@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.11

package/src/supply-chain/scanner.js

@@ -0,0 +1,511 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OSV_SCANNER_RELEASES = exports.OSV_SCANNER_TOOL = exports.OSV_SCANNER_VERSION = exports.SUPPLY_CHAIN_SCANNER_INPUT_SCHEMA_VERSION = void 0;
+exports.createSupplyChainScannerInput = createSupplyChainScannerInput;
+exports.assertSupplyChainScannerSubject = assertSupplyChainScannerSubject;
+exports.createInstalledLicenseFindings = createInstalledLicenseFindings;
+exports.normalizeOsvScannerResults = normalizeOsvScannerResults;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const validation_js_1 = require("../validation.js");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+const license_expression_js_1 = require("./license-expression.js");
+const policy_js_1 = require("./policy.js");
+exports.SUPPLY_CHAIN_SCANNER_INPUT_SCHEMA_VERSION = 2;
+exports.OSV_SCANNER_VERSION = '2.3.8';
+exports.OSV_SCANNER_TOOL = 'osv-scanner+ebk-vendored-admission';
+exports.OSV_SCANNER_RELEASES = {
+    'darwin-arm64': {
+        name: 'osv-scanner_darwin_arm64',
+        sha256: 'a8cd6507b06239f463a7642430cfd2d154882f150f6e30cdc0653e28dfc34216',
+    },
+    'darwin-x64': {
+        name: 'osv-scanner_darwin_amd64',
+        sha256: 'b8a80a9f14ca4c0cd0fc2d351b28f740da9e6a5b18385ac9f9d083360b5b504e',
+    },
+    'linux-arm64': {
+        name: 'osv-scanner_linux_arm64',
+        sha256: '8158b18edd2d03b1a30d905ca91b032bc62262167be8f206c27114f08823e27c',
+    },
+    'linux-x64': {
+        name: 'osv-scanner_linux_amd64',
+        sha256: 'bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc',
+    },
+    'win32-arm64': {
+        name: 'osv-scanner_windows_arm64.exe',
+        sha256: '285d1fbcf2c69ab5ee38ae3a850ab46e83f32ef1cd5f3c4c9eb161cc493f6d52',
+    },
+    'win32-x64': {
+        name: 'osv-scanner_windows_amd64.exe',
+        sha256: 'cb04e79dd9698a7bc821bbfdddec916a416d1409fda79c927c509d37d00c9716',
+    },
+};
+const EXACT_PACKAGE_VERSION = /^[A-Za-z0-9][A-Za-z0-9.+:~_-]{0,127}$/;
+const COVERAGE = ['container', 'npm', 'vendored-source'];
+function exactKeys(value, keys) {
+    return (JSON.stringify(Object.keys(value).sort()) ===
+        JSON.stringify([...keys].sort()));
+}
+function timestamp(value, path) {
+    if (!Number.isFinite(Date.parse(value)) ||
+        new Date(value).toISOString() !== value) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be a canonical ISO-8601 timestamp');
+    }
+}
+function safeResultPath(value, path) {
+    if (typeof value !== 'string' ||
+        !/^\.ebk\/evidence\/supply-chain\/[A-Za-z0-9._/-]+\.json$/.test(value) ||
+        value.split('/').some((segment) => segment === '' || segment === '..')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be a normalized scanner-evidence JSON path');
+    }
+}
+function createSupplyChainScannerInput(input) {
+    if (!(0, validation_js_1.isRecord)(input) ||
+        !exactKeys(input, [
+            'kind',
+            'licenses',
+            'requiredCoverage',
+            'scanner',
+            'schemaVersion',
+            'subject',
+            'vulnerabilities',
+        ]) ||
+        input.kind !== 'ebk-supply-chain-scanner-input' ||
+        input.schemaVersion !== exports.SUPPLY_CHAIN_SCANNER_INPUT_SCHEMA_VERSION ||
+        !Array.isArray(input.licenses) ||
+        !Array.isArray(input.vulnerabilities) ||
+        !Array.isArray(input.requiredCoverage) ||
+        input.requiredCoverage.length === 0 ||
+        input.requiredCoverage.some((entry) => !COVERAGE.includes(entry)) ||
+        new Set(input.requiredCoverage).size !== input.requiredCoverage.length ||
+        !(0, validation_js_1.isRecord)(input.scanner) ||
+        !exactKeys(input.scanner, [
+            'coverage',
+            'resultSetDigest',
+            'scannedAt',
+            'schemaVersion',
+            'status',
+            'tool',
+            'version',
+        ]) ||
+        !Array.isArray(input.scanner.coverage) ||
+        input.scanner.coverage.some((entry) => !COVERAGE.includes(String(entry))) ||
+        new Set(input.scanner.coverage).size !== input.scanner.coverage.length ||
+        !['complete', 'partial', 'unavailable'].includes(input.scanner.status) ||
+        input.scanner.schemaVersion !==
+            policy_js_1.SUPPLY_CHAIN_SCANNER_RESULT_SCHEMA_VERSION ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.scanner.resultSetDigest) ||
+        input.scanner.tool !== exports.OSV_SCANNER_TOOL ||
+        input.scanner.version !== exports.OSV_SCANNER_VERSION ||
+        !(0, validation_js_1.isRecord)(input.subject) ||
+        !exactKeys(input.subject, [
+            'containerInventoryDigest',
+            'lockfileDigest',
+            'repositoryCommit',
+            'resultDigests',
+            'vendoredRegistryDigest',
+        ]) ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.subject.containerInventoryDigest) ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.subject.lockfileDigest) ||
+        !/^[a-f0-9]{40}$/.test(input.subject.repositoryCommit) ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.subject.vendoredRegistryDigest) ||
+        !Array.isArray(input.subject.resultDigests) ||
+        input.subject.resultDigests.length !== input.requiredCoverage.length ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(input)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'scannerInput', 'must be the exact subject-bound normalized scanner envelope');
+    }
+    timestamp(input.scanner.scannedAt, 'scanner.scannedAt');
+    const resultCoverage = new Set();
+    for (const [index, result] of input.subject.resultDigests.entries()) {
+        if (!(0, validation_js_1.isRecord)(result)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `scannerInput.subject.resultDigests[${index}]`, 'must uniquely bind one required coverage result');
+        }
+        const coverage = result.coverage;
+        const path = result.path;
+        const sha256 = result.sha256;
+        if (!exactKeys(result, ['coverage', 'path', 'sha256']) ||
+            typeof coverage !== 'string' ||
+            !COVERAGE.includes(coverage) ||
+            typeof path !== 'string' ||
+            typeof sha256 !== 'string' ||
+            !common_js_1.SUPPLY_CHAIN_SHA256.test(sha256) ||
+            resultCoverage.has(coverage)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `scannerInput.subject.resultDigests[${index}]`, 'must uniquely bind one required coverage result');
+        }
+        safeResultPath(path, `scannerInput.subject.resultDigests[${index}].path`);
+        resultCoverage.add(coverage);
+    }
+    const required = [...input.requiredCoverage].sort();
+    if (JSON.stringify([...input.scanner.coverage].sort()) !==
+        JSON.stringify(required) ||
+        JSON.stringify([...resultCoverage].sort()) !== JSON.stringify(required) ||
+        input.scanner.status !== 'complete') {
+        throw new errors_js_1.SupplyChainError('supply-chain-scanner-unavailable', 'scannerInput.scanner.coverage', 'must completely cover the independently derived applicable ecosystems');
+    }
+    return {
+        ...input,
+        licenses: [...input.licenses].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.component.purl, right.component.purl)),
+        requiredCoverage: required,
+        scanner: {
+            ...input.scanner,
+            coverage: [...input.scanner.coverage].sort(),
+        },
+        subject: {
+            ...input.subject,
+            resultDigests: [...input.subject.resultDigests].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.coverage, right.coverage)),
+        },
+        vulnerabilities: [...input.vulnerabilities].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.id}\0${left.component.purl}\0${left.component.scope}`, `${right.id}\0${right.component.purl}\0${right.component.scope}`)),
+    };
+}
+function assertSupplyChainScannerSubject(scannerInput, expected) {
+    const normalized = createSupplyChainScannerInput(scannerInput);
+    const actualSubject = (0, common_js_1.canonicalizeSupplyChainValue)(normalized.subject);
+    const expectedSubject = (0, common_js_1.canonicalizeSupplyChainValue)({
+        containerInventoryDigest: expected.containerInventoryDigest,
+        lockfileDigest: expected.lockfileDigest,
+        repositoryCommit: expected.repositoryCommit,
+        resultDigests: [...expected.resultDigests].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.coverage, right.coverage)),
+        vendoredRegistryDigest: expected.vendoredRegistryDigest,
+    });
+    if ((0, common_js_1.canonicalizeSupplyChainValue)(normalized.requiredCoverage) !==
+        (0, common_js_1.canonicalizeSupplyChainValue)([...expected.requiredCoverage].sort()) ||
+        actualSubject !== expectedSubject) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'scannerInput.subject', 'does not bind the exact repository, lockfile, containers, vendored registry, and raw results');
+    }
+}
+function packageLicense(value) {
+    const candidates = Array.isArray(value)
+        ? value.flatMap((candidate) => typeof candidate === 'string'
+            ? [candidate]
+            : (0, validation_js_1.isRecord)(candidate) && typeof candidate.type === 'string'
+                ? [candidate.type]
+                : [])
+        : typeof value === 'string'
+            ? [value]
+            : (0, validation_js_1.isRecord)(value) && typeof value.type === 'string'
+                ? [value.type]
+                : [];
+    try {
+        return (0, license_expression_js_1.normalizeSpdxLicenseExpression)(candidates
+            .map((candidate) => candidate.trim())
+            .filter(Boolean)
+            .sort()
+            .map((candidate) => `(${candidate})`)
+            .join(' OR '));
+    }
+    catch {
+        return 'LicenseRef-Unknown';
+    }
+}
+function createInstalledLicenseFindings(input) {
+    const resolvedByLockKey = new Map(input.inventory.resolvedPackages.map((entry) => [entry.lockKey, entry]));
+    const resolvedByIdentity = new Map();
+    for (const entry of input.inventory.resolvedPackages) {
+        const key = `${entry.name}@${entry.version}`;
+        resolvedByIdentity.set(key, [
+            ...(resolvedByIdentity.get(key) ?? []),
+            entry,
+        ]);
+    }
+    const runtimePackages = new Set();
+    const visit = (lockKey) => {
+        if (runtimePackages.has(lockKey))
+            return;
+        const entry = resolvedByLockKey.get(lockKey);
+        if (!entry)
+            return;
+        runtimePackages.add(lockKey);
+        entry.dependencies.forEach(visit);
+    };
+    for (const dependency of input.inventory.dependencies) {
+        if (!['production', 'optional', 'peer'].includes(dependency.scope)) {
+            continue;
+        }
+        const exact = `${dependency.name}@${dependency.resolved}`;
+        if (resolvedByLockKey.has(exact)) {
+            visit(exact);
+            continue;
+        }
+        const candidates = resolvedByIdentity.get(`${dependency.name}@${dependency.resolved.split('(')[0] ?? ''}`) ?? [];
+        if (candidates.length === 1 && candidates[0])
+            visit(candidates[0].lockKey);
+    }
+    const installedLicenses = new Map();
+    for (const [index, metadata] of input.packageMetadata.entries()) {
+        if (!(0, validation_js_1.isRecord)(metadata) ||
+            typeof metadata.name !== 'string' ||
+            typeof metadata.version !== 'string' ||
+            !resolvedByIdentity.has(`${metadata.name}@${metadata.version}`)) {
+            continue;
+        }
+        const identity = `${metadata.name}@${metadata.version}`;
+        const license = packageLicense(metadata.license ?? metadata.licenses);
+        const existing = installedLicenses.get(identity);
+        if (existing && existing !== license) {
+            throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `packageMetadata[${index}].license`, `${identity} installed copies expose conflicting license metadata`);
+        }
+        installedLicenses.set(identity, license);
+    }
+    const findings = [];
+    for (const [identity, resolvedCopies] of [
+        ...resolvedByIdentity.entries(),
+    ].sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))) {
+        const representative = resolvedCopies[0];
+        if (!representative)
+            continue;
+        const installedLicense = installedLicenses.get(identity);
+        const applicablePlatforms = [
+            ...new Set(resolvedCopies.flatMap(({ applicablePlatforms }) => applicablePlatforms)),
+        ].sort();
+        findings.push({
+            applicablePlatforms,
+            component: {
+                name: representative.name,
+                purl: `pkg:npm/${encodeURIComponent(representative.name)}@${representative.version}`,
+                version: representative.version,
+            },
+            current: installedLicense ?? 'LicenseRef-Unknown',
+            source: installedLicense ? 'installed-package' : 'lockfile-only',
+            usage: resolvedCopies.some(({ lockKey }) => runtimePackages.has(lockKey))
+                ? 'internal-runtime'
+                : 'build',
+        });
+    }
+    return findings.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.component.purl, right.component.purl));
+}
+function severity(value) {
+    const candidate = (0, validation_js_1.isRecord)(value) && typeof value.severity === 'string'
+        ? value.severity.toLowerCase()
+        : '';
+    return ['critical', 'high', 'medium', 'low'].includes(candidate)
+        ? candidate
+        : 'unknown';
+}
+function packagePurl(ecosystem, name, version) {
+    const encodedName = encodeURIComponent(name);
+    const encodedVersion = encodeURIComponent(version);
+    switch (ecosystem.toLowerCase()) {
+        case 'npm':
+            return `pkg:npm/${encodedName}@${encodedVersion}`;
+        case 'alpine':
+            return `pkg:apk/alpine/${encodedName}@${encodedVersion}`;
+        case 'debian':
+            return `pkg:deb/debian/${encodedName}@${encodedVersion}`;
+        default:
+            return `pkg:generic/${encodedName}@${encodedVersion}`;
+    }
+}
+function fixedVersion(vulnerability) {
+    const versions = [];
+    for (const affected of Array.isArray(vulnerability.affected)
+        ? vulnerability.affected
+        : []) {
+        if (!(0, validation_js_1.isRecord)(affected))
+            continue;
+        for (const range of Array.isArray(affected.ranges) ? affected.ranges : []) {
+            if (!(0, validation_js_1.isRecord)(range))
+                continue;
+            for (const event of Array.isArray(range.events) ? range.events : []) {
+                if ((0, validation_js_1.isRecord)(event) &&
+                    typeof event.fixed === 'string' &&
+                    EXACT_PACKAGE_VERSION.test(event.fixed)) {
+                    versions.push(event.fixed);
+                }
+            }
+        }
+    }
+    return versions.sort()[0];
+}
+function directLockKey(inventory, name, resolved) {
+    const exact = `${name}@${resolved}`;
+    if (inventory.resolvedPackages.some(({ lockKey }) => lockKey === exact)) {
+        return exact;
+    }
+    const identity = `${name}@${resolved.split('(')[0] ?? ''}`;
+    const candidates = inventory.resolvedPackages.filter((entry) => `${entry.name}@${entry.version}` === identity);
+    return candidates.length === 1 ? candidates[0]?.lockKey : undefined;
+}
+function npmScopes(inventory) {
+    const byLockKey = new Map(inventory.resolvedPackages.map((entry) => [entry.lockKey, entry]));
+    const byIdentity = new Map();
+    for (const entry of inventory.resolvedPackages) {
+        const identity = `${entry.name}@${entry.version}`;
+        byIdentity.set(identity, [...(byIdentity.get(identity) ?? []), entry]);
+    }
+    const scopes = new Map();
+    const visited = new Set();
+    const visit = (lockKey, scope) => {
+        const visitKey = `${lockKey}\0${scope}`;
+        if (visited.has(visitKey))
+            return;
+        visited.add(visitKey);
+        const entry = byLockKey.get(lockKey);
+        if (!entry)
+            return;
+        const identity = `${entry.name}@${entry.version}`;
+        const assigned = scopes.get(identity) ?? new Set();
+        assigned.add(scope);
+        scopes.set(identity, assigned);
+        for (const dependency of entry.dependencies) {
+            if (byLockKey.has(dependency)) {
+                visit(dependency, scope);
+                continue;
+            }
+            const withoutPeers = dependency.replace(/\(.+$/, '');
+            const separator = withoutPeers.lastIndexOf('@');
+            const candidates = separator > 0
+                ? (byIdentity.get(`${withoutPeers.slice(0, separator)}@${withoutPeers.slice(separator + 1)}`) ?? [])
+                : [];
+            if (candidates.length === 1 && candidates[0]) {
+                visit(candidates[0].lockKey, scope);
+            }
+        }
+    };
+    for (const dependency of inventory.dependencies) {
+        const lockKey = directLockKey(inventory, dependency.name, dependency.resolved);
+        if (!lockKey)
+            continue;
+        visit(lockKey, dependency.scope === 'development' ? 'development' : 'runtime');
+    }
+    const normalized = new Map([...byIdentity.keys()].map((identity) => {
+        const assigned = scopes.get(identity);
+        return [
+            identity,
+            assigned?.has('runtime')
+                ? 'runtime'
+                : assigned?.has('development')
+                    ? 'development'
+                    : 'unknown',
+        ];
+    }));
+    const packageManager = /^pnpm@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\+sha512\.[a-f0-9]{128}$/.exec(inventory.packageManager);
+    if (!packageManager?.[1]) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'inventory.packageManager', 'must identify one exact integrity-qualified pnpm authority');
+    }
+    const packageManagerIdentity = `pnpm@${packageManager[1]}`;
+    if (normalized.get(packageManagerIdentity) !== 'runtime') {
+        normalized.set(packageManagerIdentity, 'development');
+    }
+    return normalized;
+}
+function findingIdentities(value, path) {
+    if (!Array.isArray(value) ||
+        value.length > 100 ||
+        value.some((entry) => typeof entry !== 'string' || !common_js_1.SUPPLY_CHAIN_REFERENCE.test(entry)) ||
+        new Set(value).size !== value.length) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must contain unique bounded Release or Slice identities');
+    }
+    return [...value].sort();
+}
+function normalizeOsvScannerResults(input) {
+    timestamp(input.detectedAt, 'detectedAt');
+    if (input.resultGroups.length === 0 ||
+        input.resultGroups.length > 100 ||
+        (input.coverage === 'npm' && input.inventory === undefined)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'osv.resultGroups', 'must include one to 100 contextual result groups and npm inventory');
+    }
+    const packageScopes = input.coverage === 'npm' && input.inventory
+        ? npmScopes(input.inventory)
+        : new Map();
+    const findings = new Map();
+    for (const [documentIndex, group] of input.resultGroups.entries()) {
+        if (!(0, validation_js_1.isRecord)(group) ||
+            !exactKeys(group, ['context', 'document']) ||
+            !(0, validation_js_1.isRecord)(group.context) ||
+            !exactKeys(group.context, ['releases', 'scope', 'slices']) ||
+            ![
+                'build',
+                'deployed',
+                'development',
+                'runtime',
+                'test',
+                'unknown',
+            ].includes(group.context.scope)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `osv.resultGroups[${documentIndex}].context`, 'must bind the exact scanner group to one applicability scope');
+        }
+        if (input.coverage === 'npm' && group.context.scope !== 'unknown') {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `osv.resultGroups[${documentIndex}].context.scope`, 'npm applicability must be derived from the exact lock inventory');
+        }
+        const releases = findingIdentities(group.context.releases, `osv.resultGroups[${documentIndex}].context.releases`);
+        const slices = findingIdentities(group.context.slices, `osv.resultGroups[${documentIndex}].context.slices`);
+        const document = group.document;
+        if (!(0, validation_js_1.isRecord)(document) || !Array.isArray(document.results)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `osv.documents[${documentIndex}]`, 'must be an OSV-Scanner JSON result document');
+        }
+        for (const result of document.results) {
+            if (!(0, validation_js_1.isRecord)(result) || !Array.isArray(result.packages))
+                continue;
+            for (const scannedPackage of result.packages) {
+                if (!(0, validation_js_1.isRecord)(scannedPackage) || !(0, validation_js_1.isRecord)(scannedPackage.package)) {
+                    continue;
+                }
+                const packageValue = scannedPackage.package;
+                const name = String(packageValue.name ?? '');
+                const version = String(packageValue.version ?? '');
+                const ecosystem = String(packageValue.ecosystem ?? '');
+                if (!common_js_1.SUPPLY_CHAIN_REFERENCE.test(name) ||
+                    !EXACT_PACKAGE_VERSION.test(version) ||
+                    ecosystem.trim() === '') {
+                    throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `osv.documents[${documentIndex}].package`, 'must identify an exact bounded package and ecosystem');
+                }
+                for (const vulnerability of Array.isArray(scannedPackage.vulnerabilities)
+                    ? scannedPackage.vulnerabilities
+                    : []) {
+                    if (!(0, validation_js_1.isRecord)(vulnerability) ||
+                        typeof vulnerability.id !== 'string' ||
+                        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(vulnerability.id)) {
+                        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `osv.documents[${documentIndex}].vulnerability`, 'must identify one exact OSV advisory');
+                    }
+                    const affectedInput = Array.isArray(vulnerability.affected)
+                        ? vulnerability.affected
+                        : [];
+                    if ((0, common_js_1.hasSensitiveSupplyChainShape)(affectedInput)) {
+                        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `osv.documents[${documentIndex}].vulnerability.affected`, 'must not retain credential-shaped advisory data');
+                    }
+                    const scope = input.coverage === 'npm'
+                        ? (packageScopes.get(`${name}@${version}`) ?? 'unknown')
+                        : group.context.scope;
+                    const purl = packagePurl(ecosystem, name, version);
+                    const key = `${vulnerability.id}\0${purl}\0${scope}`;
+                    const affected = (0, common_js_1.canonicalizeSupplyChainValue)(affectedInput).slice(0, 2_000);
+                    const fixed = fixedVersion(vulnerability);
+                    const next = {
+                        affectedRange: affected || '[]',
+                        component: {
+                            name,
+                            purl,
+                            scope,
+                            version,
+                        },
+                        detectedAt: input.detectedAt,
+                        exposure: 'unknown',
+                        ...(fixed ? { fixVersion: fixed } : {}),
+                        id: vulnerability.id,
+                        releases,
+                        severity: severity(vulnerability.database_specific),
+                        slices,
+                        source: `osv-scanner@${exports.OSV_SCANNER_VERSION}`,
+                        status: 'open',
+                    };
+                    const existing = findings.get(key);
+                    if (existing) {
+                        if (existing.affectedRange !== next.affectedRange ||
+                            existing.fixVersion !== next.fixVersion ||
+                            existing.severity !== next.severity) {
+                            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `osv.resultGroups[${documentIndex}].vulnerability`, 'contains contradictory advisory data for one exact component and scope');
+                        }
+                        next.releases = [
+                            ...new Set([...existing.releases, ...next.releases]),
+                        ].sort();
+                        next.slices = [
+                            ...new Set([...existing.slices, ...next.slices]),
+                        ].sort();
+                    }
+                    findings.set(key, next);
+                }
+            }
+        }
+    }
+    return [...findings.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.id}\0${left.component.purl}\0${left.component.scope}`, `${right.id}\0${right.component.purl}\0${right.component.scope}`));
+}
+//# sourceMappingURL=scanner.js.map

package/src/supply-chain/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/scanner.ts"],"names":[],"mappings":";;;AA8GA,sEAsIC;AAED,0EA6BC;AA8BD,wEAiGC;AAwLD,gEA8KC;AAxvBD,sEAAyD;AACzD,oDAA4C;AAC5C,2CAKqB;AACrB,2CAA+C;AAE/C,mEAAyE;AACzE,2CAMqB;AAER,QAAA,yCAAyC,GAAG,CAAU,CAAC;AACvD,QAAA,mBAAmB,GAAG,OAAgB,CAAC;AACvC,QAAA,gBAAgB,GAAG,oCAA6C,CAAC;AACjE,QAAA,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,kEAAkE;KAC3E;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,kEAAkE;KAC3E;IACD,aAAa,EAAE;QACb,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kEAAkE;KAC3E;IACD,WAAW,EAAE;QACX,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kEAAkE;KAC3E;IACD,aAAa,EAAE;QACb,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,kEAAkE;KAC3E;IACD,WAAW,EAAE;QACX,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,kEAAkE;KAC3E;CACO,CAAC;AA0BX,MAAM,qBAAqB,GAAG,uCAAuC,CAAC;AACtE,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,iBAAiB,CAAU,CAAC;AAElE,SAAS,SAAS,CAAC,KAAa,EAAE,IAAuB;IACvD,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,IAAY;IAC5C,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EACvC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,IAAI,EACJ,wCAAwC,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY;IACjD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;QACtE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,IAAI,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,IAAI,EACJ,iDAAiD,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,6BAA6B,CAC3C,KAA8B;IAE9B,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE;YAChB,MAAM;YACN,UAAU;YACV,kBAAkB;YAClB,SAAS;YACT,eAAe;YACf,SAAS;YACT,iBAAiB;SAClB,CAAC;QACF,KAAK,CAAC,IAAI,KAAK,gCAAgC;QAC/C,KAAK,CAAC,aAAa,KAAK,iDAAyC;QACjE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtC,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QACnC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAE,QAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC5D;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM;QACtE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC;QACxB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE;YACxB,UAAU;YACV,iBAAiB;YACjB,WAAW;YACX,eAAe;YACf,QAAQ;YACR,MAAM;YACN,SAAS;SACV,CAAC;QACF,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAE,QAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACpE;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM;QACtE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtE,KAAK,CAAC,OAAO,CAAC,aAAa;YACzB,sDAA0C;QAC5C,CAAC,+BAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QACxD,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,wBAAgB;QACvC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,2BAAmB;QAC7C,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC;QACxB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE;YACxB,0BAA0B;YAC1B,gBAAgB;YAChB,kBAAkB;YAClB,eAAe;YACf,wBAAwB;SACzB,CAAC;QACF,CAAC,+BAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC;QACjE,CAAC,+BAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QACvD,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACtD,CAAC,+BAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC;QAC/D,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM;QACpE,IAAA,wCAA4B,EAAC,KAAK,CAAC,EACnC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,cAAc,EACd,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAmB,CAAC;IAClD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,IAAI,CAAC,IAAA,wBAAQ,EAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,sCAAsC,KAAK,GAAG,EAC9C,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IACE,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,QAAQ,KAAK,QAAQ;YAC5B,CAAE,QAA8B,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnD,OAAO,IAAI,KAAK,QAAQ;YACxB,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,+BAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,cAAc,CAAC,GAAG,CAAC,QAA2B,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,sCAAsC,KAAK,GAAG,EAC9C,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,IAAI,EAAE,sCAAsC,KAAK,QAAQ,CAAC,CAAC;QAC1E,cAAc,CAAC,GAAG,CAAC,QAA2B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IACE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QACvE,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EACnC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,kCAAkC,EAClC,+BAA+B,EAC/B,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,KAAK;QACR,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjD,IAAA,qCAAY,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CACxD;QACD,gBAAgB,EAAE,QAAQ;QAC1B,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,OAAO;YAChB,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;SAC7C;QACD,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,OAAO;YAChB,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACnE,IAAA,qCAAY,EAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAC5C;SACF;QACD,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/D,IAAA,qCAAY,EACV,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAC7D,GAAG,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CACjE,CACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAC7C,YAAqC,EACrC,QAGC;IAED,MAAM,UAAU,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,IAAA,wCAA4B,EAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,IAAA,wCAA4B,EAAC;QACnD,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;QAC3D,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9D,IAAA,qCAAY,EAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAC5C;QACD,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;KACxD,CAAC,CAAC;IACH,IACE,IAAA,wCAA4B,EAAC,UAAU,CAAC,gBAAgB,CAAC;QACvD,IAAA,wCAA4B,EAAC,CAAC,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,aAAa,KAAK,eAAe,EACjC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,gCAAgC,EAChC,sBAAsB,EACtB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAC1B,OAAO,SAAS,KAAK,QAAQ;YAC3B,CAAC,CAAC,CAAC,SAAS,CAAC;YACb,CAAC,CAAC,IAAA,wBAAQ,EAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;gBACzD,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;gBAClB,CAAC,CAAC,EAAE,CACT;QACH,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBACjD,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,CAAC,CAAC,EAAE,CAAC;IACX,IAAI,CAAC;QACH,OAAO,IAAA,sDAA8B,EACnC,UAAU;aACP,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;aACpC,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,GAAG,CAAC;aACpC,IAAI,CAAC,MAAM,CAAC,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAG9C;IACC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CACxE,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAG/B,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC1B,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtC,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,OAAe,EAAQ,EAAE;QACtC,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO;QACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACtD,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1D,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GACd,kBAAkB,CAAC,GAAG,CACpB,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAChE,IAAI,EAAE,CAAC;QACV,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,IACE,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC;YACnB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;YACpC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,EAC/D,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,4BAAgB,CACxB,mCAAmC,EACnC,mBAAmB,KAAK,WAAW,EACnC,GAAG,QAAQ,uDAAuD,CACnE,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI;QACvC,GAAG,kBAAkB,CAAC,OAAO,EAAE;KAChC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,mBAAmB,GAAG;YAC1B,GAAG,IAAI,GAAG,CACR,cAAc,CAAC,OAAO,CACpB,CAAC,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAC,mBAAmB,CACjD,CACF;SACF,CAAC,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC,IAAI,CAAC;YACZ,mBAAmB;YACnB,SAAS,EAAE;gBACT,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,IAAI,EAAE,WAAW,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,IACtD,cAAc,CAAC,OACjB,EAAE;gBACF,OAAO,EAAE,cAAc,CAAC,OAAO;aAChC;YACD,OAAO,EAAE,gBAAgB,IAAI,oBAAoB;YACjD,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe;YAChE,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvE,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,OAAO;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACnC,IAAA,qCAAY,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,SAAS,GACb,IAAA,wBAAQ,EAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QACnD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE;QAC9B,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAE,SAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAe;IACnE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,KAAK;YACR,OAAO,WAAW,WAAW,IAAI,cAAc,EAAE,CAAC;QACpD,KAAK,QAAQ;YACX,OAAO,kBAAkB,WAAW,IAAI,cAAc,EAAE,CAAC;QAC3D,KAAK,QAAQ;YACX,OAAO,kBAAkB,WAAW,IAAI,cAAc,EAAE,CAAC;QAC3D;YACE,OAAO,eAAe,WAAW,IAAI,cAAc,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,aAAsC;IAC1D,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC1D,CAAC,CAAC,aAAa,CAAC,QAAQ;QACxB,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,IAAI,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1E,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;gBAAE,SAAS;YAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACpE,IACE,IAAA,wBAAQ,EAAC,KAAK,CAAC;oBACf,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;oBAC/B,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACvC,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAaD,SAAS,aAAa,CACpB,SAA+B,EAC/B,IAAY,EACZ,QAAgB;IAEhB,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;IACpC,IAAI,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3D,MAAM,UAAU,GAAG,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAClD,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,QAAQ,CACzD,CAAC;IACF,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAChB,SAA+B;IAE/B,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAClE,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6C,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,KAAyB,EAAQ,EAAE;QACjE,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAsB,CAAC;QACvE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,UAAU,GACd,SAAS,GAAG,CAAC;gBACX,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CACb,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,KAAK,CACvD,SAAS,GAAG,CAAC,CACd,EAAE,CACJ,IAAI,EAAE,CAAC;gBACV,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,aAAa,CAC3B,SAAS,EACT,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,QAAQ,CACpB,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,KAAK,CACH,OAAO,EACP,UAAU,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ;YACR,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC;gBACtB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC;oBAC5B,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,MAAM,cAAc,GAClB,mEAAmE,CAAC,IAAI,CACtE,SAAS,CAAC,cAAc,CACzB,CAAC;IACJ,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAAG,QAAQ,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;QACzD,UAAU,CAAC,GAAG,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAwB,EACxB,IAAY;IAEZ,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,IAAI,CACR,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kCAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CACnE;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EACpC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,IAAI,EACJ,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAgB,0BAA0B,CAAC,KAK1C;IACC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1C,IACE,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/B,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,GAAG;QAC/B,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GACjB,KAAK,CAAC,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,SAAS;QACzC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;QAC5B,CAAC,CAAC,IAAI,GAAG,EAA8B,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,KAAK,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QAClE,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;YAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC1C,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC;YACxB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC1D,CAAC;gBACC,OAAO;gBACP,UAAU;gBACV,aAAa;gBACb,SAAS;gBACT,MAAM;gBACN,SAAS;aACV,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,oBAAoB,aAAa,WAAW,EAC5C,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,oBAAoB,aAAa,iBAAiB,EAClD,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAChC,KAAK,CAAC,OAAO,CAAC,QAAQ,EACtB,oBAAoB,aAAa,oBAAoB,CACtD,CAAC;QACF,MAAM,MAAM,GAAG,iBAAiB,CAC9B,KAAK,CAAC,OAAO,CAAC,MAAM,EACpB,oBAAoB,aAAa,kBAAkB,CACpD,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,iBAAiB,aAAa,GAAG,EACjC,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,IAAA,wBAAQ,EAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACnE,KAAK,MAAM,cAAc,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAA,wBAAQ,EAAC,cAAc,CAAC,IAAI,CAAC,IAAA,wBAAQ,EAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnE,SAAS;gBACX,CAAC;gBACD,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;gBACnD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;gBACvD,IACE,CAAC,kCAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAClC,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;oBACpC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EACvB,CAAC;oBACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,iBAAiB,aAAa,WAAW,EACzC,sDAAsD,CACvD,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,OAAO,CACvC,cAAc,CAAC,eAAe,CAC/B;oBACC,CAAC,CAAC,cAAc,CAAC,eAAe;oBAChC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACP,IACE,CAAC,IAAA,wBAAQ,EAAC,aAAa,CAAC;wBACxB,OAAO,aAAa,CAAC,EAAE,KAAK,QAAQ;wBACpC,CAAC,kCAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAC9C,CAAC;wBACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,iBAAiB,aAAa,iBAAiB,EAC/C,sCAAsC,CACvC,CAAC;oBACJ,CAAC;oBACD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;wBACzD,CAAC,CAAC,aAAa,CAAC,QAAQ;wBACxB,CAAC,CAAC,EAAE,CAAC;oBACP,IAAI,IAAA,wCAA4B,EAAC,aAAa,CAAC,EAAE,CAAC;wBAChD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,iBAAiB,aAAa,0BAA0B,EACxD,iDAAiD,CAClD,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,GACT,KAAK,CAAC,QAAQ,KAAK,KAAK;wBACtB,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,SAAS,CAAC;wBACxD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;oBACnD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,KAAK,EAAE,CAAC;oBACrD,MAAM,QAAQ,GAAG,IAAA,wCAA4B,EAAC,aAAa,CAAC,CAAC,KAAK,CAChE,CAAC,EACD,KAAK,CACN,CAAC;oBACF,MAAM,KAAK,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;oBAC1C,MAAM,IAAI,GAAyB;wBACjC,aAAa,EAAE,QAAQ,IAAI,IAAI;wBAC/B,SAAS,EAAE;4BACT,IAAI;4BACJ,IAAI;4BACJ,KAAK;4BACL,OAAO;yBACR;wBACD,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,QAAQ,EAAE,SAAS;wBACnB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvC,EAAE,EAAE,aAAa,CAAC,EAAE;wBACpB,QAAQ;wBACR,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,iBAAiB,CAAC;wBACnD,MAAM;wBACN,MAAM,EAAE,eAAe,2BAAmB,EAAE;wBAC5C,MAAM,EAAE,MAAM;qBACf,CAAC;oBACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnC,IAAI,QAAQ,EAAE,CAAC;wBACb,IACE,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;4BAC7C,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;4BACvC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EACnC,CAAC;4BACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,oBAAoB,aAAa,iBAAiB,EAClD,wEAAwE,CACzE,CAAC;wBACJ,CAAC;wBACD,IAAI,CAAC,QAAQ,GAAG;4BACd,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;yBACrD,CAAC,IAAI,EAAE,CAAC;wBACT,IAAI,CAAC,MAAM,GAAG;4BACZ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;yBACjD,CAAC,IAAI,EAAE,CAAC;oBACX,CAAC;oBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjD,IAAA,qCAAY,EACV,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAC7D,GAAG,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CACjE,CACF,CAAC;AACJ,CAAC"}

package/src/supply-chain/vendored-source.d.ts

@@ -0,0 +1,95 @@
+export declare const VENDORED_SOURCE_SCHEMA_VERSION: 1;
+export interface VendoredSourceFile {
+    afterSha256: string;
+    beforeSha256?: string;
+    change: 'add' | 'delete' | 'update';
+    license: string;
+    ownership: 'adopter-owned' | 'managed' | 'seeded';
+    path: string;
+    sbomCoverage: 'resolved-package' | 'source-file';
+}
+export interface VendoredSourceAdmission {
+    assets: readonly {
+        license: string;
+        path: string;
+        sha256: string;
+        source: string;
+    }[];
+    dependencies: readonly {
+        name: string;
+        purpose: string;
+        specifier: string;
+    }[];
+    environment: readonly {
+        name: string;
+        purpose: string;
+        required: boolean;
+    }[];
+    filePlan: readonly VendoredSourceFile[];
+    identity: {
+        item: string;
+        publisher: string;
+        registry: string;
+        repository: string;
+        revision: string;
+    };
+    licenses: readonly {
+        identifier: string;
+        noticePath: string;
+    }[];
+    offlineBehavior: string;
+    removal: string;
+    retrieval: {
+        retrievedAt: string;
+        sha256: string;
+    };
+    revocation: {
+        status: 'active' | 'quarantined' | 'revoked';
+        upstreamIdentity: string;
+    };
+    rollback: string;
+    sbomCoverageStatement: string;
+    schemaVersion: typeof VENDORED_SOURCE_SCHEMA_VERSION;
+    scripts: readonly {
+        approved: true;
+        name: string;
+        owner: string;
+        rationale: string;
+        sha256: string;
+    }[];
+}
+export interface VendoredSourceUpdatePlan {
+    applies: false;
+    canApply: boolean;
+    changes: readonly {
+        from?: string;
+        kind: VendoredSourceFile['change'];
+        ownership: VendoredSourceFile['ownership'];
+        path: string;
+        to?: string;
+    }[];
+    conflicts: readonly {
+        actual: string | 'missing';
+        expected: string;
+        path: string;
+        reason: 'adopter-edited' | 'source-drift';
+    }[];
+    currentDigest: string;
+    proposedDigest: string;
+    schemaVersion: typeof VENDORED_SOURCE_SCHEMA_VERSION;
+}
+export interface VendoredSourceRegistry {
+    records: readonly VendoredSourceAdmission[];
+    schemaVersion: typeof VENDORED_SOURCE_SCHEMA_VERSION;
+}
+export declare function createVendoredSourceAdmission(input: VendoredSourceAdmission): VendoredSourceAdmission;
+export declare function vendoredSourceAdmissionDigest(admission: VendoredSourceAdmission): string;
+export declare function createVendoredSourceRegistry(input: VendoredSourceRegistry): VendoredSourceRegistry;
+export declare function requireActiveVendoredSourceRegistry(input: VendoredSourceRegistry): VendoredSourceRegistry;
+export declare function vendoredSourceRegistryDigest(input: VendoredSourceRegistry): string;
+export declare function planVendoredSourceUpdate(input: {
+    current: VendoredSourceAdmission;
+    currentFileHashes: Readonly<Record<string, string>>;
+    proposed: VendoredSourceAdmission;
+}): VendoredSourceUpdatePlan;
+export declare function requireConflictFreeVendoredUpdate(plan: VendoredSourceUpdatePlan): void;