@msn-control/liftoff 0.10.4 → 0.11.1

package/dist/domain/governance/assessment/report.js

@@ -0,0 +1,266 @@
+import { canonicalJson, canonicalSha256 } from '../activation/canonical-json.js';
+import { phaseIds } from '../activation/types.js';
+import { validateActivationIdentity } from '../activation/validators.js';
+import { classifications } from './types.js';
+import { containsSensitiveText, isRecord, jsonValue, notObserved, sanitizeAssessmentText } from './sanitize.js';
+export function classifyFinding(input) {
+    const { control } = input;
+    const expected = input.expected ?? control.expected;
+    const observations = { ...input.observations };
+    for (const layer of control.proofLayers) {
+        if (!observations[layer])
+            observations[layer] = notObserved(`No ${layer} proof was collected.`);
+    }
+    const missingProof = control.proofLayers.filter((layer) => observations[layer]?.availability === 'not-observed');
+    const reasons = control.proofLayers.flatMap((layer) => observations[layer]?.reason ? [`${layer}: ${observations[layer].reason}`] : []);
+    let classification;
+    let exception = null;
+    if (input.applicability === 'inapplicable') {
+        classification = 'inapplicable';
+    }
+    else if (input.applicability === 'unknown' || !control.supported) {
+        classification = 'not-observed';
+        reasons.push(input.applicability === 'unknown'
+            ? 'Applicability has not been established from authoritative workload facts.'
+            : 'This control has no supported assessment evaluator; required proof is not being inferred.');
+    }
+    else {
+        const required = control.proofLayers.map((layer) => observations[layer]);
+        const absent = required.some((observation) => observation.availability === 'missing');
+        const differs = required.some((observation) => observation.availability === 'observed' && canonicalJson(observation.value) !== canonicalJson(expected));
+        classification = input.difference ?? (absent ? 'missing' : differs ? 'conflicting' : missingProof.length ? 'not-observed' : 'aligned');
+        if (classification !== 'aligned' && classification !== 'not-observed' && missingProof.length === 0 &&
+            input.exception && control.exceptionAllowed) {
+            classification = 'approved-exception';
+            exception = input.exception;
+            reasons.push('The observed difference has an exact, current, scoped exception; it is not an exact target match.');
+        }
+        else if (classification === 'aligned') {
+            reasons.push('All required observations match the installed target.');
+        }
+    }
+    if (input.applicability === 'inapplicable')
+        reasons.push('Validated workload facts exclude this control.');
+    return {
+        controlId: control.id, title: control.title, policySection: control.policySection, severity: control.severity,
+        scope: input.scope, expected, applicability: input.applicability, classification, observations,
+        requiredProof: [...control.proofLayers],
+        missingProof: input.applicability === 'inapplicable' ? [] : missingProof,
+        unsupported: !control.supported, reasons, affectedPhases: [...control.phaseIds], exception,
+        recommendation: {
+            ownership: control.ownership,
+            approvalRequired: control.ownership !== 'managed-core',
+            action: control.recommendation
+        }
+    };
+}
+export function reportCoverage(findings) {
+    const applicable = findings.filter((finding) => finding.applicability === 'applicable');
+    return {
+        total: findings.length,
+        applicable: applicable.length,
+        inapplicable: findings.filter((finding) => finding.applicability === 'inapplicable').length,
+        unknownApplicability: findings.filter((finding) => finding.applicability === 'unknown').length,
+        fullyObserved: applicable.filter((finding) => !finding.unsupported && finding.missingProof.length === 0 && finding.classification !== 'not-observed').length,
+        unobserved: findings.filter((finding) => finding.applicability !== 'inapplicable' &&
+            (finding.classification === 'not-observed' || finding.missingProof.length > 0)).length,
+        unsupported: findings.filter((finding) => finding.applicability !== 'inapplicable' && finding.unsupported).length,
+        differences: findings.filter((finding) => ['outdated', 'missing', 'conflicting', 'approved-exception'].includes(finding.classification)).length,
+        approvedExceptions: findings.filter((finding) => finding.classification === 'approved-exception').length
+    };
+}
+export function assembleAssessmentReport(input) {
+    const findings = [...input.findings].sort((left, right) => `${left.controlId}\0${canonicalJson(left.scope)}`.localeCompare(`${right.controlId}\0${canonicalJson(right.scope)}`, 'en'));
+    const diagnostics = [...input.diagnostics].sort((a, b) => `${a.code}\0${a.source ?? ''}\0${a.message}`.localeCompare(`${b.code}\0${b.source ?? ''}\0${b.message}`, 'en'));
+    const coverage = reportCoverage(findings);
+    const failed = input.failed || diagnostics.some((diagnostic) => diagnostic.severity === 'error');
+    const outcome = failed ? 'error' : input.disabled ? 'not-applicable'
+        : !input.snapshot.inputsStable || coverage.unknownApplicability > 0 || coverage.unobserved > 0 || coverage.unsupported > 0 ? 'partial'
+            : coverage.differences > 0 ? 'differences' : findings.length === 0 ? 'error' : 'aligned';
+    const report = {
+        schemaVersion: 1, command: 'governance assess', readOnly: true, mode: input.mode,
+        projectRoot: sanitizeAssessmentText(input.projectRoot), target: input.target,
+        projectIdentity: input.projectIdentity, snapshot: input.snapshot, outcome,
+        exitCode: outcome === 'error' ? 1 : outcome === 'aligned' || outcome === 'not-applicable' ? 0 : 2,
+        coverage, findings, diagnostics, resultDigest: ''
+    };
+    report.resultDigest = canonicalSha256({ ...report, resultDigest: '' });
+    return validateAssessmentReport(report);
+}
+function exact(value, fields, label, optional = []) {
+    if (!isRecord(value) || fields.some((key) => !Object.hasOwn(value, key)) ||
+        Object.keys(value).some((key) => !fields.includes(key) && !optional.includes(key)))
+        throw new Error(`${label} has invalid fields.`);
+    return value;
+}
+function enumeration(value, options, label) {
+    if (typeof value !== 'string' || !options.includes(value))
+        throw new Error(`${label} is invalid.`);
+}
+function string(value, label, nullable = false) {
+    if ((nullable && value === null) || typeof value === 'string')
+        return;
+    throw new Error(`${label} must be a string${nullable ? ' or null' : ''}.`);
+}
+function strings(value, label, allowed) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string' || (allowed && !allowed.includes(entry)))) {
+        throw new Error(`${label} must contain valid strings.`);
+    }
+}
+function boolean(value, label) {
+    if (typeof value !== 'boolean')
+        throw new Error(`${label} must be a boolean.`);
+}
+function digest(value, label, nullable = false) {
+    if (nullable && value === null)
+        return;
+    if (typeof value !== 'string' || !/^[a-f0-9]{64}$/u.test(value))
+        throw new Error(`${label} must be a SHA-256 digest.`);
+}
+function timestamp(value, label) {
+    if (typeof value !== 'string' || !Number.isFinite(Date.parse(value)))
+        throw new Error(`${label} must be an ISO timestamp.`);
+}
+function validateObservation(value) {
+    const observation = exact(value, ['availability', 'value', 'source', 'reason'], 'Observation', ['facts']);
+    enumeration(observation.availability, ['observed', 'missing', 'not-observed'], 'Observation availability');
+    jsonValue(observation.value);
+    if (observation.facts !== undefined)
+        jsonValue(observation.facts);
+    string(observation.reason, 'Observation reason', true);
+    if (observation.source !== null) {
+        const source = exact(observation.source, ['kind', 'location', 'digest', 'capturedAt', 'revision', 'line'], 'Observation source');
+        enumeration(source.kind, ['package', 'file', 'git', 'evidence', 'github', 'azure'], 'Source kind');
+        string(source.location, 'Source location');
+        digest(source.digest, 'Source digest', true);
+        timestamp(source.capturedAt, 'Source capture time');
+        string(source.revision, 'Source revision', true);
+        if (source.line !== null && (!Number.isInteger(source.line) || Number(source.line) < 1))
+            throw new Error('Source line is invalid.');
+    }
+    else if (observation.availability !== 'not-observed') {
+        throw new Error('Observed facts or absence require provenance.');
+    }
+}
+function assertAssessmentReport(value) {
+    const report = exact(value, ['schemaVersion', 'command', 'readOnly', 'mode', 'projectRoot', 'target',
+        'projectIdentity', 'snapshot', 'outcome', 'exitCode', 'coverage', 'findings', 'diagnostics', 'resultDigest'], 'Assessment report');
+    if (report.schemaVersion !== 1 || report.command !== 'governance assess' || report.readOnly !== true)
+        throw new Error('Assessment report identity is invalid.');
+    enumeration(report.mode, ['local', 'live'], 'Assessment mode');
+    enumeration(report.outcome, ['aligned', 'differences', 'partial', 'not-applicable', 'error'], 'Assessment outcome');
+    string(report.projectRoot, 'Project root');
+    if (report.target !== null) {
+        const target = exact(report.target, ['cliVersion', 'profile', 'policyVersion', 'policyDigest', 'activationIdentity',
+            'phaseGraphHash', 'catalogSchemaVersion', 'catalogDigest'], 'Target');
+        if (target.profile !== 'single-maintainer-gitflow' || target.catalogSchemaVersion !== 1)
+            throw new Error('Target identity is invalid.');
+        for (const key of ['cliVersion', 'policyVersion'])
+            string(target[key], `Target ${key}`);
+        for (const key of ['policyDigest', 'phaseGraphHash', 'catalogDigest'])
+            digest(target[key], `Target ${key}`);
+        const identity = validateActivationIdentity(target.activationIdentity);
+        if (identity.policyVersion !== target.policyVersion || identity.phaseGraphHash !== target.phaseGraphHash)
+            throw new Error('Target version fields disagree.');
+    }
+    const identity = exact(report.projectIdentity, ['availability', 'manifestVersion', 'cliVersion', 'profile', 'policyVersion', 'recordedActivationIdentity', 'stateSource'], 'Project identity');
+    enumeration(identity.availability, ['known', 'unsupported', 'unavailable'], 'Identity availability');
+    enumeration(identity.stateSource, ['not-started', 'user', 'unsupported', 'unavailable'], 'State source');
+    if (identity.manifestVersion !== null && !Number.isInteger(identity.manifestVersion))
+        throw new Error('Manifest version is invalid.');
+    string(identity.cliVersion, 'Recorded CLI version', true);
+    string(identity.profile, 'Recorded profile', true);
+    string(identity.policyVersion, 'Recorded policy version', true);
+    jsonValue(identity.recordedActivationIdentity);
+    const snapshot = exact(report.snapshot, ['capturedAt', 'repository', 'localHead', 'worktreeDigest', 'inputsStable'], 'Snapshot');
+    timestamp(snapshot.capturedAt, 'Snapshot capture time');
+    digest(snapshot.worktreeDigest, 'Snapshot digest');
+    for (const key of ['repository', 'localHead'])
+        string(snapshot[key], `Snapshot ${key}`, true);
+    boolean(snapshot.inputsStable, 'Snapshot stability');
+    const counts = ['total', 'applicable', 'inapplicable', 'unknownApplicability', 'fullyObserved', 'unobserved', 'unsupported', 'differences', 'approvedExceptions'];
+    const coverage = exact(report.coverage, counts, 'Coverage');
+    for (const key of counts)
+        if (!Number.isInteger(coverage[key]) || Number(coverage[key]) < 0)
+            throw new Error(`Coverage ${key} is invalid.`);
+    if (!Array.isArray(report.findings) || !Array.isArray(report.diagnostics))
+        throw new Error('Findings and diagnostics must be arrays.');
+    for (const value of report.findings) {
+        const finding = exact(value, ['controlId', 'title', 'policySection', 'severity', 'scope', 'expected', 'applicability',
+            'classification', 'observations', 'requiredProof', 'missingProof', 'unsupported', 'reasons', 'affectedPhases', 'exception', 'recommendation'], 'Finding');
+        for (const key of ['controlId', 'title', 'policySection'])
+            string(finding[key], `Finding ${key}`);
+        enumeration(finding.severity, ['info', 'warning', 'error'], 'Finding severity');
+        enumeration(finding.applicability, ['applicable', 'inapplicable', 'unknown'], 'Finding applicability');
+        enumeration(finding.classification, classifications, 'Finding classification');
+        boolean(finding.unsupported, 'Finding support');
+        jsonValue(finding.expected);
+        strings(finding.requiredProof, 'Required proof', ['recorded', 'declared', 'live', 'evidence']);
+        strings(finding.missingProof, 'Missing proof', ['recorded', 'declared', 'live', 'evidence']);
+        strings(finding.reasons, 'Finding reasons');
+        strings(finding.affectedPhases, 'Phase references', phaseIds);
+        const scope = exact(finding.scope, ['repository', 'environment', 'resource'], 'Finding scope');
+        for (const key of Object.keys(scope))
+            string(scope[key], `Scope ${key}`, true);
+        if (!isRecord(finding.observations) || Object.keys(finding.observations).some((key) => !['recorded', 'declared', 'live', 'evidence'].includes(key))) {
+            throw new Error('Finding observations are invalid.');
+        }
+        for (const observation of Object.values(finding.observations))
+            validateObservation(observation);
+        if (finding.exception !== null) {
+            const exception = exact(finding.exception, ['id', 'expiresAt', 'envelopeDigest'], 'Exception');
+            for (const key of Object.keys(exception))
+                string(exception[key], `Exception ${key}`);
+        }
+        const recommendation = exact(finding.recommendation, ['ownership', 'approvalRequired', 'action'], 'Recommendation');
+        enumeration(recommendation.ownership, ['managed-core', 'project-owned', 'remote', 'external-authority'], 'Recommendation ownership');
+        boolean(recommendation.approvalRequired, 'Recommendation approval');
+        string(recommendation.action, 'Recommendation action');
+    }
+    for (const value of report.diagnostics) {
+        const diagnostic = exact(value, ['code', 'severity', 'message', 'source'], 'Diagnostic');
+        string(diagnostic.code, 'Diagnostic code');
+        string(diagnostic.message, 'Diagnostic message');
+        string(diagnostic.source, 'Diagnostic source', true);
+        enumeration(diagnostic.severity, ['info', 'warning', 'error'], 'Diagnostic severity');
+    }
+    digest(report.resultDigest, 'Result digest');
+}
+export function validateAssessmentReport(value) {
+    assertAssessmentReport(value);
+    if (canonicalJson(reportCoverage(value.findings)) !== canonicalJson(value.coverage))
+        throw new Error('Assessment coverage does not match findings.');
+    for (const finding of value.findings) {
+        const missing = finding.applicability === 'inapplicable' ? [] : finding.requiredProof.filter((layer) => !finding.observations[layer] || finding.observations[layer].availability === 'not-observed');
+        if (canonicalJson(missing) !== canonicalJson(finding.missingProof))
+            throw new Error('Finding missing-proof inventory is inconsistent.');
+        if (finding.classification === 'aligned' && (finding.applicability !== 'applicable' || finding.unsupported ||
+            missing.length > 0 || finding.requiredProof.some((layer) => {
+            const observation = finding.observations[layer];
+            return observation?.availability !== 'observed' || canonicalJson(observation.value) !== canonicalJson(finding.expected);
+        })))
+            throw new Error('Finding claims alignment without matching required proof.');
+        if (finding.classification === 'inapplicable' && finding.applicability !== 'inapplicable')
+            throw new Error('Finding invents inapplicability.');
+        if (finding.classification === 'approved-exception' && (!finding.exception || missing.length ||
+            !Number.isFinite(Date.parse(finding.exception.expiresAt)) || Date.parse(finding.exception.expiresAt) <= Date.parse(value.snapshot.capturedAt))) {
+            throw new Error('Finding has no current, fully observed exception.');
+        }
+    }
+    const expectedExit = value.outcome === 'error' ? 1 : ['aligned', 'not-applicable'].includes(value.outcome) ? 0 : 2;
+    if (value.exitCode !== expectedExit)
+        throw new Error('Assessment exit code does not match outcome.');
+    if (value.outcome === 'aligned' && (value.findings.length === 0 || !value.snapshot.inputsStable ||
+        value.coverage.unobserved || value.coverage.unsupported || value.coverage.unknownApplicability || value.coverage.differences)) {
+        throw new Error('Assessment cannot claim alignment with missing coverage or differences.');
+    }
+    if (value.outcome === 'not-applicable' && (value.projectIdentity.profile !== 'none' || value.findings.length !== 0)) {
+        throw new Error('Disabled assessment outcome does not match project profile.');
+    }
+    if (value.resultDigest !== canonicalSha256({ ...value, resultDigest: '' }))
+        throw new Error('Assessment result digest does not match report.');
+    if (containsSensitiveText(JSON.stringify(value)))
+        throw new Error('Assessment report contains sensitive data and was withheld.');
+    return value;
+}
+//# sourceMappingURL=report.js.map

package/dist/domain/governance/assessment/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../../src/domain/governance/assessment/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAK7C,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEhH,MAAM,UAAU,eAAe,CAAC,KAQ/B;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,YAAY,GAAG,EAAE,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,YAAY,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,YAAY,KAAK,cAAc,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACpD,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,YAAY,CAAC,KAAK,CAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAChF,CAAC;IACF,IAAI,cAA8B,CAAC;IACnC,IAAI,SAAS,GAAmC,IAAI,CAAC;IACrD,IAAI,KAAK,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;QAC3C,cAAc,GAAG,cAAc,CAAC;IAClC,CAAC;SAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACnE,cAAc,GAAG,cAAc,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;YAC5C,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,2FAA2F,CAAC,CAAC;IACnG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAC5C,WAAW,CAAC,YAAY,KAAK,UAAU,IAAI,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,CACxG,CAAC;QACF,cAAc,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvI,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,cAAc,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAC9F,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAChD,cAAc,GAAG,oBAAoB,CAAC;YACtC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,mGAAmG,CAAC,CAAC;QACpH,CAAC;aAAM,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAC3G,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC7G,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY;QAC9F,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,YAAY,EAAE,KAAK,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY;QACxE,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS;QAC1F,cAAc,EAAE;YACd,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,gBAAgB,EAAE,OAAO,CAAC,SAAS,KAAK,cAAc;YACtD,MAAM,EAAE,OAAO,CAAC,cAAc;SAC/B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAsC;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,KAAK,YAAY,CAAC,CAAC;IACxF,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,UAAU,EAAE,UAAU,CAAC,MAAM;QAC7B,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,MAAM;QAC3F,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,MAAM;QAC9F,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC,MAAM;QAC5J,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,KAAK,cAAc;YAC/E,CAAC,OAAO,CAAC,cAAc,KAAK,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM;QACxF,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,KAAK,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM;QACjH,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM;QAC/I,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,KAAK,oBAAoB,CAAC,CAAC,MAAM;KACzG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAUxC;IACC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxD,GAAG,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAC3H,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvD,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAC/G,CAAC;IACF,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB;QAClE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,oBAAoB,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACtI,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,MAAM,GAAqB;QAC/B,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChF,WAAW,EAAE,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC5E,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO;QACzE,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;KAClD,CAAC;IACF,MAAM,CAAC,YAAY,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,MAAyB,EAAE,KAAa,EAAE,QAAQ,GAAsB,EAAE;IACvG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IACxI,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,OAA0B,EAAE,KAAa;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;AACrG,CAAC;AACD,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa,EAAE,QAAQ,GAAG,KAAK;IAC7D,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IACtE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7E,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa,EAAE,OAA2B;IACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;AACjF,CAAC;AACD,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa,EAAE,QAAQ,GAAG,KAAK;IAC7D,IAAI,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;AACzH,CAAC;AACD,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;AAC9H,CAAC;AACD,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1G,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAC3G,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACjI,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;QACnG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QAC7C,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtI,CAAC;SAAM,IAAI,WAAW,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ;QAClG,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACrI,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,mBAAmB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChK,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC/D,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACpH,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,oBAAoB;YACjH,gBAAgB,EAAE,sBAAsB,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,OAAO,KAAK,2BAA2B,IAAI,MAAM,CAAC,oBAAoB,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxI,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;QACxF,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,eAAe,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;QAC5G,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/J,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,4BAA4B,EAAE,aAAa,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC/L,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACrG,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,cAAc,CAAC,CAAC;IACzG,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtI,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IAChE,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,UAAU,CAAC,CAAC;IACjI,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACxD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC;QAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9F,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;IAClK,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,MAAM;QAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,cAAc,CAAC,CAAC;IAC5I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvI,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe;YACnH,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5J,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;QAClG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAChF,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACvG,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAC/E,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAChD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/F,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC5C,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;QAC/F,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpJ,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;YAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,CAAC;YAC/F,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACpH,WAAW,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrI,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;QACpE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;QACzF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC7F,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;QACrD,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrJ,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACrG,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,CAAE,CAAC,YAAY,KAAK,cAAc,CAC7F,CAAC;QACF,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxI,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,YAAY,IAAI,OAAO,CAAC,WAAW;YACtG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACzD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAChD,OAAO,WAAW,EAAE,YAAY,KAAK,UAAU,IAAI,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1H,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,cAAc,KAAK,cAAc,IAAI,OAAO,CAAC,aAAa,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC/I,IAAI,OAAO,CAAC,cAAc,KAAK,oBAAoB,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM;YACxF,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACnJ,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY;QAC3F,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClI,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/I,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjI,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/domain/governance/assessment/sanitize.d.ts

@@ -0,0 +1,8 @@
+import type { JsonValue, Observation, ObservationSource } from './types.js';
+export declare function containsSensitiveText(text: string): boolean;
+export declare function sanitizeAssessmentText(text: string, limit?: number): string;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function jsonValue(value: unknown, depth?: number): JsonValue;
+export declare function notObserved(reason: string, source?: ObservationSource | null): Observation;
+export declare function observed(value: JsonValue, source: ObservationSource): Observation;
+export declare function source(kind: ObservationSource['kind'], location: string, capturedAt: string, content?: JsonValue, revision?: string | null, line?: number | null): ObservationSource;

package/dist/domain/governance/assessment/sanitize.js

@@ -0,0 +1,60 @@
+import { stripVTControlCharacters } from 'node:util';
+import { canonicalSha256 } from '../activation/canonical-json.js';
+const sensitiveText = [
+    /\bgh[oprsu]_[A-Za-z0-9_]{20,}\b/u,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}\b/u,
+    /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/u,
+    /\bAccountKey=[^;\s]+/iu,
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/u,
+    /\b(?:bearer|basic)\s+[a-z0-9+/_.=-]+/iu,
+    /\b(?:password|passwd|client[_-]?secret|access[_-]?token|api[_-]?key|token|secret|signature|sig)\s*["']?\s*[:=]\s*["']?[^;\s"'<>]+/iu,
+    /\bnpm_[a-z0-9]{20,}/iu,
+    /[a-z][a-z0-9+.-]*:\/\/[^\s/@]+:[^\s/@]+@/iu,
+    /\beyJ[a-z0-9_-]+\.[a-z0-9_-]+\.[a-z0-9_-]+/iu
+];
+export function containsSensitiveText(text) {
+    return sensitiveText.some((pattern) => pattern.test(text));
+}
+export function sanitizeAssessmentText(text, limit = 2048) {
+    const plain = stripVTControlCharacters(text)
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/gu, '').trim();
+    if (containsSensitiveText(plain))
+        return '[withheld: sensitive content]';
+    return plain.length > limit ? `${plain.slice(0, limit - 12)} [truncated]` : plain;
+}
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function jsonValue(value, depth = 0) {
+    if (depth > 12)
+        throw new Error('Assessment value exceeds nesting limit.');
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value))
+        return value.map((entry) => jsonValue(entry, depth + 1));
+    if (isRecord(value)) {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, jsonValue(entry, depth + 1)]));
+    }
+    throw new Error('Assessment values must be JSON data.');
+}
+export function notObserved(reason, source = null) {
+    return { availability: 'not-observed', value: null, source, reason: sanitizeAssessmentText(reason) };
+}
+export function observed(value, source) {
+    if (containsSensitiveText(JSON.stringify(value)) || containsSensitiveText(source.location)) {
+        return notObserved('Observation withheld because sensitive content was detected.');
+    }
+    return { availability: 'observed', value, source, reason: null };
+}
+export function source(kind, location, capturedAt, content, revision = null, line = null) {
+    return {
+        kind, location: sanitizeAssessmentText(location), capturedAt,
+        digest: content === undefined ? null : canonicalSha256(content),
+        revision, line
+    };
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/domain/governance/assessment/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../../src/domain/governance/assessment/sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,MAAM,aAAa,GAAG;IACpB,kCAAkC;IAClC,mCAAmC;IACnC,uDAAuD;IACvD,wBAAwB;IACxB,oDAAoD;IACpD,wCAAwC;IACxC,qIAAqI;IACrI,uBAAuB;IACvB,4CAA4C;IAC5C,8CAA8C;CAC/C,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,KAAK,GAAG,IAAI;IAC/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC;SACzC,OAAO,CAAC,yDAAyD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO,+BAA+B,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACjD,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAM,GAA6B,IAAI;IACjF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAgB,EAAE,MAAyB;IAClE,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3F,OAAO,WAAW,CAAC,8DAA8D,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,MAAM,CACpB,IAA+B,EAC/B,QAAgB,EAChB,UAAkB,EAClB,OAAmB,EACnB,QAAQ,GAAkB,IAAI,EAC9B,IAAI,GAAkB,IAAI;IAE1B,OAAO;QACL,IAAI,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,UAAU;QAC5D,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC;QAC/D,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC"}

package/dist/domain/governance/assessment/types.d.ts

@@ -0,0 +1,174 @@
+import type { ActivationIdentity, PhaseId } from '../activation/types.js';
+export type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export declare const classifications: readonly ['aligned', 'outdated', 'missing', 'conflicting', 'approved-exception', 'inapplicable', 'not-observed'];
+export type Classification = typeof classifications[number];
+export type Severity = 'info' | 'warning' | 'error';
+export type Layer = 'recorded' | 'declared' | 'live' | 'evidence';
+export type Ownership = 'managed-core' | 'project-owned' | 'remote' | 'external-authority';
+export type Outcome = 'aligned' | 'differences' | 'partial' | 'not-applicable' | 'error';
+export interface ObservationSource {
+    kind: 'package' | 'file' | 'git' | 'evidence' | 'github' | 'azure';
+    location: string;
+    digest: string | null;
+    capturedAt: string;
+    revision: string | null;
+    line: number | null;
+}
+export interface Observation {
+    availability: 'observed' | 'missing' | 'not-observed';
+    value: JsonValue;
+    source: ObservationSource | null;
+    reason: string | null;
+    facts?: JsonValue;
+}
+export interface AssessmentDiagnostic {
+    code: string;
+    severity: Severity;
+    message: string;
+    source: string | null;
+}
+export interface ControlDefinition {
+    id: string;
+    title: string;
+    policySection: string;
+    severity: Severity;
+    applicability: 'always' | 'api' | 'private-dast' | 'state-path';
+    evaluator: string;
+    proofLayers: Layer[];
+    expected: JsonValue;
+    phaseIds: PhaseId[];
+    supported: boolean;
+    exceptionAllowed: boolean;
+    ownership: Ownership;
+    recommendation: string;
+}
+export interface AssessmentCatalog {
+    schemaVersion: 1;
+    profile: 'single-maintainer-gitflow';
+    policyVersion: string;
+    policyDigest: string;
+    families: string[];
+    controls: ControlDefinition[];
+}
+export interface AssessmentTarget {
+    cliVersion: string;
+    profile: 'single-maintainer-gitflow';
+    policyVersion: string;
+    policyDigest: string;
+    activationIdentity: ActivationIdentity;
+    phaseGraphHash: string;
+    catalogSchemaVersion: 1;
+    catalogDigest: string;
+}
+export interface FindingScope {
+    repository: string | null;
+    environment: string | null;
+    resource: string | null;
+}
+export interface AssessmentFinding {
+    controlId: string;
+    title: string;
+    policySection: string;
+    severity: Severity;
+    scope: FindingScope;
+    expected: JsonValue;
+    applicability: 'applicable' | 'inapplicable' | 'unknown';
+    classification: Classification;
+    observations: Partial<Record<Layer, Observation>>;
+    requiredProof: Layer[];
+    missingProof: Layer[];
+    unsupported: boolean;
+    reasons: string[];
+    affectedPhases: PhaseId[];
+    exception: {
+        id: string;
+        expiresAt: string;
+        envelopeDigest: string;
+    } | null;
+    recommendation: {
+        ownership: Ownership;
+        approvalRequired: boolean;
+        action: string;
+    };
+}
+export interface AssessmentProjectIdentity {
+    availability: 'known' | 'unsupported' | 'unavailable';
+    manifestVersion: number | null;
+    cliVersion: string | null;
+    profile: string | null;
+    policyVersion: string | null;
+    recordedActivationIdentity: JsonValue;
+    stateSource: 'not-started' | 'user' | 'unsupported' | 'unavailable';
+}
+export interface AssessmentReport {
+    schemaVersion: 1;
+    command: 'governance assess';
+    readOnly: true;
+    mode: 'local' | 'live';
+    projectRoot: string;
+    target: AssessmentTarget | null;
+    projectIdentity: AssessmentProjectIdentity;
+    snapshot: {
+        capturedAt: string;
+        repository: string | null;
+        localHead: string | null;
+        worktreeDigest: string;
+        inputsStable: boolean;
+    };
+    outcome: Outcome;
+    exitCode: 0 | 1 | 2;
+    coverage: {
+        total: number;
+        applicable: number;
+        inapplicable: number;
+        unknownApplicability: number;
+        fullyObserved: number;
+        unobserved: number;
+        unsupported: number;
+        differences: number;
+        approvedExceptions: number;
+    };
+    findings: AssessmentFinding[];
+    diagnostics: AssessmentDiagnostic[];
+    resultDigest: string;
+}
+export interface AzureAssessmentBinding {
+    subscriptionId: string;
+    environment: 'dev' | 'staging' | 'prod';
+    resourceId: string;
+    resourceType: string;
+    role: 'state' | 'application' | 'runner-network';
+}
+export interface LiveAssessmentScope {
+    repository: {
+        owner: string;
+        name: string;
+        id: string | null;
+    } | null;
+    refs: string[];
+    refPrefixes?: string[];
+    environments: string[];
+    runner: {
+        organization: string;
+        runnerId: number;
+        groupId: number | null;
+        networkConfigurationId: string | null;
+    } | null;
+    azure: AzureAssessmentBinding[];
+}
+export interface LiveAssessmentResult {
+    observations: Record<string, Observation>;
+    diagnostics: AssessmentDiagnostic[];
+    refsStable: boolean;
+}
+export declare const assessmentLimits: {
+    readonly fileBytes: number;
+    readonly responseBytes: number;
+    readonly requestTimeoutMs: 10000;
+    readonly liveDeadlineMs: 60000;
+    readonly maxPages: 20;
+    readonly retries: 1;
+    readonly maxFiles: 500;
+};

package/dist/domain/governance/assessment/types.js

@@ -0,0 +1,13 @@
+export const classifications = [
+    'aligned', 'outdated', 'missing', 'conflicting', 'approved-exception', 'inapplicable', 'not-observed'
+];
+export const assessmentLimits = {
+    fileBytes: 1024 * 1024,
+    responseBytes: 5 * 1024 * 1024,
+    requestTimeoutMs: 10_000,
+    liveDeadlineMs: 60_000,
+    maxPages: 20,
+    retries: 1,
+    maxFiles: 500
+};
+//# sourceMappingURL=types.js.map

package/dist/domain/governance/assessment/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/domain/governance/assessment/types.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc;CAC7F,CAAC;AAmKX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,SAAS,EAAE,IAAI,GAAG,IAAI;IACtB,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IAC9B,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,MAAM;IACtB,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,GAAG;CACL,CAAC"}

package/dist/domain/governance/assessment/yaml.d.ts

@@ -0,0 +1,6 @@
+export interface ParsedWorkflow {
+    path: string;
+    value: Record<string, unknown>;
+    lineOf: (key: string) => number;
+}
+export declare function parseAssessmentWorkflow(text: string, path: string): ParsedWorkflow;

package/dist/domain/governance/assessment/yaml.js

@@ -0,0 +1,30 @@
+import { LineCounter, parseDocument } from 'yaml';
+import { AssessmentInputError } from './errors.js';
+import { isRecord } from './sanitize.js';
+export function parseAssessmentWorkflow(text, path) {
+    const lineCounter = new LineCounter();
+    const document = parseDocument(text, {
+        version: '1.2', schema: 'core', uniqueKeys: true, strict: true, customTags: [], lineCounter
+    });
+    if (document.errors.length || document.warnings.length) {
+        throw new AssessmentInputError('malformed-workflow', `Workflow ${path} has invalid keys, tags, or YAML syntax.`, path);
+    }
+    let value;
+    try {
+        value = document.toJS({ maxAliasCount: 50 });
+    }
+    catch {
+        throw new AssessmentInputError('malformed-workflow', `Workflow ${path} exceeds safe YAML alias limits.`, path);
+    }
+    if (!isRecord(value))
+        throw new AssessmentInputError('malformed-workflow', `Workflow ${path} must be a YAML object.`, path);
+    return {
+        path, value,
+        lineOf(key) {
+            const node = document.get(key, true);
+            return typeof node === 'object' && node !== null && 'range' in node && Array.isArray(node.range)
+                ? lineCounter.linePos(Number(node.range[0])).line : 1;
+        }
+    };
+}
+//# sourceMappingURL=yaml.js.map

package/dist/domain/governance/assessment/yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.js","sourceRoot":"","sources":["../../../../src/domain/governance/assessment/yaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAQzC,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,IAAY;IAChE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE;QACnC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW;KAC5F,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,IAAI,0CAA0C,EAAE,IAAI,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAY,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,IAAI,kCAAkC,EAAE,IAAI,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,IAAI,yBAAyB,EAAE,IAAI,CAAC,CAAC;IAC5H,OAAO;QACL,IAAI,EAAE,KAAK;QACX,MAAM,CAAC,GAAW;YAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC9F,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC"}