@xemahq/contracts 0.70.0 → 0.72.0

package/dist/deployment/lib/resolved-deployment.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResolvedDeploymentSchema = exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = void 0;
+const zod_1 = require("zod");
+const deployment_id_1 = require("./deployment-id");
+const trust_domain_1 = require("./trust-domain");
+const trust_partition_1 = require("./trust-partition");
+exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = 1;
+const DnsLabelSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(63)
+    .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'must be a lowercase DNS label');
+const BiomeIdSchema = zod_1.z
+    .string()
+    .regex(trust_domain_1.TRUST_DOMAIN_BIOME_ID_PATTERN, 'biome id must be lowercase kebab-case');
+const ResolvedBiomeSchema = zod_1.z
+    .object({
+    id: BiomeIdSchema,
+    trustCeiling: trust_domain_1.TrustDomainSchema,
+    trustDomain: trust_domain_1.TrustDomainSchema,
+})
+    .strict();
+const ResolvedServiceAccountSchema = zod_1.z
+    .object({
+    name: DnsLabelSchema,
+    workload: DnsLabelSchema,
+    actsFor: zod_1.z
+        .array(zod_1.z.object({ biome: BiomeIdSchema, component: zod_1.z.string().min(1) }).strict())
+        .min(1),
+})
+    .strict();
+exports.ResolvedDeploymentSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION),
+    deployment: zod_1.z.string().regex(deployment_id_1.DEPLOYMENT_ID_PATTERN, 'must be a deployment id'),
+    runtimeNamespace: DnsLabelSchema,
+    edition: zod_1.z
+        .object({
+        id: zod_1.z.string().min(1),
+        version: zod_1.z.string().min(1),
+        registry: zod_1.z.string().min(1),
+        lockSha256: zod_1.z.string().regex(/^[0-9a-f]{64}$/, 'must be a lowercase sha256 hex digest'),
+    })
+        .strict(),
+    biomes: zod_1.z.array(ResolvedBiomeSchema).min(1),
+    serviceAccounts: zod_1.z.array(ResolvedServiceAccountSchema),
+    provenance: zod_1.z
+        .object({
+        producer: zod_1.z.object({ name: zod_1.z.string().min(1), version: zod_1.z.string().min(1) }).strict(),
+        source: zod_1.z
+            .object({
+            repository: zod_1.z.string().min(1),
+            commit: zod_1.z.string().regex(/^[0-9a-f]{40}$/, 'must be a full commit sha'),
+        })
+            .strict(),
+    })
+        .strict(),
+})
+    .strict()
+    .superRefine((resolved, ctx) => {
+    const domainOf = {};
+    resolved.biomes.forEach((biome, index) => {
+        if (index > 0 && !((resolved.biomes[index - 1]?.id ?? '') < biome.id)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['biomes', index, 'id'],
+                message: 'biomes must be unique and sorted by id',
+            });
+        }
+        for (const field of ['trustCeiling', 'trustDomain']) {
+            const value = biome[field];
+            if (value.startsWith(trust_domain_1.THIRD_PARTY_TRUST_DOMAIN_PREFIX) &&
+                value !== `${trust_domain_1.THIRD_PARTY_TRUST_DOMAIN_PREFIX}${biome.id}`) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: ['biomes', index, field],
+                    message: `"${value}" is another biome's default domain; only ${biome.id} may be in it`,
+                });
+            }
+        }
+        domainOf[biome.id] = biome.trustDomain;
+    });
+    resolved.serviceAccounts.forEach((account, index) => {
+        if (index > 0 && (resolved.serviceAccounts[index - 1]?.name ?? '') > account.name) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['serviceAccounts', index, 'name'],
+                message: 'serviceAccounts must be sorted by name',
+            });
+        }
+    });
+    for (const violation of [
+        ...(0, trust_partition_1.gradeTrustRefinement)(resolved.biomes),
+        ...(0, trust_partition_1.gradeEnforcementIdentities)(resolved.serviceAccounts.map((account) => ({
+            serviceAccount: account.name,
+            actsFor: account.actsFor,
+        })), domainOf),
+    ]) {
+        ctx.addIssue({ code: 'custom', path: [], message: `[${violation.code}] ${violation.message}` });
+    }
+});
+//# sourceMappingURL=resolved-deployment.js.map

package/dist/deployment/lib/resolved-deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved-deployment.js","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,mDAAwD;AACxD,iDAIwB;AACxB,uDAG2B;AAwCd,QAAA,kCAAkC,GAAG,CAAU,CAAC;AAG7D,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,CAAC;AAM7E,MAAM,aAAa,GAAG,OAAC;KACpB,MAAM,EAAE;KACR,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC,CAAC;AAEjF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,aAAa;IACjB,YAAY,EAAE,gCAAiB;IAC/B,WAAW,EAAE,gCAAiB;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,4BAA4B,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IAEpB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,OAAC;SACP,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC;CACV,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,0CAAkC,CAAC;IAC5D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAqB,EAAE,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,cAAc;IAChC,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,uCAAuC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC;IACtD,UAAU,EAAE,OAAC;SACV,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACpF,MAAM,EAAE,OAAC;aACN,MAAM,CAAC;YACN,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,2BAA2B,CAAC;SACxE,CAAC;aACD,MAAM,EAAE;KACZ,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC7B,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,IACE,KAAK,CAAC,UAAU,CAAC,8CAA+B,CAAC;gBACjD,KAAK,KAAK,GAAG,8CAA+B,GAAG,KAAK,CAAC,EAAE,EAAE,EACzD,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;oBAC9B,OAAO,EAAE,IAAI,KAAK,6CAA6C,KAAK,CAAC,EAAE,eAAe;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC,CAAC,CAAC;IAGH,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAClD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAClF,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC;gBACxC,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,IAAA,sCAAoB,EAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,GAAG,IAAA,4CAA0B,EAC3B,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,IAAI;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,EACH,QAAQ,CACT;KACF,EAAE,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/deployment/lib/trust-domain.d.ts

@@ -3,4 +3,7 @@ export declare const FIRST_PARTY_TRUST_DOMAIN = "first-party";
 export declare const THIRD_PARTY_TRUST_DOMAIN_PREFIX = "third-party/";
 export declare const TRUST_DOMAIN_NAME_PATTERN: RegExp;
 export declare const TrustDomainNameSchema: z.ZodString;
+export declare const TRUST_DOMAIN_BIOME_ID_PATTERN: RegExp;
+export declare function isTrustDomainSpelling(value: string): boolean;
+export declare const TrustDomainSchema: z.ZodString;
 //# sourceMappingURL=trust-domain.d.ts.map

package/dist/deployment/lib/trust-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust-domain.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/trust-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAGtD,eAAO,MAAM,+BAA+B,iBAAiB,CAAC;AAG9D,eAAO,MAAM,yBAAyB,QAAiC,CAAC;AAGxE,eAAO,MAAM,qBAAqB,aAO/B,CAAC"}
+{"version":3,"file":"trust-domain.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/trust-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0BxB,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAGtD,eAAO,MAAM,+BAA+B,iBAAiB,CAAC;AAG9D,eAAO,MAAM,yBAAyB,QAAiC,CAAC;AAGxE,eAAO,MAAM,qBAAqB,aAO/B,CAAC;AAOJ,eAAO,MAAM,6BAA6B,QAAsB,CAAC;AAOjE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAGD,eAAO,MAAM,iBAAiB,aAM1B,CAAC"}

package/dist/deployment/lib/trust-domain.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TrustDomainNameSchema = exports.TRUST_DOMAIN_NAME_PATTERN = exports.THIRD_PARTY_TRUST_DOMAIN_PREFIX = exports.FIRST_PARTY_TRUST_DOMAIN = void 0;
+exports.TrustDomainSchema = exports.TRUST_DOMAIN_BIOME_ID_PATTERN = exports.TrustDomainNameSchema = exports.TRUST_DOMAIN_NAME_PATTERN = exports.THIRD_PARTY_TRUST_DOMAIN_PREFIX = exports.FIRST_PARTY_TRUST_DOMAIN = void 0;
+exports.isTrustDomainSpelling = isTrustDomainSpelling;
 const zod_1 = require("zod");
 exports.FIRST_PARTY_TRUST_DOMAIN = 'first-party';
 exports.THIRD_PARTY_TRUST_DOMAIN_PREFIX = 'third-party/';
@@ -10,4 +11,19 @@ exports.TrustDomainNameSchema = zod_1.z
     .min(1)
     .max(63)
     .regex(exports.TRUST_DOMAIN_NAME_PATTERN, 'trust domain name must be lowercase kebab-case');
+exports.TRUST_DOMAIN_BIOME_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
+function isTrustDomainSpelling(value) {
+    if (value === exports.FIRST_PARTY_TRUST_DOMAIN)
+        return true;
+    if (value.startsWith(exports.THIRD_PARTY_TRUST_DOMAIN_PREFIX)) {
+        return exports.TRUST_DOMAIN_BIOME_ID_PATTERN.test(value.slice(exports.THIRD_PARTY_TRUST_DOMAIN_PREFIX.length));
+    }
+    return exports.TrustDomainNameSchema.safeParse(value).success;
+}
+exports.TrustDomainSchema = zod_1.z
+    .string()
+    .min(1)
+    .refine(isTrustDomainSpelling, {
+    message: 'must be "first-party", "third-party/<biomeId>" or a kebab-case trust domain name',
+});
 //# sourceMappingURL=trust-domain.js.map

package/dist/deployment/lib/trust-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"trust-domain.js","sourceRoot":"","sources":["../../../src/deployment/lib/trust-domain.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAyBX,QAAA,wBAAwB,GAAG,aAAa,CAAC;AAGzC,QAAA,+BAA+B,GAAG,cAAc,CAAC;AAGjD,QAAA,yBAAyB,GAAG,8BAA8B,CAAC;AAG3D,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,iCAAyB,EACzB,gDAAgD,CACjD,CAAC"}
+{"version":3,"file":"trust-domain.js","sourceRoot":"","sources":["../../../src/deployment/lib/trust-domain.ts"],"names":[],"mappings":";;;AAwDA,sDAQC;AAhED,6BAAwB;AA0BX,QAAA,wBAAwB,GAAG,aAAa,CAAC;AAGzC,QAAA,+BAA+B,GAAG,cAAc,CAAC;AAGjD,QAAA,yBAAyB,GAAG,8BAA8B,CAAC;AAG3D,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,iCAAyB,EACzB,gDAAgD,CACjD,CAAC;AAOS,QAAA,6BAA6B,GAAG,mBAAmB,CAAC;AAOjE,SAAgB,qBAAqB,CAAC,KAAa;IACjD,IAAI,KAAK,KAAK,gCAAwB;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,KAAK,CAAC,UAAU,CAAC,uCAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,qCAA6B,CAAC,IAAI,CACvC,KAAK,CAAC,KAAK,CAAC,uCAA+B,CAAC,MAAM,CAAC,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,6BAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACxD,CAAC;AAGY,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,qBAAqB,EAAE;IAC7B,OAAO,EACL,kFAAkF;CACrF,CAAC,CAAC"}

package/dist/deployment/lib/trust-partition.d.ts

@@ -0,0 +1,28 @@
+export declare enum TrustPartitionViolationCode {
+    UnknownBiome = "unknown-biome",
+    ExceedsCeiling = "exceeds-ceiling",
+    IdentitySpansTrustDomains = "identity-spans-trust-domains",
+    DuplicateIdentity = "duplicate-identity",
+    UnplacedIdentityBiome = "unplaced-identity-biome"
+}
+export interface TrustPartitionViolation {
+    readonly code: TrustPartitionViolationCode;
+    readonly domain?: string;
+    readonly serviceAccount?: string;
+    readonly message: string;
+}
+export interface PartitionedBiome {
+    readonly id: string;
+    readonly trustCeiling: string;
+    readonly trustDomain: string;
+}
+export declare function gradeTrustRefinement(biomes: readonly PartitionedBiome[]): TrustPartitionViolation[];
+export interface EnforcementIdentity {
+    readonly serviceAccount: string;
+    readonly actsFor: readonly {
+        readonly biome: string;
+        readonly component: string;
+    }[];
+}
+export declare function gradeEnforcementIdentities(identities: readonly EnforcementIdentity[], domainOf: Readonly<Record<string, string>>): TrustPartitionViolation[];
+//# sourceMappingURL=trust-partition.d.ts.map

package/dist/deployment/lib/trust-partition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-partition.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/trust-partition.ts"],"names":[],"mappings":"AAmBA,oBAAY,2BAA2B;IAErC,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,yBAAyB,iCAAiC;IAE1D,iBAAiB,uBAAuB;IAExC,qBAAqB,4BAA4B;CAClD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAE3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AASD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAClC,uBAAuB,EAAE,CA2B3B;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACrF;AAaD,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,SAAS,mBAAmB,EAAE,EAC1C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACzC,uBAAuB,EAAE,CAkD3B"}

package/dist/deployment/lib/trust-partition.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustPartitionViolationCode = void 0;
+exports.gradeTrustRefinement = gradeTrustRefinement;
+exports.gradeEnforcementIdentities = gradeEnforcementIdentities;
+var TrustPartitionViolationCode;
+(function (TrustPartitionViolationCode) {
+    TrustPartitionViolationCode["UnknownBiome"] = "unknown-biome";
+    TrustPartitionViolationCode["ExceedsCeiling"] = "exceeds-ceiling";
+    TrustPartitionViolationCode["IdentitySpansTrustDomains"] = "identity-spans-trust-domains";
+    TrustPartitionViolationCode["DuplicateIdentity"] = "duplicate-identity";
+    TrustPartitionViolationCode["UnplacedIdentityBiome"] = "unplaced-identity-biome";
+})(TrustPartitionViolationCode || (exports.TrustPartitionViolationCode = TrustPartitionViolationCode = {}));
+function gradeTrustRefinement(biomes) {
+    const ceilingsOf = new Map();
+    for (const biome of biomes) {
+        const ceilings = ceilingsOf.get(biome.trustDomain) ?? new Map();
+        const members = ceilings.get(biome.trustCeiling) ?? [];
+        members.push(biome.id);
+        ceilings.set(biome.trustCeiling, members);
+        ceilingsOf.set(biome.trustDomain, ceilings);
+    }
+    const violations = [];
+    for (const domain of [...ceilingsOf.keys()].sort(codeUnit)) {
+        const ceilings = ceilingsOf.get(domain);
+        if (ceilings.size <= 1)
+            continue;
+        const summary = [...ceilings.entries()]
+            .map(([ceiling, members]) => `${ceiling} (${[...members].sort(codeUnit).join(', ')})`)
+            .sort(codeUnit)
+            .join(' and ');
+        violations.push({
+            code: TrustPartitionViolationCode.ExceedsCeiling,
+            domain,
+            message: `trust domain "${domain}" holds biomes of ${ceilings.size} edition ceiling domains: ${summary}. ` +
+                `A deployment may only split an edition's trust domains, never merge them; to let these biomes ` +
+                `share a domain, the edition must group them in its trustCeiling.`,
+        });
+    }
+    return violations;
+}
+function gradeEnforcementIdentities(identities, domainOf) {
+    const violations = [];
+    const seen = new Set();
+    for (const identity of identities) {
+        if (seen.has(identity.serviceAccount)) {
+            violations.push({
+                code: TrustPartitionViolationCode.DuplicateIdentity,
+                serviceAccount: identity.serviceAccount,
+                message: `ServiceAccount "${identity.serviceAccount}" is listed twice; list it once with every ` +
+                    `component it acts for, since a boundary sees one identity.`,
+            });
+            continue;
+        }
+        seen.add(identity.serviceAccount);
+        const domains = new Map();
+        for (const { biome, component } of identity.actsFor) {
+            const domain = Object.prototype.hasOwnProperty.call(domainOf, biome)
+                ? domainOf[biome]
+                : undefined;
+            if (domain === undefined) {
+                violations.push({
+                    code: TrustPartitionViolationCode.UnplacedIdentityBiome,
+                    serviceAccount: identity.serviceAccount,
+                    message: `ServiceAccount "${identity.serviceAccount}" acts for ${biome}/${component}, ` +
+                        `but the partition places no biome "${biome}".`,
+                });
+                continue;
+            }
+            const members = domains.get(domain) ?? [];
+            members.push(`${biome}/${component}`);
+            domains.set(domain, members);
+        }
+        if (domains.size > 1) {
+            const summary = [...domains.entries()]
+                .map(([domain, members]) => `${domain} (${members.sort(codeUnit).join(', ')})`)
+                .sort(codeUnit)
+                .join(' and ');
+            violations.push({
+                code: TrustPartitionViolationCode.IdentitySpansTrustDomains,
+                serviceAccount: identity.serviceAccount,
+                message: `ServiceAccount "${identity.serviceAccount}" acts for components of ${domains.size} trust ` +
+                    `domains: ${summary}. One account is one identity at every boundary, so these domains ` +
+                    `are not separate; run the components under separate accounts or place them in one domain.`,
+            });
+        }
+    }
+    return violations;
+}
+function codeUnit(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+//# sourceMappingURL=trust-partition.js.map

package/dist/deployment/lib/trust-partition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-partition.js","sourceRoot":"","sources":["../../../src/deployment/lib/trust-partition.ts"],"names":[],"mappings":";;;AA0DA,oDA6BC;AAmBD,gEAqDC;AA5ID,IAAY,2BAWX;AAXD,WAAY,2BAA2B;IAErC,6DAA8B,CAAA;IAE9B,iEAAkC,CAAA;IAElC,yFAA0D,CAAA;IAE1D,uEAAwC,CAAA;IAExC,gFAAiD,CAAA;AACnD,CAAC,EAXW,2BAA2B,2CAA3B,2BAA2B,QAWtC;AA4BD,SAAgB,oBAAoB,CAClC,MAAmC;IAEnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAoB,CAAC;QAClF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAA0B,CAAC;QACjE,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACrF,IAAI,CAAC,QAAQ,CAAC;aACd,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,2BAA2B,CAAC,cAAc;YAChD,MAAM;YACN,OAAO,EACL,iBAAiB,MAAM,qBAAqB,QAAQ,CAAC,IAAI,6BAA6B,OAAO,IAAI;gBACjG,gGAAgG;gBAChG,kEAAkE;SACrE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAmBD,SAAgB,0BAA0B,CACxC,UAA0C,EAC1C,QAA0C;IAE1C,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,2BAA2B,CAAC,iBAAiB;gBACnD,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,6CAA6C;oBACvF,4DAA4D;aAC/D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;gBAClE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACjB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,2BAA2B,CAAC,qBAAqB;oBACvD,cAAc,EAAE,QAAQ,CAAC,cAAc;oBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,cAAc,KAAK,IAAI,SAAS,IAAI;wBAC9E,sCAAsC,KAAK,IAAI;iBAClD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;iBACnC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;iBAC9E,IAAI,CAAC,QAAQ,CAAC;iBACd,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,2BAA2B,CAAC,yBAAyB;gBAC3D,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,4BAA4B,OAAO,CAAC,IAAI,SAAS;oBAC3F,YAAY,OAAO,oEAAoE;oBACvF,2FAA2F;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/distribution/index.d.ts

@@ -17,4 +17,6 @@ export * from './lib/nexus-binding';
 export * from './lib/resolve-nexus-bindings';
 export * from './lib/nexus-endpoint-specs';
 export * from './lib/lock-consumers';
+export * from './lib/verify-resolved-deployment';
+export type { VerifiedResolvedDeployment } from './lib/verified-resolved-deployment';
 //# sourceMappingURL=index.d.ts.map

package/dist/distribution/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,sCAAsC,CAAC;AACrD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,sCAAsC,CAAC;AACrD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/distribution/index.js

@@ -33,4 +33,5 @@ __exportStar(require("./lib/nexus-binding"), exports);
 __exportStar(require("./lib/resolve-nexus-bindings"), exports);
 __exportStar(require("./lib/nexus-endpoint-specs"), exports);
 __exportStar(require("./lib/lock-consumers"), exports);
+__exportStar(require("./lib/verify-resolved-deployment"), exports);
 //# sourceMappingURL=index.js.map

package/dist/distribution/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,8DAA4C;AAC5C,+DAA6C;AAC7C,qDAAmC;AACnC,2DAAyC;AACzC,sDAAoC;AACpC,0DAAwC;AACxC,mDAAiC;AACjC,gEAA8C;AAC9C,kEAAgD;AAChD,sEAAoD;AACpD,mEAAiD;AACjD,uEAAqD;AACrD,+DAA6C;AAC7C,qDAAmC;AACnC,sDAAoC;AACpC,+DAA6C;AAC7C,6DAA2C;AAC3C,uDAAqC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,8DAA4C;AAC5C,+DAA6C;AAC7C,qDAAmC;AACnC,2DAAyC;AACzC,sDAAoC;AACpC,0DAAwC;AACxC,mDAAiC;AACjC,gEAA8C;AAC9C,kEAAgD;AAChD,sEAAoD;AACpD,mEAAiD;AACjD,uEAAqD;AACrD,+DAA6C;AAC7C,qDAAmC;AACnC,sDAAoC;AACpC,+DAA6C;AAC7C,6DAA2C;AAC3C,uDAAqC;AACrC,mEAAiD"}

package/dist/distribution/lib/distribution-lock.d.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { BiomeComponentKind, BiomeScalingMode, type BiomeComponentProcessFacts, type PostgresExtensionName, type BiomeTier, type BiomeTarget, type BiomeOrigin, type BiomeAudience, type BiomeBundleSourceSpec } from '../../biome';
+import type { VerifiedResolvedDeployment } from './verified-resolved-deployment';
 import { type ResourceInclusion, type ResourceKindRef, type ResourceLogicalName, type ResourceScope } from '../../resource-requirement';
 import { type PlatformServiceTier } from './distribution';
 import { type ClosureEntry } from './biome-closure';
@@ -98,6 +99,8 @@ export interface LockedBiome {
     nexusRequires?: readonly NexusServiceRequirement[];
     workerTaskQueues?: Readonly<Record<string, readonly LockedWorkerTaskQueue[]>>;
     workflowClients?: Readonly<Record<string, readonly LockedWorkflowClient[]>>;
+    workflowSubjects?: readonly LockedWorkflowSubject[];
+    trustCeiling?: string;
     workerImages: Readonly<Record<string, LockedWorkerImage>>;
     imageDigest?: string;
     displayName: string;
@@ -120,16 +123,48 @@ export declare const LockedWorkerImageSchema: z.ZodObject<{
     entry: z.ZodString;
 }, z.core.$strict>;
 export interface LockedWorkflowClient {
+    biome?: string | undefined;
     component: string;
     taskQueue: LockedWorkerTaskQueue;
 }
 export declare const LockedWorkflowClientSchema: z.ZodObject<{
+    biome: z.ZodOptional<z.ZodString>;
     component: z.ZodString;
     taskQueue: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
         name: z.ZodEnum<typeof import("../../workflow").TaskQueueName>;
         placement: z.ZodEnum<typeof import("../../execution-target").TaskQueuePlacement>;
     }, z.core.$strict>]>;
 }, z.core.$strict>;
+export declare enum WorkflowSubjectPermission {
+    Write = "write"
+}
+export declare function controllerTokenServiceAccount(worker: string): string;
+export interface LockedWorkflowSubject {
+    component: string;
+    permissions: WorkflowSubjectPermission[];
+}
+export declare const LockedWorkflowSubjectSchema: z.ZodObject<{
+    component: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<typeof WorkflowSubjectPermission>>;
+}, z.core.$strict>;
+export declare function deriveWorkflowSubjects(biome: {
+    readonly workerTaskQueues?: Readonly<Record<string, readonly LockedWorkerTaskQueue[]>> | undefined;
+    readonly workflowClients?: Readonly<Record<string, readonly LockedWorkflowClient[]>> | undefined;
+}): LockedWorkflowSubject[];
+export interface ResolvedWorkflowSubject {
+    serviceAccount: string;
+    permissions: WorkflowSubjectPermission[];
+    actsFor: {
+        biome: string;
+        component: string;
+    }[];
+}
+export declare function resolveWorkflowSubjects(lock: {
+    readonly biomes: readonly {
+        readonly id: string;
+        readonly workflowSubjects?: readonly LockedWorkflowSubject[] | undefined;
+    }[];
+}, resolved: VerifiedResolvedDeployment): Record<string, ResolvedWorkflowSubject[]>;
 export declare const LockedWorkerTaskQueueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
     name: z.ZodEnum<typeof import("../../workflow").TaskQueueName>;
     placement: z.ZodEnum<typeof import("../../execution-target").TaskQueuePlacement>;
@@ -142,7 +177,7 @@ export interface LockedBiomeDisplay {
     summary?: string;
     accent?: string;
 }
-export type LockedBiomeV3 = Omit<LockedBiome, 'bundleSource' | 'serviceResources' | 'serviceProcessFacts' | 'nexusProvides' | 'nexusRequires' | 'workerTaskQueues' | 'workflowClients' | 'workerImages'>;
+export type LockedBiomeV3 = Omit<LockedBiome, 'bundleSource' | 'serviceResources' | 'serviceProcessFacts' | 'nexusProvides' | 'nexusRequires' | 'workerTaskQueues' | 'workflowClients' | 'workflowSubjects' | 'trustCeiling' | 'workerImages'>;
 export type LockedBiomeV2 = Omit<LockedBiomeV3, 'serviceDatabaseExtensions' | 'source'> & {
     source?: LockedBiomeSourceV2;
 };

package/dist/distribution/lib/distribution-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAML,kBAAkB,EAGlB,gBAAgB,EAEhB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,aAAa,CAAC;AAQrB,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,eAAe,EAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAU7B,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,kCAAkC,EAKhC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAC5B,yBAAyB,GACzB,4BAA4B,CAAC;AAEjC,eAAO,MAAM,0BAA0B,EAGjC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAOtC,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,eAAO,MAAM,6BAA6B,EAM3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAMlD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,4BAA4B,EAK1B,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAuBjD,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,mBAAmB,CAAC;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,EASzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAYhD,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,EAC1E,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,GACzE,MAAM,CAMR;AAsDD,eAAO,MAAM,4BAA4B,EAKvB,CAAC,CAAC,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;AAM9D,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,SAAS,qBAAqB,EAAE,CAUlC;AAwBD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAED,eAAO,MAAM,sBAAsB,EAcpB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA+B3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;IAE1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAgB7E,eAAO,MAAM,yBAAyB,EAEvB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAS9C,eAAO,MAAM,uBAAuB,EACL,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAQ5D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IAEpB,MAAM,EAAE,WAAW,CAAC;IAEpB,SAAS,EAAE,OAAO,CAAC;IAEnB,aAAa,EAAE,kBAAkB,CAAC;IAKlC,MAAM,EAAE,eAAe,CAAC;IAExB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAUb,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAmB5B,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAsBnD,yBAAyB,CAAC,EAAE,QAAQ,CAClC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CACjD,CAAC;IAeF,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAmCzC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAKrC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IA0BxD,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAqBpD,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAkB1E,aAAa,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,aAAa,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAqBnD,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAiB9E,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,CAAC;IA4B5E,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE1D,WAAW,CAAC,EAAE,MAAM,CAAC;IASrB,WAAW,EAAE,MAAM,CAAC;IAMpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,QAAQ,EAAE,aAAa,CAAC;IAExB,WAAW,EAAE,OAAO,CAAC;IAErB,aAAa,EAAE,OAAO,CAAC;IAEvB,kBAAkB,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAS7B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAGD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,uBAAuB;;;kBAKzB,CAAC;AAGZ,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,eAAO,MAAM,0BAA0B;;;;;;kBAK5B,CAAC;AAGZ,eAAO,MAAM,2BAA2B;;;oBAA2B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAE9E;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,WAAW,EACT,cAAc,GACd,kBAAkB,GAClB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,CACjB,CAAC;AAYF,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,EACb,2BAA2B,GAAG,QAAQ,CACvC,GAAG;IACF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAWF,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,kBAAkB,CAAC,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,gBAAgB,CAAC;IAC9B,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;kBAMjC,CAAC;AAqYZ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACpG,GAAG,SAAS,MAAM,EAAE,CAEpB;AAUD,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA6B7D,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA0C7D,eAAO,MAAM,iBAAiB,EACM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AA6C3D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;IAI1B,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,2BAA2B,EAsBhC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAqBzC,MAAM,WAAW,qBAAqB;IAEpC,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,2BAA2B,EAKzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAiFhD,eAAO,MAAM,iCAAiC,oBAAqB,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAOrD,eAAO,MAAM,yCAAyC,EAAG,CAAU,CAAC;AAcpE,eAAO,MAAM,gCAAgC,GACF,CAAC;AAO5C,eAAO,MAAM,mCAAmC,EAAG,CAAU,CAAC;AAoB9D,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAMlE,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IAWvB,sBAAsB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEzD,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEnD,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAUlB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAa1B,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAGD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,yCAAyC,CAAC;IAChE,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAOD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,mCAAmC,CAAC;IAC1D,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAQD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,uCAAuC,CAAC;IAC9D,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAQ/B,UAAU,CAAC,EAAE,0BAA0B,CAAC;IAQxC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAOD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAClC;AAED,eAAO,MAAM,gCAAgC,EA6B1B,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAqDzD,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAOvB,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AActD,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;CAC3C,CAAC;AAMF,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,GAAG;IAC/D,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC;CAC7C,CAAC;AA4GF,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAqBvE,eAAO,MAAM,sBAAsB,EAIlB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA2B7C,eAAO,MAAM,4BAA4B,EAOzB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAmB5C,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,CAAC;CACpE,GACA,6BAA6B,CAY/B;AASD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,2BAA2B,GAChC,gBAAgB,CAGlB;AA8CD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEpE;AASD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,wBAAwB,CAK1B"}
+{"version":3,"file":"distribution-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAML,kBAAkB,EAIlB,gBAAgB,EAEhB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,aAAa,CAAC;AAUrB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,eAAe,EAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAU7B,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,kCAAkC,EAKhC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAC5B,yBAAyB,GACzB,4BAA4B,CAAC;AAEjC,eAAO,MAAM,0BAA0B,EAGjC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAOtC,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,eAAO,MAAM,6BAA6B,EAM3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAMlD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,4BAA4B,EAK1B,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAuBjD,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,mBAAmB,CAAC;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,EASzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAYhD,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,EAC1E,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,GACzE,MAAM,CAMR;AAsDD,eAAO,MAAM,4BAA4B,EAKvB,CAAC,CAAC,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;AAM9D,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,SAAS,qBAAqB,EAAE,CAUlC;AAwBD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAED,eAAO,MAAM,sBAAsB,EAcpB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA+B3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;IAE1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAgB7E,eAAO,MAAM,yBAAyB,EAEvB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAS9C,eAAO,MAAM,uBAAuB,EACL,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAQ5D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IAEpB,MAAM,EAAE,WAAW,CAAC;IAEpB,SAAS,EAAE,OAAO,CAAC;IAEnB,aAAa,EAAE,kBAAkB,CAAC;IAKlC,MAAM,EAAE,eAAe,CAAC;IAExB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAUb,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAmB5B,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAsBnD,yBAAyB,CAAC,EAAE,QAAQ,CAClC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CACjD,CAAC;IAeF,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAmCzC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAKrC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IA0BxD,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAqBpD,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAkB1E,aAAa,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,aAAa,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAqBnD,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAiB9E,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAiB5E,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAapD,YAAY,CAAC,EAAE,MAAM,CAAC;IA4BtB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE1D,WAAW,CAAC,EAAE,MAAM,CAAC;IASrB,WAAW,EAAE,MAAM,CAAC;IAMpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,QAAQ,EAAE,aAAa,CAAC;IAExB,WAAW,EAAE,OAAO,CAAC;IAErB,aAAa,EAAE,OAAO,CAAC;IAEvB,kBAAkB,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAS7B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAGD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,uBAAuB;;;kBAKzB,CAAC;AAOZ,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,eAAO,MAAM,0BAA0B;;;;;;;kBAM5B,CAAC;AAOZ,oBAAY,yBAAyB;IACnC,KAAK,UAAU;CAChB;AAYD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAaD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,yBAAyB,EAAE,CAAC;CAC1C;AAED,eAAO,MAAM,2BAA2B;;;kBAU7B,CAAC;AAUZ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAC1D,SAAS,CAAC;IACd,QAAQ,CAAC,eAAe,CAAC,EACrB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,GACzD,SAAS,CAAC;CACf,GAAG,qBAAqB,EAAE,CAS1B;AAGD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAEzC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AAkBD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS;QACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,GAAG,SAAS,CAAC;KAC1E,EAAE,CAAC;CACL,EACD,QAAQ,EAAE,0BAA0B,GACnC,MAAM,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,CA+C3C;AAOD,eAAO,MAAM,2BAA2B;;;oBAA2B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAE9E;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,WAAW,EACT,cAAc,GACd,kBAAkB,GAClB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAClB,cAAc,GACd,cAAc,CACjB,CAAC;AAYF,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,EACb,2BAA2B,GAAG,QAAQ,CACvC,GAAG;IACF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAWF,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,kBAAkB,CAAC,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,gBAAgB,CAAC;IAC9B,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;kBAMjC,CAAC;AAscZ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACpG,GAAG,SAAS,MAAM,EAAE,CAEpB;AAUD,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA6B7D,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA4C7D,eAAO,MAAM,iBAAiB,EACM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AA6C3D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;IAI1B,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,2BAA2B,EAsBhC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAqBzC,MAAM,WAAW,qBAAqB;IAEpC,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,2BAA2B,EAKzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAiFhD,eAAO,MAAM,iCAAiC,oBAAqB,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAOrD,eAAO,MAAM,yCAAyC,EAAG,CAAU,CAAC;AAcpE,eAAO,MAAM,gCAAgC,GACF,CAAC;AAO5C,eAAO,MAAM,mCAAmC,EAAG,CAAU,CAAC;AAoB9D,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAMlE,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IAWvB,sBAAsB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEzD,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEnD,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAUlB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAa1B,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAGD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,yCAAyC,CAAC;IAChE,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAOD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,mCAAmC,CAAC;IAC1D,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAQD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,uCAAuC,CAAC;IAC9D,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAQ/B,UAAU,CAAC,EAAE,0BAA0B,CAAC;IAQxC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAOD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAClC;AAED,eAAO,MAAM,gCAAgC,EA6B1B,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAqDzD,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAOvB,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AActD,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;CAC3C,CAAC;AAMF,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,GAAG;IAC/D,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC;CAC7C,CAAC;AA8KF,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAqBvE,eAAO,MAAM,sBAAsB,EAIlB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA2B7C,eAAO,MAAM,4BAA4B,EAOzB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAmB5C,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,CAAC;CACpE,GACA,6BAA6B,CAY/B;AASD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,2BAA2B,GAChC,gBAAgB,CAGlB;AA8CD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEpE;AASD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,wBAAwB,CAK1B"}