@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/policy.d.ts

@@ -0,0 +1,105 @@
+import { type SupplyChainSupportedPlatform } from './inventory.js';
+export declare const SUPPLY_CHAIN_POLICY_SCHEMA_VERSION: 1;
+export declare const SUPPLY_CHAIN_SCANNER_RESULT_SCHEMA_VERSION: 2;
+export declare const SUPPLY_CHAIN_EXCEPTION_MAX_DAYS = 90;
+export declare const SUPPLY_CHAIN_SEVERITIES: readonly ["critical", "high", "medium", "low", "unknown"];
+export declare const SUPPLY_CHAIN_EXPOSURES: readonly ["exposed", "reachable", "not-reachable", "unknown"];
+export type SupplyChainSeverity = (typeof SUPPLY_CHAIN_SEVERITIES)[number];
+export type SupplyChainExposure = (typeof SUPPLY_CHAIN_EXPOSURES)[number];
+export interface VulnerabilityFinding {
+    affectedRange: string;
+    component: {
+        name: string;
+        purl: string;
+        scope: 'build' | 'deployed' | 'development' | 'runtime' | 'test' | 'unknown';
+        version: string;
+    };
+    detectedAt: string;
+    exposure: SupplyChainExposure;
+    fixVersion?: string;
+    id: string;
+    releases: readonly string[];
+    severity: SupplyChainSeverity;
+    slices: readonly string[];
+    source: string;
+    status: 'open' | 'resolved';
+}
+export interface LicenseFinding {
+    applicablePlatforms: readonly SupplyChainSupportedPlatform[];
+    component: {
+        name: string;
+        purl: string;
+        version: string;
+    };
+    current: string;
+    previous?: string;
+    source: 'installed-package' | 'lockfile-only';
+    usage: 'build' | 'distributed' | 'internal-runtime' | 'test';
+}
+export interface SupplyChainException {
+    approvedAt: string;
+    approver: string;
+    category: 'license' | 'lifecycle-script' | 'vulnerability';
+    compensatingControls: readonly string[];
+    exactComponent: string;
+    expiresAt: string;
+    id: string;
+    owner: string;
+    reason: string;
+    recheckTriggers: readonly string[];
+    subject: string;
+    workItem: string;
+}
+export interface LicensePolicy {
+    allow: readonly string[];
+    deny: readonly string[];
+    review: readonly string[];
+    schemaVersion: typeof SUPPLY_CHAIN_POLICY_SCHEMA_VERSION;
+}
+export interface VulnerabilityPolicy {
+    block: {
+        critical: readonly SupplyChainExposure[];
+        high: readonly SupplyChainExposure[];
+        low: readonly SupplyChainExposure[];
+        medium: readonly SupplyChainExposure[];
+        unknown: readonly SupplyChainExposure[];
+    };
+    schemaVersion: typeof SUPPLY_CHAIN_POLICY_SCHEMA_VERSION;
+}
+export interface ScannerResult {
+    coverage: readonly ('container' | 'npm' | 'vendored-source')[];
+    resultSetDigest: string;
+    scannedAt: string;
+    schemaVersion: typeof SUPPLY_CHAIN_SCANNER_RESULT_SCHEMA_VERSION;
+    status: 'complete' | 'partial' | 'unavailable';
+    tool: string;
+    version: string;
+}
+export interface SupplyChainPolicyEvaluation {
+    decision: 'allow' | 'deny';
+    exceptions: readonly {
+        expiresAt: string;
+        id: string;
+        subject: string;
+    }[];
+    findings: readonly {
+        category: 'license-change' | 'license-denied' | 'license-incomplete' | 'license-review' | 'scanner' | 'vulnerability';
+        component?: string;
+        exceptionId?: string;
+        id: string;
+        message: string;
+        outcome: 'allowed' | 'denied' | 'excepted';
+    }[];
+    schemaVersion: typeof SUPPLY_CHAIN_POLICY_SCHEMA_VERSION;
+}
+export declare function evaluateSupplyChainPolicy(input: {
+    exceptions: readonly SupplyChainException[];
+    licenses: readonly LicenseFinding[];
+    licensePolicy: LicensePolicy;
+    now: string;
+    protected: boolean;
+    requiredScannerCoverage: ScannerResult['coverage'];
+    scanner: ScannerResult;
+    vulnerabilities: readonly VulnerabilityFinding[];
+    vulnerabilityPolicy: VulnerabilityPolicy;
+}): SupplyChainPolicyEvaluation;

package/src/supply-chain/policy.js

@@ -0,0 +1,301 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPPLY_CHAIN_EXPOSURES = exports.SUPPLY_CHAIN_SEVERITIES = exports.SUPPLY_CHAIN_EXCEPTION_MAX_DAYS = exports.SUPPLY_CHAIN_SCANNER_RESULT_SCHEMA_VERSION = exports.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION = void 0;
+exports.evaluateSupplyChainPolicy = evaluateSupplyChainPolicy;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const validation_js_1 = require("../validation.js");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+const license_expression_js_1 = require("./license-expression.js");
+const inventory_js_1 = require("./inventory.js");
+exports.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION = 1;
+exports.SUPPLY_CHAIN_SCANNER_RESULT_SCHEMA_VERSION = 2;
+exports.SUPPLY_CHAIN_EXCEPTION_MAX_DAYS = 90;
+exports.SUPPLY_CHAIN_SEVERITIES = [
+    'critical',
+    'high',
+    'medium',
+    'low',
+    'unknown',
+];
+exports.SUPPLY_CHAIN_EXPOSURES = [
+    'exposed',
+    'reachable',
+    'not-reachable',
+    'unknown',
+];
+const SUPPLY_CHAIN_COMPONENT_VERSION = /^[A-Za-z0-9][A-Za-z0-9.+:~_-]{0,127}$/;
+function exactKeys(value, keys) {
+    return (JSON.stringify(Object.keys(value).sort()) ===
+        JSON.stringify([...keys].sort()));
+}
+function canonicalTimestamp(value, path) {
+    const timestamp = Date.parse(value);
+    if (!Number.isFinite(timestamp) ||
+        new Date(timestamp).toISOString() !== value) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be a canonical ISO-8601 timestamp');
+    }
+    return timestamp;
+}
+function validateException(value, index, now) {
+    const path = `exceptions[${index}]`;
+    if (!(0, validation_js_1.isRecord)(value) ||
+        !['license', 'lifecycle-script', 'vulnerability'].includes(value.category) ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(value.id) ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(value.subject) ||
+        !/^pkg:(?:apk|deb|generic|npm|oci)\/[A-Za-z0-9.%_@/+~-]+@[A-Za-z0-9.%+_:~-]+/.test(value.exactComponent) ||
+        [value.approver, value.owner, value.reason, value.workItem].some((entry) => typeof entry !== 'string' ||
+            entry.trim() === '' ||
+            entry !== entry.trim()) ||
+        !Array.isArray(value.compensatingControls) ||
+        value.compensatingControls.length === 0 ||
+        !Array.isArray(value.recheckTriggers) ||
+        value.recheckTriggers.length === 0 ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(value)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be an attributable, exact-component, credential-free exception');
+    }
+    const approvedAt = canonicalTimestamp(value.approvedAt, `${path}.approvedAt`);
+    const expiresAt = canonicalTimestamp(value.expiresAt, `${path}.expiresAt`);
+    if (expiresAt <= approvedAt ||
+        expiresAt - approvedAt >
+            exports.SUPPLY_CHAIN_EXCEPTION_MAX_DAYS * 24 * 60 * 60 * 1_000) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}.expiresAt`, `must be after approval and within ${exports.SUPPLY_CHAIN_EXCEPTION_MAX_DAYS} days`);
+    }
+    if (expiresAt <= now) {
+        throw new errors_js_1.SupplyChainError('supply-chain-exception-expired', `${path}.expiresAt`, 'reviewed exception has expired');
+    }
+}
+function validateVulnerability(finding, index) {
+    const path = `vulnerabilities[${index}]`;
+    if (!(0, validation_js_1.isRecord)(finding) ||
+        !(0, validation_js_1.isRecord)(finding.component) ||
+        !exactKeys(finding.component, ['name', 'purl', 'scope', 'version']) ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(finding.id) ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(finding.component.name) ||
+        !SUPPLY_CHAIN_COMPONENT_VERSION.test(finding.component.version) ||
+        !/^pkg:(?:apk|deb|generic|npm)\/[A-Za-z0-9.%_@/+~-]+@[A-Za-z0-9.%+_:~-]+$/.test(finding.component.purl) ||
+        ![
+            'build',
+            'deployed',
+            'development',
+            'runtime',
+            'test',
+            'unknown',
+        ].includes(finding.component.scope) ||
+        !exports.SUPPLY_CHAIN_SEVERITIES.includes(finding.severity) ||
+        !exports.SUPPLY_CHAIN_EXPOSURES.includes(finding.exposure) ||
+        !['open', 'resolved'].includes(finding.status) ||
+        typeof finding.affectedRange !== 'string' ||
+        finding.affectedRange.trim() === '' ||
+        typeof finding.source !== 'string' ||
+        finding.source.trim() === '' ||
+        !Array.isArray(finding.releases) ||
+        !Array.isArray(finding.slices) ||
+        finding.releases.length > 100 ||
+        finding.slices.length > 100 ||
+        [...finding.releases, ...finding.slices].some((identity) => typeof identity !== 'string' || !common_js_1.SUPPLY_CHAIN_REFERENCE.test(identity)) ||
+        new Set(finding.releases).size !== finding.releases.length ||
+        new Set(finding.slices).size !== finding.slices.length ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(finding)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be a normalized, exact-component vulnerability finding');
+    }
+    canonicalTimestamp(finding.detectedAt, `${path}.detectedAt`);
+    if (finding.fixVersion !== undefined &&
+        !SUPPLY_CHAIN_COMPONENT_VERSION.test(finding.fixVersion)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}.fixVersion`, 'must be an exact semantic version when present');
+    }
+}
+function validateLicense(finding, index) {
+    const path = `licenses[${index}]`;
+    if (!(0, validation_js_1.isRecord)(finding) ||
+        !exactKeys(finding, [
+            'applicablePlatforms',
+            'component',
+            'current',
+            ...(finding.previous === undefined ? [] : ['previous']),
+            'source',
+            'usage',
+        ]) ||
+        !(0, validation_js_1.isRecord)(finding.component) ||
+        !exactKeys(finding.component, ['name', 'purl', 'version']) ||
+        !Array.isArray(finding.applicablePlatforms) ||
+        finding.applicablePlatforms.some((platform) => !inventory_js_1.SUPPLY_CHAIN_SUPPORTED_PLATFORMS.includes(platform)) ||
+        new Set(finding.applicablePlatforms).size !==
+            finding.applicablePlatforms.length ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(finding.component.name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(finding.component.version) ||
+        !finding.component.purl.startsWith('pkg:npm/') ||
+        typeof finding.current !== 'string' ||
+        finding.current.trim() === '' ||
+        (finding.previous !== undefined &&
+            (typeof finding.previous !== 'string' ||
+                finding.previous.trim() === '')) ||
+        !['installed-package', 'lockfile-only'].includes(finding.source) ||
+        !['build', 'distributed', 'internal-runtime', 'test'].includes(finding.usage) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(finding)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must bind a package version and usage to a license identifier');
+    }
+    for (const [field, value] of [
+        ['current', finding.current],
+        ...(finding.previous === undefined
+            ? []
+            : [['previous', finding.previous]]),
+    ]) {
+        let normalized;
+        try {
+            normalized = (0, license_expression_js_1.normalizeSpdxLicenseExpression)(value);
+        }
+        catch {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}.${field}`, 'must be a valid SPDX license expression');
+        }
+        if (normalized !== value) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}.${field}`, 'must use the canonical SPDX license expression');
+        }
+    }
+}
+function validateLicensePolicy(policy) {
+    if (policy.schemaVersion !== exports.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION ||
+        !Array.isArray(policy.allow) ||
+        !Array.isArray(policy.deny) ||
+        !Array.isArray(policy.review)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'licensePolicy', 'must use the v1 allow/review/deny contract');
+    }
+    const all = [...policy.allow, ...policy.review, ...policy.deny];
+    if (all.some((entry) => typeof entry !== 'string' ||
+        !/^(?:[A-Za-z0-9-.+]+|LicenseRef-[A-Za-z0-9-.]+)$/.test(entry)) ||
+        new Set(all).size !== all.length) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'licensePolicy', 'license classes must be disjoint SPDX identifiers or LicenseRef values');
+    }
+}
+function validateVulnerabilityPolicy(policy) {
+    if (policy.schemaVersion !== exports.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION ||
+        !(0, validation_js_1.isRecord)(policy.block)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'vulnerabilityPolicy', 'must use the v1 severity/exposure contract');
+    }
+    for (const severity of exports.SUPPLY_CHAIN_SEVERITIES) {
+        const exposures = policy.block[severity];
+        if (!Array.isArray(exposures) ||
+            exposures.some((exposure) => !exports.SUPPLY_CHAIN_EXPOSURES.includes(exposure)) ||
+            new Set(exposures).size !== exposures.length) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `vulnerabilityPolicy.block.${severity}`, 'must be a unique exposure list');
+        }
+    }
+}
+function exceptionFor(exceptions, category, subject, exactComponent) {
+    return exceptions.find((exception) => exception.category === category &&
+        exception.subject === subject &&
+        exception.exactComponent === exactComponent);
+}
+function evaluateSupplyChainPolicy(input) {
+    const now = canonicalTimestamp(input.now, 'now');
+    validateLicensePolicy(input.licensePolicy);
+    validateVulnerabilityPolicy(input.vulnerabilityPolicy);
+    const ids = new Set();
+    input.exceptions.forEach((exception, index) => {
+        validateException(exception, index, now);
+        if (ids.has(exception.id)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `exceptions[${index}].id`, 'must be unique');
+        }
+        ids.add(exception.id);
+    });
+    input.vulnerabilities.forEach(validateVulnerability);
+    input.licenses.forEach(validateLicense);
+    const findings = [];
+    if (!(0, validation_js_1.isRecord)(input.scanner) ||
+        !exactKeys(input.scanner, [
+            'coverage',
+            'resultSetDigest',
+            'scannedAt',
+            'schemaVersion',
+            'status',
+            'tool',
+            'version',
+        ]) ||
+        !['complete', 'partial', 'unavailable'].includes(input.scanner.status) ||
+        input.scanner.schemaVersion !==
+            exports.SUPPLY_CHAIN_SCANNER_RESULT_SCHEMA_VERSION ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.scanner.resultSetDigest) ||
+        typeof input.scanner.tool !== 'string' ||
+        input.scanner.tool.trim() === '' ||
+        typeof input.scanner.version !== 'string' ||
+        input.scanner.version.trim() === '' ||
+        !Array.isArray(input.scanner.coverage)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'scanner', 'must identify the exact scanner, scanned result set, status, and coverage');
+    }
+    canonicalTimestamp(input.scanner.scannedAt, 'scanner.scannedAt');
+    const coverageMissing = input.requiredScannerCoverage.filter((ecosystem) => !input.scanner.coverage.includes(ecosystem));
+    if (input.scanner.status !== 'complete' || coverageMissing.length > 0) {
+        const denied = input.protected;
+        findings.push({
+            category: 'scanner',
+            id: 'scanner-coverage',
+            message: input.scanner.status === 'unavailable'
+                ? 'The vulnerability scanner was unavailable.'
+                : `Scanner coverage is incomplete${coverageMissing.length ? ` for ${coverageMissing.join(', ')}` : ''}.`,
+            outcome: denied ? 'denied' : 'allowed',
+        });
+        if (denied) {
+            throw new errors_js_1.SupplyChainError('supply-chain-scanner-unavailable', 'scanner', findings[0]?.message ?? 'scanner coverage is incomplete');
+        }
+    }
+    for (const vulnerability of input.vulnerabilities) {
+        if (vulnerability.status === 'resolved')
+            continue;
+        const exactComponent = vulnerability.component.purl;
+        const exception = exceptionFor(input.exceptions, 'vulnerability', vulnerability.id, exactComponent);
+        const blocked = input.vulnerabilityPolicy.block[vulnerability.severity].includes(vulnerability.exposure);
+        findings.push({
+            category: 'vulnerability',
+            component: exactComponent,
+            ...(exception ? { exceptionId: exception.id } : {}),
+            id: vulnerability.id,
+            message: `${vulnerability.severity} ${vulnerability.exposure} finding in ${vulnerability.component.name}@${vulnerability.component.version}`,
+            outcome: blocked ? (exception ? 'excepted' : 'denied') : 'allowed',
+        });
+    }
+    for (const [index, license] of input.licenses.entries()) {
+        if (license.applicablePlatforms.length === 0)
+            continue;
+        const exactComponent = license.component.purl;
+        if (license.source === 'lockfile-only') {
+            findings.push({
+                category: 'license-incomplete',
+                component: exactComponent,
+                id: `license-incomplete-${index}`,
+                message: `License metadata is absent for applicable supported platforms (${license.applicablePlatforms.join(', ')}) for ${license.component.name}@${license.component.version}`,
+                outcome: input.protected ? 'denied' : 'allowed',
+            });
+            continue;
+        }
+        const subject = `license:${license.current}`;
+        const exception = exceptionFor(input.exceptions, 'license', subject, exactComponent);
+        const changed = license.previous !== undefined && license.previous !== license.current;
+        const licenseDecision = (0, license_expression_js_1.evaluateSpdxLicenseExpression)(license.current, input.licensePolicy);
+        const denied = licenseDecision === 'deny';
+        const review = changed || licenseDecision === 'review';
+        if (!denied && !review)
+            continue;
+        findings.push({
+            category: denied
+                ? 'license-denied'
+                : changed
+                    ? 'license-change'
+                    : 'license-review',
+            component: exactComponent,
+            ...(exception ? { exceptionId: exception.id } : {}),
+            id: `license-${index}`,
+            message: `${license.current} requires ${denied ? 'denial' : 'owner review'} for ${license.component.name}@${license.component.version}`,
+            outcome: exception ? 'excepted' : 'denied',
+        });
+    }
+    const denied = findings.some(({ outcome }) => outcome === 'denied');
+    return {
+        decision: denied ? 'deny' : 'allow',
+        exceptions: input.exceptions
+            .map(({ expiresAt, id, subject }) => ({ expiresAt, id, subject }))
+            .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.id, right.id)),
+        findings: findings.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.category}\0${left.id}`, `${right.category}\0${right.id}`)),
+        schemaVersion: exports.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION,
+    };
+}
+//# sourceMappingURL=policy.js.map

package/src/supply-chain/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/policy.ts"],"names":[],"mappings":";;;AAqaA,8DAsKC;AA3kBD,sEAAyD;AACzD,oDAA4C;AAC5C,2CAMqB;AACrB,2CAA+C;AAC/C,mEAGiC;AACjC,iDAGwB;AAEX,QAAA,kCAAkC,GAAG,CAAU,CAAC;AAChD,QAAA,0CAA0C,GAAG,CAAU,CAAC;AACxD,QAAA,+BAA+B,GAAG,EAAE,CAAC;AACrC,QAAA,uBAAuB,GAAG;IACrC,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,SAAS;CACD,CAAC;AACE,QAAA,sBAAsB,GAAG;IACpC,SAAS;IACT,WAAW;IACX,eAAe;IACf,SAAS;CACD,CAAC;AACX,MAAM,8BAA8B,GAAG,uCAAuC,CAAC;AAyG/E,SAAS,SAAS,CAAC,KAAa,EAAE,IAAuB;IACvD,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAC3C,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,IAAI,EACJ,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2B,EAC3B,KAAa,EACb,GAAW;IAEX,MAAM,IAAI,GAAG,cAAc,KAAK,GAAG,CAAC;IACpC,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;QAChB,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC,QAAQ,CACxD,KAAK,CAAC,QAAQ,CACf;QACD,CAAC,kCAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,CAAC,kCAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3C,CAAC,4EAA4E,CAAC,IAAI,CAChF,KAAK,CAAC,cAAc,CACrB;QACD,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC9D,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YACnB,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,CACzB;QACD,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC1C,KAAK,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACrC,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAClC,IAAA,wCAA4B,EAAC,KAAK,CAAC,EACnC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,IAAI,EACJ,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IAC3E,IACE,SAAS,IAAI,UAAU;QACvB,SAAS,GAAG,UAAU;YACpB,uCAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EACxD,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,GAAG,IAAI,YAAY,EACnB,qCAAqC,uCAA+B,OAAO,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,4BAAgB,CACxB,gCAAgC,EAChC,GAAG,IAAI,YAAY,EACnB,gCAAgC,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA6B,EAC7B,KAAa;IAEb,MAAM,IAAI,GAAG,mBAAmB,KAAK,GAAG,CAAC;IACzC,IACE,CAAC,IAAA,wBAAQ,EAAC,OAAO,CAAC;QAClB,CAAC,IAAA,wBAAQ,EAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnE,CAAC,kCAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,CAAC,kCAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;QACpD,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QAC/D,CAAC,yEAAyE,CAAC,IAAI,CAC7E,OAAO,CAAC,SAAS,CAAC,IAAI,CACvB;QACD,CAAC;YACC,OAAO;YACP,UAAU;YACV,aAAa;YACb,SAAS;YACT,MAAM;YACN,SAAS;SACV,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;QACnC,CAAC,+BAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnD,CAAC,8BAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClD,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9C,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE;QACnC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG;QAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;QAC3B,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC3C,CAAC,QAAQ,EAAE,EAAE,CACX,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,kCAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACzE;QACD,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;QAC1D,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM;QACtD,IAAA,wCAA4B,EAAC,OAAO,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,IAAI,EACJ,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;IAC7D,IACE,OAAO,CAAC,UAAU,KAAK,SAAS;QAChC,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,GAAG,IAAI,aAAa,EACpB,gDAAgD,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAuB,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,YAAY,KAAK,GAAG,CAAC;IAClC,IACE,CAAC,IAAA,wBAAQ,EAAC,OAAO,CAAC;QAClB,CAAC,SAAS,CAAC,OAAO,EAAE;YAClB,qBAAqB;YACrB,WAAW;YACX,SAAS;YACT,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACvD,QAAQ;YACR,OAAO;SACR,CAAC;QACF,CAAC,IAAA,wBAAQ,EAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAC3C,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAC9B,CAAC,QAAQ,EAAE,EAAE,CACX,CAAE,+CAAsD,CAAC,QAAQ,CAC/D,QAAQ,CACT,CACJ;QACD,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI;YACvC,OAAO,CAAC,mBAAmB,CAAC,MAAM;QACpC,CAAC,qCAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;QACvD,CAAC,sCAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QAC3D,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9C,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAC7B,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;YAC7B,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC,QAAQ,CAC5D,OAAO,CAAC,KAAK,CACd;QACD,IAAA,wCAA4B,EAAC,OAAO,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAW,CAAC;KACxC,EAAE,CAAC;QACX,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,IAAA,sDAA8B,EAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,GAAG,IAAI,IAAI,KAAK,EAAE,EAClB,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,GAAG,IAAI,IAAI,KAAK,EAAE,EAClB,gDAAgD,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAqB;IAClD,IACE,MAAM,CAAC,aAAa,KAAK,0CAAkC;QAC3D,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,eAAe,EACf,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAChE,IACE,GAAG,CAAC,IAAI,CACN,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,iDAAiD,CAAC,IAAI,CAAC,KAAK,CAAC,CACjE;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAChC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,eAAe,EACf,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,MAA2B;IAC9D,IACE,MAAM,CAAC,aAAa,KAAK,0CAAkC;QAC3D,CAAC,IAAA,wBAAQ,EAAC,MAAM,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,qBAAqB,EACrB,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,+BAAuB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,IAAI,CACZ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,8BAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACzD;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAC5C,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,6BAA6B,QAAQ,EAAE,EACvC,gCAAgC,CACjC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,UAA2C,EAC3C,QAA0C,EAC1C,OAAe,EACf,cAAsB;IAEtB,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,QAAQ,KAAK,QAAQ;QAC/B,SAAS,CAAC,OAAO,KAAK,OAAO;QAC7B,SAAS,CAAC,cAAc,KAAK,cAAc,CAC9C,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CAAC,KAUzC;IACC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3C,2BAA2B,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QAC5C,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,cAAc,KAAK,MAAM,EACzB,gBAAgB,CACjB,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACrD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAsD,EAAE,CAAC;IACvE,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,OAAO,CAAC;QACxB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE;YACxB,UAAU;YACV,iBAAiB;YACjB,WAAW;YACX,eAAe;YACf,QAAQ;YACR,MAAM;YACN,SAAS;SACV,CAAC;QACF,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtE,KAAK,CAAC,OAAO,CAAC,aAAa;YACzB,kDAA0C;QAC5C,CAAC,+BAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QACxD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAChC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ;QACzC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QACnC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,SAAS,EACT,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAC1D,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC3D,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,SAAS;YACnB,EAAE,EAAE,kBAAkB;YACtB,OAAO,EACL,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa;gBACpC,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,iCACE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAClE,GAAG;YACT,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACvC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,4BAAgB,CACxB,kCAAkC,EAClC,SAAS,EACT,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gCAAgC,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,aAAa,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC;QACpD,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAK,CAAC,UAAU,EAChB,eAAe,EACf,aAAa,CAAC,EAAE,EAChB,cAAc,CACf,CAAC;QACF,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAC7C,aAAa,CAAC,QAAQ,CACvB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,cAAc;YACzB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,eAAe,aAAa,CAAC,SAAS,CAAC,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE;YAC5I,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,SAAS,EAAE,cAAc;gBACzB,EAAE,EAAE,sBAAsB,KAAK,EAAE;gBACjC,OAAO,EAAE,kEAAkE,OAAO,CAAC,mBAAmB,CAAC,IAAI,CACzG,IAAI,CACL,SAAS,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE;gBAC/D,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aAChD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAK,CAAC,UAAU,EAChB,SAAS,EACT,OAAO,EACP,cAAc,CACf,CAAC;QACF,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC;QACzE,MAAM,eAAe,GAAG,IAAA,qDAA6B,EACnD,OAAO,CAAC,OAAO,EACf,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,KAAK,MAAM,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,IAAI,eAAe,KAAK,QAAQ,CAAC;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;YAAE,SAAS;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;gBACd,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,gBAAgB;YACtB,SAAS,EAAE,cAAc;YACzB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,EAAE,EAAE,WAAW,KAAK,EAAE;YACtB,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,aACzB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cACtB,QAAQ,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE;YAC7D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC;IACpE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU;aACzB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;aACjE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACzD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtC,IAAA,qCAAY,EACV,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,EAAE,EAC9B,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,EAAE,CACjC,CACF;QACD,aAAa,EAAE,0CAAkC;KAClD,CAAC;AACJ,CAAC"}

package/src/supply-chain/publication.d.ts

@@ -0,0 +1,48 @@
+export interface NpmArtifactVerificationInput {
+    artifactBytes: Uint8Array;
+    artifactManifest: {
+        gitHead: string;
+        name: string;
+        repository: string;
+        version: string;
+    };
+    expected: {
+        name: string;
+        sourceCommit: string;
+        sourceRepository: string;
+        version: string;
+    };
+    provenance: {
+        reason: 'private-source-repository';
+        status: 'not-supported';
+    } | {
+        sourceCommit: string;
+        sourceRepository: string;
+        subjectSha256: string;
+        workflow: string;
+        status: 'verified';
+    };
+    registryMetadata: {
+        dist: {
+            integrity: string;
+            shasum: string;
+            tarball: string;
+        };
+        name: string;
+        version: string;
+    };
+    sourceRepositoryPrivate: boolean;
+}
+export interface NpmArtifactVerification {
+    artifactSha256: string;
+    integrity: string;
+    name: string;
+    provenance: 'not-supported-private-source' | 'verified';
+    registry: 'registry.npmjs.org';
+    shasum: string;
+    sourceCommit: string;
+    sourceRepository: string;
+    tarball: string;
+    version: string;
+}
+export declare function verifyNpmArtifact(input: NpmArtifactVerificationInput): NpmArtifactVerification;

package/src/supply-chain/publication.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyNpmArtifact = verifyNpmArtifact;
+const node_crypto_1 = require("node:crypto");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+function sha(algorithm, bytes, encoding) {
+    return (0, node_crypto_1.createHash)(algorithm).update(bytes).digest(encoding);
+}
+function verifyNpmArtifact(input) {
+    if (!ArrayBuffer.isView(input.artifactBytes) ||
+        input.artifactBytes.BYTES_PER_ELEMENT !== 1 ||
+        input.artifactBytes.byteLength === 0 ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(input.expected.name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(input.expected.version) ||
+        !/^[a-f0-9]{40}$/.test(input.expected.sourceCommit) ||
+        !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(input.expected.sourceRepository) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)({
+            artifactManifest: input.artifactManifest,
+            expected: input.expected,
+            provenance: input.provenance,
+            registryMetadata: input.registryMetadata,
+        })) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'npmArtifact', 'must provide exact source, registry, artifact, and provenance metadata');
+    }
+    const shasum = sha('sha1', input.artifactBytes, 'hex');
+    const artifactSha256 = sha('sha256', input.artifactBytes, 'hex');
+    const integrity = `sha512-${sha('sha512', input.artifactBytes, 'base64')}`;
+    const expectedTarballPath = input.expected.name.startsWith('@')
+        ? `${input.expected.name}/-/${input.expected.name.split('/')[1]}-${input.expected.version}.tgz`
+        : `${input.expected.name}/-/${input.expected.name}-${input.expected.version}.tgz`;
+    let tarball;
+    try {
+        tarball = new URL(input.registryMetadata.dist.tarball);
+    }
+    catch {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'registryMetadata.dist.tarball', 'must be a canonical npm registry URL');
+    }
+    if (input.registryMetadata.name !== input.expected.name ||
+        input.registryMetadata.version !== input.expected.version ||
+        input.registryMetadata.dist.integrity !== integrity ||
+        input.registryMetadata.dist.shasum !== shasum ||
+        tarball.protocol !== 'https:' ||
+        tarball.hostname !== 'registry.npmjs.org' ||
+        decodeURIComponent(tarball.pathname).replace(/^\//, '') !==
+            expectedTarballPath ||
+        input.artifactManifest.name !== input.expected.name ||
+        input.artifactManifest.version !== input.expected.version ||
+        input.artifactManifest.repository !== input.expected.sourceRepository ||
+        input.artifactManifest.gitHead !== input.expected.sourceCommit) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'npmArtifact', 'registry bytes, package manifest, or source identity do not match');
+    }
+    let provenance;
+    if (input.sourceRepositoryPrivate) {
+        if (input.provenance.status !== 'not-supported' ||
+            input.provenance.reason !== 'private-source-repository') {
+            throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'provenance', 'must honestly record that npm provenance is unavailable for private source');
+        }
+        provenance = 'not-supported-private-source';
+    }
+    else {
+        if (input.provenance.status !== 'verified' ||
+            input.provenance.sourceCommit !== input.expected.sourceCommit ||
+            input.provenance.sourceRepository !== input.expected.sourceRepository ||
+            input.provenance.subjectSha256 !== artifactSha256 ||
+            !common_js_1.SUPPLY_CHAIN_SHA256.test(input.provenance.subjectSha256) ||
+            !/^\.github\/workflows\/[A-Za-z0-9._-]+\.ya?ml@[a-f0-9]{40}$/.test(input.provenance.workflow)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'provenance', 'does not bind the public package bytes to expected source and workflow');
+        }
+        provenance = 'verified';
+    }
+    return {
+        artifactSha256,
+        integrity,
+        name: input.expected.name,
+        provenance,
+        registry: 'registry.npmjs.org',
+        shasum,
+        sourceCommit: input.expected.sourceCommit,
+        sourceRepository: input.expected.sourceRepository,
+        tarball: tarball.href,
+        version: input.expected.version,
+    };
+}
+//# sourceMappingURL=publication.js.map

package/src/supply-chain/publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/publication.ts"],"names":[],"mappings":";;AAqEA,8CA6GC;AAlLD,6CAAyC;AAEzC,2CAKqB;AACrB,2CAA+C;AAqD/C,SAAS,GAAG,CACV,SAAuC,EACvC,KAAiB,EACjB,QAA0B;IAE1B,OAAO,IAAA,wBAAU,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,SAAgB,iBAAiB,CAC/B,KAAmC;IAEnC,IACE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QACxC,KAAK,CAAC,aAAa,CAAC,iBAAiB,KAAK,CAAC;QAC3C,KAAK,CAAC,aAAa,CAAC,UAAU,KAAK,CAAC;QACpC,CAAC,qCAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpD,CAAC,sCAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxD,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnD,CAAC,oCAAoC,CAAC,IAAI,CACxC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC;QACD,IAAA,wCAA4B,EAAC;YAC3B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,EACF,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,4BAA4B,EAC5B,aAAa,EACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,UAAU,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;IAC3E,MAAM,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAC3D,KAAK,CAAC,QAAQ,CAAC,OACjB,MAAM;QACR,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,MAAM,CAAC;IACpF,IAAI,OAAY,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAAgB,CACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI;QACnD,KAAK,CAAC,gBAAgB,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;QACzD,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;QACnD,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;QAC7C,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC7B,OAAO,CAAC,QAAQ,KAAK,oBAAoB;QACzC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACrD,mBAAmB;QACrB,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI;QACnD,KAAK,CAAC,gBAAgB,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;QACzD,KAAK,CAAC,gBAAgB,CAAC,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACrE,KAAK,CAAC,gBAAgB,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,YAAY,EAC9D,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,gCAAgC,EAChC,aAAa,EACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,UAAiD,CAAC;IACtD,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAClC,IACE,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,eAAe;YAC3C,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,2BAA2B,EACvD,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,gCAAgC,EAChC,YAAY,EACZ,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,8BAA8B,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,IACE,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU;YACtC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,QAAQ,CAAC,YAAY;YAC7D,KAAK,CAAC,UAAU,CAAC,gBAAgB,KAAK,KAAK,CAAC,QAAQ,CAAC,gBAAgB;YACrE,KAAK,CAAC,UAAU,CAAC,aAAa,KAAK,cAAc;YACjD,CAAC,+BAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;YACzD,CAAC,4DAA4D,CAAC,IAAI,CAChE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAC1B,EACD,CAAC;YACD,MAAM,IAAI,4BAAgB,CACxB,gCAAgC,EAChC,YAAY,EACZ,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,UAAU,CAAC;IAC1B,CAAC;IACD,OAAO;QACL,cAAc;QACd,SAAS;QACT,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACzB,UAAU;QACV,QAAQ,EAAE,oBAAoB;QAC9B,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;QACzC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;QACjD,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;KAChC,CAAC;AACJ,CAAC"}