATA_HOME environment variable.
+if [ -z "$tools_dir" ] && [ -n "${DKCODER_DATA_HOME:-}" ]; then
+  install -d "$DKCODER_DATA_HOME"
+  tools_dir="$DKCODER_DATA_HOME"
+fi
+#   2. Check if CI since many CI providers can only cache content in a subdirectory
+#      of the project.
+if [ -z "$tools_dir" ] && [ "${CI:-}" = true ]; then
+  install -d "$DK_PROJECT_DIR/.z-dk/tools"
+  tools_dir="$DK_PROJECT_DIR/.z-dk/tools"
+fi
+#   2b. On Windows (Git Bash / MSYS2 / Cygwin) use the SAME store as dk1.cmd,
+#      %LOCALAPPDATA%\Programs\dk1, so a project driven from both PowerShell and
+#      a POSIX shell shares one cache instead of downloading every build twice.
+#      This sits after the CI check on purpose: dk1.cmd has no CI branch, but a
+#      Windows CI job driving ./dk1 from bash still wants the in-project cache.
+#      LOCALAPPDATA holds a native Windows path (MSYS does not convert
+#      environment variables), so cygpath it; needing cygpath also scopes this
+#      to MSYS/Cygwin.
+if [ -z "$tools_dir" ] && [ -n "${COMSPEC:-}" ] && [ -n "${LOCALAPPDATA:-}" ] && [ -x /usr/bin/cygpath ]; then
+  tools_dir_LOCALAPPDATA=$(/usr/bin/cygpath -au "$LOCALAPPDATA")
+  if [ -w "$tools_dir_LOCALAPPDATA" ]; then
+    install -d "$tools_dir_LOCALAPPDATA/Programs/$tools_name"
+    tools_dir="$tools_dir_LOCALAPPDATA/Programs/$tools_name"
+  fi
+fi
+#   3. Check in locations rooted under /opt/diskuv
+#      We look under a /opt/diskuv early because
+#      - Especially important for WSL2 to use a pure Linux filesystem (ext4) for
+#        best performance.
+#      - Using a canonical location (especially /opt/diskuv/usr/share) makes
+#        it easy to use CMake presets for non-Windows hosts.
+if [ -z "$tools_dir" ] && [ -n "${XDG_DATA_HOME:-}" ] && [ -w "/opt/diskuv/$XDG_DATA_HOME" ]; then
+  install -d "/opt/diskuv/$XDG_DATA_HOME/$tools_name"
+  tools_dir="/opt/diskuv/$XDG_DATA_HOME/$tools_name"
+fi
+if [ -z "$tools_dir" ] && [ -n "${HOME:-}" ] && [ -w "/opt/diskuv/$HOME" ]; then
+  install -d "/opt/diskuv/$HOME/.local/share/$tools_name"
+  tools_dir="/opt/diskuv/$HOME/.local/share/$tools_name"
+fi
+if [ -z "$tools_dir" ] && [ -w "/opt/diskuv/usr/share" ]; then
+  install -d "/opt/diskuv/usr/share/$tools_name"
+  tools_dir="/opt/diskuv/usr/share/$tools_name"
+fi
+#   4. Check in the conventional locations rooted under /
+if [ -z "$tools_dir" ] && [ -n "${XDG_DATA_HOME:-}" ] && [ -w "$XDG_DATA_HOME" ]; then
+  install -d "$XDG_DATA_HOME/$tools_name"
+  tools_dir="$XDG_DATA_HOME/$tools_name"
+fi
+if [ -z "$tools_dir" ] && [ -n "${HOME:-}" ] && [ -w "$HOME" ]; then
+  install -d "$HOME/.local/share/$tools_name"
+  tools_dir="$HOME/.local/share/$tools_name"
+fi
+#   5. Validate
+if [ -z "$tools_dir" ]; then
+  echo "FATAL: Could not find a location to install DkCoder." >&2
+  echo "  ...: Make sure you have a home directory and that it is write-able, or define" >&2
+  echo "  ...: the environment variable XDG_DATA_HOME in a shell profile script after" >&2
+  echo "  ...: creating the \$XDG_DATA_HOME directory." >&2
+  exit 2
+fi
+# --- Tool downloads and installs ---
+# PREREQS
+# -------
+install_linux_prog() {
+  install_linux_prog_NAME=$1
+  shift
+  install_linux_prog_PKG=$1
+  shift
+  install_linux_prog_ALPINE_PKG=$1
+  shift
+  if [ -x "/usr/bin/$install_linux_prog_NAME" ]; then
+    export DK_PROG_INSTALLED_LOCATION="/usr/bin/$install_linux_prog_NAME"
+  elif [ -x "/bin/$install_linux_prog_NAME" ]; then
+    export DK_PROG_INSTALLED_LOCATION="/bin/$install_linux_prog_NAME"
+  else
+    if [ -x /sbin/apk ]; then
+      if [ "$(id -u)" -eq 0 ]; then
+        run_maybe_quiet /sbin/apk add --quiet --no-progress "$install_linux_prog_ALPINE_PKG"
+      else
+        echo "Running: sudo /sbin/apk add --quiet --no-progress  $install_linux_prog_ALPINE_PKG" >&2
+        sudo /sbin/apk add --quiet --no-progress "$install_linux_prog_ALPINE_PKG"
+      fi
+    elif command -v yum > /dev/null 2> /dev/null; then
+      if [ "$(id -u)" -eq 0 ]; then
+        run_maybe_quiet yum install -q -y "$install_linux_prog_PKG"
+      else
+        echo "Running: sudo yum install -q -y $install_linux_prog_PKG" >&2
+        sudo yum install -q -y "$install_linux_prog_PKG"
+      fi
+    else
+      if [ "$(id -u)" -eq 0 ]; then
+        run_maybe_quiet apt-get -qq install -y --no-install-suggests "$install_linux_prog_PKG"
+      else
+        echo "Running: sudo apt-get -qq install -y --no-install-suggests $install_linux_prog_PKG" >&2
+        sudo apt-get -qq install -y --no-install-suggests "$install_linux_prog_PKG"
+      fi
+    fi
+    DK_PROG_INSTALLED_LOCATION=$(command -v "$install_linux_prog_NAME")
+    export DK_PROG_INSTALLED_LOCATION
+  fi
+}
+case "$BUILDHOST_ARCH" in
+  linux_*)
+    #   Need either [wget] or [curl] for [downloadfile]
+    if [ ! -x /usr/bin/wget ] && [ ! -x /bin/wget ] && [ ! -x /usr/bin/curl ] && [ ! -x /bin/curl ]; then
+      install_linux_prog wget wget wget || install_linux_prog curl curl curl
+    fi
+    ;;
+esac
+# -----
+# resolve version + verify the signed manifest
+# -----
+# A checksum-less fetch (the manifest is trusted by SIGNATURE, not a pre-known
+# checksum). curl or wget, matching downloadfile's tool detection.
+dk_fetch() {
+  # shellcheck disable=SC2046 # prints one flag or nothing; must expand to zero words
+  if [ -n "$DKMLSYS_CURL" ]; then "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL "$1" -o "$2"
+  elif [ -n "$DKMLSYS_WGET" ]; then "$DKMLSYS_WGET" $(dk_wget_https_only) -q -O "$2" "$1"
+  else dk_no_downloader; fi
+}
+# Read `%% actual_version("X.Y.Z.W")` from dk.u's workspace section (the pin).
+# The `[(]?` tolerates the parenthesized call form dk1 writes (the workspace Lua
+# grammar rejects the bare `actual_version "X"` string-call sugar); the version
+# is the first double-quoted field either way.
+dk_read_actual_version() {
+  [ -f "$DK_PROJECT_DIR/dk.u" ] || return 0
+  "$DKMLSYS_GREP" -oE '%%[[:space:]]*actual_version[[:space:]]*[(]?[[:space:]]*"[^"]+"' "$DK_PROJECT_DIR/dk.u" 2>/dev/null \
+    | head -1 | "$DKMLSYS_SED" 's/.*"\([^"]*\)".*/\1/'
+}
+# Read a plain key=value field from a verified manifest.
+dk_manifest_str() {
+  "$DKMLSYS_GREP" "^$2=" "$1" | head -1 | cut -d= -f2
+}
+# Defense-in-depth: the dk1 download URL comes from the signify-verified manifest,
+# but still restrict it to known hosts so a signed-but-malicious manifest cannot
+# redirect the fetch off github.com/dkpkg or the legacy GitLab package host.
+dk_allow_host() {
+  case "$1" in
+    https://github.com/dkpkg/*) return 0 ;;
+    https://gitlab.com/api/v4/projects/60486861/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+# On Windows the published dk1 + mlfront-signify binaries carry a `.exe`
+# extension; other platforms have none. Mirrors gen-manifest.sh's extexe.
+dk_extexe() { case "$BUILDHOST_ARCH" in windows_*) printf '.exe' ;; esac; }
+# Fetch + signify-verify the manifest into $1. $2 is the pinned version ("" =
+# latest). Aborts on any verification failure. Trust anchor = the baked
+# mlfront-signify SHA-256, then the baked public key over the manifest.
+dk_verify_manifest() {
+  dvm_out=$1; dvm_ver=$2
+  dvm_sigarch=$BUILDHOST_ARCH
+  eval "dvm_pin=\${cksum_signify_${dvm_sigarch}:-}"
+  # Empty = the arch was never provisioned; a value still starting with `__` is
+  # a maintained-but-unbaked placeholder (e.g. windows_x86 until its signify job
+  # ships). Both are "not provisioned" -- refuse rather than fetch and trust an
+  # unverifiable verifier.
+  # shellcheck disable=SC2154 # dvm_pin is assigned by the eval above
+  case "$dvm_pin" in
+    '' | __*) echo "FATAL: no pinned mlfront-signify checksum for $BUILDHOST_ARCH (launcher not provisioned)" >&2; exit 3 ;;
+  esac
+  install -d "$tools_dir/verifier"
+  dvm_exe=$(dk_extexe)
+  dvm_signify="$tools_dir/verifier/mlfront-signify-$dvm_pin$dvm_exe"
+  downloadfile "https://gitlab.com/api/v4/projects/60486861/packages/generic/mlfront-signify/$signify_pkg_ver/mlfront-signify-$dvm_sigarch$dvm_exe" "$dvm_signify" "$dvm_pin"
+  chmod +x "$dvm_signify"
+  if [ -n "$dvm_ver" ]; then dvm_url="$DK_BASE_URL/manifest-$dvm_ver.txt"; else dvm_url="$DK_BASE_URL/manifest.txt"; fi
+  dk_fetch "$dvm_url" "$dvm_out"
+  dk_fetch "$dvm_url.sig" "$dvm_out.sig"
+  printf 'untrusted comment: dk1 signify public key\n%s\n' "$SIGNIFY_PUBKEY_B64" > "$tools_dir/verifier/dk1.pub"
+  "$dvm_signify" -V -q -p "$tools_dir/verifier/dk1.pub" -m "$dvm_out" -x "$dvm_out.sig" \
+    || { echo "FATAL: manifest signature INVALID for $dvm_url -- refusing to continue" >&2; exit 1; }
+}
+# Resolve the version. `--self-update` ignores the pin and uses the LATEST dk1,
+# which rewrites the dk.u actual_version to its own version -- dk1.exe edits dk.u
+# safely, so this launcher never does file surgery (and stays batch-safe on the
+# Windows side too). Otherwise use the dk.u pin, else the latest.
+dk_selfupdate=0
+[ "${1:-}" = "--self-update" ] && dk_selfupdate=1
+if [ "$dk_selfupdate" = 1 ]; then
+  majminpat_ver=
+else
+  majminpat_ver=$(dk_read_actual_version)
+fi
+dk_manifest="$tools_dir/verifier/manifest"
+dk_verify_manifest "$dk_manifest" "$majminpat_ver"
+if [ -z "$majminpat_ver" ]; then
+  majminpat_ver=$(dk_manifest_str "$dk_manifest" version)
+  [ "$dk_selfupdate" = 0 ] && echo "dk1: no '%% actual_version' pin in dk.u; using latest $majminpat_ver (run './dk1 --self-update' to pin)" >&2
+fi
+[ -n "$majminpat_ver" ] || { echo "FATAL: could not resolve a dk1 version" >&2; exit 1; }
+dk1_cksum=$(dk_manifest_str "$dk_manifest" "dk1_${BUILDHOST_ARCH}")
+[ -n "$dk1_cksum" ] || { echo "FATAL: manifest has no dk1 build for $BUILDHOST_ARCH (version $majminpat_ver)" >&2; exit 3; }
+dk1_url_template=$(dk_manifest_str "$dk_manifest" "dk1_url_template")
+[ -n "$dk1_url_template" ] || { echo "FATAL: manifest has no dk1_url_template (version $majminpat_ver)" >&2; exit 1; }
+# -----
+# single binary executable
+# -----
+DK_EXE=
+destdir=$tools_dir/dk1exe-$majminpat_ver-$BUILDHOST_ARCH
+install -d "$destdir"
+dk1_exe="$destdir/dk1$(dk_extexe)"
+download_helper() {
+  download_helper_CKSUM=$1; shift
+  # Resolve {version}/{arch}/{exe} in the verified manifest's dk1_url_template,
+  # then allowlist the host before fetching.
+  download_helper_URL=$(printf '%s' "$dk1_url_template" | "$DKMLSYS_SED" \
+    -e "s|{version}|$majminpat_ver|g" -e "s|{arch}|$BUILDHOST_ARCH|g" -e "s|{exe}|$(dk_extexe)|g")
+  dk_allow_host "$download_helper_URL" \
+    || { echo "FATAL: dk1 download host not allowlisted: $download_helper_URL" >&2; exit 1; }
+  downloadfile "$download_helper_URL" "$dk1_exe" "$download_helper_CKSUM"
+}
+download_dk() {
+  # dk1 checksum comes from the signify-verified manifest, not a baked value.
+  download_helper "$dk1_cksum"
+}
+# downloadfile skips the download when the cached dk1 already matches the manifest
+# checksum, so this is a no-op on the common (already-cached) path. (A `--version`
+# comparison would not work: dk1 prints "X.Y.Z+rev-W" but the pin is "X.Y.Z.W".)
+download_dk
+chmod +x "$dk1_exe"
+# Set DK_EXE
+DK_EXE="$dk1_exe"
+# -----
+# launcher store GC
+# -----
+# Every dk1 version installs into its own $tools_dir/dk1exe-* directory and
+# old versions accumulate forever. Mark the pinned version as used, then
+# remove version directories (and superseded verifier binaries) that no
+# launcher has used in 30 days. Everything here re-downloads on demand from
+# its signed manifest, so deletion is always safe; pruning must never break
+# the launch, hence the blanket error suppression and the [find] guard
+# (skip pruning entirely on systems without [find]).
+touch "$destdir" "$dvm_signify" 2>/dev/null || true
+if command -v find >/dev/null 2>&1; then
+  find "$tools_dir" -maxdepth 1 -type d -name 'dk1exe-*' -mtime +30 \
+    -exec "$DKMLSYS_RM" -rf {} + 2>/dev/null || true
+  find "$tools_dir/verifier" -maxdepth 1 -type f -name 'mlfront-signify-*' \
+    -mtime +30 -exec "$DKMLSYS_RM" -f {} + 2>/dev/null || true
+fi
+# --- Run executable ---
+#   We already changed to DK_PROJECT_DIR earlier. Change back.
+cd "$dk_pwd"
+export DKCODER_ARG0="$0"
+export DKCODER_PWD="$dk_pwd"
+export DK_PROJECT_DIR
+#   Tell the dk1 binary the real execution host. dkml-c-probe bakes the ABI of
+#   the C compiler that built the binary, so a musl dk1 cross-built on glibc
+#   would otherwise self-identify as linux_x86_64 and resolve the glibc
+#   toolchain on a musl host. BUILDHOST_ARCH is the launcher's own host
+#   detection (honors a pre-set DKML_HOST_ABI, else uname + the musl loader
+#   probe above), so propagate it as DKML_HOST_ABI which the binary honors.
+export DKML_HOST_ABI="$BUILDHOST_ARCH"
+#   shellcheck disable=SC2086
+if [ "$dk_selfupdate" = 1 ]; then
+  # dk1.exe repins the dk.u actual_version line to the resolved (latest) version.
+  exec "$DK_EXE" -isystem "$DK_PROJECT_DIR/etc/dk/i" $_DKEXE_OPTIONS self-update "$majminpat_ver"
+else
+  exec "$DK_EXE" -isystem "$DK_PROJECT_DIR/etc/dk/i" $_DKEXE_OPTIONS "$@"
+fi

dk1.cmd ADDED Viewed

	@@ -0,0 +1,211 @@

+@ECHO OFF
+REM ##########################################################################
+REM # File: dk\dk1.cmd                                                       #
+REM #                                                                        #
+REM # Copyright 2025 Diskuv, Inc.                                            #
+REM #                                                                        #
+REM # Licensed under the Open Software License version 3.0                   #
+REM # (the "License"); you may not use this file except in compliance        #
+REM # with the License. You may obtain a copy of the License at              #
+REM #                                                                        #
+REM #     https://opensource.org/license/osl-3-0-php/                        #
+REM #                                                                        #
+REM ##########################################################################
+REM Recommendation: Place this file in source control.
+REM
+REM Manifest-driven, self-updating dk1 launcher for Windows. Pure batch on the
+REM hot path -- PowerShell is used only as a last-resort download fallback (after
+REM curl and BITSADMIN), never for logic -- so it runs on locked-down machines.
+REM   1. download the pinned mlfront-signify verifier, check it against the
+REM      SHA-256 baked below (the anchor -- not the manifest, so no circularity);
+REM   2. verify the signify signature over the manifest with the baked pubkey;
+REM   3. read the manifest's dk1 SHA-256 (plain key=value, no JSON), download and
+REM      cache dk1.exe, then exec it.
+REM This file never rewrites itself.
+SETLOCAL ENABLEDELAYEDEXPANSION
+SET "DK_PROJECT_DIR=%~dp0"
+SET "DKCODER_PWD=%CD%"
+REM ===== BAKED TRUST ROOT (rotates rarely; updated only on key/verifier rotation) =====
+SET "SIGNIFY_PUBKEY_B64=RWTMq/GqeeJ06ACy7By/H05vvtpc3ZPEKlbnDm9fIQxpkgTV92is6YHD"
+SET "DK_CKSUM_SIGNIFY_WINDOWS_X86_64=ebe1aa87a3eb87ed6769782a31916fab72bbdf0ced22d6ddd9a7a455e23e2c68"
+REM windows_x86 (32-bit) mlfront-signify is not published at SIGNIFY_PKG_VER yet;
+REM the __ placeholder trips the not-provisioned guard below until a real checksum
+REM is baked here (matching the ci/dist/dk1 shell slot) so .\dk1.cmd and ./dk1
+REM light up together.
+SET "DK_CKSUM_SIGNIFY_WINDOWS_X86=__CKSUM_SIGNIFY_WINDOWS_X86__"
+REM The verifier is pinned by version+checksum and fetched from its GitLab package
+REM (a direct download, not the throttled listing API); the site serves only the
+REM signed manifest and the wrappers.
+SET "SIGNIFY_PKG_VER=2.4.2.271"
+IF "%DK1_BASE_URL%"=="" (SET "DK_BASE_URL=https://diskuv.com/dk") ELSE (SET "DK_BASE_URL=%DK1_BASE_URL%")
+REM ====================================================================================
+REM Detect the Windows architecture (WOW64-aware) and select its pinned verifier.
+REM A 32-bit process on 64-bit Windows reports PROCESSOR_ARCHITECTURE=x86 but has
+REM PROCESSOR_ARCHITEW6432 defined; genuine 32-bit Windows does not.
+SET "DK_ARCH=windows_x86_64"
+SET "DK_CKSUM_SIGNIFY=%DK_CKSUM_SIGNIFY_WINDOWS_X86_64%"
+IF /I "%PROCESSOR_ARCHITECTURE%"=="x86" IF NOT DEFINED PROCESSOR_ARCHITEW6432 (
+    SET "DK_ARCH=windows_x86"
+    SET "DK_CKSUM_SIGNIFY=%DK_CKSUM_SIGNIFY_WINDOWS_X86%"
+)
+IF "!DK_CKSUM_SIGNIFY:~0,2!"=="__" (
+    ECHO dk1: no pinned mlfront-signify checksum for !DK_ARCH! ^(launcher not provisioned^) 1>&2
+    EXIT /B 3
+)
+IF "%DKCODER_DATA_HOME%"=="" (SET "DK_DATA_HOME=%LOCALAPPDATA%\Programs\dk1") ELSE (SET "DK_DATA_HOME=%DKCODER_DATA_HOME%")
+SET "DK_VDIR=%DK_DATA_HOME%\verifier"
+IF NOT EXIST "%DK_VDIR%" MKDIR "%DK_VDIR%" >NUL 2>&1
+REM 1. Pinned verifier from GitLab, checked against the baked SHA-256 (the anchor).
+SET "DK_SIGNIFY=%DK_VDIR%\mlfront-signify-%DK_CKSUM_SIGNIFY%.exe"
+IF NOT EXIST "%DK_SIGNIFY%" (
+    CALL :fetch "https://gitlab.com/api/v4/projects/60486861/packages/generic/mlfront-signify/%SIGNIFY_PKG_VER%/mlfront-signify-!DK_ARCH!.exe" "%DK_SIGNIFY%"
+    IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+)
+CALL :sha256 "%DK_SIGNIFY%" DK_SIG_ACTUAL
+IF /I NOT "!DK_SIG_ACTUAL!"=="%DK_CKSUM_SIGNIFY%" (
+    ECHO dk1: mlfront-signify checksum mismatch ^(verifier not trusted^) 1>&2
+    EXIT /B 1
+)
+REM 2. Write the baked public key (pure batch; signify accepts the CRLF form).
+> "%DK_VDIR%\dk1.pub" ECHO untrusted comment: dk1 signify public key
+>> "%DK_VDIR%\dk1.pub" ECHO %SIGNIFY_PUBKEY_B64%
+REM 3. Read the dk.u pin: the version between quotes on the actual_version line.
+SET "DK_PIN="
+IF EXIST "%DK_PROJECT_DIR%dk.u" CALL :readpin
+REM --self-update handled by dk1.exe (it edits dk.u safely); see below after resolve.
+SET "DK_SELFUPDATE=0"
+IF "%~1"=="--self-update" SET "DK_SELFUPDATE=1"
+REM 4. Verify the manifest and resolve the version + dk1 checksum. Self-update and
+REM    an unpinned project both use the latest manifest.
+IF "%DK_SELFUPDATE%"=="1" (SET "DK_WANT=") ELSE (SET "DK_WANT=%DK_PIN%")
+CALL :getmanifest "%DK_WANT%"
+IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+IF "%DK_WANT%"=="" (
+    CALL :mval version DK_VER
+    IF "%DK_SELFUPDATE%"=="0" IF "%DK_PIN%"=="" ECHO dk1: no actual_version pin in dk.u; using latest !DK_VER! ^(run "dk1 --self-update" to pin^) 1>&2
+) ELSE (
+    SET "DK_VER=%DK_PIN%"
+)
+IF "!DK_VER!"=="" (ECHO dk1: could not resolve a dk1 version 1>&2 & EXIT /B 1)
+CALL :mval dk1_!DK_ARCH! DK_CKSUM
+IF "!DK_CKSUM!"=="" (ECHO dk1: manifest has no dk1 build for !DK_ARCH! ^(version !DK_VER!^) 1>&2 & EXIT /B 3)
+CALL :mval dk1_url_template DK_TMPL
+IF "!DK_TMPL!"=="" (ECHO dk1: manifest has no dk1_url_template ^(version !DK_VER!^) 1>&2 & EXIT /B 1)
+REM 5. Cache + download dk1.exe (version-keyed dir; never overwrite a running exe).
+SET "DK_EXEDIR=%DK_DATA_HOME%\dk1exe-!DK_VER!-!DK_ARCH!"
+IF NOT EXIST "!DK_EXEDIR!" MKDIR "!DK_EXEDIR!" >NUL 2>&1
+SET "DK_EXE=!DK_EXEDIR!\dk1.exe"
+SET "DK_NEED_EXE=1"
+IF EXIST "!DK_EXE!" (
+    CALL :sha256 "!DK_EXE!" DK_EXE_ACTUAL
+    IF /I "!DK_EXE_ACTUAL!"=="!DK_CKSUM!" SET "DK_NEED_EXE=0"
+)
+IF !DK_NEED_EXE! EQU 1 (
+    REM Resolve {version}/{arch}/{exe} in the verified dk1_url_template, then
+    REM allowlist the host before downloading.
+    SET "DK_URL=!DK_TMPL!"
+    SET "DK_URL=!DK_URL:{version}=%DK_VER%!"
+    SET "DK_URL=!DK_URL:{arch}=%DK_ARCH%!"
+    SET "DK_URL=!DK_URL:{exe}=.exe!"
+    CALL :allowhost "!DK_URL!"
+    IF !ERRORLEVEL! NEQ 0 (ECHO dk1: download host not allowlisted: !DK_URL! 1>&2 & EXIT /B 1)
+    CALL :fetch "!DK_URL!" "!DK_EXE!"
+    IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+    CALL :sha256 "!DK_EXE!" DK_EXE_ACTUAL
+    IF /I NOT "!DK_EXE_ACTUAL!"=="!DK_CKSUM!" (ECHO dk1: dk1.exe checksum mismatch 1>&2 & EXIT /B 1)
+)
+REM 6. Launcher store GC. Every dk1 version installs into its own dk1exe-*
+REM    directory and old versions accumulate forever. Mark the pinned version
+REM    (and the current verifier) as used, then remove version directories and
+REM    superseded verifier binaries no launcher has used in 30 days. Everything
+REM    here re-downloads on demand from its signed manifest, so deletion is
+REM    always safe; pruning must never break the launch, so every step
+REM    suppresses errors. Pure batch: the mtime bump is a create+delete of a
+REM    marker file (updates the directory timestamp), the verifier bump is the
+REM    batch copy-touch idiom, and the age test is FORFILES /D.
+>"!DK_EXEDIR!\.dk1-touch" ECHO OK
+DEL /Q "!DK_EXEDIR!\.dk1-touch" >NUL 2>&1
+COPY /B "%DK_SIGNIFY%"+,, "%DK_SIGNIFY%" >NUL 2>&1
+FORFILES /P "%DK_DATA_HOME%" /M dk1exe-* /D -30 /C "cmd /c if @isdir==TRUE rd /s /q @path" >NUL 2>&1
+FORFILES /P "%DK_VDIR%" /M mlfront-signify-*.exe /D -30 /C "cmd /c del /q @path" >NUL 2>&1
+REM 7. Run it (same contract as the POSIX wrapper). dk1 --self-update rewrites the
+REM    dk.u actual_version line itself (dk1.exe edits dk.u safely; this launcher
+REM    never does file surgery on dk.u).
+SET "DKCODER_ARG0=dk1"
+IF "%DK_SELFUPDATE%"=="1" (
+    REM dk1.exe repins the dk.u actual_version line to the resolved (latest) version.
+    "!DK_EXE!" -isystem "%DK_PROJECT_DIR%etc\dk\i" self-update !DK_VER!
+) ELSE (
+    "!DK_EXE!" -isystem "%DK_PROJECT_DIR%etc\dk\i" %*
+)
+EXIT /B %ERRORLEVEL%
+REM ================= subroutines =================
+REM :fetch URL DEST  -- download without a checksum (the manifest is verified by
+REM signature). curl first, then BITSADMIN, then PowerShell -- so no PowerShell
+REM dependency on machines that ship curl (Windows 10 1803+).
+:fetch
+IF EXIST "%SystemRoot%\System32\curl.exe" (
+    "%SystemRoot%\System32\curl.exe" -fsSL "%~1" -o "%~2" && EXIT /B 0
+)
+BITSADMIN /TRANSFER dk1fetch /DOWNLOAD /PRIORITY FOREGROUND "%~1" "%~2" >NUL 2>&1 && EXIT /B 0
+powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -UseBasicParsing -Uri '%~1' -OutFile '%~2'" >NUL 2>&1 && EXIT /B 0
+ECHO dk1: could not download %~1 1>&2
+EXIT /B 1
+REM :sha256 FILE OUTVAR  -- set OUTVAR to the lowercased SHA-256 of FILE.
+:sha256
+SET "%~2="
+FOR /F "usebackq tokens=* delims=" %%H IN (`certutil -hashfile "%~1" SHA256 ^| findstr /R "^[0-9a-fA-F][0-9a-fA-F]*$"`) DO (
+    IF NOT DEFINED %~2 SET "%~2=%%H"
+)
+IF DEFINED %~2 SET "%~2=!%~2: =!"
+EXIT /B 0
+REM :getmanifest VER  -- fetch manifest[-VER].txt + .sig into %DK_VDIR%, signify-verify.
+:getmanifest
+IF "%~1"=="" (SET "DK_MURL=%DK_BASE_URL%/manifest.txt") ELSE (SET "DK_MURL=%DK_BASE_URL%/manifest-%~1.txt")
+CALL :fetch "!DK_MURL!" "%DK_VDIR%\manifest"
+IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+CALL :fetch "!DK_MURL!.sig" "%DK_VDIR%\manifest.sig"
+IF !ERRORLEVEL! NEQ 0 EXIT /B 1
+"%DK_SIGNIFY%" -V -q -p "%DK_VDIR%\dk1.pub" -m "%DK_VDIR%\manifest" -x "%DK_VDIR%\manifest.sig"
+IF !ERRORLEVEL! NEQ 0 (ECHO dk1: manifest signature INVALID for !DK_MURL! -- refusing to continue 1>&2 & EXIT /B 1)
+EXIT /B 0
+REM :mval KEY OUTVAR  -- read key=value from the verified %DK_VDIR%\manifest.
+:mval
+SET "%~2="
+FOR /F "usebackq tokens=1,* delims==" %%A IN ("%DK_VDIR%\manifest") DO (
+    IF /I "%%A"=="%~1" SET "%~2=%%B"
+)
+EXIT /B 0
+REM :allowhost URL  -- EXIT /B 0 if URL starts with an allowlisted host prefix,
+REM else 1. Defense-in-depth over the signify-verified template (a signed-but-
+REM malicious manifest still cannot redirect the download off a known host).
+:allowhost
+ECHO %~1| findstr /B /L /C:"https://github.com/dkpkg/" /C:"https://gitlab.com/api/v4/projects/60486861/" >NUL 2>&1
+EXIT /B !ERRORLEVEL!
+REM :readpin  -- set DK_PIN to the version between the quotes on the dk.u
+REM actual_version line. The caret-escaped FOR options are how batch uses a
+REM double-quote as a delimiter (a quoted "delims=^"" options string does not work).
+:readpin
+FOR /F usebackq^ tokens^=2^ delims^=^" %%V IN (`findstr /L /C:"actual_version" "%DK_PROJECT_DIR%dk.u"`) DO SET "DK_PIN=%%V"
+EXIT /B 0

dune-project CHANGED Viewed

@@ -32,4 +32,4 @@
   (sexplib (>= v0.14.0))
   (csexp (>= 1.3.2))
   (lru (>= 0.3.0))
-  (dap (>= 1.1.0))))

   (sexplib (>= v0.14.0))
   (csexp (>= 1.3.2))
   (lru (>= 0.3.0))
+  (dap (and (>= 1.0.6) (< 1.1.0)))))

earlybird.opam CHANGED Viewed

@@ -26,7 +26,7 @@ depends: [
   "sexplib" {>= "v0.14.0"}
   "csexp" {>= "1.3.2"}
   "lru" {>= "0.3.0"}
-  "dap" {>= "1.1.0"}
   "odoc" {with-doc}
 ]
 build: [

   "sexplib" {>= "v0.14.0"}
   "csexp" {>= "1.3.2"}
   "lru" {>= "0.3.0"}
+  "dap" {>= "1.0.6" & < "1.1.0"}
   "odoc" {with-doc}
 ]
 build: [

etc/dk/i/.gitignore ADDED Viewed

	@@ -0,0 +1,5 @@

+# Written by dk0. values.unattested.json is a scratch download; do not
+# commit it. The <LIB>.<VER>.values.json import pins and
+# dk-closure-manifest.tsv ARE committed so a fresh clone verifies imports
+# without refetching.
+values.unattested.json

etc/dk/i/CommonsBase_Std.2.6.20260920144347.values.json ADDED Viewed

	@@ -0,0 +1,229 @@

+{
+  "bundles": [
+    {
+      "assets": [
+        {
+          "checksum": {
+            "blake2b256": "1471a9db069f2e4bb198ea1a1f9eec7804f1dc893f809411cd0396aac96ed91f"
+          },
+          "origin": "CommonsBase_Std",
+          "path": "CommonsBase_Std-dist-win32.distmeta.cts.1.tracestore",
+          "size": 5394
+        },
+        {
+          "checksum": {
+            "blake2b256": "621e0f49e1d74e269b69af8696b1289f75fdf731b73b9a51eeb863d933ed933c"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 26077,
+                "central_size": 1657,
+                "checksum": {
+                  "blake2b256": "81a7b18d26a163a27f921fcf62cfe43c9b20e578e41a4b7a0ffc8fb59d57c7ef"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsBase_Std",
+          "path": "CommonsBase_Std-dist-win32.distmeta.manifest.zip",
+          "size": 27734
+        },
+        {
+          "checksum": {
+            "blake2b256": "664a6b7c88d2577f5139b65dc3e91c6c630a00728840f9e604f07aaf944bc186"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 23730,
+                "central_size": 728,
+                "checksum": {
+                  "blake2b256": "d71646da54933429062d0ac841c02636384f04c2a699ad56711dac3ff6e9f1d3"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsBase_Std",
+          "path": "CommonsBase_Std-dist-win32.distmeta.valuestore.zip",
+          "size": 24458
+        },
+        {
+          "checksum": {
+            "blake2b256": "c05555daf99672e6a6564b642bcc848595b2939846c8d91955af495b6031d661"
+          },
+          "origin": "CommonsBase_Std",
+          "path": "CommonsBase_Std-dist-win32.package.cts.1.tracestore",
+          "size": 133822
+        },
+        {
+          "checksum": {
+            "blake2b256": "73594f34f3f14dc20a5b10441936e4f6c226bc2c40975368a37914bfc92d9e6b"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 286109832,
+                "central_size": 13538,
+                "checksum": {
+                  "blake2b256": "74c1af5a71b8f7bc3155d3e9e6d3a782349c82846cce12a718bffed1338f17ff"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsBase_Std",
+          "path": "CommonsBase_Std-dist-win32.package.valuestore.zip",
+          "size": 286123370
+        }
+      ],
+      "id": "CommonsBase_Std.Distribution@2.6.20260920144347",
+      "listing": {
+        "origins": [
+          {
+            "name": "CommonsBase_Std",
+            "mirrors": [
+              "https://github.com/dkpkg/CommonsBase_Std/releases/download/2.6.20260920144347"
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "distributions": [
+    {
+      "build": {
+        "attestation": {
+          "github_slsa_v1_l2": {
+            "docs": [
+              {"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHmTCCBx6gAwIBAgIUQnuqZOeL/PYX2qKb7DZs5BrMm8swCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTIwMTQ0NjQ4WhcNMjYwOTIwMTQ1NjQ4WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEle1klWfjzlMi6Z86cJq+nMOgM1gP4NmGWyOctHUUWh4mnTlVm3jZgzxZzUoYR0AOS63hbWc038BGwUE3DGxc+6OCBj0wggY5MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU4jidOxLEdZgy2J+eCtWS5pA+fn4wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8weAYDVR0RAQH/BG4wbIZqaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnL0NvbW1vbnNCYXNlX1N0ZC8uZ2l0aHViL3dvcmtmbG93cy9kaXN0cmlidXRlLTIuNi55bWxAcmVmcy90YWdzLzIuNi4yMDI2MDkyMDE0NDM0NzA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMBIGCisGAQQBg78wAQIEBHB1c2gwNgYKKwYBBAGDvzABAwQoNzEwMDg3NzQ5YTIzNmZjMWRkYmE4MTI4Yzg5ZTEwOTQyZmNiZjQ1YTAyBgorBgEEAYO/MAEEBCQuZ2l0aHViL3dvcmtmbG93cy9kaXN0cmlidXRlLTIuNi55bWwwIwYKKwYBBAGDvzABBQQVZGtwa2cvQ29tbW9uc0Jhc2VfU3RkMCoGCisGAQQBg78wAQYEHHJlZnMvdGFncy8yLjYuMjAyNjA5MjAxNDQzNDcwOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMHoGCisGAQQBg78wAQkEbAxqaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnL0NvbW1vbnNCYXNlX1N0ZC8uZ2l0aHViL3dvcmtmbG93cy9kaXN0cmlidXRlLTIuNi55bWxAcmVmcy90YWdzLzIuNi4yMDI2MDkyMDE0NDM0NzA4BgorBgEEAYO/MAEKBCoMKDcxMDA4Nzc0OWEyMzZmYzFkZGJhODEyOGM4OWUxMDk0MmZjYmY0NWEwHQYKKwYBBAGDvzABCwQPDA1naXRodWItaG9zdGVkMDgGCisGAQQBg78wAQwEKgwoaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnL0NvbW1vbnNCYXNlX1N0ZDA4BgorBgEEAYO/MAENBCoMKDcxMDA4Nzc0OWEyMzZmYzFkZGJhODEyOGM4OWUxMDk0MmZjYmY0NWEwLAYKKwYBBAGDvzABDgQeDBxyZWZzL3RhZ3MvMi42LjIwMjYwOTIwMTQ0MzQ3MBoGCisGAQQBg78wAQ8EDAwKMTIyMTEzMjIxNDAoBgorBgEEAYO/MAEQBBoMGGh0dHBzOi8vZ2l0aHViLmNvbS9ka3BrZzAZBgorBgEEAYO/MAERBAsMCTI3ODkxMzUwMDB6BgorBgEEAYO/MAESBGwMamh0dHBzOi8vZ2l0aHViLmNvbS9ka3BrZy9Db21tb25zQmFzZV9TdGQvLmdpdGh1Yi93b3JrZmxvd3MvZGlzdHJpYnV0ZS0yLjYueW1sQHJlZnMvdGFncy8yLjYuMjAyNjA5MjAxNDQzNDcwOAYKKwYBBAGDvzABEwQqDCg3MTAwODc3NDlhMjM2ZmMxZGRiYTgxMjhjODllMTA5NDJmY2JmNDVhMBQGCisGAQQBg78wARQEBgwEcHVzaDBcBgorBgEEAYO/MAEVBE4MTGh0dHBzOi8vZ2l0aHViLmNvbS9ka3BrZy9Db21tb25zQmFzZV9TdGQvYWN0aW9ucy9ydW5zLzM1NTE3NDI3MzQxL2F0dGVtcHRzLzEwFgYKKwYBBAGDvzABFgQIDAZwdWJsaWMwHwYKKwYBBAGDvzABFwQRDA9kay1kaXN0cmlidXRpb24wRgYKKwYBBAGDvzABGAQ4DDZyZXBvOmRrcGtnL0NvbW1vbnNCYXNlX1N0ZDplbnZpcm9ubWVudDpkay1kaXN0cmlidXRpb24wgYsGCisGAQQB1nkCBAIEfQR7AHkAdwDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAaC/SLfNAAAEAwBIMEYCIQDcSmUidwkBi6osfs9IYltZL9LtvnH6uxRNaZzOKiJt8gIhAN35rxyG+HDtaxG90reCULys0AfAJhJCH3DpZBTyUCo9MAoGCCqGSM49BAMDA2kAMGYCMQDUKeibdIOPBnP8WJwxoQgvsYnVJmpcgLFa+rC8CRoRj3hWCS9nccAUGGFzirqi+U8CMQC8b+Td8u524XlXnAGFOlNMRajf4JfafLZyTe0E3pDL5qmmDWi94JImuYUKpZ1T02E="},"tlogEntries":[{"logIndex":"2900405607","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1789915609","inclusionPromise":{"signedEntryTimestamp":"MEUCIDiSAOthsVhc5JyBTLuyCxEjr4MNjGG031gEZuHuTzVuAiEAxmgU2hif2N5gRbbN/vCJQI653nR6QlOS/yMkcvZeRjw="},"inclusionProof":{"logIndex":"2778501345","rootHash":"54yfGQwxpSthbq9d4FGernIJslifTmaJG1TH9lKc+8c=","treeSize":"2778501418","hashes":["6U/Pa3fGSR1hLlnnbVLTi8g1kLqENkut+zGmJndE3NY=","yRgxpMWEXNq5Kp0ExUjioDeMeXwdZk9mnUeEJTniKVI=","hfmOv2gIMBfwbfZ3eFCbEylnD9mt2cQcrhu5b0fPr24=","6WAXl1Pl8B+tYrO5uyeQojpflwGJh6xtRdejfqy7bxI=","NloroRFCp7tUB/jEcazPL0ybyV8zNN0r5xfSAUL9TBs=","Q3SulITUMKHmWKyMvqHsBX6jY9YKYeTkvUkWhObpKpk=","nubMK8dmaAJBamEgpdy2Iwd06mJ17Tl05S/v74jzoEM=","ahfyyd1/jcofWAA6D+pKm9Zg/U/+zvE/QoEVI7ndhYg=","3vWw04XKnNvL/sBSq8Q5q3lU8f7gIYQlY3+4xVmhee0=","87Ij1gpJcc3Dp7oJzHcX6oajiNB5RR0RPUZ3FeBbrhU=","Gh+QmpRczgbt96IrwgbeeD5+XuqMEBW/ImxCK9EOGlA=","OKp70ZrFKEgLWvx9PPC4vZ2nc8ks/D5Pzcg037k0s2Y=","nj9u53dsHqNA5WYl3GQfuWmkxEYjimgFk/RfYqW839Q=","LdA825SeiwdHnEsuLTGEtQ248AUBYlr6G719py1dHeM=","tyO4Oj1UrXex15tzrEEO6sSnE8y8obZWghZ2XixBPtE=","rjDiNJHGnboMYYUH7OSezbKWj3wMXRTHGCLa/SaZ6O4=","mfWjSdNaEfNXxDww6AAOw/NoK9e6z1yKaZm5xvmMabs=","qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2778501418\n54yfGQwxpSthbq9d4FGernIJslifTmaJG1TH9lKc+8c=\n\n— rekor.sigstore.dev wNI9ajBFAiEAlipzrqmrk2akmXpZX1Nw0skiMzwrcEtTsLeAk0gJb+UCIAp7AWLKaOLRUoNA/qEtUHIYpvvpJq2enOQLb4MbtRNu\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZjRiNWEwNDkxMzcxNTEzZTRiMTM0NzJhZTI2ZGI1ZWRiYzk1NmVhMWYyZWFhMGZkMjkzOTc0MTFjMzk1YTczMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6Ijc0ZGM3ZTRjNmM4YjM0ZTYzODdjMTVhOGQ2NzdlMWVkMzQzNGRjOWRiZDAyYjE0MGY2NmMzMWUxNmE5MWM4ZDcifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVRQ0lCdDBpL2ZVMXR3Y3Vqc29TR0JqQWFNcnFwSFp5a3I2aFRDd1NrZ2VJVXpYQWlBM1JrNjVja0VqakVTZnVNdVdVWXpUS0wvNkxmUW9vL2RjTnB0TVdYMjhLUT09IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VodFZFTkRRbmcyWjBGM1NVSkJaMGxWVVc1MWNWcFBaVXd2VUZsWU1uRkxZamRFV25NMVFuSk5iVGh6ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVTWGROVkZFd1RtcFJORmRvWTA1TmFsbDNUMVJKZDAxVVVURk9hbEUwVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVnNaVEZyYkZkbWFucHNUV2syV2pnMlkwcHhLMjVOVDJkTk1XZFFORTV0UjFkNVQyTUtkRWhWVlZkb05HMXVWR3hXYlROcVdtZDZlRnA2Vlc5WlVqQkJUMU0yTTJoaVYyTXdNemhDUjNkVlJUTkVSM2hqS3paUFEwSnFNSGRuWjFrMVRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVTBhbWxrQ2s5NFRFVmtXbWQ1TWtvclpVTjBWMU0xY0VFclptNDBkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMlZCV1VSV1VqQlNRVkZJTDBKSE5IZGlTVnB4WVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBUREpTY21OSGRHNU1NRTUyWWxjeGRncGliazVEV1ZoT2JGZ3hUakJhUXpoMVdqSnNNR0ZJVm1sTU0yUjJZMjEwYldKSE9UTmplVGxyWVZoT01HTnRiR2xrV0ZKc1RGUkpkVTVwTlRWaVYzaEJDbU50Vm0xamVUa3dXVmRrZWt4NlNYVk9hVFI1VFVSSk1rMUVhM2xOUkVVd1RrUk5NRTU2UVRWQ1oyOXlRbWRGUlVGWlR5OU5RVVZDUWtOMGIyUklVbmNLWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzWTIxT2RtSnVVbXhpYmxGMVdUSTVkRTFDU1VkRGFYTkhRVkZSUWdwbk56aDNRVkZKUlVKSVFqRmpNbWQzVG1kWlMwdDNXVUpDUVVkRWRucEJRa0YzVVc5T2VrVjNUVVJuTTA1NlVUVlpWRWw2VG0xYWFrMVhVbXRaYlVVMENrMVVTVFJaZW1jMVdsUkZkMDlVVVhsYWJVNXBXbXBSTVZsVVFYbENaMjl5UW1kRlJVRlpUeTlOUVVWRlFrTlJkVm95YkRCaFNGWnBURE5rZG1OdGRHMEtZa2M1TTJONU9XdGhXRTR3WTIxc2FXUllVbXhNVkVsMVRtazFOV0pYZDNkSmQxbExTM2RaUWtKQlIwUjJla0ZDUWxGUlZscEhkSGRoTW1OMlVUSTVkQXBpVnpsMVl6QkthR015Vm1aVk0xSnJUVU52UjBOcGMwZEJVVkZDWnpjNGQwRlJXVVZJU0Vwc1dtNU5kbVJIUm01amVUaDVUR3BaZFUxcVFYbE9ha0UxQ2sxcVFYaE9SRkY2VGtSamQwOTNXVXRMZDFsQ1FrRkhSSFo2UVVKRFFWRjBSRU4wYjJSSVVuZGplbTkyVEROU2RtRXlWblZNYlVacVpFZHNkbUp1VFhVS1dqSnNNR0ZJVm1sa1dFNXNZMjFPZG1KdVVteGlibEYxV1RJNWRFMUliMGREYVhOSFFWRlJRbWMzT0hkQlVXdEZZa0Y0Y1dGSVVqQmpTRTAyVEhrNWJncGhXRkp2WkZkSmRWa3lPWFJNTWxKeVkwZDBia3d3VG5aaVZ6RjJZbTVPUTFsWVRteFlNVTR3V2tNNGRWb3liREJoU0ZacFRETmtkbU50ZEcxaVJ6a3pDbU41T1d0aFdFNHdZMjFzYVdSWVVteE1WRWwxVG1rMU5XSlhlRUZqYlZadFkzazVNRmxYWkhwTWVrbDFUbWswZVUxRVNUSk5SR3Q1VFVSRk1FNUVUVEFLVG5wQk5FSm5iM0pDWjBWRlFWbFBMMDFCUlV0Q1EyOU5TMFJqZUUxRVFUUk9lbU13VDFkRmVVMTZXbTFaZWtacldrZEthRTlFUlhsUFIwMDBUMWRWZUFwTlJHc3dUVzFhYWxsdFdUQk9WMFYzU0ZGWlMwdDNXVUpDUVVkRWRucEJRa04zVVZCRVFURnVZVmhTYjJSWFNYUmhSemw2WkVkV2EwMUVaMGREYVhOSENrRlJVVUpuTnpoM1FWRjNSVXRuZDI5aFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWxKeVkwZDBia3d3VG5aaVZ6RjJZbTVPUTFsWVRtd0tXREZPTUZwRVFUUkNaMjl5UW1kRlJVRlpUeTlOUVVWT1FrTnZUVXRFWTNoTlJFRTBUbnBqTUU5WFJYbE5lbHB0V1hwR2ExcEhTbWhQUkVWNVQwZE5OQXBQVjFWNFRVUnJNRTF0V21wWmJWa3dUbGRGZDB4QldVdExkMWxDUWtGSFJIWjZRVUpFWjFGbFJFSjRlVnBYV25wTU0xSm9Xak5OZGsxcE5ESk1ha2wzQ2sxcVdYZFBWRWwzVFZSUk1FMTZVVE5OUW05SFEybHpSMEZSVVVKbk56aDNRVkU0UlVSQmQwdE5WRWw1VFZSRmVrMXFTWGhPUkVGdlFtZHZja0puUlVVS1FWbFBMMDFCUlZGQ1FtOU5SMGRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhMkV6UW5KYWVrRmFRbWR2Y2tKblJVVkJXVTh2VFVGRlVncENRWE5OUTFSSk0wOUVhM2hOZWxWM1RVUkNOa0puYjNKQ1owVkZRVmxQTDAxQlJWTkNSM2ROWVcxb01HUklRbnBQYVRoMldqSnNNR0ZJVm1sTWJVNTJDbUpUT1d0aE0wSnlXbms1UkdJeU1YUmlNalY2VVcxR2VscFdPVlJrUjFGMlRHMWtjR1JIYURGWmFUa3pZak5LY2xwdGVIWmtNMDEyV2tkc2VtUklTbkFLV1c1V01GcFRNSGxNYWxsMVpWY3hjMUZJU214YWJrMTJaRWRHYm1ONU9IbE1hbGwxVFdwQmVVNXFRVFZOYWtGNFRrUlJlazVFWTNkUFFWbExTM2RaUWdwQ1FVZEVkbnBCUWtWM1VYRkVRMmN6VFZSQmQwOUVZek5PUkd4b1RXcE5NbHB0VFhoYVIxSnBXVlJuZUUxcWFHcFBSR3hzVFZSQk5VNUVTbTFaTWtwdENrNUVWbWhOUWxGSFEybHpSMEZSVVVKbk56aDNRVkpSUlVKbmQwVmpTRlo2WVVSQ1kwSm5iM0pDWjBWRlFWbFBMMDFCUlZaQ1JUUk5WRWRvTUdSSVFub0tUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPV3RoTTBKeVduazVSR0l5TVhSaU1qVjZVVzFHZWxwV09WUmtSMUYyV1ZkT01HRlhPWFZqZVRsNVpGYzFlZ3BNZWsweFRsUkZNMDVFU1ROTmVsRjRUREpHTUdSSFZuUmpTRko2VEhwRmQwWm5XVXRMZDFsQ1FrRkhSSFo2UVVKR1oxRkpSRUZhZDJSWFNuTmhWMDEzQ2toM1dVdExkMWxDUWtGSFJIWjZRVUpHZDFGU1JFRTVhMkY1TVd0aFdFNHdZMjFzYVdSWVVuQmlNalIzVW1kWlMwdDNXVUpDUVVkRWRucEJRa2RCVVRRS1JFUmFlVnBZUW5aUGJWSnlZMGQwYmt3d1RuWmlWekYyWW01T1ExbFlUbXhZTVU0d1drUndiR0p1V25CamJUbDFZbGRXZFdSRWNHdGhlVEZyWVZoT01BcGpiV3hwWkZoU2NHSXlOSGRuV1hOSFEybHpSMEZSVVVJeGJtdERRa0ZKUldaUlVqZEJTR3RCWkhkRVpGQlVRbkY0YzJOU1RXMU5Xa2hvZVZwYWVtTkRDbTlyY0dWMVRqUTRjbVlyU0dsdVMwRk1lVzUxYW1kQlFVRmhReTlUVEdaT1FVRkJSVUYzUWtsTlJWbERTVkZFWTFOdFZXbGtkMnRDYVRadmMyWnpPVWtLV1d4MFdrdzVUSFIyYmtnMmRYaFNUbUZhZWs5TGFVcDBPR2RKYUVGT016VnllSGxISzBoRWRHRjRSemt3Y21WRFZVeDVjekJCWmtGS2FFcERTRE5FY0FwYVFsUjVWVU52T1UxQmIwZERRM0ZIVTAwME9VSkJUVVJCTW10QlRVZFpRMDFSUkZWTFpXbGlaRWxQVUVKdVVEaFhTbmQ0YjFGbmRuTlpibFpLYlhCakNtZE1SbUVyY2tNNFExSnZVbW96YUZkRFV6bHVZMk5CVlVkSFJucHBjbkZwSzFVNFEwMVJRemhpSzFSa09IVTFNalJZYkZodVFVZEdUMnhPVFZKaGFtWUtORXBtWVdaTVdubFVaVEJGTTNCRVREVnhiVzFFVjJrNU5FcEpiWFZaVlV0d1dqRlVNREpGUFFvdExTMHRMVVZPUkNCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2c9PSJ9XX19"}],"timestampVerificationData":{}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiLmdpdGlnbm9yZSIsImRpZ2VzdCI6eyJzaGEyNTYiOiJjZGJjYWUxNTEwNWQ2Yjc4MWU2MjA4MTNjNzljN2U4Njg3NDBkNGU5Y2M1M2NlNmY1ZmNiYmMxMjM4N2FkZjRiIn19LHsibmFtZSI6IkNvbW1vbnNCYXNlX1N0ZC1kaXN0LXdpbjMyLmRpc3RtZXRhLmN0cy4xLnRyYWNlc3RvcmUiLCJkaWdlc3QiOnsic2hhMjU2IjoiNDFjM2FiZDAwYWVmYTJkYTBiNTlhNDI1ZDk4NzFhNzVmYTdhNDc5OTE0YmVmOTg4OTFhY2MyNzdiMmUyZDRmZSJ9fSx7Im5hbWUiOiJDb21tb25zQmFzZV9TdGQtZGlzdC13aW4zMi5kaXN0bWV0YS5tYW5pZmVzdC56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiM2Q3N2QxMjA2MjRlNDJkNTg0NjkwNjgyMDI4ZDJjMzVmYmQwYTZkZDZkZGE2YTRjZGZlOWY0N2IwOThjOGQxOSJ9fSx7Im5hbWUiOiJDb21tb25zQmFzZV9TdGQtZGlzdC13aW4zMi5kaXN0bWV0YS52YWx1ZXN0b3JlLmluZGV4IiwiZGlnZXN0Ijp7InNoYTI1NiI6IjA3NjFiZTI0ZTg5N2U5OGMwYzMyZDc2OGNjYzJkNWNjZmQ2ZjMwYzY4Y2U3MWY1MTMyYTY0NmQxZjVjMWU0YzYifX0seyJuYW1lIjoiQ29tbW9uc0Jhc2VfU3RkLWRpc3Qtd2luMzIuZGlzdG1ldGEudmFsdWVzdG9yZS56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiNzk3NDViMTJiODI2YzI4YmNhZjY4YWQ3NGQ0YWEzZTAyYWYzMDg5YTNkMmRkMDMxMTk5NGMxOWM2ZDk4Y2U3MiJ9fSx7Im5hbWUiOiJDb21tb25zQmFzZV9TdGQtZGlzdC13aW4zMi5wYWNrYWdlLmN0cy4xLnRyYWNlc3RvcmUiLCJkaWdlc3QiOnsic2hhMjU2IjoiOTRhNmIxYWEzYjUyOTRkZDA1OGVlMjc2MmI4Y2JiZjQ2ZWM4MmFjZWFjN2I5ZWU4M2FkNDI5NGRkMmExMjhmOCJ9fSx7Im5hbWUiOiJDb21tb25zQmFzZV9TdGQtZGlzdC13aW4zMi5wYWNrYWdlLnZhbHVlc3RvcmUuaW5kZXgiLCJkaWdlc3QiOnsic2hhMjU2IjoiN2U1NGIzZTRjZWExOTFmNjNmYTg5MWZkMDcyOGVjNjVjNThkOGQ4M2EzMjc5MjM4NDI3MGNhYjkyMDUxZmYzMCJ9fSx7Im5hbWUiOiJDb21tb25zQmFzZV9TdGQtZGlzdC13aW4zMi5wYWNrYWdlLnZhbHVlc3RvcmUuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjQyYjQzOTdkOTg5MTA4ZWE2YzE0OTAzZjE1NzViODFmMmVmNjAwOTMwOWRmM2ZmZGY4MDdjMDNiNDU5Y2IwODMifX0seyJuYW1lIjoiQ29tbW9uc0Jhc2VfU3RkLWRpc3Qtd2luMzIudmFsdWVzLmpzb24iLCJkaWdlc3QiOnsic2hhMjU2IjoiMDEwYTQ1NGRjN2M4OTM3ZGIxZTk2MDlhYmE0NDM5YjRmYzliN2IyNDVjOTI2NDg2M2MxODU1OTA4MzUzMWU0NyJ9fSx7Im5hbWUiOiJ2YWx1ZXMuanNvbiIsImRpZ2VzdCI6eyJzaGEyNTYiOiJhNDJlYmE4MzRiMDRjZDY1MDY5ZTVkMzUxNmMzZDY4OGQ0YWE2Y2U4MDAxMjM1NjE4ODYxZmUwMjdmM2VlZTFjIn19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9hY3Rpb25zLmdpdGh1Yi5pby9idWlsZHR5cGVzL3dvcmtmbG93L3YxIiwiZXh0ZXJuYWxQYXJhbWV0ZXJzIjp7IndvcmtmbG93Ijp7InJlZiI6InJlZnMvdGFncy8yLjYuMjAyNjA5MjAxNDQzNDciLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnL0NvbW1vbnNCYXNlX1N0ZCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9kaXN0cmlidXRlLTIuNi55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIyMTEzMjIxNCIsInJlcG9zaXRvcnlfb3duZXJfaWQiOiIyNzg5MTM1MDAiLCJydW5uZXJfZW52aXJvbm1lbnQiOiJnaXRodWItaG9zdGVkIn19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ka3BrZy9Db21tb25zQmFzZV9TdGRAcmVmcy90YWdzLzIuNi4yMDI2MDkyMDE0NDM0NyIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI3MTAwODc3NDlhMjM2ZmMxZGRiYTgxMjhjODllMTA5NDJmY2JmNDVhIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ka3BrZy9Db21tb25zQmFzZV9TdGQvLmdpdGh1Yi93b3JrZmxvd3MvZGlzdHJpYnV0ZS0yLjYueW1sQHJlZnMvdGFncy8yLjYuMjAyNjA5MjAxNDQzNDcifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnL0NvbW1vbnNCYXNlX1N0ZC9hY3Rpb25zL3J1bnMvMzU1MTc0MjczNDEvYXR0ZW1wdHMvMSJ9fX19","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEQCIBt0i/fU1twcujsoSGBjAaMrqpHZykr6hTCwSkgeIUzXAiA3Rk65ckEjjESfuMuWUYzTKL/6LfQoo/dcNptMWX28KQ=="}]}}
+            ] },
+          "github_slsa_v1_l3": {},
+          "openbsd_signify": {
+            "signature": "untrusted comment: signed by key f012f39422d61ed2\nRWTwEvOUItYe0tfCgKd/tlW9sEzphV1poCzJ5lFcNpeSHZ8YuxrYsKx8GQlTB32tlaMsmKgueNAF+nSzdPLhlEkattW45QfFcgM=\n"
+          }
+        },
+        "build_to_sign": {
+          "bundle_canonical": "b2de006a2e13c31a1b930e9b028dbb9f5a00de20b91d0b5244bab6c55122641a",
+          "bundle_modver": "CommonsBase_Std.Distribution@2.6.20260920144347",
+          "modules": [
+            "CommonsBase_Std.Coreutils@0.6.0",
+            "CommonsBase_Std.Coreutils@0.8.0",
+            "CommonsBase_Std.Distribution@2.6.20260920144347",
+            "CommonsBase_Std.Fd@10.3.0", "CommonsBase_Std.S7z@25.1.0",
+            "CommonsBase_Std.Toybox@0.8.9",
+            "CommonsBase_Std.Apparatus.Nano@0.1.0",
+            "CommonsBase_Std.Apparatus.NanoTbz@0.1.0",
+            "CommonsBase_Std.Apparatus.NanoZst@0.1.0",
+            "CommonsBase_Std.Assets.RustAbi@0.1.0",
+            "CommonsBase_Std.Coreutils.Bundle@0.6.0",
+            "CommonsBase_Std.Coreutils.Bundle@0.8.0",
+            "CommonsBase_Std.Coreutils.Exe@0.6.0",
+            "CommonsBase_Std.Coreutils.Exe@0.8.0",
+            "CommonsBase_Std.Coreutils.Tar@0.8.0",
+            "CommonsBase_Std.Extract.F_TarToZip@0.1.0",
+            "CommonsBase_Std.Extract.F_TarToZip@0.1.1",
+            "CommonsBase_Std.Extract.F_TarToZip@0.2.0",
+            "CommonsBase_Std.Extract.F_TarToZip@0.2.1",
+            "CommonsBase_Std.Extract.F_TarToZip@0.3.0",
+            "CommonsBase_Std.Extract.F_TarToZip@0.3.1",
+            "CommonsBase_Std.Extract.F_Untar@0.1.0",
+            "CommonsBase_Std.Extract.F_Untar@0.1.1",
+            "CommonsBase_Std.Extract.F_Untar@0.2.0",
+            "CommonsBase_Std.Extract.F_Untar@0.2.1",
+            "CommonsBase_Std.Extract.F_Untar@0.3.0",
+            "CommonsBase_Std.Extract.F_Untar@0.3.1",
+            "CommonsBase_Std.Fd.Bundle@10.3.0",
+            "CommonsBase_Std.Fd.Tar@10.3.0",
+            "CommonsBase_Std.Fd.Tar.Darwin_arm64@10.3.0",
+            "CommonsBase_Std.Fd.Tar.Darwin_x86_64@10.3.0",
+            "CommonsBase_Std.Fd.Tar.Linux_arm64@10.3.0",
+            "CommonsBase_Std.Fd.Tar.Linux_x86@10.3.0",
+            "CommonsBase_Std.Fd.Tar.Linux_x86_64@10.3.0",
+            "CommonsBase_Std.S7z.Bundle@25.1.0",
+            "CommonsBase_Std.S7z.MacLinux7zExe@25.1.0",
+            "CommonsBase_Std.S7z.MacLinux7zTar@25.1.0",
+            "CommonsBase_Std.S7z.S7zr@25.1.0",
+            "CommonsBase_Std.S7z.Windows7zExe@25.1.0"
+          ],
+          "producer_accepts": [],
+          "distmeta": {
+            "traces": [
+              {
+                "tag": "cts.1",
+                "path": "CommonsBase_Std-dist-win32.distmeta.cts.1.tracestore"
+              }
+            ],
+            "values": [
+              {
+                "path": "CommonsBase_Std-dist-win32.distmeta.valuestore.zip"
+              }
+            ]
+          },
+          "package": {
+            "traces": [
+              {
+                "tag": "cts.1",
+                "path": "CommonsBase_Std-dist-win32.package.cts.1.tracestore"
+              }
+            ],
+            "values": [
+              { "path": "CommonsBase_Std-dist-win32.package.valuestore.zip" }
+            ]
+          },
+          "script_module_sha256s": [
+            "3198432003cb0a0ebb2da7f8d3f50729d0a1b5657fa10a907fcefba2d2b1c03c",
+            "42dbd74c950125640171023de44408ee70f3f4b232371d285562eb582cbda410",
+            "86defb1b6656d796b7bac298df650533cced4c0d9a39b71c84d5d9b52b84a303",
+            "a9bbaa427f7639ed0fa7ee977a8c936984fd99731425c54d9923b054db9a9149",
+            "d7de396df11530cf6d76ca4bb2842592298eaad440a06835509eaedb2533b18a",
+            "e10eb30ef2a9ffe80fa47e8f929bcf40f59fa4d02902cfc6bfa5c805c336094d"
+          ]
+        }
+      },
+      "continuations": {
+        "attestation": {
+          "openbsd_signify": {
+            "signature": "untrusted comment: signed by key f012f39422d61ed2\nRWTwEvOUItYe0gzpAbJQl2uQHm6a/ru/M6czxUmSNJFozpqA1f6FUP0mjdnyZg7DwC5w3LqcEo1VtkW3KjuypmVTskl3hBr2jQk=\n"
+          }
+        },
+        "continuations_to_sign": {
+          "2.7": {
+            "application": { "name": "dk0", "version": "2.4.2+rev-233" },
+            "openbsd_signify": {
+              "public_key": "untrusted comment: CommonsBase_Std-2.7\nRWSesfERD4t0CfZXffufCrILIaAbo1MAkv71wC4pAb5zY5BnOkzq3yB5\n"
+            }
+          },
+          "2.8": {
+            "application": { "name": "dk0", "version": "2.4.2+rev-233" },
+            "openbsd_signify": {
+              "public_key": "untrusted comment: CommonsBase_Std-2.8\nRWTooNFcmKODlGshCH/ckDm33SWya+8Xfp/B4jc6mGNtN5v6N8gMtU0X\n"
+            }
+          },
+          "3.0": {
+            "openbsd_signify": {
+              "public_key": "untrusted comment: CommonsBase_Std-3.0\nRWTzxNnZQeugZoU4+2DgxxktaEJKGlEprALP67bac7HPQxAK4ee1WCxk\n"
+            }
+          }
+        }
+      },
+      "id": "CommonsBase_Std@2.6.20260920144347",
+      "license": { "spdx": "Apache-2.0" },
+      "producer": {
+        "application": { "name": "dk0", "version": "2.4.3+rev-22" },
+        "github_slsa_v1_l2": { "repository": "dkpkg/CommonsBase_Std" },
+        "openbsd_signify": {
+          "public_key": "untrusted comment: CommonsBase_Std-2.6\nRWTwEvOUItYe0u6ALvOER15EmRBMzwb9DEEJrCiJ25gMRzqHhpxtxa5a\n"
+        }
+      },
+      "min_dk_version": "2.4.2.213"
+    }
+  ],
+  "forms": [],
+  "schema_version": { "major": 1, "minor": 0 }
+}

etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json ADDED Viewed

	@@ -0,0 +1,815 @@

+{
+  "bundles": [
+    {
+      "assets": [
+        {
+          "checksum": {
+            "blake2b256": "1819ec510943ecfd42b950d41995a05d2d7c827f786e592cc6f3b26639f6150a"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_arm64.distmeta.cts.1.tracestore",
+          "size": 259717
+        },
+        {
+          "checksum": {
+            "blake2b256": "6ac1e00affe868a6059af96381e03bc8a7ad50c7ac671a352b6abc4bff05308a"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 419972,
+                "central_size": 1200,
+                "checksum": {
+                  "blake2b256": "19f43aa1755ed3a9564a626dd2847574aa5d77f4971e232f959d58608c69e07d"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_arm64.distmeta.manifest.zip",
+          "size": 421172
+        },
+        {
+          "checksum": {
+            "blake2b256": "e2f61225e166ad84a07e184f419558fac20a8e9b243976c90639ff6095f6e868"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 182312,
+                "central_size": 1253,
+                "checksum": {
+                  "blake2b256": "19fcb54c52583457923662d4de743cee18a7a6c4b6c13517221b4077e2589be5"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_arm64.distmeta.valuestore.zip",
+          "size": 183565
+        },
+        {
+          "checksum": {
+            "blake2b256": "9d98f3ffa0617a5d45a53213df0593e2bbfc050fb66ac0b47b25ce9a2a45bdbb"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_arm64.package.cts.1.tracestore",
+          "size": 294213
+        },
+        {
+          "checksum": {
+            "blake2b256": "720fa29247171726b1893163a2c82d4e1b5c7bd418efd33317e5f641798826c9"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 706117231,
+                "central_size": 14063,
+                "checksum": {
+                  "blake2b256": "4c19275a9385d31deb72ded871357fbda893c39274bd96d106d9745e9db98c25"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_arm64.package.valuestore.zip",
+          "size": 706131294
+        },
+        {
+          "checksum": {
+            "blake2b256": "77d2b4f7fad963206489ad9137addd5fbd9bdb65cf8499e36f04265926c0a21e"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.distmeta.cts.1.tracestore",
+          "size": 219088
+        },
+        {
+          "checksum": {
+            "blake2b256": "86aaf2c8982272b6966038e4a91a4f3de4c569f8a3588753b3507f4f795baff9"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 419962,
+                "central_size": 1201,
+                "checksum": {
+                  "blake2b256": "d90a680719ffa0f9946c4833b842222a996f9df08a9bd523c73ddf45a476d3e9"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.distmeta.manifest.zip",
+          "size": 421163
+        },
+        {
+          "checksum": {
+            "blake2b256": "b505989c29d44ecb7b22d98e4f2ebfe1acfd9f1c2ec8cf0510e6e16f829a3027"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 166877,
+                "central_size": 1148,
+                "checksum": {
+                  "blake2b256": "913884385abe8d577e19753e58412e698f768fe72bbd907ebd9621896774182c"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.distmeta.valuestore.zip",
+          "size": 168025
+        },
+        {
+          "checksum": {
+            "blake2b256": "f001aa16d2d8c42ce3f4424452d3bfff6d09f779975d063d7ceba0d73a64d372"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.package.cts.1.tracestore",
+          "size": 263406
+        },
+        {
+          "checksum": {
+            "blake2b256": "ce2ddb6fc236c65acc5f79d85544641a7f1445dc47bb6af0a9be222300cce1b0"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 694548893,
+                "central_size": 10703,
+                "checksum": {
+                  "blake2b256": "e9cb5f71fc7a150500ab4a401b227e9271126e50d523831bf3084ccd4b9416cd"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.package.valuestore.zip",
+          "size": 694559596
+        },
+        {
+          "checksum": {
+            "blake2b256": "77d2b4f7fad963206489ad9137addd5fbd9bdb65cf8499e36f04265926c0a21e"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.distmeta.cts.1.tracestore",
+          "size": 219088
+        },
+        {
+          "checksum": {
+            "blake2b256": "1b7d1344c187acd1b6159a73aec5d65d5287f0ebf18bde4d0ce62e97875d7a0c"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 419883,
+                "central_size": 1197,
+                "checksum": {
+                  "blake2b256": "d58a6909967392060a6713e6d313ec8722fc77d8a169c5ac044ea786caac0e93"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.distmeta.manifest.zip",
+          "size": 421080
+        },
+        {
+          "checksum": {
+            "blake2b256": "b505989c29d44ecb7b22d98e4f2ebfe1acfd9f1c2ec8cf0510e6e16f829a3027"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 166877,
+                "central_size": 1148,
+                "checksum": {
+                  "blake2b256": "913884385abe8d577e19753e58412e698f768fe72bbd907ebd9621896774182c"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.distmeta.valuestore.zip",
+          "size": 168025
+        },
+        {
+          "checksum": {
+            "blake2b256": "5fad041933c42408a4e88f5cf89cf97ce0da9a09292781c088b66a7908a31020"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.package.cts.1.tracestore",
+          "size": 260591
+        },
+        {
+          "checksum": {
+            "blake2b256": "f2bd8030e571d7e9ade9cd55f6d35bb7ab2d3c6818756c11fed57de4c2771055"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 471842706,
+                "central_size": 10283,
+                "checksum": {
+                  "blake2b256": "7bfb18b31e52ec73a4038ab4d019a03fdf85d4b4299c9887ce857a2deacfa718"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.package.valuestore.zip",
+          "size": 471852989
+        },
+        {
+          "checksum": {
+            "blake2b256": "ef79ef0c6a885b8a1dbd699d11aa74ac2c407789c6d025f2909d3fa1f80f0e6f"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.distmeta.cts.1.tracestore",
+          "size": 760178
+        },
+        {
+          "checksum": {
+            "blake2b256": "21dc901bebc0a21693805b1379f4abbf3d8303c46a3aeaff9b22dc9cf290c501"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 420590,
+                "central_size": 1200,
+                "checksum": {
+                  "blake2b256": "145431b17faf5d21beecd727112e89b9d38a4513328fc527966cf51efc94bcc2"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.distmeta.manifest.zip",
+          "size": 421790
+        },
+        {
+          "checksum": {
+            "blake2b256": "8e9bca44b73c17c71666a28454dbd90c14002faf744a0af88735e02ecb5f364a"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 387796,
+                "central_size": 3038,
+                "checksum": {
+                  "blake2b256": "cf8ce4e6178400617f347cc8375d7735aa6d50fd1468adcb12a51858388bb6e6"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.distmeta.valuestore.zip",
+          "size": 390834
+        },
+        {
+          "checksum": {
+            "blake2b256": "449f90ca31d7eee2594bcc55558c553495d90bf0340c4ec6d0a12cd628c3f494"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.package.cts.1.tracestore",
+          "size": 321796
+        },
+        {
+          "checksum": {
+            "blake2b256": "8bf420e35bb0dc27d3a576b96a5ac2eea6c211d0844d3f4e797f8069a3cc5c71"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 828855353,
+                "central_size": 17108,
+                "checksum": {
+                  "blake2b256": "b4a89f16781fb42d5fa8696d0ac88c50b1599b217a505c8d65d8a741ca05fd07"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.package.valuestore.zip",
+          "size": 828872461
+        },
+        {
+          "checksum": {
+            "blake2b256": "77d2b4f7fad963206489ad9137addd5fbd9bdb65cf8499e36f04265926c0a21e"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.distmeta.cts.1.tracestore",
+          "size": 219088
+        },
+        {
+          "checksum": {
+            "blake2b256": "7c7174f9d2fefc6b9bb31641912c114649a9d1c3b7c6336159b8078001cec2ee"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 420681,
+                "central_size": 1205,
+                "checksum": {
+                  "blake2b256": "c24178998535d51de29d8732da3c18526272d09279cc928cfe5569d00d7d0431"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.distmeta.manifest.zip",
+          "size": 421886
+        },
+        {
+          "checksum": {
+            "blake2b256": "b505989c29d44ecb7b22d98e4f2ebfe1acfd9f1c2ec8cf0510e6e16f829a3027"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 166877,
+                "central_size": 1148,
+                "checksum": {
+                  "blake2b256": "913884385abe8d577e19753e58412e698f768fe72bbd907ebd9621896774182c"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.distmeta.valuestore.zip",
+          "size": 168025
+        },
+        {
+          "checksum": {
+            "blake2b256": "59293a3f844134ddf9adcbe4f8332e152bebaa9032b7f9f355fcc2c5f34a8b0a"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.package.cts.1.tracestore",
+          "size": 259146
+        },
+        {
+          "checksum": {
+            "blake2b256": "a2e53b5f254d1e077dd919c4ed2264ecabcfc9581cee23bac8f9fc4af7775ad4"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 839537604,
+                "central_size": 10073,
+                "checksum": {
+                  "blake2b256": "abc7c04528c6ba9bf45374a2ff6880ddebfb14ae61b0459718ef1f50314dce8e"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.package.valuestore.zip",
+          "size": 839547677
+        },
+        {
+          "checksum": {
+            "blake2b256": "6c2daa6e8fefc06739c4bc4d70c12e2f76de462f7b050234f6d0d8f346b7b3ea"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.distmeta.cts.1.tracestore",
+          "size": 219088
+        },
+        {
+          "checksum": {
+            "blake2b256": "cffbacede7443430dc4a3e5435569d769fc9089531cc46ca10d068b39a58e174"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 419958,
+                "central_size": 1199,
+                "checksum": {
+                  "blake2b256": "29b053a164888eb781c570abd6e1915560073b35cb9a56d7f6b147b8d21ba597"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.distmeta.manifest.zip",
+          "size": 421157
+        },
+        {
+          "checksum": {
+            "blake2b256": "b505989c29d44ecb7b22d98e4f2ebfe1acfd9f1c2ec8cf0510e6e16f829a3027"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 166877,
+                "central_size": 1148,
+                "checksum": {
+                  "blake2b256": "913884385abe8d577e19753e58412e698f768fe72bbd907ebd9621896774182c"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.distmeta.valuestore.zip",
+          "size": 168025
+        },
+        {
+          "checksum": {
+            "blake2b256": "46435e89f8bd21f0f921ce0e7a5f41fd94804306cb1e3a9b4f3251d69b6003b7"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.package.cts.1.tracestore",
+          "size": 266983
+        },
+        {
+          "checksum": {
+            "blake2b256": "ac7299edec63d358ed929968d6aada92a7dced91c0451f693dd7586023af8eb6"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 261334823,
+                "central_size": 10493,
+                "checksum": {
+                  "blake2b256": "eb3fa2f933f804545cbafeafb376d3da3f0c9d31625f625cf82a578b8a84a69f"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.package.valuestore.zip",
+          "size": 261345316
+        },
+        {
+          "checksum": {
+            "blake2b256": "ef79ef0c6a885b8a1dbd699d11aa74ac2c407789c6d025f2909d3fa1f80f0e6f"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86_64.distmeta.cts.1.tracestore",
+          "size": 760178
+        },
+        {
+          "checksum": {
+            "blake2b256": "8a66fb9d0efb567fc46051713c2316eb62082de50b900e59c85dc1451b7c220c"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 420134,
+                "central_size": 1202,
+                "checksum": {
+                  "blake2b256": "185e7de7d66191596495a49aa9ef5e00778437d8b77367e4520af35992e6eba9"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86_64.distmeta.manifest.zip",
+          "size": 421336
+        },
+        {
+          "checksum": {
+            "blake2b256": "8e9bca44b73c17c71666a28454dbd90c14002faf744a0af88735e02ecb5f364a"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 387796,
+                "central_size": 3038,
+                "checksum": {
+                  "blake2b256": "cf8ce4e6178400617f347cc8375d7735aa6d50fd1468adcb12a51858388bb6e6"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86_64.distmeta.valuestore.zip",
+          "size": 390834
+        },
+        {
+          "checksum": {
+            "blake2b256": "19b64874498de16248bfbe6b614b7e4860a7b4561d540f262690de4309633e7a"
+          },
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86_64.package.cts.1.tracestore",
+          "size": 382661
+        },
+        {
+          "checksum": {
+            "blake2b256": "d257c78dd27503631d73b46f6ec3fa9421b660370540bc1ea79521d994805325"
+          },
+          "indexes": [
+            {
+              "type": "zip",
+              "zip": {
+                "local_offset": 0,
+                "central_offset": 873766957,
+                "central_size": 19418,
+                "checksum": {
+                  "blake2b256": "4d3080718723003fbaff083cd0136c2ec7ee8293e2f5b72fc249a764abfff76d"
+                }
+              }
+            }
+          ],
+          "origin": "CommonsLang_OCaml",
+          "path": "CommonsLang_OCaml-Windows_x86_64.package.valuestore.zip",
+          "size": 873786375
+        }
+      ],
+      "id": "CommonsLang_OCaml.Distribution@0.1.20260920144347",
+      "listing": {
+        "origins": [
+          {
+            "name": "CommonsLang_OCaml",
+            "mirrors": [
+              "https://github.com/dkpkg/CommonsLang_OCaml/releases/download/0.1.20260920144347"
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "distributions": [
+    {
+      "build": {
+        "attestation": {
+          "github_slsa_v1_l2": {
+            "docs": [
+              {"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHiTCCBw+gAwIBAgIUTdEGvjV/+RPctkSyPrhGxU4J6RcwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTIwMTg1MDAxWhcNMjYwOTIwMTkwMDAxWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUV408k88Q1R/wBHXiyaiMf4fQrnQTJ79zSY1bq4yT+k4doQy1GTqyP+/ORqBo9uT5AQfS0f/owsPqz79918l56OCBi4wggYqMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUXjI+L4VOqPnc1UtEG+huxOjHdpgwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wegYDVR0RAQH/BHAwboZsaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnL0NvbW1vbnNMYW5nX09DYW1sLy5naXRodWIvd29ya2Zsb3dzL2Rpc3RyaWJ1dGUtMC4xLnltbEByZWZzL3RhZ3MvMC4xLjIwMjYwOTIwMTQ0MzQ3MDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wEgYKKwYBBAGDvzABAgQEcHVzaDA2BgorBgEEAYO/MAEDBCgzZDg1ZWNjNDI0ZGI1ZWVmNzBjNzUwOWZmMzJhNzhjODE5ODI0ZGFiMDIGCisGAQQBg78wAQQEJC5naXRodWIvd29ya2Zsb3dzL2Rpc3RyaWJ1dGUtMC4xLnltbDAlBgorBgEEAYO/MAEFBBdka3BrZy9Db21tb25zTGFuZ19PQ2FtbDAqBgorBgEEAYO/MAEGBBxyZWZzL3RhZ3MvMC4xLjIwMjYwOTIwMTQ0MzQ3MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTB8BgorBgEEAYO/MAEJBG4MbGh0dHBzOi8vZ2l0aHViLmNvbS9ka3BrZy9Db21tb25zTGFuZ19PQ2FtbC8uZ2l0aHViL3dvcmtmbG93cy9kaXN0cmlidXRlLTAuMS55bWxAcmVmcy90YWdzLzAuMS4yMDI2MDkyMDE0NDM0NzA4BgorBgEEAYO/MAEKBCoMKDNkODVlY2M0MjRkYjVlZWY3MGM3NTA5ZmYzMmE3OGM4MTk4MjRkYWIwHQYKKwYBBAGDvzABCwQPDA1naXRodWItaG9zdGVkMDoGCisGAQQBg78wAQwELAwqaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnL0NvbW1vbnNMYW5nX09DYW1sMDgGCisGAQQBg78wAQ0EKgwoM2Q4NWVjYzQyNGRiNWVlZjcwYzc1MDlmZjMyYTc4YzgxOTgyNGRhYjAsBgorBgEEAYO/MAEOBB4MHHJlZnMvdGFncy8wLjEuMjAyNjA5MjAxNDQzNDcwGgYKKwYBBAGDvzABDwQMDAoxMjIyODc0MTc5MCgGCisGAQQBg78wARAEGgwYaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnMBkGCisGAQQBg78wAREECwwJMjc4OTEzNTAwMHwGCisGAQQBg78wARIEbgxsaHR0cHM6Ly9naXRodWIuY29tL2RrcGtnL0NvbW1vbnNMYW5nX09DYW1sLy5naXRodWIvd29ya2Zsb3dzL2Rpc3RyaWJ1dGUtMC4xLnltbEByZWZzL3RhZ3MvMC4xLjIwMjYwOTIwMTQ0MzQ3MDgGCisGAQQBg78wARMEKgwoM2Q4NWVjYzQyNGRiNWVlZjcwYzc1MDlmZjMyYTc4YzgxOTgyNGRhYjAUBgorBgEEAYO/MAEUBAYMBHB1c2gwXgYKKwYBBAGDvzABFQRQDE5odHRwczovL2dpdGh1Yi5jb20vZGtwa2cvQ29tbW9uc0xhbmdfT0NhbWwvYWN0aW9ucy9ydW5zLzM1NTI3OTU2OTI4L2F0dGVtcHRzLzEwFgYKKwYBBAGDvzABFgQIDAZwdWJsaWMwTQYKKwYBBAGDvzABGAQ/DD1yZXBvOmRrcGtnL0NvbW1vbnNMYW5nX09DYW1sOnJlZjpyZWZzL3RhZ3MvMC4xLjIwMjYwOTIwMTQ0MzQ3MIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGgwCdgTgAABAMARzBFAiAkad7IivzCkVQhZn4ij/dKMtUdLQsRJBYos3B5RFj4ngIhAN0anD3VWnplhbQnnh+zjzbXkEf6bSDSaW0DWFVkf8YnMAoGCCqGSM49BAMDA2gAMGUCMQD3vnXU49SXYwN+W3TJNQOEvHWC7Gpwl08GY6zUQyfkI5QvaM30EhAPOwNr+ecu78YCMCZTYn+LlRJkXv68Aifzpl+eDSUniVjLW5cgi6VX1t5ySQVWf4sipAlg+Ixt7eQKOg=="},"tlogEntries":[{"logIndex":"2902425149","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1789930201","inclusionPromise":{"signedEntryTimestamp":"MEQCID9wGWkL4tTmmOP0WUGLpZ7GkNm/yrchvnWG5Ncw061WAiAroCo5WU8+NYnHO5kmA6a6NJvpqnaE/r7yIpKAU8VgAA=="},"inclusionProof":{"logIndex":"2780520887","rootHash":"x2BTQSt4+BqsCNz48Q/nUDKtVb8X+diVFRmakLhuOC0=","treeSize":"2780520911","hashes":["e47HAPBzl11vfzrSCme3iRIx1NddLhtmUOYHfxQJ35o=","v1DFwi3ROozDOl0dwgpTCweJlP4OypyWEfDa+LtieRc=","IDNCdXCfW/ovvseVdwQyp4KOfjpyGoJDv26jOIm0/+g=","FnNK5UM4YRD4lErAa2ZPOTKHt2pSNhjgx48wM5cbLns=","uTe723lDVNOWU19MS3JgRR3mslxyWTbx0XrCX2W5ML4=","yY3FALo38nlmLkBNuSSzz60NproC+KPq9rUkd3gUx5c=","2g9fji7TNrrWTvMGt57t09+Ry1nDfmW24q3vvY04Ii0=","zm71OIt9beLJ9h/6upMGUpyxpBupJWlGDgOPBOb6o3E=","PnI2d6STSUpsciVs3VH7NpEW8t7iBVaPIIevHGHlMfU=","lhDjYMzedp2RxYBmScsDEtlxuxmtdy7KgwyecAOg3pc=","NHzw2hdxvOoGMsTeU1u997ZhMrU+TK08Ou4Xyz15Tsg=","tXOpGcIJdut1+PYUwhU09yqIExI/sVCDRukM1lZjtuM=","wpaR6ERJhaQBBFEtcUF9PZlw8/pqoS3Z0gDu1wYVLII=","7RcxS0pJxcmGtmMbmh8yAX4q9ikAuy1Yal2AdoW88VQ=","QKbPp61YvxgFORfHJl0dJ7SVftZR6WHgASgOUJ6J2aU=","uoMJ++IgguD5VRdcuqQ23KlKD9ZqrcoC6hqQDy2rPFM=","tyO4Oj1UrXex15tzrEEO6sSnE8y8obZWghZ2XixBPtE=","rjDiNJHGnboMYYUH7OSezbKWj3wMXRTHGCLa/SaZ6O4=","mfWjSdNaEfNXxDww6AAOw/NoK9e6z1yKaZm5xvmMabs=","qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2780520911\nx2BTQSt4+BqsCNz48Q/nUDKtVb8X+diVFRmakLhuOC0=\n\n— rekor.sigstore.dev wNI9ajBFAiB4InmMvUJ55gNYTlY76imGfMcyYV/A/YCYOX2L//LfxQIhAMrdwzzp80lqtXr2zgMvwhRguWSy6jC0AvVA+0vG03D7\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiYzQwNDNiN2UzZDUyZGQ0Mzc5YjUyZjRmZTNiY2UxZDlhMGVlNmZhZjY5ZTVkNjMyY2I0ZDNlMjVhNzAwNmE5MyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjY1YTVhM2VhOGFmM2Q1OTcwOTdhODlmNjIxYjUwN2ZiOWY1ODBlNjAxY2Y1NWE1Yjc3NWE5NWQzN2Q0NmQzN2YifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRQzErNG5pQlNCblNHd2UvcUFzZEt2VGtFVkVpYnlJMndqRUc2dU52S1loRndJZ0VUYVJaTGxxbXdIMUZ1QngzZ0dsUk5xK1ByVmVML3drUFRTT0hYZnhBcUE9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VocFZFTkRRbmNyWjBGM1NVSkJaMGxWVkdSRlIzWnFWaThyVWxCamRHdFRlVkJ5YUVkNFZUUktObEpqZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVTWGROVkdjeFRVUkJlRmRvWTA1TmFsbDNUMVJKZDAxVWEzZE5SRUY0VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlZWalF3T0dzNE9GRXhVaTkzUWtoWWFYbGhhVTFtTkdaUmNtNVJWRW8zT1hwVFdURUtZbkUwZVZRcmF6UmtiMUY1TVVkVWNYbFFLeTlQVW5GQ2J6bDFWRFZCVVdaVE1HWXZiM2R6VUhGNk56azVNVGhzTlRaUFEwSnBOSGRuWjFseFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVllha2tyQ2t3MFZrOXhVRzVqTVZWMFJVY3JhSFY0VDJwSVpIQm5kMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMlZuV1VSV1VqQlNRVkZJTDBKSVFYZGliMXB6WVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBUREpTY21OSGRHNU1NRTUyWWxjeGRncGliazVOV1ZjMWJsZ3dPVVJaVnpGelRIazFibUZZVW05a1YwbDJaREk1ZVdFeVduTmlNMlI2VERKU2NHTXpVbmxoVjBveFpFZFZkRTFETkhoTWJteDBDbUpGUW5sYVYxcDZURE5TYUZvelRYWk5RelI0VEdwSmQwMXFXWGRQVkVsM1RWUlJNRTE2VVROTlJHdEhRMmx6UjBGUlVVSm5OemgzUVZGRlJVc3lhREFLWkVoQ2VrOXBPSFprUnpseVdsYzBkVmxYVGpCaFZ6bDFZM2sxYm1GWVVtOWtWMG94WXpKV2VWa3lPWFZrUjFaMVpFTTFhbUl5TUhkRloxbExTM2RaUWdwQ1FVZEVkbnBCUWtGblVVVmpTRlo2WVVSQk1rSm5iM0pDWjBWRlFWbFBMMDFCUlVSQ1EyZDZXa1JuTVZwWFRtcE9SRWt3V2tkSk1WcFhWbTFPZWtKcUNrNTZWWGRQVjFwdFRYcEthRTU2YUdwUFJFVTFUMFJKTUZwSFJtbE5SRWxIUTJselIwRlJVVUpuTnpoM1FWRlJSVXBETlc1aFdGSnZaRmRKZG1ReU9Ya0tZVEphYzJJelpIcE1NbEp3WXpOU2VXRlhTakZrUjFWMFRVTTBlRXh1YkhSaVJFRnNRbWR2Y2tKblJVVkJXVTh2VFVGRlJrSkNaR3RoTTBKeVduazVSQXBpTWpGMFlqSTFlbFJIUm5WYU1UbFFVVEpHZEdKRVFYRkNaMjl5UW1kRlJVRlpUeTlOUVVWSFFrSjRlVnBYV25wTU0xSm9Xak5OZGsxRE5IaE1ha2wzQ2sxcVdYZFBWRWwzVFZSUk1FMTZVVE5OUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVJNFFtZHZja0puUlVWQldVOHZUVUZGU2tKSE5FMWlSMmd3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhMkV6UW5KYWVUbEVZakl4ZEdJeU5YcFVSMFoxV2pFNVVGRXlSblJpUXpoMVdqSnNNR0ZJVm1sTU0yUjJDbU50ZEcxaVJ6a3pZM2s1YTJGWVRqQmpiV3hwWkZoU2JFeFVRWFZOVXpVMVlsZDRRV050Vm0xamVUa3dXVmRrZWt4NlFYVk5VelI1VFVSSk1rMUVhM2tLVFVSRk1FNUVUVEJPZWtFMFFtZHZja0puUlVWQldVOHZUVUZGUzBKRGIwMUxSRTVyVDBSV2JGa3lUVEJOYWxKcldXcFdiRnBYV1ROTlIwMHpUbFJCTlFwYWJWbDZUVzFGTTA5SFRUUk5WR3MwVFdwU2ExbFhTWGRJVVZsTFMzZFpRa0pCUjBSMmVrRkNRM2RSVUVSQk1XNWhXRkp2WkZkSmRHRkhPWHBrUjFackNrMUViMGREYVhOSFFWRlJRbWMzT0hkQlVYZEZURUYzY1dGSVVqQmpTRTAyVEhrNWJtRllVbTlrVjBsMVdUSTVkRXd5VW5KalIzUnVUREJPZG1KWE1YWUtZbTVPVFZsWE5XNVlNRGxFV1ZjeGMwMUVaMGREYVhOSFFWRlJRbWMzT0hkQlVUQkZTMmQzYjAweVVUUk9WMVpxV1hwUmVVNUhVbWxPVjFac1dtcGpkd3BaZW1NeFRVUnNiVnBxVFhsWlZHTTBXWHBuZUU5VVozbE9SMUpvV1dwQmMwSm5iM0pDWjBWRlFWbFBMMDFCUlU5Q1FqUk5TRWhLYkZwdVRYWmtSMFp1Q21ONU9IZE1ha1YxVFdwQmVVNXFRVFZOYWtGNFRrUlJlazVFWTNkSFoxbExTM2RaUWtKQlIwUjJla0ZDUkhkUlRVUkJiM2hOYWtsNVQwUmpNRTFVWXpVS1RVTm5SME5wYzBkQlVWRkNaemM0ZDBGU1FVVkhaM2RaWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBUREpTY21OSGRHNU5RbXRIUTJselJ3cEJVVkZDWnpjNGQwRlNSVVZEZDNkS1RXcGpORTlVUlhwT1ZFRjNUVWgzUjBOcGMwZEJVVkZDWnpjNGQwRlNTVVZpWjNoellVaFNNR05JVFRaTWVUbHVDbUZZVW05a1YwbDFXVEk1ZEV3eVVuSmpSM1J1VERCT2RtSlhNWFppYms1TldWYzFibGd3T1VSWlZ6RnpUSGsxYm1GWVVtOWtWMGwyWkRJNWVXRXlXbk1LWWpOa2Vrd3lVbkJqTTFKNVlWZEtNV1JIVlhSTlF6UjRURzVzZEdKRlFubGFWMXA2VEROU2FGb3pUWFpOUXpSNFRHcEpkMDFxV1hkUFZFbDNUVlJSTUFwTmVsRXpUVVJuUjBOcGMwZEJVVkZDWnpjNGQwRlNUVVZMWjNkdlRUSlJORTVYVm1wWmVsRjVUa2RTYVU1WFZteGFhbU4zV1hwak1VMUViRzFhYWsxNUNsbFVZelJaZW1kNFQxUm5lVTVIVW1oWmFrRlZRbWR2Y2tKblJVVkJXVTh2VFVGRlZVSkJXVTFDU0VJeFl6Sm5kMWhuV1V0TGQxbENRa0ZIUkhaNlFVSUtSbEZTVVVSRk5XOWtTRkozWTNwdmRrd3laSEJrUjJneFdXazFhbUl5TUhaYVIzUjNZVEpqZGxFeU9YUmlWemwxWXpCNGFHSnRaR1pVTUU1b1lsZDNkZ3BaVjA0d1lWYzVkV041T1hsa1Z6VjZUSHBOTVU1VVNUTlBWRlV5VDFSSk5Fd3lSakJrUjFaMFkwaFNla3g2UlhkR1oxbExTM2RaUWtKQlIwUjJla0ZDQ2tablVVbEVRVnAzWkZkS2MyRlhUWGRVVVZsTFMzZFpRa0pCUjBSMmVrRkNSMEZSTDBSRU1YbGFXRUoyVDIxU2NtTkhkRzVNTUU1MllsY3hkbUp1VGswS1dWYzFibGd3T1VSWlZ6RnpUMjVLYkZwcWNIbGFWMXA2VEROU2FGb3pUWFpOUXpSNFRHcEpkMDFxV1hkUFZFbDNUVlJSTUUxNlVUTk5TVWRMUW1kdmNncENaMFZGUVdSYU5VRm5VVU5DU0hkRlpXZENORUZJV1VFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdDamR2TkVGQlFVZG5kME5rWjFSblFVRkNRVTFCVW5wQ1JrRnBRV3RoWkRkSmFYWjZRMnRXVVdoYWJqUnBhaTlrUzAxMFZXUk1VWE5TU2tKWmIzTXpRalVLVWtacU5HNW5TV2hCVGpCaGJrUXpWbGR1Y0d4b1lsRnVibWdyZW1wNllsaHJSV1kyWWxORVUyRlhNRVJYUmxaclpqaFpiazFCYjBkRFEzRkhVMDAwT1FwQ1FVMUVRVEpuUVUxSFZVTk5VVVF6ZG01WVZUUTVVMWhaZDA0clZ6TlVTazVSVDBWMlNGZEROMGR3ZDJ3d09FZFpObnBWVVhsbWEwazFVWFpoVFRNd0NrVm9RVkJQZDA1eUsyVmpkVGM0V1VOTlExcFVXVzRyVEd4U1NtdFlkalk0UVdsbWVuQnNLMlZFVTFWdWFWWnFURmMxWTJkcE5sWllNWFExZVZOUlZsY0taalJ6YVhCQmJHY3JTWGgwTjJWUlMwOW5QVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfX0="}],"timestampVerificationData":{}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtRGFyd2luX2FybTY0LmRpc3RtZXRhLmN0cy4xLnRyYWNlc3RvcmUiLCJkaWdlc3QiOnsic2hhMjU2IjoiMjYyYTQzOGFmYTgxNGNlYjU0NjM5ZTBhMjFkMDllMDhhMjdiN2JiNTkzNzU2Njg5OWExNzIyNTM5NDM4Nzc5YyJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1EYXJ3aW5fYXJtNjQuZGlzdG1ldGEubWFuaWZlc3QuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6Ijc2NTY3Yjc2NTcwOWUxODA5NGZlYTFmNDk4MDBiNTY2ZmQyZWEyOWE5NmE5YTRlNTgyZDUxMmM5OGQ5OGVjMTAifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtRGFyd2luX2FybTY0LmRpc3RtZXRhLnZhbHVlc3RvcmUuaW5kZXgiLCJkaWdlc3QiOnsic2hhMjU2IjoiNGJjYmQyMzY1Y2MzYWI0MWNlNGJhMTcwYThhMTIwZGEzNTRmNjJkNmYwMmQ2OGI0ZTdjYWUwOWZmZWJmM2I0YSJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1EYXJ3aW5fYXJtNjQuZGlzdG1ldGEudmFsdWVzdG9yZS56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiNTBlYzhlNTQ0ODRmNTlkMDM3N2ZjOTZiMjIxMTI5MjY3ZWIxZTcyMDZlZThmMzM3MGUxZTdhMGJjYmQ2ZDY1MyJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1EYXJ3aW5fYXJtNjQucGFja2FnZS5jdHMuMS50cmFjZXN0b3JlIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImMzNzhkNjgxMTg0MWY2Y2RjMWE3Yjg5M2VjMWRhZGM2N2Y3MzU1NmEyNjNjMDZhZmI0NDZhNDIxYTNkNjgxNDkifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtRGFyd2luX2FybTY0LnBhY2thZ2UudmFsdWVzdG9yZS5pbmRleCIsImRpZ2VzdCI6eyJzaGEyNTYiOiIyNDFkZmIwOGE3Y2IwODQ2ZDA4ZDQxNzcwMzFlYjRiY2IxODY5MDkxM2E5ZWVjOGU5YjAxYmU0YzI2NTE3ZGVhIn19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLURhcndpbl9hcm02NC5wYWNrYWdlLnZhbHVlc3RvcmUuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImVmY2U3YmJiNTkxYTlhZTA1NjNlMTNkMzA4MTgyYjkyZDQ0ZGE4NmI3OTU1NTE3MjhmOTE2YzZlNWRkMWIzM2MifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtRGFyd2luX2FybTY0LnZhbHVlcy5qc29uIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImNlZTAzODJjYWNlZWZhYTJmZGNjN2U5Yjk3OWMzOWFlYjU2ZTdhNTY3MDU3YTIzMDU3MzFjOTU2ZjM5NDAzY2IifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtRGFyd2luX3g4Nl82NC1EYXJ3aW5feDg2XzY0LmRpc3RtZXRhLmN0cy4xLnRyYWNlc3RvcmUiLCJkaWdlc3QiOnsic2hhMjU2IjoiNDAyYTkzZTIwOGVjNTU3ZmYxMTJkZjE4YzY4YzU0NzRhODNhMjg4ZjM4NjMzZmMxODY4MTEzZWI0MTBiNDhhMCJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1EYXJ3aW5feDg2XzY0LURhcndpbl94ODZfNjQuZGlzdG1ldGEubWFuaWZlc3QuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImVjOGRkNjhkMDA1MTQ3ZWQ3NzUxNjBiNjFlMGY4NWQ4YWVhMWRkZGY5ZjkzOTI5NDhlM2U1NDllOTFjOTY1NDUifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtRGFyd2luX3g4Nl82NC1EYXJ3aW5feDg2XzY0LmRpc3RtZXRhLnZhbHVlc3RvcmUuaW5kZXgiLCJkaWdlc3QiOnsic2hhMjU2IjoiNjE0MTcxZDk1ZTJhOTlhY2JmYzBjNDkyZDFhOWQ5NTNlZjE0ODY2Njk4OGQ3ZWU4M2Y3N2Y2MjM0NDMyNTQyYiJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1EYXJ3aW5feDg2XzY0LURhcndpbl94ODZfNjQuZGlzdG1ldGEudmFsdWVzdG9yZS56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiMDYwNTkxNTE1Y2I4MWNhZjFlZTFiYWVlNTcwYjZhZDM3NTMzOTJkY2Y1NTk0ZGU3ZDExMDljYzQyYzdiNmVjNiJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1EYXJ3aW5feDg2XzY0LURhcndpbl94ODZfNjQucGFja2FnZS5jdHMuMS50cmFjZXN0b3JlIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjIzODY4ZWIwY2EyMTYxZDZhMDBlOTY5YTBlNjIyZTcyNDFmOTFlNDQxOGVkOGNmMGYyNjIxNDYyMjcwNTIxZGMifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtRGFyd2luX3g4Nl82NC1EYXJ3aW5feDg2XzY0LnBhY2thZ2UudmFsdWVzdG9yZS5pbmRleCIsImRpZ2VzdCI6eyJzaGEyNTYiOiJhZDJkMzU4NjBkNWFhYmU4MDBkNDYwNTkwYjQ1MjkwZDNhNjYyMDhmNTIwMmNiMjFmN2M0MjI1MDBjMjdlNWU0In19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLURhcndpbl94ODZfNjQtRGFyd2luX3g4Nl82NC5wYWNrYWdlLnZhbHVlc3RvcmUuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjA3MzRhYTBjYmU3Njc4YTdhMTA2ZWQ0YTljOTMyYzNkMDE3YzNmMzVkOGFhZmU1ZmU0MzRlODA2M2E0M2Q5MTgifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtRGFyd2luX3g4Nl82NC1EYXJ3aW5feDg2XzY0LnZhbHVlcy5qc29uIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImFlYmUyNmM0YTIzOTQ2MDAwOTQyYzNhMjY2NmU3NjlmMDZjYmZiNTczY2NlODY2NTA1YmEzYjY3OGM1NjlhMmUifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtTGludXhfeDg2LUxpbnV4X3g4Ni5kaXN0bWV0YS5jdHMuMS50cmFjZXN0b3JlIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjQwMmE5M2UyMDhlYzU1N2ZmMTEyZGYxOGM2OGM1NDc0YTgzYTI4OGYzODYzM2ZjMTg2ODExM2ViNDEwYjQ4YTAifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtTGludXhfeDg2LUxpbnV4X3g4Ni5kaXN0bWV0YS5tYW5pZmVzdC56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiZjI0YjY4Y2JjZGY0NTIzMDdiZmIxNzU2OTk5NDVkMzE1N2ZkM2U5NDg3ZDBkNGRhNDM0ZGIyMWFmNjE3MmJjNSJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODYtTGludXhfeDg2LmRpc3RtZXRhLnZhbHVlc3RvcmUuaW5kZXgiLCJkaWdlc3QiOnsic2hhMjU2IjoiNjE0MTcxZDk1ZTJhOTlhY2JmYzBjNDkyZDFhOWQ5NTNlZjE0ODY2Njk4OGQ3ZWU4M2Y3N2Y2MjM0NDMyNTQyYiJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODYtTGludXhfeDg2LmRpc3RtZXRhLnZhbHVlc3RvcmUuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjA2MDU5MTUxNWNiODFjYWYxZWUxYmFlZTU3MGI2YWQzNzUzMzkyZGNmNTU5NGRlN2QxMTA5Y2M0MmM3YjZlYzYifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtTGludXhfeDg2LUxpbnV4X3g4Ni5wYWNrYWdlLmN0cy4xLnRyYWNlc3RvcmUiLCJkaWdlc3QiOnsic2hhMjU2IjoiNjFlYjNkNGM0NWU0NjBhNzU4NmQxMzMyYTRhNzE0MDZhNWQ2MDg0MmFjM2E1MWZkNjk3NzQxYTVkMTQ4YWU0NCJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODYtTGludXhfeDg2LnBhY2thZ2UudmFsdWVzdG9yZS5pbmRleCIsImRpZ2VzdCI6eyJzaGEyNTYiOiIyM2VlOTdhMjQ3OTY5YTM4NmJiZWRmNDU5MTIzM2M1MWQ5OTE2Y2Q1MTRmYTNmMzI4N2MwMzIyMTU5ZmI3Yzk2In19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLUxpbnV4X3g4Ni1MaW51eF94ODYucGFja2FnZS52YWx1ZXN0b3JlLnppcCIsImRpZ2VzdCI6eyJzaGEyNTYiOiJmZDkxODNkMDZhYmQ5OTc0MDIxNmYzM2M2Njk1ZDkzNjI1YjAyMmRkNzY2NDVmODYxOGRhZjgwNDdmODMxM2Y1In19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLUxpbnV4X3g4Ni1MaW51eF94ODYudmFsdWVzLmpzb24iLCJkaWdlc3QiOnsic2hhMjU2IjoiNmZhNzgxNGY5NThiNzk2YTllZGZiMGM5OTExNjNlOTBkNWJlYzVhNzU4OGVlYWVmMzY4NWIzM2RmNTRkMzIxOSJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODZfNjQtTGludXhfeDg2XzY0LmRpc3RtZXRhLmN0cy4xLnRyYWNlc3RvcmUiLCJkaWdlc3QiOnsic2hhMjU2IjoiYjI1NGI4NzNkZjQwYjhmYmIxNTIwNGY1MTczOTUzMzE4NDBlOTFhYzQzYWViM2U1ODUwN2ExNGVmYmUyMGRkOCJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODZfNjQtTGludXhfeDg2XzY0LmRpc3RtZXRhLm1hbmlmZXN0LnppcCIsImRpZ2VzdCI6eyJzaGEyNTYiOiIxOGZmMTU2ZmI2NzRmMWUyMmY2ZWM1MGE3ZjlkZWZhZjEyMzAxZWJkZWZjMGYzODk3OGU1NjE2Mzk2OWI5ODY0In19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLUxpbnV4X3g4Nl82NC1MaW51eF94ODZfNjQuZGlzdG1ldGEudmFsdWVzdG9yZS5pbmRleCIsImRpZ2VzdCI6eyJzaGEyNTYiOiI3Y2I0NzdiZjhlZjY0NDVmMWYyYzZjYmFjYWYwNWE5NWY3ZTEwM2EwYjQyM2Q2ZTdlODg2OWFkNzY1NDRlYzg2In19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLUxpbnV4X3g4Nl82NC1MaW51eF94ODZfNjQuZGlzdG1ldGEudmFsdWVzdG9yZS56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiOTczNmZhYjQxZjU4YmNlZDQ1ZmJjNGEwODY3MzYwOTFlZDcxYzNmOTZhOWY2NmRlNDUyOTMxYWQ0ZjkzMTQ0NSJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODZfNjQtTGludXhfeDg2XzY0LnBhY2thZ2UuY3RzLjEudHJhY2VzdG9yZSIsImRpZ2VzdCI6eyJzaGEyNTYiOiIwOTFlNTllNTdkMjUyMGVlOTVmNDRiMDNhMDFlNzYwNjA2NjBjNjU2NGM5Njg5MDM1YmU2NDhjOTZjODYxYTUyIn19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLUxpbnV4X3g4Nl82NC1MaW51eF94ODZfNjQucGFja2FnZS52YWx1ZXN0b3JlLmluZGV4IiwiZGlnZXN0Ijp7InNoYTI1NiI6ImM5Yjk2MjVmM2YyMDM0ZGFlOTMzMWI4YWQ4YTI5ZTVlZWQ5MDgyZDk2YmE4ZjhkYTgxOTIxYzkxZjA0MTVlM2EifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtTGludXhfeDg2XzY0LUxpbnV4X3g4Nl82NC5wYWNrYWdlLnZhbHVlc3RvcmUuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjQ2Y2Q3ZGIyMzAyNzZjYjQyNTM1MzA4MDIyODkyNDMzMTY3MWNkMzFiNmU2ZjJlNGI0ZjBjMmVlODM5Yjg5MWMifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtTGludXhfeDg2XzY0LUxpbnV4X3g4Nl82NC52YWx1ZXMuanNvbiIsImRpZ2VzdCI6eyJzaGEyNTYiOiIzNjhhOGI2YWNiMjk3NjBjYjU4ODFhMjBiMGQzZGQ2NWE3YzAwMzc3NzNjMGM4NDljMzQ4ZTMwMWM4OWUzYzMxIn19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLUxpbnV4X3g4Nl82NF9tdXNsLUxpbnV4X3g4Nl82NF9tdXNsLmRpc3RtZXRhLmN0cy4xLnRyYWNlc3RvcmUiLCJkaWdlc3QiOnsic2hhMjU2IjoiNDAyYTkzZTIwOGVjNTU3ZmYxMTJkZjE4YzY4YzU0NzRhODNhMjg4ZjM4NjMzZmMxODY4MTEzZWI0MTBiNDhhMCJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODZfNjRfbXVzbC1MaW51eF94ODZfNjRfbXVzbC5kaXN0bWV0YS5tYW5pZmVzdC56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiYTMxNDgxOGJiYmMxYWNhN2E5YjQwY2FiMjY4NTRmNjhkNTJiMzczNzRkZTM2M2FiZTVhYzlkODNjNzBhOWNkOSJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODZfNjRfbXVzbC1MaW51eF94ODZfNjRfbXVzbC5kaXN0bWV0YS52YWx1ZXN0b3JlLmluZGV4IiwiZGlnZXN0Ijp7InNoYTI1NiI6IjYxNDE3MWQ5NWUyYTk5YWNiZmMwYzQ5MmQxYTlkOTUzZWYxNDg2NjY5ODhkN2VlODNmNzdmNjIzNDQzMjU0MmIifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtTGludXhfeDg2XzY0X211c2wtTGludXhfeDg2XzY0X211c2wuZGlzdG1ldGEudmFsdWVzdG9yZS56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiMDYwNTkxNTE1Y2I4MWNhZjFlZTFiYWVlNTcwYjZhZDM3NTMzOTJkY2Y1NTk0ZGU3ZDExMDljYzQyYzdiNmVjNiJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODZfNjRfbXVzbC1MaW51eF94ODZfNjRfbXVzbC5wYWNrYWdlLmN0cy4xLnRyYWNlc3RvcmUiLCJkaWdlc3QiOnsic2hhMjU2IjoiYzU2OWIwZDQ4NDMxYTY1YzYzN2VlODA5MGU2MmNlNjA0NDEyZTYyZjRmYTdmZWRlNGExOWQ0YWI1Yjc4MmQxYyJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODZfNjRfbXVzbC1MaW51eF94ODZfNjRfbXVzbC5wYWNrYWdlLnZhbHVlc3RvcmUuaW5kZXgiLCJkaWdlc3QiOnsic2hhMjU2IjoiZjM2ODdmNzgzOWYyN2QyNzk2YzQzMTdkZmY4MjI3OTBmZDE5OTQ3Y2NhNTlmZTgxMDE5MGNlYmYwN2NlMTY2MyJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1MaW51eF94ODZfNjRfbXVzbC1MaW51eF94ODZfNjRfbXVzbC5wYWNrYWdlLnZhbHVlc3RvcmUuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImM1Y2VlZTdkMGZkNDJkNTA4MzBiZWExNWZmYjJkZGE4ZDI1ZjZmNDcxMzY1MjFjOTUxZmIyYzg3ZDQ5YjUzZGQifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtTGludXhfeDg2XzY0X211c2wtTGludXhfeDg2XzY0X211c2wudmFsdWVzLmpzb24iLCJkaWdlc3QiOnsic2hhMjU2IjoiZTE4MmM0ZjY0ZjliNjkyYWUwMzNiYzEzYzJmZWI1MDA2MzRiOWU4NDZiYzU5NjQyMTYzMWEwMDYwNDdlYzkyZiJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1XaW5kb3dzX3g4Ni1XaW5kb3dzX3g4Ni5kaXN0bWV0YS5jdHMuMS50cmFjZXN0b3JlIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjZkZjRiNTBlODc0Mjk1MzU4MzgyMWQzMjljNjNhYTI0Y2M0NWMzNDgwN2Q4MGY0NGNhODk2NDZlMjUwNDRhY2YifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtV2luZG93c194ODYtV2luZG93c194ODYuZGlzdG1ldGEubWFuaWZlc3QuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjczYmZiOThhMjgxYTJjMzU3NjZjMmQ2Njc2NzgzZDk3M2I3MGJkZTUyMzNiNjY1YTc5YjhjMmUyMTUwMDk0Y2QifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtV2luZG93c194ODYtV2luZG93c194ODYuZGlzdG1ldGEudmFsdWVzdG9yZS5pbmRleCIsImRpZ2VzdCI6eyJzaGEyNTYiOiI2MTQxNzFkOTVlMmE5OWFjYmZjMGM0OTJkMWE5ZDk1M2VmMTQ4NjY2OTg4ZDdlZTgzZjc3ZjYyMzQ0MzI1NDJiIn19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLVdpbmRvd3NfeDg2LVdpbmRvd3NfeDg2LmRpc3RtZXRhLnZhbHVlc3RvcmUuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjA2MDU5MTUxNWNiODFjYWYxZWUxYmFlZTU3MGI2YWQzNzUzMzkyZGNmNTU5NGRlN2QxMTA5Y2M0MmM3YjZlYzYifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtV2luZG93c194ODYtV2luZG93c194ODYucGFja2FnZS5jdHMuMS50cmFjZXN0b3JlIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjFiYTQwMTdlNzdkOGNiOTA0MWU4YTgzMDM2OGIyNWQ2Zjk1YzhjYzE5Nzc0YjEyYzljYjJhMDUwZDU4ZWY2NDUifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtV2luZG93c194ODYtV2luZG93c194ODYucGFja2FnZS52YWx1ZXN0b3JlLmluZGV4IiwiZGlnZXN0Ijp7InNoYTI1NiI6IjMyNDc1MGIwNmNhMTFmZjIyYmM0N2E1YzBlNGViYmM0YjlmNGU4NWUzNzMyZTE0Zjg4NjNjMzEyZTcxY2ExMDEifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtV2luZG93c194ODYtV2luZG93c194ODYucGFja2FnZS52YWx1ZXN0b3JlLnppcCIsImRpZ2VzdCI6eyJzaGEyNTYiOiIxMjBhNWVkMzk2MmJkNDA4Y2I5MTM4ODg4ODJlZDdiMjA1N2IxMmJiY2NmYTUyN2RiZjMzNjUwZTY2ZjNhMWRjIn19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLVdpbmRvd3NfeDg2LVdpbmRvd3NfeDg2LnZhbHVlcy5qc29uIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImY3M2EyZjdkOTFhNjViYWExNjg5MmNhZWM3N2E4YmNiYzM3ZTBiZTJmZGE3MzQ4N2JlNjdhODQzZTFhYzU4ZDUifX0seyJuYW1lIjoiQ29tbW9uc0xhbmdfT0NhbWwtV2luZG93c194ODZfNjQuZGlzdG1ldGEuY3RzLjEudHJhY2VzdG9yZSIsImRpZ2VzdCI6eyJzaGEyNTYiOiJiMjU0Yjg3M2RmNDBiOGZiYjE1MjA0ZjUxNzM5NTMzMTg0MGU5MWFjNDNhZWIzZTU4NTA3YTE0ZWZiZTIwZGQ4In19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLVdpbmRvd3NfeDg2XzY0LmRpc3RtZXRhLm1hbmlmZXN0LnppcCIsImRpZ2VzdCI6eyJzaGEyNTYiOiJkOWJlMjYzNmMyOGIxOTIyYTE3OTAzMjI3ZmVlMmM1ZjFjZGU2MDJiZDMzYTFhMjExYWNjZTc5ZjhlZjJhNjJjIn19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLVdpbmRvd3NfeDg2XzY0LmRpc3RtZXRhLnZhbHVlc3RvcmUuaW5kZXgiLCJkaWdlc3QiOnsic2hhMjU2IjoiN2NiNDc3YmY4ZWY2NDQ1ZjFmMmM2Y2JhY2FmMDVhOTVmN2UxMDNhMGI0MjNkNmU3ZTg4NjlhZDc2NTQ0ZWM4NiJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1XaW5kb3dzX3g4Nl82NC5kaXN0bWV0YS52YWx1ZXN0b3JlLnppcCIsImRpZ2VzdCI6eyJzaGEyNTYiOiI5NzM2ZmFiNDFmNThiY2VkNDVmYmM0YTA4NjczNjA5MWVkNzFjM2Y5NmE5ZjY2ZGU0NTI5MzFhZDRmOTMxNDQ1In19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLVdpbmRvd3NfeDg2XzY0LnBhY2thZ2UuY3RzLjEudHJhY2VzdG9yZSIsImRpZ2VzdCI6eyJzaGEyNTYiOiJhNDZlY2RiYzQ4NDQ0NDU2ZTlkYjA4MzU1NGM0ZTEzNzVkODMyZTJhZGU0ODQ3NGM2ZTBhNTNlNmQzNGRjMjRhIn19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLVdpbmRvd3NfeDg2XzY0LnBhY2thZ2UudmFsdWVzdG9yZS5pbmRleCIsImRpZ2VzdCI6eyJzaGEyNTYiOiI2YWI1Zjc1Yjc1MDg3Y2U2ODNiYmEwOTI3MWFhNzY5MWNhNWIyZTgwMmQ0ODVhOTZhYmIyYjhkMWM2OWVhOTY3In19LHsibmFtZSI6IkNvbW1vbnNMYW5nX09DYW1sLVdpbmRvd3NfeDg2XzY0LnBhY2thZ2UudmFsdWVzdG9yZS56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiZWNjM2Y0NjE4ZjE0MzUyODEzNThiZmMzMDM0M2YzN2NhNWJkNTIyMzJlNzA3NGY4MzlkOGMwZmNlMWEyNmIwZiJ9fSx7Im5hbWUiOiJDb21tb25zTGFuZ19PQ2FtbC1XaW5kb3dzX3g4Nl82NC52YWx1ZXMuanNvbiIsImRpZ2VzdCI6eyJzaGEyNTYiOiJkMDk0MGUyMzEyNDU0YzYxZjBkN2Q2OTVlZDkyYjIxNDFmYzFkYzEyYzVmNWNjOTRlNmFkZmViYjQ3MTEzZmU1In19LHsibmFtZSI6InZhbHVlcy5qc29uIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjczMmFhMGFlMDVhZDYzOWI3OWRkNWViZWVmMDY2MTc4OGE5MTEwZGMwZDdiZjllNDAyNWE5ODdkMjIwOGYzOTEifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy90YWdzLzAuMS4yMDI2MDkyMDE0NDM0NyIsInJlcG9zaXRvcnkiOiJodHRwczovL2dpdGh1Yi5jb20vZGtwa2cvQ29tbW9uc0xhbmdfT0NhbWwiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvZGlzdHJpYnV0ZS0wLjEueW1sIn19LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJwdXNoIiwicmVwb3NpdG9yeV9pZCI6IjEyMjI4NzQxNzkiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjc4OTEzNTAwIiwicnVubmVyX2Vudmlyb25tZW50IjoiZ2l0aHViLWhvc3RlZCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vZGtwa2cvQ29tbW9uc0xhbmdfT0NhbWxAcmVmcy90YWdzLzAuMS4yMDI2MDkyMDE0NDM0NyIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiIzZDg1ZWNjNDI0ZGI1ZWVmNzBjNzUwOWZmMzJhNzhjODE5ODI0ZGFiIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ka3BrZy9Db21tb25zTGFuZ19PQ2FtbC8uZ2l0aHViL3dvcmtmbG93cy9kaXN0cmlidXRlLTAuMS55bWxAcmVmcy90YWdzLzAuMS4yMDI2MDkyMDE0NDM0NyJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vZGtwa2cvQ29tbW9uc0xhbmdfT0NhbWwvYWN0aW9ucy9ydW5zLzM1NTI3OTU2OTI4L2F0dGVtcHRzLzEifX19fQ==","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIQC1+4niBSBnSGwe/qAsdKvTkEVEibyI2wjEG6uNvKYhFwIgETaRZLlqmwH1FuBx3gGlRNq+PrVeL/wkPTSOHXfxAqA="}]}}
+            ] },
+          "github_slsa_v1_l3": {},
+          "openbsd_signify": {}
+        },
+        "build_to_sign": {
+          "bundle_canonical": "e642f7f8d391d3051b99aee6cf7d803e213bcc41b861965a1d993bbcd9dff79b",
+          "bundle_modver": "CommonsLang_OCaml.Distribution@0.1.20260920144347",
+          "modules": [
+            "CommonsLang_OCaml.Base@5.5.0",
+            "CommonsLang_OCaml.Distribution@0.1.20260916151007",
+            "CommonsLang_OCaml.Distribution@0.1.20260916234322",
+            "CommonsLang_OCaml.Distribution@0.1.20260920144347",
+            "CommonsLang_OCaml.DkML@4.14.3001",
+            "CommonsLang_OCaml.Dune@3.23.2",
+            "CommonsLang_OCaml.MSYS2@2026.6.11",
+            "CommonsLang_OCaml.Opam@2.5.2",
+            "CommonsLang_OCaml.Apparatus.DkMLCleanupSlot@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLDetectVsEnvBat@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLGlibcEnv@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLMuslBuildHost@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLMuslEnv@1.0.13",
+            "CommonsLang_OCaml.Apparatus.DkMLMuslWrap@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLPatchRelocatableVersion@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLPatchStandardCompilerEnvWv18@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLPieCheck@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLRoot@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLRunBuildHost@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLX86BuildHost@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DkMLX86Env@1.0.13",
+            "CommonsLang_OCaml.Apparatus.DkMLX86Wrap@1.0.1",
+            "CommonsLang_OCaml.Apparatus.DuneBootstrapMsvc@1.0.1",
+            "CommonsLang_OCaml.Apparatus.OpamBuildSeqMeta@1.0.1",
+            "CommonsLang_OCaml.Apparatus.OpamBuildWin@1.0.1",
+            "CommonsLang_OCaml.Apparatus.OpamBuildWinVcvars@1.0.1",
+            "CommonsLang_OCaml.Apparatus.OpamBuildWrapper@1.0.12",
+            "CommonsLang_OCaml.Apparatus.OpamFileFormat@1.0.1",
+            "CommonsLang_OCaml.Apparatus.OpamLockHelper@1.0.19",
+            "CommonsLang_OCaml.Apparatus.OpamMccsGlpkStub@1.0.1",
+            "CommonsLang_OCaml.Apparatus.OpamMsvsDetectStub@1.0.1",
+            "CommonsLang_OCaml.Apparatus.Patches@1.0.1",
+            "CommonsLang_OCaml.Apparatus.Scripts@1.0.1",
+            "CommonsLang_OCaml.Apparatus.Tables@1.0.1",
+            "CommonsLang_OCaml.Apparatus.WineHostShim@1.0.1",
+            "CommonsLang_OCaml.Base.Bundle@5.5.0",
+            "CommonsLang_OCaml.Base.Unix@5.5.0",
+            "CommonsLang_OCaml.Base.Win32@5.5.0",
+            "CommonsLang_OCaml.Dk.OpamBuild.Export@1.0.0",
+            "CommonsLang_OCaml.Dk.OpamBuild.Export@1.0.29",
+            "CommonsLang_OCaml.Dk.OpamBuild.F_BuildLockedClosure@1.0.29",
+            "CommonsLang_OCaml.Dk.OpamBuild.F_BuildLockedPackage@1.0.29",
+            "CommonsLang_OCaml.Dk.OpamLock.Adopt@1.1.22",
+            "CommonsLang_OCaml.Dk.OpamLock.Export@1.1.22",
+            "CommonsLang_OCaml.Dk.OpamLock.GenerateDriver@1.1.22",
+            "CommonsLang_OCaml.Dk.OpamLock.GenerateFinal@1.1.22",
+            "CommonsLang_OCaml.Dk.OpamLock.GenerateForms@1.1.22",
+            "CommonsLang_OCaml.Dk.OpamLock.GenerateSrc@1.1.22",
+            "CommonsLang_OCaml.Dk.OpamLock.OpamVenv@1.1.22",
+            "CommonsLang_OCaml.Dk.OpamLock.Refresh@1.1.22",
+            "CommonsLang_OCaml.Dk.OpamLock.Solve@1.1.22",
+            "CommonsLang_OCaml.DkML.Bundle@4.14.3001",
+            "CommonsLang_OCaml.DkML.FlexdllSourceTree@0.43.0",
+            "CommonsLang_OCaml.DkML.OCamlSourceTree@4.14.3001",
+            "CommonsLang_OCaml.DkML.Unix@4.14.3001",
+            "CommonsLang_OCaml.DkML.Win32@4.14.3001",
+            "CommonsLang_OCaml.DkML.RuntimeCommon.Bundle@2.4.2-26",
+            "CommonsLang_OCaml.Dune.Bundle@3.23.1",
+            "CommonsLang_OCaml.Dune.Unix@3.23.2",
+            "CommonsLang_OCaml.Dune.Win32@3.23.2",
+            "CommonsLang_OCaml.MSYS2.Bundle@2026.6.11",
+            "CommonsLang_OCaml.MSYS2.Zip.Base@2026.6.11",
+            "CommonsLang_OCaml.MSYS2.Zip.Diffutils@2026.6.11",
+            "CommonsLang_OCaml.MSYS2.Zip.Dos2unix@2026.6.11",
+            "CommonsLang_OCaml.MSYS2.Zip.Libxxhash@2026.6.11",
+            "CommonsLang_OCaml.MSYS2.Zip.Patch@2026.6.11",
+            "CommonsLang_OCaml.MSYS2.Zip.Popt@2026.6.11",
+            "CommonsLang_OCaml.MSYS2.Zip.Rsync@2026.6.11",
+            "CommonsLang_OCaml.MSYS2.Zip.Unzip@2026.6.11",
+            "CommonsLang_OCaml.MuslCC.Bundle@11.2.1",
+            "CommonsLang_OCaml.Opam.Bundle@2.5.1",
+            "CommonsLang_OCaml.Opam.Unix@2.5.2",
+            "CommonsLang_OCaml.Opam.Menhir.Bundle@2025.9.3",
+            "CommonsLang_OCaml.Opam.Win32.X64@2.5.2",
+            "CommonsLang_OCaml.Opam.Win32.X86@2.5.2"
+          ],
+          "producer_accepts": [],
+          "distmeta": {
+            "traces": [
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Darwin_arm64.distmeta.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.distmeta.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.distmeta.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.distmeta.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.distmeta.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.distmeta.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Windows_x86_64.distmeta.cts.1.tracestore"
+              }
+            ],
+            "values": [
+              {
+                "path": "CommonsLang_OCaml-Darwin_arm64.distmeta.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.distmeta.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.distmeta.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.distmeta.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.distmeta.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.distmeta.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Windows_x86_64.distmeta.valuestore.zip"
+              }
+            ]
+          },
+          "package": {
+            "traces": [
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Darwin_arm64.package.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.package.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.package.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.package.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.package.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.package.cts.1.tracestore"
+              },
+              {
+                "tag": "cts.1",
+                "path": "CommonsLang_OCaml-Windows_x86_64.package.cts.1.tracestore"
+              }
+            ],
+            "values": [
+              {
+                "path": "CommonsLang_OCaml-Darwin_arm64.package.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Darwin_x86_64-Darwin_x86_64.package.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Linux_x86-Linux_x86.package.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Linux_x86_64-Linux_x86_64.package.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Linux_x86_64_musl-Linux_x86_64_musl.package.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Windows_x86-Windows_x86.package.valuestore.zip"
+              },
+              {
+                "path": "CommonsLang_OCaml-Windows_x86_64.package.valuestore.zip"
+              }
+            ]
+          },
+          "script_module_sha256s": [
+            "2c008b1284de7c17ccda33e6fff84766276b5f412ee1ba66f6b4ec1ed1e375ff",
+            "c30e27473d1542c87d82b67f81d15a62f0d42189a4e4230f79398e87bbc66d1d"
+          ]
+        }
+      },
+      "continuations": {
+        "attestation": {
+          "openbsd_signify": {
+            "signature": "untrusted comment: signed by key 2b19619c380dd657\nRWQrGWGcOA3WV/SC5szyffbUIzdMAOjD33Y9fQe9ngEw7QoRVn5420I7hpPpiOR1WF4pLrxV5L0AHe3zRd7zAHSOjc/0d8TwsAU=\n"
+          }
+        },
+        "continuations_to_sign": {
+          "0.2": {
+            "application": { "name": "dk0", "version": "2.4.2+rev-253" },
+            "openbsd_signify": {
+              "public_key": "untrusted comment: CommonsLang_OCaml-0.2\nRWRnKsyKvFT87Z/voU2a8RFDBjdtzKzfcFgCn+eTXCTheCs3Nd2BGz0H\n"
+            }
+          },
+          "1.0": {
+            "application": { "name": "dk0", "version": "2.4.2+rev-253" },
+            "openbsd_signify": {
+              "public_key": "untrusted comment: CommonsLang_OCaml-1.0\nRWRLh0MTaL/vE2fN07NUPRSEHBMs2FZpBBSCi++qsCUY3vHSttJWh66e\n"
+            }
+          }
+        }
+      },
+      "id": "CommonsLang_OCaml@0.1.20260920144347",
+      "license": { "spdx": "Apache-2.0" },
+      "producer": {
+        "application": { "name": "dk0", "version": "2.4.3+rev-22" },
+        "github_slsa_v1_l2": { "repository": "dkpkg/CommonsLang_OCaml" },
+        "openbsd_signify": {
+          "public_key": "untrusted comment: CommonsLang_OCaml-0.1\nRWQrGWGcOA3WV93QbuXdm8aAWjDkYvCM5jgFAanfDRiW9n3PzSvLESmR\n"
+        }
+      },
+      "min_dk_version": "2.4.2.213"
+    }
+  ],
+  "forms": [],
+  "schema_version": { "major": 1, "minor": 0 }
+}

etc/dk/i/dk-closure-manifest.tsv ADDED Viewed

	@@ -0,0 +1,29 @@

+# dk closure manifest v1: library	version	values_file_sha256	source
+CommonsBase_Build	0.1.20260913085659	12b5a47d353d5abe52580ec47ff3c309107aee4594e6d52544a76b447216ed65	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_Build	0.1.20260916234322	4843aa52a49cc9c02574562407e196893c8f786a62674574de028b86b6fac751	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_Build	0.1.20260920144347	eb05f811a4e114f46ab25b978a3728467d00149023b83cc6267021ffc5ac67af	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_FileMagic	0.1.20260913085659	ac662bb7e78faddf667b007df133157d9f588fb635e5edbfdccc830a8823abdb	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_FileMagic	0.1.20260916234322	bdd8c70111bffdd6666e7dc2ff74bd92ce62faa64b2542fe217f321094a1c668	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_FileMagic	0.1.20260920144347	9795f60a23f3135597b06cf41d13983757f1488f71dc301e0a90f85834a340d7	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_GNU	0.1.20260913085659	9500243faab7e00ea8c604e4b6ace72f8784587fcee453f3959304934d37c5d1	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_GNU	0.1.20260916234322	b244854bfcba1585234befef8d966f5fce276df458829850d926c2d5869beb34	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_GNU	0.1.20260920144347	53e60fcbf502ffbdf433ac2faa585d8c9eff6c5b27aedd90d2f63330a7414218	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_LLVM	0.1.20260913085659	c51d6e04e6779799c4df31630c75ed17d95386492c7e0ddc046f3734c816e929	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_LLVM	0.1.20260916234322	e66256adfd231ea822bbad59bba124c3c851243082be0426af191ae18751611a	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_LLVM	0.1.20260920144347	56312cd1d2868eff482798255793a35f8b2dbaf9c80a697622780d67639783fe	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_Std	2.6.20260913085659	25224920a4b704b3693afe5343ce05c5cd2c0d9e19ce1641511707fb5af59887	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_Std	2.6.20260916234322	eafd48ee3331a4be2fee20055a7d2f88c33b53989c2dcc7f9a6b5ac51349f250	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_Std	2.6.20260920144347	b3c67724e09942596d8af32635b585698f931047e74332bc011a532a430d5438	etc/dk/i/CommonsBase_Std.2.6.20260920144347.values.json
+CommonsBase_Std	2.6.20260920144347	b3c67724e09942596d8af32635b585698f931047e74332bc011a532a430d5438	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_Win32	0.1.20260913085659	3bf82182b61b0800bcbb7cf8f6c6fb270228e78fab9120a0ac9e169d12a451af	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_Win32	0.1.20260916234322	2c26c7595a79bd6e88bb5665dcbb552d3b72c828ebe7385315c4e8f64a8ed7ce	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsBase_Win32	0.1.20260920144347	4c1ae11415083c10650bdecf2b02c22ba5dce75362eb9b4139dd2575efe608e5	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsLang_OCaml	0.1.20260916151007	eec79d51d9e8906d861310f9d9fb04a251e0208caf6cae46f8e6ded13a498132	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsLang_OCaml	0.1.20260916234322	bbd0879f0808f8fbe230df44ba1d9a9804ce6773eb8ecda93af47d1a765a00e3	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+CommonsLang_OCaml	0.1.20260920144347	54c5ccfd53e87797ea4fea161b0fd6c869ba80a45b3b3870848407c6797741a8	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+NotMatveevKondratyev_Libinotify	0.1.20260913085659	994c3d7ae357b88c19e0cd330186a97a6078f37b1601c46fef06491756535b77	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+NotMatveevKondratyev_Libinotify	0.1.20260916234322	68849e07e20594dd003d052415ce2d181c1c00c65ba614ceb25ba970ba108976	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+NotMatveevKondratyev_Libinotify	0.1.20260920144347	33f86058acc7b9f1ca512237477d867926748f4ed3ff0d9174f14d200b649560	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+NotMitEdu_Kerberos	0.1.20260913085659	bac376f7b4b3f09a2a2e877fbce59c80e17b0661d5bd3c8d8d9c506fd47d3653	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+NotMitEdu_Kerberos	0.1.20260916234322	c208ebae1ecb09dc590b8d6f9df7cbee1c4edb83fbe4150ff50a903040f7842a	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json
+NotMitEdu_Kerberos	0.1.20260920144347	85cd3dd87bb48561bbcc75a624764d1214f7f07b78df7c8e751cd21e1e2757b8	etc/dk/i/CommonsLang_OCaml.0.1.20260920144347.values.json

etc/dk/t/.gitignore ADDED Viewed

	@@ -0,0 +1,5 @@

+# Written by dk0. The values.json copies and the imports.json ledger are
+# machine-written verification records for THIS workspace; do not commit.
+# capabilities.json (explicit human authorization grants) is committable.
+*.values.json
+imports.json

etc/dk/t/acceptances.json ADDED Viewed

	@@ -0,0 +1,9 @@

+{
+  "version": 1,
+  "acceptances": [
+    {
+      "package": "CommonsLang_OCaml",
+      "pubkey_base64": "RWQrGWGcOA3WV93QbuXdm8aAWjDkYvCM5jgFAanfDRiW9n3PzSvLESmR"
+    }
+  ]
+}

etc/dk/t/capabilities.json ADDED Viewed

	@@ -0,0 +1,10 @@

+{
+  "version": 1,
+  "grants": [
+    {
+      "package": "CommonsLang_OCaml",
+      "pubkey_base64": "RWQrGWGcOA3WV93QbuXdm8aAWjDkYvCM5jgFAanfDRiW9n3PzSvLESmR",
+      "capabilities": [ "run", "write" ]
+    }
+  ]
+}

etc/dk/v/NotHackwaly_Ocamlearlybird/Ocamlearlybird.Closure.values.jsonc ADDED Viewed

	@@ -0,0 +1,47 @@

+// Driver for the opam build of `earlybird`: ONE run-function precommand
+// instantiates the closure build rule, which reads the lock once and registers
+// every per-package build form (each still its own content-addressed dk object,
+// so an interrupted build resumes) plus the aggregate `.Built` output form.
+//
+// GENERATED by the CommonsLang_OCaml.Dk.OpamLock.GenerateDriver dialog from
+// `dk.opam-lock.jsonc`. Regenerate (do not hand-edit) when the lock changes.
+//
+// Regenerate with:
+//   dk0 dialog CommonsLang_OCaml.Dk.OpamLock.GenerateDriver@1.1.22 pkg=NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6 roots[]=earlybird
+{
+  "$schema": "https://diskuv.com/dk/schema/dk-value-1.0.json",
+  "schema_version": { "major": 1, "minor": 0 },
+  "generated": {
+    "tool": "CommonsLang_OCaml.Dk.OpamLock.GenerateDriver@1.1.22",
+    "rulefn": "CommonsLang_OCaml.Dk.OpamBuild.F_BuildLockedClosure@1.0.29",
+    "lock": "dk.opam-lock.jsonc",
+    "lock-sha256": "8b0cbeeb0d8a11845f3cadc288bf4cb22cad3623c0673892d0b85f5256f0d967",
+    "localsrc": "NotHackwaly_Ocamlearlybird.Ocamlearlybird.Src@1.3.6",
+    "locksrcpath": "./dk-opam-lock.jsonc",
+    "roots": ["earlybird"],
+    "formid": "NotHackwaly_Ocamlearlybird.Ocamlearlybird.Closure@1.3.6",
+    "pkgpath": "NotHackwaly_Ocamlearlybird.Ocamlearlybird",
+    "version": "1.3.6",
+    "parallel": "t"
+  },
+  "forms": [
+    {
+      "id": "NotHackwaly_Ocamlearlybird.Ocamlearlybird.Closure@1.3.6",
+      "precommands": {
+        "sequential": false,
+        "private": [
+          "run-function CommonsLang_OCaml.Dk.OpamBuild.F_BuildLockedClosure@1.0.29 -d built modver=NotHackwaly_Ocamlearlybird.Ocamlearlybird.Closure.Built@1.3.6 pkgpath=NotHackwaly_Ocamlearlybird.Ocamlearlybird version=1.3.6 root=earlybird localsrc=NotHackwaly_Ocamlearlybird.Ocamlearlybird.Src@1.3.6 locksrcpath=./dk-opam-lock.jsonc targetabi=Release.target_abi ocaml=CommonsLang_OCaml.DkML@4.14.3001"
+        ]
+      },
+      "function": {
+        "commands": [
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')",
+            "cp", "built/install.zip", "${SLOT.request}/install.zip"
+          ]
+        ]
+      },
+      "outputs": { "assets": [ { "slots": ["Release.Windows_x86_64", "Release.Windows_x86", "Release.Linux_x86_64", "Release.Linux_x86_64_musl", "Release.Linux_x86", "Release.Linux_arm64", "Release.Darwin_x86_64", "Release.Darwin_arm64"], "paths": ["install.zip"] } ] }
+    }
+  ]
+}

etc/dk/v/NotHackwaly_Ocamlearlybird/Ocamlearlybird.Src.values.jsonc ADDED Viewed

	@@ -0,0 +1,66 @@

+// NotHackwaly_Ocamlearlybird.Ocamlearlybird.Src@1.3.6 -- the localized working tree as one
+// content-addressed object (output.zip + dk-opam-lock.jsonc) that the generic
+// OpamBuild rule stages via localsrc= as the source for the one local package.
+//
+// GENERATED by the CommonsLang_OCaml.Dk.OpamLock.GenerateSrc dialog. Regenerate
+// (do not hand-edit) when the source tree or lock changes.
+//
+// Regenerate with:
+//   dk0 dialog CommonsLang_OCaml.Dk.OpamLock.GenerateSrc@1.1.22 pkg=NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6
+{
+  "$schema": "https://diskuv.com/dk/schema/dk-value-1.0.json",
+  "schema_version": { "major": 1, "minor": 0 },
+  "generated": {
+    "tool": "CommonsLang_OCaml.Dk.OpamLock.GenerateSrc@1.1.22",
+    "pkg": "NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6",
+    "root": "earlybird",
+    "srcdirs": ["src"],
+    "rootfiles": ["dune", "dune-project", "earlybird.opam"]
+  },
+  "forms": [
+    {
+      "id": "NotHackwaly_Ocamlearlybird.Ocamlearlybird.Src@1.3.6",
+      "precommands": {
+        "private": [
+          "get-asset NotHackwaly_Ocamlearlybird.Apparatus.Src@1.3.6 -p src -d earlybird-1.3.6"
+        ]
+      },
+      "function": {
+        "commands": [
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "mkdir", "-p", "${SLOT.request}"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp",
+            "$(get-asset NotHackwaly_Ocamlearlybird.Apparatus.DuneWorkspace@1.3.6 -p dk-src/dune-workspace -f dune-workspace)",
+            "earlybird-1.3.6/dune-workspace"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp",
+            "$(get-asset NotHackwaly_Ocamlearlybird.Apparatus.DuneRoot@1.3.6 -p dune -f dune)",
+            "earlybird-1.3.6/dune"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp",
+            "$(get-asset NotHackwaly_Ocamlearlybird.Apparatus.DuneProject@1.3.6 -p dune-project -f dune-project)",
+            "earlybird-1.3.6/dune-project"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp",
+            "$(get-asset NotHackwaly_Ocamlearlybird.Apparatus.Opam@1.3.6 -p earlybird.opam -f earlybird.opam)",
+            "earlybird-1.3.6/earlybird.opam"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp",
+            "$(get-asset NotHackwaly_Ocamlearlybird.Apparatus.Lock@1.3.6 -p dk.opam-lock.jsonc -f lock.jsonc)",
+            "${SLOT.request}/dk-opam-lock.jsonc"
+          ],
+          [
+            "--zip", "${SLOT.request}/output.zip", "earlybird-1.3.6"
+          ]
+        ]
+      },
+      "outputs": { "assets": [ { "slots": ["Release.Windows_x86_64", "Release.Windows_x86", "Release.Linux_x86_64", "Release.Linux_x86_64_musl", "Release.Linux_x86", "Release.Linux_arm64", "Release.Darwin_x86_64", "Release.Darwin_arm64"], "paths": ["output.zip", "dk-opam-lock.jsonc"] } ] }
+    }
+  ]
+}

etc/dk/v/NotHackwaly_Ocamlearlybird/Ocamlearlybird.values.jsonc ADDED Viewed

	@@ -0,0 +1,77 @@

+// NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6 -- the final per-slot executable(s).
+//
+// Republishes the NotHackwaly_Ocamlearlybird.Ocamlearlybird.Closure@1.3.6 install prefix's
+// executable(s) as bin/<exe>.exe. GENERATED by the
+// CommonsLang_OCaml.Dk.OpamLock.GenerateFinal dialog; regenerate (do not
+// hand-edit) when the exe set changes.
+//
+// Regenerate with:
+//   dk0 dialog CommonsLang_OCaml.Dk.OpamLock.GenerateFinal@1.1.22 pkg=NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6
+{
+  "$schema": "https://diskuv.com/dk/schema/dk-value-1.0.json",
+  "schema_version": { "major": 1, "minor": 0 },
+  "generated": {
+    "tool": "CommonsLang_OCaml.Dk.OpamLock.GenerateFinal@1.1.22",
+    "pkg": "NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6",
+    "exes": ["ocamlearlybird"]
+  },
+  "forms": [
+    {
+      "id": "NotHackwaly_Ocamlearlybird.Ocamlearlybird@1.3.6",
+      "precommands": {
+        "private": [
+          "get-object NotHackwaly_Ocamlearlybird.Ocamlearlybird.Closure@1.3.6 -s ${SLOTNAME.request} -m ./install.zip -d ip"
+        ]
+      },
+      "function": {
+        "commands": [
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "mkdir", "-p", "${SLOT.request}/bin"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "env", "-u", "${SLOT.Release.Windows_x86_64}", "--",
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp", "ip/bin/ocamlearlybird.exe", "${SLOT.request}/bin/ocamlearlybird.exe"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "env", "-u", "${SLOT.Release.Windows_x86}", "--",
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp", "ip/bin/ocamlearlybird.exe", "${SLOT.request}/bin/ocamlearlybird.exe"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "env", "-u", "${SLOT.Release.Linux_x86_64}", "--",
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp", "ip/bin/ocamlearlybird", "${SLOT.request}/bin/ocamlearlybird.exe"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "env", "-u", "${SLOT.Release.Linux_x86_64_musl}", "--",
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp", "ip/bin/ocamlearlybird", "${SLOT.request}/bin/ocamlearlybird.exe"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "env", "-u", "${SLOT.Release.Linux_x86}", "--",
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp", "ip/bin/ocamlearlybird", "${SLOT.request}/bin/ocamlearlybird.exe"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "env", "-u", "${SLOT.Release.Linux_arm64}", "--",
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp", "ip/bin/ocamlearlybird", "${SLOT.request}/bin/ocamlearlybird.exe"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "env", "-u", "${SLOT.Release.Darwin_x86_64}", "--",
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp", "ip/bin/ocamlearlybird", "${SLOT.request}/bin/ocamlearlybird.exe"
+          ],
+          [
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "env", "-u", "${SLOT.Release.Darwin_arm64}", "--",
+            "$(get-object CommonsBase_Std.Coreutils@0.8.0 -s ${SLOTNAME.Release.execution_abi} -m ./coreutils.exe -f coreutils.exe -e '*')", "cp", "ip/bin/ocamlearlybird", "${SLOT.request}/bin/ocamlearlybird.exe"
+          ]
+        ]
+      },
+      "outputs": { "assets": [
+        { "slots": ["Release.Windows_x86_64"], "paths": ["bin/ocamlearlybird.exe"] },
+        { "slots": ["Release.Windows_x86"], "paths": ["bin/ocamlearlybird.exe"] },
+        { "slots": ["Release.Linux_x86_64"], "paths": ["bin/ocamlearlybird.exe"] },
+        { "slots": ["Release.Linux_x86_64_musl"], "paths": ["bin/ocamlearlybird.exe"] },
+        { "slots": ["Release.Linux_x86"], "paths": ["bin/ocamlearlybird.exe"] },
+        { "slots": ["Release.Linux_arm64"], "paths": ["bin/ocamlearlybird.exe"] },
+        { "slots": ["Release.Darwin_x86_64"], "paths": ["bin/ocamlearlybird.exe"] },
+        { "slots": ["Release.Darwin_arm64"], "paths": ["bin/ocamlearlybird.exe"] }
+      ] }
+    }
+  ]
+}

scripts/check-measurement-complete.mjs ADDED Viewed

	@@ -0,0 +1,160 @@

+// THE MEASUREMENT COVERED EVERY SLOT IT CLAIMS TO COVER, OR THIS FAILS.
+//
+// WHY THIS EXISTS. The dk matrix in measure-performance.yml runs `fail-fast: false`,
+// so one leg can die while the others finish and the workflow still completes with
+// numbers. Those numbers then refresh CLO.md and both PR descriptions while silently
+// describing a slot nobody measured. Nothing noticed that before this file.
+//
+// WHY IT IS NOT A TIMING THRESHOLD. Repeated runs at one pin put 6 of the 12 dk cells
+// at or above 10 percent coefficient of variation, and the two cells quiet enough to
+// carry a threshold were not the same two before and after an unrelated workflow
+// repair. A threshold chosen on either sample rests on a property the next fix moves.
+// A MISSING or FAILED measurement has no such dependence, and it is the failure that
+// actually happened: the one real regression on record did not run slower, it did not
+// build at all.
+//
+// WHAT IT ASSERTS. Every slot named in scripts/expected-measurement.json reported
+// every phase named there, with a numeric millisecond value greater than zero.
+//
+// IT PROVES ITSELF BEFORE IT IS TRUSTED. `--selftest` builds a complete fixture and a
+// damaged one and requires this file to accept the first and reject the second. The
+// gate job runs that before applying the check to real data, because a check that has
+// only ever been observed passing is evidence about the run and not about the check.
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+const argv = process.argv.slice(2);
+const KNOWN = new Set(["--expected", "--dir", "--selftest", "--help"]);
+for (const a of argv) {
+  if (a.startsWith("--") && !KNOWN.has(a)) {
+    console.error(`FAIL  unknown flag ${a}. Known flags: ${[...KNOWN].join(", ")}`);
+    process.exit(2);
+  }
+}
+const opt = (name, dflt) => {
+  const i = argv.indexOf(name);
+  return i >= 0 && argv[i + 1] && !argv[i + 1].startsWith("--") ? argv[i + 1] : dflt;
+};
+// A millisecond reading, without a backslash class. Digits only, at least one, and a
+// value above zero. A phase that reported 0 ms did not run.
+const isPositiveInteger = (s) => {
+  if (typeof s !== "string" || s.length === 0) return false;
+  for (const ch of s) {
+    const c = ch.codePointAt(0);
+    if (c < 0x30 || c > 0x39) return false;
+  }
+  return Number(s) > 0;
+};
+function readPhases(file) {
+  const out = {};
+  for (const line of fs.readFileSync(file, "utf8").split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t) continue;
+    const eq = t.indexOf("=");
+    if (eq <= 0) continue;
+    out[t.slice(0, eq).trim()] = t.slice(eq + 1).trim();
+  }
+  return out;
+}
+function check(expectedFile, dir) {
+  const spec = JSON.parse(fs.readFileSync(expectedFile, "utf8"));
+  const slots = spec.slots ?? [];
+  const phases = spec.phases ?? [];
+  if (!slots.length || !phases.length) {
+    return { failures: [`${expectedFile} declares ${slots.length} slot(s) and ${phases.length} phase(s); a declaration that expects nothing cannot be violated, so it is refused rather than passed`], checked: 0 };
+  }
+  const failures = [];
+  let checked = 0;
+  for (const slot of slots) {
+    const file = path.join(dir, `${slot}.txt`);
+    if (!fs.existsSync(file)) {
+      failures.push(`slot ${slot} reported NO measurement at all: ${path.basename(file)} is absent. Its leg failed, was skipped, or was dropped from the matrix while this branch still claims to cover it.`);
+      continue;
+    }
+    const got = readPhases(file);
+    for (const p of phases) {
+      checked += 1;
+      if (!(p in got)) {
+        failures.push(`slot ${slot} is MISSING phase ${p}: the leg ran and produced no reading for it.`);
+      } else if (!isPositiveInteger(got[p])) {
+        failures.push(`slot ${slot} phase ${p} is ${JSON.stringify(got[p])}, which is not a positive whole number of milliseconds.`);
+      }
+    }
+  }
+  return { failures, checked };
+}
+// ---------------------------------------------------------------- selftest
+if (argv.includes("--selftest")) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "measgate-"));
+  const expected = path.join(root, "expected.json");
+  fs.writeFileSync(expected, JSON.stringify({ slots: ["A", "B"], phases: ["p1", "p2"] }));
+  const good = path.join(root, "good");
+  fs.mkdirSync(good);
+  fs.writeFileSync(path.join(good, "A.txt"), "p1=10\np2=20\n");
+  fs.writeFileSync(path.join(good, "B.txt"), "p1=30\np2=40\n");
+  const missingSlot = path.join(root, "missing-slot");
+  fs.mkdirSync(missingSlot);
+  fs.writeFileSync(path.join(missingSlot, "A.txt"), "p1=10\np2=20\n");
+  const missingPhase = path.join(root, "missing-phase");
+  fs.mkdirSync(missingPhase);
+  fs.writeFileSync(path.join(missingPhase, "A.txt"), "p1=10\n");
+  fs.writeFileSync(path.join(missingPhase, "B.txt"), "p1=30\np2=40\n");
+  const zero = path.join(root, "zero");
+  fs.mkdirSync(zero);
+  fs.writeFileSync(path.join(zero, "A.txt"), "p1=0\np2=20\n");
+  fs.writeFileSync(path.join(zero, "B.txt"), "p1=30\np2=40\n");
+  const cases = [
+    ["a complete measurement is ACCEPTED", good, 0],
+    ["a slot that reported nothing is REJECTED", missingSlot, 1],
+    ["a slot missing one phase is REJECTED", missingPhase, 1],
+    ["a phase reporting 0 ms is REJECTED", zero, 1],
+  ];
+  let bad = 0;
+  for (const [name, dir, want] of cases) {
+    const { failures } = check(expected, dir);
+    const got = failures.length ? 1 : 0;
+    const ok = got === want;
+    if (!ok) bad += 1;
+    console.log(`  ${ok ? "PASS" : "FAIL"}  selftest: ${name} (expected exit ${want}, got ${got})`);
+    for (const f of failures) console.log(`          ${f}`);
+  }
+  fs.rmSync(root, { recursive: true, force: true });
+  if (bad) {
+    console.error(`FAIL  measurement_gate_selftest  ${bad} of ${cases.length} selftest case(s) behaved wrongly. The check is NOT trustworthy and the real result below must not be believed.`);
+    process.exit(1);
+  }
+  console.log(`PASS  measurement_gate_selftest  ${cases.length} case(s): it accepts a complete measurement and rejects a missing slot, a missing phase and a zero reading.`);
+  process.exit(0);
+}
+// ---------------------------------------------------------------- the check
+const expectedFile = opt("--expected", "scripts/expected-measurement.json");
+const dir = opt("--dir", null);
+if (!dir) {
+  console.error("usage: check-measurement-complete.mjs --dir <phases-dir> [--expected <file>]");
+  console.error("       check-measurement-complete.mjs --selftest");
+  process.exit(2);
+}
+if (!fs.existsSync(dir)) {
+  console.error(`FAIL  measurement_complete  the phases directory ${dir} does not exist, so NOTHING was collected. That is not the same as a measurement that passed.`);
+  process.exit(1);
+}
+const { failures, checked } = check(expectedFile, dir);
+for (const f of failures) console.log(`  FAIL  ${f}`);
+if (failures.length) {
+  console.error(`FAIL  measurement_complete  ${failures.length} problem(s). This branch declares its coverage in ${expectedFile}; either a leg did not report, or the declaration is stale. Fix the run or move the declaration in the same commit that changes the matrix.`);
+  process.exit(1);
+}
+console.log(`PASS  measurement_complete  every declared slot reported every declared phase (${checked} reading(s) checked).`);

scripts/expected-measurement.json ADDED Viewed

	@@ -0,0 +1,15 @@

+{
+  "$what": "What THIS branch claims measure-performance.yml covers. The gate job compares it against what the dk matrix actually reported, and fails when they disagree.",
+  "$why_a_declaration_and_not_the_matrix": "Reading the coverage back out of the matrix would make the check agree with whatever the matrix says, including after a slot is quietly dropped. A separate declaration is the thing a dropped slot can DISAGREE with, which is the whole point. When a slot is added or removed on purpose, this file moves in the same commit.",
+  "$why_it_matters": "The dk matrix runs fail-fast: false, so one leg can die while the others publish numbers and the workflow still finishes. Those numbers then refresh CLO.md and both PR bodies while describing a slot nobody measured. That is the failure this gate exists for: a MISSING measurement, not a slower one.",
+  "$phases_differ_by_branch": "This branch measures build_cold, run_warm and run_edit. The high-performance branch measures fetch_cold, run_reconcile and run_warm, because it consumes a prebuilt object rather than building one. The two declarations are therefore NOT interchangeable, and copying one over the other would make each branch's gate check for phases its workflow never emits.",
+  "slots": [
+    "Release.Linux_x86_64",
+    "Release.Windows_x86_64"
+  ],
+  "phases": [
+    "dk_build_cold",
+    "dk_run_warm",
+    "dk_run_edit"
+  ]
+}

src/adapter/state_initialized.ml CHANGED Viewed

@@ -50,8 +50,7 @@ let spawn_terminal ~kind ~rpc ?name ?env ?cwd prog args =
         Debug_rpc.exec_command rpc
           (module Run_in_terminal_command)
           Run_in_terminal_command.Arguments.
-            { kind = Some kind; title = name; cwd; env; args = prog :: args;
-              args_can_be_interpreted_by_shell = None }
       in
       Lwt.return ());
   Lwt.return ()

         Debug_rpc.exec_command rpc
           (module Run_in_terminal_command)
           Run_in_terminal_command.Arguments.
+            { kind = Some kind; title = name; cwd; env; args = prog :: args }
       in
       Lwt.return ());
   Lwt.return ()