@macedon-technologies/batman 1.17.2 → 1.18.0

package/lib/SoftwareFactoryModels.js

@@ -0,0 +1,306 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SoftwareFactoryModels = void 0;
+const crypto_1 = require("crypto");
+const projen_1 = require("projen");
+/**
+ * Seed swamp model instances wiring the `@swamp/software-factory` state
+ * machine to this repo's GitHub issues/PRs and shell steps. These are
+ * `SampleFile`s (written once, then owned by the team) since the factory's
+ * stages/gates are the kind of thing a team tunes for its own workflow.
+ */
+class SoftwareFactoryModels {
+    constructor(project, options) {
+        const { repoName, githubOwner, baseBranch } = options;
+        const repo = `${githubOwner}/${repoName}`;
+        const issuesModel = `${repoName}-issues`;
+        const prModel = `${repoName}-pr`;
+        const shellModel = `${repoName}-shell`;
+        const shellArchitectureModel = `${repoName}-shell-architecture`;
+        const shellManifestModel = `${repoName}-shell-manifest`;
+        const secretsVault = `${repoName}-secrets`;
+        const factoryModel = `${repoName}-factory`;
+        new projen_1.SampleFile(project, `models/@goodcraft/github/${prModel}.yaml`, {
+            contents: `type: '@goodcraft/github'
+typeVersion: 2026.06.14.1
+id: ${(0, crypto_1.randomUUID)()}
+name: ${prModel}
+version: 1
+tags: {}
+globalArguments:
+  token: '\${{ vault.get(${secretsVault}, GITHUB_TOKEN) }}'
+  owner: ${githubOwner}
+methods: {}
+`,
+        });
+        new projen_1.SampleFile(project, `models/@webframp/github/${issuesModel}.yaml`, {
+            contents: `type: '@webframp/github'
+typeVersion: 2026.08.28.1
+id: ${(0, crypto_1.randomUUID)()}
+name: ${issuesModel}
+version: 1
+tags: {}
+globalArguments: {}
+methods: {}
+`,
+        });
+        for (const name of [shellModel, shellArchitectureModel, shellManifestModel]) {
+            new projen_1.SampleFile(project, `models/command/shell/${name}.yaml`, {
+                contents: `type: command/shell
+typeVersion: 2026.02.09.1
+id: ${(0, crypto_1.randomUUID)()}
+name: ${name}
+version: 1
+tags: {}
+globalArguments: {}
+methods: {}
+`,
+            });
+        }
+        new projen_1.SampleFile(project, `models/@swamp/software-factory/${factoryModel}.yaml`, {
+            contents: `type: '@swamp/software-factory'
+typeVersion: 2026.06.24.1
+id: ${(0, crypto_1.randomUUID)()}
+name: ${factoryModel}
+version: 1
+tags: {}
+reports:
+  require:
+    - name: "@swamp/software-factory/work-item-summary"
+      methods: [summary]
+globalArguments:
+  stages:
+    - id: intake
+      initial: true
+      description: >-
+        Fetch the GitHub issue for this work item (workItem is the bare
+        issue number) and record its context.
+      work:
+        mode: interactive
+        systemPrompt: >-
+          Fetch the GitHub issue numbered \${{ self.workItem }} for
+          ${repo} using the ${issuesModel} model
+          (list_issues, then swamp data query filtered by number — see the
+          ${issuesModel} data), and record the issue-context artifact.
+      artifacts:
+        - name: issue-context
+          schema:
+            type: object
+            required: [number, title, url]
+            properties:
+              number: { type: integer }
+              title: { type: string, minLength: 1 }
+              body: { type: string }
+              url: { type: string, minLength: 1 }
+              labels: { type: array, items: { type: string } }
+      transitions:
+        - name: submit
+          to: planning
+          gates:
+            - type: artifact-exists
+              config: { artifact: issue-context }
+
+    - id: planning
+      description: >-
+        Turn the issue into a real OpenSpec change (proposal, design,
+        specs, tasks) — OpenSpec's task list is the plan, not a
+        freeform artifact.
+      work:
+        mode: interactive
+        systemPrompt: >-
+          Using the recorded issue-context artifact, use the
+          openspec-propose skill to create a complete OpenSpec change
+          (proposal.md, design.md, specs with deltas, tasks.md) for this
+          work item under openspec/changes/<changeSlug>/ — do not write a
+          freeform plan instead of this. Then record the plan artifact
+          with the change's slug and a one-line summary.
+      artifacts:
+        - name: plan
+          schema:
+            type: object
+            required: [changeSlug, summary]
+            properties:
+              changeSlug: { type: string, minLength: 1 }
+              summary: { type: string, minLength: 1 }
+      transitions:
+        - name: submit
+          to: openspec-plan-verify
+          gates:
+            - type: artifact-exists
+              config: { artifact: plan }
+
+    - id: openspec-plan-verify
+      description: >-
+        Verify the OpenSpec change is real and well-formed (not just an
+        artifact claiming one exists) before implementation starts.
+      work:
+        mode: workflow
+        workflow:
+          name: openspec-plan-verify
+          inputs:
+            changeSlug: '\${{ data.latest(self.name, "artifact-plan").payload.changeSlug }}'
+        resultEvidence: plan-verify-run
+      transitions:
+        - name: pass
+          to: implementing
+          gates:
+            - type: workflow-succeeded
+              config: { workflow: openspec-plan-verify }
+        - name: fail
+          to: planning
+          gates:
+            - type: evidence-recorded
+              config: { name: plan-verify-run, requireField: { status: failed } }
+
+    - id: implementing
+      description: Implement the OpenSpec change's tasks on a branch.
+      work:
+        mode: interactive
+        systemPrompt: >-
+          Use the openspec-apply-change skill against the change recorded
+          in the plan artifact's changeSlug — work through its tasks.md
+          one task at a time, checking each off (\`- [ ]\` -> \`- [x]\`) as
+          you complete it, until every task is done. Commit the work on a
+          feature branch. Record the change-summary artifact and the
+          change-request evidence (branch name and head commit sha — no
+          PR yet, that happens after pre-PR verification passes).
+      artifacts:
+        - name: change-summary
+          schema:
+            type: object
+            required: [summary, headSha]
+            properties:
+              summary: { type: string, minLength: 1 }
+              headSha: { type: string, minLength: 7 }
+      evidence:
+        - name: change-request
+          schema:
+            type: object
+            required: [branch, headSha]
+            properties:
+              branch: { type: string, minLength: 1 }
+              headSha: { type: string, minLength: 7 }
+              url: { type: string }
+      transitions:
+        - name: submit
+          to: openspec-tasks-verify
+          gates:
+            - type: artifact-exists
+              config: { artifact: change-summary }
+            - type: evidence-recorded
+              config: { name: change-request }
+
+    - id: openspec-tasks-verify
+      description: >-
+        Verify every task in the OpenSpec change is actually checked off
+        before pre-PR verification runs.
+      work:
+        mode: workflow
+        workflow:
+          name: openspec-tasks-verify
+          inputs:
+            changeSlug: '\${{ data.latest(self.name, "artifact-plan").payload.changeSlug }}'
+        resultEvidence: tasks-verify-run
+      transitions:
+        - name: pass
+          to: pre-pr-verify
+          gates:
+            - type: workflow-succeeded
+              config: { workflow: openspec-tasks-verify }
+        - name: fail
+          to: implementing
+          gates:
+            - type: evidence-recorded
+              config: { name: tasks-verify-run, requireField: { status: failed } }
+
+    - id: pre-pr-verify
+      description: >-
+        Pre-PR verification: build/synth/test/lint plus the architecture
+        rule registry, run before the PR is opened rather than relying on
+        CI after the fact.
+      work:
+        mode: workflow
+        workflow:
+          name: pre-pr-verify
+          inputs:
+            commit: '\${{ data.latest(self.name, "evidence-change-request").payload.headSha }}'
+            branch: '\${{ data.latest(self.name, "evidence-change-request").payload.branch }}'
+        resultEvidence: verify-run
+      transitions:
+        - name: pass
+          to: open-pr
+          gates:
+            - type: workflow-succeeded
+              config: { workflow: pre-pr-verify }
+        - name: fail
+          to: implementing
+          gates:
+            - type: evidence-recorded
+              config: { name: verify-run, requireField: { status: failed } }
+
+    - id: open-pr
+      description: Open the pull request now that pre-PR verification has passed.
+      work:
+        mode: interactive
+        systemPrompt: >-
+          Before opening the PR, fetch the real pre-pr-verify attestation
+          with \`swamp data get --workflow pre-pr-verify
+          report-swamp-verification-attestation --json\` and include its
+          \`content\` verbatim (as a markdown block, e.g. under a "Pre-PR
+          verification" heading) in the PR body — never just assert in
+          prose that checks passed. Also fetch this same run's manifest step
+          output (\`swamp data query 'modelName == "${shellManifestModel}" &&
+          name == "result"' --select attributes.stdout --json\`, take the
+          latest) and append it to the PR body as
+          \`<!-- attestation-manifest {"commit": "<headSha>", "status":
+          "succeeded", ...the manifest step's JSON, spread in...} -->\` — an
+          HTML comment so it's invisible when rendered but still present in
+          the raw body text verify-attestation.yml reads via the GitHub API.
+          Also fetch the plan artifact's changeSlug and include an explicit
+          "OpenSpec change" line in the PR body naming it and its path
+          (\`openspec/changes/<changeSlug>/\`) — every PR the factory opens
+          must call out which OpenSpec change(s) drove the session, not
+          just imply it. If planning cycled through more than one change
+          (a rework loop produced a new changeSlug), list every distinct
+          changeSlug recorded across the run's plan artifact versions, not
+          only the latest. Then call ${prModel}'s openPr method
+          (repo=${repo}, head=<the branch recorded in
+          change-request evidence>, base=${baseBranch}, dryRun=false), with
+          title/body referencing the intake stage's issue number, the
+          OpenSpec change(s), the attestation block, and the manifest
+          comment, then record the pr-opened evidence with the returned PR
+          url and number.
+      evidence:
+        - name: pr-opened
+          schema:
+            type: object
+            required: [url, number]
+            properties:
+              url: { type: string, minLength: 1 }
+              number: { type: integer }
+      transitions:
+        - name: submit
+          to: done
+          gates:
+            - type: evidence-recorded
+              config: { name: pr-opened }
+
+    - id: done
+      terminal: true
+
+    - id: aborted
+      terminal: true
+
+  globalTransitions:
+    - name: abort
+      to: aborted
+      gates:
+        - type: human-approval
+          config: { id: abort-confirmation }
+methods: {}
+`,
+        });
+    }
+}
+exports.SoftwareFactoryModels = SoftwareFactoryModels;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU29mdHdhcmVGYWN0b3J5TW9kZWxzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL1NvZnR3YXJlRmFjdG9yeU1vZGVscy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxtQ0FBb0M7QUFDcEMsbUNBQW9DO0FBcUJwQzs7Ozs7R0FLRztBQUNILE1BQWEscUJBQXFCO0lBQ2hDLFlBQVksT0FBb0IsRUFBRSxPQUFxQztRQUNyRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxVQUFVLEVBQUUsR0FBRyxPQUFPLENBQUM7UUFDdEQsTUFBTSxJQUFJLEdBQUcsR0FBRyxXQUFXLElBQUksUUFBUSxFQUFFLENBQUM7UUFDMUMsTUFBTSxXQUFXLEdBQUcsR0FBRyxRQUFRLFNBQVMsQ0FBQztRQUN6QyxNQUFNLE9BQU8sR0FBRyxHQUFHLFFBQVEsS0FBSyxDQUFDO1FBQ2pDLE1BQU0sVUFBVSxHQUFHLEdBQUcsUUFBUSxRQUFRLENBQUM7UUFDdkMsTUFBTSxzQkFBc0IsR0FBRyxHQUFHLFFBQVEscUJBQXFCLENBQUM7UUFDaEUsTUFBTSxrQkFBa0IsR0FBRyxHQUFHLFFBQVEsaUJBQWlCLENBQUM7UUFDeEQsTUFBTSxZQUFZLEdBQUcsR0FBRyxRQUFRLFVBQVUsQ0FBQztRQUMzQyxNQUFNLFlBQVksR0FBRyxHQUFHLFFBQVEsVUFBVSxDQUFDO1FBRTNDLElBQUksbUJBQVUsQ0FBQyxPQUFPLEVBQUUsNEJBQTRCLE9BQU8sT0FBTyxFQUFFO1lBQ2xFLFFBQVEsRUFBRTs7TUFFVixJQUFBLG1CQUFVLEdBQUU7UUFDVixPQUFPOzs7OzJCQUlZLFlBQVk7V0FDNUIsV0FBVzs7Q0FFckI7U0FDSSxDQUFDLENBQUM7UUFFSCxJQUFJLG1CQUFVLENBQUMsT0FBTyxFQUFFLDJCQUEyQixXQUFXLE9BQU8sRUFBRTtZQUNyRSxRQUFRLEVBQUU7O01BRVYsSUFBQSxtQkFBVSxHQUFFO1FBQ1YsV0FBVzs7Ozs7Q0FLbEI7U0FDSSxDQUFDLENBQUM7UUFFSCxLQUFLLE1BQU0sSUFBSSxJQUFJLENBQUMsVUFBVSxFQUFFLHNCQUFzQixFQUFFLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztZQUM1RSxJQUFJLG1CQUFVLENBQUMsT0FBTyxFQUFFLHdCQUF3QixJQUFJLE9BQU8sRUFBRTtnQkFDM0QsUUFBUSxFQUFFOztNQUVaLElBQUEsbUJBQVUsR0FBRTtRQUNWLElBQUk7Ozs7O0NBS1g7YUFDTSxDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsSUFBSSxtQkFBVSxDQUFDLE9BQU8sRUFBRSxrQ0FBa0MsWUFBWSxPQUFPLEVBQUU7WUFDN0UsUUFBUSxFQUFFOztNQUVWLElBQUEsbUJBQVUsR0FBRTtRQUNWLFlBQVk7Ozs7Ozs7Ozs7Ozs7Ozs7OztZQWtCUixJQUFJLGNBQWMsV0FBVzs7WUFFN0IsV0FBVzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O3NEQXdLK0Isa0JBQWtCOzs7Ozs7Ozs7Ozs7Ozt1Q0FjakMsT0FBTztrQkFDNUIsSUFBSTsyQ0FDcUIsVUFBVTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0NBaUNwRDtTQUNJLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQXhTRCxzREF3U0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyByYW5kb21VVUlEIH0gZnJvbSAnY3J5cHRvJztcbmltcG9ydCB7IFNhbXBsZUZpbGUgfSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHsgTm9kZVByb2plY3QgfSBmcm9tICdwcm9qZW4vbGliL2phdmFzY3JpcHQnO1xuXG5leHBvcnQgaW50ZXJmYWNlIFNvZnR3YXJlRmFjdG9yeU1vZGVsc09wdGlvbnMge1xuICAvKipcbiAgICogVGhlIGJhcmUgcmVwbyBuYW1lIChlLmcuIGBleHBlbnNlLXRyYWNrZXJgKSwgdXNlZCB0byBkZXJpdmUgbW9kZWwgbmFtZXNcbiAgICogbGlrZSBgPHJlcG9OYW1lPi1mYWN0b3J5YCwgYDxyZXBvTmFtZT4tc2hlbGxgLCBgPHJlcG9OYW1lPi1zZWNyZXRzYC5cbiAgICovXG4gIHJlYWRvbmx5IHJlcG9OYW1lOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBHaXRIdWIgb3JnIHRoZSByZXBvIGxpdmVzIGluLlxuICAgKi9cbiAgcmVhZG9ubHkgZ2l0aHViT3duZXI6IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIGJyYW5jaCB0aGUgZmFjdG9yeSBvcGVucyBwdWxsIHJlcXVlc3RzIGFnYWluc3QuXG4gICAqL1xuICByZWFkb25seSBiYXNlQnJhbmNoOiBzdHJpbmc7XG59XG5cbi8qKlxuICogU2VlZCBzd2FtcCBtb2RlbCBpbnN0YW5jZXMgd2lyaW5nIHRoZSBgQHN3YW1wL3NvZnR3YXJlLWZhY3RvcnlgIHN0YXRlXG4gKiBtYWNoaW5lIHRvIHRoaXMgcmVwbydzIEdpdEh1YiBpc3N1ZXMvUFJzIGFuZCBzaGVsbCBzdGVwcy4gVGhlc2UgYXJlXG4gKiBgU2FtcGxlRmlsZWBzICh3cml0dGVuIG9uY2UsIHRoZW4gb3duZWQgYnkgdGhlIHRlYW0pIHNpbmNlIHRoZSBmYWN0b3J5J3NcbiAqIHN0YWdlcy9nYXRlcyBhcmUgdGhlIGtpbmQgb2YgdGhpbmcgYSB0ZWFtIHR1bmVzIGZvciBpdHMgb3duIHdvcmtmbG93LlxuICovXG5leHBvcnQgY2xhc3MgU29mdHdhcmVGYWN0b3J5TW9kZWxzIHtcbiAgY29uc3RydWN0b3IocHJvamVjdDogTm9kZVByb2plY3QsIG9wdGlvbnM6IFNvZnR3YXJlRmFjdG9yeU1vZGVsc09wdGlvbnMpIHtcbiAgICBjb25zdCB7IHJlcG9OYW1lLCBnaXRodWJPd25lciwgYmFzZUJyYW5jaCB9ID0gb3B0aW9ucztcbiAgICBjb25zdCByZXBvID0gYCR7Z2l0aHViT3duZXJ9LyR7cmVwb05hbWV9YDtcbiAgICBjb25zdCBpc3N1ZXNNb2RlbCA9IGAke3JlcG9OYW1lfS1pc3N1ZXNgO1xuICAgIGNvbnN0IHByTW9kZWwgPSBgJHtyZXBvTmFtZX0tcHJgO1xuICAgIGNvbnN0IHNoZWxsTW9kZWwgPSBgJHtyZXBvTmFtZX0tc2hlbGxgO1xuICAgIGNvbnN0IHNoZWxsQXJjaGl0ZWN0dXJlTW9kZWwgPSBgJHtyZXBvTmFtZX0tc2hlbGwtYXJjaGl0ZWN0dXJlYDtcbiAgICBjb25zdCBzaGVsbE1hbmlmZXN0TW9kZWwgPSBgJHtyZXBvTmFtZX0tc2hlbGwtbWFuaWZlc3RgO1xuICAgIGNvbnN0IHNlY3JldHNWYXVsdCA9IGAke3JlcG9OYW1lfS1zZWNyZXRzYDtcbiAgICBjb25zdCBmYWN0b3J5TW9kZWwgPSBgJHtyZXBvTmFtZX0tZmFjdG9yeWA7XG5cbiAgICBuZXcgU2FtcGxlRmlsZShwcm9qZWN0LCBgbW9kZWxzL0Bnb29kY3JhZnQvZ2l0aHViLyR7cHJNb2RlbH0ueWFtbGAsIHtcbiAgICAgIGNvbnRlbnRzOiBgdHlwZTogJ0Bnb29kY3JhZnQvZ2l0aHViJ1xudHlwZVZlcnNpb246IDIwMjYuMDYuMTQuMVxuaWQ6ICR7cmFuZG9tVVVJRCgpfVxubmFtZTogJHtwck1vZGVsfVxudmVyc2lvbjogMVxudGFnczoge31cbmdsb2JhbEFyZ3VtZW50czpcbiAgdG9rZW46ICdcXCR7eyB2YXVsdC5nZXQoJHtzZWNyZXRzVmF1bHR9LCBHSVRIVUJfVE9LRU4pIH19J1xuICBvd25lcjogJHtnaXRodWJPd25lcn1cbm1ldGhvZHM6IHt9XG5gLFxuICAgIH0pO1xuXG4gICAgbmV3IFNhbXBsZUZpbGUocHJvamVjdCwgYG1vZGVscy9Ad2ViZnJhbXAvZ2l0aHViLyR7aXNzdWVzTW9kZWx9LnlhbWxgLCB7XG4gICAgICBjb250ZW50czogYHR5cGU6ICdAd2ViZnJhbXAvZ2l0aHViJ1xudHlwZVZlcnNpb246IDIwMjYuMDguMjguMVxuaWQ6ICR7cmFuZG9tVVVJRCgpfVxubmFtZTogJHtpc3N1ZXNNb2RlbH1cbnZlcnNpb246IDFcbnRhZ3M6IHt9XG5nbG9iYWxBcmd1bWVudHM6IHt9XG5tZXRob2RzOiB7fVxuYCxcbiAgICB9KTtcblxuICAgIGZvciAoY29uc3QgbmFtZSBvZiBbc2hlbGxNb2RlbCwgc2hlbGxBcmNoaXRlY3R1cmVNb2RlbCwgc2hlbGxNYW5pZmVzdE1vZGVsXSkge1xuICAgICAgbmV3IFNhbXBsZUZpbGUocHJvamVjdCwgYG1vZGVscy9jb21tYW5kL3NoZWxsLyR7bmFtZX0ueWFtbGAsIHtcbiAgICAgICAgY29udGVudHM6IGB0eXBlOiBjb21tYW5kL3NoZWxsXG50eXBlVmVyc2lvbjogMjAyNi4wMi4wOS4xXG5pZDogJHtyYW5kb21VVUlEKCl9XG5uYW1lOiAke25hbWV9XG52ZXJzaW9uOiAxXG50YWdzOiB7fVxuZ2xvYmFsQXJndW1lbnRzOiB7fVxubWV0aG9kczoge31cbmAsXG4gICAgICB9KTtcbiAgICB9XG5cbiAgICBuZXcgU2FtcGxlRmlsZShwcm9qZWN0LCBgbW9kZWxzL0Bzd2FtcC9zb2Z0d2FyZS1mYWN0b3J5LyR7ZmFjdG9yeU1vZGVsfS55YW1sYCwge1xuICAgICAgY29udGVudHM6IGB0eXBlOiAnQHN3YW1wL3NvZnR3YXJlLWZhY3RvcnknXG50eXBlVmVyc2lvbjogMjAyNi4wNi4yNC4xXG5pZDogJHtyYW5kb21VVUlEKCl9XG5uYW1lOiAke2ZhY3RvcnlNb2RlbH1cbnZlcnNpb246IDFcbnRhZ3M6IHt9XG5yZXBvcnRzOlxuICByZXF1aXJlOlxuICAgIC0gbmFtZTogXCJAc3dhbXAvc29mdHdhcmUtZmFjdG9yeS93b3JrLWl0ZW0tc3VtbWFyeVwiXG4gICAgICBtZXRob2RzOiBbc3VtbWFyeV1cbmdsb2JhbEFyZ3VtZW50czpcbiAgc3RhZ2VzOlxuICAgIC0gaWQ6IGludGFrZVxuICAgICAgaW5pdGlhbDogdHJ1ZVxuICAgICAgZGVzY3JpcHRpb246ID4tXG4gICAgICAgIEZldGNoIHRoZSBHaXRIdWIgaXNzdWUgZm9yIHRoaXMgd29yayBpdGVtICh3b3JrSXRlbSBpcyB0aGUgYmFyZVxuICAgICAgICBpc3N1ZSBudW1iZXIpIGFuZCByZWNvcmQgaXRzIGNvbnRleHQuXG4gICAgICB3b3JrOlxuICAgICAgICBtb2RlOiBpbnRlcmFjdGl2ZVxuICAgICAgICBzeXN0ZW1Qcm9tcHQ6ID4tXG4gICAgICAgICAgRmV0Y2ggdGhlIEdpdEh1YiBpc3N1ZSBudW1iZXJlZCBcXCR7eyBzZWxmLndvcmtJdGVtIH19IGZvclxuICAgICAgICAgICR7cmVwb30gdXNpbmcgdGhlICR7aXNzdWVzTW9kZWx9IG1vZGVsXG4gICAgICAgICAgKGxpc3RfaXNzdWVzLCB0aGVuIHN3YW1wIGRhdGEgcXVlcnkgZmlsdGVyZWQgYnkgbnVtYmVyIOKAlCBzZWUgdGhlXG4gICAgICAgICAgJHtpc3N1ZXNNb2RlbH0gZGF0YSksIGFuZCByZWNvcmQgdGhlIGlzc3VlLWNvbnRleHQgYXJ0aWZhY3QuXG4gICAgICBhcnRpZmFjdHM6XG4gICAgICAgIC0gbmFtZTogaXNzdWUtY29udGV4dFxuICAgICAgICAgIHNjaGVtYTpcbiAgICAgICAgICAgIHR5cGU6IG9iamVjdFxuICAgICAgICAgICAgcmVxdWlyZWQ6IFtudW1iZXIsIHRpdGxlLCB1cmxdXG4gICAgICAgICAgICBwcm9wZXJ0aWVzOlxuICAgICAgICAgICAgICBudW1iZXI6IHsgdHlwZTogaW50ZWdlciB9XG4gICAgICAgICAgICAgIHRpdGxlOiB7IHR5cGU6IHN0cmluZywgbWluTGVuZ3RoOiAxIH1cbiAgICAgICAgICAgICAgYm9keTogeyB0eXBlOiBzdHJpbmcgfVxuICAgICAgICAgICAgICB1cmw6IHsgdHlwZTogc3RyaW5nLCBtaW5MZW5ndGg6IDEgfVxuICAgICAgICAgICAgICBsYWJlbHM6IHsgdHlwZTogYXJyYXksIGl0ZW1zOiB7IHR5cGU6IHN0cmluZyB9IH1cbiAgICAgIHRyYW5zaXRpb25zOlxuICAgICAgICAtIG5hbWU6IHN1Ym1pdFxuICAgICAgICAgIHRvOiBwbGFubmluZ1xuICAgICAgICAgIGdhdGVzOlxuICAgICAgICAgICAgLSB0eXBlOiBhcnRpZmFjdC1leGlzdHNcbiAgICAgICAgICAgICAgY29uZmlnOiB7IGFydGlmYWN0OiBpc3N1ZS1jb250ZXh0IH1cblxuICAgIC0gaWQ6IHBsYW5uaW5nXG4gICAgICBkZXNjcmlwdGlvbjogPi1cbiAgICAgICAgVHVybiB0aGUgaXNzdWUgaW50byBhIHJlYWwgT3BlblNwZWMgY2hhbmdlIChwcm9wb3NhbCwgZGVzaWduLFxuICAgICAgICBzcGVjcywgdGFza3MpIOKAlCBPcGVuU3BlYydzIHRhc2sgbGlzdCBpcyB0aGUgcGxhbiwgbm90IGFcbiAgICAgICAgZnJlZWZvcm0gYXJ0aWZhY3QuXG4gICAgICB3b3JrOlxuICAgICAgICBtb2RlOiBpbnRlcmFjdGl2ZVxuICAgICAgICBzeXN0ZW1Qcm9tcHQ6ID4tXG4gICAgICAgICAgVXNpbmcgdGhlIHJlY29yZGVkIGlzc3VlLWNvbnRleHQgYXJ0aWZhY3QsIHVzZSB0aGVcbiAgICAgICAgICBvcGVuc3BlYy1wcm9wb3NlIHNraWxsIHRvIGNyZWF0ZSBhIGNvbXBsZXRlIE9wZW5TcGVjIGNoYW5nZVxuICAgICAgICAgIChwcm9wb3NhbC5tZCwgZGVzaWduLm1kLCBzcGVjcyB3aXRoIGRlbHRhcywgdGFza3MubWQpIGZvciB0aGlzXG4gICAgICAgICAgd29yayBpdGVtIHVuZGVyIG9wZW5zcGVjL2NoYW5nZXMvPGNoYW5nZVNsdWc+LyDigJQgZG8gbm90IHdyaXRlIGFcbiAgICAgICAgICBmcmVlZm9ybSBwbGFuIGluc3RlYWQgb2YgdGhpcy4gVGhlbiByZWNvcmQgdGhlIHBsYW4gYXJ0aWZhY3RcbiAgICAgICAgICB3aXRoIHRoZSBjaGFuZ2UncyBzbHVnIGFuZCBhIG9uZS1saW5lIHN1bW1hcnkuXG4gICAgICBhcnRpZmFjdHM6XG4gICAgICAgIC0gbmFtZTogcGxhblxuICAgICAgICAgIHNjaGVtYTpcbiAgICAgICAgICAgIHR5cGU6IG9iamVjdFxuICAgICAgICAgICAgcmVxdWlyZWQ6IFtjaGFuZ2VTbHVnLCBzdW1tYXJ5XVxuICAgICAgICAgICAgcHJvcGVydGllczpcbiAgICAgICAgICAgICAgY2hhbmdlU2x1ZzogeyB0eXBlOiBzdHJpbmcsIG1pbkxlbmd0aDogMSB9XG4gICAgICAgICAgICAgIHN1bW1hcnk6IHsgdHlwZTogc3RyaW5nLCBtaW5MZW5ndGg6IDEgfVxuICAgICAgdHJhbnNpdGlvbnM6XG4gICAgICAgIC0gbmFtZTogc3VibWl0XG4gICAgICAgICAgdG86IG9wZW5zcGVjLXBsYW4tdmVyaWZ5XG4gICAgICAgICAgZ2F0ZXM6XG4gICAgICAgICAgICAtIHR5cGU6IGFydGlmYWN0LWV4aXN0c1xuICAgICAgICAgICAgICBjb25maWc6IHsgYXJ0aWZhY3Q6IHBsYW4gfVxuXG4gICAgLSBpZDogb3BlbnNwZWMtcGxhbi12ZXJpZnlcbiAgICAgIGRlc2NyaXB0aW9uOiA+LVxuICAgICAgICBWZXJpZnkgdGhlIE9wZW5TcGVjIGNoYW5nZSBpcyByZWFsIGFuZCB3ZWxsLWZvcm1lZCAobm90IGp1c3QgYW5cbiAgICAgICAgYXJ0aWZhY3QgY2xhaW1pbmcgb25lIGV4aXN0cykgYmVmb3JlIGltcGxlbWVudGF0aW9uIHN0YXJ0cy5cbiAgICAgIHdvcms6XG4gICAgICAgIG1vZGU6IHdvcmtmbG93XG4gICAgICAgIHdvcmtmbG93OlxuICAgICAgICAgIG5hbWU6IG9wZW5zcGVjLXBsYW4tdmVyaWZ5XG4gICAgICAgICAgaW5wdXRzOlxuICAgICAgICAgICAgY2hhbmdlU2x1ZzogJ1xcJHt7IGRhdGEubGF0ZXN0KHNlbGYubmFtZSwgXCJhcnRpZmFjdC1wbGFuXCIpLnBheWxvYWQuY2hhbmdlU2x1ZyB9fSdcbiAgICAgICAgcmVzdWx0RXZpZGVuY2U6IHBsYW4tdmVyaWZ5LXJ1blxuICAgICAgdHJhbnNpdGlvbnM6XG4gICAgICAgIC0gbmFtZTogcGFzc1xuICAgICAgICAgIHRvOiBpbXBsZW1lbnRpbmdcbiAgICAgICAgICBnYXRlczpcbiAgICAgICAgICAgIC0gdHlwZTogd29ya2Zsb3ctc3VjY2VlZGVkXG4gICAgICAgICAgICAgIGNvbmZpZzogeyB3b3JrZmxvdzogb3BlbnNwZWMtcGxhbi12ZXJpZnkgfVxuICAgICAgICAtIG5hbWU6IGZhaWxcbiAgICAgICAgICB0bzogcGxhbm5pbmdcbiAgICAgICAgICBnYXRlczpcbiAgICAgICAgICAgIC0gdHlwZTogZXZpZGVuY2UtcmVjb3JkZWRcbiAgICAgICAgICAgICAgY29uZmlnOiB7IG5hbWU6IHBsYW4tdmVyaWZ5LXJ1biwgcmVxdWlyZUZpZWxkOiB7IHN0YXR1czogZmFpbGVkIH0gfVxuXG4gICAgLSBpZDogaW1wbGVtZW50aW5nXG4gICAgICBkZXNjcmlwdGlvbjogSW1wbGVtZW50IHRoZSBPcGVuU3BlYyBjaGFuZ2UncyB0YXNrcyBvbiBhIGJyYW5jaC5cbiAgICAgIHdvcms6XG4gICAgICAgIG1vZGU6IGludGVyYWN0aXZlXG4gICAgICAgIHN5c3RlbVByb21wdDogPi1cbiAgICAgICAgICBVc2UgdGhlIG9wZW5zcGVjLWFwcGx5LWNoYW5nZSBza2lsbCBhZ2FpbnN0IHRoZSBjaGFuZ2UgcmVjb3JkZWRcbiAgICAgICAgICBpbiB0aGUgcGxhbiBhcnRpZmFjdCdzIGNoYW5nZVNsdWcg4oCUIHdvcmsgdGhyb3VnaCBpdHMgdGFza3MubWRcbiAgICAgICAgICBvbmUgdGFzayBhdCBhIHRpbWUsIGNoZWNraW5nIGVhY2ggb2ZmIChcXGAtIFsgXVxcYCAtPiBcXGAtIFt4XVxcYCkgYXNcbiAgICAgICAgICB5b3UgY29tcGxldGUgaXQsIHVudGlsIGV2ZXJ5IHRhc2sgaXMgZG9uZS4gQ29tbWl0IHRoZSB3b3JrIG9uIGFcbiAgICAgICAgICBmZWF0dXJlIGJyYW5jaC4gUmVjb3JkIHRoZSBjaGFuZ2Utc3VtbWFyeSBhcnRpZmFjdCBhbmQgdGhlXG4gICAgICAgICAgY2hhbmdlLXJlcXVlc3QgZXZpZGVuY2UgKGJyYW5jaCBuYW1lIGFuZCBoZWFkIGNvbW1pdCBzaGEg4oCUIG5vXG4gICAgICAgICAgUFIgeWV0LCB0aGF0IGhhcHBlbnMgYWZ0ZXIgcHJlLVBSIHZlcmlmaWNhdGlvbiBwYXNzZXMpLlxuICAgICAgYXJ0aWZhY3RzOlxuICAgICAgICAtIG5hbWU6IGNoYW5nZS1zdW1tYXJ5XG4gICAgICAgICAgc2NoZW1hOlxuICAgICAgICAgICAgdHlwZTogb2JqZWN0XG4gICAgICAgICAgICByZXF1aXJlZDogW3N1bW1hcnksIGhlYWRTaGFdXG4gICAgICAgICAgICBwcm9wZXJ0aWVzOlxuICAgICAgICAgICAgICBzdW1tYXJ5OiB7IHR5cGU6IHN0cmluZywgbWluTGVuZ3RoOiAxIH1cbiAgICAgICAgICAgICAgaGVhZFNoYTogeyB0eXBlOiBzdHJpbmcsIG1pbkxlbmd0aDogNyB9XG4gICAgICBldmlkZW5jZTpcbiAgICAgICAgLSBuYW1lOiBjaGFuZ2UtcmVxdWVzdFxuICAgICAgICAgIHNjaGVtYTpcbiAgICAgICAgICAgIHR5cGU6IG9iamVjdFxuICAgICAgICAgICAgcmVxdWlyZWQ6IFticmFuY2gsIGhlYWRTaGFdXG4gICAgICAgICAgICBwcm9wZXJ0aWVzOlxuICAgICAgICAgICAgICBicmFuY2g6IHsgdHlwZTogc3RyaW5nLCBtaW5MZW5ndGg6IDEgfVxuICAgICAgICAgICAgICBoZWFkU2hhOiB7IHR5cGU6IHN0cmluZywgbWluTGVuZ3RoOiA3IH1cbiAgICAgICAgICAgICAgdXJsOiB7IHR5cGU6IHN0cmluZyB9XG4gICAgICB0cmFuc2l0aW9uczpcbiAgICAgICAgLSBuYW1lOiBzdWJtaXRcbiAgICAgICAgICB0bzogb3BlbnNwZWMtdGFza3MtdmVyaWZ5XG4gICAgICAgICAgZ2F0ZXM6XG4gICAgICAgICAgICAtIHR5cGU6IGFydGlmYWN0LWV4aXN0c1xuICAgICAgICAgICAgICBjb25maWc6IHsgYXJ0aWZhY3Q6IGNoYW5nZS1zdW1tYXJ5IH1cbiAgICAgICAgICAgIC0gdHlwZTogZXZpZGVuY2UtcmVjb3JkZWRcbiAgICAgICAgICAgICAgY29uZmlnOiB7IG5hbWU6IGNoYW5nZS1yZXF1ZXN0IH1cblxuICAgIC0gaWQ6IG9wZW5zcGVjLXRhc2tzLXZlcmlmeVxuICAgICAgZGVzY3JpcHRpb246ID4tXG4gICAgICAgIFZlcmlmeSBldmVyeSB0YXNrIGluIHRoZSBPcGVuU3BlYyBjaGFuZ2UgaXMgYWN0dWFsbHkgY2hlY2tlZCBvZmZcbiAgICAgICAgYmVmb3JlIHByZS1QUiB2ZXJpZmljYXRpb24gcnVucy5cbiAgICAgIHdvcms6XG4gICAgICAgIG1vZGU6IHdvcmtmbG93XG4gICAgICAgIHdvcmtmbG93OlxuICAgICAgICAgIG5hbWU6IG9wZW5zcGVjLXRhc2tzLXZlcmlmeVxuICAgICAgICAgIGlucHV0czpcbiAgICAgICAgICAgIGNoYW5nZVNsdWc6ICdcXCR7eyBkYXRhLmxhdGVzdChzZWxmLm5hbWUsIFwiYXJ0aWZhY3QtcGxhblwiKS5wYXlsb2FkLmNoYW5nZVNsdWcgfX0nXG4gICAgICAgIHJlc3VsdEV2aWRlbmNlOiB0YXNrcy12ZXJpZnktcnVuXG4gICAgICB0cmFuc2l0aW9uczpcbiAgICAgICAgLSBuYW1lOiBwYXNzXG4gICAgICAgICAgdG86IHByZS1wci12ZXJpZnlcbiAgICAgICAgICBnYXRlczpcbiAgICAgICAgICAgIC0gdHlwZTogd29ya2Zsb3ctc3VjY2VlZGVkXG4gICAgICAgICAgICAgIGNvbmZpZzogeyB3b3JrZmxvdzogb3BlbnNwZWMtdGFza3MtdmVyaWZ5IH1cbiAgICAgICAgLSBuYW1lOiBmYWlsXG4gICAgICAgICAgdG86IGltcGxlbWVudGluZ1xuICAgICAgICAgIGdhdGVzOlxuICAgICAgICAgICAgLSB0eXBlOiBldmlkZW5jZS1yZWNvcmRlZFxuICAgICAgICAgICAgICBjb25maWc6IHsgbmFtZTogdGFza3MtdmVyaWZ5LXJ1biwgcmVxdWlyZUZpZWxkOiB7IHN0YXR1czogZmFpbGVkIH0gfVxuXG4gICAgLSBpZDogcHJlLXByLXZlcmlmeVxuICAgICAgZGVzY3JpcHRpb246ID4tXG4gICAgICAgIFByZS1QUiB2ZXJpZmljYXRpb246IGJ1aWxkL3N5bnRoL3Rlc3QvbGludCBwbHVzIHRoZSBhcmNoaXRlY3R1cmVcbiAgICAgICAgcnVsZSByZWdpc3RyeSwgcnVuIGJlZm9yZSB0aGUgUFIgaXMgb3BlbmVkIHJhdGhlciB0aGFuIHJlbHlpbmcgb25cbiAgICAgICAgQ0kgYWZ0ZXIgdGhlIGZhY3QuXG4gICAgICB3b3JrOlxuICAgICAgICBtb2RlOiB3b3JrZmxvd1xuICAgICAgICB3b3JrZmxvdzpcbiAgICAgICAgICBuYW1lOiBwcmUtcHItdmVyaWZ5XG4gICAgICAgICAgaW5wdXRzOlxuICAgICAgICAgICAgY29tbWl0OiAnXFwke3sgZGF0YS5sYXRlc3Qoc2VsZi5uYW1lLCBcImV2aWRlbmNlLWNoYW5nZS1yZXF1ZXN0XCIpLnBheWxvYWQuaGVhZFNoYSB9fSdcbiAgICAgICAgICAgIGJyYW5jaDogJ1xcJHt7IGRhdGEubGF0ZXN0KHNlbGYubmFtZSwgXCJldmlkZW5jZS1jaGFuZ2UtcmVxdWVzdFwiKS5wYXlsb2FkLmJyYW5jaCB9fSdcbiAgICAgICAgcmVzdWx0RXZpZGVuY2U6IHZlcmlmeS1ydW5cbiAgICAgIHRyYW5zaXRpb25zOlxuICAgICAgICAtIG5hbWU6IHBhc3NcbiAgICAgICAgICB0bzogb3Blbi1wclxuICAgICAgICAgIGdhdGVzOlxuICAgICAgICAgICAgLSB0eXBlOiB3b3JrZmxvdy1zdWNjZWVkZWRcbiAgICAgICAgICAgICAgY29uZmlnOiB7IHdvcmtmbG93OiBwcmUtcHItdmVyaWZ5IH1cbiAgICAgICAgLSBuYW1lOiBmYWlsXG4gICAgICAgICAgdG86IGltcGxlbWVudGluZ1xuICAgICAgICAgIGdhdGVzOlxuICAgICAgICAgICAgLSB0eXBlOiBldmlkZW5jZS1yZWNvcmRlZFxuICAgICAgICAgICAgICBjb25maWc6IHsgbmFtZTogdmVyaWZ5LXJ1biwgcmVxdWlyZUZpZWxkOiB7IHN0YXR1czogZmFpbGVkIH0gfVxuXG4gICAgLSBpZDogb3Blbi1wclxuICAgICAgZGVzY3JpcHRpb246IE9wZW4gdGhlIHB1bGwgcmVxdWVzdCBub3cgdGhhdCBwcmUtUFIgdmVyaWZpY2F0aW9uIGhhcyBwYXNzZWQuXG4gICAgICB3b3JrOlxuICAgICAgICBtb2RlOiBpbnRlcmFjdGl2ZVxuICAgICAgICBzeXN0ZW1Qcm9tcHQ6ID4tXG4gICAgICAgICAgQmVmb3JlIG9wZW5pbmcgdGhlIFBSLCBmZXRjaCB0aGUgcmVhbCBwcmUtcHItdmVyaWZ5IGF0dGVzdGF0aW9uXG4gICAgICAgICAgd2l0aCBcXGBzd2FtcCBkYXRhIGdldCAtLXdvcmtmbG93IHByZS1wci12ZXJpZnlcbiAgICAgICAgICByZXBvcnQtc3dhbXAtdmVyaWZpY2F0aW9uLWF0dGVzdGF0aW9uIC0tanNvblxcYCBhbmQgaW5jbHVkZSBpdHNcbiAgICAgICAgICBcXGBjb250ZW50XFxgIHZlcmJhdGltIChhcyBhIG1hcmtkb3duIGJsb2NrLCBlLmcuIHVuZGVyIGEgXCJQcmUtUFJcbiAgICAgICAgICB2ZXJpZmljYXRpb25cIiBoZWFkaW5nKSBpbiB0aGUgUFIgYm9keSDigJQgbmV2ZXIganVzdCBhc3NlcnQgaW5cbiAgICAgICAgICBwcm9zZSB0aGF0IGNoZWNrcyBwYXNzZWQuIEFsc28gZmV0Y2ggdGhpcyBzYW1lIHJ1bidzIG1hbmlmZXN0IHN0ZXBcbiAgICAgICAgICBvdXRwdXQgKFxcYHN3YW1wIGRhdGEgcXVlcnkgJ21vZGVsTmFtZSA9PSBcIiR7c2hlbGxNYW5pZmVzdE1vZGVsfVwiICYmXG4gICAgICAgICAgbmFtZSA9PSBcInJlc3VsdFwiJyAtLXNlbGVjdCBhdHRyaWJ1dGVzLnN0ZG91dCAtLWpzb25cXGAsIHRha2UgdGhlXG4gICAgICAgICAgbGF0ZXN0KSBhbmQgYXBwZW5kIGl0IHRvIHRoZSBQUiBib2R5IGFzXG4gICAgICAgICAgXFxgPCEtLSBhdHRlc3RhdGlvbi1tYW5pZmVzdCB7XCJjb21taXRcIjogXCI8aGVhZFNoYT5cIiwgXCJzdGF0dXNcIjpcbiAgICAgICAgICBcInN1Y2NlZWRlZFwiLCAuLi50aGUgbWFuaWZlc3Qgc3RlcCdzIEpTT04sIHNwcmVhZCBpbi4uLn0gLS0+XFxgIOKAlCBhblxuICAgICAgICAgIEhUTUwgY29tbWVudCBzbyBpdCdzIGludmlzaWJsZSB3aGVuIHJlbmRlcmVkIGJ1dCBzdGlsbCBwcmVzZW50IGluXG4gICAgICAgICAgdGhlIHJhdyBib2R5IHRleHQgdmVyaWZ5LWF0dGVzdGF0aW9uLnltbCByZWFkcyB2aWEgdGhlIEdpdEh1YiBBUEkuXG4gICAgICAgICAgQWxzbyBmZXRjaCB0aGUgcGxhbiBhcnRpZmFjdCdzIGNoYW5nZVNsdWcgYW5kIGluY2x1ZGUgYW4gZXhwbGljaXRcbiAgICAgICAgICBcIk9wZW5TcGVjIGNoYW5nZVwiIGxpbmUgaW4gdGhlIFBSIGJvZHkgbmFtaW5nIGl0IGFuZCBpdHMgcGF0aFxuICAgICAgICAgIChcXGBvcGVuc3BlYy9jaGFuZ2VzLzxjaGFuZ2VTbHVnPi9cXGApIOKAlCBldmVyeSBQUiB0aGUgZmFjdG9yeSBvcGVuc1xuICAgICAgICAgIG11c3QgY2FsbCBvdXQgd2hpY2ggT3BlblNwZWMgY2hhbmdlKHMpIGRyb3ZlIHRoZSBzZXNzaW9uLCBub3RcbiAgICAgICAgICBqdXN0IGltcGx5IGl0LiBJZiBwbGFubmluZyBjeWNsZWQgdGhyb3VnaCBtb3JlIHRoYW4gb25lIGNoYW5nZVxuICAgICAgICAgIChhIHJld29yayBsb29wIHByb2R1Y2VkIGEgbmV3IGNoYW5nZVNsdWcpLCBsaXN0IGV2ZXJ5IGRpc3RpbmN0XG4gICAgICAgICAgY2hhbmdlU2x1ZyByZWNvcmRlZCBhY3Jvc3MgdGhlIHJ1bidzIHBsYW4gYXJ0aWZhY3QgdmVyc2lvbnMsIG5vdFxuICAgICAgICAgIG9ubHkgdGhlIGxhdGVzdC4gVGhlbiBjYWxsICR7cHJNb2RlbH0ncyBvcGVuUHIgbWV0aG9kXG4gICAgICAgICAgKHJlcG89JHtyZXBvfSwgaGVhZD08dGhlIGJyYW5jaCByZWNvcmRlZCBpblxuICAgICAgICAgIGNoYW5nZS1yZXF1ZXN0IGV2aWRlbmNlPiwgYmFzZT0ke2Jhc2VCcmFuY2h9LCBkcnlSdW49ZmFsc2UpLCB3aXRoXG4gICAgICAgICAgdGl0bGUvYm9keSByZWZlcmVuY2luZyB0aGUgaW50YWtlIHN0YWdlJ3MgaXNzdWUgbnVtYmVyLCB0aGVcbiAgICAgICAgICBPcGVuU3BlYyBjaGFuZ2UocyksIHRoZSBhdHRlc3RhdGlvbiBibG9jaywgYW5kIHRoZSBtYW5pZmVzdFxuICAgICAgICAgIGNvbW1lbnQsIHRoZW4gcmVjb3JkIHRoZSBwci1vcGVuZWQgZXZpZGVuY2Ugd2l0aCB0aGUgcmV0dXJuZWQgUFJcbiAgICAgICAgICB1cmwgYW5kIG51bWJlci5cbiAgICAgIGV2aWRlbmNlOlxuICAgICAgICAtIG5hbWU6IHByLW9wZW5lZFxuICAgICAgICAgIHNjaGVtYTpcbiAgICAgICAgICAgIHR5cGU6IG9iamVjdFxuICAgICAgICAgICAgcmVxdWlyZWQ6IFt1cmwsIG51bWJlcl1cbiAgICAgICAgICAgIHByb3BlcnRpZXM6XG4gICAgICAgICAgICAgIHVybDogeyB0eXBlOiBzdHJpbmcsIG1pbkxlbmd0aDogMSB9XG4gICAgICAgICAgICAgIG51bWJlcjogeyB0eXBlOiBpbnRlZ2VyIH1cbiAgICAgIHRyYW5zaXRpb25zOlxuICAgICAgICAtIG5hbWU6IHN1Ym1pdFxuICAgICAgICAgIHRvOiBkb25lXG4gICAgICAgICAgZ2F0ZXM6XG4gICAgICAgICAgICAtIHR5cGU6IGV2aWRlbmNlLXJlY29yZGVkXG4gICAgICAgICAgICAgIGNvbmZpZzogeyBuYW1lOiBwci1vcGVuZWQgfVxuXG4gICAgLSBpZDogZG9uZVxuICAgICAgdGVybWluYWw6IHRydWVcblxuICAgIC0gaWQ6IGFib3J0ZWRcbiAgICAgIHRlcm1pbmFsOiB0cnVlXG5cbiAgZ2xvYmFsVHJhbnNpdGlvbnM6XG4gICAgLSBuYW1lOiBhYm9ydFxuICAgICAgdG86IGFib3J0ZWRcbiAgICAgIGdhdGVzOlxuICAgICAgICAtIHR5cGU6IGh1bWFuLWFwcHJvdmFsXG4gICAgICAgICAgY29uZmlnOiB7IGlkOiBhYm9ydC1jb25maXJtYXRpb24gfVxubWV0aG9kczoge31cbmAsXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/SoftwareFactoryOpenSpecGates.d.ts

@@ -0,0 +1,8 @@
+import { NodeProject } from 'projen/lib/javascript';
+/**
+ * Deterministic gate: fails unless every task in the named OpenSpec change's
+ * tasks.md is checked off. Fully generic — no per-repo parameterization.
+ */
+export declare class SoftwareFactoryOpenSpecGates {
+    constructor(project: NodeProject);
+}

package/lib/SoftwareFactoryOpenSpecGates.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SoftwareFactoryOpenSpecGates = void 0;
+const projen_1 = require("projen");
+/**
+ * Deterministic gate: fails unless every task in the named OpenSpec change's
+ * tasks.md is checked off. Fully generic — no per-repo parameterization.
+ */
+class SoftwareFactoryOpenSpecGates {
+    constructor(project) {
+        new projen_1.TextFile(project, 'openspec-gates/check-tasks-complete.ts', {
+            marker: true,
+            lines: [
+                '/**',
+                ' * Gate: fails unless every task in the named OpenSpec change\'s tasks.md is',
+                ' * checked off. `openspec validate`/`openspec status` don\'t check this (an',
+                ' * in-progress change is a normal, valid state) — this is the deterministic',
+                ' * check the pre-pr pipeline needs before letting implementation proceed.',
+                ' */',
+                "import { execFileSync } from 'node:child_process';",
+                '',
+                'interface OpenSpecChangeSummary {',
+                '  name: string;',
+                '  completedTasks: number;',
+                '  totalTasks: number;',
+                '  status: string;',
+                '}',
+                '',
+                'function main(): number {',
+                '  // pnpm\'s `-- <args>` forwarding (and projen\'s receiveArgs) can pass a',
+                '  // literal "--" through as an argv token ahead of the real argument.',
+                "  const slug = process.argv.slice(2).find((arg) => arg !== '--');",
+                '  if (!slug) {',
+                "    console.error('Usage: check-tasks-complete <change-slug>');",
+                '    return 1;',
+                '  }',
+                '',
+                "  const raw = execFileSync('openspec', ['list', '--json'], { encoding: 'utf8' });",
+                '  const { changes } = JSON.parse(raw) as { changes: OpenSpecChangeSummary[] };',
+                '  const change = changes.find((c) => c.name === slug);',
+                '',
+                '  if (!change) {',
+                '    console.error(`OpenSpec change "${slug}" not found (openspec list --json)`);',
+                '    return 1;',
+                '  }',
+                "  if (change.status !== 'complete') {",
+                '    console.error(',
+                '      `OpenSpec change "${slug}" has incomplete tasks: ${change.completedTasks}/${change.totalTasks}`,',
+                '    );',
+                '    return 1;',
+                '  }',
+                '',
+                '  console.log(`OpenSpec change "${slug}": all ${change.totalTasks} tasks complete`);',
+                '  return 0;',
+                '}',
+                '',
+                'process.exit(main());',
+            ],
+        });
+        new projen_1.JsonFile(project, 'openspec-gates/tsconfig.json', {
+            marker: false,
+            obj: {
+                extends: '../tsconfig.json',
+                compilerOptions: {
+                    noEmit: true,
+                    rootDir: '.',
+                },
+                include: ['*.ts'],
+                exclude: ['node_modules'],
+            },
+        });
+    }
+}
+exports.SoftwareFactoryOpenSpecGates = SoftwareFactoryOpenSpecGates;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU29mdHdhcmVGYWN0b3J5T3BlblNwZWNHYXRlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9Tb2Z0d2FyZUZhY3RvcnlPcGVuU3BlY0dhdGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUE0QztBQUc1Qzs7O0dBR0c7QUFDSCxNQUFhLDRCQUE0QjtJQUN2QyxZQUFZLE9BQW9CO1FBQzlCLElBQUksaUJBQVEsQ0FBQyxPQUFPLEVBQUUsd0NBQXdDLEVBQUU7WUFDOUQsTUFBTSxFQUFFLElBQUk7WUFDWixLQUFLLEVBQUU7Z0JBQ0wsS0FBSztnQkFDTCw4RUFBOEU7Z0JBQzlFLDZFQUE2RTtnQkFDN0UsNkVBQTZFO2dCQUM3RSwyRUFBMkU7Z0JBQzNFLEtBQUs7Z0JBQ0wsb0RBQW9EO2dCQUNwRCxFQUFFO2dCQUNGLG1DQUFtQztnQkFDbkMsaUJBQWlCO2dCQUNqQiwyQkFBMkI7Z0JBQzNCLHVCQUF1QjtnQkFDdkIsbUJBQW1CO2dCQUNuQixHQUFHO2dCQUNILEVBQUU7Z0JBQ0YsMkJBQTJCO2dCQUMzQiw0RUFBNEU7Z0JBQzVFLHdFQUF3RTtnQkFDeEUsbUVBQW1FO2dCQUNuRSxnQkFBZ0I7Z0JBQ2hCLGlFQUFpRTtnQkFDakUsZUFBZTtnQkFDZixLQUFLO2dCQUNMLEVBQUU7Z0JBQ0YsbUZBQW1GO2dCQUNuRixnRkFBZ0Y7Z0JBQ2hGLHdEQUF3RDtnQkFDeEQsRUFBRTtnQkFDRixrQkFBa0I7Z0JBQ2xCLGtGQUFrRjtnQkFDbEYsZUFBZTtnQkFDZixLQUFLO2dCQUNMLHVDQUF1QztnQkFDdkMsb0JBQW9CO2dCQUNwQix3R0FBd0c7Z0JBQ3hHLFFBQVE7Z0JBQ1IsZUFBZTtnQkFDZixLQUFLO2dCQUNMLEVBQUU7Z0JBQ0Ysc0ZBQXNGO2dCQUN0RixhQUFhO2dCQUNiLEdBQUc7Z0JBQ0gsRUFBRTtnQkFDRix1QkFBdUI7YUFDeEI7U0FDRixDQUFDLENBQUM7UUFFSCxJQUFJLGlCQUFRLENBQUMsT0FBTyxFQUFFLDhCQUE4QixFQUFFO1lBQ3BELE1BQU0sRUFBRSxLQUFLO1lBQ2IsR0FBRyxFQUFFO2dCQUNILE9BQU8sRUFBRSxrQkFBa0I7Z0JBQzNCLGVBQWUsRUFBRTtvQkFDZixNQUFNLEVBQUUsSUFBSTtvQkFDWixPQUFPLEVBQUUsR0FBRztpQkFDYjtnQkFDRCxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7Z0JBQ2pCLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQzthQUMxQjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQWpFRCxvRUFpRUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBKc29uRmlsZSwgVGV4dEZpbGUgfSBmcm9tICdwcm9qZW4nO1xuaW1wb3J0IHsgTm9kZVByb2plY3QgfSBmcm9tICdwcm9qZW4vbGliL2phdmFzY3JpcHQnO1xuXG4vKipcbiAqIERldGVybWluaXN0aWMgZ2F0ZTogZmFpbHMgdW5sZXNzIGV2ZXJ5IHRhc2sgaW4gdGhlIG5hbWVkIE9wZW5TcGVjIGNoYW5nZSdzXG4gKiB0YXNrcy5tZCBpcyBjaGVja2VkIG9mZi4gRnVsbHkgZ2VuZXJpYyDigJQgbm8gcGVyLXJlcG8gcGFyYW1ldGVyaXphdGlvbi5cbiAqL1xuZXhwb3J0IGNsYXNzIFNvZnR3YXJlRmFjdG9yeU9wZW5TcGVjR2F0ZXMge1xuICBjb25zdHJ1Y3Rvcihwcm9qZWN0OiBOb2RlUHJvamVjdCkge1xuICAgIG5ldyBUZXh0RmlsZShwcm9qZWN0LCAnb3BlbnNwZWMtZ2F0ZXMvY2hlY2stdGFza3MtY29tcGxldGUudHMnLCB7XG4gICAgICBtYXJrZXI6IHRydWUsXG4gICAgICBsaW5lczogW1xuICAgICAgICAnLyoqJyxcbiAgICAgICAgJyAqIEdhdGU6IGZhaWxzIHVubGVzcyBldmVyeSB0YXNrIGluIHRoZSBuYW1lZCBPcGVuU3BlYyBjaGFuZ2VcXCdzIHRhc2tzLm1kIGlzJyxcbiAgICAgICAgJyAqIGNoZWNrZWQgb2ZmLiBgb3BlbnNwZWMgdmFsaWRhdGVgL2BvcGVuc3BlYyBzdGF0dXNgIGRvblxcJ3QgY2hlY2sgdGhpcyAoYW4nLFxuICAgICAgICAnICogaW4tcHJvZ3Jlc3MgY2hhbmdlIGlzIGEgbm9ybWFsLCB2YWxpZCBzdGF0ZSkg4oCUIHRoaXMgaXMgdGhlIGRldGVybWluaXN0aWMnLFxuICAgICAgICAnICogY2hlY2sgdGhlIHByZS1wciBwaXBlbGluZSBuZWVkcyBiZWZvcmUgbGV0dGluZyBpbXBsZW1lbnRhdGlvbiBwcm9jZWVkLicsXG4gICAgICAgICcgKi8nLFxuICAgICAgICBcImltcG9ydCB7IGV4ZWNGaWxlU3luYyB9IGZyb20gJ25vZGU6Y2hpbGRfcHJvY2Vzcyc7XCIsXG4gICAgICAgICcnLFxuICAgICAgICAnaW50ZXJmYWNlIE9wZW5TcGVjQ2hhbmdlU3VtbWFyeSB7JyxcbiAgICAgICAgJyAgbmFtZTogc3RyaW5nOycsXG4gICAgICAgICcgIGNvbXBsZXRlZFRhc2tzOiBudW1iZXI7JyxcbiAgICAgICAgJyAgdG90YWxUYXNrczogbnVtYmVyOycsXG4gICAgICAgICcgIHN0YXR1czogc3RyaW5nOycsXG4gICAgICAgICd9JyxcbiAgICAgICAgJycsXG4gICAgICAgICdmdW5jdGlvbiBtYWluKCk6IG51bWJlciB7JyxcbiAgICAgICAgJyAgLy8gcG5wbVxcJ3MgYC0tIDxhcmdzPmAgZm9yd2FyZGluZyAoYW5kIHByb2plblxcJ3MgcmVjZWl2ZUFyZ3MpIGNhbiBwYXNzIGEnLFxuICAgICAgICAnICAvLyBsaXRlcmFsIFwiLS1cIiB0aHJvdWdoIGFzIGFuIGFyZ3YgdG9rZW4gYWhlYWQgb2YgdGhlIHJlYWwgYXJndW1lbnQuJyxcbiAgICAgICAgXCIgIGNvbnN0IHNsdWcgPSBwcm9jZXNzLmFyZ3Yuc2xpY2UoMikuZmluZCgoYXJnKSA9PiBhcmcgIT09ICctLScpO1wiLFxuICAgICAgICAnICBpZiAoIXNsdWcpIHsnLFxuICAgICAgICBcIiAgICBjb25zb2xlLmVycm9yKCdVc2FnZTogY2hlY2stdGFza3MtY29tcGxldGUgPGNoYW5nZS1zbHVnPicpO1wiLFxuICAgICAgICAnICAgIHJldHVybiAxOycsXG4gICAgICAgICcgIH0nLFxuICAgICAgICAnJyxcbiAgICAgICAgXCIgIGNvbnN0IHJhdyA9IGV4ZWNGaWxlU3luYygnb3BlbnNwZWMnLCBbJ2xpc3QnLCAnLS1qc29uJ10sIHsgZW5jb2Rpbmc6ICd1dGY4JyB9KTtcIixcbiAgICAgICAgJyAgY29uc3QgeyBjaGFuZ2VzIH0gPSBKU09OLnBhcnNlKHJhdykgYXMgeyBjaGFuZ2VzOiBPcGVuU3BlY0NoYW5nZVN1bW1hcnlbXSB9OycsXG4gICAgICAgICcgIGNvbnN0IGNoYW5nZSA9IGNoYW5nZXMuZmluZCgoYykgPT4gYy5uYW1lID09PSBzbHVnKTsnLFxuICAgICAgICAnJyxcbiAgICAgICAgJyAgaWYgKCFjaGFuZ2UpIHsnLFxuICAgICAgICAnICAgIGNvbnNvbGUuZXJyb3IoYE9wZW5TcGVjIGNoYW5nZSBcIiR7c2x1Z31cIiBub3QgZm91bmQgKG9wZW5zcGVjIGxpc3QgLS1qc29uKWApOycsXG4gICAgICAgICcgICAgcmV0dXJuIDE7JyxcbiAgICAgICAgJyAgfScsXG4gICAgICAgIFwiICBpZiAoY2hhbmdlLnN0YXR1cyAhPT0gJ2NvbXBsZXRlJykge1wiLFxuICAgICAgICAnICAgIGNvbnNvbGUuZXJyb3IoJyxcbiAgICAgICAgJyAgICAgIGBPcGVuU3BlYyBjaGFuZ2UgXCIke3NsdWd9XCIgaGFzIGluY29tcGxldGUgdGFza3M6ICR7Y2hhbmdlLmNvbXBsZXRlZFRhc2tzfS8ke2NoYW5nZS50b3RhbFRhc2tzfWAsJyxcbiAgICAgICAgJyAgICApOycsXG4gICAgICAgICcgICAgcmV0dXJuIDE7JyxcbiAgICAgICAgJyAgfScsXG4gICAgICAgICcnLFxuICAgICAgICAnICBjb25zb2xlLmxvZyhgT3BlblNwZWMgY2hhbmdlIFwiJHtzbHVnfVwiOiBhbGwgJHtjaGFuZ2UudG90YWxUYXNrc30gdGFza3MgY29tcGxldGVgKTsnLFxuICAgICAgICAnICByZXR1cm4gMDsnLFxuICAgICAgICAnfScsXG4gICAgICAgICcnLFxuICAgICAgICAncHJvY2Vzcy5leGl0KG1haW4oKSk7JyxcbiAgICAgIF0sXG4gICAgfSk7XG5cbiAgICBuZXcgSnNvbkZpbGUocHJvamVjdCwgJ29wZW5zcGVjLWdhdGVzL3RzY29uZmlnLmpzb24nLCB7XG4gICAgICBtYXJrZXI6IGZhbHNlLFxuICAgICAgb2JqOiB7XG4gICAgICAgIGV4dGVuZHM6ICcuLi90c2NvbmZpZy5qc29uJyxcbiAgICAgICAgY29tcGlsZXJPcHRpb25zOiB7XG4gICAgICAgICAgbm9FbWl0OiB0cnVlLFxuICAgICAgICAgIHJvb3REaXI6ICcuJyxcbiAgICAgICAgfSxcbiAgICAgICAgaW5jbHVkZTogWycqLnRzJ10sXG4gICAgICAgIGV4Y2x1ZGU6IFsnbm9kZV9tb2R1bGVzJ10sXG4gICAgICB9LFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/SoftwareFactoryWorkflows.d.ts

@@ -0,0 +1,28 @@
+import { NodeProject } from 'projen/lib/javascript';
+import { WorkflowActionVersions } from './WorkflowActionVersions';
+export interface SoftwareFactoryWorkflowsOptions {
+    /**
+     * The bare repo name, used to derive the `<repoName>-shell[-architecture|-manifest]`
+     * model names these workflows dispatch shell commands through.
+     */
+    readonly repoName: string;
+    /**
+     * Overrides for the pinned action versions used by `verify-attestation.yml`.
+     */
+    readonly actionVersions?: WorkflowActionVersions;
+}
+/**
+ * The 3 swamp workflows the factory's gate stages run (openspec-plan-verify,
+ * openspec-tasks-verify, pre-pr-verify), plus the GitHub Action that
+ * re-verifies a PR's embedded attestation at merge time.
+ *
+ * The swamp workflow YAMLs carry a swamp-assigned `id` that must stay stable
+ * across synths (swamp uses it as the workflow's identity), so — like the
+ * model instances in `SoftwareFactoryModels` — they're `SampleFile`s, written
+ * once and then owned by the team. `verify-attestation.yml` has no such
+ * identity constraint and is a plain GitHub Actions workflow, so it's built
+ * the same managed way `PrDeployWorkflow` is.
+ */
+export declare class SoftwareFactoryWorkflows {
+    constructor(project: NodeProject, options: SoftwareFactoryWorkflowsOptions);
+}