@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/release/manifest.js

@@ -0,0 +1,503 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReleaseManifestError = exports.RELEASE_ARTIFACT_STAGES = exports.RELEASE_ARTIFACT_WORKLOADS = exports.RELEASE_MANIFEST_KIND = exports.RELEASE_MANIFEST_SCHEMA_VERSION = void 0;
+exports.createReleaseManifest = createReleaseManifest;
+exports.bindReleaseManifestSupplyChain = bindReleaseManifestSupplyChain;
+exports.validateReleaseManifest = validateReleaseManifest;
+const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
+const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
+const model_js_1 = require("../infrastructure-change/model.js");
+const validation_js_1 = require("../validation.js");
+exports.RELEASE_MANIFEST_SCHEMA_VERSION = 1;
+exports.RELEASE_MANIFEST_KIND = 'ebk-release-manifest';
+exports.RELEASE_ARTIFACT_WORKLOADS = [
+    'web',
+    'lambda',
+    'service',
+    'job',
+];
+exports.RELEASE_ARTIFACT_STAGES = ['staging', 'production'];
+class ReleaseManifestError extends Error {
+    classification;
+    pointer;
+    constructor(classification, pointer, message) {
+        super(`${pointer}: ${message}`);
+        this.classification = classification;
+        this.pointer = pointer;
+        this.name = 'ReleaseManifestError';
+    }
+}
+exports.ReleaseManifestError = ReleaseManifestError;
+const SHA256 = /^[a-f0-9]{64}$/;
+const SOURCE_COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const SENSITIVE_KEY = /(?:secret|password|token|credential|private[-_]?key)/i;
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function canonicalize(value) {
+    return (0, canonical_json_1.canonicalJson)(value);
+}
+function digest(value) {
+    return (0, canonical_json_1.canonicalJsonSha256)(value);
+}
+function manifestInput(manifest) {
+    return {
+        artifacts: manifest.artifacts,
+        blueprints: manifest.blueprints,
+        build: manifest.build,
+        builtAt: manifest.builtAt,
+        configuration: manifest.configuration,
+        contracts: manifest.contracts,
+        controls: manifest.controls,
+        frameworkCandidate: manifest.frameworkCandidate,
+        infrastructure: manifest.infrastructure,
+        migrations: manifest.migrations,
+        packageLockDigest: manifest.packageLockDigest,
+        projects: manifest.projects,
+        requiredTests: manifest.requiredTests,
+        secrets: manifest.secrets,
+        source: manifest.source,
+        toolchain: manifest.toolchain,
+    };
+}
+function isIsoInstant(value) {
+    return (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value) &&
+        !Number.isNaN(Date.parse(value)));
+}
+function assertDigest(value, pointer) {
+    if (!SHA256.test(value)) {
+        throw new ReleaseManifestError('release-manifest-invalid', pointer, 'must be a lowercase SHA-256 digest');
+    }
+}
+function assertReference(value, pointer) {
+    if (!(0, safe_reference_1.isBoundedSafeReference)(value)) {
+        throw new ReleaseManifestError('release-manifest-invalid', pointer, 'must be a bounded opaque reference');
+    }
+}
+function assertRelativeEvidencePath(value, pointer) {
+    assertReference(value, pointer);
+    if (value.startsWith('/') ||
+        value.endsWith('/') ||
+        value.split('/').some((segment) => segment === '' || segment === '..')) {
+        throw new ReleaseManifestError('release-manifest-invalid', pointer, 'must be a normalized relative evidence path');
+    }
+}
+function assertOnlyKeys(value, allowed, pointer) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key)) {
+            throw new ReleaseManifestError(SENSITIVE_KEY.test(key)
+                ? 'release-sensitive-value-rejected'
+                : 'release-manifest-invalid', `${pointer}/${key}`, 'is not part of the release manifest schema');
+        }
+    }
+}
+function normalizeRecord(record, pointer) {
+    const entries = Object.entries(record).sort(([left], [right]) => compareStrings(left, right));
+    for (const [key, value] of entries) {
+        assertReference(key, `${pointer}/${key}`);
+        assertReference(value, `${pointer}/${key}`);
+        if (SENSITIVE_KEY.test(key)) {
+            throw new ReleaseManifestError('release-sensitive-value-rejected', `${pointer}/${key}`, 'release metadata may not contain sensitive-value fields');
+        }
+    }
+    return Object.fromEntries(entries);
+}
+function normalizeArtifacts(input) {
+    if (input.length === 0) {
+        throw new ReleaseManifestError('release-artifact-classification-invalid', '/artifacts', 'must capture at least one generated workload artifact');
+    }
+    const seen = new Set();
+    const normalized = [...input]
+        .sort((left, right) => compareStrings(left.name, right.name))
+        .map((artifact, index) => {
+        const pointer = `/artifacts/${index}`;
+        assertOnlyKeys(artifact, artifact.classification === 'stage-neutral'
+            ? [
+                'buildRecipeDigest',
+                'classification',
+                'digest',
+                'name',
+                'sourceInputsDigest',
+                'stages',
+                'workload',
+            ]
+            : [
+                'buildRecipeDigest',
+                'candidateDigest',
+                'classification',
+                'name',
+                'providerEvidence',
+                'reason',
+                'sourceInputsDigest',
+                'workload',
+            ], pointer);
+        assertReference(artifact.name, `${pointer}/name`);
+        if (seen.has(artifact.name) ||
+            !exports.RELEASE_ARTIFACT_WORKLOADS.includes(artifact.workload)) {
+            throw new ReleaseManifestError('release-artifact-classification-invalid', pointer, 'artifact names must be unique and workloads supported');
+        }
+        seen.add(artifact.name);
+        assertDigest(artifact.buildRecipeDigest, `${pointer}/buildRecipeDigest`);
+        assertDigest(artifact.sourceInputsDigest, `${pointer}/sourceInputsDigest`);
+        if (artifact.classification === 'stage-neutral') {
+            assertDigest(artifact.digest, `${pointer}/digest`);
+            const stages = [...new Set(artifact.stages)].sort(compareStrings);
+            if (stages.length !== exports.RELEASE_ARTIFACT_STAGES.length ||
+                exports.RELEASE_ARTIFACT_STAGES.some((stage) => !stages.includes(stage))) {
+                throw new ReleaseManifestError('release-artifact-classification-invalid', `${pointer}/stages`, 'stage-neutral promotion must bind the same digest to staging and production');
+            }
+            return { ...artifact, stages };
+        }
+        if (artifact.classification === 'stage-specific') {
+            assertDigest(artifact.candidateDigest, `${pointer}/candidateDigest`);
+            if (artifact.providerEvidence !== 'sst-plan-residual' ||
+                artifact.reason.trim().length < 10) {
+                throw new ReleaseManifestError('release-artifact-classification-invalid', `${pointer}/reason`, 'stage-specific builds require an explicit reason and truthful provider evidence class');
+            }
+            return artifact;
+        }
+        throw new ReleaseManifestError('release-artifact-classification-invalid', `${pointer}/classification`, 'must be stage-neutral or stage-specific');
+    });
+    return normalized;
+}
+function normalizeSupplyChainEvidence(input, artifacts) {
+    if (!(0, validation_js_1.isRecord)(input) ||
+        !(0, validation_js_1.isRecord)(input.binding) ||
+        !Array.isArray(input.sboms) ||
+        !Array.isArray(input.unsupportedArtifacts)) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/supplyChain', 'must contain a binding, SBOM references, and deployed-artifact applicability records');
+    }
+    assertOnlyKeys(input, ['binding', 'sboms', 'unsupportedArtifacts'], '/supplyChain');
+    assertOnlyKeys(input.binding, ['materialDigest', 'path', 'sha256'], '/supplyChain/binding');
+    assertDigest(input.binding.materialDigest, '/supplyChain/binding/materialDigest');
+    assertDigest(input.binding.sha256, '/supplyChain/binding/sha256');
+    assertRelativeEvidencePath(input.binding.path, '/supplyChain/binding/path');
+    const expectedArtifacts = artifacts
+        .map(({ name }) => name)
+        .sort(compareStrings);
+    const expectedArtifactSet = new Set(expectedArtifacts);
+    const sboms = input.sboms
+        .map((sbom, index) => {
+        if (!(0, validation_js_1.isRecord)(sbom)) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/supplyChain/sboms/${index}`, 'must be one SBOM evidence reference');
+        }
+        const reference = sbom;
+        assertOnlyKeys(reference, [
+            'artifact',
+            'artifactFamily',
+            'bindingId',
+            'deploymentRelation',
+            'inventoryScope',
+            'path',
+            'serialNumber',
+            'sha256',
+        ], `/supplyChain/sboms/${index}`);
+        assertReference(reference.artifact, `/supplyChain/sboms/${index}/artifact`);
+        if (!expectedArtifactSet.has(reference.artifact)) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/supplyChain/sboms/${index}/artifact`, 'must name a release artifact in the current manifest');
+        }
+        assertReference(reference.bindingId, `/supplyChain/sboms/${index}/bindingId`);
+        const expectedShape = {
+            'deployable-bundle': {
+                deploymentRelation: 'deployed-artifact',
+                inventoryScope: 'deployable-bundle-contents',
+            },
+            'nextjs-build-output': {
+                deploymentRelation: 'build-input',
+                inventoryScope: 'build-output-contents',
+            },
+            'oci-image': {
+                deploymentRelation: 'deployed-artifact',
+                inventoryScope: 'final-oci-contents',
+            },
+            'source-build-inputs': {
+                deploymentRelation: 'build-input',
+                inventoryScope: 'source-build-inputs',
+            },
+        }[reference.artifactFamily];
+        if (!expectedShape ||
+            reference.deploymentRelation !== expectedShape.deploymentRelation ||
+            reference.inventoryScope !== expectedShape.inventoryScope) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/supplyChain/sboms/${index}`, 'must distinguish build inputs from exact deployed-artifact evidence');
+        }
+        if (![
+            'source-build-inputs',
+            'build-output-contents',
+            'deployable-bundle-contents',
+            'final-oci-contents',
+        ].includes(reference.inventoryScope)) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/supplyChain/sboms/${index}/inventoryScope`, 'must state whether the SBOM covers source inputs, a build output, a deployable bundle, or final OCI contents');
+        }
+        assertRelativeEvidencePath(reference.path, `/supplyChain/sboms/${index}/path`);
+        assertDigest(reference.sha256, `/supplyChain/sboms/${index}/sha256`);
+        if (!/^urn:uuid:[a-f0-9-]{36}$/.test(reference.serialNumber)) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/supplyChain/sboms/${index}/serialNumber`, 'must identify one exact CycloneDX document');
+        }
+        return reference;
+    })
+        .sort((left, right) => compareStrings(left.artifact, right.artifact) ||
+        compareStrings(left.bindingId, right.bindingId));
+    const unsupportedArtifacts = input.unsupportedArtifacts
+        .map((unsupported, index) => {
+        if (!(0, validation_js_1.isRecord)(unsupported)) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/supplyChain/unsupportedArtifacts/${index}`, 'must be one deployed-artifact applicability record');
+        }
+        const applicability = unsupported;
+        assertOnlyKeys(applicability, ['artifact', 'family', 'reason'], `/supplyChain/unsupportedArtifacts/${index}`);
+        assertReference(applicability.artifact, `/supplyChain/unsupportedArtifacts/${index}/artifact`);
+        if (!expectedArtifactSet.has(applicability.artifact)) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/supplyChain/unsupportedArtifacts/${index}/artifact`, 'must name a release artifact in the current manifest');
+        }
+        if (applicability.family !== 'sst-provider-artifact' ||
+            typeof applicability.reason !== 'string' ||
+            applicability.reason.trim() !== applicability.reason ||
+            applicability.reason.length < 20) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/supplyChain/unsupportedArtifacts/${index}`, 'must honestly explain one unsupported deployed-artifact family');
+        }
+        return applicability;
+    })
+        .sort((left, right) => compareStrings(left.artifact, right.artifact));
+    const coveredArtifacts = [
+        ...sboms
+            .filter(({ deploymentRelation }) => deploymentRelation === 'deployed-artifact')
+            .map(({ artifact }) => artifact),
+        ...unsupportedArtifacts.map(({ artifact }) => artifact),
+    ].sort(compareStrings);
+    if (sboms.length === 0 ||
+        new Set(sboms.map(({ bindingId }) => bindingId)).size !== sboms.length ||
+        new Set(sboms.map(({ artifact, artifactFamily }) => JSON.stringify([artifact, artifactFamily]))).size !== sboms.length ||
+        new Set(unsupportedArtifacts.map(({ artifact }) => artifact)).size !==
+            unsupportedArtifacts.length ||
+        new Set(coveredArtifacts).size !== coveredArtifacts.length ||
+        coveredArtifacts.length !== expectedArtifacts.length ||
+        coveredArtifacts.some((artifact, index) => artifact !== expectedArtifacts[index])) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/supplyChain/sboms', 'must cover every release artifact exactly once with an exact deployed-artifact SBOM or an honest unsupported-family declaration');
+    }
+    return {
+        binding: { ...input.binding },
+        sboms,
+        unsupportedArtifacts,
+    };
+}
+function normalizeInput(input) {
+    assertOnlyKeys(input, [
+        'artifacts',
+        'blueprints',
+        'build',
+        'builtAt',
+        'configuration',
+        'contracts',
+        'controls',
+        'frameworkCandidate',
+        'infrastructure',
+        'migrations',
+        'packageLockDigest',
+        'projects',
+        'requiredTests',
+        'secrets',
+        'source',
+        'toolchain',
+    ], '');
+    assertOnlyKeys(input.build, ['provenanceDigest', 'runId', 'workflow'], '/build');
+    assertOnlyKeys(input.controls, ['digest', 'version'], '/controls');
+    assertOnlyKeys(input.infrastructure, [
+        'aggregateRisk',
+        'configurationMetadataDigest',
+        'materialDigest',
+        'policyProfileDigest',
+        'riskClasses',
+        'stage',
+        'tool',
+    ], '/infrastructure');
+    assertOnlyKeys(input.infrastructure.tool, ['name', 'version'], '/infrastructure/tool');
+    assertOnlyKeys(input.source, ['commit', 'repository', 'treeDigest'], '/source');
+    if (!isIsoInstant(input.builtAt) ||
+        !SOURCE_COMMIT.test(input.source.commit)) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/', 'build time and source identity must be exact');
+    }
+    assertDigest(input.source.treeDigest, '/source/treeDigest');
+    assertReference(input.source.repository, '/source/repository');
+    assertDigest(input.packageLockDigest, '/packageLockDigest');
+    assertDigest(input.infrastructure.configurationMetadataDigest, '/infrastructure/configurationMetadataDigest');
+    assertDigest(input.infrastructure.materialDigest, '/infrastructure/materialDigest');
+    assertDigest(input.infrastructure.policyProfileDigest, '/infrastructure/policyProfileDigest');
+    assertReference(input.infrastructure.tool.name, '/infrastructure/tool/name');
+    assertReference(input.infrastructure.tool.version, '/infrastructure/tool/version');
+    const riskClasses = [...new Set(input.infrastructure.riskClasses)].sort(compareStrings);
+    if (!exports.RELEASE_ARTIFACT_STAGES.includes(input.infrastructure.stage) ||
+        !model_js_1.INFRASTRUCTURE_RISK_CLASSES.includes(input.infrastructure.aggregateRisk) ||
+        riskClasses.length === 0 ||
+        riskClasses.some((riskClass) => !model_js_1.INFRASTRUCTURE_RISK_CLASSES.includes(riskClass)) ||
+        !riskClasses.includes(input.infrastructure.aggregateRisk)) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/infrastructure', 'must bind one protected stage to the exact assessed aggregate and normalized risk classes');
+    }
+    assertDigest(input.controls.digest, '/controls/digest');
+    assertDigest(input.build.provenanceDigest, '/build/provenanceDigest');
+    assertReference(input.frameworkCandidate, '/frameworkCandidate');
+    assertReference(input.controls.version, '/controls/version');
+    assertReference(input.build.runId, '/build/runId');
+    assertReference(input.build.workflow, '/build/workflow');
+    const projects = [...input.projects].sort(compareStrings);
+    if (projects.length === 0 ||
+        new Set(projects).size !== projects.length ||
+        projects.some((project) => !(0, safe_reference_1.isBoundedSafeReference)(project))) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/projects', 'must contain unique bounded project references');
+    }
+    const configuration = [...input.configuration].sort((left, right) => compareStrings(left.stage, right.stage));
+    configuration.forEach((entry, index) => assertOnlyKeys(entry, ['digest', 'stage'], `/configuration/${index}`));
+    if (configuration.length !== exports.RELEASE_ARTIFACT_STAGES.length ||
+        new Set(configuration.map(({ stage }) => stage)).size !==
+            configuration.length ||
+        configuration.some(({ digest: configurationDigest, stage }) => !exports.RELEASE_ARTIFACT_STAGES.includes(stage) ||
+            !SHA256.test(configurationDigest))) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/configuration', 'must bind one digest to each protected stage');
+    }
+    const normalizeVersioned = (entries, pointer) => {
+        const normalized = [...entries]
+            .sort((left, right) => compareStrings(left.name, right.name))
+            .map((entry, index) => {
+            assertOnlyKeys(entry, ['digest', 'name', 'version'], `${pointer}/${index}`);
+            assertReference(entry.name, `${pointer}/${index}/name`);
+            assertReference(entry.version, `${pointer}/${index}/version`);
+            assertDigest(entry.digest, `${pointer}/${index}/digest`);
+            return entry;
+        });
+        if (new Set(normalized.map(({ name }) => name)).size !== normalized.length) {
+            throw new ReleaseManifestError('release-manifest-invalid', pointer, 'names must be unique');
+        }
+        return normalized;
+    };
+    const secrets = [...input.secrets]
+        .sort((left, right) => compareStrings(left.logicalName, right.logicalName))
+        .map((secret, index) => {
+        assertOnlyKeys(secret, ['logicalName', 'ready', 'versionReference'], `/secrets/${index}`);
+        assertReference(secret.logicalName, `/secrets/${index}/logicalName`);
+        assertReference(secret.versionReference, `/secrets/${index}/versionReference`);
+        if (typeof secret.ready !== 'boolean') {
+            throw new ReleaseManifestError('release-manifest-invalid', `/secrets/${index}/ready`, 'must be boolean readiness metadata');
+        }
+        return secret;
+    });
+    if (new Set(secrets.map(({ logicalName }) => logicalName)).size !==
+        secrets.length) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/secrets', 'logical names must be unique');
+    }
+    const requiredTests = [...input.requiredTests]
+        .sort((left, right) => compareStrings(left.name, right.name))
+        .map((test, index) => {
+        assertOnlyKeys(test, ['evidenceDigest', 'name', 'outcome'], `/requiredTests/${index}`);
+        assertReference(test.name, `/requiredTests/${index}/name`);
+        assertDigest(test.evidenceDigest, `/requiredTests/${index}/evidenceDigest`);
+        if (!['passed', 'skipped'].includes(test.outcome)) {
+            throw new ReleaseManifestError('release-manifest-invalid', `/requiredTests/${index}/outcome`, 'must be passed or explicitly skipped');
+        }
+        return test;
+    });
+    if (requiredTests.length === 0 ||
+        new Set(requiredTests.map(({ name }) => name)).size !== requiredTests.length) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/requiredTests', 'test names must be unique');
+    }
+    return {
+        ...input,
+        artifacts: normalizeArtifacts(input.artifacts),
+        blueprints: normalizeRecord(input.blueprints, '/blueprints'),
+        configuration,
+        contracts: normalizeVersioned(input.contracts, '/contracts'),
+        infrastructure: {
+            ...input.infrastructure,
+            riskClasses,
+        },
+        migrations: normalizeVersioned(input.migrations, '/migrations'),
+        projects,
+        requiredTests,
+        secrets,
+        toolchain: normalizeRecord(input.toolchain, '/toolchain'),
+    };
+}
+function createReleaseManifest(input) {
+    const normalized = normalizeInput(input);
+    const materialDigest = digest(normalized);
+    return {
+        ...normalized,
+        initialLifecycle: {
+            at: normalized.builtAt,
+            state: 'built',
+        },
+        kind: exports.RELEASE_MANIFEST_KIND,
+        materialDigest,
+        releaseId: `release-${materialDigest.slice(0, 24)}`,
+        schemaVersion: exports.RELEASE_MANIFEST_SCHEMA_VERSION,
+    };
+}
+function bindReleaseManifestSupplyChain(manifest, evidence) {
+    const core = validateReleaseManifest(manifest);
+    return {
+        ...core,
+        supplyChain: normalizeSupplyChainEvidence(evidence, core.artifacts),
+    };
+}
+function validateReleaseManifest(manifest, expectation = {}) {
+    assertOnlyKeys(manifest, [
+        ...Object.keys(manifestInput(manifest)),
+        'initialLifecycle',
+        'kind',
+        'materialDigest',
+        'releaseId',
+        'schemaVersion',
+        ...(manifest.supplyChain === undefined ? [] : ['supplyChain']),
+    ], '');
+    if (Object.keys(manifest.initialLifecycle).some((key) => !['at', 'state'].includes(key)) ||
+        manifest.kind !== exports.RELEASE_MANIFEST_KIND ||
+        manifest.schemaVersion !== exports.RELEASE_MANIFEST_SCHEMA_VERSION ||
+        manifest.initialLifecycle.state !== 'built' ||
+        manifest.initialLifecycle.at !== manifest.builtAt) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/', 'must be an immutable v1 release manifest');
+    }
+    const rebuilt = createReleaseManifest(manifestInput(manifest));
+    if (manifest.materialDigest !== rebuilt.materialDigest ||
+        manifest.releaseId !== rebuilt.releaseId) {
+        throw new ReleaseManifestError('release-manifest-digest-mismatch', '/materialDigest', 'manifest content changed after identity was assigned');
+    }
+    const normalizedSupplyChain = manifest.supplyChain === undefined
+        ? undefined
+        : normalizeSupplyChainEvidence(manifest.supplyChain, rebuilt.artifacts);
+    if (normalizedSupplyChain !== undefined &&
+        canonicalize(normalizedSupplyChain) !== canonicalize(manifest.supplyChain)) {
+        throw new ReleaseManifestError('release-manifest-invalid', '/supplyChain', 'must use canonical artifact ordering');
+    }
+    const expectedConfiguration = expectation.configurationDigests ?? {};
+    const stale = (expectation.materialDigest !== undefined &&
+        expectation.materialDigest !== manifest.materialDigest) ||
+        (expectation.sourceCommit !== undefined &&
+            expectation.sourceCommit !== manifest.source.commit) ||
+        (expectation.requireSupplyChain === true &&
+            normalizedSupplyChain === undefined) ||
+        (expectation.supplyChainBindingDigest !== undefined &&
+            normalizedSupplyChain?.binding.materialDigest !==
+                expectation.supplyChainBindingDigest) ||
+        (expectation.infrastructureConfigurationMetadataDigest !== undefined &&
+            expectation.infrastructureConfigurationMetadataDigest !==
+                manifest.infrastructure.configurationMetadataDigest) ||
+        (expectation.infrastructureMaterialDigest !== undefined &&
+            expectation.infrastructureMaterialDigest !==
+                manifest.infrastructure.materialDigest) ||
+        (expectation.infrastructurePolicyProfileDigest !== undefined &&
+            expectation.infrastructurePolicyProfileDigest !==
+                manifest.infrastructure.policyProfileDigest) ||
+        (expectation.infrastructureRisk !== undefined &&
+            (expectation.infrastructureRisk.aggregate !==
+                manifest.infrastructure.aggregateRisk ||
+                expectation.infrastructureRisk.stage !==
+                    manifest.infrastructure.stage ||
+                canonicalize([...expectation.infrastructureRisk.classes].sort()) !==
+                    canonicalize(manifest.infrastructure.riskClasses))) ||
+        Object.entries(expectedConfiguration).some(([stage, expectedDigest]) => manifest.configuration.find((item) => item.stage === stage)?.digest !==
+            expectedDigest);
+    if (stale) {
+        throw new ReleaseManifestError('release-manifest-stale', '/', 'manifest does not match the current protected inputs');
+    }
+    return normalizedSupplyChain === undefined
+        ? manifest
+        : { ...manifest, supplyChain: normalizedSupplyChain };
+}
+//# sourceMappingURL=manifest.js.map

package/src/release/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../packages/nx/src/release/manifest.ts"],"names":[],"mappings":";;;AA22BA,sDAgBC;AAED,wEASC;AAED,0DAmGC;AA3+BD,+EAGoD;AACpD,+EAAoF;AACpF,gEAG2C;AAC3C,oDAA4C;AAE/B,QAAA,+BAA+B,GAAG,CAAU,CAAC;AAC7C,QAAA,qBAAqB,GAAG,sBAA+B,CAAC;AACxD,QAAA,0BAA0B,GAAG;IACxC,KAAK;IACL,QAAQ;IACR,SAAS;IACT,KAAK;CACG,CAAC;AACE,QAAA,uBAAuB,GAAG,CAAC,SAAS,EAAE,YAAY,CAAU,CAAC;AAmK1E,MAAa,oBAAqB,SAAQ,KAAK;IAElC;IACA;IAFX,YACW,cAAoD,EACpD,OAAe,EACxB,OAAe;QAEf,KAAK,CAAC,GAAG,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;QAJvB,mBAAc,GAAd,cAAc,CAAsC;QACpD,YAAO,GAAP,OAAO,CAAQ;QAIxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AATD,oDASC;AAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,MAAM,aAAa,GAAG,uDAAuD,CAAC;AAE9E,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,IAAA,8BAAa,EAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,IAAA,oCAAmB,EAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,QAA2B;IAChD,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,CACL,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC;QAChE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,OAAe;IAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,OAAO,EACP,oCAAoC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,OAAe;IACrD,IAAI,CAAC,IAAA,uCAAsB,EAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,OAAO,EACP,oCAAoC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa,EAAE,OAAe;IAChE,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,IACE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,IAAI,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,OAAO,EACP,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAA0B,EAC1B,OAAe;IAEf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAC5B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,0BAA0B,EAC9B,GAAG,OAAO,IAAI,GAAG,EAAE,EACnB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAAwC,EACxC,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC9D,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAC5B,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,eAAe,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC1C,eAAe,CAAC,KAAK,EAAE,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5C,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,oBAAoB,CAC5B,kCAAkC,EAClC,GAAG,OAAO,IAAI,GAAG,EAAE,EACnB,yDAAyD,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAiC;IAEjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC5B,yCAAyC,EACzC,YAAY,EACZ,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAmB,EAAE;QACxC,MAAM,OAAO,GAAG,cAAc,KAAK,EAAE,CAAC;QACtC,cAAc,CACZ,QAAQ,EACR,QAAQ,CAAC,cAAc,KAAK,eAAe;YACzC,CAAC,CAAC;gBACE,mBAAmB;gBACnB,gBAAgB;gBAChB,QAAQ;gBACR,MAAM;gBACN,oBAAoB;gBACpB,QAAQ;gBACR,UAAU;aACX;YACH,CAAC,CAAC;gBACE,mBAAmB;gBACnB,iBAAiB;gBACjB,gBAAgB;gBAChB,MAAM;gBACN,kBAAkB;gBAClB,QAAQ;gBACR,oBAAoB;gBACpB,UAAU;aACX,EACL,OAAO,CACR,CAAC;QACF,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;QAClD,IACE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC,kCAA0B,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACvD,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,yCAAyC,EACzC,OAAO,EACP,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,YAAY,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,OAAO,oBAAoB,CAAC,CAAC;QACzE,YAAY,CACV,QAAQ,CAAC,kBAAkB,EAC3B,GAAG,OAAO,qBAAqB,CAChC,CAAC;QACF,IAAI,QAAQ,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;YAChD,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,OAAO,SAAS,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClE,IACE,MAAM,CAAC,MAAM,KAAK,+BAAuB,CAAC,MAAM;gBAChD,+BAAuB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAChE,CAAC;gBACD,MAAM,IAAI,oBAAoB,CAC5B,yCAAyC,EACzC,GAAG,OAAO,SAAS,EACnB,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,cAAc,KAAK,gBAAgB,EAAE,CAAC;YACjD,YAAY,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAC;YACrE,IACE,QAAQ,CAAC,gBAAgB,KAAK,mBAAmB;gBACjD,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,EAClC,CAAC;gBACD,MAAM,IAAI,oBAAoB,CAC5B,yCAAyC,EACzC,GAAG,OAAO,SAAS,EACnB,uFAAuF,CACxF,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,yCAAyC,EACzC,GAAG,OAAO,iBAAiB,EAC3B,yCAAyC,CAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,4BAA4B,CACnC,KAAiC,EACjC,SAAqC;IAErC,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;QAChB,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC;QACxB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,cAAc,EACd,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,cAAc,CACZ,KAAK,EACL,CAAC,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC,EAC5C,cAAc,CACf,CAAC;IACF,cAAc,CACZ,KAAK,CAAC,OAAO,EACb,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,EACpC,sBAAsB,CACvB,CAAC;IACF,YAAY,CACV,KAAK,CAAC,OAAO,CAAC,cAAc,EAC5B,qCAAqC,CACtC,CAAC;IACF,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IAClE,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GAAG,SAAS;SAChC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,cAAc,CAAC,CAAC;IACxB,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK;SACtB,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,sBAAsB,KAAK,EAAE,EAC7B,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GACb,IAA8D,CAAC;QACjE,cAAc,CACZ,SAAS,EACT;YACE,UAAU;YACV,gBAAgB;YAChB,WAAW;YACX,oBAAoB;YACpB,gBAAgB;YAChB,MAAM;YACN,cAAc;YACd,QAAQ;SACT,EACD,sBAAsB,KAAK,EAAE,CAC9B,CAAC;QACF,eAAe,CACb,SAAS,CAAC,QAAQ,EAClB,sBAAsB,KAAK,WAAW,CACvC,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,sBAAsB,KAAK,WAAW,EACtC,sDAAsD,CACvD,CAAC;QACJ,CAAC;QACD,eAAe,CACb,SAAS,CAAC,SAAS,EACnB,sBAAsB,KAAK,YAAY,CACxC,CAAC;QACF,MAAM,aAAa,GAAG;YACpB,mBAAmB,EAAE;gBACnB,kBAAkB,EAAE,mBAAmB;gBACvC,cAAc,EAAE,4BAA4B;aAC7C;YACD,qBAAqB,EAAE;gBACrB,kBAAkB,EAAE,aAAa;gBACjC,cAAc,EAAE,uBAAuB;aACxC;YACD,WAAW,EAAE;gBACX,kBAAkB,EAAE,mBAAmB;gBACvC,cAAc,EAAE,oBAAoB;aACrC;YACD,qBAAqB,EAAE;gBACrB,kBAAkB,EAAE,aAAa;gBACjC,cAAc,EAAE,qBAAqB;aACtC;SACF,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC5B,IACE,CAAC,aAAa;YACd,SAAS,CAAC,kBAAkB,KAAK,aAAa,CAAC,kBAAkB;YACjE,SAAS,CAAC,cAAc,KAAK,aAAa,CAAC,cAAc,EACzD,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,sBAAsB,KAAK,EAAE,EAC7B,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IACE,CAAC;YACC,qBAAqB;YACrB,uBAAuB;YACvB,4BAA4B;YAC5B,oBAAoB;SACrB,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,sBAAsB,KAAK,iBAAiB,EAC5C,8GAA8G,CAC/G,CAAC;QACJ,CAAC;QACD,0BAA0B,CACxB,SAAS,CAAC,IAAI,EACd,sBAAsB,KAAK,OAAO,CACnC,CAAC;QACF,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,KAAK,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,sBAAsB,KAAK,eAAe,EAC1C,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;SACD,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC7C,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAClD,CAAC;IACJ,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB;SACpD,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE;QAC1B,IAAI,CAAC,IAAA,wBAAQ,EAAC,WAAW,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,qCAAqC,KAAK,EAAE,EAC5C,oDAAoD,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GACjB,WAAoF,CAAC;QACvF,cAAc,CACZ,aAAa,EACb,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAChC,qCAAqC,KAAK,EAAE,CAC7C,CAAC;QACF,eAAe,CACb,aAAa,CAAC,QAAQ,EACtB,qCAAqC,KAAK,WAAW,CACtD,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,qCAAqC,KAAK,WAAW,EACrD,sDAAsD,CACvD,CAAC;QACJ,CAAC;QACD,IACE,aAAa,CAAC,MAAM,KAAK,uBAAuB;YAChD,OAAO,aAAa,CAAC,MAAM,KAAK,QAAQ;YACxC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,aAAa,CAAC,MAAM;YACpD,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAChC,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,qCAAqC,KAAK,EAAE,EAC5C,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG;QACvB,GAAG,KAAK;aACL,MAAM,CACL,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,kBAAkB,KAAK,mBAAmB,CACvE;aACA,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;QAClC,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;KACxD,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvB,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACtE,IAAI,GAAG,CACL,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,CACzC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAC3C,CACF,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACvB,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAChE,oBAAoB,CAAC,MAAM;QAC7B,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,MAAM;QAC1D,gBAAgB,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;QACpD,gBAAgB,CAAC,IAAI,CACnB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,KAAK,iBAAiB,CAAC,KAAK,CAAC,CAC3D,EACD,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,oBAAoB,EACpB,iIAAiI,CAClI,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;QAC7B,KAAK;QACL,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAA2B;IACjD,cAAc,CACZ,KAAK,EACL;QACE,WAAW;QACX,YAAY;QACZ,OAAO;QACP,SAAS;QACT,eAAe;QACf,WAAW;QACX,UAAU;QACV,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,UAAU;QACV,eAAe;QACf,SAAS;QACT,QAAQ;QACR,WAAW;KACZ,EACD,EAAE,CACH,CAAC;IACF,cAAc,CACZ,KAAK,CAAC,KAAK,EACX,CAAC,kBAAkB,EAAE,OAAO,EAAE,UAAU,CAAC,EACzC,QAAQ,CACT,CAAC;IACF,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IACnE,cAAc,CACZ,KAAK,CAAC,cAAc,EACpB;QACE,eAAe;QACf,6BAA6B;QAC7B,gBAAgB;QAChB,qBAAqB;QACrB,aAAa;QACb,OAAO;QACP,MAAM;KACP,EACD,iBAAiB,CAClB,CAAC;IACF,cAAc,CACZ,KAAK,CAAC,cAAc,CAAC,IAAI,EACzB,CAAC,MAAM,EAAE,SAAS,CAAC,EACnB,sBAAsB,CACvB,CAAC;IACF,cAAc,CACZ,KAAK,CAAC,MAAM,EACZ,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,EACtC,SAAS,CACV,CAAC;IACF,IACE,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,GAAG,EACH,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAC5D,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAC/D,YAAY,CAAC,KAAK,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAC5D,YAAY,CACV,KAAK,CAAC,cAAc,CAAC,2BAA2B,EAChD,6CAA6C,CAC9C,CAAC;IACF,YAAY,CACV,KAAK,CAAC,cAAc,CAAC,cAAc,EACnC,gCAAgC,CACjC,CAAC;IACF,YAAY,CACV,KAAK,CAAC,cAAc,CAAC,mBAAmB,EACxC,qCAAqC,CACtC,CAAC;IACF,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IAC7E,eAAe,CACb,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EACjC,8BAA8B,CAC/B,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CACrE,cAAc,CACf,CAAC;IACF,IACE,CAAC,+BAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;QAC7D,CAAC,sCAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC;QACzE,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,WAAW,CAAC,IAAI,CACd,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,sCAA2B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAChE;QACD,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,iBAAiB,EACjB,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACxD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;IACtE,eAAe,CAAC,KAAK,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IACjE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7D,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnD,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1D,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAA,uCAAsB,EAAC,OAAO,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,WAAW,EACX,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClE,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CACxC,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACrC,cAAc,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,kBAAkB,KAAK,EAAE,CAAC,CACtE,CAAC;IACF,IACE,aAAa,CAAC,MAAM,KAAK,+BAAuB,CAAC,MAAM;QACvD,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YACnD,aAAa,CAAC,MAAM;QACtB,aAAa,CAAC,IAAI,CAChB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,CACzC,CAAC,+BAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxC,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CACpC,EACD,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,gBAAgB,EAChB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GAAG,CAGzB,OAAyB,EACzB,OAAe,EACG,EAAE;QACpB,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC;aAC5B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAC5D,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACpB,cAAc,CACZ,KAAK,EACL,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAC7B,GAAG,OAAO,IAAI,KAAK,EAAE,CACtB,CAAC;YACF,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC;YACxD,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC;YAC9D,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACL,IACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EACtE,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,OAAO,EACP,sBAAsB,CACvB,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;SAC/B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;SAC1E,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACrB,cAAc,CACZ,MAAM,EACN,CAAC,aAAa,EAAE,OAAO,EAAE,kBAAkB,CAAC,EAC5C,YAAY,KAAK,EAAE,CACpB,CAAC;QACF,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,KAAK,cAAc,CAAC,CAAC;QACrE,eAAe,CACb,MAAM,CAAC,gBAAgB,EACvB,YAAY,KAAK,mBAAmB,CACrC,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,YAAY,KAAK,QAAQ,EACzB,oCAAoC,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACL,IACE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QAC3D,OAAO,CAAC,MAAM,EACd,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,UAAU,EACV,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;SAC3C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnB,cAAc,CACZ,IAAI,EACJ,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC,EACrC,kBAAkB,KAAK,EAAE,CAC1B,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC;QAC3D,YAAY,CACV,IAAI,CAAC,cAAc,EACnB,kBAAkB,KAAK,iBAAiB,CACzC,CAAC;QACF,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,kBAAkB,KAAK,UAAU,EACjC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACL,IACE,aAAa,CAAC,MAAM,KAAK,CAAC;QAC1B,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAC5E,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9C,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC;QAC5D,aAAa;QACb,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC;QAC5D,cAAc,EAAE;YACd,GAAG,KAAK,CAAC,cAAc;YACvB,WAAW;SACZ;QACD,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC;QAC/D,QAAQ;QACR,aAAa;QACb,OAAO;QACP,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CACnC,KAA2B;IAE3B,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,UAAU;QACb,gBAAgB,EAAE;YAChB,EAAE,EAAE,UAAU,CAAC,OAAO;YACtB,KAAK,EAAE,OAAO;SACf;QACD,IAAI,EAAE,6BAAqB;QAC3B,cAAc;QACd,SAAS,EAAE,WAAW,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACnD,aAAa,EAAE,uCAA+B;KAC/C,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAC5C,QAA2B,EAC3B,QAAoC;IAEpC,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CACrC,QAA2B,EAC3B,cAA0C,EAAE;IAE5C,cAAc,CACZ,QAAQ,EACR;QACE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,kBAAkB;QAClB,MAAM;QACN,gBAAgB;QAChB,WAAW;QACX,eAAe;QACf,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;KAC/D,EACD,EAAE,CACH,CAAC;IACF,IACE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CACxC;QACD,QAAQ,CAAC,IAAI,KAAK,6BAAqB;QACvC,QAAQ,CAAC,aAAa,KAAK,uCAA+B;QAC1D,QAAQ,CAAC,gBAAgB,CAAC,KAAK,KAAK,OAAO;QAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,EACjD,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,GAAG,EACH,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,IACE,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAClD,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EACxC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,kCAAkC,EAClC,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GACzB,QAAQ,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5E,IACE,qBAAqB,KAAK,SAAS;QACnC,YAAY,CAAC,qBAAqB,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,cAAc,EACd,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GAAG,WAAW,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACrE,MAAM,KAAK,GACT,CAAC,WAAW,CAAC,cAAc,KAAK,SAAS;QACvC,WAAW,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC;QACzD,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS;YACrC,WAAW,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACtD,CAAC,WAAW,CAAC,kBAAkB,KAAK,IAAI;YACtC,qBAAqB,KAAK,SAAS,CAAC;QACtC,CAAC,WAAW,CAAC,wBAAwB,KAAK,SAAS;YACjD,qBAAqB,EAAE,OAAO,CAAC,cAAc;gBAC3C,WAAW,CAAC,wBAAwB,CAAC;QACzC,CAAC,WAAW,CAAC,yCAAyC,KAAK,SAAS;YAClE,WAAW,CAAC,yCAAyC;gBACnD,QAAQ,CAAC,cAAc,CAAC,2BAA2B,CAAC;QACxD,CAAC,WAAW,CAAC,4BAA4B,KAAK,SAAS;YACrD,WAAW,CAAC,4BAA4B;gBACtC,QAAQ,CAAC,cAAc,CAAC,cAAc,CAAC;QAC3C,CAAC,WAAW,CAAC,iCAAiC,KAAK,SAAS;YAC1D,WAAW,CAAC,iCAAiC;gBAC3C,QAAQ,CAAC,cAAc,CAAC,mBAAmB,CAAC;QAChD,CAAC,WAAW,CAAC,kBAAkB,KAAK,SAAS;YAC3C,CAAC,WAAW,CAAC,kBAAkB,CAAC,SAAS;gBACvC,QAAQ,CAAC,cAAc,CAAC,aAAa;gBACrC,WAAW,CAAC,kBAAkB,CAAC,KAAK;oBAClC,QAAQ,CAAC,cAAc,CAAC,KAAK;gBAC/B,YAAY,CAAC,CAAC,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC9D,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACxC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,EAAE,CAC1B,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,MAAM;YACnE,cAAc,CACjB,CAAC;IACJ,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC5B,wBAAwB,EACxB,GAAG,EACH,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,KAAK,SAAS;QACxC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;AAC1D,CAAC"}