@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/frontend-security/security-headers.js

@@ -0,0 +1,418 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRONTEND_CSP_NONCE_PLACEHOLDER = exports.FRONTEND_SECURITY_HEADER_POLICY_SCHEMA_VERSION = exports.FRONTEND_SECURITY_HEADER_POLICY_KIND = void 0;
+exports.validateFrontendSecurityHeaderPolicy = validateFrontendSecurityHeaderPolicy;
+exports.composeFrontendSecurityHeaders = composeFrontendSecurityHeaders;
+exports.foundationFrontendSecurityHeaderPolicy = foundationFrontendSecurityHeaderPolicy;
+exports.sliceFrontendSecurityHeaderPolicy = sliceFrontendSecurityHeaderPolicy;
+exports.resolveFrontendSecurityHeaderProfile = resolveFrontendSecurityHeaderProfile;
+exports.inspectFrontendSecurityHeaders = inspectFrontendSecurityHeaders;
+exports.FRONTEND_SECURITY_HEADER_POLICY_KIND = 'ebk-frontend-security-header-policy';
+exports.FRONTEND_SECURITY_HEADER_POLICY_SCHEMA_VERSION = 1;
+exports.FRONTEND_CSP_NONCE_PLACEHOLDER = '{{EBK_NONCE}}';
+const profiles = [
+    'deployed-https',
+    'local-development',
+];
+const foundationOwnedNames = new Set([
+    'permissions-policy',
+    'referrer-policy',
+    'strict-transport-security',
+    'x-content-type-options',
+]);
+const sliceOwnedNames = new Set([
+    'content-security-policy',
+    'content-security-policy-report-only',
+]);
+const foundationMinimumHeaders = [
+    {
+        name: 'Permissions-Policy',
+        value: 'camera=(), display-capture=(), geolocation=(), microphone=(), payment=(), usb=()',
+    },
+    {
+        name: 'Referrer-Policy',
+        value: 'strict-origin-when-cross-origin',
+    },
+    {
+        name: 'X-Content-Type-Options',
+        value: 'nosniff',
+    },
+];
+function canonicalName(value) {
+    return value.trim().toLowerCase();
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function assertExactKeys(value, allowed, label) {
+    const unsupported = Object.keys(value).filter((key) => !allowed.includes(key));
+    if (unsupported.length > 0) {
+        throw new Error(`${label} contains unsupported fields: ${unsupported.sort().join(', ')}.`);
+    }
+}
+function validateHeader(value, owner, profile, index) {
+    if (!isRecord(value)) {
+        throw new Error(`${owner} ${profile} header ${index} must be an object.`);
+    }
+    assertExactKeys(value, ['name', 'value'], `${owner} ${profile} header`);
+    if (typeof value.name !== 'string' ||
+        !/^[A-Za-z0-9-]+$/.test(value.name) ||
+        typeof value.value !== 'string' ||
+        value.value.trim() !== value.value ||
+        value.value.length === 0 ||
+        /[\r\n]/.test(value.value)) {
+        throw new Error(`${owner} ${profile} header ${index} is not a bounded HTTP response header.`);
+    }
+    const name = canonicalName(value.name);
+    const allowed = owner === 'foundation' ? foundationOwnedNames : sliceOwnedNames;
+    if (!allowed.has(name)) {
+        throw new Error(`${owner} may not own the ${value.name} response header.`);
+    }
+    return { name: value.name, value: value.value };
+}
+function validateProfile(value, owner, profile) {
+    if (!isRecord(value)) {
+        throw new Error(`${owner} ${profile} security-header profile is missing.`);
+    }
+    assertExactKeys(value, ['headers', 'transport'], `${owner} ${profile}`);
+    const expectedTransport = profile === 'deployed-https' ? 'https' : 'loopback-http';
+    if (value.transport !== expectedTransport ||
+        !Array.isArray(value.headers) ||
+        value.headers.length === 0) {
+        throw new Error(`${owner} ${profile} must declare ${expectedTransport} and at least one header.`);
+    }
+    const headers = value.headers.map((header, index) => validateHeader(header, owner, profile, index));
+    const names = headers.map(({ name }) => canonicalName(name));
+    const duplicate = names.find((name, index) => names.indexOf(name) !== index);
+    if (duplicate) {
+        throw new Error(`${owner} ${profile} declares duplicate ${duplicate} response headers.`);
+    }
+    return { headers, transport: expectedTransport };
+}
+function validateFrontendSecurityHeaderPolicy(value, expectedOwner, expectedSlice) {
+    if (!isRecord(value)) {
+        throw new Error('Frontend security-header policy must be an object.');
+    }
+    assertExactKeys(value, ['kind', 'owner', 'profiles', 'schemaVersion', 'slice'], 'Frontend security-header policy');
+    if (value.kind !== exports.FRONTEND_SECURITY_HEADER_POLICY_KIND ||
+        value.schemaVersion !== exports.FRONTEND_SECURITY_HEADER_POLICY_SCHEMA_VERSION ||
+        value.owner !== expectedOwner ||
+        !isRecord(value.profiles)) {
+        throw new Error(`Frontend security-header policy is not an exact ${expectedOwner} v1 policy.`);
+    }
+    assertExactKeys(value.profiles, profiles, `${expectedOwner} profiles`);
+    if (expectedOwner === 'slice' &&
+        (typeof value.slice !== 'string' ||
+            value.slice !== expectedSlice ||
+            !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(value.slice))) {
+        throw new Error('Slice security-header policy does not match the exact Product Slice.');
+    }
+    if (expectedOwner === 'foundation' && value.slice !== undefined) {
+        throw new Error('Foundation security-header policy may not name a Slice.');
+    }
+    const validatedProfiles = Object.fromEntries(profiles.map((profile) => [
+        profile,
+        validateProfile(value.profiles[profile], expectedOwner, profile),
+    ]));
+    return {
+        kind: exports.FRONTEND_SECURITY_HEADER_POLICY_KIND,
+        owner: expectedOwner,
+        profiles: validatedProfiles,
+        schemaVersion: exports.FRONTEND_SECURITY_HEADER_POLICY_SCHEMA_VERSION,
+        ...(expectedOwner === 'slice' ? { slice: expectedSlice } : {}),
+    };
+}
+function headerMap(headers) {
+    return new Map(headers.map(({ name, value }) => [canonicalName(name), value]));
+}
+function validateFoundationMinimum(headers, profile) {
+    const actual = headerMap(headers);
+    for (const expected of foundationMinimumHeaders) {
+        if (actual.get(canonicalName(expected.name)) !== expected.value) {
+            throw new Error(`Foundation ${profile} must retain the exact ${expected.name} minimum.`);
+        }
+    }
+    const hsts = actual.get('strict-transport-security');
+    if (profile === 'deployed-https' &&
+        hsts !== 'max-age=31536000; includeSubDomains') {
+        throw new Error('Foundation deployed-https must retain the exact one-year HSTS minimum.');
+    }
+    if (profile === 'local-development' && hsts !== undefined) {
+        throw new Error('Foundation local-development must not emit HSTS over loopback HTTP.');
+    }
+}
+function validateSliceCsp(headers, profile) {
+    const actual = headerMap(headers);
+    const enforced = actual.get('content-security-policy');
+    if (!enforced) {
+        throw new Error(`Slice ${profile} must own one enforced Content-Security-Policy header.`);
+    }
+    const directives = new Map();
+    for (const [index, rawDirective] of enforced.split(';').entries()) {
+        const directive = rawDirective.trim();
+        if (!directive) {
+            throw new Error(`Slice ${profile} CSP directive ${index} must not be empty.`);
+        }
+        const [rawName, ...sources] = directive.split(/\s+/);
+        const name = rawName?.toLowerCase() ?? '';
+        if (!/^[a-z][a-z0-9-]*$/.test(name) ||
+            sources.some((source) => !source || /[;,\r\n]/.test(source))) {
+            throw new Error(`Slice ${profile} CSP directive ${index} is malformed.`);
+        }
+        if (directives.has(name)) {
+            throw new Error(`Slice ${profile} CSP declares duplicate ${name}.`);
+        }
+        directives.set(name, sources);
+    }
+    const defaultSources = directives.get('default-src');
+    if (!defaultSources || defaultSources.length === 0) {
+        throw new Error(`Slice ${profile} CSP must declare default-src.`);
+    }
+    if (JSON.stringify(directives.get('frame-ancestors')) !==
+        JSON.stringify(["'none'"]) ||
+        JSON.stringify(directives.get('object-src')) !== JSON.stringify(["'none'"])) {
+        throw new Error(`Slice ${profile} CSP must forbid framing and object embedding exactly.`);
+    }
+    const allSources = [...directives.values()].flat();
+    if (profile === 'deployed-https' &&
+        allSources.some((source) => source === "'unsafe-eval'" || source === "'unsafe-inline'")) {
+        throw new Error('Slice deployed-https CSP may not allow unsafe-eval or unsafe-inline.');
+    }
+    if (profile === 'deployed-https' &&
+        allSources.some((source) => source.includes('*'))) {
+        throw new Error(`Slice ${profile} CSP must not admit wildcard sources.`);
+    }
+    if (profile === 'deployed-https') {
+        const nonceSource = `'nonce-${exports.FRONTEND_CSP_NONCE_PLACEHOLDER}'`;
+        const scriptSources = directives.get('script-src') ?? [];
+        const styleSources = directives.get('style-src') ?? [];
+        const nonceSources = [...directives.values()]
+            .flat()
+            .filter((source) => source.startsWith("'nonce-"));
+        if (scriptSources.filter((source) => source === nonceSource).length !== 1 ||
+            styleSources.filter((source) => source === nonceSource).length !== 1 ||
+            nonceSources.length !== 2 ||
+            nonceSources.some((source) => source !== nonceSource)) {
+            throw new Error('Slice deployed-https CSP must bind script-src and style-src to the single request nonce authority.');
+        }
+        if (!scriptSources.includes("'strict-dynamic'")) {
+            throw new Error('Slice deployed-https script-src must retain strict-dynamic nonce propagation.');
+        }
+    }
+}
+function validatedNonce(value) {
+    if (!value ||
+        !/^[A-Za-z0-9+/_-]{16,128}={0,2}$/.test(value) ||
+        value.includes(exports.FRONTEND_CSP_NONCE_PLACEHOLDER)) {
+        throw new Error('Frontend deployed-https composition requires one unpredictable request nonce.');
+    }
+    return value;
+}
+function materializeSliceHeaders(headers, profile, nonce) {
+    if (profile !== 'deployed-https')
+        return [...headers];
+    const requestNonce = validatedNonce(nonce);
+    return headers.map((header) => ({
+        ...header,
+        value: canonicalName(header.name) === 'content-security-policy'
+            ? header.value.split(exports.FRONTEND_CSP_NONCE_PLACEHOLDER).join(requestNonce)
+            : header.value,
+    }));
+}
+function composeFrontendSecurityHeaders(input) {
+    const foundation = validateFrontendSecurityHeaderPolicy(input.foundation, 'foundation');
+    const slice = validateFrontendSecurityHeaderPolicy(input.slice, 'slice', input.sliceName);
+    const foundationHeaders = foundation.profiles[input.profile].headers;
+    const sliceHeaderTemplate = slice.profiles[input.profile].headers;
+    validateFoundationMinimum(foundationHeaders, input.profile);
+    validateSliceCsp(sliceHeaderTemplate, input.profile);
+    const sliceHeaders = materializeSliceHeaders(sliceHeaderTemplate, input.profile, input.nonce);
+    const seen = new Map();
+    const composed = [
+        ...foundationHeaders.map((header) => ({
+            ...header,
+            owner: 'foundation',
+        })),
+        ...sliceHeaders.map((header) => ({
+            ...header,
+            owner: 'slice',
+        })),
+    ];
+    for (const header of composed) {
+        const name = canonicalName(header.name);
+        const priorOwner = seen.get(name);
+        if (priorOwner) {
+            throw new Error(`Response header ${header.name} is owned by both ${priorOwner} and ${header.owner}.`);
+        }
+        seen.set(name, header.owner);
+    }
+    return composed.sort((left, right) => {
+        const leftName = canonicalName(left.name);
+        const rightName = canonicalName(right.name);
+        return leftName < rightName ? -1 : leftName > rightName ? 1 : 0;
+    });
+}
+function foundationFrontendSecurityHeaderPolicy() {
+    return {
+        kind: exports.FRONTEND_SECURITY_HEADER_POLICY_KIND,
+        owner: 'foundation',
+        profiles: {
+            'deployed-https': {
+                headers: [
+                    ...foundationMinimumHeaders,
+                    {
+                        name: 'Strict-Transport-Security',
+                        value: 'max-age=31536000; includeSubDomains',
+                    },
+                ],
+                transport: 'https',
+            },
+            'local-development': {
+                headers: [...foundationMinimumHeaders],
+                transport: 'loopback-http',
+            },
+        },
+        schemaVersion: exports.FRONTEND_SECURITY_HEADER_POLICY_SCHEMA_VERSION,
+    };
+}
+function sliceFrontendSecurityHeaderPolicy(slice) {
+    return {
+        kind: exports.FRONTEND_SECURITY_HEADER_POLICY_KIND,
+        owner: 'slice',
+        profiles: {
+            'deployed-https': {
+                headers: [
+                    {
+                        name: 'Content-Security-Policy',
+                        value: "default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: blob:; object-src 'none'; script-src 'self' 'nonce-{{EBK_NONCE}}' 'strict-dynamic'; style-src 'self' 'nonce-{{EBK_NONCE}}'",
+                    },
+                ],
+                transport: 'https',
+            },
+            'local-development': {
+                headers: [
+                    {
+                        name: 'Content-Security-Policy',
+                        value: "default-src 'self'; base-uri 'self'; connect-src 'self' http://127.0.0.1:* http://localhost:* ws://127.0.0.1:* ws://localhost:*; font-src 'self' data:; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: blob:; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'",
+                    },
+                ],
+                transport: 'loopback-http',
+            },
+        },
+        schemaVersion: exports.FRONTEND_SECURITY_HEADER_POLICY_SCHEMA_VERSION,
+        slice,
+    };
+}
+function resolveFrontendSecurityHeaderProfile(environment = process.env) {
+    const stage = environment.EBK_STAGE?.trim();
+    const nodeEnvironment = environment.NODE_ENV?.trim();
+    const requested = environment.EBK_FRONTEND_SECURITY_PROFILE?.trim();
+    if (requested &&
+        requested !== 'deployed-https' &&
+        requested !== 'local-development') {
+        throw new Error('EBK_FRONTEND_SECURITY_PROFILE must be deployed-https or local-development.');
+    }
+    const selectedProfile = requested;
+    const protectedProfile = stage === 'production' ||
+        stage === 'staging' ||
+        nodeEnvironment === 'production'
+        ? 'deployed-https'
+        : stage === 'development' || nodeEnvironment === 'development'
+            ? 'local-development'
+            : (() => {
+                throw new Error('Frontend security profile requires an explicit development or deployed runtime context.');
+            })();
+    if (selectedProfile && selectedProfile !== protectedProfile) {
+        throw new Error(`Stage ${stage || 'development'} may not select the ${selectedProfile} frontend security profile.`);
+    }
+    return selectedProfile ?? protectedProfile;
+}
+function normalizeObservedHeaders(input) {
+    if (input instanceof Headers) {
+        const normalized = {};
+        input.forEach((value, name) => {
+            normalized[canonicalName(name)] = value.trim();
+        });
+        return normalized;
+    }
+    return Object.fromEntries(Object.entries(input).map(([name, value]) => [
+        canonicalName(name),
+        String(value).trim(),
+    ]));
+}
+function nonceFromObservedHeaders(headers) {
+    const csp = headers['content-security-policy'];
+    if (!csp)
+        return undefined;
+    const nonces = [
+        ...csp.matchAll(/'nonce-([A-Za-z0-9+/_-]{16,128}={0,2})'/g),
+    ].map((match) => match[1]);
+    const unique = new Set(nonces);
+    return nonces.length === 2 && unique.size === 1 ? nonces[0] : undefined;
+}
+function inspectFrontendSecurityHeaders(input) {
+    const actual = normalizeObservedHeaders(input.actual);
+    const observedNonce = input.profile === 'deployed-https'
+        ? nonceFromObservedHeaders(actual)
+        : undefined;
+    const expected = composeFrontendSecurityHeaders({
+        foundation: input.foundation,
+        nonce: input.profile === 'deployed-https'
+            ? (observedNonce ?? 'EBKInspectionNonce000000000000')
+            : undefined,
+        profile: input.profile,
+        slice: input.slice,
+        sliceName: input.sliceName,
+    });
+    const findings = [
+        ...(input.profile === 'deployed-https' && !observedNonce
+            ? ['deployed-csp-request-nonce-missing-or-ambiguous']
+            : []),
+    ];
+    for (const header of expected) {
+        const name = canonicalName(header.name);
+        if (actual[name] === undefined) {
+            findings.push(`response-header-missing:${name}`);
+        }
+        else if (actual[name] !== header.value) {
+            findings.push(`response-header-value-mismatch:${name}`);
+        }
+    }
+    const expectedNames = new Set(expected.map(({ name }) => canonicalName(name)));
+    for (const managedName of [
+        ...foundationOwnedNames,
+        ...sliceOwnedNames,
+    ].sort()) {
+        if (actual[managedName] !== undefined && !expectedNames.has(managedName)) {
+            findings.push(`response-header-forbidden-for-profile:${managedName}`);
+        }
+    }
+    if (input.profile === 'deployed-https' &&
+        !input.https &&
+        !input.allowLoopbackTransportProof) {
+        findings.push('deployed-https-transport-required');
+    }
+    if (input.allowLoopbackTransportProof &&
+        (input.profile !== 'deployed-https' || input.https)) {
+        findings.push('loopback-transport-proof-scope-invalid');
+    }
+    const enforced = actual['content-security-policy'];
+    const reportOnly = actual['content-security-policy-report-only'];
+    const uniqueFindings = [...new Set(findings)].sort();
+    return {
+        findings: uniqueFindings,
+        kind: 'ebk-frontend-security-header-result',
+        mode: enforced
+            ? reportOnly
+                ? 'enforced-with-report-only-measurement'
+                : 'enforced'
+            : reportOnly
+                ? 'report-only'
+                : 'absent',
+        outcome: uniqueFindings.length === 0 ? 'passed' : 'failed',
+        profile: input.profile,
+        schemaVersion: 1,
+        slice: input.sliceName,
+    };
+}
+//# sourceMappingURL=security-headers.js.map

package/src/frontend-security/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../../../../packages/nx/src/frontend-security/security-headers.ts"],"names":[],"mappings":";;;AAyKA,oFAkDC;AA0JD,wEAmDC;AAED,wFAsBC;AAED,8EA+BC;AAED,oFAmCC;AAgCD,wEA+EC;AArnBY,QAAA,oCAAoC,GAC/C,qCAA8C,CAAC;AACpC,QAAA,8CAA8C,GAAG,CAAU,CAAC;AAC5D,QAAA,8BAA8B,GAAG,eAAwB,CAAC;AA4CvE,MAAM,QAAQ,GAAG;IACf,gBAAgB;IAChB,mBAAmB;CACwC,CAAC;AAE9D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,oBAAoB;IACpB,iBAAiB;IACjB,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,yBAAyB;IACzB,qCAAqC;CACtC,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG;IAC/B;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EACH,kFAAkF;KACrF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,iCAAiC;KACzC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,SAAS;KACjB;CACO,CAAC;AAEX,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,eAAe,CACtB,KAA8B,EAC9B,OAA0B,EAC1B,KAAa;IAEb,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChC,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iCAAiC,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,KAA6B,EAC7B,OAAsC,EACtC,KAAa;IAEb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,OAAO,WAAW,KAAK,qBAAqB,CAAC,CAAC;IAC5E,CAAC;IACD,eAAe,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,KAAK,IAAI,OAAO,SAAS,CAAC,CAAC;IACxE,IACE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACnC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,KAAK;QAClC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,IAAI,OAAO,WAAW,KAAK,yCAAyC,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GACX,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,KAAK,CAAC,IAAI,mBAAmB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,KAA6B,EAC7B,OAAsC;IAKtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,OAAO,sCAAsC,CAAC,CAAC;IAC7E,CAAC;IACD,eAAe,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,GAAG,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,iBAAiB,GACrB,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IAC3D,IACE,KAAK,CAAC,SAAS,KAAK,iBAAiB;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,IAAI,OAAO,iBAAiB,iBAAiB,2BAA2B,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAClD,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAC9C,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAC7E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,IAAI,OAAO,uBAAuB,SAAS,oBAAoB,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AACnD,CAAC;AAED,SAAgB,oCAAoC,CAClD,KAAc,EACd,aAAqC,EACrC,aAAsB;IAEtB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,eAAe,CACb,KAAK,EACL,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,CAAC,EACvD,iCAAiC,CAClC,CAAC;IACF,IACE,KAAK,CAAC,IAAI,KAAK,4CAAoC;QACnD,KAAK,CAAC,aAAa,KAAK,sDAA8C;QACtE,KAAK,CAAC,KAAK,KAAK,aAAa;QAC7B,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mDAAmD,aAAa,aAAa,CAC9E,CAAC;IACJ,CAAC;IACD,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,aAAa,WAAW,CAAC,CAAC;IACvE,IACE,aAAa,KAAK,OAAO;QACzB,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC9B,KAAK,CAAC,KAAK,KAAK,aAAa;YAC7B,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACxB,OAAO;QACP,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC;KACjE,CAAC,CACoD,CAAC;IACzD,OAAO;QACL,IAAI,EAAE,4CAAoC;QAC1C,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,iBAAiB;QAC3B,aAAa,EAAE,sDAA8C;QAC7D,GAAG,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,OAA0C;IAE1C,OAAO,IAAI,GAAG,CACZ,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA0C,EAC1C,OAAsC;IAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,wBAAwB,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,0BAA0B,QAAQ,CAAC,IAAI,WAAW,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACrD,IACE,OAAO,KAAK,gBAAgB;QAC5B,IAAI,KAAK,qCAAqC,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA0C,EAC1C,OAAsC;IAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,wDAAwD,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,kBAAkB,KAAK,qBAAqB,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC1C,IACE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,kBAAkB,KAAK,gBAAgB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,2BAA2B,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,gCAAgC,CAAC,CAAC;IACpE,CAAC;IACD,IACE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,wDAAwD,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IACE,OAAO,KAAK,gBAAgB;QAC5B,UAAU,CAAC,IAAI,CACb,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,iBAAiB,CACvE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IACE,OAAO,KAAK,gBAAgB;QAC5B,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,uCAAuC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,UAAU,sCAA8B,GAAG,CAAC;QAChE,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;aAC1C,IAAI,EAAE;aACN,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACpD,IACE,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;YACrE,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;YACpE,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IACE,CAAC,KAAK;QACN,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9C,KAAK,CAAC,QAAQ,CAAC,sCAA8B,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAA0C,EAC1C,OAAsC,EACtC,KAAyB;IAEzB,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,GAAG,MAAM;QACT,KAAK,EACH,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,yBAAyB;YACtD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,sCAA8B,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;YACvE,CAAC,CAAC,MAAM,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAM9C;IACC,MAAM,UAAU,GAAG,oCAAoC,CACrD,KAAK,CAAC,UAAU,EAChB,YAAY,CACb,CAAC;IACF,MAAM,KAAK,GAAG,oCAAoC,CAChD,KAAK,CAAC,KAAK,EACX,OAAO,EACP,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;IACrE,MAAM,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;IAClE,yBAAyB,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,gBAAgB,CAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,uBAAuB,CAC1C,mBAAmB,EACnB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkC,CAAC;IACvD,MAAM,QAAQ,GAAG;QACf,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACpC,GAAG,MAAM;YACT,KAAK,EAAE,YAAqB;SAC7B,CAAC,CAAC;QACH,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/B,GAAG,MAAM;YACT,KAAK,EAAE,OAAgB;SACxB,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,CAAC,IAAI,qBAAqB,UAAU,QAAQ,MAAM,CAAC,KAAK,GAAG,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,sCAAsC;IACpD,OAAO;QACL,IAAI,EAAE,4CAAoC;QAC1C,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE;YACR,gBAAgB,EAAE;gBAChB,OAAO,EAAE;oBACP,GAAG,wBAAwB;oBAC3B;wBACE,IAAI,EAAE,2BAA2B;wBACjC,KAAK,EAAE,qCAAqC;qBAC7C;iBACF;gBACD,SAAS,EAAE,OAAO;aACnB;YACD,mBAAmB,EAAE;gBACnB,OAAO,EAAE,CAAC,GAAG,wBAAwB,CAAC;gBACtC,SAAS,EAAE,eAAe;aAC3B;SACF;QACD,aAAa,EAAE,sDAA8C;KAC9D,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAC/C,KAAa;IAEb,OAAO;QACL,IAAI,EAAE,4CAAoC;QAC1C,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE;YACR,gBAAgB,EAAE;gBAChB,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EACH,6QAA6Q;qBAChR;iBACF;gBACD,SAAS,EAAE,OAAO;aACnB;YACD,mBAAmB,EAAE;gBACnB,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EACH,sUAAsU;qBACzU;iBACF;gBACD,SAAS,EAAE,eAAe;aAC3B;SACF;QACD,aAAa,EAAE,sDAA8C;QAC7D,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAgB,oCAAoC,CAClD,cAA4D,OAAO,CAAC,GAAG;IAEvE,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,WAAW,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IACpE,IACE,SAAS;QACT,SAAS,KAAK,gBAAgB;QAC9B,SAAS,KAAK,mBAAmB,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,SACmB,CAAC;IAC5C,MAAM,gBAAgB,GACpB,KAAK,KAAK,YAAY;QACtB,KAAK,KAAK,SAAS;QACnB,eAAe,KAAK,YAAY;QAC9B,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,KAAK,KAAK,aAAa,IAAI,eAAe,KAAK,aAAa;YAC5D,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;IACb,IAAI,eAAe,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,SAAS,KAAK,IAAI,aAAa,uBAAuB,eAAe,6BAA6B,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,IAAI,gBAAgB,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAiD;IAEjD,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;QAC7B,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC5B,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;KACrB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAyC;IAEzC,MAAM,GAAG,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG;QACb,GAAG,GAAG,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KAC5D,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAQ9C;IACC,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,aAAa,GACjB,KAAK,CAAC,OAAO,KAAK,gBAAgB;QAChC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EACH,KAAK,CAAC,OAAO,KAAK,gBAAgB;YAChC,CAAC,CAAC,CAAC,aAAa,IAAI,gCAAgC,CAAC;YACrD,CAAC,CAAC,SAAS;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAa;QACzB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,iDAAiD,CAAC;YACrD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAChD,CAAC;IACF,KAAK,MAAM,WAAW,IAAI;QACxB,GAAG,oBAAoB;QACvB,GAAG,eAAe;KACnB,CAAC,IAAI,EAAE,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IACE,KAAK,CAAC,OAAO,KAAK,gBAAgB;QAClC,CAAC,KAAK,CAAC,KAAK;QACZ,CAAC,KAAK,CAAC,2BAA2B,EAClC,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACrD,CAAC;IACD,IACE,KAAK,CAAC,2BAA2B;QACjC,CAAC,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,KAAK,CAAC,EACnD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,qCAAqC,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,cAAc;QACxB,IAAI,EAAE,qCAAqC;QAC3C,IAAI,EAAE,QAAQ;YACZ,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,UAAU;YACd,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,QAAQ;QACd,OAAO,EAAE,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,KAAK,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC"}

package/src/generators/feature-registry.d.ts

@@ -0,0 +1,13 @@
+import type { Tree } from '@nx/devkit';
+export declare const SLICE_FEATURE_REGISTRY_PATH = "operations/features.json";
+export declare const SLICE_FEATURE_REGISTRY_SCHEMA_VERSION: 1;
+export interface SliceFeature {
+    description?: string;
+    id: string;
+}
+export interface SliceFeatureRegistry {
+    features: SliceFeature[];
+    schemaVersion: typeof SLICE_FEATURE_REGISTRY_SCHEMA_VERSION;
+}
+export declare function parseSliceFeatureRegistry(value: unknown, label?: string): SliceFeatureRegistry;
+export declare function requireRegisteredSliceFeature(tree: Tree, sliceRoot: string, requestedFeature: string): string;

package/src/generators/feature-registry.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SLICE_FEATURE_REGISTRY_SCHEMA_VERSION = exports.SLICE_FEATURE_REGISTRY_PATH = void 0;
+exports.parseSliceFeatureRegistry = parseSliceFeatureRegistry;
+exports.requireRegisteredSliceFeature = requireRegisteredSliceFeature;
+const node_path_1 = require("node:path");
+exports.SLICE_FEATURE_REGISTRY_PATH = 'operations/features.json';
+exports.SLICE_FEATURE_REGISTRY_SCHEMA_VERSION = 1;
+const FEATURE_ID = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseSliceFeatureRegistry(value, label = 'Slice feature registry') {
+    if (!isRecord(value) ||
+        Object.keys(value).some((key) => key !== 'features' && key !== 'schemaVersion') ||
+        value.schemaVersion !== exports.SLICE_FEATURE_REGISTRY_SCHEMA_VERSION ||
+        !Array.isArray(value.features)) {
+        throw new Error(`${label} must be a schemaVersion ${exports.SLICE_FEATURE_REGISTRY_SCHEMA_VERSION} registry with a features array.`);
+    }
+    const features = value.features.map((candidate, index) => {
+        const description = isRecord(candidate) ? candidate.description : undefined;
+        if (!isRecord(candidate) ||
+            Object.keys(candidate).some((key) => key !== 'description' && key !== 'id') ||
+            typeof candidate.id !== 'string' ||
+            !FEATURE_ID.test(candidate.id) ||
+            (description !== undefined &&
+                (typeof description !== 'string' || description.trim() === ''))) {
+            throw new Error(`${label} feature ${index} must have a lowercase hyphenated id and an optional non-empty description.`);
+        }
+        const normalizedDescription = typeof description === 'string' ? description.trim() : undefined;
+        return {
+            ...(normalizedDescription === undefined
+                ? {}
+                : { description: normalizedDescription }),
+            id: candidate.id,
+        };
+    });
+    const ids = features.map(({ id }) => id);
+    if (new Set(ids).size !== ids.length) {
+        throw new Error(`${label} must not contain duplicate feature ids.`);
+    }
+    if (features.length === 0) {
+        throw new Error(`${label} must declare at least one feature.`);
+    }
+    return {
+        features,
+        schemaVersion: exports.SLICE_FEATURE_REGISTRY_SCHEMA_VERSION,
+    };
+}
+function requireRegisteredSliceFeature(tree, sliceRoot, requestedFeature) {
+    const feature = requestedFeature.trim();
+    if (!FEATURE_ID.test(feature)) {
+        throw new Error('Feature must start with a lowercase letter and use only lowercase letters, numbers, and hyphens.');
+    }
+    const path = node_path_1.posix.join(sliceRoot, exports.SLICE_FEATURE_REGISTRY_PATH);
+    const source = tree.read(path, 'utf8');
+    if (source === null) {
+        throw new Error(`Slice feature registry is missing at ${path}.`);
+    }
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new Error(`Slice feature registry at ${path} must be valid JSON.`);
+    }
+    const registry = parseSliceFeatureRegistry(value, `Slice feature registry at ${path}`);
+    if (!registry.features.some(({ id }) => id === feature)) {
+        throw new Error(`Feature "${feature}" is not registered for this Product Slice. Add it to ${path} before generating the workload.`);
+    }
+    return feature;
+}
+//# sourceMappingURL=feature-registry.js.map

package/src/generators/feature-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-registry.js","sourceRoot":"","sources":["../../../../../packages/nx/src/generators/feature-registry.ts"],"names":[],"mappings":";;;AAsBA,8DAuDC;AAED,sEAiCC;AA/GD,yCAAkC;AAErB,QAAA,2BAA2B,GAAG,0BAA0B,CAAC;AACzD,QAAA,qCAAqC,GAAG,CAAU,CAAC;AAYhE,MAAM,UAAU,GAAG,iCAAiC,CAAC;AAErD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,yBAAyB,CACvC,KAAc,EACd,KAAK,GAAG,wBAAwB;IAEhC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,eAAe,CACvD;QACD,KAAK,CAAC,aAAa,KAAK,6CAAqC;QAC7D,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,4BAA4B,6CAAqC,kCAAkC,CAC5G,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CACzB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,IAAI,CAC/C;YACD,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;YAChC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,CAAC,WAAW,KAAK,SAAS;gBACxB,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,YAAY,KAAK,6EAA6E,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,qBAAqB,GACzB,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,OAAO;YACL,GAAG,CAAC,qBAAqB,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;YAC3C,EAAE,EAAE,SAAS,CAAC,EAAE;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,6CAAqC;KACrD,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAC3C,IAAU,EACV,SAAiB,EACjB,gBAAwB;IAExB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,mCAA2B,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CACxC,KAAK,EACL,6BAA6B,IAAI,EAAE,CACpC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,yDAAyD,IAAI,kCAAkC,CACnH,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/src/generators/function/function.d.ts

@@ -8,6 +8,6 @@ export interface FunctionFilePlan {
     }>;
     register: string;
 }
-export declare function createFunctionFilePlan(slice: string, name: string): FunctionFilePlan;
+export declare function createFunctionFilePlan(workspace: string, slice: string, name: string, feature?: string): FunctionFilePlan;
 export declare function functionGenerator(tree: Tree, options: FunctionGeneratorSchema): Promise<void>;
 export default functionGenerator;