@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/secrets/verification.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretStaticVerificationError = void 0;
+exports.verifySliceSecretStaticContract = verifySliceSecretStaticContract;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const guardrails_js_1 = require("./guardrails.js");
+const registry_js_1 = require("./registry.js");
+const workload_access_js_1 = require("./workload-access.js");
+const supportedSourceExtension = /(?:\.(?:[cm]?[jt]sx?|bash|env(?:\.[^/]+)?|json|sh|toml|ya?ml|zsh)|(?:^|\.)env(?:\.[^/]+)?)$/i;
+const ignoredDirectoryNames = new Set([
+    '.git',
+    '.next',
+    '.sst',
+    'build',
+    'coverage',
+    'dist',
+    'node_modules',
+]);
+const maximumSourceBytes = 2 * 1024 * 1024;
+class SecretStaticVerificationError extends Error {
+    code;
+    constructor(code) {
+        super(`Secret static verification failed (${code}).`);
+        this.name = 'SecretStaticVerificationError';
+        this.code = code;
+    }
+}
+exports.SecretStaticVerificationError = SecretStaticVerificationError;
+function isContained(root, candidate) {
+    const path = (0, node_path_1.relative)(root, candidate);
+    return path === '' || (!path.startsWith(`..${node_path_1.sep}`) && path !== '..');
+}
+function surfaceFor(path, source) {
+    const normalized = path.replace(/\\/g, '/');
+    if (normalized.startsWith('.github/workflows/'))
+        return 'workflow';
+    if (normalized === 'sst.config.ts' ||
+        normalized.startsWith('infra/') ||
+        normalized.includes('/infra/')) {
+        return 'generated-infrastructure';
+    }
+    if (/^\s*['"]use client['"];?/m.test(source) ||
+        /(?:^|\/)(?:public|static)(?:\/|$)/.test(normalized) ||
+        /\.(?:client|browser)\.[cm]?[jt]sx?$/i.test(normalized)) {
+        return 'client';
+    }
+    return 'server';
+}
+async function collectSourceFiles(projectRoot, directory, declaredSecretNames) {
+    const result = [];
+    const entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
+    for (const entry of entries.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name))) {
+        if (entry.isDirectory() && ignoredDirectoryNames.has(entry.name))
+            continue;
+        const unresolved = (0, node_path_1.resolve)(directory, entry.name);
+        const metadata = await (0, promises_1.lstat)(unresolved);
+        if (metadata.isSymbolicLink()) {
+            throw new SecretStaticVerificationError('secret-static-source-invalid');
+        }
+        const candidate = await (0, promises_1.realpath)(unresolved);
+        if (!isContained(projectRoot, candidate)) {
+            throw new SecretStaticVerificationError('secret-static-source-invalid');
+        }
+        if (metadata.isDirectory()) {
+            result.push(...(await collectSourceFiles(projectRoot, candidate, declaredSecretNames)));
+            continue;
+        }
+        if (!metadata.isFile() || !supportedSourceExtension.test(entry.name)) {
+            continue;
+        }
+        if (metadata.size > maximumSourceBytes) {
+            throw new SecretStaticVerificationError('secret-static-source-invalid');
+        }
+        const source = await (0, promises_1.readFile)(candidate, 'utf8');
+        const path = (0, node_path_1.relative)(projectRoot, candidate).replace(/\\/g, '/');
+        result.push({
+            ...(path === 'scripts/remove-personal-secrets.mjs'
+                ? { allowFrameworkPersonalSstRemove: true }
+                : {}),
+            ...(['jobs/bootstrap-database.mjs', 'jobs/retire-database.mjs'].includes(path)
+                ? { allowFrameworkSecretProviderClient: true }
+                : {}),
+            ...(path === 'infra/personal-secrets.ts'
+                ? { allowFrameworkPersonalSstSecret: true }
+                : {}),
+            declaredSecretNames,
+            path,
+            source,
+            surface: surfaceFor(path, source),
+        });
+    }
+    return result;
+}
+/**
+ * Scans the actual Product Slice sources used by build and deploy. The
+ * verifier follows no symlinks and deliberately ignores build/cache output so
+ * an alternate source tree cannot hide a forbidden secret path.
+ */
+async function verifySliceSecretStaticContract(input) {
+    if (!(0, node_path_1.isAbsolute)(input.projectRoot)) {
+        throw new SecretStaticVerificationError('secret-static-input-invalid');
+    }
+    let projectRoot;
+    try {
+        projectRoot = await (0, promises_1.realpath)(input.projectRoot);
+    }
+    catch {
+        throw new SecretStaticVerificationError('secret-static-input-invalid');
+    }
+    let registry;
+    let access;
+    try {
+        registry = (0, registry_js_1.parseSecretMetadataRegistry)(JSON.parse(await (0, promises_1.readFile)((0, node_path_1.resolve)(projectRoot, registry_js_1.SECRET_METADATA_REGISTRY_PATH), 'utf8')));
+        access = (0, workload_access_js_1.parseSecretWorkloadAccessRegistry)(JSON.parse(await (0, promises_1.readFile)((0, node_path_1.resolve)(projectRoot, workload_access_js_1.SECRET_WORKLOAD_ACCESS_REGISTRY_PATH), 'utf8')));
+    }
+    catch {
+        throw new SecretStaticVerificationError('secret-static-registry-invalid');
+    }
+    const declaredSecretNames = Object.freeze(registry.declarations.map(({ logicalName }) => logicalName));
+    const declared = new Set(declaredSecretNames);
+    if (access.bindings.some(({ logicalName }) => !declared.has(logicalName))) {
+        throw new SecretStaticVerificationError('secret-static-registry-invalid');
+    }
+    const files = await collectSourceFiles(projectRoot, projectRoot, declaredSecretNames);
+    const issues = [
+        ...(0, guardrails_js_1.inspectSecretStaticFiles)(files),
+        ...(0, guardrails_js_1.inspectClientSecretImportGraph)(files),
+    ].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path) ||
+        left.line - right.line ||
+        (0, deterministic_order_js_1.compareUtf16)(left.code, right.code));
+    return Object.freeze({
+        filesInspected: files.length,
+        issues,
+        valid: issues.length === 0,
+    });
+}
+//# sourceMappingURL=verification.js.map

package/src/secrets/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/verification.ts"],"names":[],"mappings":";;;AA6IA,0EA6DC;AA1MD,sEAAyD;AACzD,+CAAsE;AACtE,yCAA+D;AAE/D,mDAMyB;AACzB,+CAGuB;AACvB,6DAG8B;AAE9B,MAAM,wBAAwB,GAC5B,8FAA8F,CAAC;AACjG,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,UAAU;IACV,MAAM;IACN,cAAc;CACf,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAQ3C,MAAa,6BAA8B,SAAQ,KAAK;IAC7C,IAAI,CAGsB;IAEnC,YAAY,IAA2C;QACrD,KAAK,CAAC,sCAAsC,IAAI,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAXD,sEAWC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,eAAG,EAAE,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,OAAO,UAAU,CAAC;IACnE,IACE,UAAU,KAAK,eAAe;QAC9B,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC/B,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC9B,CAAC;QACD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IACE,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC;QACxC,mCAAmC,CAAC,IAAI,CAAC,UAAU,CAAC;QACpD,sCAAsC,CAAC,IAAI,CAAC,UAAU,CAAC,EACvD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,SAAiB,EACjB,mBAAsC;IAEtC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/C,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CACpC,EAAE,CAAC;QACF,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3E,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAK,EAAC,UAAU,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,6BAA6B,CAAC,8BAA8B,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAA,mBAAQ,EAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,6BAA6B,CAAC,8BAA8B,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,MAAM,kBAAkB,CAC1B,WAAW,EACX,SAAS,EACT,mBAAmB,CACpB,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;YACvC,MAAM,IAAI,6BAA6B,CAAC,8BAA8B,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAQ,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,WAAW,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,CAAC,IAAI,KAAK,qCAAqC;gBAChD,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,CAAC,6BAA6B,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CACtE,IAAI,CACL;gBACC,CAAC,CAAC,EAAE,kCAAkC,EAAE,IAAI,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,KAAK,2BAA2B;gBACtC,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,mBAAmB;YACnB,IAAI;YACJ,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,+BAA+B,CAAC,KAErD;IACC,IAAI,CAAC,IAAA,sBAAU,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,6BAA6B,CAAC,6BAA6B,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAA,mBAAQ,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,CAAC,6BAA6B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,QAAwD,CAAC;IAC7D,IAAI,MAA4D,CAAC;IACjE,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,yCAA2B,EACpC,IAAI,CAAC,KAAK,CACR,MAAM,IAAA,mBAAQ,EACZ,IAAA,mBAAO,EAAC,WAAW,EAAE,2CAA6B,CAAC,EACnD,MAAM,CACP,CACS,CACb,CAAC;QACF,MAAM,GAAG,IAAA,sDAAiC,EACxC,IAAI,CAAC,KAAK,CACR,MAAM,IAAA,mBAAQ,EACZ,IAAA,mBAAO,EAAC,WAAW,EAAE,yDAAoC,CAAC,EAC1D,MAAM,CACP,CACS,CACb,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,CAAC,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CACvC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAC5D,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,6BAA6B,CAAC,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,WAAW,EACX,WAAW,EACX,mBAAmB,CACpB,CAAC;IACF,MAAM,MAAM,GAAG;QACb,GAAG,IAAA,wCAAwB,EAAC,KAAK,CAAC;QAClC,GAAG,IAAA,8CAA8B,EAAC,KAAK,CAAC;KACzC,CAAC,IAAI,CACJ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;QACtB,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CACtC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC"}

package/src/secrets/workload-access.d.ts

@@ -0,0 +1,46 @@
+import { type WorkloadSecretPermissionIntent, type WorkloadSecretReferenceInput } from './permissions.js';
+import { type SecretMetadataDeclaration } from './model.js';
+export declare const SECRET_WORKLOAD_ACCESS_REGISTRY_PATH: "secrets/workload-access.json";
+export declare const SECRET_WORKLOAD_ACCESS_SCHEMA_VERSION: 1;
+export interface SecretWorkloadAccessBinding {
+    logicalName: string;
+    workload: string;
+}
+export interface SecretWorkloadAccessRegistry {
+    bindings: readonly SecretWorkloadAccessBinding[];
+    schemaVersion: typeof SECRET_WORKLOAD_ACCESS_SCHEMA_VERSION;
+}
+export interface SecretWorkloadAccessPlanEntry {
+    intent: WorkloadSecretPermissionIntent;
+    references: readonly WorkloadSecretReferenceInput[];
+    workload: string;
+}
+export declare class SecretWorkloadAccessError extends Error {
+    readonly code: 'secret-workload-access-invalid' | 'secret-workload-reference-invalid';
+    constructor(code: SecretWorkloadAccessError['code']);
+}
+export declare function parseSecretWorkloadAccessRegistry(value: unknown): SecretWorkloadAccessRegistry;
+/**
+ * Rejects a structurally valid registry when any binding names a workload
+ * outside the caller's exact linkable topology.
+ */
+export declare function validateSecretWorkloadAccessTargets(input: {
+    access: SecretWorkloadAccessRegistry;
+    allowedWorkloads: readonly string[];
+}): SecretWorkloadAccessRegistry;
+/**
+ * Joins adopter-owned workload access to the exact observed ARNs used by the
+ * workload-role candidate. No prefix or wildcard is accepted.
+ */
+export declare function createSecretWorkloadAccessPlan(input: {
+    access: SecretWorkloadAccessRegistry;
+    declarations: readonly SecretMetadataDeclaration[];
+    references: readonly WorkloadSecretReferenceInput[];
+    stage: string;
+}): readonly SecretWorkloadAccessPlanEntry[];
+export declare function personalSecretNamesForWorkload(input: {
+    access: SecretWorkloadAccessRegistry;
+    declarations: readonly SecretMetadataDeclaration[];
+    stage: 'development';
+    workload: string;
+}): readonly string[];

package/src/secrets/workload-access.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretWorkloadAccessError = exports.SECRET_WORKLOAD_ACCESS_SCHEMA_VERSION = exports.SECRET_WORKLOAD_ACCESS_REGISTRY_PATH = void 0;
+exports.parseSecretWorkloadAccessRegistry = parseSecretWorkloadAccessRegistry;
+exports.validateSecretWorkloadAccessTargets = validateSecretWorkloadAccessTargets;
+exports.createSecretWorkloadAccessPlan = createSecretWorkloadAccessPlan;
+exports.personalSecretNamesForWorkload = personalSecretNamesForWorkload;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const permissions_js_1 = require("./permissions.js");
+const model_js_1 = require("./model.js");
+exports.SECRET_WORKLOAD_ACCESS_REGISTRY_PATH = 'secrets/workload-access.json';
+exports.SECRET_WORKLOAD_ACCESS_SCHEMA_VERSION = 1;
+class SecretWorkloadAccessError extends Error {
+    code;
+    constructor(code) {
+        super(`Secret workload access failed (${code}).`);
+        this.name = 'SecretWorkloadAccessError';
+        this.code = code;
+    }
+}
+exports.SecretWorkloadAccessError = SecretWorkloadAccessError;
+const logicalNamePattern = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+const workloadPattern = /^[a-z0-9](?:[a-z0-9._-]{0,126}[a-z0-9])?$/;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseSecretWorkloadAccessRegistry(value) {
+    if (!isRecord(value) ||
+        Object.keys(value).some((key) => key !== 'bindings' && key !== 'schemaVersion') ||
+        value['schemaVersion'] !== exports.SECRET_WORKLOAD_ACCESS_SCHEMA_VERSION ||
+        !Array.isArray(value['bindings'])) {
+        throw new SecretWorkloadAccessError('secret-workload-access-invalid');
+    }
+    const identities = new Set();
+    const bindings = value['bindings']
+        .map((binding) => {
+        if (!isRecord(binding) ||
+            Object.keys(binding).some((key) => key !== 'logicalName' && key !== 'workload') ||
+            typeof binding['logicalName'] !== 'string' ||
+            !logicalNamePattern.test(binding['logicalName']) ||
+            typeof binding['workload'] !== 'string' ||
+            !workloadPattern.test(binding['workload'])) {
+            throw new SecretWorkloadAccessError('secret-workload-access-invalid');
+        }
+        const identity = `${binding['workload']}\0${binding['logicalName']}`;
+        if (identities.has(identity)) {
+            throw new SecretWorkloadAccessError('secret-workload-access-invalid');
+        }
+        identities.add(identity);
+        return Object.freeze({
+            logicalName: binding['logicalName'],
+            workload: binding['workload'],
+        });
+    })
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.workload, right.workload) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.logicalName, right.logicalName));
+    return Object.freeze({
+        bindings: Object.freeze(bindings),
+        schemaVersion: exports.SECRET_WORKLOAD_ACCESS_SCHEMA_VERSION,
+    });
+}
+/**
+ * Rejects a structurally valid registry when any binding names a workload
+ * outside the caller's exact linkable topology.
+ */
+function validateSecretWorkloadAccessTargets(input) {
+    const access = parseSecretWorkloadAccessRegistry(input.access);
+    const allowedWorkloads = new Set();
+    for (const workload of input.allowedWorkloads) {
+        if (!workloadPattern.test(workload) || allowedWorkloads.has(workload)) {
+            throw new SecretWorkloadAccessError('secret-workload-access-invalid');
+        }
+        allowedWorkloads.add(workload);
+    }
+    if (access.bindings.some(({ workload }) => !allowedWorkloads.has(workload))) {
+        throw new SecretWorkloadAccessError('secret-workload-access-invalid');
+    }
+    return access;
+}
+function declaredByName(declarations) {
+    const result = new Map();
+    for (const declaration of declarations) {
+        try {
+            (0, model_js_1.validateSecretMetadataDeclaration)(declaration);
+        }
+        catch {
+            throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
+        }
+        if (result.has(declaration.logicalName)) {
+            throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
+        }
+        result.set(declaration.logicalName, declaration);
+    }
+    return result;
+}
+/**
+ * Joins adopter-owned workload access to the exact observed ARNs used by the
+ * workload-role candidate. No prefix or wildcard is accepted.
+ */
+function createSecretWorkloadAccessPlan(input) {
+    if (!(0, model_js_1.isSecretCanonicalStage)(input.stage)) {
+        throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
+    }
+    const access = parseSecretWorkloadAccessRegistry(input.access);
+    const declarations = declaredByName(input.declarations);
+    const activeBindings = access.bindings.filter(({ logicalName }) => declarations.get(logicalName)?.requiredStages.includes(input.stage));
+    if (access.bindings.some(({ logicalName }) => !declarations.has(logicalName))) {
+        throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
+    }
+    const references = new Map();
+    for (const reference of input.references) {
+        if (references.has(reference.logicalName)) {
+            throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
+        }
+        references.set(reference.logicalName, reference);
+    }
+    const byWorkload = new Map();
+    for (const binding of activeBindings) {
+        const declaration = declarations.get(binding.logicalName);
+        const reference = references.get(binding.logicalName);
+        if (declaration?.source !== 'operator' ||
+            reference?.logicalName !== declaration.logicalName) {
+            throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
+        }
+        const workload = byWorkload.get(binding.workload) ?? [];
+        workload.push(reference);
+        byWorkload.set(binding.workload, workload);
+    }
+    if (references.size !==
+        new Set(activeBindings.map(({ logicalName }) => logicalName)).size) {
+        throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
+    }
+    return Object.freeze([...byWorkload.entries()]
+        .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
+        .map(([workload, workloadReferences]) => {
+        const sortedReferences = Object.freeze([...workloadReferences].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalName, right.logicalName)));
+        return Object.freeze({
+            intent: (0, permissions_js_1.createWorkloadSecretPermissionIntent)({
+                references: sortedReferences,
+                workload,
+            }),
+            references: sortedReferences,
+            workload,
+        });
+    }));
+}
+function personalSecretNamesForWorkload(input) {
+    const access = parseSecretWorkloadAccessRegistry(input.access);
+    const declarations = declaredByName(input.declarations);
+    return Object.freeze(access.bindings
+        .filter(({ workload }) => workload === input.workload)
+        .flatMap(({ logicalName }) => {
+        const declaration = declarations.get(logicalName);
+        if (!declaration || declaration.source !== 'operator') {
+            throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
+        }
+        return declaration.requiredStages.includes(input.stage)
+            ? [logicalName]
+            : [];
+    })
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left, right)));
+}
+//# sourceMappingURL=workload-access.js.map

package/src/secrets/workload-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-access.js","sourceRoot":"","sources":["../../../../../packages/nx/src/secrets/workload-access.ts"],"names":[],"mappings":";;;AAkDA,8EA+CC;AAMD,kFAgBC;AAwBD,wEAiEC;AAED,wEAwBC;AA1OD,sEAAyD;AACzD,qDAI0B;AAC1B,yCAIoB;AAEP,QAAA,oCAAoC,GAC/C,8BAAuC,CAAC;AAC7B,QAAA,qCAAqC,GAAG,CAAU,CAAC;AAkBhE,MAAa,yBAA0B,SAAQ,KAAK;IACzC,IAAI,CAC4D;IAEzE,YAAY,IAAuC;QACjD,KAAK,CAAC,kCAAkC,IAAI,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,8DASC;AAED,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,iCAAiC,CAC/C,KAAc;IAEd,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,eAAe,CACvD;QACD,KAAK,CAAC,eAAe,CAAC,KAAK,6CAAqC;QAChE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC;SAC/B,GAAG,CAAC,CAAC,OAAO,EAA+B,EAAE;QAC5C,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,UAAU,CACrD;YACD,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,QAAQ;YAC1C,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,QAAQ;YACvC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC;YACnC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC;SACD,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAA,qCAAY,EAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC3C,IAAA,qCAAY,EAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CACpD,CAAC;IACJ,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,aAAa,EAAE,6CAAqC;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,mCAAmC,CAAC,KAGnD;IACC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC9C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,YAAkD;IAElD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC5D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,IAAA,4CAAiC,EAAC,WAAW,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,8BAA8B,CAAC,KAK9C;IACC,IAAI,CAAC,IAAA,iCAAsB,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAChE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CACpE,CAAC;IACF,IACE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwC,CAAC;IACnE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;QAC3E,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0C,CAAC;IACrE,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtD,IACE,WAAW,EAAE,MAAM,KAAK,UAAU;YAClC,SAAS,EAAE,WAAW,KAAK,WAAW,CAAC,WAAW,EAClD,CAAC;YACD,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,IACE,UAAU,CAAC,IAAI;QACf,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAClE,CAAC;QACD,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;SACtB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,EAAE;QACtC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CACpC,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3C,IAAA,qCAAY,EAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAClD,CACF,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,IAAA,qDAAoC,EAAC;gBAC3C,UAAU,EAAE,gBAAgB;gBAC5B,QAAQ;aACT,CAAC;YACF,UAAU,EAAE,gBAAgB;YAC5B,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,QAAQ;SACZ,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;SACrD,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;QAC3B,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CACjC,mCAAmC,CACpC,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;YACrD,CAAC,CAAC,CAAC,WAAW,CAAC;YACf,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACpD,CAAC;AACJ,CAAC"}

package/src/supply-chain/action-pins.d.ts

@@ -0,0 +1,26 @@
+export declare const ACTION_PIN_INVENTORY_SCHEMA_VERSION: 1;
+export interface ActionPinInventoryEntry {
+    action: string;
+    scope: 'both' | 'consumer' | 'framework';
+    sha: string;
+    tag: string;
+}
+export interface ActionPinInventory {
+    actions: Readonly<Record<string, ActionPinInventoryEntry>>;
+    containers?: Readonly<Record<string, ContainerPinInventoryEntry>>;
+    schemaVersion: typeof ACTION_PIN_INVENTORY_SCHEMA_VERSION;
+}
+export interface ContainerPinInventoryEntry {
+    image: string;
+    scope: ActionPinInventoryEntry['scope'];
+    sha: string;
+    tag: string;
+}
+export interface ActionPinUse {
+    action: string;
+    file: string;
+    kind: 'container' | 'github-action';
+    reference: string;
+    sha: string;
+}
+export declare function verifyActionPinInventory(files: Readonly<Record<string, string>>, inventory: ActionPinInventory, scope: ActionPinInventoryEntry['scope']): readonly ActionPinUse[];

package/src/supply-chain/action-pins.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTION_PIN_INVENTORY_SCHEMA_VERSION = void 0;
+exports.verifyActionPinInventory = verifyActionPinInventory;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const yaml_1 = require("yaml");
+const errors_js_1 = require("./errors.js");
+exports.ACTION_PIN_INVENTORY_SCHEMA_VERSION = 1;
+const GITHUB_ACTION_SHA = /^[a-f0-9]{40}$/;
+const ACTION_REFERENCE = /^(?<action>[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_./-]+)?)@(?<sha>[a-f0-9]{40})$/;
+const CONTAINER_REFERENCE = /^(?:docker:\/\/)?(?<image>[a-z0-9][a-z0-9._/-]*):(?<tag>[A-Za-z0-9._-]+)@sha256:(?<sha>[a-f0-9]{64})$/;
+function findUses(value, uses) {
+    if (Array.isArray(value)) {
+        value.forEach((entry) => findUses(entry, uses));
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (key === 'uses' && typeof child === 'string') {
+            uses.push(child);
+        }
+        else {
+            findUses(child, uses);
+        }
+    }
+}
+function workflowContainerReferences(document, path) {
+    if (!document || typeof document !== 'object' || Array.isArray(document)) {
+        return [];
+    }
+    const jobs = document['jobs'];
+    if (!jobs || typeof jobs !== 'object' || Array.isArray(jobs))
+        return [];
+    const references = [];
+    for (const [jobName, jobValue] of Object.entries(jobs)) {
+        if (!jobValue || typeof jobValue !== 'object' || Array.isArray(jobValue)) {
+            continue;
+        }
+        const job = jobValue;
+        if (Object.prototype.hasOwnProperty.call(job, 'container')) {
+            const container = job['container'];
+            const image = typeof container === 'string'
+                ? container
+                : container &&
+                    typeof container === 'object' &&
+                    !Array.isArray(container)
+                    ? container['image']
+                    : undefined;
+            if (typeof image !== 'string') {
+                throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `jobs.${jobName}.container must declare one exact reviewed image`);
+            }
+            references.push(image);
+        }
+        const services = job['services'];
+        if (services === undefined)
+            continue;
+        if (!services || typeof services !== 'object' || Array.isArray(services)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `jobs.${jobName}.services must be a static service map`);
+        }
+        for (const [serviceName, serviceValue] of Object.entries(services)) {
+            const image = serviceValue &&
+                typeof serviceValue === 'object' &&
+                !Array.isArray(serviceValue)
+                ? serviceValue['image']
+                : undefined;
+            if (typeof image !== 'string') {
+                throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `jobs.${jobName}.services.${serviceName}.image must be one exact reviewed image`);
+            }
+            references.push(image);
+        }
+    }
+    return references;
+}
+function assertReadableTagAnnotation(source, reference, tag, path) {
+    const lines = source.split(/\r?\n/);
+    const references = lines.filter((line) => line.includes(reference));
+    const annotated = references.every((line) => {
+        const usesIndex = line.indexOf(reference);
+        const comment = line.slice(usesIndex + reference.length).trim();
+        return comment === `# ${tag}`;
+    });
+    if (references.length === 0 || !annotated) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-inventory-drift', path, `${reference} must retain the exact human-readable annotation "# ${tag}"`);
+    }
+}
+function verifyActionPinInventory(files, inventory, scope) {
+    if (inventory.schemaVersion !== exports.ACTION_PIN_INVENTORY_SCHEMA_VERSION) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'actions-pins.json#schemaVersion', 'must equal 1');
+    }
+    const expected = new Map();
+    for (const [key, pin] of Object.entries(inventory.actions)) {
+        if (!pin ||
+            typeof pin !== 'object' ||
+            !/^[A-Za-z][A-Za-z0-9]*$/.test(key) ||
+            !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_./-]+)?$/.test(pin.action) ||
+            !GITHUB_ACTION_SHA.test(pin.sha) ||
+            typeof pin.tag !== 'string' ||
+            !/^v?[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(pin.tag) ||
+            !['both', 'consumer', 'framework'].includes(pin.scope) ||
+            expected.has(pin.action)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `actions-pins.json#actions.${key}`, 'must uniquely bind an action to a full commit SHA, readable tag, and scope');
+        }
+        expected.set(pin.action, pin);
+    }
+    const expectedContainers = new Map();
+    for (const [key, pin] of Object.entries(inventory.containers ?? {})) {
+        if (!pin ||
+            typeof pin !== 'object' ||
+            !/^[A-Za-z][A-Za-z0-9]*$/.test(key) ||
+            !/^[a-z0-9][a-z0-9._/-]*$/.test(pin.image) ||
+            !/^[a-f0-9]{64}$/.test(pin.sha) ||
+            typeof pin.tag !== 'string' ||
+            !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(pin.tag) ||
+            !['both', 'consumer', 'framework'].includes(pin.scope) ||
+            expectedContainers.has(pin.image)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `actions-pins.json#containers.${key}`, 'must uniquely bind a container image to a readable tag, SHA-256 digest, and scope');
+        }
+        expectedContainers.set(pin.image, pin);
+    }
+    const found = new Map();
+    for (const [path, source] of Object.entries(files).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))) {
+        if (!/\.ya?ml$/i.test(path))
+            continue;
+        let document;
+        try {
+            document = (0, yaml_1.parse)(source);
+        }
+        catch (error) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, `cannot parse workflow or composite action: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const uses = [];
+        findUses(document, uses);
+        const executableReferences = [
+            ...uses,
+            ...workflowContainerReferences(document, path),
+        ];
+        for (const reference of executableReferences) {
+            if (reference.startsWith('./')) {
+                throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `${reference} is a repository-local action, which the v1 exact pin inventory does not admit`);
+            }
+            const container = CONTAINER_REFERENCE.exec(reference);
+            if (reference.startsWith('docker://') || container) {
+                if (!container?.groups) {
+                    throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `${reference} must pin a container digest`);
+                }
+                if (reference.includes('${{')) {
+                    throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `${reference} is a dynamic executable input`);
+                }
+                const image = container.groups['image'] ?? '';
+                const tag = container.groups['tag'] ?? '';
+                const sha = container.groups['sha'] ?? '';
+                const pin = expectedContainers.get(image);
+                if (!pin ||
+                    (pin.scope !== 'both' && pin.scope !== scope) ||
+                    pin.tag !== tag ||
+                    pin.sha !== sha) {
+                    throw new errors_js_1.SupplyChainError('supply-chain-action-inventory-drift', path, `${reference} is not the reviewed ${scope} container pin`);
+                }
+                found.set(`docker://${image}`, {
+                    action: `docker://${image}`,
+                    file: path,
+                    kind: 'container',
+                    reference,
+                    sha,
+                });
+                continue;
+            }
+            if (reference.includes('${{')) {
+                throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `${reference} is a dynamic executable input`);
+            }
+            const parsed = ACTION_REFERENCE.exec(reference);
+            if (!parsed?.groups) {
+                throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `${reference} must pin a full GitHub commit SHA`);
+            }
+            const action = parsed.groups['action'] ?? '';
+            const sha = parsed.groups['sha'] ?? '';
+            const pin = expected.get(action);
+            if (!pin ||
+                (pin.scope !== 'both' && pin.scope !== scope) ||
+                pin.sha !== sha) {
+                throw new errors_js_1.SupplyChainError('supply-chain-action-inventory-drift', path, `${reference} is not the reviewed ${scope} pin`);
+            }
+            assertReadableTagAnnotation(source, reference, pin.tag, path);
+            found.set(action, {
+                action,
+                file: path,
+                kind: 'github-action',
+                reference,
+                sha,
+            });
+        }
+    }
+    for (const pin of expectedContainers.values()) {
+        if ((pin.scope === 'both' || pin.scope === scope) &&
+            !found.has(`docker://${pin.image}`)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-action-inventory-drift', 'actions-pins.json', `${pin.image}:${pin.tag}@sha256:${pin.sha} is declared for ${scope} but unused`);
+        }
+    }
+    for (const pin of expected.values()) {
+        if ((pin.scope === 'both' || pin.scope === scope) &&
+            !found.has(pin.action)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-action-inventory-drift', 'actions-pins.json', `${pin.action}@${pin.sha} is declared for ${scope} but unused`);
+        }
+    }
+    return [...found.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.action}\0${left.file}`, `${right.action}\0${right.file}`));
+}
+//# sourceMappingURL=action-pins.js.map

package/src/supply-chain/action-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-pins.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/action-pins.ts"],"names":[],"mappings":";;;AA4IA,4DAuMC;AAnVD,sEAAyD;AACzD,+BAA0C;AAE1C,2CAA+C;AAElC,QAAA,mCAAmC,GAAG,CAAU,CAAC;AAC9D,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,gBAAgB,GACpB,2FAA2F,CAAC;AAC9F,MAAM,mBAAmB,GACvB,uGAAuG,CAAC;AA8B1G,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAc;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAiB,EACjB,IAAY;IAEZ,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAI,QAAoC,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACxE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,QAAmC,CAAC;QAChD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;YACnC,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ;gBAC3B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,SAAS;oBACP,OAAO,SAAS,KAAK,QAAQ;oBAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;oBAC3B,CAAC,CAAE,SAAqC,CAAC,OAAO,CAAC;oBACjD,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,4BAAgB,CACxB,8BAA8B,EAC9B,IAAI,EACJ,QAAQ,OAAO,kDAAkD,CAClE,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,4BAAgB,CACxB,8BAA8B,EAC9B,IAAI,EACJ,QAAQ,OAAO,wCAAwC,CACxD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,GACT,YAAY;gBACZ,OAAO,YAAY,KAAK,QAAQ;gBAChC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;gBAC1B,CAAC,CAAE,YAAwC,CAAC,OAAO,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,4BAAgB,CACxB,8BAA8B,EAC9B,IAAI,EACJ,QAAQ,OAAO,aAAa,WAAW,yCAAyC,CACjF,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,2BAA2B,CAClC,MAAc,EACd,SAAiB,EACjB,GAAW,EACX,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,OAAO,OAAO,KAAK,KAAK,GAAG,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,4BAAgB,CACxB,qCAAqC,EACrC,IAAI,EACJ,GAAG,SAAS,uDAAuD,GAAG,GAAG,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAuC,EACvC,SAA6B,EAC7B,KAAuC;IAEvC,IAAI,SAAS,CAAC,aAAa,KAAK,2CAAmC,EAAE,CAAC;QACpE,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,iCAAiC,EACjC,cAAc,CACf,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IACE,CAAC,GAAG;YACJ,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;YACnC,CAAC,2DAA2D,CAAC,IAAI,CAC/D,GAAG,CAAC,MAAM,CACX;YACD,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,CAAC,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YACtD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACxB,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,6BAA6B,GAAG,EAAE,EAClC,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAsC,CAAC;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IACE,CAAC,GAAG;YACJ,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;YACnC,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAC1C,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC/B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACnD,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YACtD,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EACjC,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,gCAAgC,GAAG,EAAE,EACrC,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC1E,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAC1B,EAAE,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAA,YAAS,EAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,IAAI,EACJ,8CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,oBAAoB,GAAG;YAC3B,GAAG,IAAI;YACP,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC;SAC/C,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC7C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,4BAAgB,CACxB,8BAA8B,EAC9B,IAAI,EACJ,GAAG,SAAS,gFAAgF,CAC7F,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;oBACvB,MAAM,IAAI,4BAAgB,CACxB,8BAA8B,EAC9B,IAAI,EACJ,GAAG,SAAS,8BAA8B,CAC3C,CAAC;gBACJ,CAAC;gBACD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,4BAAgB,CACxB,8BAA8B,EAC9B,IAAI,EACJ,GAAG,SAAS,gCAAgC,CAC7C,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC1C,IACE,CAAC,GAAG;oBACJ,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC;oBAC7C,GAAG,CAAC,GAAG,KAAK,GAAG;oBACf,GAAG,CAAC,GAAG,KAAK,GAAG,EACf,CAAC;oBACD,MAAM,IAAI,4BAAgB,CACxB,qCAAqC,EACrC,IAAI,EACJ,GAAG,SAAS,wBAAwB,KAAK,gBAAgB,CAC1D,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE;oBAC7B,MAAM,EAAE,YAAY,KAAK,EAAE;oBAC3B,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,WAAW;oBACjB,SAAS;oBACT,GAAG;iBACJ,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,4BAAgB,CACxB,8BAA8B,EAC9B,IAAI,EACJ,GAAG,SAAS,gCAAgC,CAC7C,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,4BAAgB,CACxB,8BAA8B,EAC9B,IAAI,EACJ,GAAG,SAAS,oCAAoC,CACjD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjC,IACE,CAAC,GAAG;gBACJ,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC;gBAC7C,GAAG,CAAC,GAAG,KAAK,GAAG,EACf,CAAC;gBACD,MAAM,IAAI,4BAAgB,CACxB,qCAAqC,EACrC,IAAI,EACJ,GAAG,SAAS,wBAAwB,KAAK,MAAM,CAChD,CAAC;YACJ,CAAC;YACD,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC9D,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;gBAChB,MAAM;gBACN,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,eAAe;gBACrB,SAAS;gBACT,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IACE,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC;YAC7C,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,KAAK,EAAE,CAAC,EACnC,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,qCAAqC,EACrC,mBAAmB,EACnB,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,WAAW,GAAG,CAAC,GAAG,oBAAoB,KAAK,aAAa,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IACE,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC;YAC7C,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACtB,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,qCAAqC,EACrC,mBAAmB,EACnB,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,oBAAoB,KAAK,aAAa,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9C,IAAA,qCAAY,EACV,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,EAC9B,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,EAAE,CACjC,CACF,CAAC;AACJ,CAAC"}