@xemahq/contracts 0.82.0 → 0.84.0

package/dist/deployment/lib/artifact-signer-trust.d.ts

@@ -2,7 +2,8 @@ import { z } from "zod";
 export declare enum ArtifactSignerScope {
     Charts = "charts",
     Images = "images",
-    Editions = "editions"
+    Editions = "editions",
+    StorePackages = "store-packages"
 }
 export declare const ArtifactSignerScopeSchema: z.ZodEnum<typeof ArtifactSignerScope>;
 export declare function isWhollyAnchoredRegexp(source: string): boolean;
@@ -19,7 +20,28 @@ export declare const ArtifactSignerIdentitySchema: z.ZodUnion<readonly [z.ZodObj
 }, z.core.$strict>]>;
 export type ArtifactSignerIdentity = z.infer<typeof ArtifactSignerIdentitySchema>;
 export declare const ArtifactSignerOidcIssuerSchema: z.ZodString;
-export declare const ArtifactSignerSchema: z.ZodObject<{
+export declare const StorePublisherIdentitySchema: z.ZodString;
+export declare enum SignerKind {
+    OidcCertificate = "oidc-certificate",
+    PublicKey = "public-key"
+}
+export declare const SignerKindSchema: z.ZodEnum<typeof SignerKind>;
+export declare enum TransparencyLog {
+    Rekor = "rekor",
+    None = "none"
+}
+export declare const TransparencyLogSchema: z.ZodEnum<typeof TransparencyLog>;
+export declare function publicKeySha256(pem: string): string | undefined;
+export declare const SignerPublicKeySchema: z.ZodObject<{
+    pem: z.ZodString;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export type SignerPublicKey = z.infer<typeof SignerPublicKeySchema>;
+export interface ArtifactSignerTrustAllowance {
+    readonly allowUnloggedPublicKeys?: boolean;
+}
+export declare const OidcCertificateArtifactSignerSchema: z.ZodObject<{
+    kind: z.ZodLiteral<SignerKind.OidcCertificate>;
     scope: z.ZodEnum<typeof ArtifactSignerScope>;
     oidcIssuer: z.ZodString;
     identity: z.ZodUnion<readonly [z.ZodObject<{
@@ -28,8 +50,36 @@ export declare const ArtifactSignerSchema: z.ZodObject<{
         regexp: z.ZodString;
     }, z.core.$strict>]>;
 }, z.core.$strict>;
+export declare const PublicKeyArtifactSignerSchema: z.ZodObject<{
+    kind: z.ZodLiteral<SignerKind.PublicKey>;
+    scope: z.ZodEnum<typeof ArtifactSignerScope>;
+    publicKey: z.ZodObject<{
+        pem: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>;
+    transparencyLog: z.ZodEnum<typeof TransparencyLog>;
+}, z.core.$strict>;
+export declare const ArtifactSignerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<SignerKind.OidcCertificate>;
+    scope: z.ZodEnum<typeof ArtifactSignerScope>;
+    oidcIssuer: z.ZodString;
+    identity: z.ZodUnion<readonly [z.ZodObject<{
+        exact: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        regexp: z.ZodString;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SignerKind.PublicKey>;
+    scope: z.ZodEnum<typeof ArtifactSignerScope>;
+    publicKey: z.ZodObject<{
+        pem: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>;
+    transparencyLog: z.ZodEnum<typeof TransparencyLog>;
+}, z.core.$strict>], "kind">;
 export type ArtifactSigner = z.infer<typeof ArtifactSignerSchema>;
-export declare const ArtifactSignerTrustSchema: z.ZodArray<z.ZodObject<{
+export declare const ArtifactSignerTrustSchema: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<SignerKind.OidcCertificate>;
     scope: z.ZodEnum<typeof ArtifactSignerScope>;
     oidcIssuer: z.ZodString;
     identity: z.ZodUnion<readonly [z.ZodObject<{
@@ -37,7 +87,15 @@ export declare const ArtifactSignerTrustSchema: z.ZodArray<z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         regexp: z.ZodString;
     }, z.core.$strict>]>;
-}, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SignerKind.PublicKey>;
+    scope: z.ZodEnum<typeof ArtifactSignerScope>;
+    publicKey: z.ZodObject<{
+        pem: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>;
+    transparencyLog: z.ZodEnum<typeof TransparencyLog>;
+}, z.core.$strict>], "kind">>;
 export type ArtifactSignerTrust = readonly ArtifactSigner[];
 export declare const GITHUB_ACTIONS_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
 export declare const OFFICIAL_ARTIFACT_SIGNER_TRUST: ArtifactSignerTrust;
@@ -49,13 +107,17 @@ export interface ResolvedArtifactSignerTrust {
     readonly signers: ArtifactSignerTrust;
     readonly origin: ArtifactSignerTrustOrigin;
 }
-export declare function resolveArtifactSignerTrust(declared: unknown): ResolvedArtifactSignerTrust;
+export declare function resolveArtifactSignerTrust(declared: unknown, allowance?: ArtifactSignerTrustAllowance): ResolvedArtifactSignerTrust;
 export declare function trustedSignersFor(trust: ArtifactSignerTrust, scope: ArtifactSignerScope): readonly ArtifactSigner[];
-export interface ArtifactSigningCertificate {
+export type ArtifactSigningEvidence = {
+    readonly kind: SignerKind.OidcCertificate;
     readonly oidcIssuer: string;
     readonly identity: string;
-}
-export declare function signerMatches(signer: ArtifactSigner, certificate: ArtifactSigningCertificate): boolean;
-export declare function isTrustedArtifactSigner(trust: ArtifactSignerTrust, scope: ArtifactSignerScope, certificate: ArtifactSigningCertificate): boolean;
+} | {
+    readonly kind: SignerKind.PublicKey;
+    readonly publicKeySha256: string;
+};
+export declare function signerMatches(signer: ArtifactSigner, evidence: ArtifactSigningEvidence): boolean;
+export declare function isTrustedArtifactSigner(trust: ArtifactSignerTrust, scope: ArtifactSignerScope, evidence: ArtifactSigningEvidence): boolean;
 export declare function describeArtifactSigner(signer: ArtifactSigner): string;
 //# sourceMappingURL=artifact-signer-trust.d.ts.map

package/dist/deployment/lib/artifact-signer-trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-signer-trust.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/artifact-signer-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4CxB,oBAAY,mBAAmB;IAE7B,MAAM,WAAW;IAEjB,MAAM,WAAW;IAEjB,QAAQ,aAAa;CACtB;AAED,eAAO,MAAM,yBAAyB,uCAAoC,CAAC;AAiB3E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAwB9D;AAGD,eAAO,MAAM,iCAAiC;;kBAEnC,CAAC;AAGZ,eAAO,MAAM,kCAAkC;;kBAapC,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;oBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAGF,eAAO,MAAM,8BAA8B,aAKvC,CAAC;AAGL,eAAO,MAAM,oBAAoB;;;;;;;;kBAOtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAOlE,eAAO,MAAM,yBAAyB;;;;;;;;mBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,cAAc,EAAE,CAAC;AAG5D,eAAO,MAAM,0BAA0B,gDACQ,CAAC;AAOhD,eAAO,MAAM,8BAA8B,EAAE,mBA0BzC,CAAC;AAGL,oBAAY,yBAAyB;IAEnC,QAAQ,aAAa;IAErB,QAAQ,aAAa;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C;AAOD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,GAChB,2BAA2B,CAW7B;AAGD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,mBAAmB,GACzB,SAAS,cAAc,EAAE,CAE3B;AAGD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,0BAA0B,GACtC,OAAO,CAKT;AAGD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,0BAA0B,GACtC,OAAO,CAIT;AAGD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAMrE"}
+{"version":3,"file":"artifact-signer-trust.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/artifact-signer-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuDxB,oBAAY,mBAAmB;IAE7B,MAAM,WAAW;IAEjB,MAAM,WAAW;IAEjB,QAAQ,aAAa;IAOrB,aAAa,mBAAmB;CACjC;AAED,eAAO,MAAM,yBAAyB,uCAAoC,CAAC;AAiB3E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAwB9D;AAGD,eAAO,MAAM,iCAAiC;;kBAEnC,CAAC;AAGZ,eAAO,MAAM,kCAAkC;;kBAapC,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;oBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAGF,eAAO,MAAM,8BAA8B,aAKvC,CAAC;AAQL,eAAO,MAAM,4BAA4B,aAKrC,CAAC;AAGL,oBAAY,UAAU;IAEpB,eAAe,qBAAqB;IAEpC,SAAS,eAAe;CACzB;AAED,eAAO,MAAM,gBAAgB,8BAA2B,CAAC;AAGzD,oBAAY,eAAe;IAEzB,KAAK,UAAU;IAEf,IAAI,SAAS;CACd;AAED,eAAO,MAAM,qBAAqB,mCAAgC,CAAC;AAgInE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAOD,eAAO,MAAM,qBAAqB;;;kBAqB9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC5C;AAID,eAAO,MAAM,mCAAmC;;;;;;;;;kBAQrC,CAAC;AAEZ,eAAO,MAAM,6BAA6B;;;;;;;;kBAO/B,CAAC;AAEZ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;4BAG/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAOlE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;6BAwClC,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,SAAS,cAAc,EAAE,CAAC;AAG5D,eAAO,MAAM,0BAA0B,gDACQ,CAAC;AAOhD,eAAO,MAAM,8BAA8B,EAAE,mBA6BzC,CAAC;AAGL,oBAAY,yBAAyB;IAEnC,QAAQ,aAAa;IAErB,QAAQ,aAAa;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C;AASD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,SAAS,GAAE,4BAAiC,GAC3C,2BAA2B,CAqB7B;AAGD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,mBAAmB,GACzB,SAAS,cAAc,EAAE,CAE3B;AAGD,MAAM,MAAM,uBAAuB,GAC/B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC;AAO9E,wBAAgB,aAAa,CAC3B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAYT;AAGD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAIT;AAGD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CASrE"}

package/dist/deployment/lib/artifact-signer-trust.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ArtifactSignerTrustOrigin = exports.OFFICIAL_ARTIFACT_SIGNER_TRUST = exports.GITHUB_ACTIONS_OIDC_ISSUER = exports.ArtifactSignerTrustSchema = exports.ArtifactSignerSchema = exports.ArtifactSignerOidcIssuerSchema = exports.ArtifactSignerIdentitySchema = exports.ArtifactSignerRegexpIdentitySchema = exports.ArtifactSignerExactIdentitySchema = exports.ArtifactSignerScopeSchema = exports.ArtifactSignerScope = void 0;
+exports.ArtifactSignerTrustOrigin = exports.OFFICIAL_ARTIFACT_SIGNER_TRUST = exports.GITHUB_ACTIONS_OIDC_ISSUER = exports.ArtifactSignerTrustSchema = exports.ArtifactSignerSchema = exports.PublicKeyArtifactSignerSchema = exports.OidcCertificateArtifactSignerSchema = exports.SignerPublicKeySchema = exports.TransparencyLogSchema = exports.TransparencyLog = exports.SignerKindSchema = exports.SignerKind = exports.StorePublisherIdentitySchema = exports.ArtifactSignerOidcIssuerSchema = exports.ArtifactSignerIdentitySchema = exports.ArtifactSignerRegexpIdentitySchema = exports.ArtifactSignerExactIdentitySchema = exports.ArtifactSignerScopeSchema = exports.ArtifactSignerScope = void 0;
 exports.isWhollyAnchoredRegexp = isWhollyAnchoredRegexp;
+exports.publicKeySha256 = publicKeySha256;
 exports.resolveArtifactSignerTrust = resolveArtifactSignerTrust;
 exports.trustedSignersFor = trustedSignersFor;
 exports.signerMatches = signerMatches;
@@ -13,6 +14,7 @@ var ArtifactSignerScope;
     ArtifactSignerScope["Charts"] = "charts";
     ArtifactSignerScope["Images"] = "images";
     ArtifactSignerScope["Editions"] = "editions";
+    ArtifactSignerScope["StorePackages"] = "store-packages";
 })(ArtifactSignerScope || (exports.ArtifactSignerScope = ArtifactSignerScope = {}));
 exports.ArtifactSignerScopeSchema = zod_1.z.nativeEnum(ArtifactSignerScope);
 function isCompilableRegexp(source) {
@@ -82,19 +84,212 @@ exports.ArtifactSignerOidcIssuerSchema = zod_1.z
     .refine((value) => value.startsWith("https://"), {
     message: "oidcIssuer must be an https URL",
 });
-exports.ArtifactSignerSchema = zod_1.z
+exports.StorePublisherIdentitySchema = zod_1.z
+    .string()
+    .min(1)
+    .refine((value) => !value.includes("refs/pull/"), {
+    message: "identity must not be a pull-request ref",
+});
+var SignerKind;
+(function (SignerKind) {
+    SignerKind["OidcCertificate"] = "oidc-certificate";
+    SignerKind["PublicKey"] = "public-key";
+})(SignerKind || (exports.SignerKind = SignerKind = {}));
+exports.SignerKindSchema = zod_1.z.nativeEnum(SignerKind);
+var TransparencyLog;
+(function (TransparencyLog) {
+    TransparencyLog["Rekor"] = "rekor";
+    TransparencyLog["None"] = "none";
+})(TransparencyLog || (exports.TransparencyLog = TransparencyLog = {}));
+exports.TransparencyLogSchema = zod_1.z.nativeEnum(TransparencyLog);
+const SHA256_ROUND_CONSTANTS = Uint32Array.from([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+function at(array, index) {
+    const value = array[index];
+    if (value === undefined)
+        throw new Error('sha256: index out of range');
+    return value;
+}
+function sha256Hex(bytes) {
+    const bitLength = bytes.length * 8;
+    const paddedLength = Math.ceil((bytes.length + 9) / 64) * 64;
+    const padded = new Uint8Array(paddedLength);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x100000000));
+    view.setUint32(paddedLength - 4, bitLength >>> 0);
+    const state = Uint32Array.from([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c,
+        0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const w = new Uint32Array(64);
+    const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+    for (let offset = 0; offset < paddedLength; offset += 64) {
+        for (let i = 0; i < 16; i += 1)
+            w[i] = view.getUint32(offset + i * 4);
+        for (let i = 16; i < 64; i += 1) {
+            const w15 = at(w, i - 15);
+            const w2 = at(w, i - 2);
+            const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ (w15 >>> 3);
+            const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ (w2 >>> 10);
+            w[i] = (at(w, i - 16) + s0 + at(w, i - 7) + s1) >>> 0;
+        }
+        let a = at(state, 0);
+        let b = at(state, 1);
+        let c = at(state, 2);
+        let d = at(state, 3);
+        let e = at(state, 4);
+        let f = at(state, 5);
+        let g = at(state, 6);
+        let h = at(state, 7);
+        for (let i = 0; i < 64; i += 1) {
+            const t1 = (h +
+                (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) +
+                ((e & f) ^ (~e & g)) +
+                at(SHA256_ROUND_CONSTANTS, i) +
+                at(w, i)) >>>
+                0;
+            const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) +
+                ((a & b) ^ (a & c) ^ (b & c))) >>>
+                0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        for (const [i, v] of [a, b, c, d, e, f, g, h].entries())
+            state[i] = at(state, i) + v;
+    }
+    return Array.from(state, (word) => word.toString(16).padStart(8, '0')).join('');
+}
+const SPKI_DER_PREFIXES = [
+    { prefix: '3059301306072a8648ce3d020106082a8648ce3d030107034200', length: 91 },
+    { prefix: '302a300506032b6570032100', length: 44 },
+];
+const PUBLIC_KEY_PEM_PATTERN = /^-----BEGIN PUBLIC KEY-----\n((?:[A-Za-z0-9+/]{1,64}\n)*[A-Za-z0-9+/]{1,64}={0,2})\n-----END PUBLIC KEY-----\n?$/;
+function spkiDerOf(pem) {
+    const match = PUBLIC_KEY_PEM_PATTERN.exec(pem);
+    if (match === null)
+        return undefined;
+    const base64 = (match[1] ?? '').replace(/\n/g, '');
+    if (base64.length % 4 !== 0)
+        return undefined;
+    let binary;
+    try {
+        binary = atob(base64);
+    }
+    catch {
+        return undefined;
+    }
+    const der = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    const hex = Array.from(der, (byte) => byte.toString(16).padStart(2, '0')).join('');
+    const known = SPKI_DER_PREFIXES.some((entry) => der.length === entry.length && hex.startsWith(entry.prefix));
+    return known ? der : undefined;
+}
+function publicKeySha256(pem) {
+    const der = spkiDerOf(pem);
+    return der === undefined ? undefined : sha256Hex(der);
+}
+exports.SignerPublicKeySchema = zod_1.z
     .object({
+    pem: zod_1.z.string().min(1),
+    sha256: zod_1.z.string().regex(/^[a-f0-9]{64}$/, 'expected a lowercase SHA-256 hex digest'),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const actual = publicKeySha256(value.pem);
+    if (actual === undefined) {
+        context.addIssue({
+            code: 'custom',
+            path: ['pem'],
+            message: `public key ${value.sha256} must be a PEM SPKI ECDSA P-256 or Ed25519 public key`,
+        });
+    }
+    else if (actual !== value.sha256) {
+        context.addIssue({
+            code: 'custom',
+            path: ['sha256'],
+            message: `public key ${value.sha256} is not the SHA-256 of its DER (the pem hashes to ${actual})`,
+        });
+    }
+});
+exports.OidcCertificateArtifactSignerSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(SignerKind.OidcCertificate),
     scope: exports.ArtifactSignerScopeSchema,
     oidcIssuer: exports.ArtifactSignerOidcIssuerSchema,
     identity: exports.ArtifactSignerIdentitySchema,
 })
     .strict();
-exports.ArtifactSignerTrustSchema = zod_1.z.array(exports.ArtifactSignerSchema).min(1, {
+exports.PublicKeyArtifactSignerSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal(SignerKind.PublicKey),
+    scope: exports.ArtifactSignerScopeSchema,
+    publicKey: exports.SignerPublicKeySchema,
+    transparencyLog: exports.TransparencyLogSchema,
+})
+    .strict();
+exports.ArtifactSignerSchema = zod_1.z.discriminatedUnion('kind', [
+    exports.OidcCertificateArtifactSignerSchema,
+    exports.PublicKeyArtifactSignerSchema,
+]);
+exports.ArtifactSignerTrustSchema = zod_1.z
+    .array(exports.ArtifactSignerSchema)
+    .min(1, {
     message: "artifactSignerTrust must list at least one signer. It replaces the official signers; it cannot turn verification off. Remove it to trust the official signers.",
+})
+    .superRefine((signers, context) => {
+    signers.forEach((signer, index) => {
+        if (signer.scope !== ArtifactSignerScope.StorePackages)
+            return;
+        if (signer.kind === SignerKind.PublicKey) {
+            context.addIssue({
+                code: "custom",
+                path: [index, "kind"],
+                message: `a store-packages signer must be an oidc-certificate signer; public key ${signer.publicKey.sha256} is refused`,
+            });
+            return;
+        }
+        if (!("exact" in signer.identity)) {
+            context.addIssue({
+                code: "custom",
+                path: [index, "identity"],
+                message: "a store-packages signer identity must be exact, not a regexp",
+            });
+            return;
+        }
+        const identity = exports.StorePublisherIdentitySchema.safeParse(signer.identity.exact);
+        if (!identity.success) {
+            for (const issue of identity.error.issues) {
+                context.addIssue({
+                    code: "custom",
+                    path: [index, "identity", "exact", ...issue.path],
+                    message: issue.message,
+                });
+            }
+        }
+    });
 });
 exports.GITHUB_ACTIONS_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
 exports.OFFICIAL_ARTIFACT_SIGNER_TRUST = Object.freeze([
     Object.freeze({
+        kind: SignerKind.OidcCertificate,
         scope: ArtifactSignerScope.Charts,
         oidcIssuer: exports.GITHUB_ACTIONS_OIDC_ISSUER,
         identity: Object.freeze({
@@ -102,6 +297,7 @@ exports.OFFICIAL_ARTIFACT_SIGNER_TRUST = Object.freeze([
         }),
     }),
     Object.freeze({
+        kind: SignerKind.OidcCertificate,
         scope: ArtifactSignerScope.Images,
         oidcIssuer: exports.GITHUB_ACTIONS_OIDC_ISSUER,
         identity: Object.freeze({
@@ -109,6 +305,7 @@ exports.OFFICIAL_ARTIFACT_SIGNER_TRUST = Object.freeze([
         }),
     }),
     Object.freeze({
+        kind: SignerKind.OidcCertificate,
         scope: ArtifactSignerScope.Editions,
         oidcIssuer: exports.GITHUB_ACTIONS_OIDC_ISSUER,
         identity: Object.freeze({
@@ -121,33 +318,48 @@ var ArtifactSignerTrustOrigin;
     ArtifactSignerTrustOrigin["Declared"] = "declared";
     ArtifactSignerTrustOrigin["Official"] = "official";
 })(ArtifactSignerTrustOrigin || (exports.ArtifactSignerTrustOrigin = ArtifactSignerTrustOrigin = {}));
-function resolveArtifactSignerTrust(declared) {
+function resolveArtifactSignerTrust(declared, allowance = {}) {
     if (declared === undefined) {
         return {
             signers: exports.OFFICIAL_ARTIFACT_SIGNER_TRUST,
             origin: ArtifactSignerTrustOrigin.Official,
         };
     }
-    return {
-        signers: exports.ArtifactSignerTrustSchema.parse(declared),
-        origin: ArtifactSignerTrustOrigin.Declared,
-    };
+    const signers = exports.ArtifactSignerTrustSchema.parse(declared);
+    if (allowance.allowUnloggedPublicKeys !== true) {
+        for (const signer of signers) {
+            if (signer.kind === SignerKind.PublicKey &&
+                signer.transparencyLog === TransparencyLog.None) {
+                throw new Error(`public key ${signer.publicKey.sha256} declares transparencyLog "none", which this installation does not allow (allowUnloggedPublicKeys is not true)`);
+            }
+        }
+    }
+    return { signers, origin: ArtifactSignerTrustOrigin.Declared };
 }
 function trustedSignersFor(trust, scope) {
     return trust.filter((signer) => signer.scope === scope);
 }
-function signerMatches(signer, certificate) {
-    if (signer.oidcIssuer !== certificate.oidcIssuer)
+function signerMatches(signer, evidence) {
+    if (signer.kind === SignerKind.PublicKey) {
+        return (evidence.kind === SignerKind.PublicKey &&
+            signer.publicKey.sha256 === evidence.publicKeySha256);
+    }
+    if (evidence.kind !== SignerKind.OidcCertificate)
         return false;
-    if ("exact" in signer.identity)
-        return signer.identity.exact === certificate.identity;
-    return new RegExp(signer.identity.regexp).test(certificate.identity);
+    if (signer.oidcIssuer !== evidence.oidcIssuer)
+        return false;
+    if ('exact' in signer.identity)
+        return signer.identity.exact === evidence.identity;
+    return new RegExp(signer.identity.regexp).test(evidence.identity);
 }
-function isTrustedArtifactSigner(trust, scope, certificate) {
-    return trustedSignersFor(trust, scope).some((signer) => signerMatches(signer, certificate));
+function isTrustedArtifactSigner(trust, scope, evidence) {
+    return trustedSignersFor(trust, scope).some((signer) => signerMatches(signer, evidence));
 }
 function describeArtifactSigner(signer) {
-    const identity = "exact" in signer.identity
+    if (signer.kind === SignerKind.PublicKey) {
+        return `public key ${signer.publicKey.sha256}`;
+    }
+    const identity = 'exact' in signer.identity
         ? `identity ${signer.identity.exact}`
         : `identity matching ${signer.identity.regexp}`;
     return `${identity} via ${signer.oidcIssuer}`;

package/dist/deployment/lib/artifact-signer-trust.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-signer-trust.js","sourceRoot":"","sources":["../../../src/deployment/lib/artifact-signer-trust.ts"],"names":[],"mappings":";;;AAsEA,wDAwBC;AAoHD,gEAaC;AAGD,8CAKC;AASD,sCAQC;AAGD,0DAQC;AAGD,wDAMC;AA5QD,6BAAwB;AA4CxB,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAE7B,wCAAiB,CAAA;IAEjB,wCAAiB,CAAA;IAEjB,4CAAqB,CAAA;AACvB,CAAC,EAPW,mBAAmB,mCAAnB,mBAAmB,QAO9B;AAEY,QAAA,yBAAyB,GAAG,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAE3E,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD,SAAgB,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QAClE,mBAAmB,IAAI,CAAC,CAAC;IAC3B,IAAI,mBAAmB,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,GAAG,KAAK,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,CAAC;aAC5B,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7B,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7B,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGY,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,MAAM,EAAE,CAAC;AAGC,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,MAAM,EAAE,OAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,sBAAsB,EAAE;QAC9B,OAAO,EACL,yKAAyK;KAC5K,CAAC;SACD,MAAM,CAAC,kBAAkB,EAAE;QAC1B,OAAO,EAAE,gCAAgC;KAC1C,CAAC;CACL,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC,CAAC,KAAK,CAAC;IAClD,yCAAiC;IACjC,0CAAkC;CACnC,CAAC,CAAC;AAMU,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;IAC/C,OAAO,EAAE,iCAAiC;CAC3C,CAAC,CAAC;AAGQ,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,KAAK,EAAE,iCAAyB;IAEhC,UAAU,EAAE,sCAA8B;IAC1C,QAAQ,EAAE,oCAA4B;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAQC,QAAA,yBAAyB,GAAG,OAAC,CAAC,KAAK,CAAC,4BAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE;IAC5E,OAAO,EACL,gKAAgK;CACnK,CAAC,CAAC;AAIU,QAAA,0BAA0B,GACrC,6CAA6C,CAAC;AAOnC,QAAA,8BAA8B,GACzC,MAAM,CAAC,MAAM,CAAC;IACZ,MAAM,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,mBAAmB,CAAC,MAAM;QACjC,UAAU,EAAE,kCAA0B;QACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,EACJ,+IAA+I;SAClJ,CAAC;KACH,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,mBAAmB,CAAC,MAAM;QACjC,UAAU,EAAE,kCAA0B;QACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,EACJ,6HAA6H;SAChI,CAAC;KACH,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,mBAAmB,CAAC,QAAQ;QACnC,UAAU,EAAE,kCAA0B;QACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,EACJ,gHAAgH;SACnH,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAGL,IAAY,yBAKX;AALD,WAAY,yBAAyB;IAEnC,kDAAqB,CAAA;IAErB,kDAAqB,CAAA;AACvB,CAAC,EALW,yBAAyB,yCAAzB,yBAAyB,QAKpC;AAYD,SAAgB,0BAA0B,CACxC,QAAiB;IAEjB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,sCAA8B;YACvC,MAAM,EAAE,yBAAyB,CAAC,QAAQ;SAC3C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,iCAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClD,MAAM,EAAE,yBAAyB,CAAC,QAAQ;KAC3C,CAAC;AACJ,CAAC;AAGD,SAAgB,iBAAiB,CAC/B,KAA0B,EAC1B,KAA0B;IAE1B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAC1D,CAAC;AASD,SAAgB,aAAa,CAC3B,MAAsB,EACtB,WAAuC;IAEvC,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,WAAW,CAAC,QAAQ,CAAC;IACxD,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAGD,SAAgB,uBAAuB,CACrC,KAA0B,EAC1B,KAA0B,EAC1B,WAAuC;IAEvC,OAAO,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrD,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CACnC,CAAC;AACJ,CAAC;AAGD,SAAgB,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,QAAQ,GACZ,OAAO,IAAI,MAAM,CAAC,QAAQ;QACxB,CAAC,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE;QACrC,CAAC,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpD,OAAO,GAAG,QAAQ,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"artifact-signer-trust.js","sourceRoot":"","sources":["../../../src/deployment/lib/artifact-signer-trust.ts"],"names":[],"mappings":";;;AAwFA,wDAwBC;AAsMD,0CAGC;AA8KD,gEAwBC;AAGD,8CAKC;AAgBD,sCAeC;AAGD,0DAQC;AAGD,wDASC;AA7jBD,6BAAwB;AAuDxB,IAAY,mBAcX;AAdD,WAAY,mBAAmB;IAE7B,wCAAiB,CAAA;IAEjB,wCAAiB,CAAA;IAEjB,4CAAqB,CAAA;IAOrB,uDAAgC,CAAA;AAClC,CAAC,EAdW,mBAAmB,mCAAnB,mBAAmB,QAc9B;AAEY,QAAA,yBAAyB,GAAG,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAE3E,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD,SAAgB,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QAClE,mBAAmB,IAAI,CAAC,CAAC;IAC3B,IAAI,mBAAmB,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,GAAG,KAAK,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,CAAC;aAC5B,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7B,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7B,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGY,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,MAAM,EAAE,CAAC;AAGC,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,MAAM,EAAE,OAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,sBAAsB,EAAE;QAC9B,OAAO,EACL,yKAAyK;KAC5K,CAAC;SACD,MAAM,CAAC,kBAAkB,EAAE;QAC1B,OAAO,EAAE,gCAAgC;KAC1C,CAAC;CACL,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC,CAAC,KAAK,CAAC;IAClD,yCAAiC;IACjC,0CAAkC;CACnC,CAAC,CAAC;AAMU,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;IAC/C,OAAO,EAAE,iCAAiC;CAC3C,CAAC,CAAC;AAQQ,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE;IAChD,OAAO,EAAE,yCAAyC;CACnD,CAAC,CAAC;AAGL,IAAY,UAKX;AALD,WAAY,UAAU;IAEpB,kDAAoC,CAAA;IAEpC,sCAAwB,CAAA;AAC1B,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AAEY,QAAA,gBAAgB,GAAG,OAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAGzD,IAAY,eAKX;AALD,WAAY,eAAe;IAEzB,kCAAe,CAAA;IAEf,gCAAa,CAAA;AACf,CAAC,EALW,eAAe,+BAAf,eAAe,QAK1B;AAEY,QAAA,qBAAqB,GAAG,OAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAEnE,MAAM,sBAAsB,GAAG,WAAW,CAAC,IAAI,CAAC;IAC9C,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC/C,CAAC,CAAC;AAEH,SAAS,EAAE,CAAC,KAAwB,EAAE,KAAa;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAQD,SAAS,SAAS,CAAC,KAAiB;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,CAAC,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;QAC7B,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;QACtE,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,YAAY,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YACtD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,EAAE,GACN,CAAC,CAAC;gBACA,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpB,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;gBAC7B,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACX,CAAC,CAAC;YACJ,MAAM,EAAE,GACN,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChC,CAAC,CAAC;YACJ,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;YACrD,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC;AAOD,MAAM,iBAAiB,GAGjB;IACJ,EAAE,MAAM,EAAE,sDAAsD,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9E,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;CACnD,CAAC;AAEF,MAAM,sBAAsB,GAC1B,kHAAkH,CAAC;AAGrH,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAC5E,EAAE,CACH,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAClC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CACvE,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjC,CAAC;AAGD,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAOY,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,yCAAyC,CAAC;CACtF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,cAAc,KAAK,CAAC,MAAM,uDAAuD;SAC3F,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,cAAc,KAAK,CAAC,MAAM,qDAAqD,MAAM,GAAG;SAClG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAaQ,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC3C,KAAK,EAAE,iCAAyB;IAEhC,UAAU,EAAE,sCAA8B;IAC1C,QAAQ,EAAE,oCAA4B;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACrC,KAAK,EAAE,iCAAyB;IAChC,SAAS,EAAE,6BAAqB;IAChC,eAAe,EAAE,6BAAqB;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,oBAAoB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/D,2CAAmC;IACnC,qCAA6B;CAC9B,CAAC,CAAC;AAQU,QAAA,yBAAyB,GAAG,OAAC;KACvC,KAAK,CAAC,4BAAoB,CAAC;KAC3B,GAAG,CAAC,CAAC,EAAE;IACN,OAAO,EACL,gKAAgK;CACnK,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAKhC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,CAAC,aAAa;YAAE,OAAO;QAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACrB,OAAO,EAAE,0EAA0E,MAAM,CAAC,SAAS,CAAC,MAAM,aAAa;aACxH,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;gBACzB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,oCAA4B,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC1C,OAAO,CAAC,QAAQ,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;oBACjD,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIQ,QAAA,0BAA0B,GACrC,6CAA6C,CAAC;AAOnC,QAAA,8BAA8B,GACzC,MAAM,CAAC,MAAM,CAAC;IACZ,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,UAAU,CAAC,eAAe;QAChC,KAAK,EAAE,mBAAmB,CAAC,MAAM;QACjC,UAAU,EAAE,kCAA0B;QACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,EACJ,+IAA+I;SAClJ,CAAC;KACH,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,UAAU,CAAC,eAAe;QAChC,KAAK,EAAE,mBAAmB,CAAC,MAAM;QACjC,UAAU,EAAE,kCAA0B;QACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,EACJ,6HAA6H;SAChI,CAAC;KACH,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,UAAU,CAAC,eAAe;QAChC,KAAK,EAAE,mBAAmB,CAAC,QAAQ;QACnC,UAAU,EAAE,kCAA0B;QACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,EACJ,gHAAgH;SACnH,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAGL,IAAY,yBAKX;AALD,WAAY,yBAAyB;IAEnC,kDAAqB,CAAA;IAErB,kDAAqB,CAAA;AACvB,CAAC,EALW,yBAAyB,yCAAzB,yBAAyB,QAKpC;AAcD,SAAgB,0BAA0B,CACxC,QAAiB,EACjB,YAA0C,EAAE;IAE5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,sCAA8B;YACvC,MAAM,EAAE,yBAAyB,CAAC,QAAQ;SAC3C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,iCAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,SAAS,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IACE,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,SAAS;gBACpC,MAAM,CAAC,eAAe,KAAK,eAAe,CAAC,IAAI,EAC/C,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,SAAS,CAAC,MAAM,gHAAgH,CACtJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC;AACjE,CAAC;AAGD,SAAgB,iBAAiB,CAC/B,KAA0B,EAC1B,KAA0B;IAE1B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAC1D,CAAC;AAgBD,SAAgB,aAAa,CAC3B,MAAsB,EACtB,QAAiC;IAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,SAAS;YACtC,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,eAAe,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,QAAQ,CAAC;IACrD,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpE,CAAC;AAGD,SAAgB,uBAAuB,CACrC,KAA0B,EAC1B,KAA0B,EAC1B,QAAiC;IAEjC,OAAO,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrD,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAChC,CAAC;AACJ,CAAC;AAGD,SAAgB,sBAAsB,CAAC,MAAsB;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,cAAc,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GACZ,OAAO,IAAI,MAAM,CAAC,QAAQ;QACxB,CAAC,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE;QACrC,CAAC,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpD,OAAO,GAAG,QAAQ,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC;AAChD,CAAC"}

package/dist/deployment/lib/code-unit-order.d.ts

@@ -0,0 +1,2 @@
+export declare function compareCodeUnits(a: string, b: string): number;
+//# sourceMappingURL=code-unit-order.d.ts.map

package/dist/deployment/lib/code-unit-order.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-unit-order.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/code-unit-order.ts"],"names":[],"mappings":"AACA,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/deployment/lib/code-unit-order.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareCodeUnits = compareCodeUnits;
+function compareCodeUnits(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+//# sourceMappingURL=code-unit-order.js.map

package/dist/deployment/lib/code-unit-order.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-unit-order.js","sourceRoot":"","sources":["../../../src/deployment/lib/code-unit-order.ts"],"names":[],"mappings":";;AACA,4CAEC;AAFD,SAAgB,gBAAgB,CAAC,CAAS,EAAE,CAAS;IACnD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/deployment/lib/event-subscription-grant.d.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+import { EventSubscriptionScopeKind } from '../../event-subscription';
+export declare const EventSubscriptionCallerSchema: z.ZodObject<{
+    biome: z.ZodString;
+    component: z.ZodString;
+}, z.core.$strict>;
+export type EventSubscriptionCaller = z.infer<typeof EventSubscriptionCallerSchema>;
+export declare const EventSubscriptionGrantSchema: z.ZodObject<{
+    caller: z.ZodObject<{
+        biome: z.ZodString;
+        component: z.ZodString;
+    }, z.core.$strict>;
+    clauses: z.ZodArray<z.ZodObject<{
+        types: z.ZodArray<z.ZodString>;
+        tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<EventSubscriptionScopeKind.Org>;
+            org: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<EventSubscriptionScopeKind.Realm>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type EventSubscriptionGrant = z.infer<typeof EventSubscriptionGrantSchema>;
+export declare const InstalledEventSubscriptionCeilingSchema: z.ZodObject<{
+    caller: z.ZodObject<{
+        biome: z.ZodString;
+        component: z.ZodString;
+    }, z.core.$strict>;
+    clauses: z.ZodArray<z.ZodObject<{
+        types: z.ZodArray<z.ZodString>;
+        tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<EventSubscriptionScopeKind.Org>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<EventSubscriptionScopeKind.Realm>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type InstalledEventSubscriptionCeiling = z.infer<typeof InstalledEventSubscriptionCeilingSchema>;
+export declare function compareEventSubscriptionRows(a: {
+    readonly caller: EventSubscriptionCaller;
+}, b: {
+    readonly caller: EventSubscriptionCaller;
+}): number;
+//# sourceMappingURL=event-subscription-grant.d.ts.map

package/dist/deployment/lib/event-subscription-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-subscription-grant.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/event-subscription-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,0BAA0B,EAE3B,MAAM,0BAA0B,CAAC;AAoBlC,eAAO,MAAM,6BAA6B;;;kBAK/B,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAGpF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;kBAiB9B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAGlF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;kBAmBzC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAGxG,wBAAgB,4BAA4B,CAC1C,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,EAC/C,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC9C,MAAM,CAER"}

package/dist/deployment/lib/event-subscription-grant.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledEventSubscriptionCeilingSchema = exports.EventSubscriptionGrantSchema = exports.EventSubscriptionCallerSchema = void 0;
+exports.compareEventSubscriptionRows = compareEventSubscriptionRows;
+const zod_1 = require("zod");
+const event_subscription_1 = require("../../event-subscription");
+const code_unit_order_1 = require("./code-unit-order");
+const trust_domain_1 = require("./trust-domain");
+exports.EventSubscriptionCallerSchema = zod_1.z
+    .object({
+    biome: zod_1.z.string().regex(trust_domain_1.TRUST_DOMAIN_BIOME_ID_PATTERN, 'biome id must be lowercase kebab-case'),
+    component: zod_1.z.string().min(1),
+})
+    .strict();
+exports.EventSubscriptionGrantSchema = zod_1.z
+    .object({
+    caller: exports.EventSubscriptionCallerSchema,
+    clauses: (0, event_subscription_1.eventSubscriptionClauseListSchema)(event_subscription_1.EventSubscriptionGrantClauseSchema, 'an eventSubscriptionGrants row', {
+        sorted: true,
+    }).superRefine((clauses, ctx) => {
+        clauses.forEach((clause, index) => {
+            if (clause.scope.kind !== event_subscription_1.EventSubscriptionScopeKind.Realm) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [index, 'scope'],
+                    message: 'an eventSubscriptionGrants clause is realm-scoped; org reach is granted per installation',
+                });
+            }
+        });
+    }),
+})
+    .strict();
+exports.InstalledEventSubscriptionCeilingSchema = zod_1.z
+    .object({
+    caller: exports.EventSubscriptionCallerSchema,
+    clauses: (0, event_subscription_1.eventSubscriptionClauseListSchema)(event_subscription_1.DeclaredEventSubscriptionClauseSchema, 'an installedEventSubscriptionCeilings row', { sorted: true }).superRefine((clauses, ctx) => {
+        clauses.forEach((clause, index) => {
+            if (clause.scope.kind !== event_subscription_1.EventSubscriptionScopeKind.Org) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [index, 'scope'],
+                    message: 'an installedEventSubscriptionCeilings clause is org-scoped; realm reach is never installable',
+                });
+            }
+        });
+    }),
+})
+    .strict();
+function compareEventSubscriptionRows(a, b) {
+    return (0, code_unit_order_1.compareCodeUnits)(a.caller.biome, b.caller.biome) || (0, code_unit_order_1.compareCodeUnits)(a.caller.component, b.caller.component);
+}
+//# sourceMappingURL=event-subscription-grant.js.map

package/dist/deployment/lib/event-subscription-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-subscription-grant.js","sourceRoot":"","sources":["../../../src/deployment/lib/event-subscription-grant.ts"],"names":[],"mappings":";;;AAmFA,oEAKC;AAxFD,6BAAwB;AAExB,iEAKkC;AAClC,uDAAqD;AACrD,iDAA+D;AAkBlD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC;IAC/F,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,MAAM,EAAE,qCAA6B;IACrC,OAAO,EAAE,IAAA,sDAAiC,EAAC,uDAAkC,EAAE,gCAAgC,EAAE;QAC/G,MAAM,EAAE,IAAI;KACb,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QAC9B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YAChC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,+CAA0B,CAAC,KAAK,EAAE,CAAC;gBAC3D,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;oBACtB,OAAO,EAAE,0FAA0F;iBACpG,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,uCAAuC,GAAG,OAAC;KACrD,MAAM,CAAC;IACN,MAAM,EAAE,qCAA6B;IACrC,OAAO,EAAE,IAAA,sDAAiC,EACxC,0DAAqC,EACrC,2CAA2C,EAC3C,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QAC7B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YAChC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,+CAA0B,CAAC,GAAG,EAAE,CAAC;gBACzD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;oBACtB,OAAO,EAAE,8FAA8F;iBACxG,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,SAAgB,4BAA4B,CAC1C,CAA+C,EAC/C,CAA+C;IAE/C,OAAO,IAAA,kCAAgB,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAA,kCAAgB,EAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACtH,CAAC"}