@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-release-files.js

@@ -14,7 +14,7 @@ function configurationSeedDates(seed) {
     };
 }
 /** @internal */
-function renderProductReleaseFiles(name, configurationSeed) {
+function renderProductReleaseFiles(name, configurationSeed, sql = true) {
     const configurationDates = configurationSeedDates(configurationSeed);
     return {
         'infra/container-images.ts': `import {
@@ -79,6 +79,35 @@ function readJson(root: string, candidate: string, label: string): unknown {
   }
 }
 
+function localContainerImage(local: { context: string; dockerfile: string }) {
+  const registry = process.env.EBK_CONTAINER_PACKAGE_REGISTRY?.trim() ?? '';
+  if (registry === '') return local;
+  if (registry.length > 2_048) {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(registry);
+  } catch {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  const normalized = parsed.href;
+  const localPlaintext = parsed.protocol === 'http:' &&
+    ['127.0.0.1', 'localhost', 'host.docker.internal', '[::1]'].includes(parsed.hostname);
+  if (
+    (registry !== normalized && registry + '/' !== normalized) ||
+    (parsed.protocol !== 'https:' && !localPlaintext) ||
+    parsed.username !== '' || parsed.password !== '' ||
+    parsed.search !== '' || parsed.hash !== ''
+  ) {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  return {
+    ...local,
+    args: { NPM_CONFIG_REGISTRY: normalized.endsWith('/') ? normalized.slice(0, -1) : normalized },
+  };
+}
+
 export function resolveStandardContainerImage(input: {
   artifactId: string;
   exactDevelopment?: boolean;
@@ -87,7 +116,7 @@ export function resolveStandardContainerImage(input: {
   stage: string;
 }): {
   environment: Record<string, string>;
-  image: string | { context: string; dockerfile: string };
+  image: string | { context: string; dockerfile: string; args?: Record<string, string> };
 } {
   const lifecycleAction = process.env.EBK_ACTION?.trim();
   if (
@@ -113,6 +142,9 @@ export function resolveStandardContainerImage(input: {
     (!protectedStage && !exactDevelopment) ||
     (lifecycleAction !== undefined && lifecycleAction !== 'deploy')
   ) {
+    if (!protectedStage && !exactDevelopment) {
+      return { environment: {}, image: localContainerImage(input.local) };
+    }
     return { environment: {}, image: input.local };
   }
   if (!COMMIT.test(input.sourceCommit)) {
@@ -133,6 +165,7 @@ export function resolveStandardContainerImage(input: {
       process.env.EBK_SOURCE_COMMIT?.trim() ?? input.sourceCommit,
     releaseSourceCommit: input.sourceCommit,
     repositoryRoot,
+    sstEnvironmentProjectRoot: resolve(repositoryRoot, 'packages/${name}'),
   });
   const controls = readJson(
     repositoryRoot,
@@ -1202,7 +1235,8 @@ describe('generated rollout host bindings', () => {
   });
 });
 `,
-        'web/src/lib/provider-delivery.ts': `import {
+        'web/src/lib/provider-delivery.ts': `import { NextResponse } from 'next/server';
+import {
   createSliceAwsConfigurationProvider,
   createSliceLocalConfigurationProvider,
 } from '../../../configuration/provider';
@@ -1259,9 +1293,6 @@ export function nextServerProviderDeliveryForSubject(
     ),
   );
 }
-`,
-        'web/src/app/api/provider-delivery/route.ts': `import { NextResponse } from 'next/server';
-import { nextServerProviderDeliveryForSubject } from '../../../lib/provider-delivery';
 
 export interface ProviderDeliveryRouteDependencies {
   resolveAuthenticatedSubjectId(request: Request): Promise<string>;
@@ -1290,6 +1321,8 @@ export function createProviderDeliveryRoute(
     });
   };
 }
+`,
+        'web/src/app/api/provider-delivery/route.ts': `import { NextResponse } from 'next/server';
 
 export async function GET() {
   return NextResponse.json(
@@ -1661,11 +1694,20 @@ import {
   lstatSync,
   mkdirSync,
   readFileSync,
+  readlinkSync,
   readdirSync,
   realpathSync,
   writeFileSync,
 } from 'node:fs';
-import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+  sep,
+} from 'node:path';
 import {
   createNextJsBuildOutputInventory,
   validateContainerArtifactIdentity,
@@ -1680,12 +1722,41 @@ const sourceCommit =
 if (!sourceCommit || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit)) {
   throw new Error('EBK_SOURCE_COMMIT must be one exact Git object ID.');
 }
-const repositoryRoot = execFileSync(
-  'git',
-  ['rev-parse', '--show-toplevel'],
-  { encoding: 'utf8' },
-).trim();
-const repositoryRootReal = realpathSync(repositoryRoot);
+const repositoryRoot = realpathSync(
+  execFileSync('git', ['rev-parse', '--show-toplevel'], {
+    encoding: 'utf8',
+  }).trim(),
+);
+const repositoryRootReal = repositoryRoot;
+const repositoryRootIdentity = lstatSync(repositoryRootReal, {
+  bigint: true,
+});
+if (
+  !repositoryRootIdentity.isDirectory() ||
+  repositoryRootIdentity.ino === 0n
+) {
+  throw new Error('Artifact capture cannot bind the repository identity.');
+}
+const repositoryRelativeRealPath = (absolute, pointer) => {
+  const segments = [];
+  let current = absolute;
+  for (let depth = 0; depth <= 1024; depth += 1) {
+    const identity = lstatSync(current, { bigint: true });
+    if (
+      identity.dev === repositoryRootIdentity.dev &&
+      identity.ino === repositoryRootIdentity.ino
+    ) {
+      return segments.reverse().join(sep);
+    }
+    const parent = dirname(current);
+    if (parent === current) break;
+    const segment = basename(current);
+    if (!segment || segment === '.' || segment === '..') break;
+    segments.push(segment);
+    current = parent;
+  }
+  throw new Error(pointer + ' resolves outside the repository.');
+};
 const requireCleanTree = () => {
   const status = execFileSync(
     'git',
@@ -1896,12 +1967,18 @@ if (
 ) {
   throw new Error('Generated artifact inventory names must be unique.');
 }
-const safeFiles = (paths, pointer) => {
+const safeFiles = (paths, pointer, { allowSymbolicLinks = false, nextJsBuildOutput = false } = {}) => {
   if (!Array.isArray(paths) || paths.length === 0) {
     throw new Error(pointer + ' must name at least one artifact path.');
   }
   const files = [];
   const seen = new Set();
+  const compilerCacheDirectories = new Set(
+    nextJsBuildOutput
+      ? paths.filter((path) => typeof path === 'string' && path.split('/').at(-1) === '.next')
+          .map((path) => resolve(repositoryRoot, path, 'cache'))
+      : [],
+  );
   const visit = (candidate) => {
     if (isAbsolute(candidate)) {
       throw new Error(pointer + ' contains an absolute artifact path.');
@@ -1916,33 +1993,67 @@ const safeFiles = (paths, pointer) => {
       throw new Error(pointer + ' contains a path outside the repository.');
     }
     let walked = repositoryRootReal;
-    for (const segment of pathFromRoot.split(sep)) {
+    const segments = pathFromRoot.split(sep);
+    for (const [index, segment] of segments.entries()) {
       walked = resolve(walked, segment);
-      if (lstatSync(walked).isSymbolicLink()) {
+      if (
+        lstatSync(walked).isSymbolicLink() &&
+        (!allowSymbolicLinks || index !== segments.length - 1)
+      ) {
         throw new Error(pointer + ' may not traverse symbolic links.');
       }
     }
     const real = realpathSync(absolute);
-    const realFromRoot = relative(repositoryRootReal, real);
-    if (
-      realFromRoot === '..' ||
-      realFromRoot.startsWith('..' + sep) ||
-      isAbsolute(realFromRoot)
-    ) {
-      throw new Error(pointer + ' resolves outside the repository.');
-    }
+    const realFromRoot = repositoryRelativeRealPath(real, pointer);
     const stat = lstatSync(absolute);
-    if (stat.isDirectory()) {
+    const normalized = pathFromRoot.split(sep).join('/');
+    if (compilerCacheDirectories.has(absolute)) {
+      if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error(pointer + ': Next.js compiler cache must be a real directory.');
+      }
+      return;
+    }
+    if (stat.isSymbolicLink()) {
+      const targetText = readlinkSync(absolute, 'utf8');
+      const target = realFromRoot.split(sep).join('/');
+      const targetStat = lstatSync(real);
+      const targetKind = targetStat.isDirectory()
+        ? 'directory'
+        : targetStat.isFile()
+          ? 'file'
+          : undefined;
+      if (
+        !allowSymbolicLinks ||
+        Buffer.byteLength(targetText, 'utf8') > 4096 ||
+        !targetKind
+      ) {
+        throw new Error(
+          pointer + ' contains an unsupported symbolic link.',
+        );
+      }
+      if (seen.has(normalized)) {
+        throw new Error(pointer + ' contains overlapping artifact paths.');
+      }
+      seen.add(normalized);
+      files.push({
+        kind: 'link',
+        path: normalized,
+        target,
+        targetKind,
+        targetTextSha256: createHash('sha256')
+          .update(targetText, 'utf8')
+          .digest('hex'),
+      });
+    } else if (stat.isDirectory()) {
       for (const child of readdirSync(absolute).sort()) {
         visit(join(pathFromRoot, child));
       }
     } else if (stat.isFile()) {
-      const normalized = pathFromRoot.split(sep).join('/');
       if (seen.has(normalized)) {
         throw new Error(pointer + ' contains overlapping artifact paths.');
       }
       seen.add(normalized);
-      files.push([normalized, real]);
+      files.push({ absolute: real, kind: 'file', path: normalized });
     } else {
       throw new Error(pointer + ' may contain only regular files.');
     }
@@ -1957,16 +2068,29 @@ const safeFiles = (paths, pointer) => {
     }
     visit(candidate);
   }
-  return files.sort(([left], [right]) =>
+  return files.sort(({ path: left }, { path: right }) =>
     left < right ? -1 : left > right ? 1 : 0,
   );
 };
-const digestPaths = (paths, pointer) => {
+const digestPaths = (paths, pointer, options) => {
   const hash = createHash('sha256');
-  for (const [path, absolute] of safeFiles(paths, pointer)) {
-    const content = readFileSync(absolute);
+  for (const entry of safeFiles(paths, pointer, options)) {
+    const { path } = entry;
     hash.update(path, 'utf8');
     hash.update('\\0');
+    if (entry.kind === 'link') {
+      hash.update(entry.kind, 'utf8');
+      hash.update('\\0');
+      hash.update(entry.target, 'utf8');
+      hash.update('\\0');
+      hash.update(entry.targetKind, 'utf8');
+      hash.update('\\0');
+      hash.update(entry.targetTextSha256, 'utf8');
+      hash.update('\\0');
+      continue;
+    }
+    const { absolute } = entry;
+    const content = readFileSync(absolute);
     hash.update(String(content.byteLength), 'utf8');
     hash.update('\\0');
     hash.update(content);
@@ -2019,6 +2143,11 @@ const artifacts = inventory.map((artifact, index) => {
       pointer + ' does not match the generated candidate recipe.',
     );
   }
+  const materialDigestOptions =
+    artifact.buildArtifact?.support === 'supported' &&
+    artifact.buildArtifact.family === 'nextjs-build-output'
+      ? { allowSymbolicLinks: true, nextJsBuildOutput: true }
+      : undefined;
   const common = {
     buildRecipeDigest: digestPaths(
       binding.recipePaths,
@@ -2038,6 +2167,7 @@ const artifacts = inventory.map((artifact, index) => {
       digest: digestPaths(
         binding.materialPaths,
         pointer + '.materialPaths',
+        materialDigestOptions,
       ),
       stages: ['production', 'staging'],
     };
@@ -2048,6 +2178,7 @@ const artifacts = inventory.map((artifact, index) => {
       candidateDigest: digestPaths(
         binding.materialPaths,
         pointer + '.materialPaths',
+        materialDigestOptions,
       ),
       classification: 'stage-specific',
       providerEvidence: artifact.providerEvidence,
@@ -2080,20 +2211,53 @@ const buildOutputs = inventory.flatMap((declared, index) => {
   ];
 });
 requireCleanTree();
-const provenance = {
-  runAttempt: process.env.GITHUB_RUN_ATTEMPT?.trim(),
-  runId: process.env.GITHUB_RUN_ID?.trim(),
-  workflow: process.env.GITHUB_WORKFLOW_REF?.trim(),
-};
+const localFederated =
+  process.env.GITHUB_ACTIONS !== 'true' &&
+  process.env.EBK_LOCAL_DEPLOYMENT_MODE === 'federated';
+const localStage = process.env.EBK_STAGE?.trim() ?? '';
+const localAccount = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+const localRegion = process.env.AWS_REGION?.trim() ?? '';
+if (localFederated) {
+  const policy = JSON.parse(
+    readFileSync(join(repositoryRoot, 'ebk.repository-policy.json'), 'utf8'),
+  );
+  if (
+    policy.deploymentProfile !== 'starter' ||
+    !['development', 'staging'].includes(localStage) ||
+    policy.deploymentAccounts?.[localStage] !== localAccount ||
+    policy.deploymentRegion !== localRegion
+  ) {
+    throw new Error(
+      'Local release artifact capture requires a locally admitted exact starter deployment target; production requires protected GitHub authority.',
+    );
+  }
+}
+const provenance = localFederated
+  ? {
+      runAttempt: '1',
+      runId: (BigInt('0x' + sourceCommit.slice(0, 15)) + 1n).toString(),
+      workflow:
+        'local-federated/' +
+        localStage +
+        '/' +
+        localAccount +
+        '/' +
+        localRegion,
+    }
+  : {
+      runAttempt: process.env.GITHUB_RUN_ATTEMPT?.trim(),
+      runId: process.env.GITHUB_RUN_ID?.trim(),
+      workflow: process.env.GITHUB_WORKFLOW_REF?.trim(),
+    };
 if (
-  process.env.GITHUB_ACTIONS === 'true' &&
-  (!/^[1-9][0-9]*$/.test(provenance.runAttempt ?? '') ||
-    !/^[1-9][0-9]*$/.test(provenance.runId ?? '') ||
-    !provenance.workflow ||
-    provenance.workflow.length > 512)
+  (!localFederated && process.env.GITHUB_ACTIONS !== 'true') ||
+  !/^[1-9][0-9]*$/.test(provenance.runAttempt ?? '') ||
+  !/^[1-9][0-9]*$/.test(provenance.runId ?? '') ||
+  !provenance.workflow ||
+  provenance.workflow.length > 512
 ) {
   throw new Error(
-    'GitHub release candidate capture requires exact workflow provenance.',
+    'Release artifact capture requires exact GitHub or local-federated provenance.',
   );
 }
 const evidence = {
@@ -2141,19 +2305,9 @@ import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-referen
 import ts from 'typescript';
 
 const sourceCommit = process.env.EBK_SOURCE_COMMIT?.trim();
-const runId = process.env.GITHUB_RUN_ID?.trim();
-const runAttempt = process.env.GITHUB_RUN_ATTEMPT?.trim();
-const workflow = process.env.GITHUB_WORKFLOW_REF?.trim();
-if (
-  process.env.GITHUB_ACTIONS !== 'true' ||
-  !sourceCommit ||
-  !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit) ||
-  !/^[1-9][0-9]*$/.test(runId ?? '') ||
-  !/^[1-9][0-9]*$/.test(runAttempt ?? '') ||
-  !isBoundedSafeReference(workflow, 'repository-evidence')
-) {
+if (!sourceCommit || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit)) {
   throw new Error(
-    'Release candidates require exact GitHub workflow provenance.',
+    'Release candidates require one exact source commit.',
   );
 }
 const git = (...args) =>
@@ -2166,7 +2320,64 @@ if (
     'Release candidates require the exact clean source commit.',
   );
 }
-const repository = git('remote', 'get-url', 'origin');
+const repository =
+  process.env.GITHUB_ACTIONS === 'true'
+    ? process.env.GITHUB_REPOSITORY?.trim()
+    : git('remote', 'get-url', 'origin');
+if (
+  !repository ||
+  (process.env.GITHUB_ACTIONS === 'true' &&
+    !/^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/.test(repository))
+) {
+  throw new Error(
+    'Protected GitHub release candidates require the exact repository slug.',
+  );
+}
+const localFederated =
+  process.env.GITHUB_ACTIONS !== 'true' &&
+  process.env.EBK_LOCAL_DEPLOYMENT_MODE === 'federated';
+const localStage = process.env.EBK_STAGE?.trim() ?? '';
+const localAccount = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+const localRegion = process.env.AWS_REGION?.trim() ?? '';
+if (localFederated) {
+  const policy = JSON.parse(
+    readFileSync(new URL('../../../ebk.repository-policy.json', import.meta.url), 'utf8'),
+  );
+  if (
+    policy.deploymentProfile !== 'starter' ||
+    !['development', 'staging'].includes(localStage) ||
+    policy.deploymentAccounts?.[localStage] !== localAccount ||
+    policy.deploymentRegion !== localRegion
+  ) {
+    throw new Error(
+      'Local release candidates require a locally admitted exact starter deployment target; production requires protected GitHub authority.',
+    );
+  }
+}
+const runId = localFederated
+  ? (BigInt('0x' + sourceCommit.slice(0, 15)) + 1n).toString()
+  : process.env.GITHUB_RUN_ID?.trim();
+const runAttempt = localFederated
+  ? '1'
+  : process.env.GITHUB_RUN_ATTEMPT?.trim();
+const workflow = localFederated
+  ? 'local-federated/' +
+    localStage +
+    '/' +
+    localAccount +
+    '/' +
+    localRegion
+  : process.env.GITHUB_WORKFLOW_REF?.trim();
+if (
+  (!localFederated && process.env.GITHUB_ACTIONS !== 'true') ||
+  !/^[1-9][0-9]*$/.test(runId ?? '') ||
+  !/^[1-9][0-9]*$/.test(runAttempt ?? '') ||
+  !isBoundedSafeReference(workflow, 'repository-evidence')
+) {
+  throw new Error(
+    'Release candidates require exact GitHub or local-federated provenance.',
+  );
+}
 const builtAt = new Date(
   git('show', '-s', '--format=%cI', sourceCommit),
 ).toISOString();
@@ -2312,10 +2523,14 @@ const contract = treeEvidence(
   'contracts',
   'ebk-release-contract-source',
 );
-const migration = treeEvidence(
-  'database/migrations',
-  'ebk-release-migration-source',
-);
+const sqlDeclared = ${sql};
+const migration = {
+  ...treeEvidence(
+    sqlDeclared ? 'database/migrations' : 'data/persistence.json',
+    'ebk-release-migration-source',
+  ),
+  applicability: sqlDeclared ? 'declared-sql' : 'not-applicable',
+};
 const testEvidence = JSON.parse(
   readFileSync(
     new URL('../.ebk/evidence/test-integration.json', import.meta.url),
@@ -2356,10 +2571,10 @@ if (
 }
 const migrationJournalPath =
   'packages/${name}/database/migrations/meta/_journal.json';
-const migrationJournalContent = readFileSync(
+const migrationJournalContent = sqlDeclared ? readFileSync(
   new URL('../database/migrations/meta/_journal.json', import.meta.url),
   'utf8',
-);
+) : JSON.stringify({ entries: [] });
 const migrationJournal = JSON.parse(migrationJournalContent);
 const baselineMigrationJournalContent = trackedAt(
   baselineCommit,
@@ -2403,7 +2618,8 @@ const databaseCompatibilityReport = {
   baselineDigest: digest(baselineMigrationJournalContent ?? ''),
   candidateDigest: digest(migrationJournalContent),
   classification:
-    preservedMigrations && !destructiveMigration
+    preservedMigrations && !destructiveMigration &&
+    (sqlDeclared || baselineMigrationJournalContent === undefined)
       ? 'compatible'
       : 'incompatible',
   kind: 'database-migration-compatibility',
@@ -3987,7 +4203,7 @@ const requireSupplyChainManifest = (path) => {
     ).value;
     if (
       finalSbom?.bomFormat !== 'CycloneDX' ||
-      finalSbom.specVersion !== '1.6' ||
+      finalSbom.specVersion !== '1.7' ||
       finalSbom.version !== 1 ||
       finalSbom.serialNumber?.toLowerCase() !== reference.serialNumber ||
       !Array.isArray(finalSbom.components) ||
@@ -3997,7 +4213,7 @@ const requireSupplyChainManifest = (path) => {
       typeof finalSbom.metadata !== 'object' ||
       !Array.isArray(finalSbom.metadata.properties)
     ) {
-      throw new Error('Final OCI SBOM is not complete CycloneDX 1.6 evidence.');
+      throw new Error('Final OCI SBOM is not complete CycloneDX 1.7 evidence.');
     }
     const properties = new Map();
     for (const property of finalSbom.metadata.properties) {
@@ -4097,7 +4313,7 @@ const requireSupplyChainManifest = (path) => {
       ).value;
       if (
         platformSbom?.bomFormat !== 'CycloneDX' ||
-        platformSbom.specVersion !== '1.6' ||
+        platformSbom.specVersion !== '1.7' ||
         platformSbom.version !== 1 ||
         platformSbom.serialNumber?.toLowerCase() !==
           platform.sbom.serialNumber ||
@@ -4112,7 +4328,7 @@ const requireSupplyChainManifest = (path) => {
           name: component?.name,
           purl: component?.purl ?? '',
           type: component?.type,
-          version: component?.version,
+          version: component?.version ?? '',
         }))
         .sort((left, right) =>
           JSON.stringify(left) < JSON.stringify(right)
@@ -4122,11 +4338,31 @@ const requireSupplyChainManifest = (path) => {
               : 0,
         );
       if (
-        componentSet.some(
+        platformSbom.components.some(
           (component) =>
-            typeof component.name !== 'string' ||
+            typeof component?.name !== 'string' ||
+            component.name.length === 0 ||
             typeof component.type !== 'string' ||
-            typeof component.version !== 'string',
+            component.type.length === 0 ||
+            !(
+              (typeof component.version === 'string' &&
+                component.version.length > 0) ||
+              (component.type === 'file' &&
+                component.version === undefined &&
+                component.purl === undefined &&
+                component.name.startsWith('/') &&
+                component.name.length <= 4_096 &&
+                Array.isArray(component.hashes) &&
+                component.hashes.length === 2 &&
+                component.hashes[0]?.alg === 'SHA-1' &&
+                /^[a-f0-9]{40}$/.test(
+                  component.hashes[0]?.content ?? '',
+                ) &&
+                component.hashes[1]?.alg === 'SHA-256' &&
+                /^[a-f0-9]{64}$/.test(
+                  component.hashes[1]?.content ?? '',
+                ))
+            ),
         ) ||
         supplyChainDigest(componentSet) !== platform.sbom.componentSetDigest
       ) {
@@ -6165,7 +6401,11 @@ if (['stopped', 'recovering'].includes(result.rollout.phase)) {
                         sourceInputPaths: [
                             `packages/${name}/configuration`,
                             `packages/${name}/infra`,
-                            `packages/${name}/web`,
+                            `packages/${name}/web/next-env.d.ts`,
+                            `packages/${name}/web/next.config.ts`,
+                            `packages/${name}/web/open-next.config.ts`,
+                            `packages/${name}/web/src`,
+                            `packages/${name}/web/tsconfig.json`,
                         ],
                     },
                     buildArtifact: {

package/src/generators/slice/built-in-plan-reliability-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderProductReliabilityFiles(name: string, pascalName: string, reviewedAt: string): Readonly<Record<string, string>>;
+export declare function renderProductReliabilityFiles(name: string, pascalName: string, reviewedAt: string, sql?: boolean): Readonly<Record<string, string>>;