@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/domain/governance/assessment/predicates.js

@@ -0,0 +1,545 @@
+import { isRecord } from './sanitize.js';
+function result(value, reason) {
+    return { value, reason };
+}
+function records(value) {
+    return Array.isArray(value) && value.every(isRecord) ? value : null;
+}
+function strings(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === 'string') ? value : null;
+}
+function ruleList(ruleset) {
+    return records(ruleset.rules);
+}
+function scopePatterns(ruleset) {
+    if (!isRecord(ruleset.conditions) || !isRecord(ruleset.conditions.ref_name))
+        return null;
+    if (Object.keys(ruleset.conditions).some((key) => key !== 'ref_name'))
+        return null;
+    const include = strings(ruleset.conditions.ref_name.include);
+    const exclude = strings(ruleset.conditions.ref_name.exclude);
+    return include && exclude ? { include, exclude } : null;
+}
+function parameters(rule) {
+    return isRecord(rule.parameters) ? rule.parameters : null;
+}
+function zeroReviewers(rule) {
+    const values = parameters(rule);
+    if (!values || typeof values.required_approving_review_count !== 'number' ||
+        typeof values.require_code_owner_review !== 'boolean' || typeof values.require_last_push_approval !== 'boolean' ||
+        typeof values.dismiss_stale_reviews_on_push !== 'boolean')
+        return null;
+    return values.required_approving_review_count === 0 &&
+        values.require_code_owner_review === false && values.require_last_push_approval === false &&
+        values.dismiss_stale_reviews_on_push === true;
+}
+function refMatches(pattern, ref, defaultBranch) {
+    if (pattern === '~ALL' || pattern === ref)
+        return true;
+    if (pattern === '~DEFAULT_BRANCH')
+        return defaultBranch === null ? null : ref === `refs/heads/${defaultBranch}`;
+    if (pattern === 'refs/heads/release/**' || pattern === 'refs/heads/hotfix/**')
+        return ref.startsWith(pattern.slice(0, -2));
+    if (/[*?[\]{}]/u.test(pattern))
+        return null;
+    return false;
+}
+function matchingBranchRules(rulesets, ref, defaultBranch) {
+    const matching = [];
+    let uncertain = false;
+    for (const ruleset of rulesets.filter((entry) => entry.target === 'branch' && entry.enforcement === 'active' &&
+        (entry.source_type === undefined ||
+            ['Repository', 'Organization', 'Enterprise'].includes(String(entry.source_type))))) {
+        const patterns = scopePatterns(ruleset);
+        if (!patterns) {
+            uncertain = true;
+            continue;
+        }
+        if (ref.endsWith('/**') && patterns.exclude.some((pattern) => pattern.startsWith(ref.slice(0, -2)) || pattern.startsWith('~') || /[*?[\]{}]/u.test(pattern))) {
+            uncertain = true;
+            continue;
+        }
+        const include = patterns.include.map((pattern) => refMatches(pattern, ref, defaultBranch));
+        const exclude = patterns.exclude.map((pattern) => refMatches(pattern, ref, defaultBranch));
+        if (exclude.includes(true))
+            continue;
+        if (exclude.includes(null) || (!include.includes(true) && include.includes(null))) {
+            uncertain = true;
+            continue;
+        }
+        if (include.includes(true))
+            matching.push(ruleset);
+    }
+    return { matching, uncertain };
+}
+export function protectedRefs(value, defaultBranch = null) {
+    const rulesets = records(value);
+    if (!rulesets)
+        return result(null, 'Ruleset inventory is not interpretable.');
+    const refs = ['refs/heads/develop', 'refs/heads/main', 'refs/heads/release/**', 'refs/heads/hotfix/**'];
+    for (const ref of refs) {
+        const { matching, uncertain } = matchingBranchRules(rulesets, ref, defaultBranch);
+        if (!matching.length)
+            return { ...result(uncertain ? null : false, `No proven active protection covers ${ref}.`), absent: !uncertain };
+        const rules = [];
+        for (const ruleset of matching) {
+            const members = ruleList(ruleset);
+            if (!members || !Array.isArray(ruleset.bypass_actors))
+                return result(null, 'Required rule or bypass metadata is unavailable.');
+            if (ruleset.bypass_actors.length)
+                return result(false, `Protection for ${ref} permits bypass actors.`);
+            rules.push(...members);
+        }
+        if (!['deletion', 'non_fast_forward', 'pull_request', 'required_status_checks'].every((type) => rules.some((rule) => rule.type === type))) {
+            return result(false, `Required protection rules are absent for ${ref}.`);
+        }
+        const checks = rules.filter((rule) => rule.type === 'required_status_checks');
+        if (!checks.some((rule) => {
+            const config = parameters(rule);
+            return config?.strict_required_status_checks_policy === true && config.do_not_enforce_on_create === true &&
+                Array.isArray(config.required_status_checks) && config.required_status_checks.length > 0;
+        }))
+            return result(false, `Strict, non-empty required checks are not configured for ${ref}.`);
+    }
+    return result(true, 'Required GitFlow refs have active non-bypassable repository protections.');
+}
+function classicRequiredContexts(value) {
+    if (value === null)
+        return [];
+    if (!isRecord(value))
+        return null;
+    const required = value.required_status_checks;
+    if (required === null)
+        return [];
+    if (!isRecord(required) || required.strict !== true)
+        return null;
+    const checks = records(required.checks);
+    const contexts = strings(required.contexts);
+    if (!checks || !contexts)
+        return null;
+    const result = [];
+    for (const check of checks) {
+        if (typeof check.context !== 'string' ||
+            (check.app_id !== null && typeof check.app_id !== 'number'))
+            return null;
+        result.push({ name: check.context, appId: check.app_id });
+    }
+    for (const context of contexts) {
+        if (!result.some((entry) => entry.name === context)) {
+            result.push({ name: context, appId: null });
+        }
+    }
+    return result;
+}
+function classicProtection(value) {
+    if (value === null)
+        return true;
+    if (!isRecord(value))
+        return null;
+    const force = isRecord(value.allow_force_pushes) ? value.allow_force_pushes.enabled : undefined;
+    const deletion = isRecord(value.allow_deletions) ? value.allow_deletions.enabled : undefined;
+    const reviews = value.required_pull_request_reviews;
+    const checks = classicRequiredContexts(value);
+    if (typeof force !== 'boolean' || typeof deletion !== 'boolean' || checks === null)
+        return null;
+    if (force || deletion || checks.length === 0 || reviews === null)
+        return false;
+    if (!isRecord(reviews) ||
+        typeof reviews.required_approving_review_count !== 'number' ||
+        typeof reviews.require_code_owner_reviews !== 'boolean' ||
+        typeof reviews.require_last_push_approval !== 'boolean' ||
+        typeof reviews.dismiss_stale_reviews !== 'boolean')
+        return null;
+    return reviews.required_approving_review_count === 0 &&
+        reviews.require_code_owner_reviews === false &&
+        reviews.require_last_push_approval === false &&
+        reviews.dismiss_stale_reviews === true;
+}
+export function effectiveProtectedRefs(rulesetValue, branchValue, familyValue, defaultBranch = null) {
+    const declared = protectedRefs(rulesetValue, defaultBranch);
+    if (declared.value === false)
+        return declared;
+    const branches = records(branchValue);
+    if (!branches)
+        return result(null, 'Exact branch and classic/effective protection observations are unavailable.');
+    if (!isRecord(familyValue) || familyValue.complete !== true) {
+        return result(null, 'Release and hotfix branch-family enumeration is incomplete.');
+    }
+    const prefixes = strings(familyValue.prefixes);
+    const familyRefs = strings(familyValue.refs);
+    if (!prefixes || !familyRefs || !['release/', 'hotfix/'].every((prefix) => prefixes.includes(prefix))) {
+        return result(null, 'Release and hotfix branch-family coverage is not authoritative.');
+    }
+    const requiredRefs = [...new Set(['develop', 'main', ...familyRefs])];
+    for (const ref of requiredRefs) {
+        const branch = branches.find((entry) => entry.name === ref);
+        if (!branch) {
+            return ref === 'develop' || ref === 'main'
+                ? { ...result(false, `Required protected branch ${ref} was absent.`), absent: true }
+                : result(null, `Enumerated branch ${ref} lacked protection metadata.`);
+        }
+        if (branch.protected !== true || branch.protectionObserved !== true || !isRecord(branch.protection)) {
+            return result(false, `Branch ${ref} is not proven protected by complete effective/classic metadata.`);
+        }
+        const protection = branch.protection;
+        const classic = classicProtection(protection.classic);
+        if (classic === false)
+            return result(false, `Classic branch protection contradicts the target on ${ref}.`);
+        if (classic === null)
+            return result(null, `Classic branch protection is incomplete on ${ref}.`);
+        const effectiveRules = records(protection.effectiveRules);
+        if (!effectiveRules)
+            return result(null, `Effective branch rules are incomplete on ${ref}.`);
+    }
+    return declared.value === null
+        ? declared
+        : result(true, 'Repository, inherited/effective, and classic protections cover every exact assessed ref.');
+}
+export function singleMaintainer(value) {
+    const rulesets = records(value);
+    if (!rulesets)
+        return result(null, 'Pull request rules are not observable.');
+    const reviews = [];
+    for (const ruleset of rulesets.filter((entry) => entry.target === 'branch' && entry.enforcement === 'active')) {
+        const rules = ruleList(ruleset);
+        if (!rules)
+            return result(null, 'Ruleset rule details are missing.');
+        reviews.push(...rules.filter((rule) => rule.type === 'pull_request'));
+    }
+    if (!reviews.length)
+        return { ...result(false, 'No active pull request rule was observed.'), absent: true };
+    const results = reviews.map(zeroReviewers);
+    if (results.includes(false))
+        return result(false, 'A pull request rule requires a human or code-owner approval.');
+    return result(results.includes(null) ? null : true, results.includes(null) ? 'Review settings are incomplete.' : 'Observed pull request rules use zero required human reviewers.');
+}
+export function tagControls(value, actionsAppId) {
+    const rulesets = records(value);
+    if (!rulesets)
+        return result(null, 'Tag rule details are unavailable.');
+    const matching = rulesets.filter((ruleset) => {
+        const patterns = scopePatterns(ruleset);
+        return ruleset.target === 'tag' && ruleset.enforcement === 'active' && patterns?.exclude.length === 0 &&
+            (patterns.include.includes('refs/tags/v*') || patterns.include.includes('~ALL'));
+    });
+    if (!matching.length)
+        return { ...result(false, 'No active release-tag rules were observed.'), absent: true };
+    let creation = false;
+    let immutable = false;
+    for (const ruleset of matching) {
+        const rules = ruleList(ruleset);
+        const actors = records(ruleset.bypass_actors);
+        if (!rules || !actors)
+            return result(null, 'Tag rule or bypass actor details are unavailable.');
+        if (rules.some((rule) => rule.type === 'creation') && actors.length === 1) {
+            creation ||= actors[0].actor_type === 'Integration' && typeof actors[0].actor_id === 'number' &&
+                (actionsAppId === undefined || actors[0].actor_id === actionsAppId) &&
+                !rules.some((rule) => ['deletion', 'non_fast_forward'].includes(String(rule.type)));
+        }
+        immutable ||= actors.length === 0 && ['deletion', 'non_fast_forward'].every((type) => rules.some((rule) => rule.type === type));
+    }
+    return result(creation && immutable, 'Release tags require separate automation-only creation and non-bypassable immutability rules.');
+}
+export function requiredCheckContexts(value) {
+    const rulesets = records(value);
+    if (!rulesets)
+        return null;
+    const contexts = [];
+    for (const ruleset of rulesets.filter((entry) => entry.target === 'branch' && entry.enforcement === 'active')) {
+        const rules = ruleList(ruleset);
+        if (!rules)
+            return null;
+        for (const rule of rules.filter((entry) => entry.type === 'required_status_checks')) {
+            const checks = records(parameters(rule)?.required_status_checks);
+            if (!checks)
+                return null;
+            for (const check of checks) {
+                if (typeof check.context !== 'string' || !check.context || (check.integration_id !== null && check.integration_id !== undefined && typeof check.integration_id !== 'number'))
+                    return null;
+                contexts.push({ name: check.context, appId: typeof check.integration_id === 'number' ? check.integration_id : null });
+            }
+        }
+    }
+    return contexts;
+}
+export function requiredContextBindings(value, refs, defaultBranch) {
+    const rulesets = records(value);
+    if (!rulesets || !refs.length)
+        return null;
+    const bindings = [];
+    for (const ref of [...new Set(refs)].sort()) {
+        const { matching, uncertain } = matchingBranchRules(rulesets, `refs/heads/${ref}`, defaultBranch);
+        const contexts = requiredCheckContexts(matching);
+        if (uncertain || contexts === null)
+            return null;
+        const normalized = [...new Map(contexts.map((context) => [`${context.name}\0${context.appId}`, context])).values()]
+            .sort((a, b) => a.name.localeCompare(b.name, 'en') || (a.appId ?? -1) - (b.appId ?? -1));
+        bindings.push({ ref, contexts: normalized });
+    }
+    return bindings;
+}
+export function effectiveRequiredContextBindings(ruleValue, branchValue, refs, defaultBranch) {
+    const bindings = requiredContextBindings(ruleValue, refs, defaultBranch);
+    const branches = records(branchValue);
+    if (!bindings || !branches)
+        return null;
+    const resultBindings = [];
+    for (const binding of bindings) {
+        const branch = branches.find((entry) => entry.name === binding.ref);
+        if (!branch || !isRecord(branch.protection)) {
+            resultBindings.push(binding);
+            continue;
+        }
+        const classic = classicRequiredContexts(branch.protection.classic);
+        if (classic === null)
+            return null;
+        const contexts = [...new Map([...binding.contexts, ...classic]
+                .map((context) => [`${context.name}\0${context.appId}`, context])).values()]
+            .sort((a, b) => a.name.localeCompare(b.name, 'en') || (a.appId ?? -1) - (b.appId ?? -1));
+        resultBindings.push({ ref: binding.ref, contexts });
+    }
+    return resultBindings;
+}
+export function observedRequiredContexts(ruleValue, checkValue, defaultBranch = null, branchValue) {
+    const rulesets = records(ruleValue);
+    const refs = records(checkValue);
+    if (!rulesets || !refs?.length)
+        return result(null, 'Required contexts or commit-bound check observations are unavailable.');
+    for (const ref of refs) {
+        if (typeof ref.ref !== 'string' || typeof ref.sha !== 'string' || !/^[a-f0-9]{40,64}$/iu.test(ref.sha)) {
+            return result(null, 'Check observations are not bound to known refs and commit SHAs.');
+        }
+        const checks = records(ref.checks);
+        if (!checks)
+            return result(null, 'Check run metadata is incomplete.');
+        const { matching, uncertain } = matchingBranchRules(rulesets, `refs/heads/${ref.ref}`, defaultBranch);
+        let required = requiredCheckContexts(matching);
+        if (required !== null && branchValue !== undefined) {
+            const branch = records(branchValue)?.find((entry) => entry.name === ref.ref);
+            if (branch && isRecord(branch.protection)) {
+                const classic = classicRequiredContexts(branch.protection.classic);
+                if (classic === null)
+                    return result(null, `Classic required checks for ${ref.ref} are unresolved.`);
+                required = [...new Map([...required, ...classic]
+                        .map((context) => [`${context.name}\0${context.appId}`, context])).values()];
+            }
+        }
+        if (uncertain || required === null)
+            return result(null, `Required context scope for ${ref.ref} is unresolved.`);
+        if (!required.length)
+            return { ...result(false, `No required contexts are configured for ${ref.ref}.`), absent: true };
+        if (!required.every((context) => checks.some((check) => check.name === context.name && (context.appId === null || context.appId === check.appId) &&
+            check.status === 'completed' && check.conclusion === 'success')))
+            return result(false, `Required contexts do not have matching successful checks on ${ref.ref}@${ref.sha}.`);
+    }
+    return result(true, 'Required contexts match successful check runs on each exact assessed ref and commit.');
+}
+function workflowJobs(workflow) {
+    if (!isRecord(workflow.value.jobs) || Object.keys(workflow.value.jobs).length === 0)
+        return null;
+    const values = Object.entries(workflow.value.jobs);
+    if (values.some(([, job]) => !isRecord(job)))
+        return null;
+    return values.map(([id, job]) => ({ ...(isRecord(job) ? job : {}), id }));
+}
+function permission(value) {
+    if (value === 'write-all')
+        return false;
+    if (value === 'read-all')
+        return true;
+    if (!isRecord(value))
+        return null;
+    const entries = Object.values(value);
+    return entries.every((entry) => ['read', 'write', 'none'].includes(String(entry))) ? true : null;
+}
+export function workflowPermissions(workflows) {
+    if (!workflows.length)
+        return result(false, 'No workflow files were found.');
+    let unknown = false;
+    for (const workflow of workflows) {
+        const top = permission(workflow.value.permissions);
+        const jobs = workflowJobs(workflow);
+        if (!jobs)
+            return result(null, `Jobs cannot be interpreted in ${workflow.path}.`);
+        for (const job of jobs) {
+            const found = job.permissions === undefined ? top : permission(job.permissions);
+            if (found === false)
+                return result(false, `Broad write-all permissions in ${workflow.path}.`);
+            unknown ||= found === null;
+        }
+    }
+    return result(unknown ? null : true, unknown ? 'Effective workflow permissions are not explicitly known.' : 'Workflow permissions are explicitly bounded.');
+}
+export function actionReferences(workflows) {
+    const refs = [];
+    for (const workflow of workflows) {
+        const jobs = workflowJobs(workflow);
+        if (!jobs)
+            return null;
+        for (const job of jobs) {
+            if (job.uses !== undefined) {
+                if (typeof job.uses !== 'string')
+                    return null;
+                refs.push(job.uses);
+            }
+            if (job.steps !== undefined) {
+                const steps = records(job.steps);
+                if (!steps)
+                    return null;
+                for (const step of steps) {
+                    if (step.uses === undefined)
+                        continue;
+                    if (typeof step.uses !== 'string')
+                        return null;
+                    refs.push(step.uses);
+                }
+            }
+        }
+    }
+    return [...new Set(refs)].sort();
+}
+export function pinnedActions(workflows) {
+    const refs = actionReferences(workflows);
+    if (!refs || !refs.length)
+        return result(null, 'No interpretable action reference inventory was found.');
+    if (refs.some((ref) => ref.includes('${{')))
+        return result(null, 'Dynamic action references cannot be resolved safely.');
+    const unpinned = refs.filter((ref) => !ref.startsWith('./') &&
+        !/^[^@\s]+@[a-f0-9]{40}$/iu.test(ref) && !/^docker:\/\/[^@\s]+@sha256:[a-f0-9]{64}$/iu.test(ref));
+    const value = result(unpinned.length === 0, unpinned.length ? `Unpinned action references: ${unpinned.join(', ')}` : 'External action references are content-pinned.');
+    if (unpinned.length === 1 && /^slsa-framework\/slsa-github-generator\/\.github\/workflows\/[a-zA-Z0-9_-]+\.yml@v\d+\.\d+\.\d+$/u.test(unpinned[0])) {
+        value.exceptionResource = unpinned[0];
+    }
+    return value;
+}
+export function failOpenFlags(workflows, rules) {
+    const contexts = requiredCheckContexts(rules);
+    if (!contexts?.length)
+        return result(null, 'Exact required contexts are needed to distinguish gates from diagnostic/report-only jobs.');
+    const matched = new Set();
+    let unknown = false;
+    for (const workflow of workflows) {
+        const jobs = workflowJobs(workflow);
+        if (!jobs)
+            return result(null, `Jobs cannot be interpreted in ${workflow.path}.`);
+        const byId = new Map(jobs.map((job) => [String(job.id), job]));
+        const visit = (job, requiredName, visiting) => {
+            const id = String(job.id);
+            if (visiting.has(id))
+                return result(null, `Required job ${requiredName} has a cyclic needs graph in ${workflow.path}.`);
+            if (job.uses !== undefined || job.strategy !== undefined || job.if !== undefined ||
+                (typeof job.name === 'string' && job.name.includes('${{'))) {
+                return result(null, `Required job ${requiredName} has reusable, matrix, dynamic-name, or conditional semantics in ${workflow.path}.`);
+            }
+            const steps = job.steps === undefined ? [] : records(job.steps);
+            if (!steps)
+                return result(null, `Required job steps are not interpretable in ${workflow.path}.`);
+            for (const item of [job, ...steps]) {
+                if (item['continue-on-error'] === true) {
+                    return result(true, `Required job ${requiredName} or a transitive dependency permits continue-on-error in ${workflow.path}.`);
+                }
+                if (item['continue-on-error'] !== undefined && typeof item['continue-on-error'] !== 'boolean') {
+                    return result(null, `Required job ${requiredName} has dynamic continue-on-error semantics in ${workflow.path}.`);
+                }
+                if (item !== job && (item.if !== undefined || item.uses !== undefined &&
+                    typeof item.uses === 'string' && item.uses.includes('${{'))) {
+                    return result(null, `Required job ${requiredName} has unresolved step conditions or dynamic actions in ${workflow.path}.`);
+                }
+            }
+            const needs = job.needs === undefined
+                ? []
+                : typeof job.needs === 'string'
+                    ? [job.needs]
+                    : strings(job.needs);
+            if (needs === null)
+                return result(null, `Required job ${requiredName} has dynamic needs semantics in ${workflow.path}.`);
+            const next = new Set(visiting).add(id);
+            for (const dependencyId of needs) {
+                const dependency = byId.get(dependencyId);
+                if (!dependency)
+                    return result(null, `Required job ${requiredName} references unresolved dependency ${dependencyId}.`);
+                const dependencyResult = visit(dependency, requiredName, next);
+                if (dependencyResult)
+                    return dependencyResult;
+            }
+            return null;
+        };
+        for (const context of contexts) {
+            const matching = jobs.filter((job) => {
+                const name = typeof job.name === 'string' ? job.name : String(job.id);
+                return context.name === name;
+            });
+            if (matching.length !== 1)
+                continue;
+            matched.add(context.name);
+            const check = visit(matching[0], context.name, new Set());
+            if (check?.value === true)
+                return check;
+            if (check?.value === null)
+                unknown = true;
+        }
+    }
+    const unresolved = contexts.some((context) => !matched.has(context.name));
+    return result(unresolved || unknown ? null : false, unresolved || unknown
+        ? 'Some required-job flag semantics are unresolved.' : 'No continue-on-error flags were observed in identified required jobs; script semantics require separate proof.');
+}
+export function securityPipeline(workflows) {
+    const refs = actionReferences(workflows);
+    if (!refs || !workflows.length)
+        return result(null, 'Security workflow inventory is unavailable.');
+    const forbidden = ['gitleaks/gitleaks-action', 'semgrep/semgrep-action', 'microsoft/security-devops-action'];
+    if (refs.some((ref) => forbidden.some((repo) => ref.toLowerCase().startsWith(`${repo}@`)))) {
+        return result(false, 'A policy-excluded duplicate security scanner is declared.');
+    }
+    return result(null, 'Action inventory is observable, but complete stage/tool roles and script-backed gates require explicit execution evidence.');
+}
+export function runnerAlignment(value, repository) {
+    if (!isRecord(value))
+        return result(null, 'Hosted-runner metadata is unavailable.');
+    if (value.repositoryAssigned === false) {
+        return { ...result(false, 'The bound runner group is authoritatively not assigned to this repository.'), absent: true };
+    }
+    if (value.repositoryAssigned !== true || typeof value.runnerId !== 'number' ||
+        typeof value.groupId !== 'number' || typeof value.networkConfigurationId !== 'string' ||
+        typeof value.repository !== 'string' || !repository ||
+        value.repository.toLowerCase() !== repository.toLowerCase()) {
+        return result(null, 'Exact runner, group, network, and repository assignment is incomplete.');
+    }
+    if (!isRecord(value.runner) || !isRecord(value.group) || !isRecord(value.network)) {
+        return result(null, 'Runner capacity, group restrictions, or network metadata is incomplete.');
+    }
+    const runner = value.runner;
+    const group = value.group;
+    const network = value.network;
+    const labels = strings(runner.labels);
+    const selectedWorkflows = strings(group.selectedWorkflows);
+    const networkSettings = strings(network.networkSettingsIds);
+    const size = isRecord(runner.machineSize) ? runner.machineSize : null;
+    if (!labels || !selectedWorkflows || !networkSettings || !size ||
+        typeof runner.maximumRunners !== 'number' || typeof runner.publicIpEnabled !== 'boolean' ||
+        typeof runner.status !== 'string' || typeof size.cpuCores !== 'number' ||
+        typeof size.memoryGb !== 'number' || typeof group.visibility !== 'string' ||
+        typeof group.allowsPublicRepositories !== 'boolean' ||
+        typeof group.restrictedToWorkflows !== 'boolean' ||
+        typeof group.inherited !== 'boolean' || typeof network.computeService !== 'string') {
+        return result(null, 'Runner labels, capacity, status, restrictions, or network facts are incomplete.');
+    }
+    const aligned = ['ready', 'online', 'idle'].includes(runner.status.toLowerCase()) &&
+        labels.includes('private-staging') &&
+        runner.maximumRunners === 1 &&
+        runner.publicIpEnabled === false &&
+        size.cpuCores >= 4 &&
+        size.memoryGb >= 16 &&
+        group.visibility === 'selected' &&
+        group.allowsPublicRepositories === false &&
+        group.restrictedToWorkflows === true &&
+        group.inherited === false &&
+        selectedWorkflows.length > 0 &&
+        selectedWorkflows.every((workflow) => workflow.toLowerCase().startsWith(`${repository.toLowerCase()}/.github/workflows/`)) &&
+        network.computeService === 'actions' &&
+        networkSettings.length > 0;
+    return result(aligned, aligned
+        ? 'Runner assignment, labels, capacity, status, repository/workflow restrictions, and network binding match policy.'
+        : 'Runner identity alone is insufficient; one or more labels, capacity, status, restrictions, workflow bindings, or network facts conflict.');
+}
+//# sourceMappingURL=predicates.js.map

package/dist/domain/governance/assessment/predicates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"predicates.js","sourceRoot":"","sources":["../../../../src/domain/governance/assessment/predicates.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AASzC,SAAS,MAAM,CAAC,KAAqB,EAAE,MAAc;IACnD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACnH,CAAC;AACD,SAAS,QAAQ,CAAC,OAAgC;IAChD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AACD,SAAS,aAAa,CAAC,OAAgC;IACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AACD,SAAS,UAAU,CAAC,IAA6B;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AACD,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,+BAA+B,KAAK,QAAQ;QACrE,OAAO,MAAM,CAAC,yBAAyB,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,0BAA0B,KAAK,SAAS;QAC/G,OAAO,MAAM,CAAC,6BAA6B,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,MAAM,CAAC,+BAA+B,KAAK,CAAC;QACjD,MAAM,CAAC,yBAAyB,KAAK,KAAK,IAAI,MAAM,CAAC,0BAA0B,KAAK,KAAK;QACzF,MAAM,CAAC,6BAA6B,KAAK,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,aAA4B;IAC5E,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,iBAAiB;QAAE,OAAO,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,aAAa,EAAE,CAAC;IAChH,IAAI,OAAO,KAAK,uBAAuB,IAAI,OAAO,KAAK,sBAAsB;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3H,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAmC,EAAE,GAAW,EAAE,aAA4B;IAE9E,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ;QAC1G,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;YAC9B,CAAC,YAAY,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9F,EAAE,CAAC;YACF,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3F,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAClH,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,aAAa,GAAkB,IAAI;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;IACxG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,sCAAsC,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC;QACvI,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAC;YAC/H,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAAC,CAAC;YACvG,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1I,OAAO,MAAM,CAAC,KAAK,EAAE,4CAA4C,GAAG,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,MAAM,EAAE,oCAAoC,KAAK,IAAI,IAAI,MAAM,CAAC,wBAAwB,KAAK,IAAI;gBACtG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7F,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,4DAA4D,GAAG,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,0EAA0E,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAkD,EAAE,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAuB,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,6BAA6B,CAAC;IACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChG,IAAI,KAAK,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAClB,OAAO,OAAO,CAAC,+BAA+B,KAAK,QAAQ;QAC3D,OAAO,OAAO,CAAC,0BAA0B,KAAK,SAAS;QACvD,OAAO,OAAO,CAAC,0BAA0B,KAAK,SAAS;QACvD,OAAO,OAAO,CAAC,qBAAqB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,OAAO,CAAC,+BAA+B,KAAK,CAAC;QAClD,OAAO,CAAC,0BAA0B,KAAK,KAAK;QAC5C,OAAO,CAAC,0BAA0B,KAAK,KAAK;QAC5C,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,YAAqB,EACrB,WAAoB,EACpB,WAAoB,EACpB,aAAa,GAAkB,IAAI;IAEnC,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,6EAA6E,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACtG,OAAO,MAAM,CAAC,IAAI,EAAE,iEAAiE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM;gBACxC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,6BAA6B,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBACpF,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,GAAG,8BAA8B,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACpG,OAAO,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,kEAAkE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,uDAAuD,GAAG,GAAG,CAAC,CAAC;QAC3G,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,8CAA8C,GAAG,GAAG,CAAC,CAAC;QAChG,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,4CAA4C,GAAG,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,KAAK,IAAI;QAC5B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,0FAA0F,CAAC,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9G,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,2CAA2C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5G,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,EAAE,8DAA8D,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC;AACrL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,YAAqB;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YACnG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,4CAA4C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9G,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,mDAAmD,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,UAAU,KAAK,aAAa,IAAI,OAAO,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,KAAK,QAAQ;gBAC7F,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,KAAK,YAAY,CAAC;gBACpE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,+FAA+F,CAAC,CAAC;AACxI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAkD,EAAE,CAAC;IACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9G,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,wBAAwB,CAAC,EAAE,CAAC;YACpF,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC1L,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAc,EAAE,IAAuB,EAAE,aAA4B;IAErE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAoF,EAAE,CAAC;IACrG,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aAChH,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,SAAkB,EAClB,WAAoB,EACpB,IAAuB,EACvB,aAA4B;IAE5B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,cAAc,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC;iBAC3D,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aAC3E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,SAAkB,EAClB,UAAmB,EACnB,aAAa,GAAkB,IAAI,EACnC,WAAqB;IAErB,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,uEAAuE,CAAC,CAAC;IAC7H,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvG,OAAO,MAAM,CAAC,IAAI,EAAE,iEAAiE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACtE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;QACtG,IAAI,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7E,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACnE,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,+BAA+B,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC;gBACpG,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;yBAC7C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,IAAI,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,8BAA8B,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC;QAChH,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,2CAA2C,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACvH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACrD,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;YACxF,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAC/D,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,+DAA+D,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,sFAAsF,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,YAAY,CAAC,QAAwB;IAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AACD,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAA2B;IAC7D,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC7E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,iCAAiC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QAClF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAC,KAAK,EAAE,kCAAkC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YAC9F,OAAO,KAAK,KAAK,KAAK,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,0DAA0D,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC;AAC9J,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAA2B;IAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC;gBACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;wBAAE,SAAS;oBACtC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA2B;IACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACzG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,sDAAsD,CAAC,CAAC;IACzH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QACzD,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;IACvK,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,mGAAmG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACpJ,KAAK,CAAC,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA2B,EAAE,KAAc;IACvE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,2FAA2F,CAAC,CAAC;IACxI,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,iCAAiC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,CACZ,GAA4B,EAC5B,YAAoB,EACpB,QAAqB,EACG,EAAE;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,gBAAgB,YAAY,gCAAgC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YACxH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;gBAC5E,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC/D,OAAO,MAAM,CAAC,IAAI,EAAE,gBAAgB,YAAY,oEAAoE,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YACxI,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,+CAA+C,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YACjG,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,IAAI,EAAE,CAAC;oBACvC,OAAO,MAAM,CAAC,IAAI,EAAE,gBAAgB,YAAY,4DAA4D,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;gBAChI,CAAC;gBACD,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC9F,OAAO,MAAM,CAAC,IAAI,EAAE,gBAAgB,YAAY,+CAA+C,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;gBACnH,CAAC;gBACD,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;oBACjE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAChE,OAAO,MAAM,CAAC,IAAI,EAAE,gBAAgB,YAAY,yDAAyD,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC7H,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;oBAC7B,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;oBACb,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,gBAAgB,YAAY,mCAAmC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YACzH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvC,KAAK,MAAM,YAAY,IAAI,KAAK,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC1C,IAAI,CAAC,UAAU;oBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,gBAAgB,YAAY,qCAAqC,YAAY,GAAG,CAAC,CAAC;gBACvH,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;gBAC/D,IAAI,gBAAgB;oBAAE,OAAO,gBAAgB,CAAC;YAChD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnC,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtE,OAAO,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACpC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,IAAI,KAAK,EAAE,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxC,IAAI,KAAK,EAAE,KAAK,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,IAAI,OAAO;QACvE,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,gHAAgH,CAAC,CAAC;AAC7K,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAA2B;IAC1D,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,6CAA6C,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IAC7G,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,MAAM,CAAC,KAAK,EAAE,2DAA2D,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,4HAA4H,CAAC,CAAC;AACpJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,UAAyB;IACvE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,4EAA4E,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1H,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QACvE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,sBAAsB,KAAK,QAAQ;QACrF,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU;QACnD,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC,IAAI,EAAE,wEAAwE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,OAAO,MAAM,CAAC,IAAI,EAAE,yEAAyE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI;QAC1D,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,SAAS;QACxF,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACtE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACzE,OAAO,KAAK,CAAC,wBAAwB,KAAK,SAAS;QACnD,OAAO,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAChD,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvF,OAAO,MAAM,CAAC,IAAI,EAAE,iFAAiF,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/E,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAClC,MAAM,CAAC,cAAc,KAAK,CAAC;QAC3B,MAAM,CAAC,eAAe,KAAK,KAAK;QAChC,IAAI,CAAC,QAAQ,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,IAAI,EAAE;QACnB,KAAK,CAAC,UAAU,KAAK,UAAU;QAC/B,KAAK,CAAC,wBAAwB,KAAK,KAAK;QACxC,KAAK,CAAC,qBAAqB,KAAK,IAAI;QACpC,KAAK,CAAC,SAAS,KAAK,KAAK;QACzB,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC5B,iBAAiB,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnC,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,qBAAqB,CAAC,CACpF;QACD,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,CACX,OAAO,EACP,OAAO;QACL,CAAC,CAAC,kHAAkH;QACpH,CAAC,CAAC,0IAA0I,CAC/I,CAAC;AACJ,CAAC"}

package/dist/domain/governance/assessment/report.d.ts

@@ -0,0 +1,23 @@
+import type { AssessmentDiagnostic, AssessmentFinding, AssessmentProjectIdentity, AssessmentReport, AssessmentTarget, ControlDefinition, FindingScope, JsonValue, Layer, Observation } from './types.js';
+export declare function classifyFinding(input: {
+    control: ControlDefinition;
+    scope: FindingScope;
+    expected?: JsonValue;
+    applicability: AssessmentFinding['applicability'];
+    observations: Partial<Record<Layer, Observation>>;
+    difference?: 'outdated' | 'conflicting' | 'missing';
+    exception?: AssessmentFinding['exception'];
+}): AssessmentFinding;
+export declare function reportCoverage(findings: readonly AssessmentFinding[]): AssessmentReport['coverage'];
+export declare function assembleAssessmentReport(input: {
+    projectRoot: string;
+    mode: 'local' | 'live';
+    target: AssessmentTarget | null;
+    projectIdentity: AssessmentProjectIdentity;
+    snapshot: AssessmentReport['snapshot'];
+    findings: AssessmentFinding[];
+    diagnostics: AssessmentDiagnostic[];
+    disabled?: boolean;
+    failed?: boolean;
+}): AssessmentReport;
+export declare function validateAssessmentReport(value: unknown): AssessmentReport;