@davidahmann/mill 0.1.4 → 0.2.1

package/README.md

@@ -8,12 +8,16 @@ without handing one agent an open-ended ticket, production credentials, and the
 power to judge its own work. Product truth stays in the repository. Codex writes
 inside a disposable worktree. Native tests and scenarios verify the committed
 candidate. A separate read-only pass reviews that exact commit. Only the
-attended shipper can use your GitHub identity, and it stops at a draft PR.
+attended shipper can use your GitHub identity. Draft-only is the default;
+repositories may explicitly enable a separately approved, exact-plan merge.
 
-Mill `0.1.4` is a public-alpha release candidate. The source tree implements the
-candidate and genesis release gates, but no npm availability or supported tuple
-is claimed until the separately authorized release completes and its registry
-and GitHub readback pass.
+Mill `0.1.5` is the first qualified public alpha. It is available from npm and
+as a GitHub prerelease with provenance, an SBOM, exact-artifact qualification,
+and registry and GitHub readback evidence. The source package identity is now
+prepared as `0.2.1`. The `v0.2.0` tag is retained as prepublication evidence:
+publication was held when a missing publish-runner verifier preflight was
+identified. Source changes do not establish release qualification or publication
+for the new version.
 
 ## Why Mill
 
@@ -64,6 +68,8 @@ For its one qualified shape, Mill can:
    support bundle through explicit commands;
 9. audit the exact repository candidate and validate a public-alpha
    qualification record.
+10. derive bounded, source-revision-bound TypeScript repository evidence from a
+    clean Git root without executing its code.
 
 Mill does not autonomously research the web or invent a product specification in
 this alpha. The operator supplies the structured proposal that Mill assesses and
@@ -89,8 +95,15 @@ harnesses are experimental or unsupported until independently qualified.
 
 ## Install
 
-Before the first public artifact, develop and evaluate from a clean source
-checkout:
+Install the qualified public alpha at its exact version with lifecycle scripts
+disabled:
+
+```sh
+npm install --save-dev --ignore-scripts @davidahmann/mill@0.1.5
+npx --no-install millctl --version
+```
+
+To develop Mill itself from a clean source checkout:
 
 ```sh
 git clone https://github.com/davidahmann/mill.git
@@ -103,16 +116,9 @@ PATH="$node_bin_dir:$PATH" "$node_bin_dir/npm" run build
 node dist/cli.js --version
 ```
 
-After the separately verified npm release, downstream repositories will pin the
-exact package version rather than `latest`:
-
-```sh
-npm install --save-dev --ignore-scripts @davidahmann/mill@0.1.4
-npx --no-install millctl --version
-```
-
-Do not treat the npm command as available until the release exists and the
-downloaded artifact passes the documented readback canary.
+The `alpha` and `latest` npm tags currently resolve to `0.1.5`. Downstream
+repositories should still pin the exact version so a later release cannot alter
+their delivery machinery implicitly.
 
 ## Quick start
 
@@ -124,6 +130,28 @@ node dist/cli.js inspect --prd product/PRD.md
 node dist/cli.js adopt --scan-only
 ```
 
+### Discover a TypeScript repository
+
+Static discovery is a separate read-only operation. It requires a clean Git
+repository root and rejects sensitive paths, symbolic links, unsafe Git
+configuration, and incomplete source traversal. It parses local TypeScript and
+JavaScript imports only after each regular file's physical bytes match its blob
+in the captured `HEAD` tree. The same check protects parsed package metadata. It
+reports source locations, inventories test files, and gives conservative
+importer leads for named paths. Nonliteral module loads and option-bearing test
+commands remain explicit unknowns. It never installs dependencies, runs the
+target's code, or claims executed coverage or delivery authority.
+
+```sh
+millctl --json discover /absolute/path/to/repository --changed src/service.ts
+```
+
+The first increment is a deterministic TypeScript extractor, not arbitrary-stack
+support, a graph database, a watcher, or an AI-generated knowledge graph. Read
+[`product/brownfield-discovery.md`](product/brownfield-discovery.md) and
+[`docs/canaries/brownfield-discovery.md`](docs/canaries/brownfield-discovery.md)
+for the exact boundary and real-fixture evidence.
+
 For a source-backed specification, supply the PRD, source manifest, and
 structured proposal:
 
@@ -210,24 +238,83 @@ millctl --json pr plan --task product/tasks/TASK.yaml --run <run-id>
 millctl --json pr open --task product/tasks/TASK.yaml --run <run-id> \
   --approve sha256:<delivery-plan> --attended
 millctl --json pr observe --task product/tasks/TASK.yaml --run <run-id>
-# A human marks ready and merges in GitHub.
+# By default, a human marks ready and merges in GitHub.
 millctl --json pr finalize --task product/tasks/TASK.yaml --run <run-id>
 ```
 
 Or use `millctl ship --draft` twice: first to return the proposal, then with its
-exact digest and `--attended` to perform it. `millctl` never marks ready or
-merges.
+exact digest and `--attended` to perform it. Draft delivery never implicitly
+authorizes readiness or merge.
+
+### Approve a merge from your work surface
+
+With `propose.attendedMerge: true`, producer-bound required checks, and strict
+up-to-date branch protection, the attending operator can inspect and approve:
+
+```sh
+millctl --json pr merge-plan --task product/tasks/TASK.yaml --run <run-id> --method squash
+millctl --json pr merge --task product/tasks/TASK.yaml --run <run-id> \
+  --approve sha256:<merge-plan> --attended
+millctl --json pr finalize --task product/tasks/TASK.yaml --run <run-id>
+```
+
+The plan binds PR/head/base, exact tree, actor, method, policy and expiry. A
+chat host can submit the operator's approval through this CLI; Mill does not
+authenticate arbitrary chat messages or let the builder approve its own work.
+See [attended approvals and recovery](docs/approvals.md).
+
+### Compile follow-up work and adopt native brownfield commands
+
+`plan tasks --request product/change.yaml` deterministically compiles an
+operator-supplied PRD/plan/bug/review change request and approved impact
+manifests into version-2 tasks and a dependency-checked outcome plan. Its
+separate `--apply --approve sha256:<plan> --attended` step writes an isolated
+worktree. It does not infer approval or acceptance tests from prose. See
+[planning](docs/planning.md).
+
+`adopt-native --config adoption.yaml` offers experimental Node ESM/npm adoption
+that adds only `mill.yaml` and `mill.lock`, preserving existing code and native
+scripts. Apply requires the exact digest and attendance; dependency preparation,
+baseline qualification and task execution remain separate. See
+[brownfield scope and qualification](docs/brownfield.md).
+
+### Pull-request and resulting-main checks
+
+The source implementation keeps `propose.requiredChecks` as the complete gate
+for the exact pull-request head. Optional `propose.postMergeRequiredChecks`
+selects a nonempty subset of those names for resulting-main readback only;
+omitting it retains the full `requiredChecks` list for both phases. New delivery
+plans approval-bind and persist both effective lists. Missing or pending
+required checks prevent completion; skipped or failed required checks fail the
+phase that requires them.
+
+In this repository, `dependency-review` runs only for pull requests, while
+`validate` and `codeql` also run on pushes to `main`. The maintainer-prepared
+`mill.yaml` requires all three at the exact PR head and explicitly selects
+`[validate, codeql]` for resulting-main readback.
+
+New delivery records identify the policy source as `configured` or
+`implicit_default`. A historical record with a full defaulted list and no
+provenance can bind the configured subset once only if its exact reviewed
+candidate proves omission of the optional policy and authoritative merge
+readback establishes every other delivery identity. That compatibility path
+cannot relax a new delivery. See
+[repository settings](docs/repository-settings.md) and the
+[migration record](docs/canaries/post-merge-default-policy-migration.md) for the
+conditions and outstanding live evidence for delivery
+`01801a1b-58f9-480f-8cee-54ea2bbeabb2`. Human readiness, merge authority, and
+exact candidate/tree checks remain required.
 
 ## Trust model
 
 Mill separates four principals:
 
-| Principal        | May do                                             | Cannot do                                          |
-| ---------------- | -------------------------------------------------- | -------------------------------------------------- |
-| Builder          | Edit approved paths in a disposable worktree       | Push, merge, deploy, change authority or oracles   |
-| Verifier         | Run declared commands in bounded no-network OCI    | Write candidate source or use forge credentials    |
-| Reviewer         | Read the exact committed candidate                 | Execute or edit code                               |
-| Attended shipper | Push the unchanged candidate and open its draft PR | Change the candidate, mark ready, merge, or deploy |
+| Principal        | May do                                                        | Cannot do                                                        |
+| ---------------- | ------------------------------------------------------------- | ---------------------------------------------------------------- |
+| Builder          | Edit approved paths in a disposable worktree                  | Push, merge, deploy, change authority or oracles                 |
+| Verifier         | Run declared commands in bounded no-network OCI               | Write candidate source or use forge credentials                  |
+| Reviewer         | Read the exact committed candidate                            | Execute or edit code                                             |
+| Attended shipper | Push/open a draft; separately approved opt-in readiness/merge | Change the candidate, self-approve, bypass protection, or deploy |
 
 Codex uses your existing Codex CLI session and therefore your own provider
 billing. GitHub operations use your existing `gh` session. Another maintainer
@@ -248,7 +335,7 @@ interrupted, inspect before acting:
 
 ```sh
 millctl --json status --run <run-id>
-millctl --json resume --task product/tasks/TASK.yaml --run <run-id> --attended
+millctl --json resume --task product/tasks/TASK.yaml --run <run-id>
 millctl --json cancel --run <run-id>
 millctl --json pr reconcile --task product/tasks/TASK.yaml --run <run-id>
 ```
@@ -258,13 +345,32 @@ uncertain external effect without authoritative readback. Use explicit local
 recovery for state and diagnostics:
 
 ```sh
-millctl --json state backup --output /absolute/path/backup.sqlite
-millctl --json state restore --input /absolute/path/backup.sqlite --attended
-millctl --json state purge --attended
-millctl --json support-bundle --output /absolute/path/support.json
+millctl --json state backup
+millctl --json state restore --from /absolute/path/returned-backup.sqlite3
+millctl --json state purge --confirm <repository-uuid>
+millctl --json support-bundle --run <run-id>
 millctl --json detach plan
 ```
 
+An unresolved push, PR, readiness or merge blocks repair, new delivery and state
+purge/restore even if the enclosing run says `blocked` or `cancelled`.
+Cancellation records intent without discarding the receipt. Use
+`pr merge-reconcile` for readiness/merge; a confirmed merge then requires
+`pr finalize` and green main checks before cleanup. See
+[approval recovery](docs/approvals.md#interruptions).
+
+Before any remote attempt, stale review scope can use attended
+`review --refresh --base <exact-provider-commit>`. This preserves the candidate
+and remaining review budget, invalidates the unexecuted delivery plan and does
+not move frozen Git refs. Plan delivery again after the fresh review passes.
+
+For generated authority, `state reconcile-plans` verifies the exact committed
+files. A failed plan can instead be explicitly discontinued with
+`state abandon-plan --approve <original-plan-digest> --attended`, after
+preserving partial output in a clean commit on its recorded branch. Abandonment
+retains evidence and does not certify successful apply. See
+[plan recovery](docs/planning.md#recovery).
+
 Restore validates the database before atomic replacement and quarantines newer
 unreferenced worktrees. Detach is plan-only; the operator performs the reviewed
 removal. A generated/adopted repo must continue to build and test natively after
@@ -275,7 +381,10 @@ Mill is removed.
 `millctl audit` is a bounded, read-only milestone check for Mill's selected
 recipe and release path. It requires a clean exact Git candidate and reports
 product, code, UX, accessibility, security, dependency, architecture,
-operations, and release checks in a schema-valid JSON envelope.
+operations, and release checks in a schema-valid JSON envelope. These checks are
+labelled `assurance: structural`: they inspect contracts and hooks, not executed
+security, accessibility or business behavior. Native command results, realistic
+scenarios and release canaries are separate evidence.
 
 ```sh
 millctl --json --cwd . audit

package/dist/audit/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/audit/repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EACL,iBAAiB,EAIlB,MAAM,yBAAyB,CAAC;AASjC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAkD5D,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,WAAW,CAAC,CAoOvB"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/audit/repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EACL,iBAAiB,EAIlB,MAAM,yBAAyB,CAAC;AASjC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAoD5D,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,WAAW,CAAC,CAoOvB"}

package/dist/audit/repository.js

@@ -20,6 +20,7 @@ async function runCheck(input) {
         return {
             id: input.id,
             category: input.category,
+            assurance: "structural",
             status: "passed",
             summary: input.summary,
             evidence: input.evidence,
@@ -29,6 +30,7 @@ async function runCheck(input) {
         return {
             id: input.id,
             category: input.category,
+            assurance: "structural",
             status: "blocked",
             summary: `${input.summary}: ${error instanceof Error ? error.message : String(error)}`,
             evidence: input.evidence,

package/dist/audit/repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/audit/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAkB,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAaxD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAsB;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,QAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,SAAkB;YAC1B,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACtF,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,MAAyB;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAGrC;IACC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,GACpE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC;QACnD,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC;QACpD,cAAc,CACZ,KAAK,CAAC,IAAI,EACV,8CAA8C,CAC/C;QACD,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC;QAC1C,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC;KAChD,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,CACJ,MAAM,EACN,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;QACrC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;QACrC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,8BAA8B,CAAC;QACxD,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;QACvC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC;QAC/C,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;QACvC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC;QACtC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC3C,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,+BAA+B,CAAC;KAC1D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/B,QAAQ,CAAC;YACP,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE;gBACR,gBAAgB;gBAChB,uBAAuB;gBACvB,wBAAwB;aACzB;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC3C,IACE,SAAS,CAAC,qBAAqB;oBAC/B,eAAe,CAAC,OAA+B,CAAC,EAChD,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,mDAAmD;YAC5D,QAAQ,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;YAC5C,QAAQ,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1D,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,IAAI;YACd,OAAO,EACL,kEAAkE;YACpE,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;YACpC,QAAQ,EAAE,GAAG,EAAE;gBACb,WAAW,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;gBACxE,WAAW,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC,CAAC;YACvE,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,iCAAiC;YACrC,QAAQ,EAAE,eAAe;YACzB,OAAO,EACL,wEAAwE;YAC1E,QAAQ,EAAE;gBACR,8CAA8C;gBAC9C,qBAAqB;aACtB;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBACD,WAAW,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9D,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,qBAAqB;YACzB,QAAQ,EAAE,UAAU;YACpB,OAAO,EACL,oEAAoE;YACtE,QAAQ,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC;YACtC,QAAQ,EAAE,GAAG,EAAE;gBACb,IACE,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;oBAChC,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;oBAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;oBAChC,IAAI,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EACpC,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBAC5D,CAAC;gBACD,WAAW,CAAC,QAAQ,EAAE;oBACpB,iCAAiC;oBACjC,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,iCAAiC;YACrC,QAAQ,EAAE,cAAc;YACxB,OAAO,EACL,iEAAiE;YACnE,QAAQ,EAAE;gBACR,cAAc;gBACd,mBAAmB;gBACnB,8CAA8C;aAC/C;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;gBAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC3D,IACE,OAAO,OAAO,KAAK,QAAQ;wBAC3B,CAAC,uEAAuE,CAAC,IAAI,CAC3E,OAAO,CACR,EACD,CAAC;wBACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,CAAC;gBACD,IAAI,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,+BAA+B;YACnC,QAAQ,EAAE,cAAc;YACxB,OAAO,EACL,iEAAiE;YACnE,QAAQ,EAAE,CAAC,8BAA8B,EAAE,aAAa,EAAE,cAAc,CAAC;YACzE,QAAQ,EAAE,GAAG,EAAE;gBACb,WAAW,CAAC,YAAY,EAAE;oBACxB,6BAA6B;oBAC7B,oBAAoB;iBACrB,CAAC,CAAC;gBACH,WAAW,CAAC,QAAQ,EAAE,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBACjE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAC9B,MAAM,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC,CACvC,CAAC;gBACF,IACE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACzB,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3C,EACD,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,qBAAqB;YACzB,QAAQ,EAAE,YAAY;YACtB,OAAO,EACL,0EAA0E;YAC5E,QAAQ,EAAE,CAAC,qBAAqB,EAAE,YAAY,EAAE,WAAW,CAAC;YAC5D,QAAQ,EAAE,GAAG,EAAE;gBACb,WAAW,CAAC,WAAW,EAAE;oBACvB,mBAAmB;oBACnB,uBAAuB;iBACxB,CAAC,CAAC;gBACH,WAAW,CAAC,OAAO,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;gBACvD,WAAW,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAC7D,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,wBAAwB;YAC5B,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,kEAAkE;YACpE,QAAQ,EAAE;gBACR,cAAc;gBACd,+BAA+B;gBAC/B,iBAAiB;aAClB;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,IACE,WAAW,CAAC,IAAI,KAAK,mBAAmB;oBACxC,WAAW,CAAC,OAAO,KAAK,mBAAmB;oBAC3C,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAC3D,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI,EAC3D,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACxE,CAAC;gBACD,WAAW,CAAC,eAAe,EAAE;oBAC3B,+BAA+B;oBAC/B,yBAAyB;iBAC1B,CAAC,CAAC;gBACH,WAAW,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC;YAC/D,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,iBAAiB,CAAC,KAAK,CAAC;QAC7B,aAAa,EAAE,GAAG;QAClB,SAAS;QACT,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;YACxD,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,SAAS;QACb,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/audit/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAkB,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAaxD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAsB;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,YAAqB;YAChC,MAAM,EAAE,QAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,YAAqB;YAChC,MAAM,EAAE,SAAkB;YAC1B,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACtF,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,MAAyB;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAGrC;IACC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,GACpE,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC;QACnD,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC;QACpD,cAAc,CACZ,KAAK,CAAC,IAAI,EACV,8CAA8C,CAC/C;QACD,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC;QAC1C,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC;KAChD,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,CACJ,MAAM,EACN,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;QACrC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;QACrC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,8BAA8B,CAAC;QACxD,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;QACvC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC;QAC/C,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;QACvC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC;QACtC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC3C,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,+BAA+B,CAAC;KAC1D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/B,QAAQ,CAAC;YACP,EAAE,EAAE,mBAAmB;YACvB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE;gBACR,gBAAgB;gBAChB,uBAAuB;gBACvB,wBAAwB;aACzB;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC3C,IACE,SAAS,CAAC,qBAAqB;oBAC/B,eAAe,CAAC,OAA+B,CAAC,EAChD,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,mDAAmD;YAC5D,QAAQ,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;YAC5C,QAAQ,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1D,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,IAAI;YACd,OAAO,EACL,kEAAkE;YACpE,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;YACpC,QAAQ,EAAE,GAAG,EAAE;gBACb,WAAW,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;gBACxE,WAAW,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC,CAAC;YACvE,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,iCAAiC;YACrC,QAAQ,EAAE,eAAe;YACzB,OAAO,EACL,wEAAwE;YAC1E,QAAQ,EAAE;gBACR,8CAA8C;gBAC9C,qBAAqB;aACtB;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBACD,WAAW,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9D,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,qBAAqB;YACzB,QAAQ,EAAE,UAAU;YACpB,OAAO,EACL,oEAAoE;YACtE,QAAQ,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC;YACtC,QAAQ,EAAE,GAAG,EAAE;gBACb,IACE,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;oBAChC,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;oBAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;oBAChC,IAAI,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EACpC,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBAC5D,CAAC;gBACD,WAAW,CAAC,QAAQ,EAAE;oBACpB,iCAAiC;oBACjC,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,iCAAiC;YACrC,QAAQ,EAAE,cAAc;YACxB,OAAO,EACL,iEAAiE;YACnE,QAAQ,EAAE;gBACR,cAAc;gBACd,mBAAmB;gBACnB,8CAA8C;aAC/C;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;gBAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC3D,IACE,OAAO,OAAO,KAAK,QAAQ;wBAC3B,CAAC,uEAAuE,CAAC,IAAI,CAC3E,OAAO,CACR,EACD,CAAC;wBACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,CAAC;gBACD,IAAI,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,+BAA+B;YACnC,QAAQ,EAAE,cAAc;YACxB,OAAO,EACL,iEAAiE;YACnE,QAAQ,EAAE,CAAC,8BAA8B,EAAE,aAAa,EAAE,cAAc,CAAC;YACzE,QAAQ,EAAE,GAAG,EAAE;gBACb,WAAW,CAAC,YAAY,EAAE;oBACxB,6BAA6B;oBAC7B,oBAAoB;iBACrB,CAAC,CAAC;gBACH,WAAW,CAAC,QAAQ,EAAE,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBACjE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAC9B,MAAM,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC,CACvC,CAAC;gBACF,IACE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACzB,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3C,EACD,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,qBAAqB;YACzB,QAAQ,EAAE,YAAY;YACtB,OAAO,EACL,0EAA0E;YAC5E,QAAQ,EAAE,CAAC,qBAAqB,EAAE,YAAY,EAAE,WAAW,CAAC;YAC5D,QAAQ,EAAE,GAAG,EAAE;gBACb,WAAW,CAAC,WAAW,EAAE;oBACvB,mBAAmB;oBACnB,uBAAuB;iBACxB,CAAC,CAAC;gBACH,WAAW,CAAC,OAAO,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;gBACvD,WAAW,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAC7D,CAAC;SACF,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,wBAAwB;YAC5B,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,kEAAkE;YACpE,QAAQ,EAAE;gBACR,cAAc;gBACd,+BAA+B;gBAC/B,iBAAiB;aAClB;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,IACE,WAAW,CAAC,IAAI,KAAK,mBAAmB;oBACxC,WAAW,CAAC,OAAO,KAAK,mBAAmB;oBAC3C,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAC3D,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI,EAC3D,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACxE,CAAC;gBACD,WAAW,CAAC,eAAe,EAAE;oBAC3B,+BAA+B;oBAC/B,yBAAyB;iBAC1B,CAAC,CAAC;gBACH,WAAW,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC;YAC/D,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,iBAAiB,CAAC,KAAK,CAAC;QAC7B,aAAa,EAAE,GAAG;QAClB,SAAS;QACT,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;YACxD,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,SAAS;QACb,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/cli-program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-program.d.ts","sourceRoot":"","sources":["../src/cli-program.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAwC,MAAM,WAAW,CAAC;AA2D1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CAC3C;AA+ED,wBAAgB,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,UAAQ,GAAG,OAAO,CA0wCpE;AAED,wBAAsB,MAAM,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAuFjB"}
+{"version":3,"file":"cli-program.d.ts","sourceRoot":"","sources":["../src/cli-program.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAwC,MAAM,WAAW,CAAC;AAuE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CAC3C;AA+ED,wBAAgB,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,UAAQ,GAAG,OAAO,CAuiDpE;AAED,wBAAsB,MAAM,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAuFjB"}

package/dist/cli-program.js

@@ -8,6 +8,7 @@ import { doctor, doctorReady } from "./doctor.js";
 import { asMillError, ExitCode, MillError } from "./errors.js";
 import { inspectPrd } from "./intake/prd.js";
 import { scanRepository } from "./repository/scan.js";
+import { discoverRepository } from "./repository/intelligence.js";
 import { applyAdoptionIntegration, applyGreenfieldIntegration, planAdoptionIntegration, planDetach, planGreenfieldIntegration, } from "./repository/integration.js";
 import { assessSpecificationProposal, loadPlanningSources, loadSpecificationProposal, promoteSpecificationProposal, semanticProposalDiff, } from "./planning/specification.js";
 import { assessImpactManifest, loadImpactPlanningInputs, } from "./planning/impact.js";
@@ -17,6 +18,11 @@ import { cancelRun, codexAuthStatus, qualifyBaseline, resumeRun, reviewRun, runS
 import { commandResult, formatHuman } from "./result.js";
 import { safeReadText } from "./security/safe-path.js";
 import { MILL_VERSION } from "./version.js";
+import { applyMerge, planMerge, reconcileMerge } from "./runtime/merge.js";
+import { abandonAuthorityPlan, reconcileAuthorityPlans, } from "./runtime/authority-plans.js";
+import { planOutcomeClosure } from "./planning/closure.js";
+import { compileChangeTasks, applyChangeTasks } from "./planning/tasks.js";
+import { planNativeAdoption, applyNativeAdoption, } from "./repository/native-adoption.js";
 import { prepareRepositoryDependencies, startNextReadyOutcome, startFounderDelivery, } from "./workflows/founder.js";
 function parseMode(value) {
     if (value === "inspect" || value === "build" || value === "propose") {
@@ -107,6 +113,20 @@ export function createProgram(io, jsonErrors = false) {
         const inspection = await inspectPrd(root, options.prd);
         emit(io, global.json === true, commandResult({ command: "inspect", ok: true, data: inspection }));
     });
+    program
+        .command("discover <repository>")
+        .description("derive bounded, read-only TypeScript repository evidence without executing repository code")
+        .option("--changed <path...>", "relative source paths whose importer leads should be reported")
+        .action(async (repository, options) => {
+        const global = globals(program);
+        const report = await discoverRepository({
+            root: path.resolve(global.cwd, repository),
+            ...(options.changed === undefined
+                ? {}
+                : { changedPaths: options.changed }),
+        });
+        emit(io, global.json === true, commandResult({ command: "discover", ok: true, data: report }));
+    });
     program
         .command("new <directory>")
         .description("preview or transactionally create the supported web recipe")
@@ -262,6 +282,32 @@ export function createProgram(io, jsonErrors = false) {
     const dependencies = program
         .command("dependencies")
         .description("manage exact local verifier dependency snapshots");
+    program
+        .command("adopt-native")
+        .description("experimentally adopt existing Node ESM/npm native tests without replacing source or oracles")
+        .requiredOption("--config <path>", "proposed build-only OCI configuration in the repository")
+        .option("--apply", "create new Mill controls in an isolated worktree")
+        .option("--approve <digest>", "exact native adoption plan digest")
+        .option("--attended", "the operator approves this exact adoption")
+        .action(async (options) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        const data = options.apply === true
+            ? await applyNativeAdoption({
+                root,
+                configPath: options.config,
+                approvalDigest: requiredValue(options.approve, "--approve"),
+                attended: options.attended === true,
+            })
+            : await planNativeAdoption({ root, configPath: options.config });
+        emit(io, global.json === true, commandResult({
+            command: options.apply === true
+                ? "adopt-native.apply"
+                : "adopt-native.plan",
+            ok: true,
+            data,
+        }));
+    });
     dependencies
         .command("prepare")
         .description("prepare one lock-bound snapshot through the exact OCI image")
@@ -327,6 +373,49 @@ export function createProgram(io, jsonErrors = false) {
     const plan = program
         .command("plan")
         .description("compile and assess product-continuity authority without writes");
+    plan
+        .command("close-outcome")
+        .description("propose plan closure from an exact provider-finalized run")
+        .requiredOption("--task <path>", "task packet path")
+        .requiredOption("--run <id>", "finalized run identity")
+        .option("--next <outcome-id>", "one already approved successor")
+        .action(async (options) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        const data = await planOutcomeClosure({
+            root,
+            taskPath: options.task,
+            runId: options.run,
+            ...(options.next === undefined ? {} : { nextOutcomeId: options.next }),
+        });
+        emit(io, global.json === true, commandResult({ command: "plan.close-outcome", ok: true, data }));
+    });
+    plan
+        .command("tasks")
+        .description("compile a source-backed PRD, follow-up plan, bug or review into version-2 tasks")
+        .requiredOption("--request <path>", "change request with approved outcome and impact references")
+        .option("--apply", "write the approved files in a new disposable worktree")
+        .option("--approve <digest>", "exact compilation approval digest")
+        .option("--attended", "the operator approves the compiled authority files")
+        .action(async (options) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        const data = options.apply === true
+            ? await applyChangeTasks({
+                root,
+                requestPath: options.request,
+                approvalDigest: requiredValue(options.approve, "--approve"),
+                attended: options.attended === true,
+            })
+            : await compileChangeTasks({ root, requestPath: options.request });
+        emit(io, global.json === true, commandResult({
+            command: options.apply === true ? "plan.tasks.apply" : "plan.tasks",
+            ok: true,
+            data,
+        }));
+    });
     plan
         .command("specification")
         .description("assess one source-backed product proposal and approval digest")
@@ -674,6 +763,9 @@ export function createProgram(io, jsonErrors = false) {
         .description("obtain a fresh read-only review of the exact verified candidate")
         .requiredOption("--task <path>", "approved task packet path")
         .requiredOption("--run <id>", "run identifier")
+        .option("--refresh", "refresh stale scope before any remote attempt")
+        .option("--base <commit>", "exact locally available provider-base commit for refresh")
+        .option("--attended", "confirm attended review-scope selection")
         .action(async (options) => {
         const global = globals(program);
         const root = await findRepositoryRoot(global.cwd);
@@ -682,6 +774,13 @@ export function createProgram(io, jsonErrors = false) {
             root,
             taskPath: options.task,
             runId: options.run,
+            ...(options.refresh === undefined
+                ? {}
+                : { refresh: options.refresh }),
+            ...(options.base === undefined ? {} : { baseCommit: options.base }),
+            ...(options.attended === undefined
+                ? {}
+                : { attended: options.attended }),
         });
         const ok = result.review.findings.length === 0;
         emit(io, global.json === true, commandResult({
@@ -721,6 +820,64 @@ export function createProgram(io, jsonErrors = false) {
     const pr = program
         .command("pr")
         .description("deliver an exact reviewed candidate through a draft PR");
+    pr.command("merge-plan")
+        .description("plan a distinct human-approved merge, including readiness when needed")
+        .requiredOption("--task <path>", "approved task packet path")
+        .requiredOption("--run <id>", "run identifier")
+        .option("--method <method>", "squash or merge", "squash")
+        .action(async (options) => {
+        if (options.method !== "squash" && options.method !== "merge")
+            throw new MillError("MERGE_METHOD_INVALID", "Choose squash or merge.", ExitCode.usage);
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        const data = await planMerge({
+            root,
+            taskPath: options.task,
+            runId: options.run,
+            method: options.method,
+        });
+        emit(io, global.json === true, commandResult({ command: "pr.merge-plan", ok: true, data }));
+    });
+    pr.command("merge")
+        .description("apply an exact merge plan at the trusted attended operator boundary")
+        .requiredOption("--task <path>", "approved task packet path")
+        .requiredOption("--run <id>", "run identifier")
+        .requiredOption("--approve <digest>", "exact displayed merge-plan digest")
+        .requiredOption("--attended", "operator has approved this exact plan")
+        .action(async (options) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        const data = await applyMerge({
+            root,
+            taskPath: options.task,
+            runId: options.run,
+            approvalDigest: options.approve,
+            attended: options.attended,
+        });
+        emit(io, global.json === true, commandResult({ command: "pr.merge", ok: true, data }));
+    });
+    pr.command("merge-reconcile")
+        .description("read back a possibly started merge without retrying it")
+        .requiredOption("--task <path>", "approved task packet path")
+        .requiredOption("--run <id>", "run identifier")
+        .action(async (options) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        const data = await reconcileMerge({
+            root,
+            taskPath: options.task,
+            runId: options.run,
+        });
+        emit(io, global.json === true, commandResult({
+            command: "pr.merge-reconcile",
+            ok: data.state === "merged",
+            status: data.state === "merged" ? "ok" : "blocked",
+            data,
+        }));
+    });
     pr.command("plan")
         .description("read live GitHub identity and create a local approval plan")
         .requiredOption("--task <path>", "approved task packet path")
@@ -890,6 +1047,38 @@ export function createProgram(io, jsonErrors = false) {
     const state = program
         .command("state")
         .description("manage local operational state");
+    state
+        .command("reconcile-plans")
+        .description("read back committed generated authority; never retry apply")
+        .action(async () => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        const data = await reconcileAuthorityPlans({ root });
+        const ok = data.plans.every((plan) => plan.state === "committed" || plan.state === "abandoned");
+        emit(io, global.json === true, commandResult({
+            command: "state.reconcile-plans",
+            ok,
+            status: ok ? "ok" : "blocked",
+            data,
+        }));
+    });
+    state
+        .command("abandon-plan")
+        .description("abandon an exact failed plan while retaining its clean committed branch")
+        .requiredOption("--approve <digest>", "original authority-plan approval digest")
+        .option("--attended", "confirm attended local disposition")
+        .action(async (options) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        const data = await abandonAuthorityPlan({
+            root,
+            approvalDigest: options.approve,
+            attended: options.attended === true,
+        });
+        emit(io, global.json === true, commandResult({ command: "state.abandon-plan", ok: true, data }));
+    });
     state
         .command("backup")
         .description("create a user-only SQLite backup")