@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/release/lifecycle.js

@@ -0,0 +1,411 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReleaseLifecycleError = exports.RELEASE_LIFECYCLE_STATES = void 0;
+exports.createReleaseLifecycle = createReleaseLifecycle;
+exports.advanceReleaseLifecycle = advanceReleaseLifecycle;
+exports.validateProtectedProductionAuthorization = validateProtectedProductionAuthorization;
+exports.validateReleaseRecoveryCompatibilityArtifacts = validateReleaseRecoveryCompatibilityArtifacts;
+exports.planReleaseRecovery = planReleaseRecovery;
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
+const manifest_js_1 = require("./manifest.js");
+const model_js_1 = require("../infrastructure-change/model.js");
+exports.RELEASE_LIFECYCLE_STATES = [
+    'built',
+    'staging-deployed',
+    'staging-verified',
+    'production-authorized',
+    'production-deployed',
+    'production-verified',
+    'rolled-back',
+    'superseded',
+    'retired',
+];
+class ReleaseLifecycleError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'ReleaseLifecycleError';
+    }
+}
+exports.ReleaseLifecycleError = ReleaseLifecycleError;
+const SHA256 = /^[a-f0-9]{64}$/;
+const SOURCE_COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const RELEASE_ID = /^release-[a-f0-9]{24}$/;
+const UTF8_DECODER = new node_util_1.TextDecoder('utf-8', { fatal: true });
+const ALLOWED_TRANSITIONS = {
+    built: ['staging-deployed', 'retired'],
+    'staging-deployed': ['staging-verified', 'rolled-back'],
+    'staging-verified': ['production-authorized', 'superseded', 'retired'],
+    'production-authorized': ['production-deployed', 'superseded'],
+    'production-deployed': ['production-verified', 'rolled-back'],
+    'production-verified': ['rolled-back', 'superseded'],
+    'rolled-back': ['retired'],
+    superseded: ['retired'],
+    retired: [],
+};
+function isIsoInstant(value) {
+    return (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value) &&
+        !Number.isNaN(Date.parse(value)));
+}
+function validateEvent(event) {
+    const deploymentStage = event.state === 'staging-deployed'
+        ? 'staging'
+        : event.state === 'production-deployed'
+            ? 'production'
+            : undefined;
+    if (Object.keys(event).some((key) => ![
+        'actor',
+        'at',
+        'deployment',
+        'evidenceDigest',
+        'state',
+        'workflow',
+    ].includes(key)) ||
+        !exports.RELEASE_LIFECYCLE_STATES.includes(event.state) ||
+        !(0, safe_reference_1.isBoundedSafeReference)(event.actor) ||
+        !(0, safe_reference_1.isBoundedSafeReference)(event.workflow) ||
+        !SHA256.test(event.evidenceDigest) ||
+        !isIsoInstant(event.at) ||
+        (deploymentStage === undefined) !== (event.deployment === undefined)) {
+        throw new ReleaseLifecycleError('release-lifecycle-evidence-invalid', 'Lifecycle events require bounded actor/workflow references, exact time, and evidence digest.');
+    }
+    if (event.deployment) {
+        const deployment = event.deployment;
+        if (Object.keys(deployment).some((key) => ![
+            'accountFingerprint',
+            'artifacts',
+            'authorizationDigest',
+            'configurationDigest',
+            'convergenceDigest',
+            'infrastructureAggregateRisk',
+            'infrastructurePlanDigest',
+            'infrastructureRiskClasses',
+            'region',
+            'stage',
+        ].includes(key)) ||
+            deployment.stage !== deploymentStage ||
+            !Array.isArray(deployment.artifacts) ||
+            deployment.artifacts.length === 0 ||
+            new Set(deployment.artifacts.map(({ name }) => name)).size !==
+                deployment.artifacts.length ||
+            deployment.artifacts.some((artifact) => Object.keys(artifact).some((key) => ![
+                'classification',
+                'evidenceDigest',
+                'evidenceKind',
+                'name',
+                'workload',
+            ].includes(key)) ||
+                !(0, safe_reference_1.isBoundedSafeReference)(artifact.name) ||
+                !['web', 'lambda', 'service', 'job'].includes(artifact.workload) ||
+                !SHA256.test(artifact.evidenceDigest) ||
+                (artifact.classification === 'stage-neutral'
+                    ? artifact.evidenceKind !== 'captured-digest'
+                    : artifact.classification === 'stage-specific'
+                        ? artifact.evidenceKind !== 'sst-plan-residual'
+                        : true)) ||
+            !(0, safe_reference_1.isBoundedSafeReference)(deployment.region) ||
+            !model_js_1.INFRASTRUCTURE_RISK_CLASSES.includes(deployment.infrastructureAggregateRisk) ||
+            deployment.infrastructureRiskClasses.length === 0 ||
+            new Set(deployment.infrastructureRiskClasses).size !==
+                deployment.infrastructureRiskClasses.length ||
+            deployment.infrastructureRiskClasses.some((riskClass) => !model_js_1.INFRASTRUCTURE_RISK_CLASSES.includes(riskClass)) ||
+            !deployment.infrastructureRiskClasses.includes(deployment.infrastructureAggregateRisk) ||
+            ![
+                deployment.accountFingerprint,
+                deployment.authorizationDigest,
+                deployment.configurationDigest,
+                deployment.convergenceDigest,
+                deployment.infrastructurePlanDigest,
+            ].every((value) => SHA256.test(value))) {
+            throw new ReleaseLifecycleError('release-lifecycle-evidence-invalid', 'A deployed lifecycle event must bind the exact matching protected stage, plan, authorization, target, configuration, and convergence.');
+        }
+    }
+}
+function validateLifecycleRecord(record) {
+    if (Object.keys(record).some((key) => ![
+        'events',
+        'kind',
+        'releaseId',
+        'releaseMaterialDigest',
+        'schemaVersion',
+        'state',
+    ].includes(key)) ||
+        record.kind !== 'release-lifecycle-record' ||
+        record.schemaVersion !== 1 ||
+        !RELEASE_ID.test(record.releaseId) ||
+        !SHA256.test(record.releaseMaterialDigest) ||
+        record.events.length === 0 ||
+        record.events[0]?.state !== 'built' ||
+        record.events.at(-1)?.state !== record.state) {
+        throw new ReleaseLifecycleError('release-lifecycle-evidence-invalid', 'Lifecycle record identity, initial state, and current state must agree.');
+    }
+    record.events.forEach(validateEvent);
+    const deployments = record.events.flatMap((event) => event.deployment ? [event.deployment] : []);
+    const stagingDeployment = deployments.find(({ stage }) => stage === 'staging');
+    const productionDeployment = deployments.find(({ stage }) => stage === 'production');
+    if (new Set(deployments.map(({ stage }) => stage)).size !==
+        deployments.length ||
+        (deployments.length === 2 &&
+            (deployments[0]?.infrastructurePlanDigest ===
+                deployments[1]?.infrastructurePlanDigest ||
+                deployments[0]?.authorizationDigest ===
+                    deployments[1]?.authorizationDigest))) {
+        throw new ReleaseLifecycleError('release-lifecycle-evidence-invalid', 'Staging and production must each bind one distinct protected deployment authorization.');
+    }
+    if (stagingDeployment && productionDeployment) {
+        const stagingArtifacts = new Map(stagingDeployment.artifacts.map((artifact) => [artifact.name, artifact]));
+        if (stagingArtifacts.size !== productionDeployment.artifacts.length ||
+            productionDeployment.artifacts.some((productionArtifact) => {
+                const stagingArtifact = stagingArtifacts.get(productionArtifact.name);
+                return (!stagingArtifact ||
+                    stagingArtifact.classification !==
+                        productionArtifact.classification ||
+                    stagingArtifact.workload !== productionArtifact.workload ||
+                    (productionArtifact.classification === 'stage-neutral'
+                        ? stagingArtifact.evidenceDigest !==
+                            productionArtifact.evidenceDigest
+                        : stagingArtifact.evidenceDigest ===
+                            productionArtifact.evidenceDigest));
+            })) {
+            throw new ReleaseLifecycleError('release-lifecycle-evidence-invalid', 'Protected deployments must prove identical captured digests only for stage-neutral artifacts and distinct provider evidence for stage-specific artifacts.');
+        }
+    }
+    for (let index = 1; index < record.events.length; index += 1) {
+        const previous = record.events[index - 1];
+        const current = record.events[index];
+        if (previous === undefined ||
+            current === undefined ||
+            !ALLOWED_TRANSITIONS[previous.state].includes(current.state) ||
+            Date.parse(current.at) <= Date.parse(previous.at)) {
+            throw new ReleaseLifecycleError('release-lifecycle-evidence-invalid', 'Lifecycle history contains a skipped, reversed, or non-monotonic transition.');
+        }
+    }
+}
+function createReleaseLifecycle(manifest, evidence) {
+    (0, manifest_js_1.validateReleaseManifest)(manifest);
+    const event = {
+        ...evidence,
+        at: manifest.builtAt,
+        state: 'built',
+    };
+    validateEvent(event);
+    return {
+        events: [event],
+        kind: 'release-lifecycle-record',
+        releaseMaterialDigest: manifest.materialDigest,
+        releaseId: manifest.releaseId,
+        schemaVersion: 1,
+        state: 'built',
+    };
+}
+function advanceReleaseLifecycle(record, event) {
+    validateLifecycleRecord(record);
+    validateEvent(event);
+    const previous = record.events.at(-1);
+    if (!ALLOWED_TRANSITIONS[record.state].includes(event.state) ||
+        (previous !== undefined && Date.parse(event.at) <= Date.parse(previous.at))) {
+        throw new ReleaseLifecycleError('release-lifecycle-transition-invalid', `Release lifecycle cannot transition from ${record.state} to ${event.state}.`);
+    }
+    const next = {
+        ...record,
+        events: [...record.events, event],
+        state: event.state,
+    };
+    validateLifecycleRecord(next);
+    return next;
+}
+function artifactDigests(manifest) {
+    return manifest.artifacts
+        .flatMap((artifact) => artifact.classification === 'stage-neutral' ? [artifact.digest] : [])
+        .sort();
+}
+function validateProtectedProductionAuthorization(input) {
+    if (input.environment !== 'production' ||
+        input.oidc !== true ||
+        ![
+            'production-authorized',
+            'production-deployed',
+            'production-verified',
+        ].includes(input.state) ||
+        !SOURCE_COMMIT.test(input.sourceCommit) ||
+        input.sourceCommit !== input.approvedMainCommit ||
+        !(0, safe_reference_1.isBoundedSafeReference)(input.actor) ||
+        !(0, safe_reference_1.isBoundedSafeReference)(input.workflow)) {
+        throw new ReleaseLifecycleError('release-production-authorization-invalid', 'Production authorization requires protected OIDC on the exact approved main commit.');
+    }
+    return input;
+}
+function validateReleaseRecoveryCompatibilityArtifacts(input) {
+    const active = (0, manifest_js_1.validateReleaseManifest)(input.active);
+    const target = (0, manifest_js_1.validateReleaseManifest)(input.target);
+    const expectedKinds = {
+        api: 'api-contract-compatibility-report',
+        database: 'database-migration-compatibility',
+        events: 'event-contract-compatibility',
+    };
+    const surfaces = ['api', 'database', 'events'];
+    const validArtifact = (key) => {
+        const artifact = input.artifacts[key];
+        const binding = input.evidence.compatibility?.[key];
+        const report = artifact?.report;
+        let retainedReport;
+        try {
+            retainedReport =
+                artifact?.bytes && ArrayBuffer.isView(artifact.bytes)
+                    ? JSON.parse(UTF8_DECODER.decode(artifact.bytes))
+                    : undefined;
+        }
+        catch {
+            retainedReport = undefined;
+        }
+        return (artifact !== undefined &&
+            binding !== undefined &&
+            report !== undefined &&
+            (0, node_util_1.isDeepStrictEqual)(retainedReport, report) &&
+            Object.keys(report).length === 7 &&
+            Object.keys(report).every((field) => [
+                'activeReportDigest',
+                'activeSourceCommit',
+                'classification',
+                'kind',
+                'schemaVersion',
+                'targetReportDigest',
+                'targetSourceCommit',
+            ].includes(field)) &&
+            report.schemaVersion === 1 &&
+            SHA256.test(report.activeReportDigest) &&
+            SHA256.test(report.targetReportDigest) &&
+            report.kind === expectedKinds[key] &&
+            binding.kind === expectedKinds[key] &&
+            report.classification === binding.classification &&
+            report.activeSourceCommit === active.source.commit &&
+            report.targetSourceCommit === target.source.commit &&
+            binding.evidenceDigest ===
+                (0, node_crypto_1.createHash)('sha256').update(artifact.bytes).digest('hex'));
+    };
+    const invalidSurfaces = surfaces.filter((surface) => !validArtifact(surface));
+    if (Object.keys(input.artifacts).length !== surfaces.length ||
+        invalidSurfaces.length > 0) {
+        throw new ReleaseLifecycleError('release-recovery-incompatible', `Recovery compatibility artifacts must be exact and bind both release source identities; invalid surfaces: ${invalidSurfaces.join(', ') || 'artifact inventory'}.`);
+    }
+    return input.evidence;
+}
+/**
+ * Restricts recovery to a recorded manifest and a protected workflow on the
+ * approved main tip. Database/API/event incompatibility always fails closed.
+ */
+function planReleaseRecovery(input) {
+    const active = (0, manifest_js_1.validateReleaseManifest)(input.active);
+    const target = (0, manifest_js_1.validateReleaseManifest)(input.target);
+    validateLifecycleRecord(input.activeLifecycle);
+    validateLifecycleRecord(input.targetLifecycle);
+    let compatibilityEvidence;
+    try {
+        compatibilityEvidence = JSON.parse(UTF8_DECODER.decode(input.compatibilityEvidenceBytes));
+    }
+    catch {
+        throw new ReleaseLifecycleError('release-recovery-incompatible', 'Recovery compatibility evidence must be retained as exact UTF-8 JSON bytes.');
+    }
+    const compatibilityEvidenceDigest = (0, node_crypto_1.createHash)('sha256')
+        .update(input.compatibilityEvidenceBytes)
+        .digest('hex');
+    const workflow = input.workflow;
+    if (workflow.environment !== 'production' ||
+        workflow.oidc !== true ||
+        !SOURCE_COMMIT.test(workflow.sourceCommit) ||
+        !SOURCE_COMMIT.test(workflow.approvedMainCommit) ||
+        workflow.sourceCommit !== workflow.approvedMainCommit ||
+        workflow.reason.trim().length < 10 ||
+        !(0, safe_reference_1.isBoundedSafeReference)(workflow.actor) ||
+        !(0, safe_reference_1.isBoundedSafeReference)(workflow.workflow)) {
+        throw new ReleaseLifecycleError('release-recovery-workflow-invalid', 'Recovery requires protected production OIDC on the approved main tip with actor and reason evidence.');
+    }
+    if (input.activeLifecycle.releaseId !== active.releaseId ||
+        input.activeLifecycle.releaseMaterialDigest !== active.materialDigest ||
+        !['production-deployed', 'production-verified'].includes(input.activeLifecycle.state) ||
+        !input.activeLifecycle.events.some((event) => event.state === 'production-deployed' &&
+            event.deployment?.stage === 'production')) {
+        throw new ReleaseLifecycleError('release-recovery-active-unverified', 'Recovery compatibility must start from the exact actively deployed production lifecycle.');
+    }
+    if (input.targetLifecycle.releaseId !== target.releaseId ||
+        input.targetLifecycle.releaseMaterialDigest !== target.materialDigest ||
+        input.targetLifecycle.state === 'retired' ||
+        target.source.repository !== active.source.repository) {
+        throw new ReleaseLifecycleError('release-recovery-target-unverified', 'Recovery target must match a non-retired lifecycle record.');
+    }
+    if (input.strategy === 'immutable-redeploy'
+        ? !input.targetLifecycle.events.some((event) => event.state === 'production-verified') ||
+            target.artifacts.some(({ classification }) => classification === 'stage-specific')
+        : input.targetLifecycle.state !== 'production-authorized' ||
+            !SOURCE_COMMIT.test(target.source.commit)) {
+        throw new ReleaseLifecycleError('release-recovery-target-unverified', input.strategy === 'immutable-redeploy'
+            ? 'Immutable redeploy requires prior production verification and exact captured deployable digests for every workload.'
+            : 'Revert and roll-forward recovery require the authorized main-tip release.');
+    }
+    const expectedEvidenceKeys = [
+        'active',
+        'compatibility',
+        'kind',
+        'schemaVersion',
+        'target',
+    ];
+    const validIdentity = (identity, manifest, lifecycle) => identity !== null &&
+        typeof identity === 'object' &&
+        Object.keys(identity).length === 4 &&
+        Object.keys(identity).every((key) => [
+            'candidateDigest',
+            'releaseId',
+            'releaseMaterialDigest',
+            'sourceCommit',
+        ].includes(key)) &&
+        SHA256.test(identity.candidateDigest) &&
+        SOURCE_COMMIT.test(identity.sourceCommit) &&
+        identity.releaseId === manifest.releaseId &&
+        identity.releaseMaterialDigest === manifest.materialDigest &&
+        identity.sourceCommit === manifest.source.commit &&
+        lifecycle.events[0]?.state === 'built' &&
+        lifecycle.events[0].evidenceDigest === identity.candidateDigest;
+    if (compatibilityEvidence?.kind !== 'release-recovery-compatibility-evidence' ||
+        compatibilityEvidence.schemaVersion !== 1 ||
+        Object.keys(compatibilityEvidence).length !== expectedEvidenceKeys.length ||
+        Object.keys(compatibilityEvidence).some((key) => !expectedEvidenceKeys.includes(key)) ||
+        !validIdentity(compatibilityEvidence.active, active, input.activeLifecycle) ||
+        !validIdentity(compatibilityEvidence.target, target, input.targetLifecycle) ||
+        compatibilityEvidence.compatibility === null ||
+        typeof compatibilityEvidence.compatibility !== 'object' ||
+        Object.keys(compatibilityEvidence.compatibility).length !== 3 ||
+        !['api', 'database', 'events'].every((surface) => {
+            const evidence = compatibilityEvidence.compatibility[surface];
+            return (evidence !== undefined &&
+                Object.keys(evidence).length === 3 &&
+                Object.keys(evidence).every((key) => ['classification', 'evidenceDigest', 'kind'].includes(key)) &&
+                ['compatible', 'incompatible', 'unknown'].includes(evidence.classification) &&
+                SHA256.test(evidence.evidenceDigest) &&
+                (0, safe_reference_1.isBoundedSafeReference)(evidence.kind));
+        })) {
+        throw new ReleaseLifecycleError('release-recovery-incompatible', 'Recovery compatibility evidence must bind the exact active and target candidate artifacts.');
+    }
+    if (Object.values(compatibilityEvidence.compatibility).some(({ classification }) => classification !== 'compatible')) {
+        throw new ReleaseLifecycleError('release-recovery-incompatible', 'Recovery target is not proven compatible with active API, database, and event contracts.');
+    }
+    return {
+        activeCandidateDigest: compatibilityEvidence.active.candidateDigest,
+        activeReleaseId: active.releaseId,
+        actor: workflow.actor,
+        compatibilityEvidenceDigest,
+        kind: 'release-recovery-plan',
+        protectedMutationCommit: workflow.approvedMainCommit,
+        reason: workflow.reason,
+        strategy: input.strategy,
+        targetArtifactDigests: artifactDigests(target),
+        targetCandidateDigest: compatibilityEvidence.target.candidateDigest,
+        targetMaterialDigest: target.materialDigest,
+        targetReleaseId: target.releaseId,
+        targetSourceCommit: target.source.commit,
+        workflow: workflow.workflow,
+    };
+}
+//# sourceMappingURL=lifecycle.js.map

package/src/release/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../../../packages/nx/src/release/lifecycle.ts"],"names":[],"mappings":";;;AA4XA,wDAmBC;AAED,0DAuBC;AAUD,4FAsBC;AAED,sGAqEC;AAMD,kDA6LC;AAltBD,6CAAyC;AACzC,yCAA2D;AAC3D,+EAAoF;AACpF,+CAAgF;AAChF,gEAG2C;AAE9B,QAAA,wBAAwB,GAAG;IACtC,OAAO;IACP,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,qBAAqB;IACrB,qBAAqB;IACrB,aAAa;IACb,YAAY;IACZ,SAAS;CACD,CAAC;AAgIX,MAAa,qBAAsB,SAAQ,KAAK;IAEnC;IADX,YACW,cAAqD,EAC9D,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAAuC;QAI9D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AARD,sDAQC;AAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,YAAY,GAAG,IAAI,uBAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,MAAM,mBAAmB,GAErB;IACF,KAAK,EAAE,CAAC,kBAAkB,EAAE,SAAS,CAAC;IACtC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACvD,kBAAkB,EAAE,CAAC,uBAAuB,EAAE,YAAY,EAAE,SAAS,CAAC;IACtE,uBAAuB,EAAE,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAC9D,qBAAqB,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC;IAC7D,qBAAqB,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,CAAC;IAC1B,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,CACL,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC;QAChE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAA4B;IACjD,MAAM,eAAe,GACnB,KAAK,CAAC,KAAK,KAAK,kBAAkB;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,qBAAqB;YACrC,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,CAAC;IAClB,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,GAAG,EAAE,EAAE,CACN,CAAC;QACC,OAAO;QACP,IAAI;QACJ,YAAY;QACZ,gBAAgB;QAChB,OAAO;QACP,UAAU;KACX,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClB;QACD,CAAC,gCAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/C,CAAC,IAAA,uCAAsB,EAAC,KAAK,CAAC,KAAK,CAAC;QACpC,CAAC,IAAA,uCAAsB,EAAC,KAAK,CAAC,QAAQ,CAAC;QACvC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAClC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,CAAC,eAAe,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,EACpE,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IACE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAC1B,CAAC,GAAG,EAAE,EAAE,CACN,CAAC;YACC,oBAAoB;YACpB,WAAW;YACX,qBAAqB;YACrB,qBAAqB;YACrB,mBAAmB;YACnB,6BAA6B;YAC7B,0BAA0B;YAC1B,2BAA2B;YAC3B,QAAQ;YACR,OAAO;SACR,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClB;YACD,UAAU,CAAC,KAAK,KAAK,eAAe;YACpC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;YACpC,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACjC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBACxD,UAAU,CAAC,SAAS,CAAC,MAAM;YAC7B,UAAU,CAAC,SAAS,CAAC,IAAI,CACvB,CAAC,QAAQ,EAAE,EAAE,CACX,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACxB,CAAC,GAAG,EAAE,EAAE,CACN,CAAC;gBACC,gBAAgB;gBAChB,gBAAgB;gBAChB,cAAc;gBACd,MAAM;gBACN,UAAU;aACX,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClB;gBACD,CAAC,IAAA,uCAAsB,EAAC,QAAQ,CAAC,IAAI,CAAC;gBACtC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAChE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACrC,CAAC,QAAQ,CAAC,cAAc,KAAK,eAAe;oBAC1C,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,iBAAiB;oBAC7C,CAAC,CAAC,QAAQ,CAAC,cAAc,KAAK,gBAAgB;wBAC5C,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,mBAAmB;wBAC/C,CAAC,CAAC,IAAI,CAAC,CACd;YACD,CAAC,IAAA,uCAAsB,EAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,CAAC,sCAA2B,CAAC,QAAQ,CACnC,UAAU,CAAC,2BAA2B,CACvC;YACD,UAAU,CAAC,yBAAyB,CAAC,MAAM,KAAK,CAAC;YACjD,IAAI,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,IAAI;gBAChD,UAAU,CAAC,yBAAyB,CAAC,MAAM;YAC7C,UAAU,CAAC,yBAAyB,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,sCAA2B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAChE;YACD,CAAC,UAAU,CAAC,yBAAyB,CAAC,QAAQ,CAC5C,UAAU,CAAC,2BAA2B,CACvC;YACD,CAAC;gBACC,UAAU,CAAC,kBAAkB;gBAC7B,UAAU,CAAC,mBAAmB;gBAC9B,UAAU,CAAC,mBAAmB;gBAC9B,UAAU,CAAC,iBAAiB;gBAC5B,UAAU,CAAC,wBAAwB;aACpC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,uIAAuI,CACxI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA8B;IAC7D,IACE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CACN,CAAC;QACC,QAAQ;QACR,MAAM;QACN,WAAW;QACX,uBAAuB;QACvB,eAAe;QACf,OAAO;KACR,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClB;QACD,MAAM,CAAC,IAAI,KAAK,0BAA0B;QAC1C,MAAM,CAAC,aAAa,KAAK,CAAC;QAC1B,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,OAAO;QACnC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,MAAM,CAAC,KAAK,EAC5C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAClD,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;IACF,MAAM,iBAAiB,GAAG,WAAW,CAAC,IAAI,CACxC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CACnC,CAAC;IACF,MAAM,oBAAoB,GAAG,WAAW,CAAC,IAAI,CAC3C,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,CACtC,CAAC;IACF,IACE,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACjD,WAAW,CAAC,MAAM;QACpB,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YACvB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,wBAAwB;gBACvC,WAAW,CAAC,CAAC,CAAC,EAAE,wBAAwB;gBACxC,WAAW,CAAC,CAAC,CAAC,EAAE,mBAAmB;oBACjC,WAAW,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CACzE,CAAC;QACF,IACE,gBAAgB,CAAC,IAAI,KAAK,oBAAoB,CAAC,SAAS,CAAC,MAAM;YAC/D,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE;gBACzD,MAAM,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBACtE,OAAO,CACL,CAAC,eAAe;oBAChB,eAAe,CAAC,cAAc;wBAC5B,kBAAkB,CAAC,cAAc;oBACnC,eAAe,CAAC,QAAQ,KAAK,kBAAkB,CAAC,QAAQ;oBACxD,CAAC,kBAAkB,CAAC,cAAc,KAAK,eAAe;wBACpD,CAAC,CAAC,eAAe,CAAC,cAAc;4BAC9B,kBAAkB,CAAC,cAAc;wBACnC,CAAC,CAAC,eAAe,CAAC,cAAc;4BAC9B,kBAAkB,CAAC,cAAc,CAAC,CACvC,CAAC;YACJ,CAAC,CAAC,EACF,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,2JAA2J,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IACE,QAAQ,KAAK,SAAS;YACtB,OAAO,KAAK,SAAS;YACrB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,QAA2B,EAC3B,QAAqD;IAErD,IAAA,qCAAuB,EAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,KAAK,GAA0B;QACnC,GAAG,QAAQ;QACX,EAAE,EAAE,QAAQ,CAAC,OAAO;QACpB,KAAK,EAAE,OAAO;KACf,CAAC;IACF,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO;QACL,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,IAAI,EAAE,0BAA0B;QAChC,qBAAqB,EAAE,QAAQ,CAAC,cAAc;QAC9C,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,OAAO;KACf,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CACrC,MAA8B,EAC9B,KAA4B;IAE5B,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IACE,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACxD,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,sCAAsC,EACtC,4CAA4C,MAAM,CAAC,KAAK,OAAO,KAAK,CAAC,KAAK,GAAG,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,GAAG,MAAM;QACT,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IACF,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,QAA2B;IAClD,OAAO,QAAQ,CAAC,SAAS;SACtB,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpB,QAAQ,CAAC,cAAc,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CACrE;SACA,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,wCAAwC,CACtD,KAAuC;IAEvC,IACE,KAAK,CAAC,WAAW,KAAK,YAAY;QAClC,KAAK,CAAC,IAAI,KAAK,IAAI;QACnB,CAAC;YACC,uBAAuB;YACvB,qBAAqB;YACrB,qBAAqB;SACtB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QACvC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,kBAAkB;QAC/C,CAAC,IAAA,uCAAsB,EAAC,KAAK,CAAC,KAAK,CAAC;QACpC,CAAC,IAAA,uCAAsB,EAAC,KAAK,CAAC,QAAQ,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,0CAA0C,EAC1C,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,6CAA6C,CAAC,KAO7D;IACC,MAAM,MAAM,GAAG,IAAA,qCAAuB,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAA,qCAAuB,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,mCAAmC;QACxC,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,8BAA8B;KAC9B,CAAC;IACX,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;IACxD,MAAM,aAAa,GAAG,CAAC,GAA8B,EAAW,EAAE;QAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;QAChC,IAAI,cAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,cAAc;gBACZ,QAAQ,EAAE,KAAK,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACjD,CAAC,CAAC,SAAS,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,GAAG,SAAS,CAAC;QAC7B,CAAC;QACD,OAAO,CACL,QAAQ,KAAK,SAAS;YACtB,OAAO,KAAK,SAAS;YACrB,MAAM,KAAK,SAAS;YACpB,IAAA,6BAAiB,EAAC,cAAc,EAAE,MAAM,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC;gBACE,oBAAoB;gBACpB,oBAAoB;gBACpB,gBAAgB;gBAChB,MAAM;gBACN,eAAe;gBACf,oBAAoB;gBACpB,oBAAoB;aACrB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAClB;YACD,MAAM,CAAC,aAAa,KAAK,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACtC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,GAAG,CAAC;YAClC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,GAAG,CAAC;YACnC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;YAChD,MAAM,CAAC,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM;YAClD,MAAM,CAAC,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM;YAClD,OAAO,CAAC,cAAc;gBACpB,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAC5D,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACvD,eAAe,CAAC,MAAM,GAAG,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,+BAA+B,EAC/B,6GAA6G,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oBAAoB,GAAG,CACnK,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,KAQnC;IACC,MAAM,MAAM,GAAG,IAAA,qCAAuB,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAA,qCAAuB,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/C,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,qBAA2D,CAAC;IAChE,IAAI,CAAC;QACH,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAChC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CACd,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,qBAAqB,CAC7B,+BAA+B,EAC/B,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,2BAA2B,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACrD,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC;SACxC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IACE,QAAQ,CAAC,WAAW,KAAK,YAAY;QACrC,QAAQ,CAAC,IAAI,KAAK,IAAI;QACtB,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1C,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAChD,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,kBAAkB;QACrD,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE;QAClC,CAAC,IAAA,uCAAsB,EAAC,QAAQ,CAAC,KAAK,CAAC;QACvC,CAAC,IAAA,uCAAsB,EAAC,QAAQ,CAAC,QAAQ,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,mCAAmC,EACnC,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,eAAe,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACpD,KAAK,CAAC,eAAe,CAAC,qBAAqB,KAAK,MAAM,CAAC,cAAc;QACrE,CAAC,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CACtD,KAAK,CAAC,eAAe,CAAC,KAAK,CAC5B;QACD,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAChC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,KAAK,qBAAqB;YACrC,KAAK,CAAC,UAAU,EAAE,KAAK,KAAK,YAAY,CAC3C,EACD,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,eAAe,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACpD,KAAK,CAAC,eAAe,CAAC,qBAAqB,KAAK,MAAM,CAAC,cAAc;QACrE,KAAK,CAAC,eAAe,CAAC,KAAK,KAAK,SAAS;QACzC,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EACrD,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,KAAK,oBAAoB;QACrC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,qBAAqB,CACjD;YACD,MAAM,CAAC,SAAS,CAAC,IAAI,CACnB,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,cAAc,KAAK,gBAAgB,CAC5D;QACH,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,KAAK,uBAAuB;YACvD,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,EACpC,KAAK,CAAC,QAAQ,KAAK,oBAAoB;YACrC,CAAC,CAAC,qHAAqH;YACvH,CAAC,CAAC,2EAA2E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG;QAC3B,QAAQ;QACR,eAAe;QACf,MAAM;QACN,eAAe;QACf,QAAQ;KACT,CAAC;IACF,MAAM,aAAa,GAAG,CACpB,QAAwD,EACxD,QAA2B,EAC3B,SAAiC,EACjC,EAAE,CACF,QAAQ,KAAK,IAAI;QACjB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAClC;YACE,iBAAiB;YACjB,WAAW;YACX,uBAAuB;YACvB,cAAc;SACf,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChB;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QACrC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QACzC,QAAQ,CAAC,qBAAqB,KAAK,QAAQ,CAAC,cAAc;QAC1D,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;QAChD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,OAAO;QACtC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,eAAe,CAAC;IAClE,IACE,qBAAqB,EAAE,IAAI,KAAK,yCAAyC;QACzE,qBAAqB,CAAC,aAAa,KAAK,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM;QACzE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC7C;QACD,CAAC,aAAa,CACZ,qBAAqB,CAAC,MAAM,EAC5B,MAAM,EACN,KAAK,CAAC,eAAe,CACtB;QACD,CAAC,aAAa,CACZ,qBAAqB,CAAC,MAAM,EAC5B,MAAM,EACN,KAAK,CAAC,eAAe,CACtB;QACD,qBAAqB,CAAC,aAAa,KAAK,IAAI;QAC5C,OAAO,qBAAqB,CAAC,aAAa,KAAK,QAAQ;QACvD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC;QAC7D,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/C,MAAM,QAAQ,GACZ,qBAAqB,CAAC,aAAa,CACjC,OAA2D,CAC5D,CAAC;YACJ,OAAO,CACL,QAAQ,KAAK,SAAS;gBACtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAClC,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC3D;gBACD,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,QAAQ,CAChD,QAAQ,CAAC,cAAc,CACxB;gBACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACpC,IAAA,uCAAsB,EAAC,QAAQ,CAAC,IAAI,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC,EACF,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,+BAA+B,EAC/B,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,IAAI,CACrD,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,cAAc,KAAK,YAAY,CACxD,EACD,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,+BAA+B,EAC/B,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,qBAAqB,EAAE,qBAAqB,CAAC,MAAM,CAAC,eAAe;QACnE,eAAe,EAAE,MAAM,CAAC,SAAS;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,2BAA2B;QAC3B,IAAI,EAAE,uBAAuB;QAC7B,uBAAuB,EAAE,QAAQ,CAAC,kBAAkB;QACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,qBAAqB,EAAE,eAAe,CAAC,MAAM,CAAC;QAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM,CAAC,eAAe;QACnE,oBAAoB,EAAE,MAAM,CAAC,cAAc;QAC3C,eAAe,EAAE,MAAM,CAAC,SAAS;QACjC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QACxC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC"}

package/src/release/manifest.d.ts

@@ -0,0 +1,148 @@
+import { type InfrastructureRiskClass } from '../infrastructure-change/model.js';
+export declare const RELEASE_MANIFEST_SCHEMA_VERSION: 1;
+export declare const RELEASE_MANIFEST_KIND: "ebk-release-manifest";
+export declare const RELEASE_ARTIFACT_WORKLOADS: readonly ["web", "lambda", "service", "job"];
+export declare const RELEASE_ARTIFACT_STAGES: readonly ["staging", "production"];
+export type ReleaseArtifactWorkload = (typeof RELEASE_ARTIFACT_WORKLOADS)[number];
+export type ReleaseArtifactStage = (typeof RELEASE_ARTIFACT_STAGES)[number];
+export interface StageNeutralReleaseArtifact {
+    buildRecipeDigest: string;
+    classification: 'stage-neutral';
+    digest: string;
+    name: string;
+    sourceInputsDigest: string;
+    stages: readonly ReleaseArtifactStage[];
+    workload: ReleaseArtifactWorkload;
+}
+export interface StageSpecificReleaseArtifact {
+    buildRecipeDigest: string;
+    candidateDigest: string;
+    classification: 'stage-specific';
+    name: string;
+    providerEvidence: 'sst-plan-residual';
+    reason: string;
+    sourceInputsDigest: string;
+    workload: ReleaseArtifactWorkload;
+}
+export type ReleaseArtifact = StageNeutralReleaseArtifact | StageSpecificReleaseArtifact;
+export interface ReleaseManifestInput {
+    artifacts: readonly ReleaseArtifact[];
+    blueprints: Readonly<Record<string, string>>;
+    build: {
+        provenanceDigest: string;
+        runId: string;
+        workflow: string;
+    };
+    builtAt: string;
+    configuration: readonly {
+        digest: string;
+        stage: ReleaseArtifactStage;
+    }[];
+    contracts: readonly {
+        digest: string;
+        name: string;
+        version: string;
+    }[];
+    controls: {
+        digest: string;
+        version: string;
+    };
+    frameworkCandidate: string;
+    infrastructure: {
+        aggregateRisk: InfrastructureRiskClass;
+        configurationMetadataDigest: string;
+        materialDigest: string;
+        policyProfileDigest: string;
+        riskClasses: readonly InfrastructureRiskClass[];
+        stage: ReleaseArtifactStage;
+        tool: {
+            name: string;
+            version: string;
+        };
+    };
+    migrations: readonly {
+        digest: string;
+        name: string;
+        version: string;
+    }[];
+    packageLockDigest: string;
+    projects: readonly string[];
+    requiredTests: readonly {
+        evidenceDigest: string;
+        name: string;
+        outcome: 'passed' | 'skipped';
+    }[];
+    secrets: readonly {
+        logicalName: string;
+        ready: boolean;
+        versionReference: string;
+    }[];
+    source: {
+        commit: string;
+        repository: string;
+        treeDigest: string;
+    };
+    toolchain: Readonly<Record<string, string>>;
+}
+export interface ReleaseManifestV1 extends ReleaseManifestInput {
+    initialLifecycle: {
+        at: string;
+        state: 'built';
+    };
+    kind: typeof RELEASE_MANIFEST_KIND;
+    materialDigest: string;
+    releaseId: string;
+    schemaVersion: typeof RELEASE_MANIFEST_SCHEMA_VERSION;
+    /**
+     * Attached after release identity is derived. These sidecars bind back to
+     * materialDigest, avoiding a circular digest while keeping this immutable
+     * manifest as the authoritative evidence index.
+     */
+    supplyChain?: ReleaseSupplyChainEvidence;
+}
+export interface ReleaseSupplyChainEvidence {
+    binding: {
+        materialDigest: string;
+        path: string;
+        sha256: string;
+    };
+    sboms: readonly {
+        artifact: string;
+        artifactFamily: 'deployable-bundle' | 'nextjs-build-output' | 'oci-image' | 'source-build-inputs';
+        bindingId: string;
+        deploymentRelation: 'build-input' | 'deployed-artifact';
+        inventoryScope: 'build-output-contents' | 'deployable-bundle-contents' | 'final-oci-contents' | 'source-build-inputs';
+        path: string;
+        serialNumber: string;
+        sha256: string;
+    }[];
+    unsupportedArtifacts: readonly {
+        artifact: string;
+        family: 'sst-provider-artifact';
+        reason: string;
+    }[];
+}
+export interface ReleaseManifestExpectation {
+    configurationDigests?: Readonly<Partial<Record<ReleaseArtifactStage, string>>>;
+    infrastructureConfigurationMetadataDigest?: string;
+    infrastructureMaterialDigest?: string;
+    infrastructurePolicyProfileDigest?: string;
+    infrastructureRisk?: {
+        aggregate: InfrastructureRiskClass;
+        classes: readonly InfrastructureRiskClass[];
+        stage: ReleaseArtifactStage;
+    };
+    materialDigest?: string;
+    requireSupplyChain?: boolean;
+    sourceCommit?: string;
+    supplyChainBindingDigest?: string;
+}
+export type ReleaseManifestFailureClassification = 'release-manifest-invalid' | 'release-manifest-digest-mismatch' | 'release-manifest-stale' | 'release-artifact-classification-invalid' | 'release-sensitive-value-rejected';
+export declare class ReleaseManifestError extends Error {
+    readonly classification: ReleaseManifestFailureClassification;
+    readonly pointer: string;
+    constructor(classification: ReleaseManifestFailureClassification, pointer: string, message: string);
+}
+export declare function createReleaseManifest(input: ReleaseManifestInput): ReleaseManifestV1;
+export declare function bindReleaseManifestSupplyChain(manifest: ReleaseManifestV1, evidence: ReleaseSupplyChainEvidence): ReleaseManifestV1;
+export declare function validateReleaseManifest(manifest: ReleaseManifestV1, expectation?: ReleaseManifestExpectation): ReleaseManifestV1;