@apexops/capabilities 0.10.0-next.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.tsbuildinfo +1 -0
- package/dist/bound-envelope-transport.d.ts +27 -0
- package/dist/bound-envelope-transport.d.ts.map +1 -0
- package/dist/bound-envelope-transport.js +96 -0
- package/dist/bound-envelope-transport.js.map +1 -0
- package/dist/capability.d.ts +36 -0
- package/dist/capability.d.ts.map +1 -0
- package/dist/capability.js +83 -0
- package/dist/capability.js.map +1 -0
- package/dist/command-plans.d.ts +49 -0
- package/dist/command-plans.d.ts.map +1 -0
- package/dist/command-plans.js +157 -0
- package/dist/command-plans.js.map +1 -0
- package/dist/design-capabilities.d.ts +23 -0
- package/dist/design-capabilities.d.ts.map +1 -0
- package/dist/design-capabilities.js +32 -0
- package/dist/design-capabilities.js.map +1 -0
- package/dist/encrypted-envelope-transport.d.ts +32 -0
- package/dist/encrypted-envelope-transport.d.ts.map +1 -0
- package/dist/encrypted-envelope-transport.js +138 -0
- package/dist/encrypted-envelope-transport.js.map +1 -0
- package/dist/iac-generation.d.ts +52 -0
- package/dist/iac-generation.d.ts.map +1 -0
- package/dist/iac-generation.js +645 -0
- package/dist/iac-generation.js.map +1 -0
- package/dist/iac-normalizers.d.ts +22 -0
- package/dist/iac-normalizers.d.ts.map +1 -0
- package/dist/iac-normalizers.js +198 -0
- package/dist/iac-normalizers.js.map +1 -0
- package/dist/iac.d.ts +83 -0
- package/dist/iac.d.ts.map +1 -0
- package/dist/iac.js +217 -0
- package/dist/iac.js.map +1 -0
- package/dist/index.d.ts +17 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +17 -0
- package/dist/index.js.map +1 -0
- package/dist/local-plan-transport.d.ts +29 -0
- package/dist/local-plan-transport.d.ts.map +1 -0
- package/dist/local-plan-transport.js +101 -0
- package/dist/local-plan-transport.js.map +1 -0
- package/dist/native-iac-providers.d.ts +96 -0
- package/dist/native-iac-providers.d.ts.map +1 -0
- package/dist/native-iac-providers.js +487 -0
- package/dist/native-iac-providers.js.map +1 -0
- package/dist/operations-placeholders.d.ts +5 -0
- package/dist/operations-placeholders.d.ts.map +1 -0
- package/dist/operations-placeholders.js +23 -0
- package/dist/operations-placeholders.js.map +1 -0
- package/dist/pack-manager.d.ts +95 -0
- package/dist/pack-manager.d.ts.map +1 -0
- package/dist/pack-manager.js +556 -0
- package/dist/pack-manager.js.map +1 -0
- package/dist/packs.d.ts +29 -0
- package/dist/packs.d.ts.map +1 -0
- package/dist/packs.js +51 -0
- package/dist/packs.js.map +1 -0
- package/dist/process-runner.d.ts +30 -0
- package/dist/process-runner.d.ts.map +1 -0
- package/dist/process-runner.js +97 -0
- package/dist/process-runner.js.map +1 -0
- package/dist/secret-redaction.d.ts +3 -0
- package/dist/secret-redaction.d.ts.map +1 -0
- package/dist/secret-redaction.js +48 -0
- package/dist/secret-redaction.js.map +1 -0
- package/dist/terraform-provider-schema.d.ts +75 -0
- package/dist/terraform-provider-schema.d.ts.map +1 -0
- package/dist/terraform-provider-schema.js +307 -0
- package/dist/terraform-provider-schema.js.map +1 -0
- package/dist/terraform-registry-client.d.ts +63 -0
- package/dist/terraform-registry-client.d.ts.map +1 -0
- package/dist/terraform-registry-client.js +388 -0
- package/dist/terraform-registry-client.js.map +1 -0
- package/dist/test/bound-envelope-transport.test.d.ts +2 -0
- package/dist/test/bound-envelope-transport.test.d.ts.map +1 -0
- package/dist/test/bound-envelope-transport.test.js +30 -0
- package/dist/test/bound-envelope-transport.test.js.map +1 -0
- package/dist/test/capabilities.test.d.ts +2 -0
- package/dist/test/capabilities.test.d.ts.map +1 -0
- package/dist/test/capabilities.test.js +86 -0
- package/dist/test/capabilities.test.js.map +1 -0
- package/dist/test/encrypted-envelope-transport.test.d.ts +2 -0
- package/dist/test/encrypted-envelope-transport.test.d.ts.map +1 -0
- package/dist/test/encrypted-envelope-transport.test.js +74 -0
- package/dist/test/encrypted-envelope-transport.test.js.map +1 -0
- package/dist/test/fixtures/terraform-provider-schema.d.ts +65 -0
- package/dist/test/fixtures/terraform-provider-schema.d.ts.map +1 -0
- package/dist/test/fixtures/terraform-provider-schema.js +29 -0
- package/dist/test/fixtures/terraform-provider-schema.js.map +1 -0
- package/dist/test/fixtures/terraform-registry.d.ts +54 -0
- package/dist/test/fixtures/terraform-registry.d.ts.map +1 -0
- package/dist/test/fixtures/terraform-registry.js +42 -0
- package/dist/test/fixtures/terraform-registry.js.map +1 -0
- package/dist/test/iac-generation.test.d.ts +2 -0
- package/dist/test/iac-generation.test.d.ts.map +1 -0
- package/dist/test/iac-generation.test.js +271 -0
- package/dist/test/iac-generation.test.js.map +1 -0
- package/dist/test/iac.test.d.ts +2 -0
- package/dist/test/iac.test.d.ts.map +1 -0
- package/dist/test/iac.test.js +161 -0
- package/dist/test/iac.test.js.map +1 -0
- package/dist/test/native-iac-providers.test.d.ts +2 -0
- package/dist/test/native-iac-providers.test.d.ts.map +1 -0
- package/dist/test/native-iac-providers.test.js +594 -0
- package/dist/test/native-iac-providers.test.js.map +1 -0
- package/dist/test/operations-placeholders.test.d.ts +2 -0
- package/dist/test/operations-placeholders.test.d.ts.map +1 -0
- package/dist/test/operations-placeholders.test.js +34 -0
- package/dist/test/operations-placeholders.test.js.map +1 -0
- package/dist/test/pack-manager.test.d.ts +2 -0
- package/dist/test/pack-manager.test.d.ts.map +1 -0
- package/dist/test/pack-manager.test.js +379 -0
- package/dist/test/pack-manager.test.js.map +1 -0
- package/dist/test/packs-and-commands.test.d.ts +2 -0
- package/dist/test/packs-and-commands.test.d.ts.map +1 -0
- package/dist/test/packs-and-commands.test.js +131 -0
- package/dist/test/packs-and-commands.test.js.map +1 -0
- package/dist/test/process-runner.test.d.ts +2 -0
- package/dist/test/process-runner.test.d.ts.map +1 -0
- package/dist/test/process-runner.test.js +42 -0
- package/dist/test/process-runner.test.js.map +1 -0
- package/dist/test/terraform-provider-schema.test.d.ts +2 -0
- package/dist/test/terraform-provider-schema.test.d.ts.map +1 -0
- package/dist/test/terraform-provider-schema.test.js +259 -0
- package/dist/test/terraform-provider-schema.test.js.map +1 -0
- package/dist/test/terraform-registry-client.test.d.ts +2 -0
- package/dist/test/terraform-registry-client.test.d.ts.map +1 -0
- package/dist/test/terraform-registry-client.test.js +321 -0
- package/dist/test/terraform-registry-client.test.js.map +1 -0
- package/package.json +41 -0
|
@@ -0,0 +1,487 @@
|
|
|
1
|
+
import { createHash, randomUUID } from "node:crypto";
|
|
2
|
+
import { readFile, rm } from "node:fs/promises";
|
|
3
|
+
import { isAbsolute, resolve } from "node:path";
|
|
4
|
+
import { BicepCommandAdapter, TerraformCommandAdapter, } from "./command-plans.js";
|
|
5
|
+
import { authorizeDeploymentPreview, IacProviderError, sha256, } from "./iac.js";
|
|
6
|
+
import { normalizeAzureStackResources, normalizeAzureWhatIf, normalizeTerraformPlan, parseJsonProcessOutput, selectAzureDeploymentStack, } from "./iac-normalizers.js";
|
|
7
|
+
import { secretFreeProperties } from "./secret-redaction.js";
|
|
8
|
+
import { LocalEncryptedPlanTransport } from "./local-plan-transport.js";
|
|
9
|
+
function terraformStateIdentity(value) {
|
|
10
|
+
if (value === null || typeof value !== "object" || Array.isArray(value))
|
|
11
|
+
return {};
|
|
12
|
+
const state = value;
|
|
13
|
+
const stateLineage = typeof state.lineage === "string" && state.lineage.length > 0 ? state.lineage : undefined;
|
|
14
|
+
const stateSerial = typeof state.serial === "number" && Number.isInteger(state.serial) && state.serial >= 0 ? state.serial : undefined;
|
|
15
|
+
return {
|
|
16
|
+
...(stateLineage === undefined ? {} : { stateLineage }),
|
|
17
|
+
...(stateSerial === undefined ? {} : { stateSerial }),
|
|
18
|
+
};
|
|
19
|
+
}
|
|
20
|
+
function terraformStateIdentityOutput(stdout) {
|
|
21
|
+
return stdout.trim().length === 0 ? {} : terraformStateIdentity(parseJsonProcessOutput("terraform-state", stdout));
|
|
22
|
+
}
|
|
23
|
+
class NativeProviderBase {
|
|
24
|
+
runner;
|
|
25
|
+
now;
|
|
26
|
+
nextId;
|
|
27
|
+
currentAuthority;
|
|
28
|
+
#timeoutMs;
|
|
29
|
+
#maxOutputBytes;
|
|
30
|
+
#operations = new Map();
|
|
31
|
+
#executionEvidence = new Map();
|
|
32
|
+
bindingStore;
|
|
33
|
+
constructor(options) {
|
|
34
|
+
this.runner = options.runner;
|
|
35
|
+
this.currentAuthority = options.currentAuthority;
|
|
36
|
+
this.now = options.now ?? (() => new Date());
|
|
37
|
+
this.nextId = options.nextId ?? randomUUID;
|
|
38
|
+
this.#timeoutMs = options.timeoutMs ?? 15 * 60_000;
|
|
39
|
+
this.#maxOutputBytes = options.maxOutputBytes ?? 16 * 1024 * 1024;
|
|
40
|
+
this.bindingStore = options.bindingStore;
|
|
41
|
+
}
|
|
42
|
+
async run(plan) {
|
|
43
|
+
const result = await this.runner.run({
|
|
44
|
+
executable: plan.executable,
|
|
45
|
+
args: plan.args,
|
|
46
|
+
...(plan.cwd === undefined ? {} : { cwd: plan.cwd }),
|
|
47
|
+
timeoutMs: this.#timeoutMs,
|
|
48
|
+
maxOutputBytes: this.#maxOutputBytes,
|
|
49
|
+
});
|
|
50
|
+
return result.stdout;
|
|
51
|
+
}
|
|
52
|
+
async authorize(track, operation, preview, approval, suppliedAuthority, latestPreviewHash) {
|
|
53
|
+
const authority = await this.currentAuthority();
|
|
54
|
+
if (authority.head !== suppliedAuthority.head ||
|
|
55
|
+
authority.dependencyRevision !== suppliedAuthority.dependencyRevision ||
|
|
56
|
+
authority.ownerEpoch !== suppliedAuthority.ownerEpoch ||
|
|
57
|
+
authority.previousOwnerEpoch !== suppliedAuthority.previousOwnerEpoch ||
|
|
58
|
+
authority.writerTransferClaimHash !== suppliedAuthority.writerTransferClaimHash ||
|
|
59
|
+
authority.recipientIdentity !== suppliedAuthority.recipientIdentity) {
|
|
60
|
+
throw new IacProviderError("PREVIEW_OWNER_EPOCH_MISMATCH", "Supplied authority is not the current authority");
|
|
61
|
+
}
|
|
62
|
+
authorizeDeploymentPreview({
|
|
63
|
+
operation,
|
|
64
|
+
track,
|
|
65
|
+
preview,
|
|
66
|
+
approval,
|
|
67
|
+
authority,
|
|
68
|
+
now: this.now(),
|
|
69
|
+
...(latestPreviewHash === undefined ? {} : { latestPreviewHash }),
|
|
70
|
+
});
|
|
71
|
+
return authority;
|
|
72
|
+
}
|
|
73
|
+
record(operation, preview, approval, authority, providerOperationId, validatorIds = []) {
|
|
74
|
+
const operationId = this.nextId();
|
|
75
|
+
const record = {
|
|
76
|
+
schemaVersion: "1.0.0",
|
|
77
|
+
operationId,
|
|
78
|
+
projectId: preview.projectId,
|
|
79
|
+
runId: preview.runId,
|
|
80
|
+
...(providerOperationId === undefined ? {} : { providerOperationId }),
|
|
81
|
+
operation,
|
|
82
|
+
state: "succeeded",
|
|
83
|
+
previewHash: preview.previewHash,
|
|
84
|
+
approvalHash: sha256(approval),
|
|
85
|
+
ownerEpoch: authority.ownerEpoch,
|
|
86
|
+
updatedAt: this.now().toISOString(),
|
|
87
|
+
};
|
|
88
|
+
this.#operations.set(operationId, record);
|
|
89
|
+
this.#executionEvidence.set(operationId, {
|
|
90
|
+
mode: "native",
|
|
91
|
+
operationId,
|
|
92
|
+
previewHash: preview.previewHash,
|
|
93
|
+
validatorIds: [...validatorIds],
|
|
94
|
+
});
|
|
95
|
+
return record;
|
|
96
|
+
}
|
|
97
|
+
async reconcile(operationId) {
|
|
98
|
+
return this.#operations.get(operationId);
|
|
99
|
+
}
|
|
100
|
+
executionEvidence(operationId) {
|
|
101
|
+
return this.#executionEvidence.get(operationId);
|
|
102
|
+
}
|
|
103
|
+
previewKey(request, operation) {
|
|
104
|
+
return `${request.projectId}\u0000${request.runId}\u0000${operation}`;
|
|
105
|
+
}
|
|
106
|
+
createPreview(track, operation, request, normalized, extra = {}) {
|
|
107
|
+
const createdAt = this.now();
|
|
108
|
+
const base = {
|
|
109
|
+
schemaVersion: "1.0.0",
|
|
110
|
+
projectId: request.projectId,
|
|
111
|
+
runId: request.runId,
|
|
112
|
+
environment: request.environment,
|
|
113
|
+
track,
|
|
114
|
+
operation,
|
|
115
|
+
target: request.target,
|
|
116
|
+
commit: request.commit,
|
|
117
|
+
dependencyRevision: request.dependencyRevision,
|
|
118
|
+
ownerEpoch: request.ownerEpoch,
|
|
119
|
+
inputHash: request.inputHash,
|
|
120
|
+
iacHash: request.iacHash,
|
|
121
|
+
policyHash: request.policyHash,
|
|
122
|
+
...extra,
|
|
123
|
+
changes: normalized.changes,
|
|
124
|
+
blockers: [...(request.blockers ?? []), ...normalized.blockers],
|
|
125
|
+
createdAt: createdAt.toISOString(),
|
|
126
|
+
expiresAt: new Date(createdAt.getTime() + request.ttlMs).toISOString(),
|
|
127
|
+
};
|
|
128
|
+
return { ...base, previewHash: sha256(base) };
|
|
129
|
+
}
|
|
130
|
+
}
|
|
131
|
+
export class NativeBicepProvider extends NativeProviderBase {
|
|
132
|
+
track = "bicep";
|
|
133
|
+
#target;
|
|
134
|
+
#commands = new BicepCommandAdapter();
|
|
135
|
+
#bindings = new Map();
|
|
136
|
+
constructor(options) {
|
|
137
|
+
super(options);
|
|
138
|
+
const actionOnUnmanage = options.target.actionOnUnmanage ?? "detachAll";
|
|
139
|
+
this.#target = { ...options.target, actionOnUnmanage };
|
|
140
|
+
if (!["deleteAll", "deleteResources", "detachAll"].includes(this.#target.actionOnUnmanage)) {
|
|
141
|
+
throw new TypeError("Invalid Bicep stack action-on-unmanage");
|
|
142
|
+
}
|
|
143
|
+
if (!["denyDelete", "denyWriteAndDelete", "none"].includes(this.#target.denySettingsMode)) {
|
|
144
|
+
throw new TypeError("Invalid Bicep stack deny-settings-mode");
|
|
145
|
+
}
|
|
146
|
+
if (actionOnUnmanage === "deleteResources" && options.target.ownershipAuthorizesDeleteResources !== true) {
|
|
147
|
+
throw new TypeError("deleteResources requires an explicit ownership authorization");
|
|
148
|
+
}
|
|
149
|
+
if (actionOnUnmanage === "deleteAll" &&
|
|
150
|
+
(options.target.dedicatedSandboxResourceGroup !== true || options.target.allowDeleteAll !== true)) {
|
|
151
|
+
throw new TypeError("deleteAll requires an explicitly authorized dedicated sandbox resource group");
|
|
152
|
+
}
|
|
153
|
+
}
|
|
154
|
+
async validate() {
|
|
155
|
+
await this.run(this.#commands.validate(this.#target.templateFile, this.#target.cwd));
|
|
156
|
+
return [];
|
|
157
|
+
}
|
|
158
|
+
async previewApply(request) {
|
|
159
|
+
const [stdout, stackResources] = await Promise.all([
|
|
160
|
+
this.run(this.#commands.preview(this.#target)),
|
|
161
|
+
this.#currentStackResources(),
|
|
162
|
+
]);
|
|
163
|
+
const normalized = normalizeAzureWhatIf(parseJsonProcessOutput("azure-what-if", stdout));
|
|
164
|
+
const previewIds = new Set(normalized.changes.map(({ resourceId }) => resourceId.toLowerCase()));
|
|
165
|
+
const unrepresented = stackResources.filter(({ resourceId }) => !previewIds.has(resourceId.toLowerCase()));
|
|
166
|
+
if (unrepresented.length > 0) {
|
|
167
|
+
normalized.blockers.push(`Group what-if cannot prove action-on-unmanage behavior for current stack resources: ${unrepresented.map(({ resourceId }) => resourceId).join(", ")}`);
|
|
168
|
+
}
|
|
169
|
+
return await this.#bind(request, "apply", normalized, stackResources);
|
|
170
|
+
}
|
|
171
|
+
async previewDestroy(request) {
|
|
172
|
+
const resources = await this.#currentStackResources();
|
|
173
|
+
return await this.#bind(request, "destroy", {
|
|
174
|
+
changes: resources.map((resource) => ({ resourceId: resource.resourceId, action: "delete", material: true })),
|
|
175
|
+
blockers: [],
|
|
176
|
+
}, resources);
|
|
177
|
+
}
|
|
178
|
+
async apply(preview, approval, authority) {
|
|
179
|
+
return await this.#execute("apply", preview, approval, authority);
|
|
180
|
+
}
|
|
181
|
+
async destroy(preview, approval, authority) {
|
|
182
|
+
return await this.#execute("destroy", preview, approval, authority);
|
|
183
|
+
}
|
|
184
|
+
async inventory(projectId, runId) {
|
|
185
|
+
const resources = await this.#currentStackResources();
|
|
186
|
+
return {
|
|
187
|
+
schemaVersion: "1.0.0",
|
|
188
|
+
projectId,
|
|
189
|
+
runId,
|
|
190
|
+
deploymentHash: sha256(resources),
|
|
191
|
+
collectedAt: this.now().toISOString(),
|
|
192
|
+
resources: [...resources],
|
|
193
|
+
};
|
|
194
|
+
}
|
|
195
|
+
async #bind(request, operation, normalized, stackResources) {
|
|
196
|
+
const templateHash = await this.#rawFileHash(this.#target.templateFile);
|
|
197
|
+
const parametersHash = this.#target.parametersFile === undefined
|
|
198
|
+
? createHash("sha256").update(Buffer.alloc(0)).digest("hex")
|
|
199
|
+
: await this.#rawFileHash(this.#target.parametersFile);
|
|
200
|
+
const stackStateHash = sha256(stackResources);
|
|
201
|
+
const providerBindingHash = sha256({
|
|
202
|
+
resourceGroup: this.#target.resourceGroup,
|
|
203
|
+
stackName: this.#target.stackName,
|
|
204
|
+
actionOnUnmanage: this.#target.actionOnUnmanage,
|
|
205
|
+
denySettingsMode: this.#target.denySettingsMode,
|
|
206
|
+
templateHash,
|
|
207
|
+
parametersHash,
|
|
208
|
+
stackStateHash,
|
|
209
|
+
});
|
|
210
|
+
const preview = this.createPreview(this.track, operation, request, normalized, {
|
|
211
|
+
artifactHash: providerBindingHash,
|
|
212
|
+
});
|
|
213
|
+
const binding = {
|
|
214
|
+
kind: "bicep",
|
|
215
|
+
preview,
|
|
216
|
+
providerBindingHash,
|
|
217
|
+
templateHash,
|
|
218
|
+
parametersHash,
|
|
219
|
+
stackStateHash,
|
|
220
|
+
};
|
|
221
|
+
this.#bindings.set(this.previewKey(request, operation), binding);
|
|
222
|
+
await this.bindingStore?.save(preview.previewHash, binding);
|
|
223
|
+
return preview;
|
|
224
|
+
}
|
|
225
|
+
async #rawFileHash(path) {
|
|
226
|
+
const filePath = isAbsolute(path) ? path : resolve(this.#target.cwd ?? process.cwd(), path);
|
|
227
|
+
return createHash("sha256")
|
|
228
|
+
.update(await readFile(filePath))
|
|
229
|
+
.digest("hex");
|
|
230
|
+
}
|
|
231
|
+
async #currentStackResources() {
|
|
232
|
+
const stdout = await this.run(this.#commands.stackList(this.#target));
|
|
233
|
+
const selected = selectAzureDeploymentStack(parseJsonProcessOutput("azure-stack", stdout), this.#target.resourceGroup, this.#target.stackName);
|
|
234
|
+
return selected === null ? [] : normalizeAzureStackResources(selected);
|
|
235
|
+
}
|
|
236
|
+
async #execute(operation, preview, approval, suppliedAuthority) {
|
|
237
|
+
const key = `${preview.projectId}\u0000${preview.runId}\u0000${operation}`;
|
|
238
|
+
const restoredLatest = await this.bindingStore?.loadLatest?.(preview.projectId, preview.runId, operation);
|
|
239
|
+
const latestBinding = this.#bindings.get(key) ?? (restoredLatest?.kind === "bicep" ? restoredLatest : undefined);
|
|
240
|
+
let binding = latestBinding;
|
|
241
|
+
if (binding === undefined) {
|
|
242
|
+
const restored = await this.bindingStore?.load(preview.previewHash);
|
|
243
|
+
if (restored?.kind === "bicep")
|
|
244
|
+
binding = restored;
|
|
245
|
+
}
|
|
246
|
+
const authority = await this.authorize(this.track, operation, preview, approval, suppliedAuthority, latestBinding?.preview.previewHash ?? binding?.preview.previewHash);
|
|
247
|
+
if (binding === undefined || binding.preview.previewHash !== preview.previewHash) {
|
|
248
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "No exact Bicep stack binding is available for this preview");
|
|
249
|
+
}
|
|
250
|
+
const templateHash = await this.#rawFileHash(this.#target.templateFile);
|
|
251
|
+
const parametersHash = this.#target.parametersFile === undefined
|
|
252
|
+
? createHash("sha256").update(Buffer.alloc(0)).digest("hex")
|
|
253
|
+
: await this.#rawFileHash(this.#target.parametersFile);
|
|
254
|
+
const stackStateHash = sha256(await this.#currentStackResources());
|
|
255
|
+
if (templateHash !== binding.templateHash ||
|
|
256
|
+
parametersHash !== binding.parametersHash ||
|
|
257
|
+
stackStateHash !== binding.stackStateHash ||
|
|
258
|
+
preview.artifactHash !== binding.providerBindingHash) {
|
|
259
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Bicep stack inputs, configuration, or managed state changed after preview");
|
|
260
|
+
}
|
|
261
|
+
const stdout = await this.run(operation === "apply" ? this.#commands.stackApply(this.#target) : this.#commands.stackDestroy(this.#target));
|
|
262
|
+
let providerOperationId;
|
|
263
|
+
if (stdout.trim().length > 0) {
|
|
264
|
+
const result = parseJsonProcessOutput("azure-stack", stdout);
|
|
265
|
+
providerOperationId = typeof result.id === "string" ? result.id : undefined;
|
|
266
|
+
}
|
|
267
|
+
return this.record(operation, preview, approval, authority, providerOperationId, ["deploy:bicep-stack-ownership"]);
|
|
268
|
+
}
|
|
269
|
+
}
|
|
270
|
+
export class NativeTerraformProvider extends NativeProviderBase {
|
|
271
|
+
track = "terraform";
|
|
272
|
+
#target;
|
|
273
|
+
#commands = new TerraformCommandAdapter();
|
|
274
|
+
#bindings = new Map();
|
|
275
|
+
#keyProvider;
|
|
276
|
+
#artifactStore;
|
|
277
|
+
#transport;
|
|
278
|
+
constructor(options) {
|
|
279
|
+
super(options);
|
|
280
|
+
this.#target = options.target;
|
|
281
|
+
this.#keyProvider = options.keyProvider;
|
|
282
|
+
this.#artifactStore = options.artifactStore;
|
|
283
|
+
this.#transport = options.transport ?? new LocalEncryptedPlanTransport(this.now);
|
|
284
|
+
}
|
|
285
|
+
async validate() {
|
|
286
|
+
await this.run(this.#commands.init(this.#target.cwd, false));
|
|
287
|
+
for (const command of this.#commands.validate(this.#target.cwd)) {
|
|
288
|
+
await this.run(command);
|
|
289
|
+
}
|
|
290
|
+
return [];
|
|
291
|
+
}
|
|
292
|
+
async previewApply(request) {
|
|
293
|
+
return await this.#preview(request, "apply");
|
|
294
|
+
}
|
|
295
|
+
async previewDestroy(request) {
|
|
296
|
+
return await this.#preview(request, "destroy");
|
|
297
|
+
}
|
|
298
|
+
async apply(preview, approval, authority) {
|
|
299
|
+
return await this.#execute("apply", preview, approval, authority);
|
|
300
|
+
}
|
|
301
|
+
async destroy(preview, approval, authority) {
|
|
302
|
+
return await this.#execute("destroy", preview, approval, authority);
|
|
303
|
+
}
|
|
304
|
+
async inventory(projectId, runId) {
|
|
305
|
+
const stdout = await this.run({ executable: "terraform", args: ["show", "-json"], cwd: this.#target.cwd });
|
|
306
|
+
const root = parseJsonProcessOutput("terraform-plan", stdout);
|
|
307
|
+
const values = root.values;
|
|
308
|
+
const rootModule = values?.root_module;
|
|
309
|
+
const collectResources = (module) => [
|
|
310
|
+
...(Array.isArray(module?.resources) ? module.resources : []),
|
|
311
|
+
...(Array.isArray(module?.child_modules)
|
|
312
|
+
? module.child_modules.flatMap((child) => child !== null && typeof child === "object" && !Array.isArray(child)
|
|
313
|
+
? collectResources(child)
|
|
314
|
+
: [])
|
|
315
|
+
: []),
|
|
316
|
+
];
|
|
317
|
+
const resources = collectResources(rootModule);
|
|
318
|
+
const normalized = resources.flatMap((entry) => {
|
|
319
|
+
if (entry === null || typeof entry !== "object" || Array.isArray(entry))
|
|
320
|
+
return [];
|
|
321
|
+
const resource = entry;
|
|
322
|
+
const address = typeof resource.address === "string" ? resource.address : undefined;
|
|
323
|
+
if (address === undefined)
|
|
324
|
+
return [];
|
|
325
|
+
return [
|
|
326
|
+
{
|
|
327
|
+
logicalId: address,
|
|
328
|
+
resourceId: typeof resource.provider_name === "string" ? `${resource.provider_name}:${address}` : address,
|
|
329
|
+
type: typeof resource.type === "string" ? resource.type : "unknown",
|
|
330
|
+
location: "terraform-managed",
|
|
331
|
+
properties: secretFreeProperties(resource.values, resource.sensitive_values),
|
|
332
|
+
},
|
|
333
|
+
];
|
|
334
|
+
});
|
|
335
|
+
return {
|
|
336
|
+
schemaVersion: "1.0.0",
|
|
337
|
+
projectId,
|
|
338
|
+
runId,
|
|
339
|
+
deploymentHash: sha256(normalized),
|
|
340
|
+
collectedAt: this.now().toISOString(),
|
|
341
|
+
resources: normalized,
|
|
342
|
+
};
|
|
343
|
+
}
|
|
344
|
+
attestation(previewHash) {
|
|
345
|
+
for (const binding of this.#bindings.values()) {
|
|
346
|
+
if (binding.preview.previewHash === previewHash)
|
|
347
|
+
return binding.attestation;
|
|
348
|
+
}
|
|
349
|
+
return undefined;
|
|
350
|
+
}
|
|
351
|
+
async #preview(request, operation) {
|
|
352
|
+
if (this.#keyProvider === undefined || this.#artifactStore === undefined || this.bindingStore === undefined) {
|
|
353
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Terraform local/reference plan transport requires injected key, artifact, and binding stores");
|
|
354
|
+
}
|
|
355
|
+
const planPath = this.#target.planPath(request, operation);
|
|
356
|
+
await this.run(this.#commands.init(this.#target.cwd, true));
|
|
357
|
+
const stateIdentity = terraformStateIdentityOutput(await this.run(this.#commands.statePull(this.#target.cwd)));
|
|
358
|
+
await this.run(this.#commands.preview(this.#target.cwd, planPath, operation === "destroy"));
|
|
359
|
+
try {
|
|
360
|
+
const planBytes = await readFile(planPath);
|
|
361
|
+
const planDigest = createHash("sha256").update(planBytes).digest("hex");
|
|
362
|
+
const showOutput = await this.run(this.#commands.showJson(this.#target.cwd, planPath));
|
|
363
|
+
const normalized = normalizeTerraformPlan(parseJsonProcessOutput("terraform-plan", showOutput));
|
|
364
|
+
const authority = await this.currentAuthority();
|
|
365
|
+
if (authority.ownerEpoch !== request.ownerEpoch ||
|
|
366
|
+
authority.head !== request.commit ||
|
|
367
|
+
authority.dependencyRevision !== request.dependencyRevision) {
|
|
368
|
+
throw new IacProviderError("PREVIEW_OWNER_EPOCH_MISMATCH", "Preview request authority is stale");
|
|
369
|
+
}
|
|
370
|
+
const executionRecipient = request.executionRecipientIdentity ?? authority.recipientIdentity;
|
|
371
|
+
const encrypted = this.#transport.encrypt(planBytes, await this.#keyProvider(), {
|
|
372
|
+
recipient: executionRecipient,
|
|
373
|
+
ttlMs: request.ttlMs,
|
|
374
|
+
});
|
|
375
|
+
const artifactRef = `${request.projectId}/${request.runId}/${operation}/${planDigest}.tfplan.enc`;
|
|
376
|
+
await this.#artifactStore.put(artifactRef, encrypted);
|
|
377
|
+
const configHash = await this.#target.configHash();
|
|
378
|
+
const artifactHash = sha256({
|
|
379
|
+
planDigest,
|
|
380
|
+
configHash,
|
|
381
|
+
lockfileHash: this.#target.lockfileHash,
|
|
382
|
+
recipient: executionRecipient,
|
|
383
|
+
artifactRef,
|
|
384
|
+
});
|
|
385
|
+
const preview = this.createPreview(this.track, operation, request, normalized, {
|
|
386
|
+
artifactHash,
|
|
387
|
+
...stateIdentity,
|
|
388
|
+
});
|
|
389
|
+
const createdAt = this.now();
|
|
390
|
+
const attestation = {
|
|
391
|
+
schemaVersion: "1.0.0",
|
|
392
|
+
projectId: request.projectId,
|
|
393
|
+
runId: request.runId,
|
|
394
|
+
track: this.track,
|
|
395
|
+
previewHash: preview.previewHash,
|
|
396
|
+
inputHash: request.inputHash,
|
|
397
|
+
iacHash: request.iacHash,
|
|
398
|
+
policyHash: request.policyHash,
|
|
399
|
+
configHash,
|
|
400
|
+
lockfileHash: this.#target.lockfileHash,
|
|
401
|
+
recipient: executionRecipient,
|
|
402
|
+
planDigest,
|
|
403
|
+
artifactRef,
|
|
404
|
+
...(preview.stateLineage === undefined ? {} : { stateLineage: preview.stateLineage }),
|
|
405
|
+
...(preview.stateSerial === undefined ? {} : { stateSerial: preview.stateSerial }),
|
|
406
|
+
transport: {
|
|
407
|
+
encrypted: true,
|
|
408
|
+
implementation: "local-reference",
|
|
409
|
+
algorithm: "aes-256-gcm",
|
|
410
|
+
recipient: executionRecipient,
|
|
411
|
+
mediaType: "application/vnd.apex.terraform-plan",
|
|
412
|
+
iv: encrypted.iv,
|
|
413
|
+
authTag: encrypted.authTag,
|
|
414
|
+
},
|
|
415
|
+
createdAt: createdAt.toISOString(),
|
|
416
|
+
expiresAt: preview.expiresAt,
|
|
417
|
+
};
|
|
418
|
+
const binding = { kind: "terraform", preview, attestation };
|
|
419
|
+
this.#bindings.set(this.previewKey(request, operation), binding);
|
|
420
|
+
await this.bindingStore.save(preview.previewHash, binding);
|
|
421
|
+
return preview;
|
|
422
|
+
}
|
|
423
|
+
finally {
|
|
424
|
+
await rm(planPath, { force: true });
|
|
425
|
+
}
|
|
426
|
+
}
|
|
427
|
+
async #execute(operation, preview, approval, suppliedAuthority) {
|
|
428
|
+
let binding = this.#bindings.get(`${preview.projectId}\u0000${preview.runId}\u0000${operation}`);
|
|
429
|
+
if (binding === undefined) {
|
|
430
|
+
const restored = await this.bindingStore?.load(preview.previewHash);
|
|
431
|
+
if (restored?.kind === "terraform")
|
|
432
|
+
binding = restored;
|
|
433
|
+
}
|
|
434
|
+
const authority = await this.authorize(this.track, operation, preview, approval, suppliedAuthority, binding?.preview.previewHash);
|
|
435
|
+
if (binding === undefined) {
|
|
436
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "No exact saved plan is bound to this preview");
|
|
437
|
+
}
|
|
438
|
+
if (binding.attestation.recipient !== authority.recipientIdentity) {
|
|
439
|
+
throw new IacProviderError("APPROVAL_RECIPIENT_MISMATCH", "Saved plan recipient is not the current authority");
|
|
440
|
+
}
|
|
441
|
+
if (binding.attestation.configHash !== (await this.#target.configHash()) ||
|
|
442
|
+
binding.attestation.lockfileHash !== this.#target.lockfileHash ||
|
|
443
|
+
binding.attestation.inputHash !== preview.inputHash ||
|
|
444
|
+
binding.attestation.stateLineage !== preview.stateLineage ||
|
|
445
|
+
binding.attestation.stateSerial !== preview.stateSerial) {
|
|
446
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Saved plan attestation does not match the preview");
|
|
447
|
+
}
|
|
448
|
+
const currentState = terraformStateIdentityOutput(await this.run(this.#commands.statePull(this.#target.cwd)));
|
|
449
|
+
if (currentState.stateLineage !== binding.attestation.stateLineage ||
|
|
450
|
+
currentState.stateSerial !== binding.attestation.stateSerial) {
|
|
451
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Terraform state changed after preview");
|
|
452
|
+
}
|
|
453
|
+
const providerArtifactHash = sha256({
|
|
454
|
+
planDigest: binding.attestation.planDigest,
|
|
455
|
+
configHash: binding.attestation.configHash,
|
|
456
|
+
lockfileHash: binding.attestation.lockfileHash,
|
|
457
|
+
recipient: binding.attestation.recipient,
|
|
458
|
+
artifactRef: binding.attestation.artifactRef,
|
|
459
|
+
});
|
|
460
|
+
if (preview.artifactHash !== providerArtifactHash) {
|
|
461
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Terraform provider binding hash does not match the preview");
|
|
462
|
+
}
|
|
463
|
+
if (this.#keyProvider === undefined || this.#artifactStore === undefined) {
|
|
464
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Terraform plan decryption dependencies are unavailable");
|
|
465
|
+
}
|
|
466
|
+
const encrypted = await this.#artifactStore.get(binding.attestation.artifactRef);
|
|
467
|
+
if (encrypted === undefined)
|
|
468
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Encrypted plan artifact is missing");
|
|
469
|
+
if (encrypted.iv !== binding.attestation.transport.iv ||
|
|
470
|
+
encrypted.authTag !== binding.attestation.transport.authTag ||
|
|
471
|
+
encrypted.metadata.digest !== binding.attestation.planDigest) {
|
|
472
|
+
throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Encrypted plan metadata does not match its attestation");
|
|
473
|
+
}
|
|
474
|
+
const handle = await this.#transport.decryptToRestrictiveTemp(encrypted, await this.#keyProvider(), authority.recipientIdentity);
|
|
475
|
+
try {
|
|
476
|
+
await this.run(this.#commands.applyExact(this.#target.cwd, handle.path));
|
|
477
|
+
return this.record(operation, preview, approval, authority, `terraform-plan:${binding.attestation.planDigest}`, [
|
|
478
|
+
"deploy:exact-saved-plan",
|
|
479
|
+
"deploy:state-lineage-and-serial",
|
|
480
|
+
]);
|
|
481
|
+
}
|
|
482
|
+
finally {
|
|
483
|
+
await handle.dispose();
|
|
484
|
+
}
|
|
485
|
+
}
|
|
486
|
+
}
|
|
487
|
+
//# sourceMappingURL=native-iac-providers.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"native-iac-providers.js","sourceRoot":"","sources":["../src/native-iac-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQhD,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GAIxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,MAAM,GAKP,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAA2B,MAAM,2BAA2B,CAAC;AAiEjG,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,MAAM,WAAW,GACf,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,OAAO;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QACvD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAc;IAClD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;AACrH,CAAC;AAED,MAAe,kBAAkB;IACZ,MAAM,CAAoB;IAC1B,GAAG,CAAa;IAChB,MAAM,CAAe;IACrB,gBAAgB,CAA4C;IACtE,UAAU,CAAS;IACnB,eAAe,CAAS;IACxB,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,kBAAkB,GAAG,IAAI,GAAG,EAAqC,CAAC;IACxD,YAAY,CAAkC;IAEjE,YAAsB,OAA8B;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,GAAG,MAAM,CAAC;QACnD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QAClE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC3C,CAAC;IAES,KAAK,CAAC,GAAG,CAAC,IAAiB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACpD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,cAAc,EAAE,IAAI,CAAC,eAAe;SACrC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,KAA4B,EAC5B,SAA8B,EAC9B,OAA4B,EAC5B,QAA4B,EAC5B,iBAA6C,EAC7C,iBAAqC;QAErC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,IACE,SAAS,CAAC,IAAI,KAAK,iBAAiB,CAAC,IAAI;YACzC,SAAS,CAAC,kBAAkB,KAAK,iBAAiB,CAAC,kBAAkB;YACrE,SAAS,CAAC,UAAU,KAAK,iBAAiB,CAAC,UAAU;YACrD,SAAS,CAAC,kBAAkB,KAAK,iBAAiB,CAAC,kBAAkB;YACrE,SAAS,CAAC,uBAAuB,KAAK,iBAAiB,CAAC,uBAAuB;YAC/E,SAAS,CAAC,iBAAiB,KAAK,iBAAiB,CAAC,iBAAiB,EACnE,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,EAAE,iDAAiD,CAAC,CAAC;QAChH,CAAC;QACD,0BAA0B,CAAC;YACzB,SAAS;YACT,KAAK;YACL,OAAO;YACP,QAAQ;YACR,SAAS;YACT,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAES,MAAM,CACd,SAA8B,EAC9B,OAA4B,EAC5B,QAA4B,EAC5B,SAAqC,EACrC,mBAA4B,EAC5B,YAAY,GAAsB,EAAE;QAEpC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,MAAM,GAAsB;YAChC,aAAa,EAAE,OAAO;YACtB,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;YACrE,SAAS;YACT,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE;YACvC,IAAI,EAAE,QAAQ;YACd,WAAW;YACX,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,iBAAiB,CAAC,WAAmB;QACnC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,UAAU,CAAC,OAAuB,EAAE,SAA8B;QAC1E,OAAO,GAAG,OAAO,CAAC,SAAS,SAAS,OAAO,CAAC,KAAK,SAAS,SAAS,EAAE,CAAC;IACxE,CAAC;IAES,aAAa,CACrB,KAA4B,EAC5B,SAA8B,EAC9B,OAAuB,EACvB,UAAmD,EACnD,KAAK,GAAwF,EAAE;QAE/F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG;YACX,aAAa,EAAE,OAAgB;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK;YACL,SAAS;YACT,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,KAAK;YACR,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;YAC/D,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;SACvE,CAAC;QACF,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAChD,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,kBAAkB;IAChD,KAAK,GAAG,OAAgB,CAAC;IACzB,OAAO,CAA2B;IAClC,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;IACtC,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE5D,YAAY,OAAmC;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,IAAI,WAAW,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACvD,IAAI,CAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,CAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAE,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,CAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,gBAAgB,KAAK,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,kCAAkC,KAAK,IAAI,EAAE,CAAC;YACzG,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAC;QACtF,CAAC;QACD,IACE,gBAAgB,KAAK,WAAW;YAChC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,EACjG,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,8EAA8E,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACrF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAuB;QACxC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,sBAAsB,EAAE;SAC9B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,sBAAsB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3G,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,QAAQ,CAAC,IAAI,CACtB,uFAAuF,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAuB;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtD,OAAO,MAAM,IAAI,CAAC,KAAK,CACrB,OAAO,EACP,SAAS,EACT;YACE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7G,QAAQ,EAAE,EAAE;SACb,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAA4B,EAC5B,QAA4B,EAC5B,SAAqC;QAErC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAA4B,EAC5B,QAA4B,EAC5B,SAAqC;QAErC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,KAAa;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtD,OAAO;YACL,aAAa,EAAE,OAAO;YACtB,SAAS;YACT,KAAK;YACL,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC;YACjC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;SAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAAuB,EACvB,SAA8B,EAC9B,UAAmD,EACnD,cAA+D;QAE/D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxE,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;YACvC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,mBAAmB,GAAG,MAAM,CAAC;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YACzC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAC/C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAC/C,YAAY;YACZ,cAAc;YACd,cAAc;SACf,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE;YAC7E,YAAY,EAAE,mBAAmB;SAClC,CAAC,CAAC;QACH,MAAM,OAAO,GAAwB;YACnC,IAAI,EAAE,OAAO;YACb,OAAO;YACP,mBAAmB;YACnB,YAAY;YACZ,cAAc;YACd,cAAc;SACf,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5F,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;aAChC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,0BAA0B,CACzC,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAAC,EAC7C,IAAI,CAAC,OAAO,CAAC,aAAa,EAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,CACvB,CAAC;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAA8B,EAC9B,OAA4B,EAC5B,QAA4B,EAC5B,iBAA6C;QAE7C,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,SAAS,OAAO,CAAC,KAAK,SAAS,SAAS,EAAE,CAAC;QAC3E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1G,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjH,IAAI,OAAO,GAAG,aAAa,CAAC;QAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,QAAQ,EAAE,IAAI,KAAK,OAAO;gBAAE,OAAO,GAAG,QAAQ,CAAC;QACrD,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CACpC,IAAI,CAAC,KAAK,EACV,SAAS,EACT,OAAO,EACP,QAAQ,EACR,iBAAiB,EACjB,aAAa,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,EAAE,OAAO,CAAC,WAAW,CACnE,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACjF,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,4DAA4D,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxE,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;YACvC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACnE,IACE,YAAY,KAAK,OAAO,CAAC,YAAY;YACrC,cAAc,KAAK,OAAO,CAAC,cAAc;YACzC,cAAc,KAAK,OAAO,CAAC,cAAc;YACzC,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,mBAAmB,EACpD,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,uBAAuB,EACvB,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAC3B,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAC5G,CAAC;QACF,IAAI,mBAAuC,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAA4B,CAAC;YACxF,mBAAmB,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACrH,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,kBAAkB;IACpD,KAAK,GAAG,WAAoB,CAAC;IAC7B,OAAO,CAAwB;IAC/B,SAAS,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAC1C,SAAS,GAAG,IAAI,GAAG,EAAmC,CAAC;IACvD,YAAY,CAA0C;IACtD,cAAc,CAAyC;IACvD,UAAU,CAA8B;IAEjD,YAAY,OAAuC;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAuB;QACxC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAuB;QAC1C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAA4B,EAC5B,QAA4B,EAC5B,SAAqC;QAErC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAA4B,EAC5B,QAA4B,EAC5B,SAAqC;QAErC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,KAAa;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,CAA4B,CAAC;QACzF,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;QAClE,MAAM,UAAU,GAAG,MAAM,EAAE,WAAkD,CAAC;QAC9E,MAAM,gBAAgB,GAAG,CAAC,MAA2C,EAAsB,EAAE,CAAC;YAC5F,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC;gBACtC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACrC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAClE,CAAC,CAAC,gBAAgB,CAAC,KAAgC,CAAC;oBACpD,CAAC,CAAC,EAAE,CACP;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,KAAgC,CAAC;YAClD,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACrC,OAAO;gBACL;oBACE,SAAS,EAAE,OAAO;oBAClB,UAAU,EAAE,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,aAAa,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO;oBACzG,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBACnE,QAAQ,EAAE,mBAAmB;oBAC7B,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC;iBAC7E;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,OAAO;YACtB,SAAS;YACT,KAAK;YACL,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC;YAClC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,SAAS,EAAE,UAAU;SACtB,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,WAAmB;QAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,WAAW,CAAC;QAC9E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAuB,EAAE,SAA8B;QACpE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5G,MAAM,IAAI,gBAAgB,CACxB,uBAAuB,EACvB,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,4BAA4B,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvF,MAAM,UAAU,GAAG,sBAAsB,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC;YAChG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAChD,IACE,SAAS,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAC3C,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;gBACjC,SAAS,CAAC,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,EAC3D,CAAC;gBACD,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,EAAE,oCAAoC,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,0BAA0B,IAAI,SAAS,CAAC,iBAAiB,CAAC;YAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE;gBAC9E,SAAS,EAAE,kBAAkB;gBAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,SAAS,IAAI,UAAU,aAAa,CAAC;YAClG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG,MAAM,CAAC;gBAC1B,UAAU;gBACV,UAAU;gBACV,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,SAAS,EAAE,kBAAkB;gBAC7B,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE;gBAC7E,YAAY;gBACZ,GAAG,aAAa;aACjB,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,WAAW,GAA6B;gBAC5C,aAAa,EAAE,OAAO;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU;gBACV,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,SAAS,EAAE,kBAAkB;gBAC7B,UAAU;gBACV,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;gBACrF,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBAClF,SAAS,EAAE;oBACT,SAAS,EAAE,IAAI;oBACf,cAAc,EAAE,iBAAiB;oBACjC,SAAS,EAAE,aAAa;oBACxB,SAAS,EAAE,kBAAkB;oBAC7B,SAAS,EAAE,qCAAqC;oBAChD,EAAE,EAAE,SAAS,CAAC,EAAE;oBAChB,OAAO,EAAE,SAAS,CAAC,OAAO;iBAC3B;gBACD,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;YACF,MAAM,OAAO,GAA4B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YACrF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAA8B,EAC9B,OAA4B,EAC5B,QAA4B,EAC5B,iBAA6C;QAE7C,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,SAAS,OAAO,CAAC,KAAK,SAAS,SAAS,EAAE,CAAC,CAAC;QACjG,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,QAAQ,EAAE,IAAI,KAAK,WAAW;gBAAE,OAAO,GAAG,QAAQ,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CACpC,IAAI,CAAC,KAAK,EACV,SAAS,EACT,OAAO,EACP,QAAQ,EACR,iBAAiB,EACjB,OAAO,EAAE,OAAO,CAAC,WAAW,CAC7B,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,8CAA8C,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,iBAAiB,EAAE,CAAC;YAClE,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,EAAE,mDAAmD,CAAC,CAAC;QACjH,CAAC;QACD,IACE,OAAO,CAAC,WAAW,CAAC,UAAU,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACpE,OAAO,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY;YAC9D,OAAO,CAAC,WAAW,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;YACnD,OAAO,CAAC,WAAW,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;YACzD,OAAO,CAAC,WAAW,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EACvD,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,YAAY,GAAG,4BAA4B,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9G,IACE,YAAY,CAAC,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,YAAY;YAC9D,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,WAAW,EAC5D,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,uCAAuC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,oBAAoB,GAAG,MAAM,CAAC;YAClC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU;YAC1C,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU;YAC1C,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,YAAY;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,WAAW;SAC7C,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAClD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,4DAA4D,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,SAAS,KAAK,SAAS;YACzB,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;QAC5F,IACE,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE;YACjD,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO;YAC3D,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,UAAU,EAC5D,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAC3D,SAAS,EACT,MAAM,IAAI,CAAC,YAAY,EAAE,EACzB,SAAS,CAAC,iBAAiB,CAC5B,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE;gBAC9G,yBAAyB;gBACzB,iCAAiC;aAClC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;CACF"}
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
import { type Capability } from "./capability.js";
|
|
2
|
+
export declare const operationsCapabilityCategories: readonly ["governance-discovery", "inventory-query", "quota-availability", "diagnostics-kusto", "compliance", "cost-normalization"];
|
|
3
|
+
export type OperationsCapabilityCategory = (typeof operationsCapabilityCategories)[number];
|
|
4
|
+
export declare function createUnavailableOperationsCapabilities(requiredRole: string): readonly Capability<unknown, never>[];
|
|
5
|
+
//# sourceMappingURL=operations-placeholders.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"operations-placeholders.d.ts","sourceRoot":"","sources":["../src/operations-placeholders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEnE,eAAO,MAAM,8BAA8B,YACzC,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,CACZ,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,wBAAgB,uCAAuC,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAenH"}
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
import { CapabilityError } from "./capability.js";
|
|
2
|
+
export const operationsCapabilityCategories = [
|
|
3
|
+
"governance-discovery",
|
|
4
|
+
"inventory-query",
|
|
5
|
+
"quota-availability",
|
|
6
|
+
"diagnostics-kusto",
|
|
7
|
+
"compliance",
|
|
8
|
+
"cost-normalization",
|
|
9
|
+
];
|
|
10
|
+
export function createUnavailableOperationsCapabilities(requiredRole) {
|
|
11
|
+
return operationsCapabilityCategories.map((category) => ({
|
|
12
|
+
id: `operations.${category}`,
|
|
13
|
+
sideEffect: "none",
|
|
14
|
+
requiredRole,
|
|
15
|
+
timeoutMs: 100,
|
|
16
|
+
retries: 0,
|
|
17
|
+
idempotency: "none",
|
|
18
|
+
async execute() {
|
|
19
|
+
throw new CapabilityError("CAPABILITY_UNAVAILABLE", `Capability 'operations.${category}' is unavailable in this runtime`);
|
|
20
|
+
},
|
|
21
|
+
}));
|
|
22
|
+
}
|
|
23
|
+
//# sourceMappingURL=operations-placeholders.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"operations-placeholders.js","sourceRoot":"","sources":["../src/operations-placeholders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAmB,MAAM,iBAAiB,CAAC;AAEnE,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,sBAAsB;IACtB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,YAAY;IACZ,oBAAoB;CACZ,CAAC;AAIX,MAAM,UAAU,uCAAuC,CAAC,YAAoB;IAC1E,OAAO,8BAA8B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvD,EAAE,EAAE,cAAc,QAAQ,EAAE;QAC5B,UAAU,EAAE,MAAM;QAClB,YAAY;QACZ,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,MAAM;QACnB,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,eAAe,CACvB,wBAAwB,EACxB,0BAA0B,QAAQ,kCAAkC,CACrE,CAAC;QACJ,CAAC;KACF,CAAC,CAAC,CAAC;AACN,CAAC"}
|