@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/performance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/nx/src/performance/index.ts"],"names":[],"mappings":";;;AAAA,+DAAqC;AACrC,6DAAmC;AACnC,wDAA8B;AAC9B,2DAAiC;AACjC,qDAA2B;AAC3B,kEAAwC;AACxC,sDAA4B;AAC5B,wDAA8B;AAC9B,iEAAuC;AACvC,yDAA+B"}

package/src/performance/load-safety.d.ts

@@ -0,0 +1,84 @@
+import { type PerformanceStage, type PerformanceWorkloadKind } from './model.js';
+import type { PerformanceReleaseBindingV1 } from './evidence.js';
+export declare const PROTECTED_LOAD_PLAN_KIND: "ebk-protected-load-plan";
+export declare const PROTECTED_LOAD_AUTHORIZATION_KIND: "ebk-protected-load-authorization";
+export interface ProtectedLoadStopConditionV1 {
+    metric: 'downstream-saturation' | 'error-rate' | 'estimated-cost-usd' | 'latency-milliseconds';
+    threshold: number;
+}
+export interface ProtectedLoadPlanInputV1 {
+    cleanupRef: string;
+    createdAt: string;
+    dataIsolationRef: string;
+    estimatedMaximumCostUsd: number;
+    evidencePath: string;
+    expiresAt: string;
+    externalProvider: {
+        mode: 'not-involved' | 'sandbox';
+    } | {
+        mode: 'permissioned-real';
+        permissionEvidenceRef: string;
+    };
+    maximumConcurrency: number;
+    maximumRatePerSecond: number;
+    maximumRequests: number;
+    owner: string;
+    rampSeconds: number;
+    release: PerformanceReleaseBindingV1;
+    runId: string;
+    scenarioId: string;
+    sourceCommit: string;
+    stopConditions: readonly ProtectedLoadStopConditionV1[];
+    target: {
+        accountFingerprint: string;
+        endpoint: string;
+        region: string;
+        stage: PerformanceStage;
+    };
+    terminationRef: string;
+    durationSeconds: number;
+    workload: PerformanceWorkloadKind;
+}
+export interface ProtectedLoadPlanV1 extends ProtectedLoadPlanInputV1 {
+    kind: typeof PROTECTED_LOAD_PLAN_KIND;
+    materialDigest: string;
+    policyDigest: string;
+    schemaVersion: 1;
+    slice: string;
+}
+export interface ProtectedLoadApprovalV1 {
+    approvedAt: string;
+    approvedMaterialDigest: string;
+    approver: string;
+    environment: PerformanceStage;
+    expiresAt: string;
+    kind: typeof PROTECTED_LOAD_AUTHORIZATION_KIND;
+    oidc: true;
+    productionException?: {
+        evidenceRef: string;
+        humanApproved: true;
+        reason: string;
+    };
+    schemaVersion: 1;
+    sourceCommit: string;
+    workflow: string;
+}
+export interface ProtectedLoadAuthorizationResultV1 {
+    allowed: true;
+    approvedAt: string;
+    materialDigest: string;
+    runId: string;
+    sourceCommit: string;
+    target: ProtectedLoadPlanV1['target'];
+}
+export declare function createProtectedLoadPlan(policyValue: unknown, input: ProtectedLoadPlanInputV1): ProtectedLoadPlanV1;
+export declare function validateProtectedLoadAuthorization(input: {
+    approval: ProtectedLoadApprovalV1;
+    currentSourceCommit: string;
+    expectedAccountFingerprint: string;
+    expectedEndpoint: string;
+    expectedRegion: string;
+    now: string;
+    plan: ProtectedLoadPlanV1;
+    policy: unknown;
+}): ProtectedLoadAuthorizationResultV1;

package/src/performance/load-safety.js

@@ -0,0 +1,346 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTECTED_LOAD_AUTHORIZATION_KIND = exports.PROTECTED_LOAD_PLAN_KIND = void 0;
+exports.createProtectedLoadPlan = createProtectedLoadPlan;
+exports.validateProtectedLoadAuthorization = validateProtectedLoadAuthorization;
+const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
+const model_js_1 = require("./model.js");
+exports.PROTECTED_LOAD_PLAN_KIND = 'ebk-protected-load-plan';
+exports.PROTECTED_LOAD_AUTHORIZATION_KIND = 'ebk-protected-load-authorization';
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const ACCOUNT_FINGERPRINT = /^sha256:[a-f0-9]{64}$/;
+const AWS_REGION = /^(?:(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-(?:gov|iso|isob|isoe|isof))?|eusc-[a-z]{2})-[a-z]+-\d$/;
+const MAXIMUM_AUTHORIZATION_WINDOW_MILLISECONDS = 24 * 60 * 60 * 1_000;
+const PLACEHOLDER_OWNER = /(?:^|[._-])(?:example|placeholder|replace(?:[._-]?with)?|tbd|todo|unknown|unassigned)(?:$|[._-])/i;
+const SENSITIVE_KEY = /(?:secret|password|token|credential|private[-_]?key|customer|tenant|user)/i;
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function onlyKeys(value, keys, pointer) {
+    if (!record(value)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', pointer, 'must be an object');
+    }
+    for (const key of Object.keys(value)) {
+        if (!keys.includes(key)) {
+            throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', `${pointer}/${key}`, SENSITIVE_KEY.test(key)
+                ? 'sensitive or high-cardinality fields are forbidden'
+                : 'is not part of the v1 protected-load contract');
+        }
+    }
+}
+function reference(value, pointer) {
+    const normalized = typeof value === 'string' ? value.trim() : '';
+    if (!(0, safe_reference_1.isBoundedSafeReference)(normalized, 'performance-evidence')) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', pointer, 'must be a bounded opaque reference');
+    }
+    return normalized;
+}
+function positive(value, pointer, integer = false) {
+    if (typeof value !== 'number' ||
+        !Number.isFinite(value) ||
+        value <= 0 ||
+        (integer && !Number.isSafeInteger(value))) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', pointer, integer
+            ? 'must be a positive safe integer'
+            : 'must be a finite number greater than zero');
+    }
+    return value;
+}
+function validateRelease(release, sourceCommit) {
+    if (!/^[a-f0-9]{64}$/.test(release.candidateDigest) ||
+        !/^[a-f0-9]{64}$/.test(release.releaseMaterialDigest) ||
+        !(0, safe_reference_1.isBoundedSafeReference)(release.releaseId, 'performance-evidence') ||
+        release.sourceCommit !== sourceCommit) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/release', 'must bind the exact candidate, release material, and source commit');
+    }
+    (0, model_js_1.assertFullCommit)(release.sourceCommit, 'plan/release/sourceCommit');
+}
+function validateEndpoint(value) {
+    let endpoint;
+    try {
+        endpoint = new URL(value);
+    }
+    catch {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/target/endpoint', 'must be an exact HTTPS URL');
+    }
+    if (endpoint.protocol !== 'https:' ||
+        endpoint.username ||
+        endpoint.password ||
+        endpoint.hash ||
+        endpoint.search ||
+        endpoint.hostname === 'localhost' ||
+        endpoint.hostname.endsWith('.localhost') ||
+        endpoint.hostname === '127.0.0.1' ||
+        endpoint.hostname === '::1') {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/target/endpoint', 'must be an exact remote HTTPS URL without credentials or fragments');
+    }
+    return endpoint.href;
+}
+function unsignedPlan(policy, input) {
+    return {
+        cleanupRef: input.cleanupRef,
+        createdAt: input.createdAt,
+        dataIsolationRef: input.dataIsolationRef,
+        durationSeconds: input.durationSeconds,
+        estimatedMaximumCostUsd: input.estimatedMaximumCostUsd,
+        evidencePath: input.evidencePath,
+        expiresAt: input.expiresAt,
+        externalProvider: input.externalProvider,
+        kind: exports.PROTECTED_LOAD_PLAN_KIND,
+        maximumConcurrency: input.maximumConcurrency,
+        maximumRatePerSecond: input.maximumRatePerSecond,
+        maximumRequests: input.maximumRequests,
+        owner: input.owner,
+        policyDigest: (0, model_js_1.performanceDigest)(policy),
+        rampSeconds: input.rampSeconds,
+        release: input.release,
+        runId: input.runId,
+        scenarioId: input.scenarioId,
+        schemaVersion: 1,
+        slice: policy.slice,
+        sourceCommit: input.sourceCommit,
+        stopConditions: input.stopConditions,
+        target: input.target,
+        terminationRef: input.terminationRef,
+        workload: input.workload,
+    };
+}
+function createProtectedLoadPlan(policyValue, input) {
+    const policy = (0, model_js_1.validatePerformancePolicy)(policyValue);
+    onlyKeys(input, [
+        'cleanupRef',
+        'createdAt',
+        'dataIsolationRef',
+        'durationSeconds',
+        'estimatedMaximumCostUsd',
+        'evidencePath',
+        'expiresAt',
+        'externalProvider',
+        'kind',
+        'materialDigest',
+        'maximumConcurrency',
+        'maximumRatePerSecond',
+        'maximumRequests',
+        'owner',
+        'policyDigest',
+        'rampSeconds',
+        'release',
+        'runId',
+        'scenarioId',
+        'schemaVersion',
+        'slice',
+        'sourceCommit',
+        'stopConditions',
+        'target',
+        'terminationRef',
+        'workload',
+    ], 'plan');
+    onlyKeys(input.release, ['candidateDigest', 'releaseId', 'releaseMaterialDigest', 'sourceCommit'], 'plan/release');
+    onlyKeys(input.target, ['accountFingerprint', 'endpoint', 'region', 'stage'], 'plan/target');
+    onlyKeys(input.externalProvider, ['mode', 'permissionEvidenceRef'], 'plan/externalProvider');
+    if (!Array.isArray(input.stopConditions)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/stopConditions', 'must be an array');
+    }
+    input.stopConditions.forEach((condition, index) => {
+        onlyKeys(condition, ['metric', 'threshold'], `plan/stopConditions/${index}`);
+    });
+    (0, model_js_1.assertFullCommit)(input.sourceCommit, 'plan/sourceCommit');
+    validateRelease(input.release, input.sourceCommit);
+    if (!(0, model_js_1.isIsoInstant)(input.createdAt) ||
+        !(0, model_js_1.isIsoInstant)(input.expiresAt) ||
+        Date.parse(input.expiresAt) <= Date.parse(input.createdAt) ||
+        Date.parse(input.expiresAt) - Date.parse(input.createdAt) >
+            MAXIMUM_AUTHORIZATION_WINDOW_MILLISECONDS) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/expiry', 'createdAt and expiresAt must define a positive ISO time window no longer than 24 hours');
+    }
+    if (policy.cost.status !== 'declared') {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'policy/cost/status', 'must be declared before a protected load plan can be created');
+    }
+    if (PLACEHOLDER_OWNER.test(policy.owner)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'policy/owner', 'must be a deliberately adopted non-placeholder owner');
+    }
+    if (policy.reviewAt === null ||
+        Date.parse(policy.reviewAt) <= Date.parse(input.createdAt)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'policy/reviewAt', 'must be current at protected load plan creation');
+    }
+    if (!RUN_ID.test(input.runId)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/runId', 'must be a bounded opaque run identifier');
+    }
+    reference(input.owner, 'plan/owner');
+    reference(input.scenarioId, 'plan/scenarioId');
+    reference(input.cleanupRef, 'plan/cleanupRef');
+    reference(input.dataIsolationRef, 'plan/dataIsolationRef');
+    reference(input.evidencePath, 'plan/evidencePath');
+    reference(input.terminationRef, 'plan/terminationRef');
+    if (!ACCOUNT_FINGERPRINT.test(input.target.accountFingerprint)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/target/accountFingerprint', 'must be sha256: followed by exactly 64 lowercase hexadecimal characters');
+    }
+    if (!AWS_REGION.test(input.target.region)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/target/region', 'must be an exact AWS Region');
+    }
+    if (validateEndpoint(input.target.endpoint) !== input.target.endpoint) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/target/endpoint', 'must use the canonical exact HTTPS URL');
+    }
+    if (input.target.stage !== 'staging' && input.target.stage !== 'production') {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/target/stage', 'must equal staging or production');
+    }
+    if (!model_js_1.PERFORMANCE_WORKLOAD_KINDS.includes(input.workload)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/workload', 'must be a supported workload kind');
+    }
+    positive(input.maximumConcurrency, 'plan/maximumConcurrency', true);
+    positive(input.maximumRatePerSecond, 'plan/maximumRatePerSecond');
+    positive(input.maximumRequests, 'plan/maximumRequests', true);
+    positive(input.durationSeconds, 'plan/durationSeconds', true);
+    positive(input.rampSeconds, 'plan/rampSeconds', true);
+    positive(input.estimatedMaximumCostUsd, 'plan/estimatedMaximumCostUsd');
+    if (input.rampSeconds > input.durationSeconds) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/rampSeconds', 'must not exceed durationSeconds');
+    }
+    for (const [field, value, maximum] of [
+        [
+            'maximumConcurrency',
+            input.maximumConcurrency,
+            policy.load.maximumConcurrency,
+        ],
+        [
+            'maximumRatePerSecond',
+            input.maximumRatePerSecond,
+            policy.load.maximumRatePerSecond,
+        ],
+        ['maximumRequests', input.maximumRequests, policy.load.maximumRequests],
+        [
+            'durationSeconds',
+            input.durationSeconds,
+            policy.load.maximumDurationSeconds,
+        ],
+        [
+            'estimatedMaximumCostUsd',
+            input.estimatedMaximumCostUsd,
+            Math.min(policy.load.maximumEstimatedCostUsd, policy.cost.testRunMaximumUsd),
+        ],
+    ]) {
+        if (value > maximum) {
+            throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', `plan/${field}`, `exceeds the adopter-owned protected maximum ${maximum}`);
+        }
+    }
+    if (input.maximumRatePerSecond * input.durationSeconds <
+        input.maximumRequests) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/maximumRequests', 'must not exceed the rate and duration envelope');
+    }
+    const stopMetrics = new Set(input.stopConditions.map(({ metric }) => metric));
+    for (const required of [
+        'downstream-saturation',
+        'error-rate',
+        'estimated-cost-usd',
+        'latency-milliseconds',
+    ]) {
+        if (!stopMetrics.has(required)) {
+            throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/stopConditions', `must include ${required}`);
+        }
+    }
+    if (input.stopConditions.length !== 4 ||
+        input.stopConditions.length !== stopMetrics.size ||
+        input.stopConditions.some(({ metric }) => ![
+            'downstream-saturation',
+            'error-rate',
+            'estimated-cost-usd',
+            'latency-milliseconds',
+        ].includes(metric)) ||
+        input.stopConditions.some(({ threshold }) => typeof threshold !== 'number' ||
+            !Number.isFinite(threshold) ||
+            threshold <= 0)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/stopConditions', 'must contain unique metrics with positive finite thresholds');
+    }
+    const costStop = input.stopConditions.find(({ metric }) => metric === 'estimated-cost-usd');
+    const errorRateStop = input.stopConditions.find(({ metric }) => metric === 'error-rate');
+    const downstreamSaturationStop = input.stopConditions.find(({ metric }) => metric === 'downstream-saturation');
+    if (!errorRateStop || errorRateStop.threshold > 1) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/stopConditions/error-rate', 'must be greater than zero and no greater than 1');
+    }
+    if (!downstreamSaturationStop || downstreamSaturationStop.threshold > 100) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/stopConditions/downstream-saturation', 'must be greater than zero and no greater than 100');
+    }
+    if (!costStop || costStop.threshold > input.estimatedMaximumCostUsd) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/stopConditions/estimated-cost-usd', 'must stop no later than the plan cost ceiling');
+    }
+    if (input.externalProvider.mode === 'permissioned-real' &&
+        !(0, safe_reference_1.isBoundedSafeReference)(input.externalProvider.permissionEvidenceRef, 'performance-evidence')) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/externalProvider/permissionEvidenceRef', 'is required for a real external provider');
+    }
+    if (!['not-involved', 'permissioned-real', 'sandbox'].includes(input.externalProvider.mode) ||
+        (input.externalProvider.mode !== 'permissioned-real' &&
+            'permissionEvidenceRef' in input.externalProvider)) {
+        throw new model_js_1.PerformanceContractError('performance-load-plan-invalid', 'plan/externalProvider', 'must be not-involved, sandbox, or permissioned-real with exact evidence');
+    }
+    const unsigned = unsignedPlan(policy, input);
+    return { ...unsigned, materialDigest: (0, model_js_1.performanceDigest)(unsigned) };
+}
+function validateProtectedLoadAuthorization(input) {
+    const policy = (0, model_js_1.validatePerformancePolicy)(input.policy);
+    const recomputed = createProtectedLoadPlan(policy, input.plan);
+    if (recomputed.materialDigest !== input.plan.materialDigest ||
+        input.plan.policyDigest !== (0, model_js_1.performanceDigest)(policy)) {
+        throw new model_js_1.PerformanceContractError('performance-load-authorization-invalid', 'plan/materialDigest', 'plan or policy material changed after review');
+    }
+    const approval = input.approval;
+    onlyKeys(approval, [
+        'approvedAt',
+        'approvedMaterialDigest',
+        'approver',
+        'environment',
+        'expiresAt',
+        'kind',
+        'oidc',
+        'productionException',
+        'schemaVersion',
+        'sourceCommit',
+        'workflow',
+    ], 'approval');
+    if (approval.productionException !== undefined) {
+        onlyKeys(approval.productionException, ['evidenceRef', 'humanApproved', 'reason'], 'approval/productionException');
+    }
+    if (approval.kind !== exports.PROTECTED_LOAD_AUTHORIZATION_KIND ||
+        approval.schemaVersion !== 1 ||
+        approval.oidc !== true ||
+        !(0, model_js_1.isIsoInstant)(approval.approvedAt) ||
+        !(0, model_js_1.isIsoInstant)(approval.expiresAt) ||
+        !(0, model_js_1.isIsoInstant)(input.now) ||
+        Date.parse(approval.approvedAt) > Date.parse(input.now) ||
+        Date.parse(approval.expiresAt) <= Date.parse(input.now) ||
+        Date.parse(input.plan.expiresAt) <= Date.parse(input.now) ||
+        approval.approvedMaterialDigest !== input.plan.materialDigest ||
+        approval.sourceCommit !== input.plan.sourceCommit ||
+        input.currentSourceCommit !== input.plan.sourceCommit ||
+        approval.environment !== input.plan.target.stage ||
+        approval.workflow !== '.github/workflows/performance-load.yml' ||
+        !(0, safe_reference_1.isBoundedSafeReference)(approval.approver, 'performance-evidence')) {
+        throw new model_js_1.PerformanceContractError('performance-load-authorization-invalid', 'approval', 'must be current OIDC approval for the exact plan, source, and stage');
+    }
+    (0, model_js_1.assertFullCommit)(input.currentSourceCommit, 'currentSourceCommit');
+    if (input.plan.target.accountFingerprint !== input.expectedAccountFingerprint ||
+        input.plan.target.region !== input.expectedRegion ||
+        input.plan.target.endpoint !== input.expectedEndpoint) {
+        throw new model_js_1.PerformanceContractError('performance-load-authorization-invalid', 'plan/target', 'runtime account, Region, and endpoint must exactly match the reviewed target');
+    }
+    if (input.plan.target.stage === 'production') {
+        const exception = approval.productionException;
+        if (policy.load.productionExceptionalOnly !== true ||
+            exception?.humanApproved !== true ||
+            !exception.reason?.trim() ||
+            !(0, safe_reference_1.isBoundedSafeReference)(exception.evidenceRef, 'performance-evidence')) {
+            throw new model_js_1.PerformanceContractError('performance-load-production-refused', 'approval/productionException', 'production load requires explicit human-reviewed exceptional evidence');
+        }
+    }
+    else if (!policy.load.allowedProtectedStages.includes(input.plan.target.stage)) {
+        throw new model_js_1.PerformanceContractError('performance-load-authorization-invalid', 'plan/target/stage', 'stage is not permitted by the adopter-owned protected-load policy');
+    }
+    return {
+        allowed: true,
+        approvedAt: approval.approvedAt,
+        materialDigest: input.plan.materialDigest,
+        runId: input.plan.runId,
+        sourceCommit: input.plan.sourceCommit,
+        target: input.plan.target,
+    };
+}
+//# sourceMappingURL=load-safety.js.map

package/src/performance/load-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-safety.js","sourceRoot":"","sources":["../../../../../packages/nx/src/performance/load-safety.ts"],"names":[],"mappings":";;;AAqPA,0DAoTC;AAED,gFAiHC;AA5pBD,+EAAoF;AACpF,yCAUoB;AAGP,QAAA,wBAAwB,GAAG,yBAAkC,CAAC;AAC9D,QAAA,iCAAiC,GAC5C,kCAA2C,CAAC;AA6E9C,MAAM,MAAM,GAAG,oCAAoC,CAAC;AACpD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AACpD,MAAM,UAAU,GACd,iGAAiG,CAAC;AACpG,MAAM,yCAAyC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACvE,MAAM,iBAAiB,GACrB,mGAAmG,CAAC;AACtG,MAAM,aAAa,GACjB,4EAA4E,CAAC;AAE/E,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CACf,KAAc,EACd,IAAuB,EACvB,OAAe;IAEf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,OAAO,EACP,mBAAmB,CACpB,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,GAAG,OAAO,IAAI,GAAG,EAAE,EACnB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrB,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,+CAA+C,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,OAAe;IAC/C,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,CAAC,IAAA,uCAAsB,EAAC,UAAU,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,OAAO,EACP,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAe,EAAE,OAAO,GAAG,KAAK;IAC/D,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvB,KAAK,IAAI,CAAC;QACV,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,OAAO,EACP,OAAO;YACL,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,2CAA2C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CACtB,OAAoC,EACpC,YAAoB;IAEpB,IACE,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QAC/C,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACrD,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,CAAC;QAClE,OAAO,CAAC,YAAY,KAAK,YAAY,EACrC,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,cAAc,EACd,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAA,2BAAgB,EAAC,OAAO,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,sBAAsB,EACtB,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAC9B,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,QAAQ,KAAK,WAAW;QACjC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACxC,QAAQ,CAAC,QAAQ,KAAK,WAAW;QACjC,QAAQ,CAAC,QAAQ,KAAK,KAAK,EAC3B,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,sBAAsB,EACtB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CACnB,MAA2B,EAC3B,KAA+B;IAE/B,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,IAAI,EAAE,gCAAwB;QAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,IAAA,4BAAiB,EAAC,MAAM,CAAC;QACvC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,CAAU;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CACrC,WAAoB,EACpB,KAA+B;IAE/B,MAAM,MAAM,GAAG,IAAA,oCAAyB,EAAC,WAAW,CAAC,CAAC;IACtD,QAAQ,CACN,KAAK,EACL;QACE,YAAY;QACZ,WAAW;QACX,kBAAkB;QAClB,iBAAiB;QACjB,yBAAyB;QACzB,cAAc;QACd,WAAW;QACX,kBAAkB;QAClB,MAAM;QACN,gBAAgB;QAChB,oBAAoB;QACpB,sBAAsB;QACtB,iBAAiB;QACjB,OAAO;QACP,cAAc;QACd,aAAa;QACb,SAAS;QACT,OAAO;QACP,YAAY;QACZ,eAAe;QACf,OAAO;QACP,cAAc;QACd,gBAAgB;QAChB,QAAQ;QACR,gBAAgB;QAChB,UAAU;KACX,EACD,MAAM,CACP,CAAC;IACF,QAAQ,CACN,KAAK,CAAC,OAAO,EACb,CAAC,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,EAAE,cAAc,CAAC,EACzE,cAAc,CACf,CAAC;IACF,QAAQ,CACN,KAAK,CAAC,MAAM,EACZ,CAAC,oBAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,EACrD,aAAa,CACd,CAAC;IACF,QAAQ,CACN,KAAK,CAAC,gBAAgB,EACtB,CAAC,MAAM,EAAE,uBAAuB,CAAC,EACjC,uBAAuB,CACxB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QAChD,QAAQ,CACN,SAAS,EACT,CAAC,QAAQ,EAAE,WAAW,CAAC,EACvB,uBAAuB,KAAK,EAAE,CAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAA,2BAAgB,EAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IAC1D,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACnD,IACE,CAAC,IAAA,uBAAY,EAAC,KAAK,CAAC,SAAS,CAAC;QAC9B,CAAC,IAAA,uBAAY,EAAC,KAAK,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YACvD,yCAAyC,EAC3C,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,aAAa,EACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,oBAAoB,EACpB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,cAAc,EACd,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,IAAI;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,YAAY,EACZ,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACrC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC/C,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC/C,SAAS,CAAC,KAAK,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;IAC3D,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IACnD,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;IACvD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,gCAAgC,EAChC,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,sBAAsB,EACtB,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC5E,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,mBAAmB,EACnB,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,qCAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,eAAe,EACf,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,KAAK,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;IAClE,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,uBAAuB,EAAE,8BAA8B,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,kBAAkB,EAClB,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI;QACpC;YACE,oBAAoB;YACpB,KAAK,CAAC,kBAAkB;YACxB,MAAM,CAAC,IAAI,CAAC,kBAAkB;SAC/B;QACD;YACE,sBAAsB;YACtB,KAAK,CAAC,oBAAoB;YAC1B,MAAM,CAAC,IAAI,CAAC,oBAAoB;SACjC;QACD,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;QACvE;YACE,iBAAiB;YACjB,KAAK,CAAC,eAAe;YACrB,MAAM,CAAC,IAAI,CAAC,sBAAsB;SACnC;QACD;YACE,yBAAyB;YACzB,KAAK,CAAC,uBAAuB;YAC7B,IAAI,CAAC,GAAG,CACN,MAAM,CAAC,IAAI,CAAC,uBAAuB,EACnC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAC9B;SACF;KACO,EAAE,CAAC;QACX,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,QAAQ,KAAK,EAAE,EACf,+CAA+C,OAAO,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IACE,KAAK,CAAC,oBAAoB,GAAG,KAAK,CAAC,eAAe;QAClD,KAAK,CAAC,eAAe,EACrB,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,sBAAsB,EACtB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,KAAK,MAAM,QAAQ,IAAI;QACrB,uBAAuB;QACvB,YAAY;QACZ,oBAAoB;QACpB,sBAAsB;KACvB,EAAE,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAkD,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,qBAAqB,EACrB,gBAAgB,QAAQ,EAAE,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IACE,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACjC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI;QAChD,KAAK,CAAC,cAAc,CAAC,IAAI,CACvB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACb,CAAC;YACC,uBAAuB;YACvB,YAAY;YACZ,oBAAoB;YACpB,sBAAsB;SACvB,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrB;QACD,KAAK,CAAC,cAAc,CAAC,IAAI,CACvB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAChB,OAAO,SAAS,KAAK,QAAQ;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3B,SAAS,IAAI,CAAC,CACjB,EACD,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,qBAAqB,EACrB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CACxC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,oBAAoB,CAChD,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CAC7C,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,YAAY,CACxC,CAAC;IACF,MAAM,wBAAwB,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CACxD,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,uBAAuB,CACnD,CAAC;IACF,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,gCAAgC,EAChC,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,wBAAwB,IAAI,wBAAwB,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QAC1E,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,2CAA2C,EAC3C,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,uBAAuB,EAAE,CAAC;QACpE,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,wCAAwC,EACxC,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,mBAAmB;QACnD,CAAC,IAAA,uCAAsB,EACrB,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,EAC5C,sBAAsB,CACvB,EACD,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,6CAA6C,EAC7C,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,cAAc,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC,QAAQ,CACxD,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAC5B;QACD,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,mBAAmB;YAClD,uBAAuB,IAAI,KAAK,CAAC,gBAAgB,CAAC,EACpD,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,+BAA+B,EAC/B,uBAAuB,EACvB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,IAAA,4BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAgB,kCAAkC,CAAC,KASlD;IACC,MAAM,MAAM,GAAG,IAAA,oCAAyB,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,IACE,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc;QACvD,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,IAAA,4BAAiB,EAAC,MAAM,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,wCAAwC,EACxC,qBAAqB,EACrB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,QAAQ,CACN,QAAQ,EACR;QACE,YAAY;QACZ,wBAAwB;QACxB,UAAU;QACV,aAAa;QACb,WAAW;QACX,MAAM;QACN,MAAM;QACN,qBAAqB;QACrB,eAAe;QACf,cAAc;QACd,UAAU;KACX,EACD,UAAU,CACX,CAAC;IACF,IAAI,QAAQ,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC/C,QAAQ,CACN,QAAQ,CAAC,mBAAmB,EAC5B,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,CAAC,EAC1C,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,IAAI,KAAK,yCAAiC;QACnD,QAAQ,CAAC,aAAa,KAAK,CAAC;QAC5B,QAAQ,CAAC,IAAI,KAAK,IAAI;QACtB,CAAC,IAAA,uBAAY,EAAC,QAAQ,CAAC,UAAU,CAAC;QAClC,CAAC,IAAA,uBAAY,EAAC,QAAQ,CAAC,SAAS,CAAC;QACjC,CAAC,IAAA,uBAAY,EAAC,KAAK,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;QACzD,QAAQ,CAAC,sBAAsB,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc;QAC7D,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY;QACjD,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY;QACrD,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;QAChD,QAAQ,CAAC,QAAQ,KAAK,wCAAwC;QAC9D,CAAC,IAAA,uCAAsB,EAAC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAClE,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,wCAAwC,EACxC,UAAU,EACV,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAA,2BAAgB,EAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IACnE,IACE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,KAAK,KAAK,CAAC,0BAA0B;QACzE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;QACjD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,gBAAgB,EACrD,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,wCAAwC,EACxC,aAAa,EACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QAC/C,IACE,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,IAAI;YAC9C,SAAS,EAAE,aAAa,KAAK,IAAI;YACjC,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;YACzB,CAAC,IAAA,uCAAsB,EAAC,SAAS,CAAC,WAAW,EAAE,sBAAsB,CAAC,EACtE,CAAC;YACD,MAAM,IAAI,mCAAwB,CAChC,qCAAqC,EACrC,8BAA8B,EAC9B,uEAAuE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IACL,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,mCAAwB,CAChC,wCAAwC,EACxC,mBAAmB,EACnB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;QACzC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;QACvB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;QACrC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;KAC1B,CAAC;AACJ,CAAC"}

package/src/performance/model.d.ts

@@ -0,0 +1,129 @@
+export declare const PERFORMANCE_POLICY_SCHEMA_VERSION: 1;
+export declare const PERFORMANCE_POLICY_KIND: "ebk-performance-policy";
+export declare const PERFORMANCE_EVIDENCE_PROVENANCE: readonly ["estimate", "test", "actual"];
+export declare const PERFORMANCE_POPULATIONS: readonly ["all", "cache-hit", "cache-miss", "cold", "warm"];
+export declare const PERFORMANCE_WORKLOAD_KINDS: readonly ["api-lambda", "async-worker", "browser", "database", "job", "service"];
+export declare const PERFORMANCE_REQUIRED_TAG_KEYS: readonly ["ebk:cost-allocation", "ebk:cost-scope", "ebk:framework-version", "ebk:managed-by", "ebk:owner", "ebk:production-profile", "ebk:repository", "ebk:slice", "ebk:stage", "ebk:workspace"];
+export type PerformanceEvidenceProvenance = (typeof PERFORMANCE_EVIDENCE_PROVENANCE)[number];
+export type PerformancePopulation = (typeof PERFORMANCE_POPULATIONS)[number];
+export type PerformanceWorkloadKind = (typeof PERFORMANCE_WORKLOAD_KINDS)[number];
+export type PerformanceStage = 'production' | 'staging';
+export interface PerformanceAuthorityHooksV1 {
+    /**
+     * Opaque reference to the reliability-owned journey/SLO declaration.
+     * Performance code resolves the reference through an injected adapter and
+     * never defines or mutates the shared operations schema.
+     */
+    journeyAuthorityPath: string;
+    /**
+     * Opaque reference to the reliability-owned alarm/route declaration.
+     */
+    operationsAuthorityPath: string;
+    releaseManifestPath: string;
+    repositoryPolicyPath: string;
+}
+export interface PerformanceBudgetV1 {
+    comparator: 'maximum' | 'minimum';
+    evidenceProvenance: readonly PerformanceEvidenceProvenance[];
+    id: string;
+    journeyRef: string;
+    metric: 'backlog-age-seconds' | 'bundle-bytes' | 'cold-resume-milliseconds' | 'error-rate' | 'latency-milliseconds' | 'monthly-cost-usd' | 'throughput-per-second' | 'timeout-rate' | 'unit-cost-usd';
+    percentile?: 50 | 95 | 99;
+    population: PerformancePopulation;
+    scenarioRef: string;
+    status: 'declared' | 'example';
+    threshold: number;
+    unit: string;
+}
+export interface PerformanceCapacityResourceV1 {
+    capacityUnit: string;
+    configuredMaximum: number | null;
+    downstreamMaximum: number | null;
+    failureMode: string;
+    id: string;
+    kind: PerformanceWorkloadKind;
+    protectionRef: string;
+    quotaMaximum: number | null;
+    saturationSignalRef: string;
+    status: 'declared' | 'requires-adopter-value';
+}
+export declare const STANDARD_SERVICE_PER_TASK_CONCURRENCY = 32;
+export interface PerformanceLoadLimitsV1 {
+    allowedProtectedStages: readonly ['staging'];
+    maximumConcurrency: number;
+    maximumDurationSeconds: number;
+    maximumEstimatedCostUsd: number;
+    maximumRatePerSecond: number;
+    maximumRequests: number;
+    productionExceptionalOnly: true;
+}
+export interface PerformanceCostPolicyV1 {
+    accountMonthlyMaximumUsd: number;
+    actualNotificationThresholdPercent: number;
+    anomalyRouteRef: string;
+    anomalyThresholdUsd: number;
+    forecastNotificationThresholdPercent: number;
+    notificationRoute: 'foundation-alert-topic';
+    pilotMonthlyMaximumUsd: number;
+    sharedCostAllocationRef: string;
+    status: 'declared' | 'example';
+    testRunMaximumUsd: number;
+    unitCostRefs: readonly string[];
+}
+export interface PerformanceTagPolicyV1 {
+    forbiddenKeys: readonly ['ebk:feature'];
+    requiredKeys: readonly string[];
+    unsupportedResourcePolicy: 'report-with-reason-and-allocation';
+}
+export interface PerformancePolicyV1 {
+    $schema?: string;
+    authority: PerformanceAuthorityHooksV1;
+    budgets: readonly PerformanceBudgetV1[];
+    capacity: readonly PerformanceCapacityResourceV1[];
+    cost: PerformanceCostPolicyV1;
+    evidence: {
+        maximumAgeDays: Readonly<Record<PerformanceEvidenceProvenance, number>>;
+        protectedEvidenceRequiresExactRelease: true;
+    };
+    kind: typeof PERFORMANCE_POLICY_KIND;
+    load: PerformanceLoadLimitsV1;
+    owner: string;
+    reviewAt: string | null;
+    schemaVersion: typeof PERFORMANCE_POLICY_SCHEMA_VERSION;
+    slice: string;
+    tags: PerformanceTagPolicyV1;
+}
+export type PerformanceFailureClassification = 'performance-policy-invalid' | 'performance-policy-incomplete' | 'performance-budget-failed' | 'performance-evidence-invalid' | 'performance-evidence-stale' | 'performance-capacity-unsafe' | 'performance-load-authorization-invalid' | 'performance-load-plan-invalid' | 'performance-load-production-refused' | 'performance-tag-coverage-incomplete';
+export declare class PerformanceContractError extends Error {
+    readonly classification: PerformanceFailureClassification;
+    readonly pointer: string;
+    constructor(classification: PerformanceFailureClassification, pointer: string, message: string);
+}
+export declare function isIsoInstant(value: unknown): value is string;
+export declare function assertFullCommit(value: string, pointer: string): void;
+export declare function assertDigest(value: string, pointer: string): void;
+export declare function performanceDigest(value: unknown): string;
+export declare function validatePerformancePolicy(value: unknown): PerformancePolicyV1;
+export declare function assessPerformancePolicyReadiness(value: unknown): {
+    ready: boolean;
+    findings: readonly {
+        code: 'budget-example' | 'capacity-value-missing' | 'cost-example' | 'review-expired' | 'review-missing';
+        pointer: string;
+    }[];
+};
+export declare function createStandardResourceTags(input: {
+    costAllocation?: string;
+    frameworkVersion: string;
+    managedBy?: string;
+    owner: string;
+    productionProfile: 'cost-optimized' | 'standard';
+    repository: string;
+    slice: string;
+    stage: string;
+    workspace: string;
+}): Readonly<Record<string, string>>;
+export declare function createWorkloadPerformanceRegistration(input: {
+    kind: 'job' | 'service';
+    name: string;
+    slice: string;
+}): PerformanceCapacityResourceV1;