@empire-builder-kit/runtime 1.0.0-beta.9 → 1.0.0-rc.2

package/src/performance/index.d.ts

@@ -0,0 +1 @@
+export * from './protected-load-endpoint.js';

package/src/performance/index.js

@@ -0,0 +1,2 @@
+export * from './protected-load-endpoint.js';
+//# sourceMappingURL=index.js.map

package/src/performance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/performance/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC"}

package/src/performance/protected-load-endpoint.d.ts

@@ -0,0 +1,140 @@
+export declare const PROTECTED_LOAD_ENDPOINT_ADAPTERS: readonly [{
+    readonly capacityBound: "rate";
+    readonly cleanupPath: null;
+    readonly id: "ebk-api-lambda-v1";
+    readonly mutation: false;
+    readonly requestMethod: "GET";
+    readonly requestPath: "/__ebk/performance/api-lambda";
+    readonly scenarioId: "api-peak";
+    readonly saturationSignalRef: "runtime:nodejs-heap-utilization-percent";
+    readonly version: "1.0.0";
+    readonly workload: "api-lambda";
+}, {
+    readonly capacityBound: "rate";
+    readonly cleanupPath: "/__ebk/performance/async-worker/cleanup";
+    readonly id: "ebk-async-worker-v1";
+    readonly mutation: true;
+    readonly requestMethod: "POST";
+    readonly requestPath: "/__ebk/performance/async-worker";
+    readonly scenarioId: "async-burst";
+    readonly saturationSignalRef: "database:protected-async-backlog-utilization-percent";
+    readonly version: "1.0.0";
+    readonly workload: "async-worker";
+}, {
+    readonly capacityBound: "concurrency";
+    readonly cleanupPath: "/__ebk/performance/database/cleanup";
+    readonly id: "ebk-database-v1";
+    readonly mutation: true;
+    readonly requestMethod: "POST";
+    readonly requestPath: "/__ebk/performance/database";
+    readonly scenarioId: "database-cold-resume";
+    readonly saturationSignalRef: "database:connection-utilization-percent";
+    readonly version: "1.0.0";
+    readonly workload: "database";
+}, {
+    readonly capacityBound: "concurrency";
+    readonly cleanupPath: "/__ebk/performance/service/cleanup";
+    readonly id: "ebk-service-v1";
+    readonly mutation: false;
+    readonly requestMethod: "GET";
+    readonly requestPath: "/__ebk/performance/service";
+    readonly scenarioId: "service-extension";
+    readonly saturationSignalRef: null;
+    readonly version: "1.0.0";
+    readonly workload: "service";
+}];
+export type ProtectedLoadEndpointAdapterId = (typeof PROTECTED_LOAD_ENDPOINT_ADAPTERS)[number]['id'];
+export type ProtectedLoadEndpointStage = 'production' | 'staging';
+export interface ProtectedLoadEndpointReleaseV1 {
+    candidateDigest: string;
+    releaseId: string;
+    releaseMaterialDigest: string;
+    sourceCommit: string;
+}
+export interface ProtectedLoadEndpointHmacKeyV1 {
+    id: string;
+    secret: string;
+}
+export interface ProtectedLoadEndpointTargetV1 {
+    accountFingerprint: string;
+    endpoint: string;
+    region: string;
+    slice: string;
+}
+export interface ProtectedLoadEndpointBindingV1 {
+    adapterId: ProtectedLoadEndpointAdapterId;
+    deployedCandidateDigest: string;
+    deployedReleaseId: string;
+    deployedReleaseMaterialDigest: string;
+    deployedSourceCommit: string;
+    hmacKeys: {
+        current: ProtectedLoadEndpointHmacKeyV1;
+        previous?: ProtectedLoadEndpointHmacKeyV1;
+    };
+    stage: ProtectedLoadEndpointStage;
+    target: Omit<ProtectedLoadEndpointTargetV1, 'endpoint'> & {
+        origin: string;
+    };
+}
+export interface ProtectedLoadRequestAuthorizationV1 {
+    adapterId: ProtectedLoadEndpointAdapterId;
+    configuredMaximum: number;
+    createdAt: string;
+    durationSeconds: number;
+    effectId: string | null;
+    expiresAt: string;
+    maximumRequests: number;
+    hmacKeyId: string;
+    operation: 'cleanup' | 'execute';
+    planMaterialDigest: string;
+    release: ProtectedLoadEndpointReleaseV1;
+    requestOrdinal: number;
+    runId: string;
+    saturationSignalRef: string;
+    scenarioId: string;
+    stage: ProtectedLoadEndpointStage;
+    target: ProtectedLoadEndpointTargetV1;
+    workload: 'api-lambda' | 'async-worker' | 'database' | 'service';
+}
+export interface ProtectedLoadEndpointRequestV1 {
+    body?: unknown;
+    headers: Readonly<Record<string, string | undefined>>;
+    method: 'GET' | 'POST';
+    url: string;
+}
+export interface ProtectedLoadEndpointResponseV1 {
+    body: unknown;
+    status: number;
+}
+export declare class ProtectedLoadEndpointError extends Error {
+    readonly pointer: string;
+    readonly classification = "performance-load-authorization-invalid";
+    constructor(pointer: string, message: string);
+}
+export declare function createProtectedLoadRequestSignature(input: {
+    authorization: ProtectedLoadRequestAuthorizationV1;
+    hmacKey: ProtectedLoadEndpointHmacKeyV1;
+}): string;
+export declare function handleProtectedLoadScenarioEndpoint(input: {
+    binding: ProtectedLoadEndpointBindingV1;
+    execute(request: {
+        authorization: ProtectedLoadRequestAuthorizationV1;
+        effectId?: string;
+        requestOrdinal: number;
+    }): Promise<{
+        effectState?: 'already-existed' | 'created';
+        saturationPercent: number;
+    }>;
+    now?: () => Date;
+    request: ProtectedLoadEndpointRequestV1;
+    reserve(authorization: ProtectedLoadRequestAuthorizationV1): Promise<'claimed'>;
+}): Promise<ProtectedLoadEndpointResponseV1>;
+export declare function handleProtectedLoadCleanupEndpoint(input: {
+    binding: ProtectedLoadEndpointBindingV1;
+    cleanup(authorization: ProtectedLoadRequestAuthorizationV1): Promise<{
+        remainingEffectCount: number;
+        removedEffectCount: number;
+    }>;
+    now?: () => Date;
+    request: ProtectedLoadEndpointRequestV1;
+}): Promise<ProtectedLoadEndpointResponseV1>;

package/src/performance/protected-load-endpoint.js

@@ -0,0 +1,462 @@
+import { __awaiter } from "tslib";
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { isBoundedSafeReference } from '../safe-reference.js';
+export const PROTECTED_LOAD_ENDPOINT_ADAPTERS = [
+    {
+        capacityBound: 'rate',
+        cleanupPath: null,
+        id: 'ebk-api-lambda-v1',
+        mutation: false,
+        requestMethod: 'GET',
+        requestPath: '/__ebk/performance/api-lambda',
+        scenarioId: 'api-peak',
+        saturationSignalRef: 'runtime:nodejs-heap-utilization-percent',
+        version: '1.0.0',
+        workload: 'api-lambda',
+    },
+    {
+        capacityBound: 'rate',
+        cleanupPath: '/__ebk/performance/async-worker/cleanup',
+        id: 'ebk-async-worker-v1',
+        mutation: true,
+        requestMethod: 'POST',
+        requestPath: '/__ebk/performance/async-worker',
+        scenarioId: 'async-burst',
+        saturationSignalRef: 'database:protected-async-backlog-utilization-percent',
+        version: '1.0.0',
+        workload: 'async-worker',
+    },
+    {
+        capacityBound: 'concurrency',
+        cleanupPath: '/__ebk/performance/database/cleanup',
+        id: 'ebk-database-v1',
+        mutation: true,
+        requestMethod: 'POST',
+        requestPath: '/__ebk/performance/database',
+        scenarioId: 'database-cold-resume',
+        saturationSignalRef: 'database:connection-utilization-percent',
+        version: '1.0.0',
+        workload: 'database',
+    },
+    {
+        capacityBound: 'concurrency',
+        cleanupPath: '/__ebk/performance/service/cleanup',
+        id: 'ebk-service-v1',
+        mutation: false,
+        requestMethod: 'GET',
+        requestPath: '/__ebk/performance/service',
+        scenarioId: 'service-extension',
+        saturationSignalRef: null,
+        version: '1.0.0',
+        workload: 'service',
+    },
+];
+export class ProtectedLoadEndpointError extends Error {
+    constructor(pointer, message) {
+        super(`${pointer}: ${message}`);
+        this.pointer = pointer;
+        this.classification = 'performance-load-authorization-invalid';
+        this.name = 'ProtectedLoadEndpointError';
+    }
+}
+const DIGEST = /^[a-f0-9]{64}$/;
+const FULL_COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const ACCOUNT_FINGERPRINT = /^sha256:[a-f0-9]{64}$/;
+const AWS_REGION = /^(?:(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-(?:gov|iso|isob|isoe|isof))?|eusc-[a-z]{2})-[a-z]+-\d$/;
+const HMAC_KEY_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const SLICE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const MAXIMUM_AUTHORIZATION_SECONDS = 24 * 60 * 60;
+const MAXIMUM_CLEANUP_GRACE_SECONDS = 24 * 60 * 60;
+const MAXIMUM_REQUESTS = 100000;
+function invalid(pointer, message) {
+    return new ProtectedLoadEndpointError(pointer, message);
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, expected, pointer) {
+    if (!record(value))
+        throw invalid(pointer, 'must be an object');
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    if (JSON.stringify(actual) !== JSON.stringify(wanted)) {
+        throw invalid(pointer, 'must contain only the exact v1 fields');
+    }
+}
+function reference(value, pointer) {
+    if (!isBoundedSafeReference(value, 'performance-evidence')) {
+        throw invalid(pointer, 'must be one bounded opaque reference');
+    }
+    return value;
+}
+function digest(value, pointer) {
+    if (typeof value !== 'string' || !DIGEST.test(value)) {
+        throw invalid(pointer, 'must be a lowercase SHA-256 digest');
+    }
+    return value;
+}
+function canonicalInstant(value, pointer) {
+    if (typeof value !== 'string' ||
+        !Number.isFinite(Date.parse(value)) ||
+        new Date(Date.parse(value)).toISOString() !== value) {
+        throw invalid(pointer, 'must be a canonical ISO-8601 instant');
+    }
+    return value;
+}
+function positiveInteger(value, pointer, maximum) {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0 || parsed > maximum) {
+        throw invalid(pointer, `must be between 1 and ${maximum}`);
+    }
+    return parsed;
+}
+function positiveNumber(value, pointer) {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw invalid(pointer, 'must be a finite number greater than zero');
+    }
+    return parsed;
+}
+function validateRelease(value, pointer) {
+    exactKeys(value, ['candidateDigest', 'releaseId', 'releaseMaterialDigest', 'sourceCommit'], pointer);
+    const sourceCommit = value['sourceCommit'];
+    if (typeof sourceCommit !== 'string' || !FULL_COMMIT.test(sourceCommit)) {
+        throw invalid(`${pointer}/sourceCommit`, 'must be one full Git object ID');
+    }
+    return {
+        candidateDigest: digest(value['candidateDigest'], `${pointer}/candidateDigest`),
+        releaseId: reference(value['releaseId'], `${pointer}/releaseId`),
+        releaseMaterialDigest: digest(value['releaseMaterialDigest'], `${pointer}/releaseMaterialDigest`),
+        sourceCommit,
+    };
+}
+function adapter(id) {
+    const value = PROTECTED_LOAD_ENDPOINT_ADAPTERS.find((candidate) => candidate.id === id);
+    if (!value)
+        throw invalid('binding/adapterId', 'is not supported');
+    return value;
+}
+function materialBytes(value) {
+    return JSON.stringify({
+        adapterId: value.adapterId,
+        configuredMaximum: value.configuredMaximum,
+        createdAt: value.createdAt,
+        durationSeconds: value.durationSeconds,
+        effectId: value.effectId,
+        expiresAt: value.expiresAt,
+        hmacKeyId: value.hmacKeyId,
+        maximumRequests: value.maximumRequests,
+        operation: value.operation,
+        planMaterialDigest: value.planMaterialDigest,
+        release: {
+            candidateDigest: value.release.candidateDigest,
+            releaseId: value.release.releaseId,
+            releaseMaterialDigest: value.release.releaseMaterialDigest,
+            sourceCommit: value.release.sourceCommit,
+        },
+        requestOrdinal: value.requestOrdinal,
+        runId: value.runId,
+        saturationSignalRef: value.saturationSignalRef,
+        scenarioId: value.scenarioId,
+        stage: value.stage,
+        target: {
+            accountFingerprint: value.target.accountFingerprint,
+            endpoint: value.target.endpoint,
+            region: value.target.region,
+            slice: value.target.slice,
+        },
+        workload: value.workload,
+    });
+}
+function validateHmacKey(value, pointer) {
+    const secret = record(value) && typeof value['secret'] === 'string' ? value['secret'] : '';
+    const decoded = /^[A-Za-z0-9_-]{43}$/.test(secret)
+        ? Buffer.from(secret, 'base64url')
+        : Buffer.alloc(0);
+    if (!record(value) ||
+        Object.keys(value).length !== 2 ||
+        !Object.prototype.hasOwnProperty.call(value, 'id') ||
+        !Object.prototype.hasOwnProperty.call(value, 'secret') ||
+        typeof value['id'] !== 'string' ||
+        !HMAC_KEY_ID.test(value['id']) ||
+        decoded.length !== 32 ||
+        decoded.toString('base64url') !== secret) {
+        throw invalid(pointer, 'must contain one bounded key ID and a canonical base64url 256-bit secret');
+    }
+    return value;
+}
+export function createProtectedLoadRequestSignature(input) {
+    const key = validateHmacKey(input.hmacKey, 'hmacKey');
+    if (input.authorization.hmacKeyId !== key.id) {
+        throw invalid('authorization/hmacKeyId', 'must equal the selected HMAC key identity');
+    }
+    return createHmac('sha256', Buffer.from(key.secret, 'base64url'))
+        .update(materialBytes(input.authorization), 'utf8')
+        .digest('hex');
+}
+function canonicalEndpoint(value, pointer) {
+    if (typeof value !== 'string') {
+        throw invalid(pointer, 'must be one exact canonical HTTPS endpoint');
+    }
+    let endpoint;
+    try {
+        endpoint = new URL(value);
+    }
+    catch (_a) {
+        throw invalid(pointer, 'must be one exact canonical HTTPS endpoint');
+    }
+    if (endpoint.protocol !== 'https:' ||
+        endpoint.username ||
+        endpoint.password ||
+        endpoint.search ||
+        endpoint.hash ||
+        endpoint.href !== value ||
+        ['localhost', '127.0.0.1', '::1'].includes(endpoint.hostname) ||
+        endpoint.hostname.endsWith('.localhost')) {
+        throw invalid(pointer, 'must be one exact canonical remote HTTPS endpoint');
+    }
+    return endpoint.href;
+}
+function expectedEndpoint(binding, operation) {
+    const definition = adapter(binding.adapterId);
+    const path = operation === 'cleanup' ? definition.cleanupPath : definition.requestPath;
+    if (path === null) {
+        throw invalid('binding/adapterId', 'does not provide cleanup');
+    }
+    const origin = canonicalEndpoint(`${binding.target.origin}/`, 'binding/target/origin');
+    if (new URL(origin).origin !== binding.target.origin) {
+        throw invalid('binding/target/origin', 'must be one exact canonical HTTPS origin without a trailing slash');
+    }
+    return new URL(`/${binding.target.slice}${path}`, origin).href;
+}
+function requestAuthorization(request, binding, operation, now) {
+    var _a, _b, _c, _d, _e, _f;
+    const definition = adapter(binding.adapterId);
+    const currentHmacKey = validateHmacKey((_a = binding.hmacKeys) === null || _a === void 0 ? void 0 : _a.current, 'binding/hmacKeys/current');
+    const previousHmacKey = ((_b = binding.hmacKeys) === null || _b === void 0 ? void 0 : _b.previous) === undefined
+        ? undefined
+        : validateHmacKey(binding.hmacKeys.previous, 'binding/hmacKeys/previous');
+    if (!DIGEST.test(binding.deployedCandidateDigest) ||
+        !isBoundedSafeReference(binding.deployedReleaseId, 'performance-evidence') ||
+        !DIGEST.test(binding.deployedReleaseMaterialDigest) ||
+        !FULL_COMMIT.test(binding.deployedSourceCommit) ||
+        !['production', 'staging'].includes(binding.stage) ||
+        !ACCOUNT_FINGERPRINT.test((_c = binding.target) === null || _c === void 0 ? void 0 : _c.accountFingerprint) ||
+        !AWS_REGION.test((_d = binding.target) === null || _d === void 0 ? void 0 : _d.region) ||
+        !SLICE.test((_e = binding.target) === null || _e === void 0 ? void 0 : _e.slice) ||
+        (previousHmacKey === null || previousHmacKey === void 0 ? void 0 : previousHmacKey.id) === currentHmacKey.id ||
+        (previousHmacKey === null || previousHmacKey === void 0 ? void 0 : previousHmacKey.secret) === currentHmacKey.secret) {
+        throw invalid('binding', 'must bind one exact deployed release, target, stage, and HMAC key generation');
+    }
+    const deployedEndpoint = expectedEndpoint(binding, operation);
+    const body = request.body === undefined ? {} : request.body;
+    if (!record(body))
+        throw invalid('request/body', 'must be an object');
+    const release = validateRelease({
+        candidateDigest: request.headers['x-ebk-performance-candidate'],
+        releaseId: request.headers['x-ebk-performance-release-id'],
+        releaseMaterialDigest: request.headers['x-ebk-performance-release-material'],
+        sourceCommit: request.headers['x-ebk-performance-source'],
+    }, 'request/release');
+    const createdAt = canonicalInstant(request.headers['x-ebk-performance-created-at'], 'request/createdAt');
+    const expiresAt = canonicalInstant(request.headers['x-ebk-performance-expires-at'], 'request/expiresAt');
+    const durationSeconds = positiveInteger(request.headers['x-ebk-performance-duration-seconds'], 'request/durationSeconds', MAXIMUM_AUTHORIZATION_SECONDS);
+    const configuredMaximum = positiveNumber(request.headers['x-ebk-performance-configured-maximum'], 'request/configuredMaximum');
+    const maximumRequests = positiveInteger(request.headers['x-ebk-performance-maximum-requests'], 'request/maximumRequests', MAXIMUM_REQUESTS);
+    const requestOrdinal = positiveInteger(request.headers['x-ebk-performance-request'], 'request/requestOrdinal', maximumRequests);
+    const stage = request.headers['x-ebk-performance-stage'];
+    if (stage !== 'production' && stage !== 'staging') {
+        throw invalid('request/stage', 'must equal production or staging');
+    }
+    const hmacKeyId = request.headers['x-ebk-performance-hmac-key-id'];
+    if (typeof hmacKeyId !== 'string' || !HMAC_KEY_ID.test(hmacKeyId)) {
+        throw invalid('request/hmacKeyId', 'must select one bounded deployed HMAC key generation');
+    }
+    const accountFingerprint = request.headers['x-ebk-performance-account-fingerprint'];
+    const region = request.headers['x-ebk-performance-region'];
+    const slice = request.headers['x-ebk-performance-slice'];
+    if (typeof accountFingerprint !== 'string' ||
+        !ACCOUNT_FINGERPRINT.test(accountFingerprint) ||
+        typeof region !== 'string' ||
+        !AWS_REGION.test(region) ||
+        typeof slice !== 'string' ||
+        !SLICE.test(slice)) {
+        throw invalid('request/target', 'must contain the exact account fingerprint, Region, and Slice');
+    }
+    const target = {
+        accountFingerprint,
+        endpoint: canonicalEndpoint(request.url, 'request/url'),
+        region,
+        slice,
+    };
+    const effectId = typeof body['effectId'] === 'string' ? body['effectId'] : null;
+    const authorization = {
+        adapterId: binding.adapterId,
+        configuredMaximum,
+        createdAt,
+        durationSeconds,
+        effectId,
+        expiresAt,
+        hmacKeyId,
+        maximumRequests,
+        operation,
+        planMaterialDigest: digest(request.headers['x-ebk-performance-plan'], 'request/planMaterialDigest'),
+        release,
+        requestOrdinal,
+        runId: reference(request.headers['x-ebk-performance-run'], 'request/runId'),
+        saturationSignalRef: reference(request.headers['x-ebk-performance-saturation-signal'], 'request/saturationSignalRef'),
+        scenarioId: reference(request.headers['x-ebk-performance-scenario'], 'request/scenarioId'),
+        stage,
+        target,
+        workload: definition.workload,
+    };
+    if (binding.stage !== stage ||
+        definition.scenarioId !== authorization.scenarioId ||
+        (definition.saturationSignalRef !== null &&
+            definition.saturationSignalRef !== authorization.saturationSignalRef) ||
+        binding.deployedCandidateDigest !== release.candidateDigest ||
+        binding.deployedReleaseId !== release.releaseId ||
+        binding.deployedReleaseMaterialDigest !== release.releaseMaterialDigest ||
+        binding.deployedSourceCommit !== release.sourceCommit ||
+        binding.target.accountFingerprint !== target.accountFingerprint ||
+        binding.target.region !== target.region ||
+        binding.target.slice !== target.slice ||
+        deployedEndpoint !== target.endpoint ||
+        request.method !==
+            (operation === 'cleanup' ? 'POST' : definition.requestMethod)) {
+        throw invalid('request', 'does not match the deployed release, target, adapter, signal, method, and stage');
+    }
+    const created = Date.parse(createdAt);
+    const expires = Date.parse(expiresAt);
+    const nowMilliseconds = now.getTime();
+    if (expires <= created ||
+        expires - created > MAXIMUM_AUTHORIZATION_SECONDS * 1000 ||
+        durationSeconds * 1000 > expires - created ||
+        nowMilliseconds < created ||
+        nowMilliseconds >
+            expires +
+                (operation === 'cleanup' ? MAXIMUM_CLEANUP_GRACE_SECONDS * 1000 : 0)) {
+        throw invalid('request/authorizationWindow', 'is not active inside the bounded execution or cleanup window');
+    }
+    const selectedHmacKey = currentHmacKey.id === hmacKeyId
+        ? currentHmacKey
+        : (previousHmacKey === null || previousHmacKey === void 0 ? void 0 : previousHmacKey.id) === hmacKeyId
+            ? previousHmacKey
+            : undefined;
+    if (!selectedHmacKey ||
+        (operation === 'execute' && selectedHmacKey !== currentHmacKey)) {
+        throw invalid('request/hmacKeyId', operation === 'execute'
+            ? 'execution requires the current deployed HMAC key generation'
+            : 'cleanup requires the current or immediately previous deployed HMAC key generation');
+    }
+    const signature = (_f = request.headers['x-ebk-performance-signature']) !== null && _f !== void 0 ? _f : '';
+    const actual = Buffer.from(signature, 'hex');
+    const expected = createHmac('sha256', Buffer.from(selectedHmacKey.secret, 'base64url'))
+        .update(materialBytes(authorization), 'utf8')
+        .digest();
+    if (!DIGEST.test(signature) ||
+        actual.length !== expected.length ||
+        !timingSafeEqual(actual, expected)) {
+        throw invalid('request/signature', 'does not authorize the exact request');
+    }
+    const expectedBodyKeys = [
+        ...(definition.mutation && operation === 'execute' ? ['effectId'] : []),
+        'planMaterialDigest',
+        'release',
+        'requestOrdinal',
+        'runId',
+        'scenarioId',
+        'workload',
+    ];
+    if (request.method === 'POST') {
+        exactKeys(body, expectedBodyKeys, 'request/body');
+        const bodyRelease = validateRelease(body['release'], 'request/body/release');
+        if (body['planMaterialDigest'] !== authorization.planMaterialDigest ||
+            body['requestOrdinal'] !== requestOrdinal ||
+            body['runId'] !== authorization.runId ||
+            body['scenarioId'] !== authorization.scenarioId ||
+            body['workload'] !== definition.workload ||
+            JSON.stringify(bodyRelease) !== JSON.stringify(release)) {
+            throw invalid('request/body', 'does not match the signed authorization');
+        }
+    }
+    else if (Object.keys(body).length !== 0) {
+        throw invalid('request/body', 'GET authorization cannot carry a body');
+    }
+    if ((definition.mutation &&
+        operation === 'execute' &&
+        !DIGEST.test(effectId !== null && effectId !== void 0 ? effectId : '')) ||
+        (operation === 'cleanup' && effectId !== null) ||
+        (!definition.mutation && effectId !== null)) {
+        throw invalid('request/body/effectId', 'must match the fixed execute-effect or run-cleanup contract');
+    }
+    return { authorization, body };
+}
+export function handleProtectedLoadScenarioEndpoint(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const definition = adapter(input.binding.adapterId);
+        const { authorization } = requestAuthorization(input.request, input.binding, 'execute', ((_a = input.now) !== null && _a !== void 0 ? _a : (() => new Date()))());
+        if ((yield input.reserve(authorization)) !== 'claimed') {
+            throw invalid('request/reservation', 'was not atomically claimed');
+        }
+        const result = yield input.execute(Object.assign(Object.assign({ authorization }, (authorization.effectId ? { effectId: authorization.effectId } : {})), { requestOrdinal: authorization.requestOrdinal }));
+        if (typeof result.saturationPercent !== 'number' ||
+            !Number.isFinite(result.saturationPercent) ||
+            result.saturationPercent < 0 ||
+            result.saturationPercent > 100 ||
+            (definition.mutation &&
+                !['already-existed', 'created'].includes(String(result.effectState))) ||
+            (!definition.mutation && result.effectState !== undefined)) {
+            throw invalid('execution', 'must return bounded saturation and the exact effect outcome');
+        }
+        return {
+            body: Object.assign(Object.assign({}, (authorization.effectId
+                ? {
+                    effect: {
+                        id: authorization.effectId,
+                        state: result.effectState,
+                    },
+                }
+                : {})), { kind: 'ebk-protected-load-telemetry', hmacKeyId: authorization.hmacKeyId, planMaterialDigest: authorization.planMaterialDigest, release: authorization.release, requestOrdinal: authorization.requestOrdinal, runId: authorization.runId, saturation: {
+                    percent: result.saturationPercent,
+                    signalRef: authorization.saturationSignalRef,
+                }, scenarioId: authorization.scenarioId, schemaVersion: 1, target: authorization.target, workload: authorization.workload }),
+            status: 200,
+        };
+    });
+}
+export function handleProtectedLoadCleanupEndpoint(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const definition = adapter(input.binding.adapterId);
+        if (definition.cleanupPath === null) {
+            throw invalid('cleanup', 'is unavailable for this adapter');
+        }
+        const { authorization } = requestAuthorization(input.request, input.binding, 'cleanup', ((_a = input.now) !== null && _a !== void 0 ? _a : (() => new Date()))());
+        const cleanup = yield input.cleanup(authorization);
+        if (!Number.isSafeInteger(cleanup.remainingEffectCount) ||
+            cleanup.remainingEffectCount !== 0 ||
+            !Number.isSafeInteger(cleanup.removedEffectCount) ||
+            cleanup.removedEffectCount < 0) {
+            throw invalid('cleanup', 'must prove the exact protected run absent');
+        }
+        return {
+            body: {
+                kind: 'ebk-protected-load-cleanup-result',
+                hmacKeyId: authorization.hmacKeyId,
+                planMaterialDigest: authorization.planMaterialDigest,
+                release: authorization.release,
+                remainingEffectCount: cleanup.remainingEffectCount,
+                removedEffectCount: cleanup.removedEffectCount,
+                runId: authorization.runId,
+                scenarioId: authorization.scenarioId,
+                schemaVersion: 1,
+                status: 'run-absent',
+                target: authorization.target,
+            },
+            status: 200,
+        };
+    });
+}
+//# sourceMappingURL=protected-load-endpoint.js.map

package/src/performance/protected-load-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-load-endpoint.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/performance/protected-load-endpoint.ts"],"names":[],"mappings":";AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C;QACE,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,IAAI;QACjB,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,WAAW,EAAE,+BAA+B;QAC5C,UAAU,EAAE,UAAU;QACtB,mBAAmB,EAAE,yCAAyC;QAC9D,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,YAAY;KACvB;IACD;QACE,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,yCAAyC;QACtD,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,iCAAiC;QAC9C,UAAU,EAAE,aAAa;QACzB,mBAAmB,EAAE,sDAAsD;QAC3E,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,cAAc;KACzB;IACD;QACE,aAAa,EAAE,aAAa;QAC5B,WAAW,EAAE,qCAAqC;QAClD,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,6BAA6B;QAC1C,UAAU,EAAE,sBAAsB;QAClC,mBAAmB,EAAE,yCAAyC;QAC9D,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,aAAa,EAAE,aAAa;QAC5B,WAAW,EAAE,oCAAoC;QACjD,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,WAAW,EAAE,4BAA4B;QACzC,UAAU,EAAE,mBAAmB;QAC/B,mBAAmB,EAAE,IAAI;QACzB,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,SAAS;KACpB;CACO,CAAC;AA0EX,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAGnD,YACW,OAAe,EACxB,OAAe;QAEf,KAAK,CAAC,GAAG,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;QAHvB,YAAO,GAAP,OAAO,CAAQ;QAHjB,mBAAc,GAAG,wCAAwC,CAAC;QAOjE,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,WAAW,GAAG,iCAAiC,CAAC;AACtD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AACpD,MAAM,UAAU,GACd,iGAAiG,CAAC;AACpG,MAAM,WAAW,GAAG,mCAAmC,CAAC;AACxD,MAAM,KAAK,GAAG,iCAAiC,CAAC;AAChD,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACnD,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACnD,MAAM,gBAAgB,GAAG,MAAO,CAAC;AAEjC,SAAS,OAAO,CAAC,OAAe,EAAE,OAAe;IAC/C,OAAO,IAAI,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,QAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,OAAe;IAChD,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,OAAe;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,OAAe;IACvD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EACnD,CAAC;QACD,MAAM,OAAO,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,OAAe,EACf,OAAe;IAEf,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;QACrE,MAAM,OAAO,CAAC,OAAO,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,OAAe;IACrD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,CAAC,OAAO,EAAE,2CAA2C,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,OAAe;IAEf,SAAS,CACP,KAAK,EACL,CAAC,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,EAAE,cAAc,CAAC,EACzE,OAAO,CACR,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,CAAC,GAAG,OAAO,eAAe,EAAE,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACL,eAAe,EAAE,MAAM,CACrB,KAAK,CAAC,iBAAiB,CAAC,EACxB,GAAG,OAAO,kBAAkB,CAC7B;QACD,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,YAAY,CAAC;QAChE,qBAAqB,EAAE,MAAM,CAC3B,KAAK,CAAC,uBAAuB,CAAC,EAC9B,GAAG,OAAO,wBAAwB,CACnC;QACD,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,EAAkC;IACjD,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CACjD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CACnC,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,OAAO,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAA0C;IAC/D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,OAAO,EAAE;YACP,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,qBAAqB;YAC1D,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE;YACN,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB;YACnD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;YAC3B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;SAC1B;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,OAAe;IAEf,MAAM,MAAM,GACV,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAChD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IACE,CAAC,MAAM,CAAC,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QAClD,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC/B,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,MAAM,KAAK,EAAE;QACrB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,MAAM,EACxC,CAAC;QACD,MAAM,OAAO,CACX,OAAO,EACP,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAkD,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAGnD;IACC,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,aAAa,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,CACX,yBAAyB,EACzB,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;SAC9D,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;SAClD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,OAAe;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,OAAO,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;IACvE,CAAC;IACD,IACE,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAC9B,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,IAAI,KAAK,KAAK;QACvB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7D,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EACxC,CAAC;QACD,MAAM,OAAO,CAAC,OAAO,EAAE,mDAAmD,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAuC,EACvC,SAA2D;IAE3D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,IAAI,GACR,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;IAC5E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,OAAO,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAC9B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,EAC3B,uBAAuB,CACxB,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,OAAO,CACX,uBAAuB,EACvB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAuC,EACvC,OAAuC,EACvC,SAA2D,EAC3D,GAAS;;IAKT,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,eAAe,CACpC,MAAA,OAAO,CAAC,QAAQ,0CAAE,OAAO,EACzB,0BAA0B,CAC3B,CAAC;IACF,MAAM,eAAe,GACnB,CAAA,MAAA,OAAO,CAAC,QAAQ,0CAAE,QAAQ,MAAK,SAAS;QACtC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IAC9E,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAC7C,CAAC,sBAAsB,CACrB,OAAO,CAAC,iBAAiB,EACzB,sBAAsB,CACvB;QACD,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC;QACnD,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC/C,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;QAClD,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,kBAAkB,CAAC;QAC7D,CAAC,UAAU,CAAC,IAAI,CAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;QACxC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,KAAK,CAAC;QAClC,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,EAAE,MAAK,cAAc,CAAC,EAAE;QACzC,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,MAAM,MAAK,cAAc,CAAC,MAAM,EACjD,CAAC;QACD,MAAM,OAAO,CACX,SAAS,EACT,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,eAAe,CAC7B;QACE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC;QAC/D,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC;QAC1D,qBAAqB,EACnB,OAAO,CAAC,OAAO,CAAC,oCAAoC,CAAC;QACvD,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC;KAC1D,EACD,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,gBAAgB,CAChC,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAC/C,mBAAmB,CACpB,CAAC;IACF,MAAM,SAAS,GAAG,gBAAgB,CAChC,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAC/C,mBAAmB,CACpB,CAAC;IACF,MAAM,eAAe,GAAG,eAAe,CACrC,OAAO,CAAC,OAAO,CAAC,oCAAoC,CAAC,EACrD,yBAAyB,EACzB,6BAA6B,CAC9B,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,CACtC,OAAO,CAAC,OAAO,CAAC,sCAAsC,CAAC,EACvD,2BAA2B,CAC5B,CAAC;IACF,MAAM,eAAe,GAAG,eAAe,CACrC,OAAO,CAAC,OAAO,CAAC,oCAAoC,CAAC,EACrD,yBAAyB,EACzB,gBAAgB,CACjB,CAAC;IACF,MAAM,cAAc,GAAG,eAAe,CACpC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAC5C,wBAAwB,EACxB,eAAe,CAChB,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,OAAO,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,OAAO,CACX,mBAAmB,EACnB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GACtB,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACzD,IACE,OAAO,kBAAkB,KAAK,QAAQ;QACtC,CAAC,mBAAmB,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAC7C,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QACxB,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAClB,CAAC;QACD,MAAM,OAAO,CACX,gBAAgB,EAChB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAkC;QAC5C,kBAAkB;QAClB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC;QACvD,MAAM;QACN,KAAK;KACN,CAAC;IACF,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,aAAa,GAAwC;QACzD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB;QACjB,SAAS;QACT,eAAe;QACf,QAAQ;QACR,SAAS;QACT,SAAS;QACT,eAAe;QACf,SAAS;QACT,kBAAkB,EAAE,MAAM,CACxB,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,EACzC,4BAA4B,CAC7B;QACD,OAAO;QACP,cAAc;QACd,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC;QAC3E,mBAAmB,EAAE,SAAS,CAC5B,OAAO,CAAC,OAAO,CAAC,qCAAqC,CAAC,EACtD,6BAA6B,CAC9B;QACD,UAAU,EAAE,SAAS,CACnB,OAAO,CAAC,OAAO,CAAC,4BAA4B,CAAC,EAC7C,oBAAoB,CACrB;QACD,KAAK;QACL,MAAM;QACN,QAAQ,EAAE,UAAU,CAAC,QAAQ;KAC9B,CAAC;IACF,IACE,OAAO,CAAC,KAAK,KAAK,KAAK;QACvB,UAAU,CAAC,UAAU,KAAK,aAAa,CAAC,UAAU;QAClD,CAAC,UAAU,CAAC,mBAAmB,KAAK,IAAI;YACtC,UAAU,CAAC,mBAAmB,KAAK,aAAa,CAAC,mBAAmB,CAAC;QACvE,OAAO,CAAC,uBAAuB,KAAK,OAAO,CAAC,eAAe;QAC3D,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,SAAS;QAC/C,OAAO,CAAC,6BAA6B,KAAK,OAAO,CAAC,qBAAqB;QACvE,OAAO,CAAC,oBAAoB,KAAK,OAAO,CAAC,YAAY;QACrD,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB;QAC/D,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QACvC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QACrC,gBAAgB,KAAK,MAAM,CAAC,QAAQ;QACpC,OAAO,CAAC,MAAM;YACZ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,EAC/D,CAAC;QACD,MAAM,OAAO,CACX,SAAS,EACT,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACtC,IACE,OAAO,IAAI,OAAO;QAClB,OAAO,GAAG,OAAO,GAAG,6BAA6B,GAAG,IAAK;QACzD,eAAe,GAAG,IAAK,GAAG,OAAO,GAAG,OAAO;QAC3C,eAAe,GAAG,OAAO;QACzB,eAAe;YACb,OAAO;gBACL,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,GAAG,IAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EACzE,CAAC;QACD,MAAM,OAAO,CACX,6BAA6B,EAC7B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GACnB,cAAc,CAAC,EAAE,KAAK,SAAS;QAC7B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,EAAE,MAAK,SAAS;YACjC,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,SAAS,CAAC;IAClB,IACE,CAAC,eAAe;QAChB,CAAC,SAAS,KAAK,SAAS,IAAI,eAAe,KAAK,cAAc,CAAC,EAC/D,CAAC;QACD,MAAM,OAAO,CACX,mBAAmB,EACnB,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,mFAAmF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,mCAAI,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,UAAU,CACzB,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CACjD;SACE,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;SAC5C,MAAM,EAAE,CAAC;IACZ,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACvB,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAClC,CAAC;QACD,MAAM,OAAO,CAAC,mBAAmB,EAAE,sCAAsC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,gBAAgB,GAAG;QACvB,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,oBAAoB;QACpB,SAAS;QACT,gBAAgB;QAChB,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,SAAS,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,eAAe,CACjC,IAAI,CAAC,SAAS,CAAC,EACf,sBAAsB,CACvB,CAAC;QACF,IACE,IAAI,CAAC,oBAAoB,CAAC,KAAK,aAAa,CAAC,kBAAkB;YAC/D,IAAI,CAAC,gBAAgB,CAAC,KAAK,cAAc;YACzC,IAAI,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC,KAAK;YACrC,IAAI,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC,UAAU;YAC/C,IAAI,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,QAAQ;YACxC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvD,CAAC;YACD,MAAM,OAAO,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,CAAC,cAAc,EAAE,uCAAuC,CAAC,CAAC;IACzE,CAAC;IACD,IACE,CAAC,UAAU,CAAC,QAAQ;QAClB,SAAS,KAAK,SAAS;QACvB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,CAAC;QAC/B,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;QAC9C,CAAC,CAAC,UAAU,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,EAC3C,CAAC;QACD,MAAM,OAAO,CACX,uBAAuB,EACvB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAgB,mCAAmC,CAAC,KAezD;;;QACC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,SAAS,EACT,CAAC,MAAA,KAAK,CAAC,GAAG,mCAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CACpC,CAAC;QACF,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,OAAO,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,+BAChC,aAAa,IACV,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACvE,cAAc,EAAE,aAAa,CAAC,cAAc,IAC5C,CAAC;QACH,IACE,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;YAC5C,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,CAAC;YAC5B,MAAM,CAAC,iBAAiB,GAAG,GAAG;YAC9B,CAAC,UAAU,CAAC,QAAQ;gBAClB,CAAC,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC,UAAU,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,EAC1D,CAAC;YACD,MAAM,OAAO,CACX,WAAW,EACX,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,kCACC,CAAC,aAAa,CAAC,QAAQ;gBACxB,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,EAAE,EAAE,aAAa,CAAC,QAAQ;wBAC1B,KAAK,EAAE,MAAM,CAAC,WAAW;qBAC1B;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC,KACP,IAAI,EAAE,8BAA8B,EACpC,SAAS,EAAE,aAAa,CAAC,SAAS,EAClC,kBAAkB,EAAE,aAAa,CAAC,kBAAkB,EACpD,OAAO,EAAE,aAAa,CAAC,OAAO,EAC9B,cAAc,EAAE,aAAa,CAAC,cAAc,EAC5C,KAAK,EAAE,aAAa,CAAC,KAAK,EAC1B,UAAU,EAAE;oBACV,OAAO,EAAE,MAAM,CAAC,iBAAiB;oBACjC,SAAS,EAAE,aAAa,CAAC,mBAAmB;iBAC7C,EACD,UAAU,EAAE,aAAa,CAAC,UAAU,EACpC,aAAa,EAAE,CAAC,EAChB,MAAM,EAAE,aAAa,CAAC,MAAM,EAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ,GACjC;YACD,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;CAAA;AAED,MAAM,UAAgB,kCAAkC,CAAC,KAQxD;;;QACC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,EACb,SAAS,EACT,CAAC,MAAA,KAAK,CAAC,GAAG,mCAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CACpC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACnD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACnD,OAAO,CAAC,oBAAoB,KAAK,CAAC;YAClC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACjD,OAAO,CAAC,kBAAkB,GAAG,CAAC,EAC9B,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;QACxE,CAAC;QACD,OAAO;YACL,IAAI,EAAE;gBACJ,IAAI,EAAE,mCAAmC;gBACzC,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAClD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,UAAU,EAAE,aAAa,CAAC,UAAU;gBACpC,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,aAAa,CAAC,MAAM;aAC7B;YACD,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;CAAA"}