@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/governance-activation/transition-planning.js

@@ -0,0 +1,259 @@
+import { NodeCommandRunner } from '../process-runner.js';
+import { evidencePathParts, safeTimestamp, evidenceWriteOperation, stateWriteOperation, assertNoSecrets } from './transition-records.js';
+import { remoteRepository, githubRepositoryFromPushUrl } from '../domain/governance/activation/inputs.js';
+import { operation, transitionDestination, phaseById, planDigestFor, rollbackPlanForPhase, assertPlanOperationsAllowed } from '../domain/governance/activation/operations.js';
+import { generatedSeedChangeName, previewLocalSeedPhase, selectSeedBaselineChecks } from './seed-lifecycle.js';
+import { gitCommitOperations, gitPushOperations, reviewedPushUrl, inspectGitRepository } from './phase-publication.js';
+import { credentialPolicyPathParts } from './credentials.js';
+import { latestRecordWithPayload, rulesetSourceDigestFromEvidence } from '../domain/governance/activation/evidence.js';
+import { validateManifestActivationForExecution, validateSavedTransitionPlan } from '../domain/governance/activation/validators.js';
+import { transitionPlanForPhase, evaluateApprovalForTransitionPlan } from '../domain/governance/activation/approvals.js';
+import { phaseCapabilities } from '../domain/governance/activation/capabilities.js';
+import { errorMessage } from './transition-process.js';
+import { canonicalSha256 } from '../domain/governance/activation/canonical-json.js';
+const planLifetimeMs = 15 * 60 * 1000;
+async function phaseOperations(inspection, phase, runner, createdAt, localRevalidation = false) {
+    const repositoryName = remoteRepository(inspection.state).name;
+    const baseEvidencePath = evidencePathParts(`${phase.id}-${safeTimestamp(createdAt)}`);
+    const writeOps = () => [evidenceWriteOperation(phase, baseEvidencePath), stateWriteOperation(phase)];
+    const repositoryStep = (actionId, mutationClass, inputs, repository = repositoryName) => operation({
+        adapter: 'github', actionId, mutationClass, phaseId: phase.id, inputs,
+        destination: transitionDestination('repository', repository, { repository }),
+        remote: true, destructive: false
+    });
+    const subscriptionStep = (actionId, mutationClass, inputs, subscriptionId = 'phase-0-discovered-subscription') => operation({
+        adapter: 'azure-opentofu', actionId, mutationClass, phaseId: phase.id, inputs,
+        destination: transitionDestination('subscription', subscriptionId, { subscriptionId }),
+        remote: true, destructive: false
+    });
+    const localStep = (actionId, mutationClass, inputs, destination, adapter = 'selected-spec-workflow', destructive = false) => operation({ adapter, actionId, mutationClass, phaseId: phase.id, inputs, destination, remote: false, destructive });
+    if (localRevalidation) {
+        if (phase.id !== 'seed-valid' && phase.id !== 'seed-verified' && phase.id !== 'seed-archived') {
+            throw new Error(`Local revalidation stops before ${phase.id}; review its separate governance transition.`);
+        }
+        const preview = await previewLocalSeedPhase(inspection.projectRoot, inspection.manifest, phase.id);
+        if (preview.blockers.length)
+            throw new Error(preview.blockers.join(' '));
+        return [preview.operation, ...writeOps()];
+    }
+    switch (phase.id) {
+        case 'seed-valid':
+            return [
+                localStep('openspec.seed.validate', 'read-worktree', { changeName: generatedSeedChangeName(inspection.manifest) }, transitionDestination('local', inspection.projectRoot)),
+                ...writeOps()
+            ];
+        case 'seed-verified':
+            return [
+                localStep('openspec.seed.baseline-verify', 'read-worktree', {
+                    changeName: generatedSeedChangeName(inspection.manifest),
+                    checks: selectSeedBaselineChecks(inspection.manifest).map((check) => ({
+                        id: check.id, taskId: check.taskId, applicable: check.applicability.applicable
+                    }))
+                }, transitionDestination('local', inspection.projectRoot)),
+                ...(inspection.manifest.project.specWorkflow === 'spec-kit' ? [
+                    localStep('seed.tasks.project', 'write-seed-tasks', { pathParts: ['specs', '000-liftoff-bootstrap', 'tasks.md'] }, transitionDestination('local', 'specs/000-liftoff-bootstrap/tasks.md', { pathParts: ['specs', '000-liftoff-bootstrap', 'tasks.md'] }))
+                ] : []),
+                ...writeOps()
+            ];
+        case 'seed-archived':
+            return [
+                localStep('openspec.seed.archive', inspection.manifest.project.specWorkflow === 'spec-kit' ? 'read-worktree' : 'write-openspec-seed', { changeName: generatedSeedChangeName(inspection.manifest) }, transitionDestination('local', inspection.manifest.project.specWorkflow === 'spec-kit' ? 'specs/000-liftoff-bootstrap' : 'openspec/changes')),
+                ...writeOps()
+            ];
+        case 'committed':
+            return [...await gitCommitOperations(inspection, phase, runner), ...writeOps()];
+        case 'pushed':
+            return [...await gitPushOperations(inspection, phase, runner), ...writeOps()];
+        case 'phase-0-complete': {
+            const repository = githubRepositoryFromPushUrl(reviewedPushUrl(await inspectGitRepository(inspection.projectRoot, runner)));
+            return [repositoryStep('github.phase0.discover', 'github-read', { repository }, repository), ...writeOps()];
+        }
+        case 'activation-approved': {
+            const actionId = inspection.manifest.project.specWorkflow === 'openspec'
+                ? 'openspec.governance.create-change' : 'spec-kit.governance.create-change';
+            const changeId = inspection.sourceOfTruth.status === 'none' ? inspection.sourceOfTruth.createPlan.changeId :
+                inspection.sourceOfTruth.status === 'selected' ? inspection.sourceOfTruth.selected.changeId : null;
+            if (!changeId)
+                throw new Error('A reviewed governance change destination is required.');
+            const changePath = inspection.manifest.project.specWorkflow === 'openspec'
+                ? ['openspec', 'changes', changeId] : ['specs', changeId];
+            return [
+                localStep(actionId, 'write-openspec-governance', { workflowKind: inspection.manifest.project.specWorkflow }, transitionDestination('local', changePath.join('/'), { pathParts: changePath })),
+                stateWriteOperation(phase)
+            ];
+        }
+        case 'credential-ready':
+            return [repositoryStep('github.credential.verify-policy', 'github-read', { policyPathParts: credentialPolicyPathParts }), ...writeOps()];
+        case 'provider-ready':
+            return [subscriptionStep('azure.provider.ensure-ready', 'azure-provider-register', { retainedCapability: true }), ...writeOps()];
+        case 'state-path-selected':
+            return [subscriptionStep('azure.state-path.select', 'azure-read', { allowed: ['existing-private', 'bootstrap-local'] }), ...writeOps()];
+        case 'existing-private-path':
+            return [subscriptionStep('azure.existing-private-path.verify', 'azure-read', { statePath: 'existing-private' }), ...writeOps()];
+        case 'bootstrap-local':
+            return [
+                subscriptionStep('azure.bootstrap-local.apply', 'azure-network-provision', { boundedLocalBootstrap: true }),
+                repositoryStep('github.bootstrap-local.configure', 'github-write', { repository: repositoryName }),
+                ...writeOps()
+            ];
+        case 'runner-ready':
+            return [repositoryStep('github.runner.ensure-ready', 'github-write', { restrictedRunner: true }), ...writeOps()];
+        case 'private-backend-proof':
+            return [repositoryStep('github.runner.backend-proof', 'github-read', { requiredConclusion: 'success' }), ...writeOps()];
+        case 'remote-import-verified':
+            return [subscriptionStep('azure.remote-import.verify', 'azure-state-import', { noChangePlanRequired: true }), ...writeOps()];
+        case 'remote-ready': {
+            const statePath = inspection.state.applicability.statePath;
+            if (statePath === 'none')
+                throw new Error('Remote readiness requires an explicitly selected backend path.');
+            const selectedPath = statePath === 'bootstrap-local' ? 'remote-import-verified' : 'existing-private-path';
+            const selected = latestRecordWithPayload(inspection, selectedPath);
+            if (selected?.header.result !== 'verified')
+                throw new Error('Remote readiness requires successful proof from the selected backend path.');
+            const proof = selected.liveReadback?.find((entry) => entry.provider === 'azure');
+            const subscriptionId = proof?.resourceId.match(/^\/subscriptions\/([a-f0-9-]+)\//i)?.[1];
+            if (!subscriptionId)
+                throw new Error('Remote readiness requires the selected backend proof to bind a verified subscription destination.');
+            return [subscriptionStep('azure.remote-ready.verify', 'azure-read', { retainBootstrapStateForDays: 30 }, subscriptionId), ...writeOps()];
+        }
+        case 'application-foundation':
+            return [subscriptionStep('azure.application-foundation.apply', 'azure-resource-provision', { noProviderUnregisterRollback: true }), ...writeOps()];
+        case 'workflow-source-ready':
+            return [
+                localStep('local.workflow-source.write', 'write-workflows', { path: '.github/workflows' }, transitionDestination('local', '.github/workflows', { pathParts: ['.github', 'workflows'] }), 'local-state'),
+                localStep('local.ruleset-source.write', 'write-ruleset-source', { path: '.github/rulesets' }, transitionDestination('local', '.github/rulesets', { pathParts: ['.github', 'rulesets'] }), 'local-state'),
+                ...writeOps()
+            ];
+        case 'dev-proof':
+            return [repositoryStep('github.checks.dev-proof', 'github-read', { acceptedConclusions: ['success'] }), ...writeOps()];
+        case 'staging-qualified':
+            return [repositoryStep('github.checks.staging', 'github-read', { acceptedConclusions: ['success'] }), ...writeOps()];
+        case 'production-rehearsed':
+            return [repositoryStep('github.checks.production-rehearsal', 'github-read', { acceptedConclusions: ['success'] }), ...writeOps()];
+        case 'green-red-proof':
+            return [repositoryStep('github.checks.green-red-proof', 'github-read', { required: ['green-success', 'deliberate-red-failure'] }), ...writeOps()];
+        case 'enforcement-approved':
+            return [stateWriteOperation(phase)];
+        case 'rulesets-applied':
+            return [
+                repositoryStep('github.ruleset.apply', 'github-ruleset-write', { sourceDigest: rulesetSourceDigestFromEvidence(inspection) ?? 'missing' }),
+                repositoryStep('github.ruleset.readback', 'github-read', { sourceDigest: rulesetSourceDigestFromEvidence(inspection) ?? 'missing' }),
+                ...writeOps()
+            ];
+        case 'live-readback':
+            return [repositoryStep('github.ruleset.readback', 'github-read', { sourceDigest: rulesetSourceDigestFromEvidence(inspection) ?? 'missing' }), ...writeOps()];
+        case 'bootstrap-state-disposed': {
+            const paths = {
+                encryptedStatePathParts: inspection.state.bootstrapState?.encryptedStatePathParts ?? [],
+                encryptionKeyPathParts: inspection.state.bootstrapState?.encryptionKeyPathParts ?? []
+            };
+            const destinations = [...paths.encryptedStatePathParts, ...paths.encryptionKeyPathParts];
+            return [
+                ...destinations.map((destination) => localStep('local.bootstrap-state.dispose', 'delete-local-state', paths, transitionDestination('local', destination.join('/'), { pathParts: destination }), 'local-state', true)),
+                ...writeOps()
+            ];
+        }
+    }
+}
+export async function buildSavedTransitionPlan(input) {
+    validateManifestActivationForExecution(input.inspection.manifest);
+    const phaseId = input.inspection.readiness.nextReadyPhase;
+    if (!phaseId)
+        return null;
+    const runner = input.runner ?? new NodeCommandRunner();
+    const phase = phaseById(input.inspection.graph, phaseId);
+    const createdAt = (input.now ?? new Date()).toISOString();
+    const expiresAt = new Date(Date.parse(createdAt) + planLifetimeMs).toISOString();
+    const context = input.inspection.contexts[phaseId];
+    const operations = await phaseOperations(input.inspection, phase, runner, createdAt, input.localRevalidation);
+    const approvalPlan = transitionPlanForPhase(phase, input.inspection.state, context.transition, input.inspection.projectRoot, phase.id === 'pushed' ? operations.find((operation) => operation.adapter === 'git')?.destination.identity : undefined);
+    const evaluation = evaluateApprovalForTransitionPlan(approvalPlan, input.inspection.approvals, { now: input.now });
+    const digest = planDigestFor({ phase, transitionDigest: context.transition.transitionDigest, operations, approvalPlanDigest: approvalPlan.planDigest });
+    const plan = validateSavedTransitionPlan({
+        schemaVersion: 1, phaseId, createdAt, expiresAt,
+        identity: input.inspection.state.identity,
+        graphHash: input.inspection.graphHash,
+        stateHash: input.inspection.loadedState?.contentHash ?? null,
+        baselineDigest: context.baselineSha, inputDigest: context.inputDigest,
+        transitionDigest: context.transition.transitionDigest, planDigest: digest,
+        mutationClasses: phase.allowedMutations, operations,
+        approval: {
+            gateKind: phase.approvalGate.kind, required: phase.approvalGate.required, evaluation,
+            envelopeId: evaluation.envelopeId, envelopeHash: evaluation.envelopeHash
+        },
+        rollbackPlan: rollbackPlanForPhase(phase),
+        noSecrets: true
+    });
+    assertPlanOperationsAllowed(plan, phase);
+    assertNoSecrets(plan);
+    return plan;
+}
+export async function previewApplyNext(input) {
+    let plan = null;
+    const blockers = [];
+    try {
+        plan = await buildSavedTransitionPlan(input);
+        if (plan && phaseCapabilities[plan.phaseId].blocker)
+            blockers.push(phaseCapabilities[plan.phaseId].blocker);
+    }
+    catch (error) {
+        blockers.push(errorMessage(error));
+    }
+    const nextReadyPhase = input.inspection.readiness.nextReadyPhase;
+    if (!nextReadyPhase && blockers.length === 0) {
+        const first = input.inspection.graph.phases.find((phase) => input.inspection.readiness.phases[phase.id].blockers.length > 0);
+        if (first)
+            blockers.push(...input.inspection.readiness.phases[first.id].blockers);
+    }
+    if (!nextReadyPhase || blockers.length > 0 || !plan) {
+        return {
+            schemaVersion: 1, command: 'governance apply-next', projectRoot: input.inspection.projectRoot,
+            execute: input.execute, applied: false, authorized: false, reason: 'blocked',
+            message: blockers[0] ?? 'No phase is ready for execution.', selectedPhase: nextReadyPhase, nextReadyPhase,
+            approval: plan?.approval ?? null,
+            proposedMutations: {
+                local: plan?.mutationClasses.local ?? ['none'], remote: plan?.mutationClasses.remote ?? ['none'], operations: plan?.operations ?? []
+            },
+            savedPlan: null, noWrites: true,
+            blockers: blockers.length > 0 ? blockers : ['No phase is ready for execution.']
+        };
+    }
+    if (plan.approval.evaluation.approvalRequired) {
+        return {
+            schemaVersion: 1, command: 'governance apply-next', projectRoot: input.inspection.projectRoot,
+            execute: input.execute, applied: false, authorized: false, reason: 'approval-required',
+            message: plan.approval.evaluation.reasons.join('; '), selectedPhase: nextReadyPhase, nextReadyPhase, approval: plan.approval,
+            proposedMutations: { local: plan.mutationClasses.local, remote: plan.mutationClasses.remote, operations: plan.operations },
+            savedPlan: null, noWrites: true, blockers: plan.approval.evaluation.reasons
+        };
+    }
+    return {
+        schemaVersion: 1, command: 'governance apply-next', projectRoot: input.inspection.projectRoot,
+        execute: input.execute, applied: false, authorized: true,
+        reason: input.execute ? 'execute-requested' : 'execute-required',
+        message: input.execute
+            ? 'Execution requested; the plan must be saved and revalidated before any mutation.'
+            : 'Preview only. Rerun with --execute to save this plan and execute at most one phase.',
+        selectedPhase: nextReadyPhase, nextReadyPhase, approval: plan.approval,
+        proposedMutations: { local: plan.mutationClasses.local, remote: plan.mutationClasses.remote, operations: plan.operations },
+        savedPlan: null, noWrites: true, blockers: []
+    };
+}
+export function comparePlanFreshness(saved, fresh) {
+    if (!fresh)
+        return ['No phase remained ready after saving the transition plan.'];
+    const issues = [];
+    if (saved.phaseId !== fresh.phaseId)
+        issues.push(`Ready phase changed from ${saved.phaseId} to ${fresh.phaseId}.`);
+    for (const field of ['stateHash', 'baselineDigest', 'inputDigest', 'transitionDigest']) {
+        if (saved[field] !== fresh[field])
+            issues.push(`${field} changed after plan save.`);
+    }
+    if (canonicalSha256(saved.operations) !== canonicalSha256(fresh.operations))
+        issues.push('Proposed operations changed after plan save.');
+    if (saved.approval.evaluation.approvalRequired || fresh.approval.evaluation.approvalRequired) {
+        issues.push('Approval was not valid immediately before execution.');
+    }
+    return issues;
+}
+//# sourceMappingURL=transition-planning.js.map

package/dist/governance-activation/transition-planning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transition-planning.js","sourceRoot":"","sources":["../../src/governance-activation/transition-planning.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACzI,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAC1G,OAAO,EACL,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,2BAA2B,EAC9G,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACvH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACvH,OAAO,EAAE,sCAAsC,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACpI,OAAO,EAAE,sBAAsB,EAAE,iCAAiC,EAAE,MAAM,8CAA8C,CAAC;AACzH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,mDAAmD,CAAC;AAEpF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,KAAK,UAAU,eAAe,CAC5B,UAA0C,EAC1C,KAAqB,EACrB,MAAqB,EACrB,SAAiB,EACjB,iBAAiB,GAAG,KAAK;IAEzB,MAAM,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,aAA4B,EAAE,MAA+B,EAAE,UAAU,GAAG,cAAc,EAAE,EAAE,CACtI,SAAS,CAAC;QACR,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM;QACrE,WAAW,EAAE,qBAAqB,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC;QAC5E,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK;KACjC,CAAC,CAAC;IACL,MAAM,gBAAgB,GAAG,CACvB,QAAgB,EAChB,aAA4B,EAC5B,MAA+B,EAC/B,cAAc,GAAG,iCAAiC,EAClD,EAAE,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM;QAC7E,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,CAAC;QACtF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK;KACjC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,CAChB,QAAgB,EAChB,aAA4B,EAC5B,MAA+B,EAC/B,WAA+C,EAC/C,OAAO,GAAmC,wBAAwB,EAClE,WAAW,GAAG,KAAK,EACnB,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAEzH,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY,IAAI,KAAK,CAAC,EAAE,KAAK,eAAe,IAAI,KAAK,CAAC,EAAE,KAAK,eAAe,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,EAAE,8CAA8C,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,QAAQ,KAAK,CAAC,EAAE,EAAE,CAAC;QACjB,KAAK,YAAY;YACf,OAAO;gBACL,SAAS,CAAC,wBAAwB,EAAE,eAAe,EACjD,EAAE,UAAU,EAAE,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;gBACvH,GAAG,QAAQ,EAAE;aACd,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,SAAS,CAAC,+BAA+B,EAAE,eAAe,EAAE;oBAC1D,UAAU,EAAE,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC;oBACxD,MAAM,EAAE,wBAAwB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACpE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU;qBAC/E,CAAC,CAAC;iBACJ,EAAE,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;gBAC1D,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC;oBAC5D,SAAS,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,UAAU,CAAC,EAAE,EAC/G,qBAAqB,CAAC,OAAO,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;iBACzI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,QAAQ,EAAE;aACd,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,EAClI,EAAE,UAAU,EAAE,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAC5D,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC/I,GAAG,QAAQ,EAAE;aACd,CAAC;QACJ,KAAK,WAAW;YACd,OAAO,CAAC,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAClF,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAChF,KAAK,kBAAkB,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,2BAA2B,CAAC,eAAe,CAAC,MAAM,oBAAoB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5H,OAAO,CAAC,cAAc,CAAC,wBAAwB,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,KAAK,qBAAqB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU;gBACtE,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,mCAAmC,CAAC;YAC9E,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1G,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YACrG,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACxF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU;gBACxE,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC5D,OAAO;gBACL,SAAS,CAAC,QAAQ,EAAE,2BAA2B,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EACzG,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;gBAClF,mBAAmB,CAAC,KAAK,CAAC;aAC3B,CAAC;QACJ,CAAC;QACD,KAAK,kBAAkB;YACrB,OAAO,CAAC,cAAc,CAAC,iCAAiC,EAAE,aAAa,EAAE,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC3I,KAAK,gBAAgB;YACnB,OAAO,CAAC,gBAAgB,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACnI,KAAK,qBAAqB;YACxB,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC1I,KAAK,uBAAuB;YAC1B,OAAO,CAAC,gBAAgB,CAAC,oCAAoC,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAClI,KAAK,iBAAiB;YACpB,OAAO;gBACL,gBAAgB,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;gBAC3G,cAAc,CAAC,kCAAkC,EAAE,cAAc,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;gBAClG,GAAG,QAAQ,EAAE;aACd,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,CAAC,cAAc,CAAC,4BAA4B,EAAE,cAAc,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACnH,KAAK,uBAAuB;YAC1B,OAAO,CAAC,cAAc,CAAC,6BAA6B,EAAE,aAAa,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC1H,KAAK,wBAAwB;YAC3B,OAAO,CAAC,gBAAgB,CAAC,4BAA4B,EAAE,oBAAoB,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC/H,KAAK,cAAc,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;YAC3D,IAAI,SAAS,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAC5G,MAAM,YAAY,GAAG,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC1G,MAAM,QAAQ,GAAG,uBAAuB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACnE,IAAI,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;YAC1I,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YACjF,MAAM,cAAc,GAAG,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;YAC1I,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,EAAE,YAAY,EAAE,EAAE,2BAA2B,EAAE,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC3I,CAAC;QACD,KAAK,wBAAwB;YAC3B,OAAO,CAAC,gBAAgB,CAAC,oCAAoC,EAAE,0BAA0B,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACrJ,KAAK,uBAAuB;YAC1B,OAAO;gBACL,SAAS,CAAC,6BAA6B,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EACvF,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC;gBAC9G,SAAS,CAAC,4BAA4B,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAC1F,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC;gBAC5G,GAAG,QAAQ,EAAE;aACd,CAAC;QACJ,KAAK,WAAW;YACd,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACzH,KAAK,mBAAmB;YACtB,OAAO,CAAC,cAAc,CAAC,uBAAuB,EAAE,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACvH,KAAK,sBAAsB;YACzB,OAAO,CAAC,cAAc,CAAC,oCAAoC,EAAE,aAAa,EAAE,EAAE,mBAAmB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACpI,KAAK,iBAAiB;YACpB,OAAO,CAAC,cAAc,CAAC,+BAA+B,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,CAAC,eAAe,EAAE,wBAAwB,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACpJ,KAAK,sBAAsB;YACzB,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,KAAK,kBAAkB;YACrB,OAAO;gBACL,cAAc,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,EAAE,YAAY,EAAE,+BAA+B,CAAC,UAAU,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1I,cAAc,CAAC,yBAAyB,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,+BAA+B,CAAC,UAAU,CAAC,IAAI,SAAS,EAAE,CAAC;gBACpI,GAAG,QAAQ,EAAE;aACd,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,+BAA+B,CAAC,UAAU,CAAC,IAAI,SAAS,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC/J,KAAK,0BAA0B,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG;gBACZ,uBAAuB,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,uBAAuB,IAAI,EAAE;gBACvF,sBAAsB,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,sBAAsB,IAAI,EAAE;aACtF,CAAC;YACF,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,uBAAuB,EAAE,GAAG,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACzF,OAAO;gBACL,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS,CAAC,+BAA+B,EAAE,oBAAoB,EAAE,KAAK,EACzG,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;gBAC1G,GAAG,QAAQ,EAAE;aACd,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACC,sCAAsC,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC9G,MAAM,YAAY,GAAG,sBAAsB,CACzC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAC/E,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CACtH,CAAC;IACF,MAAM,UAAU,GAAG,iCAAiC,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC;IACxJ,MAAM,IAAI,GAAG,2BAA2B,CAAC;QACvC,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;QAC/C,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ;QACzC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;QACrC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,IAAI,IAAI;QAC5D,cAAc,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;QACrE,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,EAAE,MAAM;QACzE,eAAe,EAAE,KAAK,CAAC,gBAAgB,EAAE,UAAU;QACnD,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU;YACpF,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY;SACzE;QACD,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACzC,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAMtC;IACC,IAAI,IAAI,GAA+B,IAAI,CAAC;IAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAQ,CAAC,CAAC;IAC/G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC;IACjE,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7H,IAAI,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO;YACL,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;YAC7F,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS;YAC5E,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,kCAAkC,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc;YACzG,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI;YAChC,iBAAiB,EAAE;gBACjB,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE;aACrI;YACD,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;YAC/B,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC;SAChF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO;YACL,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;YAC7F,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB;YACtF,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YAC5H,iBAAiB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;YAC1H,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO;SAC5E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;QAC7F,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;QACxD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB;QAChE,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,qFAAqF;QACzF,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACtE,iBAAiB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;QAC1H,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA0B,EAAE,KAAiC;IAChG,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,2DAA2D,CAAC,CAAC;IACjF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACnH,KAAK,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,CAAU,EAAE,CAAC;QAChG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzI,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/governance-activation/transition-ports.d.ts

@@ -0,0 +1,150 @@
+import type { LiftoffManifest } from '../domain/project/contracts.js';
+import type { ManagedPhaseGraph, UserActivationState, ApprovalEnvelope, PhaseEvidenceRecord, PhaseId, EvidenceHeader, LiveReadbackProof, TransitionOperation, SavedTransitionPlan, PhaseGraphNode, MutationClass, TransitionRollbackPlan } from '../domain/governance/activation/types.js';
+import type { LoadedActivationState } from './activation-state.js';
+import type { EvidenceFreshnessContext } from '../domain/governance/activation/evidence.js';
+import type { GovernanceSourceOfTruthInspection } from './source-of-truth.js';
+import type { ProjectFileMutation, ProjectFileSnapshot } from '../adapters/filesystem/project-transaction.js';
+import type { CommandRunner } from '../process-runner.js';
+import type { ProjectMutationLease } from '../adapters/filesystem/project-lock.js';
+export interface GovernanceTransitionInspection {
+    projectRoot: string;
+    manifest: LiftoffManifest;
+    graph: ManagedPhaseGraph;
+    graphHash: string;
+    loadedState?: LoadedActivationState;
+    state: UserActivationState;
+    approvals: readonly ApprovalEnvelope[];
+    evidence: readonly PhaseEvidenceRecord[];
+    contexts: Record<PhaseId, EvidenceFreshnessContext>;
+    readiness: {
+        nextReadyPhase: PhaseId | null;
+        phases: Record<PhaseId, {
+            state: string;
+            blockers: readonly string[];
+        }>;
+    };
+    sourceOfTruth: GovernanceSourceOfTruthInspection;
+}
+export interface GitRepositoryInspection {
+    insideWorkTree: boolean;
+    root: string | null;
+    branch: string | null;
+    head: string | null;
+    upstream: string | null;
+    status: readonly GitStatusEntry[];
+    remotes: readonly GitRemote[];
+    issues: readonly string[];
+}
+export interface GitStatusEntry {
+    index: string;
+    worktree: string;
+    path: string;
+}
+export interface GitRemote {
+    name: string;
+    url: string;
+    pushUrls: readonly string[];
+}
+export interface Phase0DiscoveryFacts {
+    repositoryId: string;
+    repositoryName: string;
+    defaultBranch: string;
+    baselineDigest: string;
+    privateStagingDast: boolean | 'unknown';
+    credentialRequired: boolean | 'unknown';
+    statePath: UserActivationState['applicability']['statePath'];
+    approvedFacts: readonly {
+        id: string;
+        value: string | number | boolean | null;
+    }[];
+}
+export interface GitHubRulesetWriteResult {
+    resourceId: string;
+    sourceDigest: string;
+    readbackDigest: string;
+}
+export interface GitHubRulesetAdapter {
+    applyRuleset(input: {
+        repository: string;
+        sourceDigest: string;
+        approvalEnvelopeId: string;
+    }): Promise<GitHubRulesetWriteResult>;
+    readRuleset(input: {
+        repository: string;
+        sourceDigest: string;
+    }): Promise<GitHubRulesetWriteResult>;
+}
+export interface PhaseAdapterOutcome {
+    status: 'completed' | 'blocked';
+    resultState?: EvidenceHeader['result'] | 'approved';
+    blocker?: string;
+    evidencePayload?: unknown;
+    liveReadback?: readonly LiveReadbackProof[];
+    stateOverride?: UserActivationState;
+    fileMutations?: readonly ProjectFileMutation[];
+    filePreconditions?: readonly ProjectFileSnapshot[];
+    completedOperations?: readonly TransitionOperation[];
+    cleanupWarnings?: readonly string[];
+    retryableWithoutStateMutation?: boolean;
+}
+export interface GovernancePhaseAdapter {
+    phaseId: PhaseId;
+    execute(input: PhaseAdapterExecutionInput): Promise<PhaseAdapterOutcome>;
+}
+export interface PhaseAdapterExecutionInput {
+    inspection: GovernanceTransitionInspection;
+    plan: SavedTransitionPlan;
+    phase: PhaseGraphNode;
+    runner: CommandRunner;
+    adapters: GovernanceTransitionAdapters;
+    now: Date;
+    clock?: () => Date;
+    lease?: ProjectMutationLease;
+}
+export interface GovernanceTransitionAdapters {
+    phases?: Partial<Record<PhaseId, GovernancePhaseAdapter>>;
+    githubRulesets?: GitHubRulesetAdapter;
+}
+export interface ApplyNextPreview {
+    schemaVersion: 1;
+    command: 'governance apply-next';
+    projectRoot: string;
+    execute: boolean;
+    applied: false;
+    authorized: boolean;
+    reason: string;
+    message: string;
+    selectedPhase: PhaseId | null;
+    nextReadyPhase: PhaseId | null;
+    approval: SavedTransitionPlan['approval'] | null;
+    proposedMutations: {
+        local: readonly MutationClass[];
+        remote: readonly MutationClass[];
+        operations: readonly TransitionOperation[];
+    };
+    savedPlan: null | {
+        pathParts: readonly string[];
+        digest: string;
+    };
+    noWrites: boolean;
+    blockers: readonly string[];
+}
+export interface ApplyNextExecutionResult extends Omit<ApplyNextPreview, 'applied' | 'savedPlan' | 'noWrites'> {
+    applied: boolean;
+    executedPhase: PhaseId | null;
+    savedPlan: {
+        pathParts: readonly string[];
+        digest: string;
+    } | null;
+    noWrites: false;
+    executedOperations: readonly TransitionOperation[];
+    evidence: {
+        evidenceId: string;
+        pathParts: readonly string[];
+        headerDigest: string;
+        result: EvidenceHeader['result'];
+    } | null;
+    stateHash: string | null;
+    rollbackPlan: TransitionRollbackPlan;
+    cleanupWarnings: readonly string[];
+}

package/dist/governance-activation/transition-ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=transition-ports.js.map

package/dist/governance-activation/transition-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transition-ports.js","sourceRoot":"","sources":["../../src/governance-activation/transition-ports.ts"],"names":[],"mappings":""}

package/dist/governance-activation/transition-process.d.ts

@@ -0,0 +1,7 @@
+import type { CommandResult, CommandRunner } from '../process-runner.js';
+import type { ExternalCommand } from '../domain/project/contracts.js';
+export declare function errorMessage(error: unknown): string;
+export declare function commandSucceeded(result: CommandResult): boolean;
+export declare function commandFailure(result: CommandResult): string;
+export declare function runCommand(runner: CommandRunner, command: ExternalCommand, cwd: string): Promise<CommandResult>;
+export declare function runGit(runner: CommandRunner, projectRoot: string, args: string[]): Promise<CommandResult>;

package/dist/governance-activation/transition-process.js

@@ -0,0 +1,21 @@
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function commandSucceeded(result) {
+    return result.status === 0 && !result.timedOut && !result.errorCode;
+}
+export function commandFailure(result) {
+    if (result.timedOut)
+        return `${result.displayCommand} timed out`;
+    if (result.errorCode || result.errorMessage) {
+        return `${result.displayCommand}: ${[result.errorCode, result.errorMessage].filter(Boolean).join(': ')}`;
+    }
+    return `${result.displayCommand} exited ${result.status ?? 'unknown'}${result.stderr ? `: ${result.stderr.trim()}` : ''}`;
+}
+export async function runCommand(runner, command, cwd) {
+    return await runner.run(command, { cwd });
+}
+export async function runGit(runner, projectRoot, args) {
+    return await runCommand(runner, { executable: 'git', args }, projectRoot);
+}
+//# sourceMappingURL=transition-process.js.map

package/dist/governance-activation/transition-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transition-process.js","sourceRoot":"","sources":["../../src/governance-activation/transition-process.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,GAAG,MAAM,CAAC,cAAc,YAAY,CAAC;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,GAAG,MAAM,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,cAAc,WAAW,MAAM,CAAC,MAAM,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAqB,EAAE,OAAwB,EAAE,GAAW;IAC3F,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAqB,EAAE,WAAmB,EAAE,IAAc;IACrF,OAAO,MAAM,UAAU,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;AAC5E,CAAC"}

package/dist/governance-activation/transition-records.d.ts

@@ -0,0 +1,56 @@
+import type { SavedTransitionPlan, UserActivationState, PhaseGraphNode, TransitionOperation, EvidenceHeader, LiveReadbackProof, PhaseId, PhaseEvidenceRecord } from '../domain/governance/activation/types.js';
+import { type ProjectFileSnapshot, type ProjectFileMutation } from '../adapters/filesystem/project-transaction.js';
+import type { GovernanceTransitionInspection, ApplyNextExecutionResult, PhaseAdapterExecutionInput } from './transition-ports.js';
+export declare const governancePlanDirectoryPathParts: readonly ['governance', 'plans'];
+export declare function safeTimestamp(value: string): string;
+export declare function transitionPlanPathParts(plan: SavedTransitionPlan): string[];
+export declare function evidencePathParts(evidenceId: string): string[];
+export declare function activationStatePathParts(): string[];
+export declare function cloneState(state: UserActivationState): UserActivationState;
+export declare function initializeExecutionAnchor(inspection: GovernanceTransitionInspection, now: Date): Promise<void>;
+export declare function evidenceWriteOperation(phase: PhaseGraphNode, pathParts: readonly string[]): TransitionOperation;
+export declare function stateWriteOperation(phase: PhaseGraphNode): TransitionOperation;
+export declare function assertNoSecrets(plan: SavedTransitionPlan): void;
+export declare function saveTransitionPlan(projectRoot: string, plan: SavedTransitionPlan): Promise<{
+    pathParts: readonly string[];
+    digest: string;
+}>;
+export declare function evidenceHeaderFor(input: {
+    inspection: GovernanceTransitionInspection;
+    phase: PhaseGraphNode;
+    plan: SavedTransitionPlan;
+    result: EvidenceHeader['result'];
+    now: Date;
+    payload?: unknown;
+    liveReadback?: readonly LiveReadbackProof[];
+}): EvidenceHeader;
+export declare function nextStateForOutcome(input: {
+    inspection: GovernanceTransitionInspection;
+    phase: PhaseGraphNode;
+    plan: SavedTransitionPlan;
+    resultState: EvidenceHeader['result'] | 'approved';
+    evidenceReference?: UserActivationState['phases'][PhaseId]['evidence'][number];
+    blocker?: string;
+    override?: UserActivationState;
+    now: Date;
+}): UserActivationState;
+export declare function blockedState(input: {
+    inspection: GovernanceTransitionInspection;
+    phase: PhaseGraphNode;
+    plan: SavedTransitionPlan;
+    blocker: string;
+    now: Date;
+}): UserActivationState;
+export declare function writeOutcomeTransaction(input: {
+    projectRoot: string;
+    plan: SavedTransitionPlan;
+    nextState: UserActivationState;
+    evidenceRecord?: PhaseEvidenceRecord;
+    evidencePathParts?: readonly string[];
+    fileMutations?: readonly ProjectFileMutation[];
+    filePreconditions?: readonly ProjectFileSnapshot[];
+}): Promise<{
+    stateHash: string;
+    evidence: ApplyNextExecutionResult['evidence'];
+}>;
+export declare function readbackProof(input: PhaseAdapterExecutionInput, provider: LiveReadbackProof['provider'], resourceType: string, resourceId: string, observed: unknown): LiveReadbackProof;