@mannyc1/ts-release 0.2.2 → 0.3.0

package/dist/operation-journal/aws/policy.js

@@ -0,0 +1,404 @@
+import { encodeCanonicalJson, parseStrictJson } from "../../model/canonical.js";
+import { objectChecksum } from "../canonical.js";
+import { S3JournalBoundaryError } from "../model.js";
+const encoder = new TextEncoder();
+const boundaryFailure = (reason) => S3JournalBoundaryError.make({
+    operation: "observe-authority",
+    commitment: "not-applicable",
+    reason
+});
+const fail = (reason) => {
+    throw boundaryFailure(reason);
+};
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const exactObject = (value, fields, label) => {
+    if (!isObject(value))
+        fail(`${label} must be an object.`);
+    const object = value;
+    const actual = Object.keys(object).sort();
+    const expected = [...fields].sort();
+    if (actual.length !== expected.length || actual.some((field, index) => field !== expected[index])) {
+        fail(`${label} fields are not the exact admitted set.`);
+    }
+    return object;
+};
+const stringValue = (value, label) => {
+    if (typeof value !== "string" || value.length === 0 || value !== value.normalize("NFC")) {
+        fail(`${label} must be one non-empty NFC string.`);
+    }
+    return value;
+};
+const stringSet = (value, label) => {
+    const values = Array.isArray(value)
+        ? value.map((item, index) => stringValue(item, `${label}[${index}]`))
+        : [stringValue(value, label)];
+    const sorted = [...values].sort();
+    if (sorted.length === 0 || new Set(sorted).size !== sorted.length) {
+        fail(`${label} must be one duplicate-free string set.`);
+    }
+    return sorted;
+};
+const normalizePrincipal = (value, label) => {
+    if (value === "*")
+        return "*";
+    if (!isObject(value))
+        fail(`${label} must be '*' or an exact principal object.`);
+    const principal = value;
+    const fields = Object.keys(principal).sort();
+    if (fields.length !== 1 || (fields[0] !== "AWS" && fields[0] !== "Federated")) {
+        fail(`${label} must contain exactly one AWS or Federated principal kind.`);
+    }
+    const field = fields[0];
+    return { [field]: stringSet(principal[field], `${label}.${field}`) };
+};
+const normalizeCondition = (value, label) => {
+    if (!isObject(value))
+        fail(`${label} must be an object.`);
+    const condition = value;
+    const normalized = {};
+    const operators = Object.keys(condition).sort();
+    if (operators.length === 0)
+        fail(`${label} must not be empty.`);
+    for (const operator of operators) {
+        if (!/^[A-Za-z][A-Za-z0-9:]*$/u.test(operator))
+            fail(`${label} has an invalid operator.`);
+        const entries = condition[operator];
+        if (!isObject(entries))
+            fail(`${label}.${operator} must be an object.`);
+        const normalizedEntries = {};
+        const keys = Object.keys(entries).sort();
+        if (keys.length === 0)
+            fail(`${label}.${operator} must not be empty.`);
+        for (const key of keys) {
+            normalizedEntries[key] = stringSet(entries[key], `${label}.${operator}.${key}`);
+        }
+        normalized[operator] = normalizedEntries;
+    }
+    return normalized;
+};
+const normalizeStatement = (value, index) => {
+    if (!isObject(value))
+        fail(`Policy statement ${index} must be an object.`);
+    const object = value;
+    const admitted = new Set(["Sid", "Effect", "Principal", "Action", "Resource", "NotResource", "Condition"]);
+    for (const field of Object.keys(object)) {
+        if (!admitted.has(field))
+            fail(`Policy statement ${index} contains unadmitted field ${field}.`);
+    }
+    const sid = stringValue(object.Sid, `Policy statement ${index}.Sid`);
+    if (!/^[A-Za-z0-9]{1,128}$/u.test(sid))
+        fail(`Policy statement ${index}.Sid is not canonical.`);
+    const effect = stringValue(object.Effect, `Policy statement ${index}.Effect`);
+    if (effect !== "Allow" && effect !== "Deny")
+        fail(`Policy statement ${index}.Effect is not admitted.`);
+    if (object.Resource !== undefined && object.NotResource !== undefined) {
+        fail(`Policy statement ${index} cannot contain both Resource and NotResource.`);
+    }
+    return {
+        Sid: sid,
+        Effect: effect,
+        ...(object.Principal === undefined ? {} : { Principal: normalizePrincipal(object.Principal, `Policy statement ${index}.Principal`) }),
+        Action: stringSet(object.Action, `Policy statement ${index}.Action`),
+        ...(object.Resource === undefined ? {} : { Resource: stringSet(object.Resource, `Policy statement ${index}.Resource`) }),
+        ...(object.NotResource === undefined ? {} : { NotResource: stringSet(object.NotResource, `Policy statement ${index}.NotResource`) }),
+        ...(object.Condition === undefined ? {} : { Condition: normalizeCondition(object.Condition, `Policy statement ${index}.Condition`) })
+    };
+};
+const parsePolicyDocument = (document, label) => {
+    let parsed;
+    try {
+        const source = document.trimStart().startsWith("{") ? document : decodeURIComponent(document);
+        parsed = parseStrictJson(source);
+    }
+    catch {
+        return fail(`${label} is not one valid JSON or RFC3986-encoded JSON policy.`);
+    }
+    const policy = exactObject(parsed, ["Statement", "Version"], label);
+    if (policy.Version !== "2012-10-17")
+        fail(`${label} has an unsupported version.`);
+    const rawStatements = Array.isArray(policy.Statement) ? policy.Statement : [policy.Statement];
+    if (rawStatements.length === 0)
+        fail(`${label} has no statements.`);
+    const statements = rawStatements.map(normalizeStatement).sort((left, right) => left.Sid.localeCompare(right.Sid));
+    if (new Set(statements.map((statement) => statement.Sid)).size !== statements.length) {
+        fail(`${label} repeats a statement Sid.`);
+    }
+    return { Version: "2012-10-17", Statement: statements };
+};
+const canonicalPolicy = (policy) => encodeCanonicalJson(policy);
+const policyDigest = (policy) => objectChecksum(encoder.encode(canonicalPolicy(policy)));
+const condition = (operator, entries) => ({
+    [operator]: Object.fromEntries(Object.entries(entries).map(([key, value]) => [
+        key,
+        [...(Array.isArray(value) ? value : [value])].sort()
+    ]))
+});
+const statement = (value) => value;
+const requireImmutableCalledWorkflow = (coordinates) => {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/\.github\/workflows\/[A-Za-z0-9._-]+\.ya?ml@[a-f0-9]{40}$/u
+        .test(coordinates.oidcTrust.jobWorkflowRef)) {
+        fail("Journal OIDC trust must pin the called workflow to one immutable source SHA.");
+    }
+};
+export const makeAwsJournalTrustPolicy = (coordinates) => {
+    requireImmutableCalledWorkflow(coordinates);
+    return {
+        Version: "2012-10-17",
+        Statement: [statement({
+                Sid: "AllowGitHubJournalOidc",
+                Effect: "Allow",
+                Principal: {
+                    Federated: [`arn:aws:iam::${coordinates.accountId}:oidc-provider/token.actions.githubusercontent.com`]
+                },
+                Action: ["sts:AssumeRoleWithWebIdentity"],
+                Condition: condition("StringEquals", {
+                    "token.actions.githubusercontent.com:aud": coordinates.oidcTrust.audience,
+                    "token.actions.githubusercontent.com:sub": coordinates.oidcTrust.subject,
+                    "token.actions.githubusercontent.com:repository": coordinates.oidcTrust.repository,
+                    "token.actions.githubusercontent.com:repository_id": coordinates.oidcTrust.repositoryId,
+                    "token.actions.githubusercontent.com:repository_owner_id": coordinates.oidcTrust.repositoryOwnerId,
+                    "token.actions.githubusercontent.com:workflow": coordinates.oidcTrust.workflow,
+                    "token.actions.githubusercontent.com:ref": coordinates.oidcTrust.ref,
+                    "token.actions.githubusercontent.com:environment": coordinates.oidcTrust.environment,
+                    "token.actions.githubusercontent.com:job_workflow_ref": coordinates.oidcTrust.jobWorkflowRef
+                })
+            })]
+    };
+};
+export const makeAwsJournalRolePolicy = (coordinates) => ({
+    Version: "2012-10-17",
+    Statement: [
+        statement({
+            Sid: "DenyJournalBucketGovernanceMutation",
+            Effect: "Deny",
+            Action: [
+                "s3:DeleteBucket*",
+                "s3:DeletePublicAccessBlock",
+                "s3:PutBucket*",
+                "s3:PutLifecycleConfiguration",
+                "s3:PutPublicAccessBlock"
+            ].sort(),
+            Resource: [coordinates.bucketArn]
+        }),
+        statement({
+            Sid: "DenyJournalCopy",
+            Effect: "Deny",
+            Action: ["s3:PutObject"],
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`],
+            Condition: condition("Null", { "s3:x-amz-copy-source": "false" })
+        }),
+        statement({
+            Sid: "DenyJournalDestructiveObjectMutation",
+            Effect: "Deny",
+            Action: [
+                "s3:AbortMultipartUpload",
+                "s3:BypassGovernanceRetention",
+                "s3:DeleteObject",
+                "s3:DeleteObjectVersion",
+                "s3:PutObjectAcl",
+                "s3:PutObjectLegalHold",
+                "s3:PutObjectRetention",
+                "s3:PutObjectTagging"
+            ].sort(),
+            Resource: [`${coordinates.bucketArn}/*`]
+        }),
+        statement({
+            Sid: "DenyJournalIamMutation",
+            Effect: "Deny",
+            Action: [
+                "iam:Add*",
+                "iam:Attach*",
+                "iam:Change*",
+                "iam:Create*",
+                "iam:Deactivate*",
+                "iam:Delete*",
+                "iam:Detach*",
+                "iam:Enable*",
+                "iam:PassRole",
+                "iam:Put*",
+                "iam:Remove*",
+                "iam:Reset*",
+                "iam:Resync*",
+                "iam:Set*",
+                "iam:Tag*",
+                "iam:Untag*",
+                "iam:Update*",
+                "iam:Upload*"
+            ].sort(),
+            Resource: ["*"]
+        }),
+        statement({
+            Sid: "DenyJournalMultipart",
+            Effect: "Deny",
+            Action: ["s3:PutObject"],
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`],
+            Condition: condition("Bool", { "s3:ObjectCreationOperation": "false" })
+        }),
+        statement({
+            Sid: "DenyJournalWritesOutsideNamespace",
+            Effect: "Deny",
+            Action: ["s3:PutObject"],
+            NotResource: [`${coordinates.bucketArn}/operation-journal/v1/*`]
+        }),
+        statement({
+            Sid: "ListJournalNamespace",
+            Effect: "Allow",
+            Action: ["s3:ListBucketVersions"],
+            Resource: [coordinates.bucketArn],
+            Condition: condition("StringLike", { "s3:prefix": "operation-journal/v1/*" })
+        }),
+        statement({
+            Sid: "ReadJournalBucketGovernance",
+            Effect: "Allow",
+            Action: [
+                "s3:GetBucketObjectLockConfiguration",
+                "s3:GetBucketOwnershipControls",
+                "s3:GetBucketPolicy",
+                "s3:GetBucketPolicyStatus",
+                "s3:GetBucketPublicAccessBlock",
+                "s3:GetBucketVersioning"
+            ].sort(),
+            Resource: [coordinates.bucketArn]
+        }),
+        statement({
+            Sid: "ReadJournalRole",
+            Effect: "Allow",
+            Action: [
+                "iam:GetRole",
+                "iam:GetRolePolicy",
+                "iam:ListAttachedRolePolicies",
+                "iam:ListRolePolicies"
+            ].sort(),
+            Resource: [coordinates.roleArn]
+        }),
+        statement({
+            Sid: "ReadWriteJournalObjects",
+            Effect: "Allow",
+            Action: [
+                "s3:GetObjectRetention",
+                "s3:GetObjectVersion",
+                "s3:GetObjectVersionAttributes",
+                "s3:PutObject"
+            ].sort(),
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`]
+        })
+    ].sort((left, right) => left.Sid.localeCompare(right.Sid))
+});
+export const makeAwsJournalBucketPolicy = (coordinates) => ({
+    Version: "2012-10-17",
+    Statement: [
+        statement({
+            Sid: "DenyJournalCopy",
+            Effect: "Deny",
+            Principal: "*",
+            Action: ["s3:PutObject"],
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`],
+            Condition: condition("Null", { "s3:x-amz-copy-source": "false" })
+        }),
+        statement({
+            Sid: "DenyJournalDeletes",
+            Effect: "Deny",
+            Principal: "*",
+            Action: ["s3:DeleteObject", "s3:DeleteObjectVersion"],
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`]
+        }),
+        statement({
+            Sid: "DenyJournalDualConditionWrite",
+            Effect: "Deny",
+            Principal: "*",
+            Action: ["s3:PutObject"],
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`],
+            Condition: {
+                Bool: { "s3:ObjectCreationOperation": ["true"] },
+                Null: { "s3:if-match": ["false"], "s3:if-none-match": ["false"] }
+            }
+        }),
+        statement({
+            Sid: "DenyJournalMetadataMutation",
+            Effect: "Deny",
+            Principal: "*",
+            Action: [
+                "s3:PutObjectAcl",
+                "s3:PutObjectLegalHold",
+                "s3:PutObjectRetention",
+                "s3:PutObjectTagging"
+            ].sort(),
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`]
+        }),
+        statement({
+            Sid: "DenyJournalMultipart",
+            Effect: "Deny",
+            Principal: "*",
+            Action: ["s3:PutObject"],
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`],
+            Condition: condition("Bool", { "s3:ObjectCreationOperation": "false" })
+        }),
+        statement({
+            Sid: "DenyJournalRoleWriteOutsideNamespace",
+            Effect: "Deny",
+            Principal: "*",
+            Action: ["s3:PutObject"],
+            NotResource: [`${coordinates.bucketArn}/operation-journal/v1/*`],
+            Condition: condition("ArnEquals", { "aws:PrincipalArn": coordinates.roleArn })
+        }),
+        statement({
+            Sid: "DenyJournalUnconditionalWrite",
+            Effect: "Deny",
+            Principal: "*",
+            Action: ["s3:PutObject"],
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`],
+            Condition: {
+                Bool: { "s3:ObjectCreationOperation": ["true"] },
+                Null: { "s3:if-match": ["true"], "s3:if-none-match": ["true"] }
+            }
+        }),
+        statement({
+            Sid: "DenyNonJournalPrincipalList",
+            Effect: "Deny",
+            Principal: "*",
+            Action: ["s3:ListBucketVersions"],
+            Resource: [coordinates.bucketArn],
+            Condition: condition("ArnNotEquals", { "aws:PrincipalArn": coordinates.roleArn })
+        }),
+        statement({
+            Sid: "DenyNonJournalPrincipalObjectAccess",
+            Effect: "Deny",
+            Principal: "*",
+            Action: [
+                "s3:GetObject",
+                "s3:GetObjectAttributes",
+                "s3:GetObjectRetention",
+                "s3:GetObjectVersion",
+                "s3:GetObjectVersionAttributes",
+                "s3:PutObject"
+            ].sort(),
+            Resource: [`${coordinates.bucketArn}/operation-journal/v1/*`],
+            Condition: condition("ArnNotEquals", { "aws:PrincipalArn": coordinates.roleArn })
+        })
+    ].sort((left, right) => left.Sid.localeCompare(right.Sid))
+});
+const requireExactPolicy = (observedDocument, expected, label) => {
+    const observed = parsePolicyDocument(observedDocument, label);
+    if (canonicalPolicy(observed) !== canonicalPolicy(expected)) {
+        fail(`${label} does not equal the one admitted operational-journal policy.`);
+    }
+    return observed;
+};
+export const validateAwsJournalPolicies = (input) => {
+    const trust = requireExactPolicy(input.trustPolicyDocument, makeAwsJournalTrustPolicy(input.coordinates), "Journal role trust policy");
+    const role = requireExactPolicy(input.rolePolicyDocument, makeAwsJournalRolePolicy(input.coordinates), "Journal role permission policy");
+    const bucket = requireExactPolicy(input.bucketPolicyDocument, makeAwsJournalBucketPolicy(input.coordinates), "Journal bucket policy");
+    return {
+        bucketPolicyDigest: policyDigest(bucket),
+        rolePolicyDigest: policyDigest(role),
+        oidcTrustPolicyDigest: policyDigest(trust)
+    };
+};
+export const assertAwsJournalPolicyDigests = (authority, observed) => {
+    if (authority.bucketPolicyDigest !== observed.bucketPolicyDigest ||
+        authority.rolePolicyDigest !== observed.rolePolicyDigest ||
+        authority.oidcTrustPolicyDigest !== observed.oidcTrustPolicyDigest) {
+        fail("Observed journal policy digests drifted from the exact activation contract.");
+    }
+};
+//# sourceMappingURL=policy.js.map

package/dist/operation-journal/aws/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/operation-journal/aws/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAa,MAAM,0BAA0B,CAAA;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EACL,sBAAsB,EAGvB,MAAM,aAAa,CAAA;AAEpB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAsCjC,MAAM,eAAe,GAAG,CAAC,MAAc,EAA0B,EAAE,CACjE,sBAAsB,CAAC,IAAI,CAAC;IAC1B,SAAS,EAAE,mBAAmB;IAC9B,UAAU,EAAE,gBAAgB;IAC5B,MAAM;CACP,CAAC,CAAA;AAEJ,MAAM,IAAI,GAAG,CAAC,MAAc,EAAS,EAAE;IACrC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,KAAW,EAAuB,EAAE,CACpD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEtE,MAAM,WAAW,GAAG,CAClB,KAAW,EACX,MAA6B,EAC7B,KAAa,EACD,EAAE;IACd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,KAAmB,CAAA;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAClG,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAE,KAAa,EAAU,EAAE;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,KAAe,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAuB,EAAE,KAAa,EAAyB,EAAE;IAClF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,KAAuB,EAAE,KAAa,EAA6B,EAAE;IAC/F,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IAC7B,IAAI,CAAC,QAAQ,CAAC,KAAM,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,4CAA4C,CAAC,CAAA;IACjF,MAAM,SAAS,GAAG,KAAmB,CAAA;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,GAAG,KAAK,4DAA4D,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAwB,CAAA;IAC9C,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,EAAE,CAAA;AACtE,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CACzB,KAAuB,EACvB,KAAa,EAC8D,EAAE;IAC7E,IAAI,CAAC,QAAQ,CAAC,KAAM,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,KAAmB,CAAA;IACrC,MAAM,UAAU,GAA0D,EAAE,CAAA;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAA;IAC/D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAA;QACzF,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnC,IAAI,CAAC,QAAQ,CAAC,OAAQ,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK,IAAI,QAAQ,qBAAqB,CAAC,CAAA;QACxE,MAAM,iBAAiB,GAA0C,EAAE,CAAA;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAqB,CAAC,CAAC,IAAI,EAAE,CAAA;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK,IAAI,QAAQ,qBAAqB,CAAC,CAAA;QACtE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,iBAAiB,CAAC,GAAG,CAAC,GAAG,SAAS,CAAE,OAAsB,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAA;QACjG,CAAC;QACD,UAAU,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAA;IAC1C,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,KAAW,EAAE,KAAa,EAAuB,EAAE;IAC7E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,oBAAoB,KAAK,qBAAqB,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,KAAmB,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAC1G,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,oBAAoB,KAAK,8BAA8B,KAAK,GAAG,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,oBAAoB,KAAK,MAAM,CAAC,CAAA;IACpE,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,oBAAoB,KAAK,wBAAwB,CAAC,CAAA;IAC/F,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAA;IAC7E,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM;QAAE,IAAI,CAAC,oBAAoB,KAAK,0BAA0B,CAAC,CAAA;IACtG,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtE,IAAI,CAAC,oBAAoB,KAAK,gDAAgD,CAAC,CAAA;IACjF,CAAC;IACD,OAAO;QACL,GAAG,EAAE,GAAG;QACR,MAAM,EAAE,MAA0B;QAClC,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,KAAK,YAAY,CAAC,EAAE,CAAC;QACrI,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,KAAK,SAAS,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,KAAK,WAAW,CAAC,EAAE,CAAC;QACxH,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,KAAK,cAAc,CAAC,EAAE,CAAC;QACpI,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,KAAK,YAAY,CAAC,EAAE,CAAC;KACtI,CAAA;AACH,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAoB,EAAE;IAChF,IAAI,MAAY,CAAA;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAC7F,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,GAAG,KAAK,wDAAwD,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAA;IACnE,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY;QAAE,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAA;IACjF,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAU,CAAC,CAAA;IAC9F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACjH,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACrF,IAAI,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,MAAwB,EAAU,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;AACzF,MAAM,YAAY,GAAG,CAAC,MAAwB,EAAU,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAElH,MAAM,SAAS,GAAG,CAChB,QAAgB,EAChB,OAAiE,EACU,EAAE,CAAC,CAAC;IAC/E,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3E,GAAG;QACH,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACrD,CAAC,CAAC;CACJ,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,KAA0B,EAAuB,EAAE,CAAC,KAAK,CAAA;AAE5E,MAAM,8BAA8B,GAAG,CAAC,WAAwC,EAAQ,EAAE;IACxF,IAAI,CAAC,+FAA+F;SACjG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,8EAA8E,CAAC,CAAA;IACtF,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,WAAwC,EACtB,EAAE;IACpB,8BAA8B,CAAC,WAAW,CAAC,CAAA;IAC3C,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE,CAAC,SAAS,CAAC;gBACpB,GAAG,EAAE,wBAAwB;gBAC7B,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE;oBACT,SAAS,EAAE,CAAC,gBAAgB,WAAW,CAAC,SAAS,oDAAoD,CAAC;iBACvG;gBACD,MAAM,EAAE,CAAC,+BAA+B,CAAC;gBACzC,SAAS,EAAE,SAAS,CAAC,cAAc,EAAE;oBACnC,yCAAyC,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ;oBACzE,yCAAyC,EAAE,WAAW,CAAC,SAAS,CAAC,OAAO;oBACxE,gDAAgD,EAAE,WAAW,CAAC,SAAS,CAAC,UAAU;oBAClF,mDAAmD,EAAE,WAAW,CAAC,SAAS,CAAC,YAAY;oBACvF,yDAAyD,EAAE,WAAW,CAAC,SAAS,CAAC,iBAAiB;oBAClG,8CAA8C,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ;oBAC9E,yCAAyC,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG;oBACpE,iDAAiD,EAAE,WAAW,CAAC,SAAS,CAAC,WAAW;oBACpF,sDAAsD,EAAE,WAAW,CAAC,SAAS,CAAC,cAAc;iBAC7F,CAAC;aACH,CAAC,CAAC;KACJ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,WAAwC,EACtB,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT,SAAS,CAAC;YACR,GAAG,EAAE,qCAAqC;YAC1C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,kBAAkB;gBAClB,4BAA4B;gBAC5B,eAAe;gBACf,8BAA8B;gBAC9B,yBAAyB;aAC1B,CAAC,IAAI,EAAE;YACR,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;SAClC,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,iBAAiB;YACtB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;YAC7D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC;SAClE,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,sCAAsC;YAC3C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,yBAAyB;gBACzB,8BAA8B;gBAC9B,iBAAiB;gBACjB,wBAAwB;gBACxB,iBAAiB;gBACjB,uBAAuB;gBACvB,uBAAuB;gBACvB,qBAAqB;aACtB,CAAC,IAAI,EAAE;YACR,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,IAAI,CAAC;SACzC,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,UAAU;gBACV,aAAa;gBACb,aAAa;gBACb,aAAa;gBACb,iBAAiB;gBACjB,aAAa;gBACb,aAAa;gBACb,aAAa;gBACb,cAAc;gBACd,UAAU;gBACV,aAAa;gBACb,YAAY;gBACZ,aAAa;gBACb,UAAU;gBACV,UAAU;gBACV,YAAY;gBACZ,aAAa;gBACb,aAAa;aACd,CAAC,IAAI,EAAE;YACR,QAAQ,EAAE,CAAC,GAAG,CAAC;SAChB,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;YAC7D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,4BAA4B,EAAE,OAAO,EAAE,CAAC;SACxE,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,mCAAmC;YACxC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;SACjE,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,CAAC,uBAAuB,CAAC;YACjC,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;YACjC,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;SAC9E,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,OAAO;YACf,MAAM,EAAE;gBACN,qCAAqC;gBACrC,+BAA+B;gBAC/B,oBAAoB;gBACpB,0BAA0B;gBAC1B,+BAA+B;gBAC/B,wBAAwB;aACzB,CAAC,IAAI,EAAE;YACR,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;SAClC,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,iBAAiB;YACtB,MAAM,EAAE,OAAO;YACf,MAAM,EAAE;gBACN,aAAa;gBACb,mBAAmB;gBACnB,8BAA8B;gBAC9B,sBAAsB;aACvB,CAAC,IAAI,EAAE;YACR,QAAQ,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;SAChC,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,yBAAyB;YAC9B,MAAM,EAAE,OAAO;YACf,MAAM,EAAE;gBACN,uBAAuB;gBACvB,qBAAqB;gBACrB,+BAA+B;gBAC/B,cAAc;aACf,CAAC,IAAI,EAAE;YACR,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;SAC9D,CAAC;KACH,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;CAC3D,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,WAAwC,EACtB,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT,SAAS,CAAC;YACR,GAAG,EAAE,iBAAiB;YACtB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;YAC7D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC;SAClE,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,oBAAoB;YACzB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;YACrD,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;SAC9D,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,+BAA+B;YACpC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;YAC7D,SAAS,EAAE;gBACT,IAAI,EAAE,EAAE,4BAA4B,EAAE,CAAC,MAAM,CAAC,EAAE;gBAChD,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC,OAAO,CAAC,EAAE;aAClE;SACF,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE;gBACN,iBAAiB;gBACjB,uBAAuB;gBACvB,uBAAuB;gBACvB,qBAAqB;aACtB,CAAC,IAAI,EAAE;YACR,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;SAC9D,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;YAC7D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,4BAA4B,EAAE,OAAO,EAAE,CAAC;SACxE,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,sCAAsC;YAC3C,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;YAChE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAC/E,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,+BAA+B;YACpC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;YAC7D,SAAS,EAAE;gBACT,IAAI,EAAE,EAAE,4BAA4B,EAAE,CAAC,MAAM,CAAC,EAAE;gBAChD,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC,EAAE;aAChE;SACF,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,CAAC,uBAAuB,CAAC;YACjC,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;YACjC,SAAS,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,kBAAkB,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAClF,CAAC;QACF,SAAS,CAAC;YACR,GAAG,EAAE,qCAAqC;YAC1C,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE;gBACN,cAAc;gBACd,wBAAwB;gBACxB,uBAAuB;gBACvB,qBAAqB;gBACrB,+BAA+B;gBAC/B,cAAc;aACf,CAAC,IAAI,EAAE;YACR,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;YAC7D,SAAS,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,kBAAkB,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAClF,CAAC;KACH,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;CAC3D,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,CACzB,gBAAwB,EACxB,QAA0B,EAC1B,KAAa,EACK,EAAE;IACpB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;IAC7D,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,KAAK,8DAA8D,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,KAK1C,EAAmC,EAAE;IACpC,MAAM,KAAK,GAAG,kBAAkB,CAC9B,KAAK,CAAC,mBAAmB,EACzB,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,EAC5C,2BAA2B,CAC5B,CAAA;IACD,MAAM,IAAI,GAAG,kBAAkB,CAC7B,KAAK,CAAC,kBAAkB,EACxB,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,EAC3C,gCAAgC,CACjC,CAAA;IACD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,KAAK,CAAC,oBAAoB,EAC1B,0BAA0B,CAAC,KAAK,CAAC,WAAW,CAAC,EAC7C,uBAAuB,CACxB,CAAA;IACD,OAAO;QACL,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC;QACxC,gBAAgB,EAAE,YAAY,CAAC,IAAI,CAAC;QACpC,qBAAqB,EAAE,YAAY,CAAC,KAAK,CAAC;KAC3C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,SAA6B,EAC7B,QAAyC,EACnC,EAAE;IACR,IAAI,SAAS,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB;QAC5D,SAAS,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;QACxD,SAAS,CAAC,qBAAqB,KAAK,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACvE,IAAI,CAAC,6EAA6E,CAAC,CAAA;IACrF,CAAC;AACH,CAAC,CAAA"}

package/dist/operation-journal/aws/s3-boundary.d.ts

@@ -0,0 +1,17 @@
+import { IAMClient } from "@aws-sdk/client-iam";
+import { S3Client } from "@aws-sdk/client-s3";
+import { STSClient } from "@aws-sdk/client-sts";
+import { type S3JournalAuthority, type S3JournalBoundaryShape } from "../model.js";
+import type { AwsJournalSession } from "./oidc.js";
+export interface AwsS3JournalBoundaryOptions {
+    readonly authority: S3JournalAuthority;
+    readonly rolePolicyName: string;
+}
+export interface AwsJournalClients {
+    readonly iam: IAMClient;
+    readonly s3: S3Client;
+    readonly sts: STSClient;
+}
+export declare const readBoundedObjectBody: (body: unknown, contentLength: number, deadlineMilliseconds?: number) => Promise<Uint8Array>;
+export declare const makeAwsS3JournalBoundaryFromClients: (options: AwsS3JournalBoundaryOptions, session: AwsJournalSession, clients: AwsJournalClients, deadlineMilliseconds?: number) => S3JournalBoundaryShape;
+//# sourceMappingURL=s3-boundary.d.ts.map

package/dist/operation-journal/aws/s3-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-boundary.d.ts","sourceRoot":"","sources":["../../../src/operation-journal/aws/s3-boundary.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,SAAS,EAGV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAYL,QAAQ,EACT,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAA4B,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAGzE,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAK5B,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAWlD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;IACvB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CACxB;AA6FD,eAAO,MAAM,qBAAqB,GAChC,MAAM,OAAO,EACb,eAAe,MAAM,EACrB,6BAAkE,KACjE,OAAO,CAAC,UAAU,CAkDpB,CAAA;AA4VD,eAAO,MAAM,mCAAmC,GAC9C,SAAS,2BAA2B,EACpC,SAAS,iBAAiB,EAC1B,SAAS,iBAAiB,EAC1B,6BAAkE,KACjE,sBAMD,CAAA"}