@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/domain/governance/activation/graph.js

@@ -0,0 +1,441 @@
+import { canonicalJson, canonicalSha256, sha256Hex } from './canonical-json.js';
+import { activationContractVersion, approvalEnvelopeSchemaVersion, buildActivationCompatibilityMap, createActivationIdentity, evidenceHeaderSchemaVersion, governanceActivationPolicyVersion, liftoffActivationPackageVersion, phaseGraphSchemaVersion } from '../policy/identity.js';
+const terminalVerified = ['verified', 'failed'];
+const terminalApproved = ['approved', 'failed'];
+const terminalConditional = ['verified', 'failed', 'inapplicable'];
+function dep(anyOf, description) {
+    return { anyOf, accepts: ['approved', 'verified', 'inapplicable', 'retained', 'disposed'], description };
+}
+function mutations(local, remote = ['none']) {
+    const normalizedLocal = [...local];
+    if (normalizedLocal.includes('write-evidence') &&
+        !normalizedLocal.includes('write-activation-state')) {
+        normalizedLocal.push('write-activation-state');
+    }
+    return { local: normalizedLocal, remote };
+}
+function evidence(schema, required = true, liveReadbackProviders = []) {
+    return { schema, required, headerSchemaVersion: evidenceHeaderSchemaVersion, liveReadbackProviders };
+}
+function approval(kind, required) {
+    return { kind, required, envelopeSchemaVersion: approvalEnvelopeSchemaVersion };
+}
+function rollback(kind, target, description) {
+    return { kind, target, description };
+}
+export const canonicalPhaseGraph = {
+    schemaVersion: phaseGraphSchemaVersion,
+    versions: {
+        liftoffVersion: liftoffActivationPackageVersion,
+        policyVersion: governanceActivationPolicyVersion,
+        activationContractVersion,
+        phaseGraphSchemaVersion
+    },
+    phases: [
+        {
+            id: 'seed-valid',
+            label: 'Generated bootstrap seed is strict-valid',
+            dependencies: [],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['read-worktree', 'write-evidence']),
+            evidence: evidence('seed-valid.v1'),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['project-files', 'policy', 'activation-identity'],
+            rollback: rollback('none', null, 'No mutation is authorized by seed validation.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'seed-verified',
+            label: 'Generated bootstrap baseline checks are verified',
+            dependencies: [dep(['seed-valid'], 'Seed strict validation must pass first.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['read-worktree', 'write-seed-tasks', 'write-evidence']),
+            evidence: evidence('seed-verified.v1'),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['project-files', 'activation-identity'],
+            rollback: rollback('none', null, 'A failed baseline leaves the seed active.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'seed-archived',
+            label: 'Generated bootstrap seed is synced and archived',
+            dependencies: [dep(['seed-verified'], 'Only a verified seed may be archived.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['read-worktree', 'write-openspec-seed', 'write-evidence']),
+            evidence: evidence('seed-archived.v1'),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['project-files', 'activation-identity'],
+            rollback: rollback('none', null, 'Archive failures keep the seed active.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'committed',
+            label: 'Initial repository baseline is committed',
+            dependencies: [dep(['seed-archived'], 'Generated seed must be complete before commit guidance.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['read-worktree', 'git-commit', 'write-evidence']),
+            evidence: evidence('committed.v1'),
+            approvalGate: approval('repository-publish', true),
+            invalidationInputs: ['baseline-sha', 'project-files', 'approval-envelope'],
+            rollback: rollback('none', null, 'Never rewrite a committed user history automatically.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'pushed',
+            label: 'Initial repository baseline is pushed',
+            dependencies: [dep(['committed'], 'Commit evidence precedes initial push.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['read-worktree', 'write-evidence'], ['git-push', 'github-read']),
+            evidence: evidence('pushed.v1', true, ['github']),
+            approvalGate: approval('repository-publish', true),
+            invalidationInputs: ['baseline-sha', 'approval-envelope'],
+            rollback: rollback('none', null, 'Never force-push, delete, or rewrite refs.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'phase-0-complete',
+            label: 'Read-only Phase 0 discovery is complete',
+            dependencies: [dep(['pushed'], 'Remote repository identity must be resolvable.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
+            evidence: evidence('phase-0-complete.v1', true, ['github']),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['baseline-sha', 'policy', 'live-readback'],
+            rollback: rollback('none', null, 'Discovery is read-only and can be refreshed.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'activation-approved',
+            label: 'Governance activation plan is approved',
+            dependencies: [dep(['phase-0-complete'], 'Approval reviews Phase 0 evidence.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-openspec-governance', 'write-activation-state', 'write-evidence']),
+            evidence: evidence('activation-approved.v1', false),
+            approvalGate: approval('activation-plan', true),
+            invalidationInputs: ['baseline-sha', 'approval-envelope', 'policy'],
+            rollback: rollback('none', null, 'Approval expiry returns descendants to blocked.'),
+            terminalStates: terminalApproved
+        },
+        {
+            id: 'credential-ready',
+            label: 'Runner preflight credential policy is ready when required',
+            dependencies: [dep(['activation-approved'], 'Credential enrollment follows approved activation scope.')],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'credential-required',
+                when: 'credentialRequired=true',
+                inapplicableWhen: 'credentialRequired=false',
+                exclusiveWith: []
+            },
+            allowedMutations: mutations(['write-evidence'], ['github-secret-write', 'github-read']),
+            evidence: evidence('credential-ready.v1', true, ['github']),
+            approvalGate: approval('credential-enrollment', true),
+            invalidationInputs: ['credentials', 'approval-envelope', 'activation-identity'],
+            rollback: rollback('none', null, 'Leaked or expired credentials block use and require rotation.'),
+            terminalStates: terminalConditional
+        },
+        {
+            id: 'provider-ready',
+            label: 'Azure provider namespaces are terminal ready',
+            dependencies: [
+                dep(['activation-approved'], 'Provider readiness belongs to approved infrastructure scope.'),
+                dep(['credential-ready'], 'Runner preflight credential readiness or inapplicability precedes provider work.')
+            ],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'private-staging-dast',
+                when: 'privateStagingDast=true',
+                inapplicableWhen: 'privateStagingDast=false',
+                exclusiveWith: []
+            },
+            allowedMutations: mutations(['write-evidence'], ['azure-read', 'azure-provider-register']),
+            evidence: evidence('provider-ready.v1', true, ['azure']),
+            approvalGate: approval('infrastructure-cost', true),
+            invalidationInputs: ['provider-inventory', 'approval-envelope', 'policy'],
+            rollback: rollback('retain', null, 'Provider registrations are retained subscription capabilities.'),
+            terminalStates: ['verified', 'failed', 'inapplicable', 'retained']
+        },
+        {
+            id: 'state-path-selected',
+            label: 'Private state path is selected',
+            dependencies: [dep(['provider-ready'], 'Provider readiness precedes private state path selection.')],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'private-staging-dast',
+                when: 'privateStagingDast=true',
+                inapplicableWhen: 'privateStagingDast=false',
+                exclusiveWith: []
+            },
+            allowedMutations: mutations(['write-activation-state', 'write-evidence'], ['azure-read']),
+            evidence: evidence('state-path-selected.v1', true, ['azure']),
+            approvalGate: approval('infrastructure-cost', true),
+            invalidationInputs: ['remote-state', 'provider-inventory', 'approval-envelope'],
+            rollback: rollback('none', null, 'A changed path selection invalidates mutually exclusive descendants.'),
+            terminalStates: terminalConditional
+        },
+        {
+            id: 'existing-private-path',
+            label: 'Existing private backend management path is verified',
+            dependencies: [dep(['state-path-selected'], 'State path selection chooses this branch.')],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'state-path',
+                when: 'statePath=existing-private',
+                inapplicableWhen: 'statePath!=existing-private',
+                exclusiveWith: ['bootstrap-local']
+            },
+            allowedMutations: mutations(['write-evidence'], ['azure-read']),
+            evidence: evidence('existing-private-path.v1', true, ['azure']),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['remote-state', 'live-readback'],
+            rollback: rollback('none', null, 'Existing path verification is read-only.'),
+            terminalStates: terminalConditional
+        },
+        {
+            id: 'bootstrap-local',
+            label: 'Bounded local bootstrap creates access-establishing resources',
+            dependencies: [
+                dep(['provider-ready'], 'Provider readiness precedes local bootstrap.'),
+                dep(['state-path-selected'], 'State path selection precedes local bootstrap.')
+            ],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'state-path',
+                when: 'statePath=bootstrap-local',
+                inapplicableWhen: 'statePath!=bootstrap-local',
+                exclusiveWith: ['existing-private-path']
+            },
+            allowedMutations: mutations(['write-local-state', 'write-evidence'], ['azure-network-provision', 'github-write']),
+            evidence: evidence('bootstrap-local.v1', true, ['github', 'azure']),
+            approvalGate: approval('infrastructure-cost', true),
+            invalidationInputs: ['approval-envelope', 'provider-inventory', 'remote-state'],
+            rollback: rollback('reverse-to', 'provider-ready', 'Remove only repository-owned bootstrap resources in dependency order.'),
+            terminalStates: terminalConditional
+        },
+        {
+            id: 'runner-ready',
+            label: 'Restricted larger runner is assigned and ready',
+            dependencies: [dep(['bootstrap-local'], 'Local bootstrap must establish runner networking before runner proof.')],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'state-path',
+                when: 'statePath=bootstrap-local',
+                inapplicableWhen: 'statePath!=bootstrap-local',
+                exclusiveWith: []
+            },
+            allowedMutations: mutations(['write-evidence'], ['github-read', 'github-write']),
+            evidence: evidence('runner-ready.v1', true, ['github']),
+            approvalGate: approval('infrastructure-cost', true),
+            invalidationInputs: ['runner-inventory', 'approval-envelope'],
+            rollback: rollback('reverse-to', 'bootstrap-local', 'Remove repository runner assignment before network resources.'),
+            terminalStates: terminalConditional
+        },
+        {
+            id: 'private-backend-proof',
+            label: 'Private backend is reachable from runner',
+            dependencies: [dep(['runner-ready'], 'Runner readiness precedes private backend proof.')],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'state-path',
+                when: 'statePath=bootstrap-local',
+                inapplicableWhen: 'statePath!=bootstrap-local',
+                exclusiveWith: []
+            },
+            allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
+            evidence: evidence('private-backend-proof.v1', true, ['github', 'azure']),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['runner-inventory', 'remote-state', 'live-readback'],
+            rollback: rollback('reverse-to', 'runner-ready', 'Failed proof keeps remote import blocked.'),
+            terminalStates: terminalConditional
+        },
+        {
+            id: 'remote-import-verified',
+            label: 'Declarative remote import and no-change plan are verified',
+            dependencies: [dep(['private-backend-proof'], 'Private backend proof precedes remote import.')],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'state-path',
+                when: 'statePath=bootstrap-local',
+                inapplicableWhen: 'statePath!=bootstrap-local',
+                exclusiveWith: []
+            },
+            allowedMutations: mutations(['write-evidence'], ['azure-state-import']),
+            evidence: evidence('remote-import-verified.v1', true, ['azure']),
+            approvalGate: approval('infrastructure-cost', true),
+            invalidationInputs: ['remote-state', 'approval-envelope'],
+            rollback: rollback('reverse-to', 'private-backend-proof', 'Failed import leaves local state retained for remediation.'),
+            terminalStates: terminalConditional
+        },
+        {
+            id: 'remote-ready',
+            label: 'Remote state is ready and local bootstrap state is frozen',
+            dependencies: [dep(['existing-private-path', 'remote-import-verified'], 'Remote readiness follows either existing private path or verified remote import.')],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'private-staging-dast',
+                when: 'privateStagingDast=true',
+                inapplicableWhen: 'privateStagingDast=false',
+                exclusiveWith: []
+            },
+            allowedMutations: mutations(['write-evidence'], ['azure-read']),
+            evidence: evidence('remote-ready.v1'),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['remote-state', 'live-readback'],
+            rollback: rollback('retain', null, 'Retain local bootstrap state read-only for exactly 30 days when used.'),
+            terminalStates: ['verified', 'failed', 'inapplicable', 'retained']
+        },
+        {
+            id: 'application-foundation',
+            label: 'Application infrastructure foundation is reconciled',
+            dependencies: [dep(['remote-ready'], 'Application resources wait for remote state readiness or inapplicability.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-evidence', 'write-openspec-governance'], ['azure-resource-provision']),
+            evidence: evidence('application-foundation.v1', true, ['azure']),
+            approvalGate: approval('infrastructure-cost', true),
+            invalidationInputs: ['project-files', 'remote-state', 'approval-envelope'],
+            rollback: rollback('reverse-to', 'remote-ready', 'Application resources are removed without unregistering providers.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'workflow-source-ready',
+            label: 'Workflow source and ruleset payloads are ready',
+            dependencies: [dep(['application-foundation'], 'Workflow source targets the reconciled application foundation.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-workflows', 'write-ruleset-source', 'write-evidence']),
+            evidence: evidence('workflow-source-ready.v1'),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['project-files', 'policy'],
+            rollback: rollback('reverse-to', 'application-foundation', 'Remove or repair only workflow/ruleset source changes.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'dev-proof',
+            label: 'Development proof is green',
+            dependencies: [dep(['workflow-source-ready'], 'Workflow source must exist before proving checks.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-evidence'], ['github-read']),
+            evidence: evidence('dev-proof.v1', true, ['github']),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['workflow-source', 'project-files'],
+            rollback: rollback('none', null, 'A failed check blocks descendants until fixed.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'staging-qualified',
+            label: 'Staging release qualification is complete',
+            dependencies: [dep(['dev-proof'], 'Development proof precedes staging qualification.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
+            evidence: evidence('staging-qualified.v1', true, ['github', 'azure']),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['workflow-source', 'security-evidence', 'live-readback'],
+            rollback: rollback('none', null, 'Qualification failures keep production blocked.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'production-rehearsed',
+            label: 'Production promotion and rollback are rehearsed',
+            dependencies: [dep(['staging-qualified'], 'Only a staging-qualified candidate may be rehearsed.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
+            evidence: evidence('production-rehearsed.v1', true, ['github', 'azure']),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['live-readback', 'workflow-source'],
+            rollback: rollback('none', null, 'Rollback remains ungated and documented.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'green-red-proof',
+            label: 'Required checks are proven green and deliberately red',
+            dependencies: [dep(['production-rehearsed'], 'Promotion rehearsal precedes final context proof.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-evidence'], ['github-read']),
+            evidence: evidence('green-red-proof.v1', true, ['github']),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['security-evidence', 'workflow-source'],
+            rollback: rollback('none', null, 'Missing red proof prevents enforcement.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'enforcement-approved',
+            label: 'Final ruleset enforcement is approved',
+            dependencies: [dep(['green-red-proof'], 'Only exact green/red evidence may request enforcement.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-activation-state', 'write-evidence']),
+            evidence: evidence('enforcement-approved.v1', false),
+            approvalGate: approval('enforcement', true),
+            invalidationInputs: ['approval-envelope', 'ruleset-readback'],
+            rollback: rollback('none', null, 'Approval expiry blocks ruleset application.'),
+            terminalStates: terminalApproved
+        },
+        {
+            id: 'rulesets-applied',
+            label: 'Repository rulesets are applied idempotently last',
+            dependencies: [dep(['enforcement-approved'], 'Final enforcement approval precedes ruleset mutation.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-evidence'], ['github-ruleset-write', 'github-read']),
+            evidence: evidence('rulesets-applied.v1', true, ['github']),
+            approvalGate: approval('enforcement', true),
+            invalidationInputs: ['approval-envelope', 'ruleset-readback'],
+            rollback: rollback('reverse-to', 'green-red-proof', 'Rulesets can be disabled or repaired without approval-gating rollback.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'live-readback',
+            label: 'Live enforcement readback matches source',
+            dependencies: [dep(['rulesets-applied'], 'Live readback follows ruleset application.')],
+            applicability: { kind: 'always' },
+            allowedMutations: mutations(['write-evidence'], ['github-read']),
+            evidence: evidence('live-readback.v1', true, ['github']),
+            approvalGate: approval('none', false),
+            invalidationInputs: ['ruleset-readback', 'live-readback'],
+            rollback: rollback('reverse-to', 'rulesets-applied', 'Mismatched live readback blocks completion.'),
+            terminalStates: terminalVerified
+        },
+        {
+            id: 'bootstrap-state-disposed',
+            label: 'Retained local bootstrap state is disposed after day 30',
+            dependencies: [dep(['live-readback'], 'Disposal is scheduled only after live enforcement readback.')],
+            applicability: {
+                kind: 'conditional',
+                discriminator: 'state-path',
+                when: 'statePath=bootstrap-local',
+                inapplicableWhen: 'statePath!=bootstrap-local',
+                exclusiveWith: []
+            },
+            allowedMutations: mutations(['delete-local-state', 'write-evidence']),
+            evidence: evidence('bootstrap-state-disposed.v1'),
+            approvalGate: approval('destructive-disposal', true),
+            invalidationInputs: ['remote-state', 'approval-envelope'],
+            rollback: rollback('dispose', null, 'Deletion destroys only the local encryption key and records no payload.'),
+            terminalStates: ['disposed', 'failed', 'inapplicable']
+        }
+    ]
+};
+function phaseBehavior(node) {
+    return {
+        id: node.id,
+        dependencies: node.dependencies,
+        applicability: node.applicability,
+        allowedMutations: node.allowedMutations,
+        evidence: node.evidence,
+        approvalGate: node.approvalGate,
+        invalidationInputs: node.invalidationInputs,
+        rollback: node.rollback,
+        terminalStates: node.terminalStates
+    };
+}
+export function phaseContractDigest(node) {
+    return sha256Hex(canonicalJson(phaseBehavior(node)));
+}
+export function phaseContractDigests(graph = canonicalPhaseGraph) {
+    return Object.fromEntries(graph.phases.map((node) => [node.id, phaseContractDigest(node)]));
+}
+export const canonicalPhaseGraphJson = canonicalJson(canonicalPhaseGraph);
+export const canonicalPhaseGraphHash = canonicalSha256(canonicalPhaseGraph);
+export const canonicalPhaseContractDigests = phaseContractDigests(canonicalPhaseGraph);
+export const currentActivationIdentity = createActivationIdentity(canonicalPhaseGraphHash);
+export const activationCompatibility = buildActivationCompatibilityMap([
+    currentActivationIdentity
+]);
+//# sourceMappingURL=graph.js.map

package/dist/domain/governance/activation/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../../src/domain/governance/activation/graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,wBAAwB,EACxB,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,uBAAuB,EACxB,MAAM,uBAAuB,CAAC;AAW/B,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAkD,CAAC;AACjG,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAkD,CAAC;AACjG,MAAM,mBAAmB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAkD,CAAC;AAEpH,SAAS,GAAG,CAAC,KAAyB,EAAE,WAAmB;IACzD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;AAC3G,CAAC;AAED,SAAS,SAAS,CAChB,KAA+B,EAC/B,MAAM,GAA6B,CAAC,MAAM,CAAC;IAE3C,MAAM,eAAe,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACnC,IACE,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1C,CAAC,eAAe,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EACnD,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CACf,MAAc,EACd,QAAQ,GAAG,IAAI,EACf,qBAAqB,GAAoC,EAAE;IAE3D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,CAAC;AACvG,CAAC;AAED,SAAS,QAAQ,CAAC,IAA4C,EAAE,QAAiB;IAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAwC,EAAE,MAAsB,EAAE,WAAmB;IACrG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa,EAAE,uBAAuB;IACtC,QAAQ,EAAE;QACR,cAAc,EAAE,+BAA+B;QAC/C,aAAa,EAAE,iCAAiC;QAChD,yBAAyB;QACzB,uBAAuB;KACxB;IACD,MAAM,EAAE;QACN;YACE,EAAE,EAAE,YAAY;YAChB,KAAK,EAAE,0CAA0C;YACjD,YAAY,EAAE,EAAE;YAChB,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;YAChE,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC;YACnC,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,qBAAqB,CAAC;YACtE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,+CAA+C,CAAC;YACjF,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE,kDAAkD;YACzD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,yCAAyC,CAAC,CAAC;YAC9E,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;YACpF,QAAQ,EAAE,QAAQ,CAAC,kBAAkB,CAAC;YACtC,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;YAC5D,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,2CAA2C,CAAC;YAC7E,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE,iDAAiD;YACxD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,EAAE,uCAAuC,CAAC,CAAC;YAC/E,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;YACvF,QAAQ,EAAE,QAAQ,CAAC,kBAAkB,CAAC;YACtC,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;YAC5D,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,wCAAwC,CAAC;YAC1E,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,0CAA0C;YACjD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,EAAE,yDAAyD,CAAC,CAAC;YACjG,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAC9E,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC;YAClC,YAAY,EAAE,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC;YAClD,kBAAkB,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,mBAAmB,CAAC;YAC1E,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,uDAAuD,CAAC;YACzF,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,uCAAuC;YAC9C,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,wCAAwC,CAAC,CAAC;YAC5E,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC7F,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjD,YAAY,EAAE,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC;YAClD,kBAAkB,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;YACzD,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,4CAA4C,CAAC;YAC9E,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,yCAAyC;YAChD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,gDAAgD,CAAC,CAAC;YACjF,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAC9E,QAAQ,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC3D,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,eAAe,CAAC;YAC/D,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,8CAA8C,CAAC;YAChF,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,wCAAwC;YAC/C,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAAC,EAAE,oCAAoC,CAAC,CAAC;YAC/E,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,2BAA2B,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;YACtG,QAAQ,EAAE,QAAQ,CAAC,wBAAwB,EAAE,KAAK,CAAC;YACnD,YAAY,EAAE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC;YAC/C,kBAAkB,EAAE,CAAC,cAAc,EAAE,mBAAmB,EAAE,QAAQ,CAAC;YACnE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,iDAAiD,CAAC;YACnF,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,2DAA2D;YAClE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,EAAE,0DAA0D,CAAC,CAAC;YACxG,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,qBAAqB;gBACpC,IAAI,EAAE,yBAAyB;gBAC/B,gBAAgB,EAAE,0BAA0B;gBAC5C,aAAa,EAAE,EAAE;aAClB;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC;YACvF,QAAQ,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC3D,YAAY,EAAE,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC;YACrD,kBAAkB,EAAE,CAAC,aAAa,EAAE,mBAAmB,EAAE,qBAAqB,CAAC;YAC/E,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,+DAA+D,CAAC;YACjG,cAAc,EAAE,mBAAmB;SACpC;QACD;YACE,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,8CAA8C;YACrD,YAAY,EAAE;gBACZ,GAAG,CAAC,CAAC,qBAAqB,CAAC,EAAE,8DAA8D,CAAC;gBAC5F,GAAG,CAAC,CAAC,kBAAkB,CAAC,EAAE,kFAAkF,CAAC;aAC9G;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,gBAAgB,EAAE,0BAA0B;gBAC5C,aAAa,EAAE,EAAE;aAClB;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;YAC1F,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;YACxD,YAAY,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC;YACnD,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,QAAQ,CAAC;YACzE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,gEAAgE,CAAC;YACpG,cAAc,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC;SACnE;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,EAAE,2DAA2D,CAAC,CAAC;YACpG,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,gBAAgB,EAAE,0BAA0B;gBAC5C,aAAa,EAAE,EAAE;aAClB;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YACzF,QAAQ,EAAE,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;YAC7D,YAAY,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC;YACnD,kBAAkB,EAAE,CAAC,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,CAAC;YAC/E,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,sEAAsE,CAAC;YACxG,cAAc,EAAE,mBAAmB;SACpC;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,sDAAsD;YAC7D,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,EAAE,2CAA2C,CAAC,CAAC;YACzF,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,YAAY;gBAC3B,IAAI,EAAE,4BAA4B;gBAClC,gBAAgB,EAAE,6BAA6B;gBAC/C,aAAa,EAAE,CAAC,iBAAiB,CAAC;aACnC;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAC/D,QAAQ,EAAE,QAAQ,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;YAC/D,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;YACrD,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,0CAA0C,CAAC;YAC5E,cAAc,EAAE,mBAAmB;SACpC;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,+DAA+D;YACtE,YAAY,EAAE;gBACZ,GAAG,CAAC,CAAC,gBAAgB,CAAC,EAAE,8CAA8C,CAAC;gBACvE,GAAG,CAAC,CAAC,qBAAqB,CAAC,EAAE,gDAAgD,CAAC;aAC/E;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,YAAY;gBAC3B,IAAI,EAAE,2BAA2B;gBACjC,gBAAgB,EAAE,4BAA4B;gBAC9C,aAAa,EAAE,CAAC,uBAAuB,CAAC;aACzC;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,EAAE,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;YACjH,QAAQ,EAAE,QAAQ,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnE,YAAY,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC;YACnD,kBAAkB,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,cAAc,CAAC;YAC/E,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,gBAAgB,EAAE,uEAAuE,CAAC;YAC3H,cAAc,EAAE,mBAAmB;SACpC;QACD;YACE,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,gDAAgD;YACvD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,EAAE,uEAAuE,CAAC,CAAC;YACjH,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,YAAY;gBAC3B,IAAI,EAAE,2BAA2B;gBACjC,gBAAgB,EAAE,4BAA4B;gBAC9C,aAAa,EAAE,EAAE;aAClB;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAChF,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YACvD,YAAY,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC;YACnD,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;YAC7D,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,EAAE,+DAA+D,CAAC;YACpH,cAAc,EAAE,mBAAmB;SACpC;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0CAA0C;YACjD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,EAAE,kDAAkD,CAAC,CAAC;YACzF,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,YAAY;gBAC3B,IAAI,EAAE,2BAA2B;gBACjC,gBAAgB,EAAE,4BAA4B;gBAC9C,aAAa,EAAE,EAAE;aAClB;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAC9E,QAAQ,EAAE,QAAQ,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,cAAc,EAAE,eAAe,CAAC;YACzE,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,2CAA2C,CAAC;YAC7F,cAAc,EAAE,mBAAmB;SACpC;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,KAAK,EAAE,2DAA2D;YAClE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAC,EAAE,+CAA+C,CAAC,CAAC;YAC/F,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,YAAY;gBAC3B,IAAI,EAAE,2BAA2B;gBACjC,gBAAgB,EAAE,4BAA4B;gBAC9C,aAAa,EAAE,EAAE;aAClB;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC;YACvE,QAAQ,EAAE,QAAQ,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;YAChE,YAAY,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC;YACnD,kBAAkB,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;YACzD,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,EAAE,4DAA4D,CAAC;YACvH,cAAc,EAAE,mBAAmB;SACpC;QACD;YACE,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,2DAA2D;YAClE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,uBAAuB,EAAE,wBAAwB,CAAC,EAAE,kFAAkF,CAAC,CAAC;YAC5J,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,gBAAgB,EAAE,0BAA0B;gBAC5C,aAAa,EAAE,EAAE;aAClB;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAC/D,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC;YACrC,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;YACrD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,uEAAuE,CAAC;YAC3G,cAAc,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC;SACnE;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,KAAK,EAAE,qDAAqD;YAC5D,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,EAAE,2EAA2E,CAAC,CAAC;YAClH,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;YAC1G,QAAQ,EAAE,QAAQ,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;YAChE,YAAY,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC;YACnD,kBAAkB,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,mBAAmB,CAAC;YAC1E,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,oEAAoE,CAAC;YACtH,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,gDAAgD;YACvD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,wBAAwB,CAAC,EAAE,gEAAgE,CAAC,CAAC;YACjH,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;YAC1F,QAAQ,EAAE,QAAQ,CAAC,0BAA0B,CAAC;YAC9C,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;YAC/C,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,wBAAwB,EAAE,wDAAwD,CAAC;YACpH,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAC,EAAE,mDAAmD,CAAC,CAAC;YACnG,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;YAChE,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpD,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,eAAe,CAAC;YACxD,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,gDAAgD,CAAC;YAClF,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,2CAA2C;YAClD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,mDAAmD,CAAC,CAAC;YACvF,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAC9E,QAAQ,EAAE,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,eAAe,CAAC;YAC7E,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,iDAAiD,CAAC;YACnF,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,iDAAiD;YACxD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,mBAAmB,CAAC,EAAE,sDAAsD,CAAC,CAAC;YAClG,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAC9E,QAAQ,EAAE,QAAQ,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;YACxD,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,0CAA0C,CAAC;YAC5E,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,uDAAuD;YAC9D,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,EAAE,mDAAmD,CAAC,CAAC;YAClG,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;YAChE,QAAQ,EAAE,QAAQ,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC1D,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;YAC5D,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,yCAAyC,CAAC;YAC3E,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,uCAAuC;YAC9C,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,EAAE,wDAAwD,CAAC,CAAC;YAClG,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;YACzE,QAAQ,EAAE,QAAQ,CAAC,yBAAyB,EAAE,KAAK,CAAC;YACpD,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;YAC3C,kBAAkB,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;YAC7D,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,6CAA6C,CAAC;YAC/E,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,mDAAmD;YAC1D,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,EAAE,uDAAuD,CAAC,CAAC;YACtG,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;YACxF,QAAQ,EAAE,QAAQ,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC3D,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;YAC3C,kBAAkB,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;YAC7D,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,EAAE,wEAAwE,CAAC;YAC7H,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE,0CAA0C;YACjD,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAAC,EAAE,4CAA4C,CAAC,CAAC;YACvF,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,gBAAgB,EAAE,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;YAChE,QAAQ,EAAE,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YACxD,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;YACrC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,eAAe,CAAC;YACzD,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,kBAAkB,EAAE,6CAA6C,CAAC;YACnG,cAAc,EAAE,gBAAgB;SACjC;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,KAAK,EAAE,yDAAyD;YAChE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,EAAE,6DAA6D,CAAC,CAAC;YACrG,aAAa,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,YAAY;gBAC3B,IAAI,EAAE,2BAA2B;gBACjC,gBAAgB,EAAE,4BAA4B;gBAC9C,aAAa,EAAE,EAAE;aAClB;YACD,gBAAgB,EAAE,SAAS,CAAC,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;YACrE,QAAQ,EAAE,QAAQ,CAAC,6BAA6B,CAAC;YACjD,YAAY,EAAE,QAAQ,CAAC,sBAAsB,EAAE,IAAI,CAAC;YACpD,kBAAkB,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;YACzD,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,yEAAyE,CAAC;YAC9G,cAAc,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC;SACvD;KACF;CACmC,CAAC;AAIvC,SAAS,aAAa,CAAC,IAAoB;IACzC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,OAAO,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAK,GAAsB,mBAAmB;IAE9C,OAAO,MAAM,CAAC,WAAW,CACvB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CACtC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC,mBAAmB,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,yBAAyB,GAAuB,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;AAC/G,MAAM,CAAC,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;IACrE,yBAAyB;CAC1B,CAAC,CAAC"}

package/dist/domain/governance/activation/inputs.d.ts

@@ -0,0 +1,25 @@
+import type { PhaseId, UserActivationState } from './types.js';
+export interface ActivationInputFile {
+    path: string;
+    digest: string;
+}
+export declare function isProjectMutationReservationName(name: string): boolean;
+export interface ActivationInputSnapshot {
+    schemaVersion: 2;
+    project: unknown;
+    files: readonly ActivationInputFile[];
+    git: {
+        head: string | null;
+        branch: string | null;
+        pushUrls: readonly string[];
+    };
+    baselineSha: string;
+    workflowSpecDigest?: string;
+}
+export declare function normalizedPublicEnvironment(text: string): Record<string, string>;
+export declare function normalizedSeedInput(text: string): string;
+export declare function activationBaselineDigest(project: unknown, files: readonly ActivationInputFile[]): string;
+export declare function phaseInputDigest(phaseId: PhaseId, snapshot: ActivationInputSnapshot): string;
+export declare function remoteBindingDigest(binding: UserActivationState['remoteBinding']): string | undefined;
+export declare function remoteRepository(state: UserActivationState): UserActivationState['repository'];
+export declare function githubRepositoryFromPushUrl(url: string): string;

package/dist/domain/governance/activation/inputs.js

@@ -0,0 +1,63 @@
+import { canonicalSha256 } from './canonical-json.js';
+export function isProjectMutationReservationName(name) {
+    return /^\.liftoff-mutation-[a-f0-9]{64}\.lock$/.test(name);
+}
+const publicEnvironmentKeys = new Set([
+    'APP_NAME', 'APP_ENV', 'ENVIRONMENT', 'LOG_LEVEL', 'PORT', 'HOST', 'CORS_ORIGINS',
+    'MODEL_PROVIDER', 'MODEL_NAME', 'AI_MODEL_PROVIDER', 'AI_MODEL_NAME', 'AI_MODEL_ID',
+    'AZURE_OPENAI_ENDPOINT', 'AZURE_OPENAI_DEPLOYMENT', 'OPENAI_MODEL', 'OLLAMA_BASE_URL',
+    'LANGFUSE_HOST', 'OTEL_SERVICE_NAME', 'OTEL_EXPORTER_OTLP_ENDPOINT',
+    'MESSAGING_TRANSPORT', 'REDIS_STREAM', 'REDIS_STREAM_NAME', 'SERVICE_BUS_NAMESPACE',
+    'SERVICE_BUS_QUEUE_NAME', 'SERVICEBUS_FULLY_QUALIFIED_NAMESPACE', 'SERVICEBUS_QUEUE_NAME'
+]);
+export function normalizedPublicEnvironment(text) {
+    const result = {};
+    for (const line of text.split(/\r?\n/)) {
+        const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+        if (!match || !publicEnvironmentKeys.has(match[1]))
+            continue;
+        let value = match[2].trim();
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")))
+            value = value.slice(1, -1);
+        else
+            value = value.replace(/\s+#.*$/, '').trim();
+        if (value.includes('${'))
+            throw new Error(`Public configuration ${match[1]} has unresolved interpolation; no project configuration is executed.`);
+        if (/https?:\/\/[^/]*@/i.test(value) || /[?&](?:token|key|secret|sig)=/i.test(value))
+            continue;
+        result[match[1]] = value;
+    }
+    return result;
+}
+export function normalizedSeedInput(text) {
+    return text.replace(/\r\n/g, '\n').replace(/^(\s*-\s+\[)[xX](\])/gm, '$1 $2');
+}
+export function activationBaselineDigest(project, files) {
+    return canonicalSha256({ schemaVersion: 2, project, files: [...files].sort((a, b) => a.path.localeCompare(b.path, 'en')) });
+}
+export function phaseInputDigest(phaseId, snapshot) {
+    // Publication creates HEAD; earlier local receipts bind source bytes rather than
+    // the later Git container. The actual resulting OID is recorded in its receipt.
+    const local = ['seed-valid', 'seed-verified', 'seed-archived', 'committed'].includes(phaseId);
+    return canonicalSha256({
+        phaseId,
+        baselineSha: snapshot.baselineSha,
+        ...(!local ? { git: snapshot.git } : {})
+    });
+}
+export function remoteBindingDigest(binding) {
+    if (!binding)
+        return undefined;
+    const { verifiedAt: _verifiedAt, ...identity } = binding;
+    return canonicalSha256(identity);
+}
+export function remoteRepository(state) {
+    return state.remoteBinding ?? state.repository;
+}
+export function githubRepositoryFromPushUrl(url) {
+    const match = /^(?:https:\/\/github\.com\/|git@github\.com:)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/.exec(url);
+    if (!match)
+        throw new Error('A supported credential-free GitHub push destination is required for repository discovery.');
+    return match[1];
+}
+//# sourceMappingURL=inputs.js.map

package/dist/domain/governance/activation/inputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputs.js","sourceRoot":"","sources":["../../../../src/domain/governance/activation/inputs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAQtD,MAAM,UAAU,gCAAgC,CAAC,IAAY;IAC3D,OAAO,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAeD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc;IACjF,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa;IACnF,uBAAuB,EAAE,yBAAyB,EAAE,cAAc,EAAE,iBAAiB;IACrF,eAAe,EAAE,mBAAmB,EAAE,6BAA6B;IACnE,qBAAqB,EAAE,cAAc,EAAE,mBAAmB,EAAE,uBAAuB;IACnF,wBAAwB,EAAE,sCAAsC,EAAE,uBAAuB;CAC1F,CAAC,CAAC;AAEH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;YAAE,SAAS;QAC9D,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;;YAC5H,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC;QAClJ,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/F,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB,EAAE,KAAqC;IAC9F,OAAO,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9H,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,QAAiC;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9F,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA6C;IAC/E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IACzD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAA0B;IACzD,OAAO,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,MAAM,KAAK,GAAG,gGAAgG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzH,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IACzH,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;AACnB,CAAC"}

package/dist/domain/governance/activation/operations.d.ts

@@ -0,0 +1,19 @@
+import type { PhaseGraphNode, PhaseId, SavedTransitionPlan, TransitionOperation } from './types.js';
+import { type ManagedPhaseGraph, type TransitionOperationDestination, type TransitionRollbackPlan } from './types.js';
+export declare function phaseById(graph: ManagedPhaseGraph, phaseId: PhaseId): PhaseGraphNode;
+export declare function phaseOrder(phaseId: PhaseId): number;
+export declare function operation(input: Omit<TransitionOperation, 'phaseId'> & {
+    phaseId: PhaseId;
+}): TransitionOperation;
+export declare function transitionDestination(type: TransitionOperationDestination['type'], identity: string, extras?: Omit<TransitionOperationDestination, 'type' | 'identity'>): TransitionOperationDestination;
+export declare function rollbackPlanForPhase(phase: PhaseGraphNode, completed?: readonly TransitionOperation[]): TransitionRollbackPlan;
+export declare function rollbackPlanFromCompletedOperations(phaseId: PhaseId, strategy: TransitionRollbackPlan['strategy'], target: PhaseId | null, completed: readonly TransitionOperation[]): TransitionRollbackPlan;
+export interface PlanDigestInput {
+    phase: PhaseGraphNode;
+    transitionDigest: string;
+    operations: readonly TransitionOperation[];
+    approvalPlanDigest: string;
+}
+export declare function planDigestFor(input: PlanDigestInput): string;
+export declare function assertOperationAllowed(phase: PhaseGraphNode, operation: TransitionOperation): void;
+export declare function assertPlanOperationsAllowed(plan: SavedTransitionPlan, phase: PhaseGraphNode): void;