@xemahq/contracts 0.1.0

package/dist/distribution/lib/image-producer-evidence.js

@@ -0,0 +1,458 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DistributionImageReplayStateSchema = exports.SigstoreOfflineTrustPolicySchema = exports.SigstoreIdentityPolicySchema = exports.DistributionImageEvidenceSetSchema = exports.SigstoreEvidenceDescriptorSchema = exports.ImageDeliveryEntitlementStatementSchema = exports.ImageDeliveryEntitlementPredicateSchema = exports.IMAGE_DELIVERY_ENTITLEMENT_PREDICATE_TYPE = exports.ImageDeliveryMode = exports.DistributionImagesStatementSchema = exports.DistributionImagesPredicateSchema = exports.DISTRIBUTION_IMAGES_PREDICATE_TYPE = exports.ImageProducerStatementSchema = exports.IMAGE_PRODUCER_PREDICATE_TYPE = exports.ImageProducerPredicateSchema = exports.ImageProducerRunSchema = exports.ImageProducerArtifactSchema = exports.ImageProducerBuildSchema = exports.ImageProducerSourceSchema = exports.ImageProducerPlatformSchema = exports.InTotoSubjectSchema = void 0;
+exports.parseImageProducerStatement = parseImageProducerStatement;
+exports.parseDistributionImagesStatement = parseDistributionImagesStatement;
+exports.parseImageDeliveryEntitlementStatement = parseImageDeliveryEntitlementStatement;
+exports.parseSigstoreOfflineTrustPolicy = parseSigstoreOfflineTrustPolicy;
+exports.parseDistributionImageEvidenceSet = parseDistributionImageEvidenceSet;
+exports.parseDistributionImageReplayState = parseDistributionImageReplayState;
+const zod_1 = require("zod");
+const image_lock_1 = require("./image-lock");
+const kernel_contract_authority_1 = require("./kernel-contract-authority");
+const Sha256HexSchema = zod_1.z.string().regex(/^[a-f0-9]{64}$/);
+const Sha256DigestSchema = zod_1.z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const GitCommitSchema = zod_1.z.string().regex(/^[a-f0-9]{40}$/);
+const Rfc3339Schema = zod_1.z.string().datetime({ offset: true });
+const CanonicalIdentifierSchema = zod_1.z
+    .string()
+    .regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9._:/@+-]{0,254}[a-zA-Z0-9])?$/);
+const CanonicalRelativePathSchema = zod_1.z
+    .string()
+    .min(1)
+    .refine((value) => value === value.normalize('NFC') &&
+    !value.startsWith('/') &&
+    !value.endsWith('/') &&
+    !value
+        .split('/')
+        .some((segment) => segment === '' || segment === '.' || segment === '..'), 'must be an NFC-normalized repository-relative path without traversal');
+exports.InTotoSubjectSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().min(1),
+    digest: zod_1.z
+        .object({
+        sha256: Sha256HexSchema,
+    })
+        .strict(),
+})
+    .strict();
+exports.ImageProducerPlatformSchema = zod_1.z
+    .object({
+    ...image_lock_1.RuntimeImagePlatformSchema.shape,
+    manifestDigest: Sha256DigestSchema,
+})
+    .strict();
+exports.ImageProducerSourceSchema = zod_1.z
+    .object({
+    kind: zod_1.z.nativeEnum(image_lock_1.RuntimeImageSubjectKind),
+    id: CanonicalIdentifierSchema,
+    repositoryUrl: zod_1.z.string().url(),
+    repo: CanonicalRelativePathSchema,
+    path: CanonicalRelativePathSchema,
+    sourceCommit: GitCommitSchema,
+    sourceManifestHash: Sha256HexSchema,
+    sourceHashAlgorithm: zod_1.z.union([
+        zod_1.z.literal(image_lock_1.ImageSourceHashAlgorithm.ImageInputV1),
+        zod_1.z.literal(image_lock_1.ImageSourceHashAlgorithm.ImageInputV2),
+    ]),
+    sourceTreeHash: Sha256HexSchema,
+})
+    .strict();
+exports.ImageProducerBuildSchema = zod_1.z
+    .object({
+    builderId: zod_1.z.string().url(),
+    buildType: zod_1.z.string().url(),
+    buildDefinitionDigest: Sha256DigestSchema,
+    parametersDigest: Sha256DigestSchema,
+    platforms: zod_1.z.array(exports.ImageProducerPlatformSchema).min(1).readonly(),
+})
+    .strict();
+exports.ImageProducerArtifactSchema = zod_1.z
+    .object({
+    imageRepository: zod_1.z.string().min(1),
+    manifestDigest: Sha256DigestSchema,
+    manifestMediaType: zod_1.z.string().min(1),
+    sbom: zod_1.z
+        .object({
+        predicateType: zod_1.z.literal('https://spdx.dev/Document'),
+        digest: Sha256DigestSchema,
+    })
+        .strict(),
+    provenance: zod_1.z
+        .object({
+        predicateType: zod_1.z.literal('https://slsa.dev/provenance/v1'),
+        digest: Sha256DigestSchema,
+    })
+        .strict(),
+})
+    .strict();
+exports.ImageProducerRunSchema = zod_1.z
+    .object({
+    producerWorkflowSha: GitCommitSchema,
+    runId: CanonicalIdentifierSchema,
+    runAttempt: zod_1.z.number().int().positive(),
+    nonce: zod_1.z.string().regex(/^[a-zA-Z0-9_-]{22,128}$/),
+    issuedAt: Rfc3339Schema,
+    expiresAt: Rfc3339Schema,
+})
+    .strict();
+exports.ImageProducerPredicateSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(2),
+    contractAuthority: kernel_contract_authority_1.KernelContractAuthoritySchema,
+    source: exports.ImageProducerSourceSchema,
+    build: exports.ImageProducerBuildSchema,
+    artifact: exports.ImageProducerArtifactSchema,
+    producerRun: exports.ImageProducerRunSchema,
+})
+    .strict();
+exports.IMAGE_PRODUCER_PREDICATE_TYPE = 'https://xema.dev/attestations/image-source/v2';
+exports.ImageProducerStatementSchema = zod_1.z
+    .object({
+    _type: zod_1.z.literal('https://in-toto.io/Statement/v1'),
+    subject: zod_1.z.array(exports.InTotoSubjectSchema).length(1).readonly(),
+    predicateType: zod_1.z.literal(exports.IMAGE_PRODUCER_PREDICATE_TYPE),
+    predicate: exports.ImageProducerPredicateSchema,
+})
+    .strict();
+exports.DISTRIBUTION_IMAGES_PREDICATE_TYPE = 'https://xema.dev/attestations/distribution-images/v1';
+exports.DistributionImagesPredicateSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    distributionId: CanonicalIdentifierSchema,
+    distributionInputHash: Sha256HexSchema,
+    normalizedImageLockDigest: Sha256DigestSchema,
+    releaseSequence: zod_1.z.number().int().nonnegative(),
+    releaseSourceCommit: GitCommitSchema,
+    runId: CanonicalIdentifierSchema,
+    runAttempt: zod_1.z.number().int().positive(),
+    nonce: zod_1.z.string().regex(/^[a-zA-Z0-9_-]{22,128}$/),
+    issuedAt: Rfc3339Schema,
+    expiresAt: Rfc3339Schema,
+    images: zod_1.z
+        .array(zod_1.z
+        .object({
+        subjectKind: zod_1.z.nativeEnum(image_lock_1.RuntimeImageSubjectKind),
+        subjectId: CanonicalIdentifierSchema,
+        imageRepository: zod_1.z.string().min(1),
+        manifestDigest: Sha256DigestSchema,
+        producerStatementDigest: Sha256DigestSchema,
+        producerBundleDigest: Sha256DigestSchema,
+    })
+        .strict())
+        .min(1)
+        .readonly(),
+})
+    .strict();
+exports.DistributionImagesStatementSchema = zod_1.z
+    .object({
+    _type: zod_1.z.literal('https://in-toto.io/Statement/v1'),
+    subject: zod_1.z.array(exports.InTotoSubjectSchema).length(1).readonly(),
+    predicateType: zod_1.z.literal(exports.DISTRIBUTION_IMAGES_PREDICATE_TYPE),
+    predicate: exports.DistributionImagesPredicateSchema,
+})
+    .strict();
+var ImageDeliveryMode;
+(function (ImageDeliveryMode) {
+    ImageDeliveryMode["Shared"] = "shared";
+    ImageDeliveryMode["Mirror"] = "mirror";
+    ImageDeliveryMode["Airgap"] = "airgap";
+})(ImageDeliveryMode || (exports.ImageDeliveryMode = ImageDeliveryMode = {}));
+const CanonicalRegistryAuthoritySchema = zod_1.z.string().refine((value) => {
+    if (value.length === 0 ||
+        value !== value.toLowerCase() ||
+        value.includes('/') ||
+        value.includes('@')) {
+        return false;
+    }
+    try {
+        const parsed = new URL(`https://${value}`);
+        if (parsed.username ||
+            parsed.password ||
+            parsed.pathname !== '/' ||
+            parsed.search ||
+            parsed.hash ||
+            parsed.host !== value) {
+            return false;
+        }
+        if (parsed.port && Number(parsed.port) > 65535)
+            return false;
+        if (parsed.hostname.startsWith('['))
+            return true;
+        return parsed.hostname
+            .split('.')
+            .every((label) => label.length > 0 &&
+            label.length <= 63 &&
+            /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label));
+    }
+    catch {
+        return false;
+    }
+}, 'must be a canonical lowercase OCI registry authority');
+exports.IMAGE_DELIVERY_ENTITLEMENT_PREDICATE_TYPE = 'https://xema.dev/attestations/image-delivery-entitlement/v1';
+exports.ImageDeliveryEntitlementPredicateSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    customerId: CanonicalIdentifierSchema,
+    distributionId: CanonicalIdentifierSchema,
+    distributionStatementDigest: Sha256DigestSchema,
+    mode: zod_1.z.nativeEnum(ImageDeliveryMode),
+    targetRegistry: CanonicalRegistryAuthoritySchema.nullable(),
+    nonce: zod_1.z.string().regex(/^[a-zA-Z0-9_-]{22,128}$/),
+    idempotencyKey: CanonicalIdentifierSchema,
+    issuedAt: Rfc3339Schema,
+    expiresAt: Rfc3339Schema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.mode === ImageDeliveryMode.Mirror &&
+        value.targetRegistry === null) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['targetRegistry'],
+            message: 'mirror delivery requires a target registry',
+        });
+    }
+    if (value.mode !== ImageDeliveryMode.Mirror &&
+        value.targetRegistry !== null) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['targetRegistry'],
+            message: 'shared and airgap delivery forbid a target registry',
+        });
+    }
+});
+exports.ImageDeliveryEntitlementStatementSchema = zod_1.z
+    .object({
+    _type: zod_1.z.literal('https://in-toto.io/Statement/v1'),
+    subject: zod_1.z.array(exports.InTotoSubjectSchema).length(1).readonly(),
+    predicateType: zod_1.z.literal(exports.IMAGE_DELIVERY_ENTITLEMENT_PREDICATE_TYPE),
+    predicate: exports.ImageDeliveryEntitlementPredicateSchema,
+})
+    .strict();
+exports.SigstoreEvidenceDescriptorSchema = zod_1.z
+    .object({
+    statementPath: CanonicalRelativePathSchema,
+    statementDigest: Sha256DigestSchema,
+    bundlePath: CanonicalRelativePathSchema,
+    bundleDigest: Sha256DigestSchema,
+    bundleMediaType: zod_1.z.literal('application/vnd.dev.sigstore.bundle.v0.3+json'),
+})
+    .strict();
+exports.DistributionImageEvidenceSetSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    distributionId: CanonicalIdentifierSchema,
+    producerEvidence: zod_1.z
+        .array(zod_1.z
+        .object({
+        subjectKind: zod_1.z.nativeEnum(image_lock_1.RuntimeImageSubjectKind),
+        subjectId: CanonicalIdentifierSchema,
+        evidence: exports.SigstoreEvidenceDescriptorSchema,
+    })
+        .strict())
+        .min(1)
+        .readonly(),
+    completeness: exports.SigstoreEvidenceDescriptorSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    const subjectIdentities = new Map();
+    const statementDigests = new Map();
+    const bundleDigests = new Map();
+    for (const [index, producer] of value.producerEvidence.entries()) {
+        const subjectIdentity = `${producer.subjectKind}\0${producer.subjectId}`;
+        const subjectIncumbent = subjectIdentities.get(subjectIdentity);
+        if (subjectIncumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['producerEvidence', index, 'subjectId'],
+                message: `duplicates producerEvidence[${subjectIncumbent}] identity "${producer.subjectKind}:${producer.subjectId}"`,
+            });
+        }
+        else {
+            subjectIdentities.set(subjectIdentity, index);
+        }
+        const statementIncumbent = statementDigests.get(producer.evidence.statementDigest);
+        if (statementIncumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['producerEvidence', index, 'evidence', 'statementDigest'],
+                message: `reuses producerEvidence[${statementIncumbent}] statementDigest`,
+            });
+        }
+        else {
+            statementDigests.set(producer.evidence.statementDigest, index);
+        }
+        const bundleIncumbent = bundleDigests.get(producer.evidence.bundleDigest);
+        if (bundleIncumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['producerEvidence', index, 'evidence', 'bundleDigest'],
+                message: `reuses producerEvidence[${bundleIncumbent}] bundleDigest`,
+            });
+        }
+        else {
+            bundleDigests.set(producer.evidence.bundleDigest, index);
+        }
+    }
+});
+exports.SigstoreIdentityPolicySchema = zod_1.z
+    .object({
+    policyId: CanonicalIdentifierSchema,
+    predicateTypes: zod_1.z.array(zod_1.z.string().url()).min(1).readonly(),
+    certificateIdentity: zod_1.z.string().url(),
+    oidcIssuer: zod_1.z.string().url(),
+    githubWorkflow: zod_1.z
+        .object({
+        repository: zod_1.z.string().regex(/^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/),
+        ref: zod_1.z.string().regex(/^refs\/(?:heads|tags)\/.+$/),
+        path: CanonicalRelativePathSchema,
+    })
+        .strict()
+        .optional(),
+    imageProducer: zod_1.z
+        .object({
+        builderIds: zod_1.z.array(zod_1.z.string().url()).min(1).readonly(),
+        buildTypes: zod_1.z.array(zod_1.z.string().url()).min(1).readonly(),
+        buildDefinitionDigests: zod_1.z
+            .array(Sha256DigestSchema)
+            .min(1)
+            .readonly()
+            .optional(),
+        parametersDigests: zod_1.z
+            .array(Sha256DigestSchema)
+            .min(1)
+            .readonly()
+            .optional(),
+        manifestMediaTypes: zod_1.z
+            .array(zod_1.z.enum([
+            'application/vnd.oci.image.index.v1+json',
+            'application/vnd.oci.image.manifest.v1+json',
+        ]))
+            .min(1)
+            .readonly(),
+    })
+        .strict()
+        .optional(),
+    allowedImageRepositoryPrefixes: zod_1.z
+        .array(zod_1.z
+        .string()
+        .regex(/^[a-z0-9.-]+(?::[1-9]\d{0,4})?\/(?:[a-z0-9._-]+\/)*$/, 'must be a canonical lowercase OCI repository namespace ending in "/"'))
+        .min(1)
+        .readonly(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.githubWorkflow) {
+        const expectedIdentity = `https://github.com/${value.githubWorkflow.repository}/` +
+            `${value.githubWorkflow.path}@${value.githubWorkflow.ref}`;
+        if (value.certificateIdentity !== expectedIdentity) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['certificateIdentity'],
+                message: 'must exactly match githubWorkflow repository, path, and ref',
+            });
+        }
+    }
+    const signsProducerEvidence = value.predicateTypes.includes(exports.IMAGE_PRODUCER_PREDICATE_TYPE);
+    if (signsProducerEvidence !== (value.imageProducer !== undefined)) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['imageProducer'],
+            message: 'is required exactly when predicateTypes includes image-producer evidence',
+        });
+    }
+    const signsDistributionCompleteness = value.predicateTypes.includes(exports.DISTRIBUTION_IMAGES_PREDICATE_TYPE);
+    if ((signsProducerEvidence || signsDistributionCompleteness) &&
+        value.githubWorkflow === undefined) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['githubWorkflow'],
+            message: 'is required for producer or distribution-completeness evidence to bind the exact workflow commit',
+        });
+    }
+});
+exports.SigstoreOfflineTrustPolicySchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    trustedRootPath: CanonicalRelativePathSchema,
+    trustedRootDigest: Sha256DigestSchema,
+    cosignVersion: zod_1.z.string().regex(/^v\d+\.\d+\.\d+$/),
+    trustedCosignBinaryDigests: zod_1.z.array(Sha256DigestSchema).readonly(),
+    gitVersion: zod_1.z.string().regex(/^\d+\.\d+\.\d+$/),
+    trustedGitBinaryDigests: zod_1.z.array(Sha256DigestSchema).readonly(),
+    maxProducerTtlSeconds: zod_1.z.number().int().positive(),
+    maxCompletenessTtlSeconds: zod_1.z.number().int().positive(),
+    maxEntitlementTtlSeconds: zod_1.z.number().int().positive(),
+    policies: zod_1.z.array(exports.SigstoreIdentityPolicySchema).readonly(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const policyIds = new Map();
+    for (const [index, policy] of value.policies.entries()) {
+        const incumbent = policyIds.get(policy.policyId);
+        if (incumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['policies', index, 'policyId'],
+                message: `duplicates policies[${incumbent}].policyId "${policy.policyId}"`,
+            });
+        }
+        else {
+            policyIds.set(policy.policyId, index);
+        }
+    }
+});
+exports.DistributionImageReplayStateSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    distributionId: CanonicalIdentifierSchema,
+    trustPolicyDigest: Sha256DigestSchema,
+    lastReleaseSequence: zod_1.z.number().int().min(-1),
+    lastCompletenessStatementDigest: Sha256DigestSchema.nullable(),
+    lastCompletenessNonce: zod_1.z
+        .string()
+        .regex(/^[a-zA-Z0-9_-]{22,128}$/)
+        .nullable(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const firstRelease = value.lastReleaseSequence === -1;
+    if ((value.lastCompletenessStatementDigest === null) !== firstRelease ||
+        (value.lastCompletenessNonce === null) !== firstRelease) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['lastReleaseSequence'],
+            message: 'sequence -1 requires null completeness identity; accepted releases require both identities',
+        });
+    }
+});
+function parseWithSchema(label, schema, raw) {
+    const result = schema.safeParse(raw);
+    if (!result.success) {
+        throw new Error(`Invalid ${label}: ${result.error.issues
+            .map((issue) => `[${issue.path.join('.')}] ${issue.message}`)
+            .join('; ')}`);
+    }
+    return result.data;
+}
+function parseImageProducerStatement(raw) {
+    return parseWithSchema('image-producer statement', exports.ImageProducerStatementSchema, raw);
+}
+function parseDistributionImagesStatement(raw) {
+    return parseWithSchema('distribution-images statement', exports.DistributionImagesStatementSchema, raw);
+}
+function parseImageDeliveryEntitlementStatement(raw) {
+    return parseWithSchema('image-delivery entitlement statement', exports.ImageDeliveryEntitlementStatementSchema, raw);
+}
+function parseSigstoreOfflineTrustPolicy(raw) {
+    return parseWithSchema('Sigstore offline trust policy', exports.SigstoreOfflineTrustPolicySchema, raw);
+}
+function parseDistributionImageEvidenceSet(raw) {
+    return parseWithSchema('distribution image evidence set', exports.DistributionImageEvidenceSetSchema, raw);
+}
+function parseDistributionImageReplayState(raw) {
+    return parseWithSchema('distribution image replay state', exports.DistributionImageReplayStateSchema, raw);
+}
+//# sourceMappingURL=image-producer-evidence.js.map

package/dist/distribution/lib/image-producer-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-producer-evidence.js","sourceRoot":"","sources":["../../../src/distribution/lib/image-producer-evidence.ts"],"names":[],"mappings":";;;AAijBA,kEAQC;AAED,4EAQC;AAED,wFAQC;AAED,0EAQC;AAED,8EAQC;AAED,8EAQC;AA3mBD,6BAAwB;AACxB,6CAIsB;AACtB,2EAA4E;AAE5E,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACrE,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC3D,MAAM,aAAa,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,MAAM,yBAAyB,GAAG,OAAC;KAChC,MAAM,EAAE;KACR,KAAK,CAAC,wDAAwD,CAAC,CAAC;AACnE,MAAM,2BAA2B,GAAG,OAAC;KAClC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;IAChC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;IACtB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;IACpB,CAAC,KAAK;SACH,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CACnE,EACL,sEAAsE,CACvE,CAAC;AAES,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,OAAC;SACN,MAAM,CAAC;QACN,MAAM,EAAE,eAAe;KACxB,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,GAAG,uCAA0B,CAAC,KAAK;IACnC,cAAc,EAAE,kBAAkB;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,oCAAuB,CAAC;IAC3C,EAAE,EAAE,yBAAyB;IAC7B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,2BAA2B;IACjC,YAAY,EAAE,eAAe;IAC7B,kBAAkB,EAAE,eAAe;IAenC,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC;QAC3B,OAAC,CAAC,OAAO,CAAC,qCAAwB,CAAC,YAAY,CAAC;QAChD,OAAC,CAAC,OAAO,CAAC,qCAAwB,CAAC,YAAY,CAAC;KACjD,CAAC;IACF,cAAc,EAAE,eAAe;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,qBAAqB,EAAE,kBAAkB;IACzC,gBAAgB,EAAE,kBAAkB;IACpC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,cAAc,EAAE,kBAAkB;IAClC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;QACrD,MAAM,EAAE,kBAAkB;KAC3B,CAAC;SACD,MAAM,EAAE;IACX,UAAU,EAAE,OAAC;SACV,MAAM,CAAC;QACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;QAC1D,MAAM,EAAE,kBAAkB;KAC3B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,mBAAmB,EAAE,eAAe;IACpC,KAAK,EAAE,yBAAyB;IAChC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAClD,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,aAAa;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,iBAAiB,EAAE,yDAA6B;IAChD,MAAM,EAAE,iCAAyB;IACjC,KAAK,EAAE,gCAAwB;IAC/B,QAAQ,EAAE,mCAA2B;IACrC,WAAW,EAAE,8BAAsB;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,6BAA6B,GACxC,+CAAwD,CAAC;AAE9C,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACnD,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,2BAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,qCAA6B,CAAC;IACvD,SAAS,EAAE,oCAA4B;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,kCAAkC,GAC7C,sDAA+D,CAAC;AAErD,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,yBAAyB;IACzC,qBAAqB,EAAE,eAAe;IACtC,yBAAyB,EAAE,kBAAkB;IAC7C,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,mBAAmB,EAAE,eAAe;IACpC,KAAK,EAAE,yBAAyB;IAChC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAClD,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,aAAa;IACxB,MAAM,EAAE,OAAC;SACN,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,oCAAuB,CAAC;QAClD,SAAS,EAAE,yBAAyB;QACpC,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,cAAc,EAAE,kBAAkB;QAClC,uBAAuB,EAAE,kBAAkB;QAC3C,oBAAoB,EAAE,kBAAkB;KACzC,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACnD,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,2BAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,0CAAkC,CAAC;IAC5D,SAAS,EAAE,yCAAiC;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,sCAAiB,CAAA;IACjB,sCAAiB,CAAA;AACnB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAED,MAAM,gCAAgC,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IACnE,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE;QAC7B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QAC3C,IACE,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ,KAAK,GAAG;YACvB,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,IAAI,KAAK,KAAK,EACrB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,MAAM,CAAC,QAAQ;aACnB,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CACJ,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,MAAM,IAAI,EAAE;YAClB,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAClD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EAAE,sDAAsD,CAAC,CAAC;AAE9C,QAAA,yCAAyC,GACpD,6DAAsE,CAAC;AAE5D,QAAA,uCAAuC,GAAG,OAAC;KACrD,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,yBAAyB;IACrC,cAAc,EAAE,yBAAyB;IACzC,2BAA2B,EAAE,kBAAkB;IAC/C,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;IACrC,cAAc,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC3D,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAClD,cAAc,EAAE,yBAAyB;IACzC,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,aAAa;CACzB,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IACE,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM;QACvC,KAAK,CAAC,cAAc,KAAK,IAAI,EAC7B,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,IACE,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM;QACvC,KAAK,CAAC,cAAc,KAAK,IAAI,EAC7B,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEQ,QAAA,uCAAuC,GAAG,OAAC;KACrD,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACnD,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,2BAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,iDAAyC,CAAC;IACnE,SAAS,EAAE,+CAAuC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,aAAa,EAAE,2BAA2B;IAC1C,eAAe,EAAE,kBAAkB;IACnC,UAAU,EAAE,2BAA2B;IACvC,YAAY,EAAE,kBAAkB;IAChC,eAAe,EAAE,OAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC;CAC5E,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,yBAAyB;IACzC,gBAAgB,EAAE,OAAC;SAChB,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,WAAW,EAAE,OAAC,CAAC,UAAU,CAAC,oCAAuB,CAAC;QAClD,SAAS,EAAE,yBAAyB;QACpC,QAAQ,EAAE,wCAAgC;KAC3C,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;IACb,YAAY,EAAE,wCAAgC;CAC/C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,eAAe,GAAG,GAAG,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QACzE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,EAAE,WAAW,CAAC;gBAC9C,OAAO,EAAE,+BAA+B,gBAAgB,eAAe,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,SAAS,GAAG;aACrH,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,GAAG,CAC7C,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAClC,CAAC;QACF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC;gBAChE,OAAO,EAAE,2BAA2B,kBAAkB,mBAAmB;aAC1E,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,eAAe,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1E,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC;gBAC7D,OAAO,EAAE,2BAA2B,eAAe,gBAAgB;aACpE,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAMQ,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,QAAQ,EAAE,yBAAyB;IACnC,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC5B,cAAc,EAAE,OAAC;SACd,MAAM,CAAC;QACN,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC;QAClE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,CAAC;QACnD,IAAI,EAAE,2BAA2B;KAClC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,aAAa,EAAE,OAAC;SACb,MAAM,CAAC;QACN,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvD,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAqBvD,sBAAsB,EAAE,OAAC;aACtB,KAAK,CAAC,kBAAkB,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,EAAE;QACb,iBAAiB,EAAE,OAAC;aACjB,KAAK,CAAC,kBAAkB,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,EAAE;QACb,kBAAkB,EAAE,OAAC;aAClB,KAAK,CACJ,OAAC,CAAC,IAAI,CAAC;YACL,yCAAyC;YACzC,4CAA4C;SAC7C,CAAC,CACH;aACA,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,8BAA8B,EAAE,OAAC;SAC9B,KAAK,CACJ,OAAC;SACE,MAAM,EAAE;SACR,KAAK,CACJ,sDAAsD,EACtD,sEAAsE,CACvE,CACJ;SACA,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,gBAAgB,GACpB,sBAAsB,KAAK,CAAC,cAAc,CAAC,UAAU,GAAG;YACxD,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QAC7D,IAAI,KAAK,CAAC,mBAAmB,KAAK,gBAAgB,EAAE,CAAC;YACnD,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,qBAAqB,CAAC;gBAC7B,OAAO,EACL,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,qBAAqB,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CACzD,qCAA6B,CAC9B,CAAC;IACF,IAAI,qBAAqB,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,0EAA0E;SAC7E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,6BAA6B,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CACjE,0CAAkC,CACnC,CAAC;IACF,IACE,CAAC,qBAAqB,IAAI,6BAA6B,CAAC;QACxD,KAAK,CAAC,cAAc,KAAK,SAAS,EAClC,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EACL,kGAAkG;SACrG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEQ,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,eAAe,EAAE,2BAA2B;IAC5C,iBAAiB,EAAE,kBAAkB;IACrC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACnD,0BAA0B,EAAE,OAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAClE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC/C,uBAAuB,EAAE,OAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC/D,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClD,yBAAyB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtD,wBAAwB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,oCAA4B,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC;gBACrC,OAAO,EAAE,uBAAuB,SAAS,eAAe,MAAM,CAAC,QAAQ,GAAG;aAC3E,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEQ,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,yBAAyB;IACzC,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7C,+BAA+B,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC9D,qBAAqB,EAAE,OAAC;SACrB,MAAM,EAAE;SACR,KAAK,CAAC,yBAAyB,CAAC;SAChC,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,YAAY,GAAG,KAAK,CAAC,mBAAmB,KAAK,CAAC,CAAC,CAAC;IACtD,IACE,CAAC,KAAK,CAAC,+BAA+B,KAAK,IAAI,CAAC,KAAK,YAAY;QACjE,CAAC,KAAK,CAAC,qBAAqB,KAAK,IAAI,CAAC,KAAK,YAAY,EACvD,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,qBAAqB,CAAC;YAC7B,OAAO,EACL,4FAA4F;SAC/F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAUL,SAAS,eAAe,CACtB,KAAa,EACb,MAAoB,EACpB,GAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM;aACrC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAgB,2BAA2B,CACzC,GAAY;IAEZ,OAAO,eAAe,CACpB,0BAA0B,EAC1B,oCAA4B,EAC5B,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAgB,gCAAgC,CAC9C,GAAY;IAEZ,OAAO,eAAe,CACpB,+BAA+B,EAC/B,yCAAiC,EACjC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAgB,sCAAsC,CACpD,GAAY;IAEZ,OAAO,eAAe,CACpB,sCAAsC,EACtC,+CAAuC,EACvC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAY;IAEZ,OAAO,eAAe,CACpB,+BAA+B,EAC/B,wCAAgC,EAChC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAC/C,GAAY;IAEZ,OAAO,eAAe,CACpB,iCAAiC,EACjC,0CAAkC,EAClC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAC/C,GAAY;IAEZ,OAAO,eAAe,CACpB,iCAAiC,EACjC,0CAAkC,EAClC,GAAG,CACJ,CAAC;AACJ,CAAC"}

package/dist/distribution/lib/install-policy.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+export declare enum BiomeInstallPolicy {
+    Required = "required",
+    DefaultSelected = "default-selected",
+    Optional = "optional"
+}
+export declare const BiomeInstallPolicySchema: z.ZodEnum<typeof BiomeInstallPolicy>;
+export declare enum BiomeLaunchMode {
+    Static = "static",
+    PerInstallation = "per-installation"
+}
+export declare const BiomeLaunchModeSchema: z.ZodEnum<typeof BiomeLaunchMode>;
+//# sourceMappingURL=install-policy.d.ts.map

package/dist/distribution/lib/install-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-policy.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/install-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,QAAQ,aAAa;CACtB;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAezE,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,eAAe,qBAAqB;CACrC;AAED,eAAO,MAAM,qBAAqB,mCAAgC,CAAC"}

package/dist/distribution/lib/install-policy.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiomeLaunchModeSchema = exports.BiomeLaunchMode = exports.BiomeInstallPolicySchema = exports.BiomeInstallPolicy = void 0;
+const zod_1 = require("zod");
+var BiomeInstallPolicy;
+(function (BiomeInstallPolicy) {
+    BiomeInstallPolicy["Required"] = "required";
+    BiomeInstallPolicy["DefaultSelected"] = "default-selected";
+    BiomeInstallPolicy["Optional"] = "optional";
+})(BiomeInstallPolicy || (exports.BiomeInstallPolicy = BiomeInstallPolicy = {}));
+exports.BiomeInstallPolicySchema = zod_1.z.nativeEnum(BiomeInstallPolicy);
+var BiomeLaunchMode;
+(function (BiomeLaunchMode) {
+    BiomeLaunchMode["Static"] = "static";
+    BiomeLaunchMode["PerInstallation"] = "per-installation";
+})(BiomeLaunchMode || (exports.BiomeLaunchMode = BiomeLaunchMode = {}));
+exports.BiomeLaunchModeSchema = zod_1.z.nativeEnum(BiomeLaunchMode);
+//# sourceMappingURL=install-policy.js.map

package/dist/distribution/lib/install-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-policy.js","sourceRoot":"","sources":["../../../src/distribution/lib/install-policy.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAmBxB,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,2CAAqB,CAAA;IACrB,0DAAoC,CAAA;IACpC,2CAAqB,CAAA;AACvB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAezE,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,uDAAoC,CAAA;AACtC,CAAC,EAHW,eAAe,+BAAf,eAAe,QAG1B;AAEY,QAAA,qBAAqB,GAAG,OAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC"}

package/dist/distribution/lib/kernel-contract-authority.d.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+export declare const XEMA_KERNEL_CONTRACT_REPOSITORY_URL: "https://github.com/xema-dev/xema-kernel-contracts.git";
+export declare const XEMA_KERNEL_CONTRACT_SOURCE_PATHS: readonly ["packages/kernel/kernel-contracts/src/distribution/index.ts", "packages/kernel/kernel-contracts/src/distribution/lib/image-lock.ts", "packages/kernel/kernel-contracts/src/distribution/lib/image-producer-evidence.ts", "packages/kernel/kernel-contracts/src/distribution/lib/kernel-contract-authority.ts", "packages/kernel/kernel-contracts/src/distribution/lib/runtime-image-source-index.ts"];
+export declare const XEMA_KERNEL_CONTRACT_SOURCE_MODE: "100644";
+export declare const XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR: "xema-distributions/build-runtime-image-source-index.mjs@v1";
+export declare const XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_DOMAIN: "xema.kernel-contract-authority.digest";
+export declare const XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_VERSION: 1;
+export declare enum KernelContractContentHashAlgorithm {
+    LengthFramedGitPathModeBlobV1 = "xema-kernel-contract-authority-length-framed-git-path-mode-blob-sha256-v1"
+}
+export interface KernelContractAuthorityDigestSource {
+    readonly path: string;
+    readonly mode: string;
+    readonly blob: Uint8Array;
+}
+export declare const KernelContractAuthoritySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    generatorIdentity: z.ZodLiteral<"xema-distributions/build-runtime-image-source-index.mjs@v1">;
+    repositoryUrl: z.ZodLiteral<"https://github.com/xema-dev/xema-kernel-contracts.git">;
+    sourceCommit: z.ZodString;
+    sourcePaths: z.ZodReadonly<z.ZodTuple<[z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/index.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/image-lock.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/image-producer-evidence.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/kernel-contract-authority.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/runtime-image-source-index.ts">], null>>;
+    contentHashAlgorithm: z.ZodLiteral<KernelContractContentHashAlgorithm>;
+    contentDigest: z.ZodString;
+}, z.core.$strict>;
+export type KernelContractAuthority = z.infer<typeof KernelContractAuthoritySchema>;
+export declare function encodeKernelContractAuthorityDigestPreimage(sources: readonly KernelContractAuthorityDigestSource[]): Uint8Array;
+export declare function computeKernelContractAuthorityContentDigest(sources: readonly KernelContractAuthorityDigestSource[]): Promise<string>;
+//# sourceMappingURL=kernel-contract-authority.d.ts.map

package/dist/distribution/lib/kernel-contract-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-contract-authority.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/kernel-contract-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,mCAAmC,EAC9C,uDAAgE,CAAC;AAEnE,eAAO,MAAM,iCAAiC,iZAMnC,CAAC;AAEZ,eAAO,MAAM,gCAAgC,EAAG,QAAiB,CAAC;AAElE,eAAO,MAAM,wCAAwC,EACnD,4DAAqE,CAAC;AAExE,eAAO,MAAM,4CAA4C,EACvD,uCAAgD,CAAC;AAEnD,eAAO,MAAM,6CAA6C,EAAG,CAAU,CAAC;AAExE,oBAAY,kCAAkC;IAC5C,6BAA6B,8EAA8E;CAC5G;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAKD,eAAO,MAAM,6BAA6B;;;;;;;;kBAoB/B,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAUF,wBAAgB,2CAA2C,CACzD,OAAO,EAAE,SAAS,mCAAmC,EAAE,GACtD,UAAU,CAuBZ;AAKD,wBAAsB,2CAA2C,CAC/D,OAAO,EAAE,SAAS,mCAAmC,EAAE,GACtD,OAAO,CAAC,MAAM,CAAC,CAEjB"}