@codyswann/lisa 2.278.0 → 2.279.1

package/dist/cli/doctor-readiness-credentials.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Credential over-authority detection for the delivery/authority readiness
+ * dimension — ship blocker B3 (PRD #1739, #1896).
+ *
+ * B3 asks whether the credential that ships carries only the authority it needs.
+ * The question is answered offline from what the workflows *declare*, because a
+ * credential's blast radius is a property of the declaration, not of any
+ * particular run: a token granted `write-all` is over-authorized whether or not
+ * today's run happened to use it.
+ *
+ * Four declarations are treated as material over-authority: inherited secrets
+ * (`secrets: inherit` hands a called workflow everything), `write-all`/`read-all`
+ * blanket permission grants, a job that uses `GITHUB_TOKEN` with no
+ * `permissions` block at all (so it takes the repository default rather than a
+ * stated minimum), and static long-lived AWS keys in a job that could have used
+ * OIDC instead. Each is provable from the declaration alone.
+ *
+ * A fifth signal — one secret NAME appearing under several environments — is
+ * reported as an *observation*, never a blocker: environment secrets are meant
+ * to reuse one name per environment, and repository-scope versus
+ * environment-scope is not decidable from YAML.
+ *
+ * It lives beside the delivery producer rather than inside it for file-size
+ * hygiene — the same split the blocker gate and journey wiring already use.
+ * @module cli/doctor-readiness-credentials
+ */
+import type { ParsedWorkflow } from "./doctor-readiness-workflows.js";
+/** The credential half of a delivery/authority assessment. */
+export interface CredentialFindings {
+    /** Provable over-authority: each line stands blocker B3. */
+    readonly violations: readonly string[];
+    /** Observations that are real but not decidable offline; never blocking. */
+    readonly informational: readonly string[];
+}
+/**
+ * Detect credential over-authority across the repository's workflows.
+ *
+ * Violations are ordered by consequence: blanket grants and inherited secrets
+ * first (they are unbounded), then narrower over-authority. Anything the
+ * workflow files cannot settle lands in `informational`, which carries no
+ * `blocker` key and therefore can never flip a verdict.
+ * @param workflows - Parsed workflows
+ * @returns Violations and informational observations
+ */
+export declare function detectCredentialFindings(workflows: readonly ParsedWorkflow[]): CredentialFindings;
+//# sourceMappingURL=doctor-readiness-credentials.d.ts.map

package/dist/cli/doctor-readiness-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-credentials.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,iCAAiC,CAAC;AA4OzC,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,kBAAkB,CAYpB"}

package/dist/cli/doctor-readiness-credentials.js

@@ -0,0 +1,199 @@
+/** Blanket permission scalars that grant far more than any one job needs. */
+const BLANKET_PERMISSIONS = new Set(["write-all", "read-all"]);
+/** Matches every `secrets.NAME` reference inside a job's declared text. */
+const SECRET_REFERENCE = /secrets\.(\w+)/g;
+/** Static AWS credential inputs that OIDC (`id-token: write`) would replace. */
+const STATIC_AWS_KEYS = ["aws-access-key-id", "aws-secret-access-key"];
+/** Matches a repository-token reference in either of its spellings. */
+const REPOSITORY_TOKEN = /GITHUB_TOKEN|github\.token/;
+/**
+ * Flatten every string a job declares — step commands, actions, `env`, and
+ * `with` — into one searchable blob so a credential reference is found wherever
+ * it is stated.
+ * @param job - The parsed job
+ * @returns Newline-joined declared text
+ */
+function jobText(job) {
+    return job.steps
+        .flatMap(step => [step.run, step.uses, step.inputs])
+        .filter(part => part !== "")
+        .join("\n");
+}
+/**
+ * Whether a permissions block grants OIDC token minting, which is what makes a
+ * keyless cloud login possible.
+ * @param permissions - A job- or workflow-level permissions block
+ * @returns True when `id-token` is granted write
+ */
+function grantsOidc(permissions) {
+    return (typeof permissions === "object" &&
+        permissions !== null &&
+        permissions["id-token"] === "write");
+}
+/**
+ * Report a blanket `write-all`/`read-all` grant at either scope.
+ * @param scope - Human-readable scope label for the evidence line
+ * @param permissions - The permissions block to inspect
+ * @returns Evidence lines (empty when the grant is scoped)
+ */
+function blanketGrantViolations(scope, permissions) {
+    if (typeof permissions === "string" && BLANKET_PERMISSIONS.has(permissions)) {
+        return [
+            `${scope} declares \`permissions: ${permissions}\`, granting every ` +
+                "scope the repository token can carry instead of only what the job needs",
+        ];
+    }
+    return [];
+}
+/**
+ * Report an inherited secret block, which hands a called workflow every secret
+ * the repository holds rather than the ones it needs.
+ * @param where - Evidence location label
+ * @param job - The parsed job
+ * @returns Evidence lines (empty when secrets are mapped explicitly)
+ */
+function inheritedSecretViolations(where, job) {
+    return job.secrets === "inherit"
+        ? [
+            `${where} declares \`secrets: inherit\`, handing the called workflow ` +
+                "every secret in the repository rather than the ones it needs",
+        ]
+        : [];
+}
+/**
+ * Report a job that uses the repository token with no `permissions:` block at
+ * either scope, so it runs at the repository default instead of a stated
+ * minimum.
+ * @param where - Evidence location label
+ * @param workflow - The workflow declaring the job
+ * @param job - The parsed job
+ * @param text - The job's flattened declared text
+ * @returns Evidence lines (empty when permissions are declared)
+ */
+function unscopedTokenViolations(where, workflow, job, text) {
+    const unscoped = REPOSITORY_TOKEN.test(text) &&
+        job.permissions === null &&
+        workflow.permissions === null;
+    return unscoped
+        ? [
+            `${where} uses GITHUB_TOKEN with no \`permissions:\` block at either ` +
+                "scope, so it runs with the repository default rather than a stated minimum",
+        ]
+        : [];
+}
+/**
+ * Report static long-lived cloud keys in a job that could have authenticated
+ * keylessly through OIDC.
+ * @param where - Evidence location label
+ * @param workflow - The workflow declaring the job
+ * @param job - The parsed job
+ * @param text - The job's flattened declared text
+ * @returns Evidence lines (empty when the job is keyless or already OIDC-enabled)
+ */
+function staticKeyViolations(where, workflow, job, text) {
+    const staticKey = STATIC_AWS_KEYS.find(key => text.includes(key));
+    if (staticKey === undefined ||
+        grantsOidc(job.permissions) ||
+        grantsOidc(workflow.permissions)) {
+        return [];
+    }
+    return [
+        `${where} authenticates with the static long-lived credential ` +
+            `\`${staticKey}\` where keyless OIDC (\`id-token: write\`) would do`,
+    ];
+}
+/**
+ * Detect per-job credential over-authority inside one workflow.
+ * @param workflow - The parsed workflow
+ * @param job - The job to inspect
+ * @returns Evidence lines for this job (empty when scoped correctly)
+ */
+function jobCredentialViolations(workflow, job) {
+    const where = `${workflow.file} job \`${job.id}\``;
+    const text = jobText(job);
+    return [
+        ...blanketGrantViolations(where, job.permissions),
+        ...inheritedSecretViolations(where, job),
+        ...unscopedTokenViolations(where, workflow, job, text),
+        ...staticKeyViolations(where, workflow, job, text),
+    ];
+}
+/**
+ * Pair every secret reference with each deployment environment that uses it.
+ * @param workflows - Parsed workflows
+ * @returns One pair per (secret, environment) reference
+ */
+function secretEnvironmentPairs(workflows) {
+    const jobs = workflows.flatMap(workflow => workflow.jobs);
+    return jobs
+        .filter(job => job.environment.length > 0)
+        .flatMap(job => jobSecretEnvironmentPairs(job));
+}
+/**
+ * Pair one job's secret references with the environments that job deploys to.
+ * @param job - A job declaring at least one environment
+ * @returns One pair per (secret, environment) reference in this job
+ */
+function jobSecretEnvironmentPairs(job) {
+    const secrets = [...jobText(job).matchAll(SECRET_REFERENCE)]
+        .map(match => match[1] ?? "")
+        // GITHUB_TOKEN is minted fresh per job per run, so it cannot be "shared"
+        // between environments — reporting it as such is impossible by construction.
+        .filter(secret => secret !== "GITHUB_TOKEN");
+    return secrets.flatMap(secret => job.environment.map(environment => ({ secret, environment })));
+}
+/**
+ * Sort and de-duplicate a list of names for stable evidence text.
+ * @param names - Raw names
+ * @returns Unique names in locale order
+ */
+function uniqueSorted(names) {
+    return [...new Set(names)].sort((a, b) => a.localeCompare(b));
+}
+/**
+ * Note each secret NAME that appears under more than one deployment environment.
+ *
+ * This is informational, never a standing blocker. GitHub environment secrets
+ * are *supposed* to reuse one name across environments — that is the recommended
+ * least-privilege pattern, with a distinct value stored per environment — and
+ * whether a given name resolves to a repository-scoped secret (genuinely shared)
+ * or an environment-scoped one (correctly isolated) is not decidable from the
+ * YAML. Blocking on it would fail correct repositories for doing the right thing.
+ * @param workflows - Parsed workflows
+ * @returns Observation lines (empty when no name is reused)
+ */
+function sharedSecretObservations(workflows) {
+    const pairs = secretEnvironmentPairs(workflows);
+    return uniqueSorted(pairs.map(pair => pair.secret)).flatMap(secret => {
+        const environments = uniqueSorted(pairs.filter(pair => pair.secret === secret).map(pair => pair.environment));
+        return environments.length > 1
+            ? [
+                `secret name \`${secret}\` appears under ${environments.length} ` +
+                    `deployment environments (${environments.join(", ")}). If it is an ` +
+                    "environment-scoped secret this is the recommended pattern; if it " +
+                    "is repository-scoped, one credential spans every environment. " +
+                    "Which one it is cannot be determined from the workflow files.",
+            ]
+            : [];
+    });
+}
+/**
+ * Detect credential over-authority across the repository's workflows.
+ *
+ * Violations are ordered by consequence: blanket grants and inherited secrets
+ * first (they are unbounded), then narrower over-authority. Anything the
+ * workflow files cannot settle lands in `informational`, which carries no
+ * `blocker` key and therefore can never flip a verdict.
+ * @param workflows - Parsed workflows
+ * @returns Violations and informational observations
+ */
+export function detectCredentialFindings(workflows) {
+    return {
+        violations: [
+            ...workflows.flatMap(workflow => blanketGrantViolations(workflow.file, workflow.permissions)),
+            ...workflows.flatMap(workflow => workflow.jobs.flatMap(job => jobCredentialViolations(workflow, job))),
+        ],
+        informational: sharedSecretObservations(workflows),
+    };
+}
+//# sourceMappingURL=doctor-readiness-credentials.js.map

package/dist/cli/doctor-readiness-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-credentials.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-credentials.ts"],"names":[],"mappings":"AAgCA,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,gFAAgF;AAChF,MAAM,eAAe,GAAG,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;AAEvE,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAQtD;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,GAAsB;IACrC,OAAO,GAAG,CAAC,KAAK;SACb,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACnD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC3B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,WAA0B;IAC5C,OAAO,CACL,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,WAAW,CAAC,UAAU,CAAC,KAAK,OAAO,CACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,KAAa,EACb,WAA0B;IAE1B,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,GAAG,KAAK,4BAA4B,WAAW,qBAAqB;gBAClE,yEAAyE;SAC5E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,KAAa,EACb,GAAsB;IAEtB,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAC9B,CAAC,CAAC;YACE,GAAG,KAAK,8DAA8D;gBACpE,8DAA8D;SACjE;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,QAAwB,EACxB,GAAsB,EACtB,IAAY;IAEZ,MAAM,QAAQ,GACZ,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,GAAG,CAAC,WAAW,KAAK,IAAI;QACxB,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC;IAChC,OAAO,QAAQ;QACb,CAAC,CAAC;YACE,GAAG,KAAK,8DAA8D;gBACpE,4EAA4E;SAC/E;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAAa,EACb,QAAwB,EACxB,GAAsB,EACtB,IAAY;IAEZ,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IACE,SAAS,KAAK,SAAS;QACvB,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAChC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,KAAK,uDAAuD;YAC7D,KAAK,SAAS,sDAAsD;KACvE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,QAAwB,EACxB,GAAsB;IAEtB,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO;QACL,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC;QACjD,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC;QACxC,GAAG,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;QACtD,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,SAAoC;IAEpC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,IAAI;SACR,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;SACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAChC,GAAsB;IAEtB,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;SACzD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,yEAAyE;QACzE,6EAA6E;SAC5E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAC9B,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAwB;IAC5C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,wBAAwB,CAC/B,SAAoC;IAEpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACnE,MAAM,YAAY,GAAG,YAAY,CAC/B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAC3E,CAAC;QACF,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC;gBACE,iBAAiB,MAAM,oBAAoB,YAAY,CAAC,MAAM,GAAG;oBAC/D,4BAA4B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;oBACpE,mEAAmE;oBACnE,gEAAgE;oBAChE,+DAA+D;aAClE;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAoC;IAEpC,OAAO;QACL,UAAU,EAAE;YACV,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC9B,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CAC5D;YACD,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC9B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CACrE;SACF;QACD,aAAa,EAAE,wBAAwB,CAAC,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-delivery.d.ts

@@ -0,0 +1,16 @@
+import type { ReadinessDimensionRecord } from "./doctor-readiness-types.js";
+import { type ParsedWorkflow } from "./doctor-readiness-workflows.js";
+/** The delivery/authority readiness dimension id (readiness-rubric, RRR-1). */
+export declare const DELIVERY_AUTHORITY_DIMENSION_ID = "delivery-authority";
+/**
+ * Assess the delivery/authority dimension: B2 (release path bypasses the
+ * validated artifact) and B3 (credentials carry unintended authority). Offline
+ * by construction — it reads only the repository's declared workflows, and
+ * degrades to a stated-reason SKIP wherever those files cannot settle the
+ * question.
+ * @param root - Project root to assess
+ * @param parsedWorkflows - Pre-parsed workflows (default: parse `root`)
+ * @returns The delivery/authority dimension record
+ */
+export declare function assessDeliveryAuthorityDimension(root: string, parsedWorkflows?: readonly ParsedWorkflow[]): Promise<ReadinessDimensionRecord>;
+//# sourceMappingURL=doctor-readiness-delivery.d.ts.map

package/dist/cli/doctor-readiness-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-delivery.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-delivery.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAEzC,+EAA+E;AAC/E,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAgPpE;;;;;;;;;GASG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CAiBnC"}

package/dist/cli/doctor-readiness-delivery.js

@@ -0,0 +1,243 @@
+/**
+ * The delivery/authority readiness producer — ship blockers B2 and B3
+ * (PRD #1739, #1896).
+ *
+ * Dimension 7 of the `readiness-rubric` asks two questions no other dimension
+ * can answer: does the thing that ships equal the thing that was validated
+ * (B2), and does the shipping credential carry only the authority it needs
+ * (B3)? Both are answered offline from the repository's own
+ * `.github/workflows/*.yml` declarations — the release path is a property of
+ * what CI declares, so no network call is needed and none is made.
+ *
+ * Two disciplines are load-bearing rather than stylistic:
+ *
+ * 1. **A finding names a `blocker` id ONLY on an actual violation.** The blocker
+ *    engine stands a blocker up on any finding that names an id and carries
+ *    evidence, regardless of the finding's status — so a clean repository's PASS
+ *    finding must carry no `blocker` key, or a healthy repository reports
+ *    NOT_READY.
+ * 2. **Never manufacture RED from absence.** Reading workflow files offline
+ *    cannot see a calling workflow, an upstream `workflow_run`, or a branch
+ *    protection rule. When the file alone does not prove a bypass, this producer
+ *    renders a stated-reason SKIP — including when the repository publishes
+ *    nothing at all, because "nothing ships here" is not proof that what ships
+ *    was validated.
+ * @module cli/doctor-readiness-delivery
+ */
+import { detectCredentialFindings, } from "./doctor-readiness-credentials.js";
+import { assessReleasePath, PROMOTION_ACTION, } from "./doctor-readiness-release-path.js";
+import { parseRepositoryWorkflows, } from "./doctor-readiness-workflows.js";
+/** The delivery/authority readiness dimension id (readiness-rubric, RRR-1). */
+export const DELIVERY_AUTHORITY_DIMENSION_ID = "delivery-authority";
+/** The ship blocker for a release path that bypasses the validated artifact. */
+const RELEASE_BLOCKER_ID = "B2";
+/** The ship blocker for credentials carrying material unintended authority. */
+const CREDENTIAL_BLOCKER_ID = "B3";
+/**
+ * Assess every publishing job across every workflow.
+ * @param workflows - Parsed workflows
+ * @returns What the release paths established, in aggregate
+ */
+function summarizeReleasePaths(workflows) {
+    const outcomes = workflows.flatMap(workflow => workflow.jobs.flatMap(job => {
+        const outcome = assessReleasePath(workflow, job);
+        return outcome ? [outcome] : [];
+    }));
+    return {
+        violations: outcomes.flatMap(outcome => outcome.kind === "violation" ? [outcome.evidence] : []),
+        unresolved: outcomes.flatMap(outcome => outcome.kind === "unresolved" ? [outcome.reason] : []),
+        cleanCount: outcomes.filter(outcome => outcome.kind === "clean").length,
+        publishJobCount: outcomes.length,
+    };
+}
+/**
+ * Build the B2 finding from its evidence lines.
+ * @param violations - Evidence lines
+ * @returns The rubric-shaped B2 finding
+ */
+function releaseFinding(violations) {
+    return {
+        blocker: RELEASE_BLOCKER_ID,
+        invariant_violated: "what ships to users is the exact artifact the validating pipeline checked",
+        evidence: violations.join(" | "),
+        why_proof_missed: "the existing checks prove things about the source tree, not about the " +
+            "artifact the release path actually hands to users, so a release that " +
+            "skips or rebuilds past them still reports green",
+        root_correction: "make the release job depend on the validating jobs and publish only an " +
+            `artifact downloaded via \`${PROMOTION_ACTION}\`, so the validated bytes ` +
+            "are the only bytes that can ship",
+        machinery_to_remove: [
+            "any rebuild step inside the release job, which exists only because the " +
+                "validated artifact was not carried forward",
+        ],
+    };
+}
+/**
+ * Build the B3 finding from its evidence lines.
+ * @param violations - Evidence lines
+ * @returns The rubric-shaped B3 finding
+ */
+function credentialFinding(violations) {
+    return {
+        blocker: CREDENTIAL_BLOCKER_ID,
+        invariant_violated: "a shipping credential carries only the authority the job it runs needs",
+        evidence: violations.join(" | "),
+        why_proof_missed: "credential scope is declared, never exercised, so no test or review run " +
+            "observes the unused authority a workflow silently carries",
+        root_correction: "declare a minimal job-level `permissions:` block, map secrets explicitly " +
+            "per environment instead of inheriting them, and prefer keyless OIDC over " +
+            "long-lived static keys",
+        machinery_to_remove: [
+            "blanket permission grants and inherited secret blocks made unnecessary " +
+                "by explicit per-job scoping",
+        ],
+    };
+}
+/**
+ * Wrap non-blocking observations as findings. They deliberately carry no
+ * `blocker` key: naming one would stand a blocker up on an observation that was
+ * never decidable offline.
+ * @param notes - Informational lines
+ * @returns Findings, one per note
+ */
+function informationalFindings(notes) {
+    return notes.map(note => ({ observation: note, blocking: false }));
+}
+/**
+ * Build the SKIP record for a repository whose release paths could not be
+ * settled from the workflow files alone.
+ * @param reasons - Stated reasons, one per unsettled release path
+ * @param credentials - The credential half of the assessment
+ * @returns The SKIP dimension record
+ */
+function unresolvedRecord(reasons, credentials) {
+    return {
+        id: DELIVERY_AUTHORITY_DIMENSION_ID,
+        status: "SKIP",
+        findings: [
+            { reason: reasons.join(" | "), skip: true },
+            ...informationalFindings(credentials.informational),
+        ],
+    };
+}
+/**
+ * Build the PASS record. It carries evidence of exactly what was inspected and
+ * names no `blocker` — naming one here would stand the blocker up.
+ * @param summary - What the release paths established
+ * @param workflows - Parsed workflows
+ * @param credentials - The credential half of the assessment
+ * @returns The PASS dimension record
+ */
+function cleanRecord(summary, workflows, credentials) {
+    return {
+        id: DELIVERY_AUTHORITY_DIMENSION_ID,
+        status: "PASS",
+        findings: [
+            {
+                evidence: `Inspected ${summary.publishJobCount} publishing job(s) across ` +
+                    `${workflows.length} workflow file(s): each is preceded by a test ` +
+                    `run or promotes the CI-built artifact via \`${PROMOTION_ACTION}\`. ` +
+                    "No workflow declares blanket permissions, inherited secrets, or " +
+                    "static cloud keys.",
+                checked: [RELEASE_BLOCKER_ID, CREDENTIAL_BLOCKER_ID],
+            },
+            ...informationalFindings(credentials.informational),
+        ],
+    };
+}
+/**
+ * Build the FAIL record from whichever halves found violations, ordered by
+ * consequence: shipping unvalidated bytes outranks over-broad authority, because
+ * it is already user-visible rather than latent.
+ * @param summary - What the release paths established
+ * @param credentials - The credential half of the assessment
+ * @returns The FAIL dimension record
+ */
+function violationRecord(summary, credentials) {
+    return {
+        id: DELIVERY_AUTHORITY_DIMENSION_ID,
+        status: "FAIL",
+        findings: [
+            ...(summary.violations.length > 0
+                ? [releaseFinding(summary.violations)]
+                : []),
+            ...(credentials.violations.length > 0
+                ? [credentialFinding(credentials.violations)]
+                : []),
+            // A standing blocker must not swallow the release paths that could not be
+            // settled offline: dropping those reasons is #1898's defect one layer in.
+            // They carry no `blocker` key, so they add nothing to the verdict.
+            ...informationalFindings(summary.unresolved),
+            ...informationalFindings(credentials.informational),
+        ],
+    };
+}
+/**
+ * Build the SKIP record for a repository that declares no workflows at all.
+ * @returns The SKIP dimension record
+ */
+function noWorkflowsRecord() {
+    return {
+        id: DELIVERY_AUTHORITY_DIMENSION_ID,
+        status: "SKIP",
+        findings: [
+            {
+                reason: "no .github/workflows/*.yml files were found, so this repository " +
+                    "declares no release path or shipping credential to assess; " +
+                    "delivery authority is not established either way",
+                skip: true,
+            },
+        ],
+    };
+}
+/**
+ * Build the SKIP record for a repository whose workflows publish nothing.
+ * @param workflows - Parsed workflows
+ * @param credentials - The credential half of the assessment
+ * @returns The SKIP dimension record
+ */
+function noReleasePathRecord(workflows, credentials) {
+    return {
+        id: DELIVERY_AUTHORITY_DIMENSION_ID,
+        status: "SKIP",
+        findings: [
+            {
+                reason: `None of the ${workflows.length} workflow file(s) declares a ` +
+                    "publishing or deploy step, so whether what ships equals what was " +
+                    "validated is not established either way. Credential scope was " +
+                    "assessed and found nothing over-authorized.",
+                skip: true,
+            },
+            ...informationalFindings(credentials.informational),
+        ],
+    };
+}
+/**
+ * Assess the delivery/authority dimension: B2 (release path bypasses the
+ * validated artifact) and B3 (credentials carry unintended authority). Offline
+ * by construction — it reads only the repository's declared workflows, and
+ * degrades to a stated-reason SKIP wherever those files cannot settle the
+ * question.
+ * @param root - Project root to assess
+ * @param parsedWorkflows - Pre-parsed workflows (default: parse `root`)
+ * @returns The delivery/authority dimension record
+ */
+export async function assessDeliveryAuthorityDimension(root, parsedWorkflows) {
+    const workflows = parsedWorkflows ?? (await parseRepositoryWorkflows(root));
+    if (workflows.length === 0) {
+        return noWorkflowsRecord();
+    }
+    const summary = summarizeReleasePaths(workflows);
+    const credentials = detectCredentialFindings(workflows);
+    if (summary.violations.length > 0 || credentials.violations.length > 0) {
+        return violationRecord(summary, credentials);
+    }
+    if (summary.unresolved.length > 0) {
+        return unresolvedRecord(summary.unresolved, credentials);
+    }
+    if (summary.publishJobCount === 0) {
+        return noReleasePathRecord(workflows, credentials);
+    }
+    return cleanRecord(summary, workflows, credentials);
+}
+//# sourceMappingURL=doctor-readiness-delivery.js.map

package/dist/cli/doctor-readiness-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-delivery.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAEL,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAEL,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAUnC;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,SAAoC;IAEpC,MAAM,QAAQ,GAAkC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC3E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QAC1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACrC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CACvD;QACD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACrC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD;QACD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;QACvE,eAAe,EAAE,QAAQ,CAAC,MAAM;KACjC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,UAA6B;IAE7B,OAAO;QACL,OAAO,EAAE,kBAAkB;QAC3B,kBAAkB,EAChB,2EAA2E;QAC7E,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,gBAAgB,EACd,wEAAwE;YACxE,uEAAuE;YACvE,iDAAiD;QACnD,eAAe,EACb,yEAAyE;YACzE,6BAA6B,gBAAgB,6BAA6B;YAC1E,kCAAkC;QACpC,mBAAmB,EAAE;YACnB,yEAAyE;gBACvE,4CAA4C;SAC/C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,UAA6B;IAE7B,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAChB,wEAAwE;QAC1E,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,gBAAgB,EACd,0EAA0E;YAC1E,2DAA2D;QAC7D,eAAe,EACb,2EAA2E;YAC3E,2EAA2E;YAC3E,wBAAwB;QAC1B,mBAAmB,EAAE;YACnB,yEAAyE;gBACvE,6BAA6B;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,KAAwB;IAExB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,OAA2B,EAC3B,SAAoC,EACpC,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,OAAO,CAAC,eAAe,4BAA4B;oBAChE,GAAG,SAAS,CAAC,MAAM,gDAAgD;oBACnE,+CAA+C,gBAAgB,MAAM;oBACrE,kEAAkE;oBAClE,oBAAoB;gBACtB,OAAO,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;aACrD;YACD,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,OAA2B,EAC3B,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAC/B,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBACnC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,GAAG,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5C,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EACJ,kEAAkE;oBAClE,6DAA6D;oBAC7D,kDAAkD;gBACpD,IAAI,EAAE,IAAI;aACX;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,SAAoC,EACpC,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EACJ,eAAe,SAAS,CAAC,MAAM,+BAA+B;oBAC9D,mEAAmE;oBACnE,gEAAgE;oBAChE,6CAA6C;gBAC/C,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GAAG,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC"}

package/dist/cli/doctor-readiness-journey.d.ts

@@ -26,20 +26,14 @@
  * @module cli/doctor-readiness-journey
  */
 import { type MutationPolicy, resolveMutationPolicy } from "./doctor-readiness-journey-freshness.js";
+import type { ReadinessDimensionRecord } from "./doctor-readiness-types.js";
 import { type RuntimeWorkerSignature } from "./doctor-worker-journey.js";
 export { resolveMutationPolicy, type MutationPolicy };
 /** The execution/proof readiness dimension id (readiness-rubric, RRR-1). */
 export declare const EXECUTION_PROOF_DIMENSION_ID = "execution-proof";
 /** The proportionality readiness dimension id (readiness-rubric, RRR-1). */
 export declare const PROPORTIONALITY_DIMENSION_ID = "proportionality";
-/** Per-dimension status, mirroring the shared doctor readiness statuses. */
-type ReadinessStatus = "PASS" | "WARN" | "FAIL" | "SKIP";
-/** A per-dimension record the readiness collector persists. */
-export interface JourneyDimensionRecord {
-    readonly id: string;
-    readonly status: ReadinessStatus;
-    readonly findings: readonly unknown[];
-}
+export type { ReadinessDimensionRecord };
 /** The outcome of running a representative journey. */
 export type JourneyOutcome = {
     readonly result: "passed";
@@ -97,7 +91,7 @@ export interface ProportionalityOptions {
  * @param options - Injected collaborators and freshness inputs
  * @returns The execution/proof dimension record
  */
-export declare function assessExecutionProofDimension(targetPath: string, options?: ExecutionProofOptions): Promise<JourneyDimensionRecord>;
+export declare function assessExecutionProofDimension(targetPath: string, options?: ExecutionProofOptions): Promise<ReadinessDimensionRecord>;
 /**
  * Assess the proportionality dimension: surface #1742's scaffolding-subtraction
  * candidate count into `machinery_to_remove`. Surfaced, never auto-deleted
@@ -106,5 +100,5 @@ export declare function assessExecutionProofDimension(targetPath: string, option
  * @param options - Injected subtraction count
  * @returns The proportionality dimension record
  */
-export declare function assessProportionalityDimension(targetPath: string, options?: ProportionalityOptions): Promise<JourneyDimensionRecord>;
+export declare function assessProportionalityDimension(targetPath: string, options?: ProportionalityOptions): Promise<ReadinessDimensionRecord>;
 //# sourceMappingURL=doctor-readiness-journey.d.ts.map

package/dist/cli/doctor-readiness-journey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-journey.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-journey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAEL,KAAK,cAAc,EACnB,qBAAqB,EAEtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAEL,KAAK,sBAAsB,EAE5B,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EAAE,qBAAqB,EAAE,KAAK,cAAc,EAAE,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAU9D,4EAA4E;AAC5E,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzD,+DAA+D;AAC/D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC;AAED,uDAAuD;AACvD,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAED,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;CAC5C;AAED,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,oBAAoB,KAC1B,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,yDAAyD;AACzD,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IACzC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAED,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAsBjC;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,sBAAsB,CAAC,CAuBjC"}
+{"version":3,"file":"doctor-readiness-journey.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-journey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAEL,KAAK,cAAc,EACnB,qBAAqB,EAEtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAEL,KAAK,sBAAsB,EAE5B,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EAAE,qBAAqB,EAAE,KAAK,cAAc,EAAE,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAa9D,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,uDAAuD;AACvD,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAED,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;CAC5C;AAED,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,oBAAoB,KAC1B,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,yDAAyD;AACzD,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IACzC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAED,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAsBnC;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,wBAAwB,CAAC,CAyCnC"}

package/dist/cli/doctor-readiness-journey.js

@@ -72,13 +72,29 @@ export async function assessProportionalityDimension(targetPath, options = {}) {
     const count = options.subtractionCount ??
         (await resolveWorkerJourneyEvidence(targetPath)).subtractionCount;
     if (count <= 0) {
-        return { id: PROPORTIONALITY_DIMENSION_ID, status: "SKIP", findings: [] };
+        // A SKIP is never blank (#1898): it states why the dimension was not
+        // assessed, so silence is reported as silence rather than as health.
+        return {
+            id: PROPORTIONALITY_DIMENSION_ID,
+            status: "SKIP",
+            findings: [
+                {
+                    reason: "the worker-epoch runner (#1742) surfaced no scaffolding-subtraction " +
+                        "candidates, so there is nothing to weigh against the job; " +
+                        "proportionality is reported as unassessed rather than as proven",
+                    skip: true,
+                },
+            ],
+        };
     }
     return {
         id: PROPORTIONALITY_DIMENSION_ID,
         status: "SKIP",
         findings: [
             {
+                reason: "proportionality is surfaced, never scored: subtraction candidates " +
+                    "are reported for operator review and no readiness judgement is made",
+                skip: true,
                 machinery_to_remove: [
                     `${count} worker-specific scaffolding-subtraction candidate` +
                         `${count === 1 ? "" : "s"} surfaced by the worker-epoch runner (#1742)`,

package/dist/cli/doctor-readiness-journey.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-journey.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-journey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAE5B,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,4BAA4B,GAG7B,MAAM,4BAA4B,CAAC;AAEpC,+EAA+E;AAC/E,gFAAgF;AAChF,qBAAqB;AACrB,OAAO,EAAE,qBAAqB,EAAuB,CAAC;AAEtD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAE9D;;;GAGG;AACH,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AACtD,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAyEpC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,UAAkB,EAClB,UAAiC,EAAE;IAEnC,MAAM,MAAM,GACV,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,aAAa,CAClB,oBAAoB,MAAM,6CAA6C;YACrE,+EAA+E,EACjF,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAChE,IACE,MAAM,4BAA4B,CAChC,QAAQ,EACR,UAAU,EACV,OAAO,CAAC,YAAY,CACrB,EACD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GACT,OAAO,CAAC,gBAAgB;QACxB,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACpE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,4BAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,mBAAmB,EAAE;oBACnB,GAAG,KAAK,oDAAoD;wBAC1D,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,8CAA8C;iBAC1E;gBACD,QAAQ,EACN,gDAAgD,KAAK,iBAAiB;oBACtE,iDAAiD;gBACnD,YAAY,EAAE,KAAK;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,QAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,sBAAsB;gBAC/B,QAAQ,EACN,2CAA2C,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI;oBACtE,GAAG,QAAQ,CAAC,QAAQ,kDAAkD;oBACtE,mBAAmB;gBACrB,cAAc,EAAE,gBAAgB,EAAE;gBAClC,iBAAiB,EAAE,0BAA0B;gBAC7C,MAAM,EAAE,IAAI;aACb;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB,CACrC,UAAkB,EAClB,QAA+B,EAC/B,OAA8B;IAE9B,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,aAAa,CAClB,0EAA0E;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,gCAAgC,EAClC,EAAE,eAAe,EAAE,iBAAiB,EAAE,CACvC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QACvC,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc,EAAE,MAAM;KACvB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,QAA+B,EAC/B,eAAuB;IAEvB,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,sBAAsB;gBAC/B,QAAQ,EACN,6DAA6D;oBAC7D,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,eAAe,GAAG;gBACnD,cAAc,EAAE,gBAAgB,EAAE;gBAClC,iBAAiB,EAAE,0BAA0B;gBAC7C,MAAM,EAAE,KAAK;aACd;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,QAA+B,EAC/B,OAAsD,EACtD,OAA8B;IAE9B,MAAM,MAAM,GACV,OAAO,CAAC,aAAa,IAAI,yCAAyC,CAAC;IACrE,MAAM,OAAO,GAAG,qCAAqC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC1F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;QACjC,OAAO;QACP,MAAM,EAAE,GAAG,OAAO,uBAAuB,OAAO,CAAC,QAAQ,GAAG;QAC5D,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,8BAA8B,SAAS,GAAG;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,sBAAsB;gBAC/B,kBAAkB,EAChB,2EAA2E;gBAC7E,QAAQ,EAAE,GAAG,OAAO,uBAAuB,OAAO,CAAC,QAAQ,IAAI,YAAY,EAAE;gBAC7E,gBAAgB,EACd,qEAAqE;gBACvE,cAAc,EAAE;oBACd,QAAQ,EAAE,oBAAoB;oBAC9B,QAAQ,EAAE,oBAAoB;oBAC9B,uBAAuB,EAAE,CAAC,wBAAwB,CAAC;oBACnD,eAAe,EAAE,CAAC,oBAAoB,CAAC;iBACxC;gBACD,UAAU,EAAE,SAAS;aACtB;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB;IACvB,OAAO;QACL,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,oBAAoB;QAC9B,uBAAuB,EAAE,CAAC,wBAAwB,CAAC;QACnD,eAAe,EAAE,EAAE;QACnB,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,MAAc,EACd,QAAiC,EAAE;IAEnC,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"doctor-readiness-journey.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-journey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAE5B,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,4BAA4B,GAG7B,MAAM,4BAA4B,CAAC;AAEpC,+EAA+E;AAC/E,gFAAgF;AAChF,qBAAqB;AACrB,OAAO,EAAE,qBAAqB,EAAuB,CAAC;AAEtD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAE9D;;;GAGG;AACH,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AACtD,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAoEpC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,UAAkB,EAClB,UAAiC,EAAE;IAEnC,MAAM,MAAM,GACV,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,aAAa,CAClB,oBAAoB,MAAM,6CAA6C;YACrE,+EAA+E,EACjF,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAChE,IACE,MAAM,4BAA4B,CAChC,QAAQ,EACR,UAAU,EACV,OAAO,CAAC,YAAY,CACrB,EACD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GACT,OAAO,CAAC,gBAAgB;QACxB,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACpE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,qEAAqE;QACrE,qEAAqE;QACrE,OAAO;YACL,EAAE,EAAE,4BAA4B;YAChC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR;oBACE,MAAM,EACJ,sEAAsE;wBACtE,4DAA4D;wBAC5D,iEAAiE;oBACnE,IAAI,EAAE,IAAI;iBACX;aACF;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EACJ,oEAAoE;oBACpE,qEAAqE;gBACvE,IAAI,EAAE,IAAI;gBACV,mBAAmB,EAAE;oBACnB,GAAG,KAAK,oDAAoD;wBAC1D,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,8CAA8C;iBAC1E;gBACD,QAAQ,EACN,gDAAgD,KAAK,iBAAiB;oBACtE,iDAAiD;gBACnD,YAAY,EAAE,KAAK;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,QAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,sBAAsB;gBAC/B,QAAQ,EACN,2CAA2C,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI;oBACtE,GAAG,QAAQ,CAAC,QAAQ,kDAAkD;oBACtE,mBAAmB;gBACrB,cAAc,EAAE,gBAAgB,EAAE;gBAClC,iBAAiB,EAAE,0BAA0B;gBAC7C,MAAM,EAAE,IAAI;aACb;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB,CACrC,UAAkB,EAClB,QAA+B,EAC/B,OAA8B;IAE9B,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,aAAa,CAClB,0EAA0E;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,gCAAgC,EAClC,EAAE,eAAe,EAAE,iBAAiB,EAAE,CACvC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QACvC,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc,EAAE,MAAM;KACvB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,QAA+B,EAC/B,eAAuB;IAEvB,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,sBAAsB;gBAC/B,QAAQ,EACN,6DAA6D;oBAC7D,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,eAAe,GAAG;gBACnD,cAAc,EAAE,gBAAgB,EAAE;gBAClC,iBAAiB,EAAE,0BAA0B;gBAC7C,MAAM,EAAE,KAAK;aACd;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,QAA+B,EAC/B,OAAsD,EACtD,OAA8B;IAE9B,MAAM,MAAM,GACV,OAAO,CAAC,aAAa,IAAI,yCAAyC,CAAC;IACrE,MAAM,OAAO,GAAG,qCAAqC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC1F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;QACjC,OAAO;QACP,MAAM,EAAE,GAAG,OAAO,uBAAuB,OAAO,CAAC,QAAQ,GAAG;QAC5D,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,8BAA8B,SAAS,GAAG;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,sBAAsB;gBAC/B,kBAAkB,EAChB,2EAA2E;gBAC7E,QAAQ,EAAE,GAAG,OAAO,uBAAuB,OAAO,CAAC,QAAQ,IAAI,YAAY,EAAE;gBAC7E,gBAAgB,EACd,qEAAqE;gBACvE,cAAc,EAAE;oBACd,QAAQ,EAAE,oBAAoB;oBAC9B,QAAQ,EAAE,oBAAoB;oBAC9B,uBAAuB,EAAE,CAAC,wBAAwB,CAAC;oBACnD,eAAe,EAAE,CAAC,oBAAoB,CAAC;iBACxC;gBACD,UAAU,EAAE,SAAS;aACtB;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB;IACvB,OAAO;QACL,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,oBAAoB;QAC9B,uBAAuB,EAAE,CAAC,wBAAwB,CAAC;QACnD,eAAe,EAAE,EAAE;QACnB,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,MAAc,EACd,QAAiC,EAAE;IAEnC,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC"}