@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/domain/governance/assessment/live-normalize.js

@@ -0,0 +1,403 @@
+import { containsSensitiveText, isRecord, sanitizeAssessmentText } from './sanitize.js';
+import { LiveFailure } from './errors.js';
+import { assessmentLimits } from './types.js';
+const maxEntries = assessmentLimits.maxPages * 100;
+export function record(value) {
+    if (!isRecord(value))
+        throw new LiveFailure('invalid-response', 'Required provider metadata was missing or malformed.');
+    return value;
+}
+export function text(value) {
+    if (typeof value !== 'string')
+        throw new LiveFailure('invalid-response', 'Required textual metadata was missing or malformed.');
+    if (containsSensitiveText(value) ||
+        /(?:https?|ftp|ssh):\/\/|\b(?:SharedAccessSignature|DefaultEndpointsProtocol|SharedAccessKey|InstrumentationKey|Endpoint|Server|Database|User\s*Id)\s*=/iu.test(value)) {
+        throw new LiveFailure('sensitive-response', 'Sensitive or URL-bearing metadata was withheld before normalization.');
+    }
+    if (!value || value.length > 2048 || sanitizeAssessmentText(value, 2060) !== value) {
+        throw new LiveFailure('invalid-response', 'Provider text was empty, oversized or contained unsafe control characters.');
+    }
+    return value;
+}
+export function id(value) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 1) {
+        throw new LiveFailure('invalid-response', 'An expected numeric provider identity was unavailable.');
+    }
+    return value;
+}
+export function boolean(value) {
+    if (typeof value !== 'boolean')
+        throw new LiveFailure('invalid-response', 'Expected boolean metadata was unavailable.');
+    return value;
+}
+function number(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value < 0) {
+        throw new LiveFailure('invalid-response', 'Expected numeric metadata was unavailable.');
+    }
+    return value;
+}
+export function list(value) {
+    if (!Array.isArray(value) || value.length > maxEntries) {
+        throw new LiveFailure('invalid-response', 'Expected bounded array metadata was unavailable.');
+    }
+    return value;
+}
+export function sorted(values) {
+    return values.sort((a, b) => {
+        const left = JSON.stringify(a);
+        const right = JSON.stringify(b);
+        return left < right ? -1 : left > right ? 1 : 0;
+    });
+}
+function array(decode) {
+    return (value) => sorted(list(value).map(decode));
+}
+function nullable(decode) {
+    return (value) => value === null ? null : decode(value);
+}
+function enumeration(values) {
+    return (value) => {
+        const entry = text(value);
+        if (!values.includes(entry)) {
+            throw new LiveFailure('unsupported-response', 'Unrecognized enforcement metadata prevents a complete normalized observation.');
+        }
+        return entry;
+    };
+}
+function shape(fields, required = [], strict = false) {
+    return (value) => {
+        const input = record(value);
+        if (required.some((key) => !Object.hasOwn(input, key))) {
+            throw new LiveFailure('invalid-response', 'Required metadata fields were omitted by the provider.');
+        }
+        if (strict && Object.keys(input).some((key) => !Object.hasOwn(fields, key))) {
+            throw new LiveFailure('unsupported-response', 'Unrecognized enforcement fields prevent a complete normalized observation.');
+        }
+        return Object.fromEntries(Object.entries(fields)
+            .filter(([key]) => Object.hasOwn(input, key))
+            .map(([key, decode]) => [key, decode(input[key])]));
+    };
+}
+const strings = array(text);
+const toggle = shape({ enabled: boolean }, ['enabled']);
+const actor = shape({ id, login: text, slug: text }, ['id']);
+const actors = shape({ users: array(actor), teams: array(actor), apps: array(actor) });
+const checkContext = shape({ context: text, integration_id: nullable(number) }, ['context'], true);
+const workflow = shape({ path: text, repository_id: id, ref: text, sha: text }, ['path', 'repository_id'], true);
+const ruleParameters = shape({
+    update_allows_fetch_and_merge: boolean,
+    required_deployment_environments: strings,
+    required_status_checks: array(checkContext),
+    strict_required_status_checks_policy: boolean,
+    do_not_enforce_on_create: boolean,
+    dismiss_stale_reviews_on_push: boolean,
+    require_code_owner_review: boolean,
+    require_last_push_approval: boolean,
+    required_approving_review_count: number,
+    required_review_thread_resolution: boolean,
+    allowed_merge_methods: strings,
+    operator: text, pattern: text, negate: boolean, name: text,
+    restricted_file_paths: strings, restricted_file_extensions: strings,
+    max_file_path_length: number, max_file_size: number,
+    workflows: array(workflow), required_workflows: array(workflow),
+    code_scanning_tools: array(shape({
+        tool: text, alerts_threshold: text, security_alerts_threshold: text
+    }, ['tool', 'alerts_threshold', 'security_alerts_threshold'], true)),
+    merge_method: text, grouping_strategy: text,
+    check_response_timeout_minutes: number, max_entries_to_build: number,
+    min_entries_to_merge: number, max_entries_to_merge: number,
+    min_entries_to_merge_wait_minutes: number,
+    automatic_review: boolean, review_on_push: boolean, review_draft_pull_requests: boolean
+}, [], true);
+export const normalizeRule = shape({
+    type: enumeration([
+        'creation', 'update', 'deletion', 'required_linear_history', 'merge_queue',
+        'required_deployments', 'required_signatures', 'pull_request', 'required_status_checks',
+        'non_fast_forward', 'commit_message_pattern', 'commit_author_email_pattern', 'committer_email_pattern',
+        'branch_name_pattern', 'tag_name_pattern', 'file_path_restriction', 'max_file_path_length',
+        'file_extension_restriction', 'max_file_size', 'workflows', 'required_workflows', 'code_scanning', 'copilot_code_review'
+    ]),
+    parameters: ruleParameters,
+    ruleset_id: id, ruleset_source_type: text, ruleset_source: text
+}, ['type'], true);
+const patterns = shape({ include: strings, exclude: strings }, ['include', 'exclude'], true);
+const repositoryPatterns = shape({
+    include: strings, exclude: strings, protected: boolean
+}, ['include', 'exclude'], true);
+const propertyCondition = shape({
+    name: text, source: text, property_values: strings
+}, ['name', 'property_values'], true);
+export const normalizeRuleset = shape({
+    id, node_id: text, name: text,
+    target: enumeration(['branch', 'tag', 'push']),
+    enforcement: enumeration(['disabled', 'active', 'evaluate']),
+    source_type: text, source: text,
+    conditions: shape({
+        ref_name: patterns,
+        repository_name: repositoryPatterns,
+        repository_id: shape({ repository_ids: array(id) }, ['repository_ids'], true),
+        repository_property: shape({
+            include: array(propertyCondition), exclude: array(propertyCondition)
+        }, ['include', 'exclude'], true)
+    }, [], true),
+    bypass_actors: array(shape({
+        actor_id: nullable(number), actor_type: text, bypass_mode: text
+    }, ['actor_id', 'actor_type', 'bypass_mode'], true)),
+    rules: array(normalizeRule)
+}, ['id', 'name', 'target', 'enforcement', 'source_type', 'source', 'conditions', 'bypass_actors', 'rules']);
+export const normalizeProtection = shape({
+    required_status_checks: nullable(shape({
+        strict: boolean, contexts: strings,
+        checks: array(shape({ context: text, app_id: nullable(number) }, ['context', 'app_id']))
+    }, ['strict', 'contexts'])),
+    enforce_admins: toggle,
+    required_pull_request_reviews: nullable(shape({
+        dismissal_restrictions: actors,
+        dismiss_stale_reviews: boolean, require_code_owner_reviews: boolean,
+        required_approving_review_count: number, require_last_push_approval: boolean,
+        bypass_pull_request_allowances: actors
+    }, ['dismiss_stale_reviews', 'require_code_owner_reviews', 'required_approving_review_count'])),
+    restrictions: nullable(actors),
+    required_linear_history: toggle, allow_force_pushes: toggle, allow_deletions: toggle,
+    block_creations: toggle, required_conversation_resolution: toggle,
+    required_signatures: toggle, lock_branch: toggle, allow_fork_syncing: toggle
+}, ['enforce_admins']);
+const uuidPattern = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/iu;
+export function uuid(value) {
+    const found = text(value);
+    if (!uuidPattern.test(found))
+        throw new LiveFailure('unsafe-scope', 'A subscription or identity GUID was invalid.');
+    return found;
+}
+function armId(value) {
+    const found = text(value);
+    const parts = found.split('/');
+    if (parts.length < 9 || parts.length % 2 !== 1 ||
+        parts[0] !== '' || parts[1].toLowerCase() !== 'subscriptions' ||
+        !uuidPattern.test(parts[2]) || parts[3].toLowerCase() !== 'resourcegroups' ||
+        parts[5].toLowerCase() !== 'providers' ||
+        parts.slice(3).some((part) => !/^[A-Za-z0-9_.()-]+$/u.test(part) || part === '.' || part === '..')) {
+        throw new LiveFailure('unsafe-scope', 'An ARM resource identity was not a complete safe resource path.');
+    }
+    return found;
+}
+const reference = shape({ id: armId }, ['id']);
+const references = array(reference);
+const addressSpace = shape({ addressPrefixes: strings });
+const dnsSettings = shape({ enableProxy: boolean, servers: strings, requireProxyForNetworkRules: boolean });
+const subnetFields = {
+    provisioningState: text, addressPrefix: text, addressPrefixes: strings,
+    defaultOutboundAccess: boolean, sharingScope: text,
+    privateEndpointNetworkPolicies: text, privateLinkServiceNetworkPolicies: text,
+    natGateway: nullable(reference), routeTable: nullable(reference), networkSecurityGroup: nullable(reference),
+    serviceEndpoints: array(shape({ service: text, locations: strings }, ['service'])),
+    serviceEndpointPolicies: references,
+    delegations: array(shape({
+        name: text, properties: shape({ serviceName: text, actions: strings }, ['serviceName'])
+    }, ['name', 'properties']))
+};
+const subnet = shape(subnetFields);
+const resourceChild = (properties) => shape({ id: armId, name: text, properties }, ['properties']);
+const route = shape({
+    provisioningState: text, addressPrefix: text, nextHopType: text,
+    nextHopIpAddress: text, hasBgpOverride: boolean
+});
+const securityRule = shape({
+    provisioningState: text, protocol: text, access: text, priority: number, direction: text,
+    sourcePortRange: text, sourcePortRanges: strings, destinationPortRange: text, destinationPortRanges: strings,
+    sourceAddressPrefix: text, sourceAddressPrefixes: strings,
+    destinationAddressPrefix: text, destinationAddressPrefixes: strings,
+    sourceApplicationSecurityGroups: references, destinationApplicationSecurityGroups: references
+});
+const privateConnections = array(shape({
+    id: armId,
+    properties: shape({
+        provisioningState: text, privateEndpoint: reference,
+        privateLinkServiceConnectionState: shape({ status: text, actionsRequired: text }, ['status'])
+    }, ['privateLinkServiceConnectionState'])
+}, ['properties']));
+const ipConfiguration = resourceChild(shape({
+    provisioningState: text, privateIPAddress: text, publicIPAddress: reference, subnet: reference
+}));
+const networkRule = shape({
+    name: text, protocols: strings, sourceAddresses: strings, destinationAddresses: strings,
+    sourceIpGroups: strings, destinationIpGroups: strings, destinationPorts: strings, destinationFqdns: strings
+});
+const applicationRule = shape({
+    name: text, sourceAddresses: strings, sourceIpGroups: strings, targetFqdns: strings, fqdnTags: strings,
+    protocols: array(shape({ protocolType: text, port: number }, ['protocolType', 'port']))
+});
+const ruleCollection = (decode) => resourceChild(shape({
+    priority: number, action: shape({ type: text }, ['type']), rules: array(decode)
+}, ['priority', 'action', 'rules']));
+const resourceDefinitions = {
+    'microsoft.storage/storageaccounts': {
+        type: 'Microsoft.Storage/storageAccounts', apiVersion: '2023-05-01',
+        properties: shape({
+            provisioningState: text, publicNetworkAccess: text,
+            allowBlobPublicAccess: boolean, allowSharedKeyAccess: boolean,
+            supportsHttpsTrafficOnly: boolean, minimumTlsVersion: text,
+            defaultToOAuthAuthentication: boolean, allowCrossTenantReplication: boolean,
+            isHnsEnabled: boolean, isNfsV3Enabled: boolean,
+            networkAcls: shape({
+                defaultAction: text, bypass: text,
+                ipRules: array(shape({ action: text, value: text }, ['value'])),
+                virtualNetworkRules: array(shape({ action: text, id: armId, state: text }, ['id'])),
+                resourceAccessRules: array(shape({ tenantId: uuid, resourceId: armId }, ['tenantId', 'resourceId']))
+            }),
+            encryption: shape({
+                keySource: text, requireInfrastructureEncryption: boolean,
+                services: shape(Object.fromEntries(['blob', 'file', 'queue', 'table'].map((service) => [service, shape({ enabled: boolean, keyType: text })])))
+            }),
+            privateEndpointConnections: privateConnections
+        })
+    },
+    'microsoft.network/virtualnetworks': {
+        type: 'Microsoft.Network/virtualNetworks', apiVersion: '2024-05-01',
+        properties: shape({
+            provisioningState: text, addressSpace, dhcpOptions: shape({ dnsServers: strings }),
+            enableDdosProtection: boolean, ddosProtectionPlan: reference, flowTimeoutInMinutes: number,
+            encryption: shape({ enabled: boolean, enforcement: text }),
+            subnets: array(resourceChild(subnet)),
+            virtualNetworkPeerings: array(resourceChild(shape({
+                allowVirtualNetworkAccess: boolean, allowForwardedTraffic: boolean,
+                allowGatewayTransit: boolean, useRemoteGateways: boolean,
+                remoteVirtualNetwork: reference, remoteAddressSpace: addressSpace, peeringState: text
+            })))
+        })
+    },
+    'microsoft.network/virtualnetworks/subnets': {
+        type: 'Microsoft.Network/virtualNetworks/subnets', apiVersion: '2024-05-01', properties: subnet
+    },
+    'microsoft.network/networksecuritygroups': {
+        type: 'Microsoft.Network/networkSecurityGroups', apiVersion: '2024-05-01',
+        properties: shape({
+            provisioningState: text, securityRules: array(resourceChild(securityRule)),
+            defaultSecurityRules: array(resourceChild(securityRule))
+        })
+    },
+    'microsoft.network/routetables': {
+        type: 'Microsoft.Network/routeTables', apiVersion: '2024-05-01',
+        properties: shape({ provisioningState: text, disableBgpRoutePropagation: boolean, routes: array(resourceChild(route)) })
+    },
+    'microsoft.network/routetables/routes': {
+        type: 'Microsoft.Network/routeTables/routes', apiVersion: '2024-05-01', properties: route
+    },
+    'microsoft.network/natgateways': {
+        type: 'Microsoft.Network/natGateways', apiVersion: '2024-05-01',
+        properties: shape({
+            provisioningState: text, idleTimeoutInMinutes: number, publicIpAddresses: references,
+            publicIpPrefixes: references, subnets: references
+        })
+    },
+    'microsoft.network/azurefirewalls': {
+        type: 'Microsoft.Network/azureFirewalls', apiVersion: '2024-05-01',
+        properties: shape({
+            provisioningState: text, threatIntelMode: text, firewallPolicy: reference, virtualHub: reference,
+            dnsSettings, ipConfigurations: array(ipConfiguration), managementIpConfiguration: ipConfiguration,
+            applicationRuleCollections: array(ruleCollection(applicationRule)),
+            networkRuleCollections: array(ruleCollection(networkRule))
+        })
+    },
+    'microsoft.network/firewallpolicies': {
+        type: 'Microsoft.Network/firewallPolicies', apiVersion: '2024-05-01',
+        properties: shape({ provisioningState: text, threatIntelMode: text, dnsSettings, basePolicy: reference })
+    },
+    'microsoft.network/publicipaddresses': {
+        type: 'Microsoft.Network/publicIPAddresses', apiVersion: '2024-05-01',
+        properties: shape({
+            provisioningState: text, publicIPAllocationMethod: text, publicIPAddressVersion: text,
+            ipAddress: text, publicIPPrefix: reference, idleTimeoutInMinutes: number,
+            dnsSettings: shape({ domainNameLabel: text, fqdn: text, reverseFqdn: text })
+        })
+    },
+    'microsoft.network/publicipprefixes': {
+        type: 'Microsoft.Network/publicIPPrefixes', apiVersion: '2024-05-01',
+        properties: shape({ provisioningState: text, publicIPAddressVersion: text, prefixLength: number, ipPrefix: text })
+    },
+    'microsoft.network/privateendpoints': {
+        type: 'Microsoft.Network/privateEndpoints', apiVersion: '2024-05-01',
+        properties: shape({
+            provisioningState: text, subnet: reference,
+            privateLinkServiceConnections: array(resourceChild(shape({
+                privateLinkServiceId: armId, groupIds: strings,
+                privateLinkServiceConnectionState: shape({ status: text, actionsRequired: text }, ['status'])
+            }, ['privateLinkServiceId']))),
+            customDnsConfigs: array(shape({ fqdn: text, ipAddresses: strings }, ['fqdn', 'ipAddresses']))
+        })
+    },
+    'microsoft.network/privatednszones': {
+        type: 'Microsoft.Network/privateDnsZones', apiVersion: '2020-06-01',
+        properties: shape({
+            provisioningState: text, numberOfRecordSets: number, maxNumberOfRecordSets: number,
+            numberOfVirtualNetworkLinks: number, numberOfVirtualNetworkLinksWithRegistration: number
+        })
+    },
+    'microsoft.network/privatednszones/virtualnetworklinks': {
+        type: 'Microsoft.Network/privateDnsZones/virtualNetworkLinks', apiVersion: '2020-06-01',
+        properties: shape({
+            provisioningState: text, registrationEnabled: boolean, virtualNetwork: reference,
+            virtualNetworkLinkState: text, resolutionPolicy: text
+        })
+    },
+    'microsoft.managedidentity/userassignedidentities': {
+        type: 'Microsoft.ManagedIdentity/userAssignedIdentities', apiVersion: '2023-01-31',
+        properties: shape({ tenantId: uuid, principalId: uuid, clientId: uuid })
+    },
+    'github.network/networksettings': {
+        type: 'GitHub.Network/networkSettings', apiVersion: '2024-04-02',
+        properties: shape({
+            provisioningState: text, subnetId: armId,
+            businessId: (value) => typeof value === 'number' ? number(value) : text(value)
+        })
+    }
+};
+export function azureBinding(value, environments) {
+    const subscriptionId = uuid(value.subscriptionId);
+    const resourceId = armId(value.resourceId);
+    const parts = resourceId.split('/');
+    const definition = resourceDefinitions[text(value.resourceType).toLowerCase()];
+    const actualType = [parts[6], ...parts.slice(7).filter((_, index) => index % 2 === 0)].join('/');
+    if (!definition || actualType.toLowerCase() !== value.resourceType.toLowerCase() ||
+        parts[2].toLowerCase() !== subscriptionId.toLowerCase() ||
+        !['dev', 'staging', 'prod'].includes(value.environment) || !environments.includes(value.environment) ||
+        !['state', 'application', 'runner-network'].includes(value.role)) {
+        throw new LiveFailure('unsafe-azure-scope', 'The resource type, subscription, environment or role did not match an explicit allowlisted binding.');
+    }
+    const namespace = definition.type.split('/')[0];
+    return {
+        subscriptionId, resourceId, resourceType: definition.type, environment: value.environment, role: value.role,
+        namespace,
+        url: `https://management.azure.com${resourceId}?api-version=${definition.apiVersion}`
+    };
+}
+export function normalizeResource(value, binding) {
+    const input = record(value);
+    if (armId(input.id).toLowerCase() !== binding.resourceId.toLowerCase() ||
+        text(input.type).toLowerCase() !== binding.resourceType.toLowerCase()) {
+        throw new LiveFailure('scope-mismatch', 'The ARM resource response did not match the exact requested resource identity and type.');
+    }
+    const properties = record(resourceDefinitions[binding.resourceType.toLowerCase()].properties(input.properties));
+    if (Object.keys(properties).length === 0) {
+        throw new LiveFailure('invalid-response', 'No allowlisted resource configuration was present in the ARM response.');
+    }
+    if (input.identity !== undefined && input.identity !== null) {
+        const identity = record(input.identity);
+        const normalized = record(shape({ type: text, principalId: uuid, tenantId: uuid }, ['type'])(identity));
+        if (identity.userAssignedIdentities !== undefined) {
+            normalized.userAssignedIdentities = sorted(Object.entries(record(identity.userAssignedIdentities))
+                .map(([key, entry]) => ({
+                id: armId(key), ...record(shape({ principalId: uuid, clientId: uuid })(entry))
+            })));
+        }
+        properties.identity = normalized;
+    }
+    return {
+        subscriptionId: binding.subscriptionId, environment: binding.environment,
+        resourceId: binding.resourceId, resourceType: binding.resourceType, role: binding.role,
+        properties: properties,
+        sku: input.sku === undefined || input.sku === null ? null
+            : shape({ name: text, tier: text, size: text, family: text, capacity: number })(input.sku)
+    };
+}
+//# sourceMappingURL=live-normalize.js.map

package/dist/domain/governance/assessment/live-normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-normalize.js","sourceRoot":"","sources":["../../../../src/domain/governance/assessment/live-normalize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAA+C,MAAM,YAAY,CAAC;AAI3F,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,GAAG,GAAG,CAAC;AAEnD,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;IACxH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,qDAAqD,CAAC,CAAC;IAChI,IAAI,qBAAqB,CAAC,KAAK,CAAC;QAC5B,0JAA0J,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3K,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,sEAAsE,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QACnF,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,4EAA4E,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;IACxH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QACvD,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,MAAM,CAAI,MAAW;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,MAAe;IAC5B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,MAAe;IAC/B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,MAAyB;IAC5C,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,+EAA+E,CAAC,CAAC;QACjI,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc,EAAE,QAAQ,GAAa,EAAE,EAAE,MAAM,GAAG,KAAK;IACpE,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,4EAA4E,CAAC,CAAC;QAC9H,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aAC7C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACxD,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACvF,MAAM,YAAY,GAAG,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AACnG,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;AACjH,MAAM,cAAc,GAAG,KAAK,CAAC;IAC3B,6BAA6B,EAAE,OAAO;IACtC,gCAAgC,EAAE,OAAO;IACzC,sBAAsB,EAAE,KAAK,CAAC,YAAY,CAAC;IAC3C,oCAAoC,EAAE,OAAO;IAC7C,wBAAwB,EAAE,OAAO;IACjC,6BAA6B,EAAE,OAAO;IACtC,yBAAyB,EAAE,OAAO;IAClC,0BAA0B,EAAE,OAAO;IACnC,+BAA+B,EAAE,MAAM;IACvC,iCAAiC,EAAE,OAAO;IAC1C,qBAAqB,EAAE,OAAO;IAC9B,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI;IAC1D,qBAAqB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO;IACnE,oBAAoB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;IACnD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC;IAC/D,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC;QAC/B,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI;KACpE,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI;IAC3C,8BAA8B,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM;IACpE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM;IAC1D,iCAAiC,EAAE,MAAM;IACzC,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO;CACxF,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;AAEb,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;IACjC,IAAI,EAAE,WAAW,CAAC;QAChB,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,yBAAyB,EAAE,aAAa;QAC1E,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,wBAAwB;QACvF,kBAAkB,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,yBAAyB;QACtG,qBAAqB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB;QAC1F,4BAA4B,EAAE,eAAe,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,EAAE,qBAAqB;KACzH,CAAC;IACF,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI;CAChE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAEnB,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO;CACvD,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AACjC,MAAM,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO;CACnD,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;IACpC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC7B,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,WAAW,EAAE,WAAW,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;IAC/B,UAAU,EAAE,KAAK,CAAC;QAChB,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,kBAAkB;QACnC,aAAa,EAAE,KAAK,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC;QAC7E,mBAAmB,EAAE,KAAK,CAAC;YACzB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC;SACrE,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC;KACjC,EAAE,EAAE,EAAE,IAAI,CAAC;IACZ,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC;QACzB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;KAChE,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC;CAC5B,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7G,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;IACvC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC;QACrC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;QAClC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;KACzF,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,MAAM;IACtB,6BAA6B,EAAE,QAAQ,CAAC,KAAK,CAAC;QAC5C,sBAAsB,EAAE,MAAM;QAC9B,qBAAqB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO;QACnE,+BAA+B,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO;QAC5E,8BAA8B,EAAE,MAAM;KACvC,EAAE,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,iCAAiC,CAAC,CAAC,CAAC;IAC/F,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM;IACpF,eAAe,EAAE,MAAM,EAAE,gCAAgC,EAAE,MAAM;IACjE,mBAAmB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM;CAC7E,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAEvB,MAAM,WAAW,GAAG,kEAAkE,CAAC;AACvF,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,8CAA8C,CAAC,CAAC;IACpH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,eAAe;QAC9D,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,gBAAgB;QAC5E,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,WAAW;QACvC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,iEAAiE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;AACpC,MAAM,YAAY,GAAG,KAAK,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;AACzD,MAAM,WAAW,GAAG,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5G,MAAM,YAAY,GAAW;IAC3B,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO;IACtE,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI;IAClD,8BAA8B,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI;IAC7E,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC3G,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,uBAAuB,EAAE,UAAU;IACnC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC;QACvB,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;KACxF,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;CAC5B,CAAC;AACF,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;AACnC,MAAM,aAAa,GAAG,CAAC,UAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5G,MAAM,KAAK,GAAG,KAAK,CAAC;IAClB,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;IAC/D,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO;CAChD,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,KAAK,CAAC;IACzB,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;IACxF,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO;IAC5G,mBAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO;IACzD,wBAAwB,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO;IACnE,+BAA+B,EAAE,UAAU,EAAE,oCAAoC,EAAE,UAAU;CAC9F,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC;IACrC,EAAE,EAAE,KAAK;IACT,UAAU,EAAE,KAAK,CAAC;QAChB,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QACnD,iCAAiC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;KAC9F,EAAE,CAAC,mCAAmC,CAAC,CAAC;CAC1C,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACpB,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC;IAC1C,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS;CAC/F,CAAC,CAAC,CAAC;AACJ,MAAM,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO;IACvF,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO;CAC5G,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IACtG,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;CACxF,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,CAAC,MAAe,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;CAChF,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAErC,MAAM,mBAAmB,GAA8E;IACrG,mCAAmC,EAAE;QACnC,IAAI,EAAE,mCAAmC,EAAE,UAAU,EAAE,YAAY;QACnE,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI;YAClD,qBAAqB,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO;YAC7D,wBAAwB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI;YAC1D,4BAA4B,EAAE,OAAO,EAAE,2BAA2B,EAAE,OAAO;YAC3E,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO;YAC9C,WAAW,EAAE,KAAK,CAAC;gBACjB,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;gBACjC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/D,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnF,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;aACrG,CAAC;YACF,UAAU,EAAE,KAAK,CAAC;gBAChB,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO;gBACzD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACpF,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aAC3D,CAAC;YACF,0BAA0B,EAAE,kBAAkB;SAC/C,CAAC;KACH;IACD,mCAAmC,EAAE;QACnC,IAAI,EAAE,mCAAmC,EAAE,UAAU,EAAE,YAAY;QACnE,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAClF,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM;YAC1F,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,sBAAsB,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC;gBAChD,yBAAyB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO;gBAClE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO;gBACxD,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI;aACtF,CAAC,CAAC,CAAC;SACL,CAAC;KACH;IACD,2CAA2C,EAAE;QAC3C,IAAI,EAAE,2CAA2C,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;KAChG;IACD,yCAAyC,EAAE;QACzC,IAAI,EAAE,yCAAyC,EAAE,UAAU,EAAE,YAAY;QACzE,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC1E,oBAAoB,EAAE,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;SACzD,CAAC;KACH;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,+BAA+B,EAAE,UAAU,EAAE,YAAY;QAC/D,UAAU,EAAE,KAAK,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;KACzH;IACD,sCAAsC,EAAE;QACtC,IAAI,EAAE,sCAAsC,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK;KAC1F;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,+BAA+B,EAAE,UAAU,EAAE,YAAY;QAC/D,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU;YACpF,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;SAClD,CAAC;KACH;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,kCAAkC,EAAE,UAAU,EAAE,YAAY;QAClE,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS;YAChG,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,yBAAyB,EAAE,eAAe;YACjG,0BAA0B,EAAE,KAAK,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YAClE,sBAAsB,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;SAC3D,CAAC;KACH;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,oCAAoC,EAAE,UAAU,EAAE,YAAY;QACpE,UAAU,EAAE,KAAK,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;KAC1G;IACD,qCAAqC,EAAE;QACrC,IAAI,EAAE,qCAAqC,EAAE,UAAU,EAAE,YAAY;QACrE,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI;YACrF,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM;YACxE,WAAW,EAAE,KAAK,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SAC7E,CAAC;KACH;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,oCAAoC,EAAE,UAAU,EAAE,YAAY;QACpE,UAAU,EAAE,KAAK,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACnH;IACD,oCAAoC,EAAE;QACpC,IAAI,EAAE,oCAAoC,EAAE,UAAU,EAAE,YAAY;QACpE,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS;YAC1C,6BAA6B,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC;gBACvD,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO;gBAC9C,iCAAiC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;aAC9F,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC9B,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;SAC9F,CAAC;KACH;IACD,mCAAmC,EAAE;QACnC,IAAI,EAAE,mCAAmC,EAAE,UAAU,EAAE,YAAY;QACnE,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM;YAClF,2BAA2B,EAAE,MAAM,EAAE,2CAA2C,EAAE,MAAM;SACzF,CAAC;KACH;IACD,uDAAuD,EAAE;QACvD,IAAI,EAAE,uDAAuD,EAAE,UAAU,EAAE,YAAY;QACvF,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS;YAChF,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI;SACtD,CAAC;KACH;IACD,kDAAkD,EAAE;QAClD,IAAI,EAAE,kDAAkD,EAAE,UAAU,EAAE,YAAY;QAClF,UAAU,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACzE;IACD,gCAAgC,EAAE;QAChC,IAAI,EAAE,gCAAgC,EAAE,UAAU,EAAE,YAAY;QAChE,UAAU,EAAE,KAAK,CAAC;YAChB,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK;YACxC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;SAC/E,CAAC;KACH;CACF,CAAC;AAOF,MAAM,UAAU,YAAY,CAAC,KAA6B,EAAE,YAA+B;IACzF,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjG,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE;QAC5E,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE;QACxD,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QACpG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,qGAAqG,CAAC,CAAC;IACrJ,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACjD,OAAO;QACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;QAC3G,SAAS;QACT,GAAG,EAAE,+BAA+B,UAAU,gBAAgB,UAAU,CAAC,UAAU,EAAE;KACtF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,OAA8B;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;QAClE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,yFAAyF,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,CAAE,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACjH,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,wEAAwE,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxG,IAAI,QAAQ,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;YAClD,UAAU,CAAC,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;iBAC/F,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;aAC/E,CAAC,CAAC,CAAC,CAAC;QACT,CAAC;QACD,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC;IACnC,CAAC;IACD,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;QACxE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;QACtF,UAAU,EAAE,UAAuC;QACnD,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;YACvD,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KAC7F,CAAC;AACJ,CAAC"}

package/dist/domain/governance/assessment/predicates.d.ts

@@ -0,0 +1,36 @@
+import type { ParsedWorkflow } from './yaml.js';
+export interface PredicateResult {
+    value: boolean | null;
+    reason: string;
+    exceptionResource?: string;
+    absent?: boolean;
+}
+export declare function protectedRefs(value: unknown, defaultBranch?: string | null): PredicateResult;
+export declare function effectiveProtectedRefs(rulesetValue: unknown, branchValue: unknown, familyValue: unknown, defaultBranch?: string | null): PredicateResult;
+export declare function singleMaintainer(value: unknown): PredicateResult;
+export declare function tagControls(value: unknown, actionsAppId?: number): PredicateResult;
+export declare function requiredCheckContexts(value: unknown): Array<{
+    name: string;
+    appId: number | null;
+}> | null;
+export declare function requiredContextBindings(value: unknown, refs: readonly string[], defaultBranch: string | null): Array<{
+    ref: string;
+    contexts: Array<{
+        name: string;
+        appId: number | null;
+    }>;
+}> | null;
+export declare function effectiveRequiredContextBindings(ruleValue: unknown, branchValue: unknown, refs: readonly string[], defaultBranch: string | null): Array<{
+    ref: string;
+    contexts: Array<{
+        name: string;
+        appId: number | null;
+    }>;
+}> | null;
+export declare function observedRequiredContexts(ruleValue: unknown, checkValue: unknown, defaultBranch?: string | null, branchValue?: unknown): PredicateResult;
+export declare function workflowPermissions(workflows: ParsedWorkflow[]): PredicateResult;
+export declare function actionReferences(workflows: ParsedWorkflow[]): string[] | null;
+export declare function pinnedActions(workflows: ParsedWorkflow[]): PredicateResult;
+export declare function failOpenFlags(workflows: ParsedWorkflow[], rules: unknown): PredicateResult;
+export declare function securityPipeline(workflows: ParsedWorkflow[]): PredicateResult;
+export declare function runnerAlignment(value: unknown, repository: string | null): PredicateResult;