@agent-teams/engineering-foundation 0.4.1 → 0.5.0

package/dist/capabilities/repository-agent-workflow/contract/config.js

@@ -0,0 +1,121 @@
+import { CapabilityInputError } from "../../../capability-runtime.js";
+import { assertSchema } from "../../../schema-catalog.js";
+import { assertRepositoryRelativePath, loadStrictYamlFile } from "../../../strict-yaml.js";
+export const CAPABILITY_ID = "repository.agent-workflow";
+export const CAPABILITY_CONFIG_SCHEMA_VERSION = 1;
+function inputError(message) {
+    throw new CapabilityInputError({
+        code: "REPOSITORY_AGENT_WORKFLOW_CONFIG_INVALID",
+        message,
+        phase: "repository-agent-workflow-config",
+        retryable: false
+    });
+}
+function record(value, field) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        inputError(`${field} must be an object.`);
+    }
+    return value;
+}
+function string(value, field) {
+    if (typeof value !== "string") {
+        inputError(`${field} must be a string.`);
+    }
+    return value;
+}
+function path(value, field) {
+    const result = string(value, field);
+    assertRepositoryRelativePath(result, "repository-agent-workflow-config");
+    return result;
+}
+function paths(value, field) {
+    if (!Array.isArray(value)) {
+        inputError(`${field} must be an array.`);
+    }
+    return Object.freeze(value.map((entry, index) => path(entry, `${field}[${index}]`)));
+}
+function instructions(value) {
+    const input = record(value, "instructions");
+    return Object.freeze({
+        canonical: path(input["canonical"], "instructions.canonical"),
+        claude: path(input["claude"], "instructions.claude"),
+        gemini: path(input["gemini"], "instructions.gemini"),
+        copilot: path(input["copilot"], "instructions.copilot")
+    });
+}
+function scripts(value) {
+    const input = record(value, "scripts");
+    return Object.freeze({
+        changed: string(input["changed"], "scripts.changed"),
+        fast: string(input["fast"], "scripts.fast"),
+        full: string(input["full"], "scripts.full")
+    });
+}
+function changedCheck(value, index) {
+    const field = `changedChecks[${index}]`;
+    const input = record(value, field);
+    const extensionsInput = input["extensions"];
+    if (!Array.isArray(extensionsInput)) {
+        inputError(`${field}.extensions must be an array.`);
+    }
+    return Object.freeze({
+        id: string(input["id"], `${field}.id`),
+        script: string(input["script"], `${field}.script`),
+        extensions: Object.freeze(extensionsInput.map((entry, extensionIndex) => string(entry, `${field}.extensions[${extensionIndex}]`).toLowerCase())),
+        passPaths: input["passPaths"] !== false
+    });
+}
+export async function loadAgentWorkflowPolicy(consumerRoot, configPath, signal) {
+    const input = await loadStrictYamlFile(consumerRoot, configPath, "repository-agent-workflow-config", signal);
+    await assertSchema("repository-agent-workflow/v1", input, "repository-agent-workflow-config");
+    const root = record(input, "repository agent workflow config");
+    const checksInput = root["changedChecks"];
+    if (!Array.isArray(checksInput)) {
+        inputError("changedChecks must be an array.");
+    }
+    const result = Object.freeze({
+        instructions: instructions(root["instructions"]),
+        scripts: scripts(root["scripts"]),
+        changedChecks: Object.freeze(checksInput.map(changedCheck)),
+        fullScanPaths: paths(root["fullScanPaths"], "fullScanPaths")
+    });
+    const instructionPaths = [
+        result.instructions.canonical,
+        result.instructions.claude,
+        result.instructions.gemini,
+        result.instructions.copilot
+    ];
+    if (new Set(instructionPaths).size !== instructionPaths.length) {
+        inputError("Instruction file paths must be unique.");
+    }
+    const scriptNames = result.changedChecks.map(({ script }) => script);
+    const checkIds = result.changedChecks.map(({ id }) => id);
+    if (new Set(scriptNames).size !== scriptNames.length) {
+        inputError("changedChecks scripts must be unique.");
+    }
+    if (new Set(checkIds).size !== checkIds.length) {
+        inputError("changedChecks ids must be unique.");
+    }
+    for (const check of result.changedChecks) {
+        if (new Set(check.extensions).size !== check.extensions.length) {
+            inputError(`changedChecks.${check.id} extensions must be unique ignoring case.`);
+        }
+    }
+    if (scriptNames.includes(result.scripts.changed)) {
+        inputError("The changed workflow script cannot invoke itself.");
+    }
+    if (result.scripts.fast === result.scripts.changed) {
+        inputError("The fast workflow script cannot be the changed workflow script.");
+    }
+    return Object.freeze({
+        ...result,
+        fullScanPaths: Object.freeze([...new Set([
+                ...result.fullScanPaths,
+                ...instructionPaths,
+                "foundation.config.yaml",
+                configPath,
+                "package.json"
+            ])].toSorted((left, right) => left.localeCompare(right)))
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/capabilities/repository-agent-workflow/contract/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-agent-workflow/contract/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAQ3F,MAAM,CAAC,MAAM,aAAa,GAAG,2BAAoC,CAAC;AAClE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC;AAE3D,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,IAAI,oBAAoB,CAAC;QAC7B,IAAI,EAAE,0CAA0C;QAChD,OAAO;QACP,KAAK,EAAE,kCAAkC;QACzC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,UAAU,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,4BAA4B,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;QAC7D,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;QACpD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;QACpD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;QACpD,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,MAAM,KAAK,GAAG,iBAAiB,KAAK,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,eAAe,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;QAClD,UAAU,EAAE,MAAM,CAAC,MAAM,CACvB,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAC5C,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,eAAe,cAAc,GAAG,CAAC,CAAC,WAAW,EAAE,CACtE,CACF;QACD,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,KAAK;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,UAAkB,EAClB,MAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,YAAY,EACZ,UAAU,EACV,kCAAkC,EAClC,MAAM,CACP,CAAC;IACF,MAAM,YAAY,CAChB,8BAA8B,EAC9B,KAAK,EACL,kCAAkC,CACnC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,UAAU,CAAC,iCAAiC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAsB;QAC1C,MAAM,CAAC,YAAY,CAAC,SAAS;QAC7B,MAAM,CAAC,YAAY,CAAC,MAAM;QAC1B,MAAM,CAAC,YAAY,CAAC,MAAM;QAC1B,MAAM,CAAC,YAAY,CAAC,OAAO;KAC5B,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC/D,UAAU,CAAC,wCAAwC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACrD,UAAU,CAAC,uCAAuC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/C,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC/D,UAAU,CAAC,iBAAiB,KAAK,CAAC,EAAE,2CAA2C,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,UAAU,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnD,UAAU,CAAC,iEAAiE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,MAAM;QACT,aAAa,EAAE,MAAM,CAAC,MAAM,CAC1B,CAAC,GAAG,IAAI,GAAG,CAAS;gBAClB,GAAG,MAAM,CAAC,aAAa;gBACvB,GAAG,gBAAgB;gBACnB,wBAAwB;gBACxB,UAAU;gBACV,cAAc;aACf,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CACzD;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-agent-workflow/module.d.ts

@@ -0,0 +1,5 @@
+import { type CapabilityDefinition } from "../../capability-runtime.js";
+import { REPOSITORY_AGENT_WORKFLOW_RULES_BY_ID } from "./application/rules.js";
+export { REPOSITORY_AGENT_WORKFLOW_RULES_BY_ID };
+export declare function createRepositoryAgentWorkflowCapability(): CapabilityDefinition;
+//# sourceMappingURL=module.d.ts.map

package/dist/capabilities/repository-agent-workflow/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/capabilities/repository-agent-workflow/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAQ/E,OAAO,EAAE,qCAAqC,EAAE,CAAC;AAEjD,wBAAgB,uCAAuC,IAAI,oBAAoB,CA+C9E"}

package/dist/capabilities/repository-agent-workflow/module.js

@@ -0,0 +1,49 @@
+import { CapabilityInputError, capabilityReport } from "../../capability-runtime.js";
+import { FilesystemRepositoryAgentWorkflowReader } from "./adapters/outbound/filesystem/filesystem-repository-agent-workflow-reader.js";
+import { REPOSITORY_AGENT_WORKFLOW_RULES_BY_ID } from "./application/rules.js";
+import { analyzeRepositoryAgentWorkflow } from "./application/use-cases/analyze-repository-agent-workflow.js";
+import { CAPABILITY_CONFIG_SCHEMA_VERSION, CAPABILITY_ID, loadAgentWorkflowPolicy } from "./contract/config.js";
+export { REPOSITORY_AGENT_WORKFLOW_RULES_BY_ID };
+export function createRepositoryAgentWorkflowCapability() {
+    const reader = new FilesystemRepositoryAgentWorkflowReader();
+    return Object.freeze({
+        id: CAPABILITY_ID,
+        configSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+        async run(invocation) {
+            try {
+                const policy = await loadAgentWorkflowPolicy(invocation.consumerRoot, invocation.configPath, invocation.signal);
+                return capabilityReport({
+                    capabilityId: CAPABILITY_ID,
+                    capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                    diagnostics: await analyzeRepositoryAgentWorkflow({
+                        consumerRoot: invocation.consumerRoot,
+                        policy,
+                        ...(invocation.signal === undefined ? {} : { signal: invocation.signal })
+                    }, reader)
+                });
+            }
+            catch (error) {
+                if (error instanceof CapabilityInputError) {
+                    return capabilityReport({
+                        capabilityId: CAPABILITY_ID,
+                        capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                        outcome: error.problem.code === "EXECUTION_CANCELLED" ? "cancelled" : "invalid-input",
+                        problem: error.problem
+                    });
+                }
+                return capabilityReport({
+                    capabilityId: CAPABILITY_ID,
+                    capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                    outcome: "failed",
+                    problem: {
+                        code: "CAPABILITY_EXECUTION_FAILED",
+                        message: "Repository agent workflow capability execution failed.",
+                        phase: "repository-agent-workflow-execution",
+                        retryable: false
+                    }
+                });
+            }
+        }
+    });
+}
+//# sourceMappingURL=module.js.map

package/dist/capabilities/repository-agent-workflow/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/capabilities/repository-agent-workflow/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAGjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uCAAuC,EAAE,MAAM,+EAA+E,CAAC;AACxI,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,uBAAuB,EACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qCAAqC,EAAE,CAAC;AAEjD,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,IAAI,uCAAuC,EAAE,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,aAAa;QACjB,mBAAmB,EAAE,gCAAgC;QACrD,KAAK,CAAC,GAAG,CAAC,UAAgC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,CAClB,CAAC;gBACF,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,WAAW,EAAE,MAAM,8BAA8B,CAC/C;wBACE,YAAY,EAAE,UAAU,CAAC,YAAY;wBACrC,MAAM;wBACN,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;qBAC1E,EACD,MAAM,CACP;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,OAAO,gBAAgB,CAAC;wBACtB,YAAY,EAAE,aAAa;wBAC3B,6BAA6B,EAAE,gCAAgC;wBAC/D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe;wBACrF,OAAO,EAAE,KAAK,CAAC,OAAO;qBACvB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE;wBACP,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,wDAAwD;wBACjE,KAAK,EAAE,qCAAqC;wBAC5C,SAAS,EAAE,KAAK;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAEV,0BAA0B,EAC1B,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AA0HzC,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,GACnC,SAAS,oBAAoB,EAAE,CAuLjC"}
+{"version":3,"file":"evaluate-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAEV,0BAA0B,EAC1B,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AAuVzC,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,GACnC,SAAS,oBAAoB,EAAE,CAgCjC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.js

@@ -65,125 +65,169 @@ function unsafePackagePath(entry) {
         segment === ".." ||
         UNSAFE_PACKAGE_SEGMENT.test(segment));
 }
-export function evaluateRepositorySecurity(policy, evidence) {
-    const diagnostics = [];
-    const seenPrivilegedJobs = new Set();
-    let dependencyReviewFound = false;
-    let sbomFound = false;
-    for (const workflow of evidence.workflows) {
-        if (workflow.permissions === undefined ||
-            typeof workflow.permissions === "string" ||
-            Object.values(workflow.permissions).some((value) => value === "write")) {
-            diagnostics.push(diagnostic({
-                rule: REPOSITORY_SECURITY_RULES.permissionsInvalid,
-                subject: workflow.path,
-                path: workflow.path,
-                message: "Workflow root permissions are missing, broad, or write-capable."
-            }));
-        }
-        if (workflow.triggers.includes("pull_request_target")) {
-            diagnostics.push(diagnostic({
-                rule: REPOSITORY_SECURITY_RULES.dangerousTrigger,
-                subject: workflow.path,
-                path: workflow.path,
-                message: "Workflow uses prohibited pull_request_target."
-            }));
-        }
-        for (const job of workflow.jobs) {
-            const permissionSet = jobPermissions(job, workflow.permissions);
-            const privileged = policyForJob(policy, workflow.path, job.id);
-            if (privileged !== undefined) {
-                seenPrivilegedJobs.add(`${workflow.path}:${job.id}`);
-            }
-            const hasWrite = permissionSet === "write-all" ||
-                (typeof permissionSet === "object" &&
-                    Object.values(permissionSet).some((value) => value === "write"));
-            const privilegeMismatch = privileged === undefined
-                ? hasWrite
-                : typeof permissionSet !== "object" ||
-                    !exactPermissions(permissionSet, privileged.permissions);
-            if (privilegeMismatch) {
-                diagnostics.push(diagnostic({
-                    rule: REPOSITORY_SECURITY_RULES.privilegedJobMismatch,
-                    subject: `${workflow.path}:${job.id}`,
-                    path: workflow.path,
-                    message: "Job permissions do not match one exact privileged-job declaration."
-                }));
-            }
-            if (job.uses !== undefined && !actionPinned(job.uses)) {
-                diagnostics.push(diagnostic({
-                    rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
-                    subject: `${workflow.path}:${job.id}`,
-                    path: workflow.path,
-                    message: `Reusable workflow is not pinned to immutable evidence: ${job.uses}.`,
-                    evidence: [{ kind: "action", value: job.uses }]
-                }));
-            }
-            for (const step of job.steps) {
-                if (step.uses !== undefined && !actionPinned(step.uses)) {
-                    diagnostics.push(diagnostic({
-                        rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
-                        subject: `${workflow.path}:${job.id}`,
-                        path: workflow.path,
-                        message: `Action is not pinned to immutable evidence: ${step.uses}.`,
-                        evidence: [{ kind: "action", value: step.uses }]
-                    }));
-                }
-                if (step.run !== undefined && UNTRUSTED_EXPRESSION_IN_RUN.test(step.run)) {
-                    diagnostics.push(diagnostic({
-                        rule: REPOSITORY_SECURITY_RULES.eventInterpolationInRun,
-                        subject: `${workflow.path}:${job.id}`,
-                        path: workflow.path,
-                        message: "Shell script directly interpolates github.event data."
-                    }));
-                }
-                if (workflow.path === policy.dependencyReviewWorkflow &&
-                    workflow.unconditionalTriggers.includes("pull_request") &&
-                    !job.conditional &&
-                    !job.nonBlocking &&
-                    !step.conditional &&
-                    !step.nonBlocking &&
-                    inputIsDisabledOrAbsent(step, "warn-only") &&
-                    step.inputs["config-file"] === undefined &&
-                    step.uses?.startsWith("actions/dependency-review-action@") === true &&
-                    actionPinned(step.uses)) {
-                    dependencyReviewFound = true;
-                }
-                if (workflow.path === policy.sbomWorkflow &&
-                    workflow.unconditionalTriggers.includes("pull_request") &&
-                    !job.conditional &&
-                    !job.nonBlocking &&
-                    !step.conditional &&
-                    !step.nonBlocking &&
-                    inputIsEnabledOrAbsent(step, "upload-artifact") &&
-                    scansRepositoryRoot(step) &&
-                    step.uses?.startsWith("anchore/sbom-action@") === true &&
-                    actionPinned(step.uses)) {
-                    sbomFound = true;
-                }
-            }
-        }
+function isDependencyReviewEvidence(policy, workflow, job, step) {
+    return (workflow.path === policy.dependencyReviewWorkflow &&
+        workflow.unconditionalTriggers.includes("pull_request") &&
+        !job.conditional &&
+        !job.nonBlocking &&
+        !step.conditional &&
+        !step.nonBlocking &&
+        inputIsDisabledOrAbsent(step, "warn-only") &&
+        step.inputs["config-file"] === undefined &&
+        step.uses?.startsWith("actions/dependency-review-action@") === true &&
+        actionPinned(step.uses));
+}
+function isSbomEvidence(policy, workflow, job, step) {
+    return (workflow.path === policy.sbomWorkflow &&
+        workflow.unconditionalTriggers.includes("pull_request") &&
+        !job.conditional &&
+        !job.nonBlocking &&
+        !step.conditional &&
+        !step.nonBlocking &&
+        inputIsEnabledOrAbsent(step, "upload-artifact") &&
+        scansRepositoryRoot(step) &&
+        step.uses?.startsWith("anchore/sbom-action@") === true &&
+        actionPinned(step.uses));
+}
+function inspectWorkflowRoot(workflow, state) {
+    if (workflow.permissions === undefined ||
+        typeof workflow.permissions === "string" ||
+        Object.values(workflow.permissions).some((value) => value === "write")) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.permissionsInvalid,
+            subject: workflow.path,
+            path: workflow.path,
+            message: "Workflow root permissions are missing, broad, or write-capable."
+        }));
     }
-    if (!dependencyReviewFound) {
-        diagnostics.push(diagnostic({
+    if (workflow.triggers.includes("pull_request_target")) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.dangerousTrigger,
+            subject: workflow.path,
+            path: workflow.path,
+            message: "Workflow uses prohibited pull_request_target."
+        }));
+    }
+}
+function inspectWorkflowStep(policy, workflow, job, step, state) {
+    const subject = `${workflow.path}:${job.id}`;
+    if (step.uses !== undefined && !actionPinned(step.uses)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
+            subject,
+            path: workflow.path,
+            message: `Action is not pinned to immutable evidence: ${step.uses}.`,
+            evidence: [{ kind: "action", value: step.uses }]
+        }));
+    }
+    if (step.run !== undefined && UNTRUSTED_EXPRESSION_IN_RUN.test(step.run)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.eventInterpolationInRun,
+            subject,
+            path: workflow.path,
+            message: "Shell script directly interpolates github.event data."
+        }));
+    }
+    if (isDependencyReviewEvidence(policy, workflow, job, step)) {
+        state.dependencyReviewFound = true;
+    }
+    if (isSbomEvidence(policy, workflow, job, step)) {
+        state.sbomFound = true;
+    }
+}
+function inspectWorkflowJob(policy, workflow, job, state) {
+    const subject = `${workflow.path}:${job.id}`;
+    const permissionSet = jobPermissions(job, workflow.permissions);
+    const privileged = policyForJob(policy, workflow.path, job.id);
+    if (privileged !== undefined) {
+        state.seenPrivilegedJobs.add(subject);
+    }
+    const hasWrite = permissionSet === "write-all" ||
+        (typeof permissionSet === "object" &&
+            Object.values(permissionSet).some((value) => value === "write"));
+    const privilegeMismatch = privileged === undefined
+        ? hasWrite
+        : typeof permissionSet !== "object" ||
+            !exactPermissions(permissionSet, privileged.permissions);
+    if (privilegeMismatch) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.privilegedJobMismatch,
+            subject,
+            path: workflow.path,
+            message: "Job permissions do not match one exact privileged-job declaration."
+        }));
+    }
+    if (job.uses !== undefined && !actionPinned(job.uses)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
+            subject,
+            path: workflow.path,
+            message: `Reusable workflow is not pinned to immutable evidence: ${job.uses}.`,
+            evidence: [{ kind: "action", value: job.uses }]
+        }));
+    }
+    for (const step of job.steps) {
+        inspectWorkflowStep(policy, workflow, job, step, state);
+    }
+}
+function inspectRequiredEvidence(policy, state) {
+    if (!state.dependencyReviewFound) {
+        state.diagnostics.push(diagnostic({
             rule: REPOSITORY_SECURITY_RULES.dependencyReviewMissing,
             subject: policy.dependencyReviewWorkflow,
             path: policy.dependencyReviewWorkflow,
             message: "Declared dependency-review workflow does not run the pinned official action."
         }));
     }
-    if (!sbomFound) {
-        diagnostics.push(diagnostic({
+    if (!state.sbomFound) {
+        state.diagnostics.push(diagnostic({
             rule: REPOSITORY_SECURITY_RULES.sbomMissing,
             subject: policy.sbomWorkflow,
             path: policy.sbomWorkflow,
             message: "Declared SBOM workflow does not run the pinned Anchore action."
         }));
     }
+}
+function inspectPackageEvidence(packageEvidence, diagnostics) {
+    if (!packageEvidence.provenance) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.packageProvenanceMissing,
+            subject: packageEvidence.packageName,
+            path: packageEvidence.manifestPath,
+            message: "Publishable package does not enable npm provenance."
+        }));
+    }
+    const unsafeFiles = packageEvidence.files?.filter(unsafePackagePath);
+    if (packageEvidence.files === undefined ||
+        packageEvidence.files.length === 0 ||
+        (unsafeFiles !== undefined && unsafeFiles.length > 0)) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.packageFilesUnsafe,
+            subject: packageEvidence.packageName,
+            path: packageEvidence.manifestPath,
+            message: "Publishable package files allowlist is missing or unsafe.",
+            evidence: (unsafeFiles ?? []).map((value) => ({ kind: "unsafe-path", value }))
+        }));
+    }
+}
+export function evaluateRepositorySecurity(policy, evidence) {
+    const state = {
+        diagnostics: [],
+        seenPrivilegedJobs: new Set(),
+        dependencyReviewFound: false,
+        sbomFound: false
+    };
+    for (const workflow of evidence.workflows) {
+        inspectWorkflowRoot(workflow, state);
+        for (const job of workflow.jobs) {
+            inspectWorkflowJob(policy, workflow, job, state);
+        }
+    }
+    inspectRequiredEvidence(policy, state);
     for (const privileged of policy.privilegedJobs) {
         const key = `${privileged.workflowPath}:${privileged.jobId}`;
-        if (!seenPrivilegedJobs.has(key)) {
-            diagnostics.push(diagnostic({
+        if (!state.seenPrivilegedJobs.has(key)) {
+            state.diagnostics.push(diagnostic({
                 rule: REPOSITORY_SECURITY_RULES.stalePrivilegedJob,
                 subject: key,
                 path: privileged.workflowPath,
@@ -192,27 +236,8 @@ export function evaluateRepositorySecurity(policy, evidence) {
         }
     }
     for (const packageEvidence of evidence.packages) {
-        if (!packageEvidence.provenance) {
-            diagnostics.push(diagnostic({
-                rule: REPOSITORY_SECURITY_RULES.packageProvenanceMissing,
-                subject: packageEvidence.packageName,
-                path: packageEvidence.manifestPath,
-                message: "Publishable package does not enable npm provenance."
-            }));
-        }
-        const unsafeFiles = packageEvidence.files?.filter(unsafePackagePath);
-        if (packageEvidence.files === undefined ||
-            packageEvidence.files.length === 0 ||
-            (unsafeFiles !== undefined && unsafeFiles.length > 0)) {
-            diagnostics.push(diagnostic({
-                rule: REPOSITORY_SECURITY_RULES.packageFilesUnsafe,
-                subject: packageEvidence.packageName,
-                path: packageEvidence.manifestPath,
-                message: "Publishable package files allowlist is missing or unsafe.",
-                evidence: (unsafeFiles ?? []).map((value) => ({ kind: "unsafe-path", value }))
-            }));
-        }
+        inspectPackageEvidence(packageEvidence, state.diagnostics);
     }
-    return diagnostics;
+    return state.diagnostics;
 }
 //# sourceMappingURL=evaluate-repository-security.js.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AAErB,MAAM,eAAe,GAAG,4EAA4E,CAAC;AACrG,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AACxE,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,2BAA2B,GAC/B,0FAA0F,CAAC;AAE7F,SAAS,UAAU,CAAC,KAMnB;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAoD,EACpD,QAAsD;IAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CACxE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC5E,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CACnB,MAAgC,EAChC,YAAoB,EACpB,KAAa;IAEb,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CACrB,GAAwB,EACxB,mBAAmF;IAEnF,OAAO,GAAG,CAAC,WAAW,IAAI,mBAAmB,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,KAAK;QACf,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0C;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CACL,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAAoC;IAEpC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;YAClC,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EACtE,CAAC;YACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,QAAQ,CAAC,IAAI;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,iEAAiE;aAC3E,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACtD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,gBAAgB;gBAChD,OAAO,EAAE,QAAQ,CAAC,IAAI;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,+CAA+C;aACzD,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,kBAAkB,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,QAAQ,GACZ,aAAa,KAAK,WAAW;gBAC7B,CAAC,OAAO,aAAa,KAAK,QAAQ;oBAChC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;YACrE,MAAM,iBAAiB,GACrB,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;oBACjC,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;YAC/D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;oBACT,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;oBACrD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;oBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,oEAAoE;iBAC9E,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;oBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;oBAC/C,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;oBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,0DAA0D,GAAG,CAAC,IAAI,GAAG;oBAC9E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;wBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;wBAC/C,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;wBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,GAAG;wBACpE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;qBACjD,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzE,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;wBACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;wBACvD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;wBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,OAAO,EAAE,uDAAuD;qBACjE,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IACE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,wBAAwB;oBACjD,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACvD,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,IAAI,CAAC,WAAW;oBACjB,CAAC,IAAI,CAAC,WAAW;oBACjB,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC;oBAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;oBACxC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,mCAAmC,CAAC,KAAK,IAAI;oBACnE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,CAAC;oBACD,qBAAqB,GAAG,IAAI,CAAC;gBAC/B,CAAC;gBACD,IACE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY;oBACrC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACvD,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,IAAI,CAAC,WAAW;oBACjB,CAAC,IAAI,CAAC,WAAW;oBACjB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,CAAC;oBAC/C,mBAAmB,CAAC,IAAI,CAAC;oBACzB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,sBAAsB,CAAC,KAAK,IAAI;oBACtD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO,EAAE,MAAM,CAAC,wBAAwB;YACxC,IAAI,EAAE,MAAM,CAAC,wBAAwB;YACrC,OAAO,EAAE,8EAA8E;SACxF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,WAAW;YAC3C,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,UAAU,CAAC,YAAY;gBAC7B,OAAO,EAAE,0DAA0D;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;gBACxD,OAAO,EAAE,eAAe,CAAC,WAAW;gBACpC,IAAI,EAAE,eAAe,CAAC,YAAY;gBAClC,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrE,IACE,eAAe,CAAC,KAAK,KAAK,SAAS;YACnC,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAClC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EACrD,CAAC;YACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,eAAe,CAAC,WAAW;gBACpC,IAAI,EAAE,eAAe,CAAC,YAAY;gBAClC,OAAO,EAAE,2DAA2D;gBACpE,QAAQ,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/E,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"evaluate-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AAErB,MAAM,eAAe,GAAG,4EAA4E,CAAC;AACrG,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AACxE,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,2BAA2B,GAC/B,0FAA0F,CAAC;AAE7F,SAAS,UAAU,CAAC,KAMnB;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAoD,EACpD,QAAsD;IAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CACxE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC5E,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CACnB,MAAgC,EAChC,YAAoB,EACpB,KAAa;IAEb,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CACrB,GAAwB,EACxB,mBAAmF;IAEnF,OAAO,GAAG,CAAC,WAAW,IAAI,mBAAmB,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,KAAK;QACf,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0C;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CACL,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAYD,SAAS,0BAA0B,CACjC,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD;IAEvD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,wBAAwB;QACjD,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,WAAW;QACjB,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QACxC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,mCAAmC,CAAC,KAAK,IAAI;QACnE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD;IAEvD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY;QACrC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,WAAW;QACjB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC/C,mBAAmB,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,sBAAsB,CAAC,KAAK,IAAI;QACtD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA0B,EAC1B,KAAsB;IAEtB,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;QACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EACtE,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,gBAAgB;YAChD,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,+CAA+C;SACzD,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD,EACvD,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;YAC/C,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,GAAG;YACpE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACjD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,uDAAuD;SACjE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,0BAA0B,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACrC,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GACZ,aAAa,KAAK,WAAW;QAC7B,CAAC,OAAO,aAAa,KAAK,QAAQ;YAChC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,UAAU,KAAK,SAAS;QAChD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;YACrD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;YAC/C,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,0DAA0D,GAAG,CAAC,IAAI,GAAG;YAC9E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAgC,EAChC,KAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QACjC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO,EAAE,MAAM,CAAC,wBAAwB;YACxC,IAAI,EAAE,MAAM,CAAC,wBAAwB;YACrC,OAAO,EAAE,8EAA8E;SACxF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,WAAW;YAC3C,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,eAAgC,EAChC,WAAmC;IAEnC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;YACxD,OAAO,EAAE,eAAe,CAAC,WAAW;YACpC,IAAI,EAAE,eAAe,CAAC,YAAY;YAClC,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrE,IACE,eAAe,CAAC,KAAK,KAAK,SAAS;QACnC,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO,EAAE,eAAe,CAAC,WAAW;YACpC,IAAI,EAAE,eAAe,CAAC,YAAY;YAClC,OAAO,EAAE,2DAA2D;YACpE,QAAQ,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;SAC/E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAAoC;IAEpC,MAAM,KAAK,GAAoB;QAC7B,WAAW,EAAE,EAAE;QACf,kBAAkB,EAAE,IAAI,GAAG,EAAU;QACrC,qBAAqB,EAAE,KAAK;QAC5B,SAAS,EAAE,KAAK;KACjB,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,UAAU,CAAC,YAAY;gBAC7B,OAAO,EAAE,0DAA0D;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChD,sBAAsB,CAAC,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC"}

package/dist/capabilities/workspace-dependency-declarations/application/policies/evaluate-workspace-dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-workspace-dependencies.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/workspace-dependency-declarations/application/policies/evaluate-workspace-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,oBAAoB,EACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAuRxC,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,yBAAyB,GAChC,SAAS,oBAAoB,EAAE,CAOjC"}
+{"version":3,"file":"evaluate-workspace-dependencies.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/workspace-dependency-declarations/application/policies/evaluate-workspace-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,oBAAoB,EACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAkSxC,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,yBAAyB,GAChC,SAAS,oBAAoB,EAAE,CAOjC"}

package/dist/capabilities/workspace-dependency-declarations/application/policies/evaluate-workspace-dependencies.js

@@ -1,5 +1,13 @@
 import { isExactVersion } from "../../../../semantic-version.js";
 import { RULES } from "../rules.js";
+const EXACT_NPM_ALIAS_PATTERN = /^npm:(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*@(.+)$/u;
+function isExactCatalogVersion(value) {
+    if (isExactVersion(value)) {
+        return true;
+    }
+    const alias = EXACT_NPM_ALIAS_PATTERN.exec(value);
+    return alias?.[1] !== undefined && isExactVersion(alias[1]);
+}
 function diagnostic(input) {
     return {
         ruleId: input.rule.id,
@@ -42,7 +50,7 @@ function evaluateCatalogs(snapshot) {
         }));
     }
     for (const entry of snapshot.catalogs) {
-        if (!isExactVersion(entry.version)) {
+        if (!isExactCatalogVersion(entry.version)) {
             diagnostics.push(diagnostic({
                 rule: RULES.catalogVersionNotExact,
                 subject: `catalog:${entry.catalogName}:${entry.dependencyName}`,