@agent-teams/engineering-foundation 1.0.1 → 1.1.0

package/dist/capabilities/repository-security-baseline/application/policies/security-file-read-failure.js

@@ -0,0 +1,24 @@
+import { ContainedFileReadError } from "../../../../source-inventory/api.js";
+import { repositorySecurityInputError } from "./repository-security-input.js";
+function mapFileReadFailure(error, repositoryPath) {
+    if (error.failure === "escape") {
+        repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_ESCAPE", `Security evidence escapes the repository: ${repositoryPath}.`);
+    }
+    if (error.failure === "symlink") {
+        repositorySecurityInputError("REPOSITORY_SECURITY_SYMLINK_PROHIBITED", `Security evidence cannot traverse a symbolic link: ${repositoryPath}.`);
+    }
+    if (error.failure === "invalid") {
+        repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_INVALID", `Security evidence is not a valid file: ${repositoryPath}.`);
+    }
+    repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_UNAVAILABLE", `Security evidence is unavailable or changed while reading: ${repositoryPath}.`);
+}
+export function rejectSecurityFileReadFailure(error, repositoryPath, optional) {
+    if (error instanceof ContainedFileReadError) {
+        if (optional && error.failure === "missing") {
+            return undefined;
+        }
+        mapFileReadFailure(error, repositoryPath);
+    }
+    throw error;
+}
+//# sourceMappingURL=security-file-read-failure.js.map

package/dist/capabilities/repository-security-baseline/application/policies/security-file-read-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-file-read-failure.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/security-file-read-failure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,SAAS,kBAAkB,CAAC,KAA6B,EAAE,cAAsB;IAC/E,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/B,4BAA4B,CAC1B,qCAAqC,EACrC,6CAA6C,cAAc,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,4BAA4B,CAC1B,wCAAwC,EACxC,sDAAsD,cAAc,GAAG,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,4BAA4B,CAC1B,sCAAsC,EACtC,0CAA0C,cAAc,GAAG,CAC5D,CAAC;IACJ,CAAC;IACD,4BAA4B,CAC1B,0CAA0C,EAC1C,8DAA8D,cAAc,GAAG,CAChF,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,6BAA6B,CAC3C,KAAc,EACd,cAAsB,EACtB,QAAiB;IAEjB,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;QAC5C,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC"}

package/dist/capabilities/repository-security-baseline/application/ports/security-evidence-observation.d.ts

@@ -0,0 +1,10 @@
+export interface SecurityEvidenceObservation {
+    readonly read: (input: {
+        readonly root: string;
+        readonly candidate: string;
+        readonly maxBytes: number;
+    }) => Promise<Uint8Array>;
+    readonly traversesSymbolicLink: (root: string, candidate: string) => Promise<boolean>;
+    readonly parseYaml: (source: string, phase: string) => unknown;
+}
+//# sourceMappingURL=security-evidence-observation.d.ts.map

package/dist/capabilities/repository-security-baseline/application/ports/security-evidence-observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-evidence-observation.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/ports/security-evidence-observation.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,QAAQ,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAChE"}

package/dist/capabilities/repository-security-baseline/application/ports/security-evidence-observation.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=security-evidence-observation.js.map

package/dist/capabilities/repository-security-baseline/application/ports/security-evidence-observation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-evidence-observation.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/ports/security-evidence-observation.ts"],"names":[],"mappings":""}

package/dist/capabilities/repository-security-baseline/application/rules.d.ts

@@ -1,4 +1,4 @@
-import type { DiagnosticSeverity } from "../../../check-contract.js";
+import type { DiagnosticSeverity } from "../../../features/validation-reporting/api.js";
 export interface RepositorySecurityRuleMetadata {
     readonly id: string;
     readonly severity: DiagnosticSeverity;

package/dist/capabilities/repository-security-baseline/application/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/application/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;AAiBD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmIpC,CAAC;AAEH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CACvD,MAAM,EACN,8BAA8B,CAI/B,CAAC"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/application/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AAGxF,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;AAiBD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmIpC,CAAC;AAEH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CACvD,MAAM,EACN,8BAA8B,CAI/B,CAAC"}

package/dist/capabilities/repository-security-baseline/application/rules.js

@@ -1,4 +1,4 @@
-import { createUniqueRegistry } from "../../../unique-registry.js";
+import { createUniqueRegistry } from "../../../features/validation-reporting/api.js";
 function rule(suffix, rationale, remediation) {
     return Object.freeze({
         id: `repository.security-baseline.${suffix}`,

package/dist/capabilities/repository-security-baseline/application/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/application/rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAWnE,SAAS,IAAI,CACX,MAAc,EACd,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,gCAAgC,MAAM,EAAE;QAC5C,QAAQ,EAAE,OAAO;QACjB,SAAS;QACT,WAAW;QACX,aAAa,EAAE,+CAA+C;QAC9D,0BAA0B,EAAE,KAAK;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,IAAI,CACnB,mBAAmB,EACnB,iEAAiE,EACjE,yDAAyD,CAC1D;IACD,oBAAoB,EAAE,IAAI,CACxB,wBAAwB,EACxB,4DAA4D,EAC5D,uGAAuG,CACxG;IACD,4BAA4B,EAAE,IAAI,CAChC,iCAAiC,EACjC,4FAA4F,EAC5F,+EAA+E,CAChF;IACD,uBAAuB,EAAE,IAAI,CAC3B,2BAA2B,EAC3B,4DAA4D,EAC5D,6EAA6E,CAC9E;IACD,wBAAwB,EAAE,IAAI,CAC5B,4BAA4B,EAC5B,wHAAwH,EACxH,sLAAsL,CACvL;IACD,uBAAuB,EAAE,IAAI,CAC3B,2BAA2B,EAC3B,oFAAoF,EACpF,mHAAmH,CACpH;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,oFAAoF,EACpF,0EAA0E,CAC3E;IACD,gBAAgB,EAAE,IAAI,CACpB,mBAAmB,EACnB,8FAA8F,EAC9F,iFAAiF,CAClF;IACD,uBAAuB,EAAE,IAAI,CAC3B,4BAA4B,EAC5B,iFAAiF,EACjF,2FAA2F,CAC5F;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,uFAAuF,EACvF,uGAAuG,CACxG;IACD,wBAAwB,EAAE,IAAI,CAC5B,4BAA4B,EAC5B,sDAAsD,EACtD,2EAA2E,CAC5E;IACD,kBAAkB,EAAE,IAAI,CACtB,qBAAqB,EACrB,uEAAuE,EACvE,4EAA4E,CAC7E;IACD,WAAW,EAAE,IAAI,CACf,cAAc,EACd,oFAAoF,EACpF,mEAAmE,CACpE;IACD,qBAAqB,EAAE,IAAI,CACzB,yBAAyB,EACzB,mEAAmE,EACnE,0FAA0F,CAC3F;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,kEAAkE,EAClE,oEAAoE,CACrE;IACD,8BAA8B,EAAE,IAAI,CAClC,oCAAoC,EACpC,mFAAmF,EACnF,4FAA4F,CAC7F;IACD,eAAe,EAAE,IAAI,CACnB,mBAAmB,EACnB,iEAAiE,EACjE,iFAAiF,CAClF;IACD,0BAA0B,EAAE,IAAI,CAC9B,+BAA+B,EAC/B,iFAAiF,EACjF,sFAAsF,CACvF;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,6DAA6D,EAC7D,yEAAyE,CAC1E;IACD,sBAAsB,EAAE,IAAI,CAC1B,2BAA2B,EAC3B,wEAAwE,EACxE,gFAAgF,CACjF;IACD,6BAA6B,EAAE,IAAI,CACjC,kCAAkC,EAClC,+EAA+E,EAC/E,0FAA0F,CAC3F;IACD,mBAAmB,EAAE,IAAI,CACvB,uBAAuB,EACvB,qDAAqD,EACrD,qFAAqF,CACtF;IACD,gCAAgC,EAAE,IAAI,CACpC,sCAAsC,EACtC,uEAAuE,EACvE,wFAAwF,CACzF;IACD,2BAA2B,EAAE,IAAI,CAC/B,gCAAgC,EAChC,8FAA8F,EAC9F,qGAAqG,CACtG;IACD,iBAAiB,EAAE,IAAI,CACrB,qBAAqB,EACrB,mFAAmF,EACnF,gFAAgF,CACjF;IACD,2BAA2B,EAAE,IAAI,CAC/B,gCAAgC,EAChC,qFAAqF,EACrF,iEAAiE,CAClE;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAGxC,oBAAoB,CACtB,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACpF,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/application/rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAWrF,SAAS,IAAI,CACX,MAAc,EACd,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,gCAAgC,MAAM,EAAE;QAC5C,QAAQ,EAAE,OAAO;QACjB,SAAS;QACT,WAAW;QACX,aAAa,EAAE,+CAA+C;QAC9D,0BAA0B,EAAE,KAAK;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,IAAI,CACnB,mBAAmB,EACnB,iEAAiE,EACjE,yDAAyD,CAC1D;IACD,oBAAoB,EAAE,IAAI,CACxB,wBAAwB,EACxB,4DAA4D,EAC5D,uGAAuG,CACxG;IACD,4BAA4B,EAAE,IAAI,CAChC,iCAAiC,EACjC,4FAA4F,EAC5F,+EAA+E,CAChF;IACD,uBAAuB,EAAE,IAAI,CAC3B,2BAA2B,EAC3B,4DAA4D,EAC5D,6EAA6E,CAC9E;IACD,wBAAwB,EAAE,IAAI,CAC5B,4BAA4B,EAC5B,wHAAwH,EACxH,sLAAsL,CACvL;IACD,uBAAuB,EAAE,IAAI,CAC3B,2BAA2B,EAC3B,oFAAoF,EACpF,mHAAmH,CACpH;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,oFAAoF,EACpF,0EAA0E,CAC3E;IACD,gBAAgB,EAAE,IAAI,CACpB,mBAAmB,EACnB,8FAA8F,EAC9F,iFAAiF,CAClF;IACD,uBAAuB,EAAE,IAAI,CAC3B,4BAA4B,EAC5B,iFAAiF,EACjF,2FAA2F,CAC5F;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,uFAAuF,EACvF,uGAAuG,CACxG;IACD,wBAAwB,EAAE,IAAI,CAC5B,4BAA4B,EAC5B,sDAAsD,EACtD,2EAA2E,CAC5E;IACD,kBAAkB,EAAE,IAAI,CACtB,qBAAqB,EACrB,uEAAuE,EACvE,4EAA4E,CAC7E;IACD,WAAW,EAAE,IAAI,CACf,cAAc,EACd,oFAAoF,EACpF,mEAAmE,CACpE;IACD,qBAAqB,EAAE,IAAI,CACzB,yBAAyB,EACzB,mEAAmE,EACnE,0FAA0F,CAC3F;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,kEAAkE,EAClE,oEAAoE,CACrE;IACD,8BAA8B,EAAE,IAAI,CAClC,oCAAoC,EACpC,mFAAmF,EACnF,4FAA4F,CAC7F;IACD,eAAe,EAAE,IAAI,CACnB,mBAAmB,EACnB,iEAAiE,EACjE,iFAAiF,CAClF;IACD,0BAA0B,EAAE,IAAI,CAC9B,+BAA+B,EAC/B,iFAAiF,EACjF,sFAAsF,CACvF;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,6DAA6D,EAC7D,yEAAyE,CAC1E;IACD,sBAAsB,EAAE,IAAI,CAC1B,2BAA2B,EAC3B,wEAAwE,EACxE,gFAAgF,CACjF;IACD,6BAA6B,EAAE,IAAI,CACjC,kCAAkC,EAClC,+EAA+E,EAC/E,0FAA0F,CAC3F;IACD,mBAAmB,EAAE,IAAI,CACvB,uBAAuB,EACvB,qDAAqD,EACrD,qFAAqF,CACtF;IACD,gCAAgC,EAAE,IAAI,CACpC,sCAAsC,EACtC,uEAAuE,EACvE,wFAAwF,CACzF;IACD,2BAA2B,EAAE,IAAI,CAC/B,gCAAgC,EAChC,8FAA8F,EAC9F,qGAAqG,CACtG;IACD,iBAAiB,EAAE,IAAI,CACrB,qBAAqB,EACrB,mFAAmF,EACnF,gFAAgF,CACjF;IACD,2BAA2B,EAAE,IAAI,CAC/B,gCAAgC,EAChC,qFAAqF,EACrF,iEAAiE,CAClE;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAGxC,oBAAoB,CACtB,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACpF,CAAC"}

package/dist/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.d.ts

@@ -1,4 +1,4 @@
-import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { FoundationDiagnostic } from "../../../../features/validation-reporting/api.js";
 import type { RepositorySecurityPolicy } from "../model/repository-security.js";
 import type { RepositorySecurityReader } from "../ports/repository-security-reader.js";
 export declare function analyzeRepositorySecurity(input: {

package/dist/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGvF,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE;IACL,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,EACD,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAM1C"}
+{"version":3,"file":"analyze-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAE7F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGvF,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE;IACL,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,EACD,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAM1C"}

package/dist/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.js

@@ -1,4 +1,4 @@
-import { assertNotCancelled } from "../../../../strict-yaml.js";
+import { assertNotCancelled } from "../../../../features/validation-reporting/api.js";
 import { evaluateRepositorySecurity } from "../policies/evaluate-repository-security.js";
 export async function analyzeRepositorySecurity(input, reader) {
     assertNotCancelled(input.signal);

package/dist/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAIC,EACD,MAAgC;IAEhC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,0BAA0B,CAC/B,KAAK,CAAC,MAAM,EACZ,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAClE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"analyze-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AAGtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAIC,EACD,MAAgC;IAEhC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,0BAA0B,CAC/B,KAAK,CAAC,MAAM,EACZ,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAClE,CAAC;AACJ,CAAC"}

package/dist/capabilities/repository-security-baseline/contract/config.d.ts

@@ -1,5 +1,3 @@
-import type { RepositorySecurityPolicy } from "../application/model/repository-security.js";
 export declare const CAPABILITY_ID: "repository.security-baseline";
 export declare const CAPABILITY_CONFIG_SCHEMA_VERSION: 1;
-export declare function loadCapabilityConfig(consumerRoot: string, configPath: string, signal?: AbortSignal): Promise<RepositorySecurityPolicy>;
 //# sourceMappingURL=config.d.ts.map

package/dist/capabilities/repository-security-baseline/contract/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/contract/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAIV,wBAAwB,EAMzB,MAAM,6CAA6C,CAAC;AAQrD,eAAO,MAAM,aAAa,EAAG,8BAAuC,CAAC;AACrE,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAkM3D,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CA+EnC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/contract/config.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,EAAG,8BAAuC,CAAC;AACrE,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC"}

package/dist/capabilities/repository-security-baseline/contract/config.js

@@ -1,234 +1,3 @@
-import { CapabilityInputError } from "../../../capability-runtime.js";
-import { assertSchema } from "../../../schema-catalog.js";
-import { assertRepositoryRelativePath, loadStrictYamlFile } from "../../../strict-yaml.js";
-import { configuredRepositorySecurityTools, flattenAllowedWorkflowUses, isPinnedContainerImage, isPinnedExternalWorkflowUse } from "../application/model/repository-security.js";
 export const CAPABILITY_ID = "repository.security-baseline";
 export const CAPABILITY_CONFIG_SCHEMA_VERSION = 1;
-function inputError(message) {
-    throw new CapabilityInputError({
-        code: "REPOSITORY_SECURITY_CONFIG_INVALID",
-        message,
-        phase: "repository-security-config",
-        retryable: false
-    });
-}
-function record(value, field) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        inputError(`${field} must be an object.`);
-    }
-    return value;
-}
-function string(value, field) {
-    if (typeof value !== "string") {
-        inputError(`${field} must be a string.`);
-    }
-    return value;
-}
-function path(value, field) {
-    const result = string(value, field);
-    assertRepositoryRelativePath(result, "repository-security-config");
-    return result;
-}
-function rollout(value, field) {
-    if (value !== "advisory" && value !== "blocking") {
-        inputError(`${field} must be advisory or blocking.`);
-    }
-    return value;
-}
-function version(value, field) {
-    const result = string(value, field);
-    if (!/^v?[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(result)) {
-        inputError(`${field} must be an exact semantic version.`);
-    }
-    return result;
-}
-function pinnedExternalUse(value, field) {
-    const result = string(value, field);
-    if (!isPinnedExternalWorkflowUse(result)) {
-        inputError(`${field} must be an immutable external action, reusable workflow, or container digest.`);
-    }
-    return result;
-}
-function mapToolEvidencePolicy(value, tool) {
-    const field = `toolEvidence.${tool}`;
-    const input = record(value, field);
-    return Object.freeze({
-        configPath: path(input["configPath"], `${field}.configPath`),
-        evidencePath: path(input["evidencePath"], `${field}.evidencePath`),
-        invocationUse: pinnedExternalUse(input["invocationUse"], `${field}.invocationUse`),
-        jobId: string(input["jobId"], `${field}.jobId`),
-        resultPath: path(input["resultPath"], `${field}.resultPath`),
-        rollout: rollout(input["rollout"], `${field}.rollout`),
-        version: version(input["version"], `${field}.version`),
-        workflowPath: path(input["workflowPath"], `${field}.workflowPath`)
-    });
-}
-function mapToolEvidencePolicies(value) {
-    const input = record(value, "toolEvidence");
-    const actionlint = mapToolEvidencePolicy(input["actionlint"], "actionlint");
-    const zizmor = mapToolEvidencePolicy(input["zizmor"], "zizmor");
-    const codeql = input["codeql"] === undefined ? undefined : mapToolEvidencePolicy(input["codeql"], "codeql");
-    const policies = [actionlint, zizmor, ...(codeql === undefined ? [] : [codeql])];
-    const artifactPaths = policies.flatMap(({ evidencePath, resultPath }) => [
-        evidencePath,
-        resultPath
-    ]);
-    if (new Set(artifactPaths).size !== artifactPaths.length) {
-        inputError("Each security tool must declare independent evidence and result paths.");
-    }
-    const jobKeys = policies.map(({ jobId, workflowPath }) => `${workflowPath}:${jobId}`);
-    if (new Set(jobKeys).size !== jobKeys.length) {
-        inputError("Each security tool must declare an independent workflow job.");
-    }
-    return Object.freeze({
-        actionlint,
-        zizmor,
-        ...(codeql === undefined ? {} : { codeql })
-    });
-}
-function mapAllowedUse(value, field, depth) {
-    if (depth > 10) {
-        inputError(`${field} exceeds the supported transitive allowlist depth.`);
-    }
-    const input = record(value, field);
-    const use = pinnedExternalUse(input["uses"], `${field}.uses`);
-    const transitiveInput = input["transitiveUses"];
-    if (!Array.isArray(transitiveInput)) {
-        inputError(`${field}.transitiveUses must be an array.`);
-    }
-    return Object.freeze({
-        uses: use,
-        transitiveUses: Object.freeze(transitiveInput.map((entry, index) => mapAllowedUse(entry, `${field}.transitiveUses[${index}]`, depth + 1)))
-    });
-}
-function mapAllowedUses(value) {
-    if (!Array.isArray(value)) {
-        inputError("allowedUses must be an array.");
-    }
-    const entries = value.map((entry, index) => mapAllowedUse(entry, `allowedUses[${index}]`, 1));
-    const flattened = flattenAllowedWorkflowUses(entries).map(({ uses }) => uses);
-    if (new Set(flattened).size !== flattened.length) {
-        inputError("allowedUses and transitiveUses entries must be globally unique.");
-    }
-    return Object.freeze(entries);
-}
-function mapAllowedContainerImages(value) {
-    if (!Array.isArray(value)) {
-        inputError("allowedContainerImages must be an array.");
-    }
-    const images = value.map((entry, index) => {
-        const field = `allowedContainerImages[${index}]`;
-        const image = string(entry, field);
-        if (!isPinnedContainerImage(image)) {
-            inputError(`${field} must be an immutable container image digest.`);
-        }
-        return image;
-    });
-    if (new Set(images).size !== images.length) {
-        inputError("allowedContainerImages entries must be unique.");
-    }
-    return Object.freeze(images);
-}
-function mapDependencyReview(value) {
-    const input = record(value, "dependencyReview");
-    const baseRef = string(input["baseRef"], "dependencyReview.baseRef");
-    const headRef = string(input["headRef"], "dependencyReview.headRef");
-    if (baseRef.trim().length === 0 || headRef.trim().length === 0 || baseRef === headRef) {
-        inputError("dependencyReview baseRef and headRef must be distinct non-empty expressions.");
-    }
-    const failOnSeverity = string(input["failOnSeverity"], "dependencyReview.failOnSeverity");
-    if (failOnSeverity !== "low" && failOnSeverity !== "moderate") {
-        inputError("dependencyReview.failOnSeverity must be low or moderate.");
-    }
-    return Object.freeze({
-        baseRef,
-        failOnSeverity,
-        headRef,
-        jobId: string(input["jobId"], "dependencyReview.jobId"),
-        workflowPath: path(input["workflowPath"], "dependencyReview.workflowPath")
-    });
-}
-function mapPrivilegedJob(value, index) {
-    const field = `privilegedJobs[${index}]`;
-    const input = record(value, field);
-    const permissionInput = record(input["permissions"], `${field}.permissions`);
-    const permissions = {};
-    for (const [name, permission] of Object.entries(permissionInput)) {
-        if (permission !== "none" && permission !== "read" && permission !== "write") {
-            inputError(`${field}.permissions.${name} is invalid.`);
-        }
-        permissions[name] = permission;
-    }
-    if (!Object.values(permissions).includes("write")) {
-        inputError(`${field} must govern at least one write permission.`);
-    }
-    return Object.freeze({
-        workflowPath: path(input["workflowPath"], `${field}.workflowPath`),
-        jobId: string(input["jobId"], `${field}.jobId`),
-        permissions: Object.freeze(permissions)
-    });
-}
-export async function loadCapabilityConfig(consumerRoot, configPath, signal) {
-    const input = await loadStrictYamlFile(consumerRoot, configPath, "repository-security-config", signal);
-    await assertSchema("repository-security-baseline/v1", input, "repository-security-config");
-    const root = record(input, "repository security config");
-    const workflowDirectory = path(root["workflowDirectory"], "workflowDirectory");
-    const allowedPullRequestTargetInput = root["allowedPullRequestTargetWorkflows"] ?? [];
-    if (!Array.isArray(allowedPullRequestTargetInput)) {
-        inputError("allowedPullRequestTargetWorkflows must be an array.");
-    }
-    const allowedPullRequestTargetWorkflows = allowedPullRequestTargetInput.map((value, index) => path(value, `allowedPullRequestTargetWorkflows[${index}]`));
-    if (new Set(allowedPullRequestTargetWorkflows).size !==
-        allowedPullRequestTargetWorkflows.length) {
-        inputError("allowedPullRequestTargetWorkflows entries must be unique.");
-    }
-    for (const workflowPath of allowedPullRequestTargetWorkflows) {
-        if (!workflowPath.startsWith(`${workflowDirectory}/`)) {
-            inputError(`Allowed pull_request_target workflow must be inside ${workflowDirectory}: ${workflowPath}.`);
-        }
-    }
-    const dependencyReview = mapDependencyReview(root["dependencyReview"]);
-    const sbomWorkflow = path(root["sbomWorkflow"], "sbomWorkflow");
-    for (const governedWorkflow of [dependencyReview.workflowPath, sbomWorkflow]) {
-        if (!governedWorkflow.startsWith(`${workflowDirectory}/`)) {
-            inputError(`${governedWorkflow} must be inside workflowDirectory.`);
-        }
-    }
-    const privilegedInput = root["privilegedJobs"];
-    const manifestsInput = root["publishablePackageManifests"];
-    if (!Array.isArray(privilegedInput) || !Array.isArray(manifestsInput)) {
-        inputError("privilegedJobs and publishablePackageManifests must be arrays.");
-    }
-    const privilegedJobs = privilegedInput.map(mapPrivilegedJob);
-    const privilegedKeys = privilegedJobs.map(({ workflowPath, jobId }) => `${workflowPath}:${jobId}`);
-    if (new Set(privilegedKeys).size !== privilegedKeys.length) {
-        inputError("Privileged workflow job declarations must be unique.");
-    }
-    for (const privileged of privilegedJobs) {
-        if (!privileged.workflowPath.startsWith(`${workflowDirectory}/`)) {
-            inputError(`Privileged workflow must be inside ${workflowDirectory}: ${privileged.workflowPath}.`);
-        }
-    }
-    const allowedUses = mapAllowedUses(root["allowedUses"]);
-    const allowedContainerImages = mapAllowedContainerImages(root["allowedContainerImages"]);
-    const toolEvidence = root["toolEvidence"] === undefined
-        ? undefined
-        : mapToolEvidencePolicies(root["toolEvidence"]);
-    for (const tool of configuredRepositorySecurityTools(toolEvidence)) {
-        if (!tool.policy.workflowPath.startsWith(`${workflowDirectory}/`)) {
-            inputError(`${tool.policy.workflowPath} must be inside workflowDirectory.`);
-        }
-    }
-    return Object.freeze({
-        allowedContainerImages,
-        allowedPullRequestTargetWorkflows: Object.freeze(allowedPullRequestTargetWorkflows),
-        allowedUses,
-        workflowDirectory,
-        dependencyReview,
-        sbomWorkflow,
-        privilegedJobs: Object.freeze(privilegedJobs),
-        publishablePackageManifests: Object.freeze(manifestsInput.map((value, index) => path(value, `publishablePackageManifests[${index}]`))),
-        ...(toolEvidence === undefined ? {} : { toolEvidence })
-    });
-}
 //# sourceMappingURL=config.js.map

package/dist/capabilities/repository-security-baseline/contract/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/contract/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAY3F,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,6CAA6C,CAAC;AAErD,MAAM,CAAC,MAAM,aAAa,GAAG,8BAAuC,CAAC;AACrE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC;AAE3D,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,IAAI,oBAAoB,CAAC;QAC7B,IAAI,EAAE,oCAAoC;QAC1C,OAAO;QACP,KAAK,EAAE,4BAA4B;QACnC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,UAAU,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,4BAA4B,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACjD,UAAU,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,IACE,CAAC,sEAAsE,CAAC,IAAI,CAC1E,MAAM,CACP,EACD,CAAC;QACD,UAAU,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,UAAU,CAAC,GAAG,KAAK,gFAAgF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,IAAsB;IAEtB,MAAM,KAAK,GAAG,gBAAgB,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC;QAC5D,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,eAAe,CAAC;QAClE,aAAa,EAAE,iBAAiB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,gBAAgB,CAAC;QAClF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC;QAC5D,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU,CAAC;QACtD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,eAAe,CAAC;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvE,YAAY;QACZ,UAAU;KACX,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACzD,UAAU,CAAC,wEAAwE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,IAAI,KAAK,EAAE,CAAC,CAAC;IACtF,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC7C,UAAU,CAAC,8DAA8D,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,EAAE,KAAa;IACjE,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,UAAU,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,GAAG;QACT,cAAc,EAAE,MAAM,CAAC,MAAM,CAC3B,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACnC,aAAa,CAAC,KAAK,EAAE,GAAG,KAAK,mBAAmB,KAAK,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CACrE,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,eAAe,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACjD,UAAU,CAAC,iEAAiE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,0BAA0B,KAAK,GAAG,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,UAAU,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,UAAU,CAAC,gDAAgD,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACtF,UAAU,CAAC,8EAA8E,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAC3B,KAAK,CAAC,gBAAgB,CAAC,EACvB,iCAAiC,CAClC,CAAC;IACF,IAAI,cAAc,KAAK,KAAK,IAAI,cAAc,KAAK,UAAU,EAAE,CAAC;QAC9D,UAAU,CAAC,0DAA0D,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,cAAc;QACd,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;QACvD,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,+BAA+B,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,kBAAkB,KAAK,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAuC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACjE,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC7E,UAAU,CAAC,GAAG,KAAK,gBAAgB,IAAI,cAAc,CAAC,CAAC;QACzD,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,UAAU,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,eAAe,CAAC;QAClE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,UAAkB,EAClB,MAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,YAAY,EACZ,UAAU,EACV,4BAA4B,EAC5B,MAAM,CACP,CAAC;IACF,MAAM,YAAY,CAAC,iCAAiC,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,6BAA6B,GACjC,IAAI,CAAC,mCAAmC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAClD,UAAU,CAAC,qDAAqD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,iCAAiC,GAAG,6BAA6B,CAAC,GAAG,CACzE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,qCAAqC,KAAK,GAAG,CAAC,CAC7E,CAAC;IACF,IACE,IAAI,GAAG,CAAC,iCAAiC,CAAC,CAAC,IAAI;QAC/C,iCAAiC,CAAC,MAAM,EACxC,CAAC;QACD,UAAU,CAAC,2DAA2D,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,YAAY,IAAI,iCAAiC,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACtD,UAAU,CACR,uDAAuD,iBAAiB,KAAK,YAAY,GAAG,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;IAChE,KAAK,MAAM,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC1D,UAAU,CAAC,GAAG,gBAAgB,oCAAoC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACtE,UAAU,CAAC,gEAAgE,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,IAAI,KAAK,EAAE,CAAC,CAAC;IACnG,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QAC3D,UAAU,CAAC,sDAAsD,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACjE,UAAU,CAAC,sCAAsC,iBAAiB,KAAK,UAAU,CAAC,YAAY,GAAG,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACzF,MAAM,YAAY,GAChB,IAAI,CAAC,cAAc,CAAC,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,iCAAiC,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAClE,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,oCAAoC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,sBAAsB;QACtB,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAC9C,iCAAiC,CAClC;QACD,WAAW;QACX,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,2BAA2B,EAAE,MAAM,CAAC,MAAM,CACxC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,+BAA+B,KAAK,GAAG,CAAC,CAAC,CAC3F;QACD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/contract/config.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,8BAAuC,CAAC;AACrE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC"}

package/dist/capabilities/repository-security-baseline/module.d.ts

@@ -1,5 +1,8 @@
-import { type CapabilityDefinition } from "../../capability-runtime.js";
+import { type CapabilityDefinition } from "../../features/validation-reporting/api.js";
 import { REPOSITORY_SECURITY_RULES_BY_ID } from "./application/rules.js";
+import { type RepositorySecurityConfigurationDependencies } from "./adapters/inbound/configuration/load-capability-config.js";
 export { REPOSITORY_SECURITY_RULES_BY_ID };
-export declare function createRepositorySecurityBaselineCapability(): CapabilityDefinition;
+export declare function createRepositorySecurityBaselineCapability(input: {
+    readonly assertSchema: RepositorySecurityConfigurationDependencies["assertSchema"];
+}): CapabilityDefinition;
 //# sourceMappingURL=module.d.ts.map

package/dist/capabilities/repository-security-baseline/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/capabilities/repository-security-baseline/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAQzE,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAE3C,wBAAgB,0CAA0C,IAAI,oBAAoB,CAoCjF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/capabilities/repository-security-baseline/module.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAMzE,OAAO,EAAwB,KAAK,2CAA2C,EAAE,MAAM,4DAA4D,CAAC;AAGpJ,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAE3C,wBAAgB,0CAA0C,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,2CAA2C,CAAC,cAAc,CAAC,CAAA;CAAE,GAAG,oBAAoB,CAwC9K"}

package/dist/capabilities/repository-security-baseline/module.js

@@ -1,17 +1,24 @@
-import { capabilityFailureReport, capabilityReport } from "../../capability-runtime.js";
+import { pathTraversesSymbolicLink, readContainedRegularFile } from "../../source-inventory/node.js";
+import { parseStrictYamlSource } from "../../features/configuration-input/yaml.js";
+import { capabilityFailureReport, capabilityReport } from "../../features/validation-reporting/api.js";
 import { FilesystemRepositorySecurityReader } from "./adapters/outbound/filesystem/filesystem-repository-security-reader.js";
 import { REPOSITORY_SECURITY_RULES_BY_ID } from "./application/rules.js";
 import { analyzeRepositorySecurity } from "./application/use-cases/analyze-repository-security.js";
-import { CAPABILITY_CONFIG_SCHEMA_VERSION, CAPABILITY_ID, loadCapabilityConfig } from "./contract/config.js";
+import { CAPABILITY_CONFIG_SCHEMA_VERSION, CAPABILITY_ID } from "./contract/config.js";
+import { loadCapabilityConfig } from "./adapters/inbound/configuration/load-capability-config.js";
+import { loadStrictYamlFile } from "../../features/configuration-input/node.js";
 export { REPOSITORY_SECURITY_RULES_BY_ID };
-export function createRepositorySecurityBaselineCapability() {
-    const reader = new FilesystemRepositorySecurityReader();
+export function createRepositorySecurityBaselineCapability(input) {
+    const reader = new FilesystemRepositorySecurityReader({
+        read: readContainedRegularFile, traversesSymbolicLink: pathTraversesSymbolicLink,
+        parseYaml: parseStrictYamlSource
+    });
     return Object.freeze({
         id: CAPABILITY_ID,
         configSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
         async run(invocation) {
             try {
-                const policy = await loadCapabilityConfig(invocation.consumerRoot, invocation.configPath, invocation.signal);
+                const policy = await loadCapabilityConfig({ readYaml: loadStrictYamlFile, assertSchema: input.assertSchema }, invocation.consumerRoot, invocation.configPath, invocation.signal);
                 const diagnostics = await analyzeRepositorySecurity({
                     consumerRoot: invocation.consumerRoot,
                     policy,

package/dist/capabilities/repository-security-baseline/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/capabilities/repository-security-baseline/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAGjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yEAAyE,CAAC;AAC7H,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAE3C,MAAM,UAAU,0CAA0C;IACxD,MAAM,MAAM,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,aAAa;QACjB,mBAAmB,EAAE,gCAAgC;QACrD,KAAK,CAAC,GAAG,CAAC,UAAgC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,CAClB,CAAC;gBACF,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD;oBACE,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,MAAM;oBACN,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;iBAC1E,EACD,MAAM,CACP,CAAC;gBACF,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,WAAW;oBACX,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;iBAC5F,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,uBAAuB,CAAC;oBAC7B,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,KAAK;oBACL,KAAK,EAAE,+BAA+B;iBACvC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/capabilities/repository-security-baseline/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAGjB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,kCAAkC,EAAE,MAAM,yEAAyE,CAAC;AAC7H,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EACL,gCAAgC,EAChC,aAAa,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAoD,MAAM,4DAA4D,CAAC;AACpJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAE3C,MAAM,UAAU,0CAA0C,CAAC,KAA6F;IACtJ,MAAM,MAAM,GAAG,IAAI,kCAAkC,CAAC;QACpD,IAAI,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,yBAAyB;QAChF,SAAS,EAAE,qBAAqB;KACjC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,aAAa;QACjB,mBAAmB,EAAE,gCAAgC;QACrD,KAAK,CAAC,GAAG,CAAC,UAAgC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAClE,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,CAClB,CAAC;gBACF,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD;oBACE,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,MAAM;oBACN,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;iBAC1E,EACD,MAAM,CACP,CAAC;gBACF,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,WAAW;oBACX,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;iBAC5F,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,uBAAuB,CAAC;oBAC7B,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,KAAK;oBACL,KAAK,EAAE,+BAA+B;iBACvC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-security-baseline/schemas.d.ts

@@ -0,0 +1,2 @@
+export declare const REPOSITORY_SECURITY_BASELINE_SCHEMA_IDS: readonly ["repository-security-baseline/v1"];
+//# sourceMappingURL=schemas.d.ts.map

package/dist/capabilities/repository-security-baseline/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/capabilities/repository-security-baseline/schemas.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,uCAAuC,YAClD,iCAAiC,CACzB,CAAC"}

package/dist/capabilities/repository-security-baseline/schemas.js

@@ -0,0 +1,5 @@
+// Published schema identities contributed by their semantic owner. Schema bytes stay in schemas/.
+export const REPOSITORY_SECURITY_BASELINE_SCHEMA_IDS = [
+    "repository-security-baseline/v1"
+];
+//# sourceMappingURL=schemas.js.map

package/dist/capabilities/repository-security-baseline/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/capabilities/repository-security-baseline/schemas.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,MAAM,CAAC,MAAM,uCAAuC,GAAG;IACrD,iCAAiC;CACzB,CAAC"}

package/dist/capabilities/source-dependencies/adapters/inbound/configuration/load-capability-config.d.ts

@@ -0,0 +1,7 @@
+import type { SourceArchitectureConfigSchemaVersion, SourceArchitecturePolicy } from "../../../application/model/source-workspace.js";
+export interface SourceArchitectureConfigurationDependencies {
+    readonly readYaml: (consumerRoot: string, configPath: string, phase: string) => Promise<unknown>;
+    readonly assertSchema: (schemaId: "architecture-source-dependencies/v1" | "architecture-source-dependencies/v2", input: unknown, phase: string) => Promise<void>;
+}
+export declare function loadCapabilityConfig(dependencies: SourceArchitectureConfigurationDependencies, consumerRoot: string, configPath: string, signal?: AbortSignal, observeSchemaVersion?: (version: SourceArchitectureConfigSchemaVersion) => void): Promise<SourceArchitecturePolicy>;
+//# sourceMappingURL=load-capability-config.d.ts.map

package/dist/capabilities/source-dependencies/adapters/inbound/configuration/load-capability-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-capability-config.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/source-dependencies/adapters/inbound/configuration/load-capability-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qCAAqC,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAItI,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,qCAAqC,GAAG,qCAAqC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClK;AAOD,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,2CAA2C,EACzD,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,qCAAqC,KAAK,IAAI,GAC9E,OAAO,CAAC,wBAAwB,CAAC,CAenC"}

package/dist/capabilities/source-dependencies/adapters/inbound/configuration/load-capability-config.js

@@ -0,0 +1,24 @@
+import { assertConfigurationNotCancelled } from "../../../application/configuration-input.js";
+import { readSourceArchitectureHeader, parseSourceArchitecturePolicy } from "./parse-capability-config.js";
+const SOURCE_ARCHITECTURE_SCHEMA_IDS = Object.freeze({
+    1: "architecture-source-dependencies/v1",
+    2: "architecture-source-dependencies/v2"
+});
+export async function loadCapabilityConfig(dependencies, consumerRoot, configPath, signal, observeSchemaVersion) {
+    let input;
+    try {
+        // This contained read is bounded. Completing it once lets cancellation
+        // reports retain the requested v1/v2 schema version without a second read.
+        input = await dependencies.readYaml(consumerRoot, configPath, "source-architecture-config");
+    }
+    catch (error) {
+        assertConfigurationNotCancelled(signal);
+        throw error;
+    }
+    const header = readSourceArchitectureHeader(input);
+    observeSchemaVersion?.(header.version);
+    assertConfigurationNotCancelled(signal);
+    await dependencies.assertSchema(SOURCE_ARCHITECTURE_SCHEMA_IDS[header.version], input, "source-architecture-config");
+    return parseSourceArchitecturePolicy(header);
+}
+//# sourceMappingURL=load-capability-config.js.map

package/dist/capabilities/source-dependencies/adapters/inbound/configuration/load-capability-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-capability-config.js","sourceRoot":"","sources":["../../../../../../src/capabilities/source-dependencies/adapters/inbound/configuration/load-capability-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAO3G,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IACnD,CAAC,EAAE,qCAAqC;IACxC,CAAC,EAAE,qCAAqC;CAChC,CAAC,CAAC;AAEZ,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAyD,EACzD,YAAoB,EACpB,UAAkB,EAClB,MAAoB,EACpB,oBAA+E;IAE/E,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,uEAAuE;QACvE,2EAA2E;QAC3E,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACnD,oBAAoB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,YAAY,CAAC,YAAY,CAAC,8BAA8B,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACrH,OAAO,6BAA6B,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC"}

package/dist/capabilities/source-dependencies/adapters/inbound/configuration/parse-capability-config.d.ts

@@ -0,0 +1,8 @@
+import type { SourceArchitectureConfigSchemaVersion, SourceArchitecturePolicy } from "../../../application/model/source-workspace.js";
+export interface SourceArchitectureConfigurationHeader {
+    readonly root: Record<string, unknown>;
+    readonly version: SourceArchitectureConfigSchemaVersion;
+}
+export declare function readSourceArchitectureHeader(input: unknown): SourceArchitectureConfigurationHeader;
+export declare function parseSourceArchitecturePolicy(header: SourceArchitectureConfigurationHeader): SourceArchitecturePolicy;
+//# sourceMappingURL=parse-capability-config.d.ts.map

package/dist/capabilities/source-dependencies/adapters/inbound/configuration/parse-capability-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-capability-config.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/source-dependencies/adapters/inbound/configuration/parse-capability-config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,qCAAqC,EACrC,wBAAwB,EACzB,MAAM,gDAAgD,CAAC;AA6XxD,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAC;CACzD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,qCAAqC,CAIlG;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,qCAAqC,GAAG,wBAAwB,CAsCrH"}