@agent-teams/engineering-foundation 1.0.1 → 1.1.0

package/dist/capabilities/repository-agent-workflow/contract/config.js

@@ -1,122 +1,3 @@
-import { compareBinaryStrings } from "../../../binary-string-comparator.js";
-import { CapabilityInputError } from "../../../capability-runtime.js";
-import { assertSchema } from "../../../schema-catalog.js";
-import { assertRepositoryRelativePath, loadStrictYamlFile } from "../../../strict-yaml.js";
 export const CAPABILITY_ID = "repository.agent-workflow";
 export const CAPABILITY_CONFIG_SCHEMA_VERSION = 1;
-function inputError(message) {
-    throw new CapabilityInputError({
-        code: "REPOSITORY_AGENT_WORKFLOW_CONFIG_INVALID",
-        message,
-        phase: "repository-agent-workflow-config",
-        retryable: false
-    });
-}
-function record(value, field) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        inputError(`${field} must be an object.`);
-    }
-    return value;
-}
-function string(value, field) {
-    if (typeof value !== "string") {
-        inputError(`${field} must be a string.`);
-    }
-    return value;
-}
-function path(value, field) {
-    const result = string(value, field);
-    assertRepositoryRelativePath(result, "repository-agent-workflow-config");
-    return result;
-}
-function paths(value, field) {
-    if (!Array.isArray(value)) {
-        inputError(`${field} must be an array.`);
-    }
-    return Object.freeze(value.map((entry, index) => path(entry, `${field}[${index}]`)));
-}
-function instructions(value) {
-    const input = record(value, "instructions");
-    return Object.freeze({
-        canonical: path(input["canonical"], "instructions.canonical"),
-        claude: path(input["claude"], "instructions.claude"),
-        gemini: path(input["gemini"], "instructions.gemini"),
-        copilot: path(input["copilot"], "instructions.copilot")
-    });
-}
-function scripts(value) {
-    const input = record(value, "scripts");
-    return Object.freeze({
-        changed: string(input["changed"], "scripts.changed"),
-        fast: string(input["fast"], "scripts.fast"),
-        full: string(input["full"], "scripts.full")
-    });
-}
-function changedCheck(value, index) {
-    const field = `changedChecks[${index}]`;
-    const input = record(value, field);
-    const extensionsInput = input["extensions"];
-    if (!Array.isArray(extensionsInput)) {
-        inputError(`${field}.extensions must be an array.`);
-    }
-    return Object.freeze({
-        id: string(input["id"], `${field}.id`),
-        script: string(input["script"], `${field}.script`),
-        extensions: Object.freeze(extensionsInput.map((entry, extensionIndex) => string(entry, `${field}.extensions[${extensionIndex}]`).toLowerCase())),
-        passPaths: input["passPaths"] !== false
-    });
-}
-export async function loadAgentWorkflowPolicy(consumerRoot, configPath, signal) {
-    const input = await loadStrictYamlFile(consumerRoot, configPath, "repository-agent-workflow-config", signal);
-    await assertSchema("repository-agent-workflow/v1", input, "repository-agent-workflow-config");
-    const root = record(input, "repository agent workflow config");
-    const checksInput = root["changedChecks"];
-    if (!Array.isArray(checksInput)) {
-        inputError("changedChecks must be an array.");
-    }
-    const result = Object.freeze({
-        instructions: instructions(root["instructions"]),
-        scripts: scripts(root["scripts"]),
-        changedChecks: Object.freeze(checksInput.map(changedCheck)),
-        fullScanPaths: paths(root["fullScanPaths"], "fullScanPaths")
-    });
-    const instructionPaths = [
-        result.instructions.canonical,
-        result.instructions.claude,
-        result.instructions.gemini,
-        result.instructions.copilot
-    ];
-    if (new Set(instructionPaths).size !== instructionPaths.length) {
-        inputError("Instruction file paths must be unique.");
-    }
-    const scriptNames = result.changedChecks.map(({ script }) => script);
-    const checkIds = result.changedChecks.map(({ id }) => id);
-    if (new Set(scriptNames).size !== scriptNames.length) {
-        inputError("changedChecks scripts must be unique.");
-    }
-    if (new Set(checkIds).size !== checkIds.length) {
-        inputError("changedChecks ids must be unique.");
-    }
-    for (const check of result.changedChecks) {
-        if (new Set(check.extensions).size !== check.extensions.length) {
-            inputError(`changedChecks.${check.id} extensions must be unique ignoring case.`);
-        }
-    }
-    if (scriptNames.includes(result.scripts.changed)) {
-        inputError("The changed workflow script cannot invoke itself.");
-    }
-    if (result.scripts.fast === result.scripts.changed) {
-        inputError("The fast workflow script cannot be the changed workflow script.");
-    }
-    return Object.freeze({
-        ...result,
-        fullScanPaths: Object.freeze([...new Set([
-                ...result.fullScanPaths,
-                ...instructionPaths,
-                "foundation.config.yaml",
-                configPath,
-                "package.json"
-            ])].toSorted(compareBinaryStrings))
-    });
-}
 //# sourceMappingURL=config.js.map

package/dist/capabilities/repository-agent-workflow/contract/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-agent-workflow/contract/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAQ3F,MAAM,CAAC,MAAM,aAAa,GAAG,2BAAoC,CAAC;AAClE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC;AAE3D,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,IAAI,oBAAoB,CAAC;QAC7B,IAAI,EAAE,0CAA0C;QAChD,OAAO;QACP,KAAK,EAAE,kCAAkC;QACzC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,UAAU,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,4BAA4B,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;QAC7D,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;QACpD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;QACpD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;QACpD,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,MAAM,KAAK,GAAG,iBAAiB,KAAK,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,eAAe,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;QAClD,UAAU,EAAE,MAAM,CAAC,MAAM,CACvB,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAC5C,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,eAAe,cAAc,GAAG,CAAC,CAAC,WAAW,EAAE,CACtE,CACF;QACD,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,KAAK;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,UAAkB,EAClB,MAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,YAAY,EACZ,UAAU,EACV,kCAAkC,EAClC,MAAM,CACP,CAAC;IACF,MAAM,YAAY,CAChB,8BAA8B,EAC9B,KAAK,EACL,kCAAkC,CACnC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,UAAU,CAAC,iCAAiC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAsB;QAC1C,MAAM,CAAC,YAAY,CAAC,SAAS;QAC7B,MAAM,CAAC,YAAY,CAAC,MAAM;QAC1B,MAAM,CAAC,YAAY,CAAC,MAAM;QAC1B,MAAM,CAAC,YAAY,CAAC,OAAO;KAC5B,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC/D,UAAU,CAAC,wCAAwC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACrD,UAAU,CAAC,uCAAuC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/C,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC/D,UAAU,CAAC,iBAAiB,KAAK,CAAC,EAAE,2CAA2C,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,UAAU,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnD,UAAU,CAAC,iEAAiE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,MAAM;QACT,aAAa,EAAE,MAAM,CAAC,MAAM,CAC1B,CAAC,GAAG,IAAI,GAAG,CAAS;gBAClB,GAAG,MAAM,CAAC,aAAa;gBACvB,GAAG,gBAAgB;gBACnB,wBAAwB;gBACxB,UAAU;gBACV,cAAc;aACf,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CACnC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-agent-workflow/contract/config.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,2BAAoC,CAAC;AAClE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC"}

package/dist/capabilities/repository-agent-workflow/module.d.ts

@@ -1,5 +1,8 @@
-import { type CapabilityDefinition } from "../../capability-runtime.js";
+import { type CapabilityDefinition } from "../../features/validation-reporting/api.js";
 import { REPOSITORY_AGENT_WORKFLOW_RULES_BY_ID } from "./application/rules.js";
+import { type AgentWorkflowConfigurationDependencies } from "./adapters/inbound/configuration/load-agent-workflow-policy.js";
 export { REPOSITORY_AGENT_WORKFLOW_RULES_BY_ID };
-export declare function createRepositoryAgentWorkflowCapability(): CapabilityDefinition;
+export declare function createRepositoryAgentWorkflowCapability(input: {
+    readonly assertSchema: AgentWorkflowConfigurationDependencies["assertSchema"];
+}): CapabilityDefinition;
 //# sourceMappingURL=module.d.ts.map

package/dist/capabilities/repository-agent-workflow/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/capabilities/repository-agent-workflow/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAQ/E,OAAO,EAAE,qCAAqC,EAAE,CAAC;AAEjD,wBAAgB,uCAAuC,IAAI,oBAAoB,CAkC9E"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/capabilities/repository-agent-workflow/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAO/E,OAAO,EAA2B,KAAK,sCAAsC,EAAE,MAAM,gEAAgE,CAAC;AAGtJ,OAAO,EAAE,qCAAqC,EAAE,CAAC;AAEjD,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,YAAY,EAAE,sCAAsC,CAAC,cAAc,CAAC,CAAC;CAC/E,GAAG,oBAAoB,CAmCvB"}

package/dist/capabilities/repository-agent-workflow/module.js

@@ -1,17 +1,19 @@
-import { capabilityFailureReport, capabilityReport } from "../../capability-runtime.js";
+import { capabilityFailureReport, capabilityReport } from "../../features/validation-reporting/api.js";
 import { FilesystemRepositoryAgentWorkflowReader } from "./adapters/outbound/filesystem/filesystem-repository-agent-workflow-reader.js";
 import { REPOSITORY_AGENT_WORKFLOW_RULES_BY_ID } from "./application/rules.js";
 import { analyzeRepositoryAgentWorkflow } from "./application/use-cases/analyze-repository-agent-workflow.js";
-import { CAPABILITY_CONFIG_SCHEMA_VERSION, CAPABILITY_ID, loadAgentWorkflowPolicy } from "./contract/config.js";
+import { CAPABILITY_CONFIG_SCHEMA_VERSION, CAPABILITY_ID } from "./contract/config.js";
+import { loadAgentWorkflowPolicy } from "./adapters/inbound/configuration/load-agent-workflow-policy.js";
+import { loadStrictYamlFile } from "../../features/configuration-input/node.js";
 export { REPOSITORY_AGENT_WORKFLOW_RULES_BY_ID };
-export function createRepositoryAgentWorkflowCapability() {
+export function createRepositoryAgentWorkflowCapability(input) {
     const reader = new FilesystemRepositoryAgentWorkflowReader();
     return Object.freeze({
         id: CAPABILITY_ID,
         configSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
         async run(invocation) {
             try {
-                const policy = await loadAgentWorkflowPolicy(invocation.consumerRoot, invocation.configPath, invocation.signal);
+                const policy = await loadAgentWorkflowPolicy({ readYaml: loadStrictYamlFile, assertSchema: input.assertSchema }, invocation.consumerRoot, invocation.configPath, invocation.signal);
                 return capabilityReport({
                     capabilityId: CAPABILITY_ID,
                     capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,

package/dist/capabilities/repository-agent-workflow/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/capabilities/repository-agent-workflow/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAGjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uCAAuC,EAAE,MAAM,+EAA+E,CAAC;AACxI,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,uBAAuB,EACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qCAAqC,EAAE,CAAC;AAEjD,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,IAAI,uCAAuC,EAAE,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,aAAa;QACjB,mBAAmB,EAAE,gCAAgC;QACrD,KAAK,CAAC,GAAG,CAAC,UAAgC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,CAClB,CAAC;gBACF,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,WAAW,EAAE,MAAM,8BAA8B,CAC/C;wBACE,YAAY,EAAE,UAAU,CAAC,YAAY;wBACrC,MAAM;wBACN,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;qBAC1E,EACD,MAAM,CACP;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,uBAAuB,CAAC;oBAC7B,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,KAAK;oBACL,KAAK,EAAE,qCAAqC;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/capabilities/repository-agent-workflow/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAGjB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uCAAuC,EAAE,MAAM,+EAA+E,CAAC;AACxI,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EACL,gCAAgC,EAChC,aAAa,EACd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,uBAAuB,EAA+C,MAAM,gEAAgE,CAAC;AACtJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,EAAE,qCAAqC,EAAE,CAAC;AAEjD,MAAM,UAAU,uCAAuC,CAAC,KAEvD;IACC,MAAM,MAAM,GAAG,IAAI,uCAAuC,EAAE,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,aAAa;QACjB,mBAAmB,EAAE,gCAAgC;QACrD,KAAK,CAAC,GAAG,CAAC,UAAgC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAClE,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,CAClB,CAAC;gBACF,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,WAAW,EAAE,MAAM,8BAA8B,CAC/C;wBACE,YAAY,EAAE,UAAU,CAAC,YAAY;wBACrC,MAAM;wBACN,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;qBAC1E,EACD,MAAM,CACP;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,uBAAuB,CAAC;oBAC7B,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,KAAK;oBACL,KAAK,EAAE,qCAAqC;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-agent-workflow/schemas.d.ts

@@ -0,0 +1,2 @@
+export declare const REPOSITORY_AGENT_WORKFLOW_SCHEMA_IDS: readonly ["repository-agent-workflow/v1"];
+//# sourceMappingURL=schemas.d.ts.map

package/dist/capabilities/repository-agent-workflow/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/capabilities/repository-agent-workflow/schemas.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,oCAAoC,YAC/C,8BAA8B,CACtB,CAAC"}

package/dist/capabilities/repository-agent-workflow/schemas.js

@@ -0,0 +1,5 @@
+// Published schema identities contributed by their semantic owner. Schema bytes stay in schemas/.
+export const REPOSITORY_AGENT_WORKFLOW_SCHEMA_IDS = [
+    "repository-agent-workflow/v1"
+];
+//# sourceMappingURL=schemas.js.map

package/dist/capabilities/repository-agent-workflow/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/capabilities/repository-agent-workflow/schemas.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,8BAA8B;CACtB,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/inbound/configuration/load-capability-config.d.ts

@@ -0,0 +1,7 @@
+import type { RepositorySecurityPolicy } from "../../../application/model/repository-security.js";
+export interface RepositorySecurityConfigurationDependencies {
+    readonly readYaml: (consumerRoot: string, configPath: string, phase: string, signal?: AbortSignal) => Promise<unknown>;
+    readonly assertSchema: (schemaId: "repository-security-baseline/v1", input: unknown, phase: string) => Promise<void>;
+}
+export declare function loadCapabilityConfig(dependencies: RepositorySecurityConfigurationDependencies, consumerRoot: string, configPath: string, signal?: AbortSignal): Promise<RepositorySecurityPolicy>;
+//# sourceMappingURL=load-capability-config.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/inbound/configuration/load-capability-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-capability-config.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/inbound/configuration/load-capability-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAGlG,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvH,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtH;AAED,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,2CAA2C,EACzD,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CASnC"}

package/dist/capabilities/repository-security-baseline/adapters/inbound/configuration/load-capability-config.js

@@ -0,0 +1,7 @@
+import { parseCapabilityConfig } from "./parse-capability-config.js";
+export async function loadCapabilityConfig(dependencies, consumerRoot, configPath, signal) {
+    const input = await dependencies.readYaml(consumerRoot, configPath, "repository-security-config", signal);
+    await dependencies.assertSchema("repository-security-baseline/v1", input, "repository-security-config");
+    return parseCapabilityConfig(input);
+}
+//# sourceMappingURL=load-capability-config.js.map

package/dist/capabilities/repository-security-baseline/adapters/inbound/configuration/load-capability-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-capability-config.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/inbound/configuration/load-capability-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAOrE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAyD,EACzD,YAAoB,EACpB,UAAkB,EAClB,MAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CACvC,YAAY,EACZ,UAAU,EACV,4BAA4B,EAC5B,MAAM,CACP,CAAC;IACF,MAAM,YAAY,CAAC,YAAY,CAAC,iCAAiC,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACxG,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/inbound/configuration/parse-capability-config.d.ts

@@ -0,0 +1,3 @@
+import type { RepositorySecurityPolicy } from "../../../application/model/repository-security.js";
+export declare function parseCapabilityConfig(input: unknown): RepositorySecurityPolicy;
+//# sourceMappingURL=parse-capability-config.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/inbound/configuration/parse-capability-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-capability-config.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/inbound/configuration/parse-capability-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAIV,wBAAwB,EAMzB,MAAM,mDAAmD,CAAC;AAkM3D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAwE9E"}

package/dist/capabilities/repository-security-baseline/adapters/inbound/configuration/parse-capability-config.js

@@ -0,0 +1,220 @@
+import { configuredRepositorySecurityTools, flattenAllowedWorkflowUses, isPinnedContainerImage, isPinnedExternalWorkflowUse } from "../../../application/model/repository-security.js";
+import { configurationInputError as inputError, assertConfigRepositoryRelativePath } from "../../../application/configuration-input.js";
+function record(value, field) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        inputError(`${field} must be an object.`);
+    }
+    return value;
+}
+function string(value, field) {
+    if (typeof value !== "string") {
+        inputError(`${field} must be a string.`);
+    }
+    return value;
+}
+function path(value, field) {
+    const result = string(value, field);
+    assertConfigRepositoryRelativePath(result);
+    return result;
+}
+function rollout(value, field) {
+    if (value !== "advisory" && value !== "blocking") {
+        inputError(`${field} must be advisory or blocking.`);
+    }
+    return value;
+}
+function version(value, field) {
+    const result = string(value, field);
+    if (!/^v?[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(result)) {
+        inputError(`${field} must be an exact semantic version.`);
+    }
+    return result;
+}
+function pinnedExternalUse(value, field) {
+    const result = string(value, field);
+    if (!isPinnedExternalWorkflowUse(result)) {
+        inputError(`${field} must be an immutable external action, reusable workflow, or container digest.`);
+    }
+    return result;
+}
+function mapToolEvidencePolicy(value, tool) {
+    const field = `toolEvidence.${tool}`;
+    const input = record(value, field);
+    return Object.freeze({
+        configPath: path(input["configPath"], `${field}.configPath`),
+        evidencePath: path(input["evidencePath"], `${field}.evidencePath`),
+        invocationUse: pinnedExternalUse(input["invocationUse"], `${field}.invocationUse`),
+        jobId: string(input["jobId"], `${field}.jobId`),
+        resultPath: path(input["resultPath"], `${field}.resultPath`),
+        rollout: rollout(input["rollout"], `${field}.rollout`),
+        version: version(input["version"], `${field}.version`),
+        workflowPath: path(input["workflowPath"], `${field}.workflowPath`)
+    });
+}
+function mapToolEvidencePolicies(value) {
+    const input = record(value, "toolEvidence");
+    const actionlint = mapToolEvidencePolicy(input["actionlint"], "actionlint");
+    const zizmor = mapToolEvidencePolicy(input["zizmor"], "zizmor");
+    const codeql = input["codeql"] === undefined ? undefined : mapToolEvidencePolicy(input["codeql"], "codeql");
+    const policies = [actionlint, zizmor, ...(codeql === undefined ? [] : [codeql])];
+    const artifactPaths = policies.flatMap(({ evidencePath, resultPath }) => [
+        evidencePath,
+        resultPath
+    ]);
+    if (new Set(artifactPaths).size !== artifactPaths.length) {
+        inputError("Each security tool must declare independent evidence and result paths.");
+    }
+    const jobKeys = policies.map(({ jobId, workflowPath }) => `${workflowPath}:${jobId}`);
+    if (new Set(jobKeys).size !== jobKeys.length) {
+        inputError("Each security tool must declare an independent workflow job.");
+    }
+    return Object.freeze({
+        actionlint,
+        zizmor,
+        ...(codeql === undefined ? {} : { codeql })
+    });
+}
+function mapAllowedUse(value, field, depth) {
+    if (depth > 10) {
+        inputError(`${field} exceeds the supported transitive allowlist depth.`);
+    }
+    const input = record(value, field);
+    const use = pinnedExternalUse(input["uses"], `${field}.uses`);
+    const transitiveInput = input["transitiveUses"];
+    if (!Array.isArray(transitiveInput)) {
+        inputError(`${field}.transitiveUses must be an array.`);
+    }
+    return Object.freeze({
+        uses: use,
+        transitiveUses: Object.freeze(transitiveInput.map((entry, index) => mapAllowedUse(entry, `${field}.transitiveUses[${index}]`, depth + 1)))
+    });
+}
+function mapAllowedUses(value) {
+    if (!Array.isArray(value)) {
+        inputError("allowedUses must be an array.");
+    }
+    const entries = value.map((entry, index) => mapAllowedUse(entry, `allowedUses[${index}]`, 1));
+    const flattened = flattenAllowedWorkflowUses(entries).map(({ uses }) => uses);
+    if (new Set(flattened).size !== flattened.length) {
+        inputError("allowedUses and transitiveUses entries must be globally unique.");
+    }
+    return Object.freeze(entries);
+}
+function mapAllowedContainerImages(value) {
+    if (!Array.isArray(value)) {
+        inputError("allowedContainerImages must be an array.");
+    }
+    const images = value.map((entry, index) => {
+        const field = `allowedContainerImages[${index}]`;
+        const image = string(entry, field);
+        if (!isPinnedContainerImage(image)) {
+            inputError(`${field} must be an immutable container image digest.`);
+        }
+        return image;
+    });
+    if (new Set(images).size !== images.length) {
+        inputError("allowedContainerImages entries must be unique.");
+    }
+    return Object.freeze(images);
+}
+function mapDependencyReview(value) {
+    const input = record(value, "dependencyReview");
+    const baseRef = string(input["baseRef"], "dependencyReview.baseRef");
+    const headRef = string(input["headRef"], "dependencyReview.headRef");
+    if (baseRef.trim().length === 0 || headRef.trim().length === 0 || baseRef === headRef) {
+        inputError("dependencyReview baseRef and headRef must be distinct non-empty expressions.");
+    }
+    const failOnSeverity = string(input["failOnSeverity"], "dependencyReview.failOnSeverity");
+    if (failOnSeverity !== "low" && failOnSeverity !== "moderate") {
+        inputError("dependencyReview.failOnSeverity must be low or moderate.");
+    }
+    return Object.freeze({
+        baseRef,
+        failOnSeverity,
+        headRef,
+        jobId: string(input["jobId"], "dependencyReview.jobId"),
+        workflowPath: path(input["workflowPath"], "dependencyReview.workflowPath")
+    });
+}
+function mapPrivilegedJob(value, index) {
+    const field = `privilegedJobs[${index}]`;
+    const input = record(value, field);
+    const permissionInput = record(input["permissions"], `${field}.permissions`);
+    const permissions = {};
+    for (const [name, permission] of Object.entries(permissionInput)) {
+        if (permission !== "none" && permission !== "read" && permission !== "write") {
+            inputError(`${field}.permissions.${name} is invalid.`);
+        }
+        permissions[name] = permission;
+    }
+    if (!Object.values(permissions).includes("write")) {
+        inputError(`${field} must govern at least one write permission.`);
+    }
+    return Object.freeze({
+        workflowPath: path(input["workflowPath"], `${field}.workflowPath`),
+        jobId: string(input["jobId"], `${field}.jobId`),
+        permissions: Object.freeze(permissions)
+    });
+}
+export function parseCapabilityConfig(input) {
+    const root = record(input, "repository security config");
+    const workflowDirectory = path(root["workflowDirectory"], "workflowDirectory");
+    const allowedPullRequestTargetInput = root["allowedPullRequestTargetWorkflows"] ?? [];
+    if (!Array.isArray(allowedPullRequestTargetInput)) {
+        inputError("allowedPullRequestTargetWorkflows must be an array.");
+    }
+    const allowedPullRequestTargetWorkflows = allowedPullRequestTargetInput.map((value, index) => path(value, `allowedPullRequestTargetWorkflows[${index}]`));
+    if (new Set(allowedPullRequestTargetWorkflows).size !==
+        allowedPullRequestTargetWorkflows.length) {
+        inputError("allowedPullRequestTargetWorkflows entries must be unique.");
+    }
+    for (const workflowPath of allowedPullRequestTargetWorkflows) {
+        if (!workflowPath.startsWith(`${workflowDirectory}/`)) {
+            inputError(`Allowed pull_request_target workflow must be inside ${workflowDirectory}: ${workflowPath}.`);
+        }
+    }
+    const dependencyReview = mapDependencyReview(root["dependencyReview"]);
+    const sbomWorkflow = path(root["sbomWorkflow"], "sbomWorkflow");
+    for (const governedWorkflow of [dependencyReview.workflowPath, sbomWorkflow]) {
+        if (!governedWorkflow.startsWith(`${workflowDirectory}/`)) {
+            inputError(`${governedWorkflow} must be inside workflowDirectory.`);
+        }
+    }
+    const privilegedInput = root["privilegedJobs"];
+    const manifestsInput = root["publishablePackageManifests"];
+    if (!Array.isArray(privilegedInput) || !Array.isArray(manifestsInput)) {
+        inputError("privilegedJobs and publishablePackageManifests must be arrays.");
+    }
+    const privilegedJobs = privilegedInput.map(mapPrivilegedJob);
+    const privilegedKeys = privilegedJobs.map(({ workflowPath, jobId }) => `${workflowPath}:${jobId}`);
+    if (new Set(privilegedKeys).size !== privilegedKeys.length) {
+        inputError("Privileged workflow job declarations must be unique.");
+    }
+    for (const privileged of privilegedJobs) {
+        if (!privileged.workflowPath.startsWith(`${workflowDirectory}/`)) {
+            inputError(`Privileged workflow must be inside ${workflowDirectory}: ${privileged.workflowPath}.`);
+        }
+    }
+    const allowedUses = mapAllowedUses(root["allowedUses"]);
+    const allowedContainerImages = mapAllowedContainerImages(root["allowedContainerImages"]);
+    const toolEvidence = root["toolEvidence"] === undefined
+        ? undefined
+        : mapToolEvidencePolicies(root["toolEvidence"]);
+    for (const tool of configuredRepositorySecurityTools(toolEvidence)) {
+        if (!tool.policy.workflowPath.startsWith(`${workflowDirectory}/`)) {
+            inputError(`${tool.policy.workflowPath} must be inside workflowDirectory.`);
+        }
+    }
+    return Object.freeze({
+        allowedContainerImages,
+        allowedPullRequestTargetWorkflows: Object.freeze(allowedPullRequestTargetWorkflows),
+        allowedUses,
+        workflowDirectory,
+        dependencyReview,
+        sbomWorkflow,
+        privilegedJobs: Object.freeze(privilegedJobs),
+        publishablePackageManifests: Object.freeze(manifestsInput.map((value, index) => path(value, `publishablePackageManifests[${index}]`))),
+        ...(toolEvidence === undefined ? {} : { toolEvidence })
+    });
+}
+//# sourceMappingURL=parse-capability-config.js.map

package/dist/capabilities/repository-security-baseline/adapters/inbound/configuration/parse-capability-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-capability-config.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/inbound/configuration/parse-capability-config.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,uBAAuB,IAAI,UAAU,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AAGxI,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,UAAU,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,kCAAkC,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACjD,UAAU,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,IACE,CAAC,sEAAsE,CAAC,IAAI,CAC1E,MAAM,CACP,EACD,CAAC;QACD,UAAU,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,UAAU,CAAC,GAAG,KAAK,gFAAgF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,IAAsB;IAEtB,MAAM,KAAK,GAAG,gBAAgB,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC;QAC5D,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,eAAe,CAAC;QAClE,aAAa,EAAE,iBAAiB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,gBAAgB,CAAC;QAClF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC;QAC5D,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU,CAAC;QACtD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,eAAe,CAAC;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvE,YAAY;QACZ,UAAU;KACX,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACzD,UAAU,CAAC,wEAAwE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,IAAI,KAAK,EAAE,CAAC,CAAC;IACtF,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC7C,UAAU,CAAC,8DAA8D,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,EAAE,KAAa;IACjE,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,UAAU,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,GAAG;QACT,cAAc,EAAE,MAAM,CAAC,MAAM,CAC3B,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACnC,aAAa,CAAC,KAAK,EAAE,GAAG,KAAK,mBAAmB,KAAK,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CACrE,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,eAAe,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACjD,UAAU,CAAC,iEAAiE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,0BAA0B,KAAK,GAAG,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,UAAU,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,UAAU,CAAC,gDAAgD,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACtF,UAAU,CAAC,8EAA8E,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAC3B,KAAK,CAAC,gBAAgB,CAAC,EACvB,iCAAiC,CAClC,CAAC;IACF,IAAI,cAAc,KAAK,KAAK,IAAI,cAAc,KAAK,UAAU,EAAE,CAAC;QAC9D,UAAU,CAAC,0DAA0D,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,cAAc;QACd,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;QACvD,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,+BAA+B,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,kBAAkB,KAAK,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAuC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACjE,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC7E,UAAU,CAAC,GAAG,KAAK,gBAAgB,IAAI,cAAc,CAAC,CAAC;QACzD,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,UAAU,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,eAAe,CAAC;QAClE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,6BAA6B,GACjC,IAAI,CAAC,mCAAmC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAClD,UAAU,CAAC,qDAAqD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,iCAAiC,GAAG,6BAA6B,CAAC,GAAG,CACzE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,qCAAqC,KAAK,GAAG,CAAC,CAC7E,CAAC;IACF,IACE,IAAI,GAAG,CAAC,iCAAiC,CAAC,CAAC,IAAI;QAC/C,iCAAiC,CAAC,MAAM,EACxC,CAAC;QACD,UAAU,CAAC,2DAA2D,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,iCAAiC,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACtD,UAAU,CACR,uDAAuD,iBAAiB,KAAK,YAAY,GAAG,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;IAChE,KAAK,MAAM,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC1D,UAAU,CAAC,GAAG,gBAAgB,oCAAoC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACtE,UAAU,CAAC,gEAAgE,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,IAAI,KAAK,EAAE,CAAC,CAAC;IACnG,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QAC3D,UAAU,CAAC,sDAAsD,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACjE,UAAU,CAAC,sCAAsC,iBAAiB,KAAK,UAAU,CAAC,YAAY,GAAG,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACzF,MAAM,YAAY,GAChB,IAAI,CAAC,cAAc,CAAC,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,iCAAiC,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAClE,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,oCAAoC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,sBAAsB;QACtB,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAC9C,iCAAiC,CAClC;QACD,WAAW;QACX,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,2BAA2B,EAAE,MAAM,CAAC,MAAM,CACxC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,+BAA+B,KAAK,GAAG,CAAC,CAAC,CAC3F;QACD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.d.ts

@@ -1,6 +1,9 @@
+import type { SecurityEvidenceObservation } from "../../../application/ports/security-evidence-observation.js";
 import type { RepositorySecurityEvidence, RepositorySecurityPolicy } from "../../../application/model/repository-security.js";
 import type { RepositorySecurityReader } from "../../../application/ports/repository-security-reader.js";
 export declare class FilesystemRepositorySecurityReader implements RepositorySecurityReader {
+    private readonly observation;
+    constructor(observation: SecurityEvidenceObservation);
     read(consumerRoot: string, policy: RepositorySecurityPolicy, signal?: AbortSignal): Promise<RepositorySecurityEvidence>;
 }
 //# sourceMappingURL=filesystem-repository-security-reader.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-repository-security-reader.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AAqBzG,qBAAa,kCAAmC,YAAW,wBAAwB;IAC3E,IAAI,CACR,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAyBrC;CACF"}
+{"version":3,"file":"filesystem-repository-security-reader.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAC/G,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AAOzG,qBAAa,kCAAmC,YAAW,wBAAwB;IACrE,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,2BAA2B,EAAI;IAEnE,IAAI,CACR,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,CAAC,CA0BrC;CACF"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.js

@@ -1,26 +1,22 @@
-import { assertNotCancelled } from "../../../../../strict-yaml.js";
 import { readPublishablePackageEvidence } from "./publishable-package-evidence-reader.js";
 import { resolveConsumerRoot } from "./repository-security-filesystem.js";
-import { repositorySecurityInputError } from "./repository-security-input.js";
+import { assertSecurityObservationActive, requireConfiguredWorkflows } from "../../../application/policies/repository-security-input.js";
 import { readSecurityToolEvidence } from "./security-tool-evidence-reader.js";
 import { readWorkflowDirectoryEvidence } from "./workflow-evidence-reader.js";
-function requireConfiguredWorkflows(workflows, policy) {
-    for (const requiredWorkflow of [policy.dependencyReview.workflowPath, policy.sbomWorkflow]) {
-        if (!workflows.some(({ path }) => path === requiredWorkflow)) {
-            repositorySecurityInputError("REPOSITORY_SECURITY_REQUIRED_WORKFLOW_UNAVAILABLE", `Required security workflow is not discovered: ${requiredWorkflow}.`);
-        }
-    }
-}
 export class FilesystemRepositorySecurityReader {
+    observation;
+    constructor(observation) {
+        this.observation = observation;
+    }
     async read(consumerRoot, policy, signal) {
-        assertNotCancelled(signal);
+        assertSecurityObservationActive(signal);
         const root = await resolveConsumerRoot(consumerRoot);
         const [workflowDirectory, packages] = await Promise.all([
-            readWorkflowDirectoryEvidence(root, policy, signal),
-            Promise.all(policy.publishablePackageManifests.map((manifestPath) => readPublishablePackageEvidence(root, manifestPath)))
+            readWorkflowDirectoryEvidence(this.observation, root, policy, signal),
+            Promise.all(policy.publishablePackageManifests.map((manifestPath) => readPublishablePackageEvidence(this.observation, root, manifestPath)))
         ]);
         requireConfiguredWorkflows(workflowDirectory.workflows, policy);
-        const toolEvidence = await readSecurityToolEvidence(root, policy, workflowDirectory.workflowDigest);
+        const toolEvidence = await readSecurityToolEvidence(this.observation, root, policy, workflowDirectory.workflowDigest);
         return Object.freeze({
             compositeActions: workflowDirectory.compositeActions,
             workflows: workflowDirectory.workflows,

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-repository-security-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAMnE,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,SAAS,0BAA0B,CACjC,SAAkD,EAClD,MAAgC;IAEhC,KAAK,MAAM,gBAAgB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAC7D,4BAA4B,CAC1B,mDAAmD,EACnD,iDAAiD,gBAAgB,GAAG,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,kCAAkC;IAC7C,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,MAAgC,EAChC,MAAoB;QAEpB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;YACnD,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CACtD,8BAA8B,CAAC,IAAI,EAAE,YAAY,CAAC,CACnD,CACF;SACF,CAAC,CAAC;QACH,0BAA0B,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,MAAM,wBAAwB,CACjD,IAAI,EACJ,MAAM,EACN,iBAAiB,CAAC,cAAc,CACjC,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;YACpD,SAAS,EAAE,iBAAiB,CAAC,SAAS;YACtC,YAAY,EAAE,iBAAiB,CAAC,YAAY;YAC5C,cAAc,EAAE,iBAAiB,CAAC,cAAc;YAChD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"filesystem-repository-security-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AACzI,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,OAAO,kCAAkC;IAChB,WAAW;IAAxC,YAA6B,WAAwC;2BAAxC,WAAW;IAAgC,CAAC;IAEzE,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,MAAgC,EAChC,MAAoB;QAEpB,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,6BAA6B,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;YACrE,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CACtD,8BAA8B,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CACrE,CACF;SACF,CAAC,CAAC;QACH,0BAA0B,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,MAAM,wBAAwB,CACjD,IAAI,CAAC,WAAW,EAChB,IAAI,EACJ,MAAM,EACN,iBAAiB,CAAC,cAAc,CACjC,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;YACpD,SAAS,EAAE,iBAAiB,CAAC,SAAS;YACtC,YAAY,EAAE,iBAAiB,CAAC,YAAY;YAC5C,cAAc,EAAE,iBAAiB,CAAC,cAAc;YAChD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.d.ts

@@ -1,3 +1,4 @@
+import type { SecurityEvidenceObservation } from "../../../application/ports/security-evidence-observation.js";
 import type { PublishablePackageEvidence } from "../../../application/model/repository-security.js";
-export declare function readPublishablePackageEvidence(root: string, manifestPath: string): Promise<PublishablePackageEvidence>;
+export declare function readPublishablePackageEvidence(observation: SecurityEvidenceObservation, root: string, manifestPath: string): Promise<PublishablePackageEvidence>;
 //# sourceMappingURL=publishable-package-evidence-reader.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publishable-package-evidence-reader.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAOpG,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAsCrC"}
+{"version":3,"file":"publishable-package-evidence-reader.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAC/G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAOpG,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,2BAA2B,EACxC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAsCrC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.js

@@ -1,9 +1,9 @@
 import { readRequiredEvidenceFile } from "./repository-security-filesystem.js";
-import { repositorySecurityInputError, requireRecord } from "./repository-security-input.js";
-export async function readPublishablePackageEvidence(root, manifestPath) {
+import { repositorySecurityInputError, requireRecord } from "../../../application/policies/repository-security-input.js";
+export async function readPublishablePackageEvidence(observation, root, manifestPath) {
     let input;
     try {
-        input = JSON.parse((await readRequiredEvidenceFile(root, manifestPath)).toString("utf8"));
+        input = JSON.parse((await readRequiredEvidenceFile(observation, root, manifestPath)).toString("utf8"));
     }
     catch {
         repositorySecurityInputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Package manifest is not valid JSON: ${manifestPath}.`);

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"publishable-package-evidence-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,YAAoB;IAEpB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,wBAAwB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B,CAC1B,qCAAqC,EACrC,uCAAuC,YAAY,GAAG,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzC,4BAA4B,CAC1B,qCAAqC,EACrC,wCAAwC,YAAY,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAC7E,CAAC;QACD,4BAA4B,CAC1B,qCAAqC,EACrC,8CAA8C,YAAY,GAAG,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC;QAC7B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,UAAU,EACR,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,aAAyC,CAAC,YAAY,CAAC,KAAK,IAAI;KACpE,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"publishable-package-evidence-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACd,MAAM,4DAA4D,CAAC;AAEpE,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,WAAwC,EACxC,IAAY,EACZ,YAAoB;IAEpB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,wBAAwB,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACpH,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B,CAC1B,qCAAqC,EACrC,uCAAuC,YAAY,GAAG,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzC,4BAA4B,CAC1B,qCAAqC,EACrC,wCAAwC,YAAY,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAC7E,CAAC;QACD,4BAA4B,CAC1B,qCAAqC,EACrC,8CAA8C,YAAY,GAAG,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC;QAC7B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,UAAU,EACR,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,aAAyC,CAAC,YAAY,CAAC,KAAK,IAAI;KACpE,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.js

@@ -1,5 +1,5 @@
 import { compareBinaryStrings } from "../../../../../binary-string-comparator.js";
-import { repositorySecurityInputError } from "./repository-security-input.js";
+import { repositorySecurityInputError } from "../../../application/policies/repository-security-input.js";
 const MAX_WORKFLOW_DIGEST_BYTES = 32 * 1024 * 1024;
 function encode(value) {
     return new TextEncoder().encode(value);

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository-security-digests.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAA4B;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAChF,4BAA4B,CAC1B,wCAAwC,EACxC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA0E;IAE1E,MAAM,KAAK,GAAiB,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnG,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAClB,MAAM,CAAC,QAAQ,CAAC,EAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EACvC,MAAM,CAAC,QAAQ,CAAC,EAChB,KAAK,CAAC,MAAM,EACZ,MAAM,CAAC,QAAQ,CAAC,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"repository-security-digests.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAC;AAE1G,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAA4B;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAChF,4BAA4B,CAC1B,wCAAwC,EACxC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA0E;IAE1E,MAAM,KAAK,GAAiB,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnG,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAClB,MAAM,CAAC,QAAQ,CAAC,EAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EACvC,MAAM,CAAC,QAAQ,CAAC,EAChB,KAAK,CAAC,MAAM,EACZ,MAAM,CAAC,QAAQ,CAAC,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}