@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/governance-assessment/predicates.js

@@ -1,330 +1,2 @@
-import { isRecord } from './sanitize.js';
-function result(value, reason) {
-    return { value, reason };
-}
-function records(value) {
-    return Array.isArray(value) && value.every(isRecord) ? value : null;
-}
-function strings(value) {
-    return Array.isArray(value) && value.every((entry) => typeof entry === 'string') ? value : null;
-}
-function ruleList(ruleset) {
-    return records(ruleset.rules);
-}
-function scopePatterns(ruleset) {
-    if (!isRecord(ruleset.conditions) || !isRecord(ruleset.conditions.ref_name))
-        return null;
-    if (Object.keys(ruleset.conditions).some((key) => key !== 'ref_name'))
-        return null;
-    const include = strings(ruleset.conditions.ref_name.include);
-    const exclude = strings(ruleset.conditions.ref_name.exclude);
-    return include && exclude ? { include, exclude } : null;
-}
-function parameters(rule) {
-    return isRecord(rule.parameters) ? rule.parameters : null;
-}
-function zeroReviewers(rule) {
-    const values = parameters(rule);
-    if (!values || typeof values.required_approving_review_count !== 'number' ||
-        typeof values.require_code_owner_review !== 'boolean' || typeof values.require_last_push_approval !== 'boolean' ||
-        typeof values.dismiss_stale_reviews_on_push !== 'boolean')
-        return null;
-    return values.required_approving_review_count === 0 &&
-        values.require_code_owner_review === false && values.require_last_push_approval === false &&
-        values.dismiss_stale_reviews_on_push === true;
-}
-function refMatches(pattern, ref, defaultBranch) {
-    if (pattern === '~ALL' || pattern === ref)
-        return true;
-    if (pattern === '~DEFAULT_BRANCH')
-        return defaultBranch === null ? null : ref === `refs/heads/${defaultBranch}`;
-    if (pattern === 'refs/heads/release/**' || pattern === 'refs/heads/hotfix/**')
-        return ref.startsWith(pattern.slice(0, -2));
-    if (/[*?[\]{}]/u.test(pattern))
-        return null;
-    return false;
-}
-function matchingBranchRules(rulesets, ref, defaultBranch) {
-    const matching = [];
-    let uncertain = false;
-    for (const ruleset of rulesets.filter((entry) => entry.target === 'branch' && entry.enforcement === 'active' &&
-        (entry.source_type === undefined || entry.source_type === 'Repository'))) {
-        const patterns = scopePatterns(ruleset);
-        if (!patterns) {
-            uncertain = true;
-            continue;
-        }
-        if (ref.endsWith('/**') && patterns.exclude.some((pattern) => pattern.startsWith(ref.slice(0, -2)) || pattern.startsWith('~') || /[*?[\]{}]/u.test(pattern))) {
-            uncertain = true;
-            continue;
-        }
-        const include = patterns.include.map((pattern) => refMatches(pattern, ref, defaultBranch));
-        const exclude = patterns.exclude.map((pattern) => refMatches(pattern, ref, defaultBranch));
-        if (exclude.includes(true))
-            continue;
-        if (exclude.includes(null) || (!include.includes(true) && include.includes(null))) {
-            uncertain = true;
-            continue;
-        }
-        if (include.includes(true))
-            matching.push(ruleset);
-    }
-    return { matching, uncertain };
-}
-export function protectedRefs(value, defaultBranch = null) {
-    const rulesets = records(value);
-    if (!rulesets)
-        return result(null, 'Ruleset inventory is not interpretable.');
-    const refs = ['refs/heads/develop', 'refs/heads/main', 'refs/heads/release/**', 'refs/heads/hotfix/**'];
-    for (const ref of refs) {
-        const { matching, uncertain } = matchingBranchRules(rulesets, ref, defaultBranch);
-        if (!matching.length)
-            return { ...result(uncertain ? null : false, `No proven active protection covers ${ref}.`), absent: !uncertain };
-        const rules = [];
-        for (const ruleset of matching) {
-            const members = ruleList(ruleset);
-            if (!members || !Array.isArray(ruleset.bypass_actors))
-                return result(null, 'Required rule or bypass metadata is unavailable.');
-            if (ruleset.bypass_actors.length)
-                return result(false, `Protection for ${ref} permits bypass actors.`);
-            rules.push(...members);
-        }
-        if (!['deletion', 'non_fast_forward', 'pull_request', 'required_status_checks'].every((type) => rules.some((rule) => rule.type === type))) {
-            return result(false, `Required protection rules are absent for ${ref}.`);
-        }
-        const checks = rules.filter((rule) => rule.type === 'required_status_checks');
-        if (!checks.some((rule) => {
-            const config = parameters(rule);
-            return config?.strict_required_status_checks_policy === true && config.do_not_enforce_on_create === true &&
-                Array.isArray(config.required_status_checks) && config.required_status_checks.length > 0;
-        }))
-            return result(false, `Strict, non-empty required checks are not configured for ${ref}.`);
-    }
-    return result(true, 'Required GitFlow refs have active non-bypassable repository protections.');
-}
-export function singleMaintainer(value) {
-    const rulesets = records(value);
-    if (!rulesets)
-        return result(null, 'Pull request rules are not observable.');
-    const reviews = [];
-    for (const ruleset of rulesets.filter((entry) => entry.target === 'branch' && entry.enforcement === 'active')) {
-        const rules = ruleList(ruleset);
-        if (!rules)
-            return result(null, 'Ruleset rule details are missing.');
-        reviews.push(...rules.filter((rule) => rule.type === 'pull_request'));
-    }
-    if (!reviews.length)
-        return { ...result(false, 'No active pull request rule was observed.'), absent: true };
-    const results = reviews.map(zeroReviewers);
-    if (results.includes(false))
-        return result(false, 'A pull request rule requires a human or code-owner approval.');
-    return result(results.includes(null) ? null : true, results.includes(null) ? 'Review settings are incomplete.' : 'Observed pull request rules use zero required human reviewers.');
-}
-export function tagControls(value, actionsAppId) {
-    const rulesets = records(value);
-    if (!rulesets)
-        return result(null, 'Tag rule details are unavailable.');
-    const matching = rulesets.filter((ruleset) => {
-        const patterns = scopePatterns(ruleset);
-        return ruleset.target === 'tag' && ruleset.enforcement === 'active' && patterns?.exclude.length === 0 &&
-            (patterns.include.includes('refs/tags/v*') || patterns.include.includes('~ALL'));
-    });
-    if (!matching.length)
-        return { ...result(false, 'No active release-tag rules were observed.'), absent: true };
-    let creation = false;
-    let immutable = false;
-    for (const ruleset of matching) {
-        const rules = ruleList(ruleset);
-        const actors = records(ruleset.bypass_actors);
-        if (!rules || !actors)
-            return result(null, 'Tag rule or bypass actor details are unavailable.');
-        if (rules.some((rule) => rule.type === 'creation') && actors.length === 1) {
-            creation ||= actors[0].actor_type === 'Integration' && typeof actors[0].actor_id === 'number' &&
-                (actionsAppId === undefined || actors[0].actor_id === actionsAppId) &&
-                !rules.some((rule) => ['deletion', 'non_fast_forward'].includes(String(rule.type)));
-        }
-        immutable ||= actors.length === 0 && ['deletion', 'non_fast_forward'].every((type) => rules.some((rule) => rule.type === type));
-    }
-    return result(creation && immutable, 'Release tags require separate automation-only creation and non-bypassable immutability rules.');
-}
-export function requiredCheckContexts(value) {
-    const rulesets = records(value);
-    if (!rulesets)
-        return null;
-    const contexts = [];
-    for (const ruleset of rulesets.filter((entry) => entry.target === 'branch' && entry.enforcement === 'active')) {
-        const rules = ruleList(ruleset);
-        if (!rules)
-            return null;
-        for (const rule of rules.filter((entry) => entry.type === 'required_status_checks')) {
-            const checks = records(parameters(rule)?.required_status_checks);
-            if (!checks)
-                return null;
-            for (const check of checks) {
-                if (typeof check.context !== 'string' || !check.context || (check.integration_id !== null && check.integration_id !== undefined && typeof check.integration_id !== 'number'))
-                    return null;
-                contexts.push({ name: check.context, appId: typeof check.integration_id === 'number' ? check.integration_id : null });
-            }
-        }
-    }
-    return contexts;
-}
-export function requiredContextBindings(value, refs, defaultBranch) {
-    const rulesets = records(value);
-    if (!rulesets || !refs.length)
-        return null;
-    const bindings = [];
-    for (const ref of [...new Set(refs)].sort()) {
-        const { matching, uncertain } = matchingBranchRules(rulesets, `refs/heads/${ref}`, defaultBranch);
-        const contexts = requiredCheckContexts(matching);
-        if (uncertain || contexts === null)
-            return null;
-        const normalized = [...new Map(contexts.map((context) => [`${context.name}\0${context.appId}`, context])).values()]
-            .sort((a, b) => a.name.localeCompare(b.name, 'en') || (a.appId ?? -1) - (b.appId ?? -1));
-        bindings.push({ ref, contexts: normalized });
-    }
-    return bindings;
-}
-export function observedRequiredContexts(ruleValue, checkValue, defaultBranch = null) {
-    const rulesets = records(ruleValue);
-    const refs = records(checkValue);
-    if (!rulesets || !refs?.length)
-        return result(null, 'Required contexts or commit-bound check observations are unavailable.');
-    for (const ref of refs) {
-        if (typeof ref.ref !== 'string' || typeof ref.sha !== 'string' || !/^[a-f0-9]{40,64}$/iu.test(ref.sha)) {
-            return result(null, 'Check observations are not bound to known refs and commit SHAs.');
-        }
-        const checks = records(ref.checks);
-        if (!checks)
-            return result(null, 'Check run metadata is incomplete.');
-        const { matching, uncertain } = matchingBranchRules(rulesets, `refs/heads/${ref.ref}`, defaultBranch);
-        const required = requiredCheckContexts(matching);
-        if (uncertain || required === null)
-            return result(null, `Required context scope for ${ref.ref} is unresolved.`);
-        if (!required.length)
-            return { ...result(false, `No required contexts are configured for ${ref.ref}.`), absent: true };
-        if (!required.every((context) => checks.some((check) => check.name === context.name && (context.appId === null || context.appId === check.appId) &&
-            check.status === 'completed' && check.conclusion === 'success')))
-            return result(false, `Required contexts do not have matching successful checks on ${ref.ref}@${ref.sha}.`);
-    }
-    return result(true, 'Required contexts match successful check runs on each exact assessed ref and commit.');
-}
-function workflowJobs(workflow) {
-    if (!isRecord(workflow.value.jobs) || Object.keys(workflow.value.jobs).length === 0)
-        return null;
-    const values = Object.entries(workflow.value.jobs);
-    if (values.some(([, job]) => !isRecord(job)))
-        return null;
-    return values.map(([id, job]) => ({ ...(isRecord(job) ? job : {}), id }));
-}
-function permission(value) {
-    if (value === 'write-all')
-        return false;
-    if (value === 'read-all')
-        return true;
-    if (!isRecord(value))
-        return null;
-    const entries = Object.values(value);
-    return entries.every((entry) => ['read', 'write', 'none'].includes(String(entry))) ? true : null;
-}
-export function workflowPermissions(workflows) {
-    if (!workflows.length)
-        return result(false, 'No workflow files were found.');
-    let unknown = false;
-    for (const workflow of workflows) {
-        const top = permission(workflow.value.permissions);
-        const jobs = workflowJobs(workflow);
-        if (!jobs)
-            return result(null, `Jobs cannot be interpreted in ${workflow.path}.`);
-        for (const job of jobs) {
-            const found = job.permissions === undefined ? top : permission(job.permissions);
-            if (found === false)
-                return result(false, `Broad write-all permissions in ${workflow.path}.`);
-            unknown ||= found === null;
-        }
-    }
-    return result(unknown ? null : true, unknown ? 'Effective workflow permissions are not explicitly known.' : 'Workflow permissions are explicitly bounded.');
-}
-export function actionReferences(workflows) {
-    const refs = [];
-    for (const workflow of workflows) {
-        const jobs = workflowJobs(workflow);
-        if (!jobs)
-            return null;
-        for (const job of jobs) {
-            if (job.uses !== undefined) {
-                if (typeof job.uses !== 'string')
-                    return null;
-                refs.push(job.uses);
-            }
-            if (job.steps !== undefined) {
-                const steps = records(job.steps);
-                if (!steps)
-                    return null;
-                for (const step of steps) {
-                    if (step.uses === undefined)
-                        continue;
-                    if (typeof step.uses !== 'string')
-                        return null;
-                    refs.push(step.uses);
-                }
-            }
-        }
-    }
-    return [...new Set(refs)].sort();
-}
-export function pinnedActions(workflows) {
-    const refs = actionReferences(workflows);
-    if (!refs || !refs.length)
-        return result(null, 'No interpretable action reference inventory was found.');
-    if (refs.some((ref) => ref.includes('${{')))
-        return result(null, 'Dynamic action references cannot be resolved safely.');
-    const unpinned = refs.filter((ref) => !ref.startsWith('./') &&
-        !/^[^@\s]+@[a-f0-9]{40}$/iu.test(ref) && !/^docker:\/\/[^@\s]+@sha256:[a-f0-9]{64}$/iu.test(ref));
-    const value = result(unpinned.length === 0, unpinned.length ? `Unpinned action references: ${unpinned.join(', ')}` : 'External action references are content-pinned.');
-    if (unpinned.length === 1 && /^slsa-framework\/slsa-github-generator\/\.github\/workflows\/[a-zA-Z0-9_-]+\.yml@v\d+\.\d+\.\d+$/u.test(unpinned[0])) {
-        value.exceptionResource = unpinned[0];
-    }
-    return value;
-}
-export function failOpenFlags(workflows, rules) {
-    const contexts = requiredCheckContexts(rules);
-    if (!contexts?.length)
-        return result(null, 'Exact required contexts are needed to distinguish gates from diagnostic/report-only jobs.');
-    const matched = new Set();
-    let unknown = false;
-    for (const workflow of workflows) {
-        const jobs = workflowJobs(workflow);
-        if (!jobs)
-            return result(null, `Jobs cannot be interpreted in ${workflow.path}.`);
-        for (const job of jobs) {
-            const name = typeof job.name === 'string' ? job.name : String(job.id);
-            if (!contexts.some((context) => context.name === name))
-                continue;
-            matched.add(name);
-            const steps = job.steps === undefined ? [] : records(job.steps);
-            if (!steps)
-                return result(null, `Required job steps are not interpretable in ${workflow.path}.`);
-            for (const item of [job, ...steps]) {
-                if (item['continue-on-error'] === true)
-                    return result(true, `Required job ${name} in ${workflow.path} permits continue-on-error.`);
-                if (item['continue-on-error'] !== undefined && typeof item['continue-on-error'] !== 'boolean')
-                    unknown = true;
-            }
-        }
-    }
-    const unresolved = contexts.some((context) => !matched.has(context.name));
-    return result(unresolved || unknown ? null : false, unresolved || unknown
-        ? 'Some required-job flag semantics are unresolved.' : 'No continue-on-error flags were observed in identified required jobs; script semantics require separate proof.');
-}
-export function securityPipeline(workflows) {
-    const refs = actionReferences(workflows);
-    if (!refs || !workflows.length)
-        return result(null, 'Security workflow inventory is unavailable.');
-    const forbidden = ['gitleaks/gitleaks-action', 'semgrep/semgrep-action', 'microsoft/security-devops-action'];
-    if (refs.some((ref) => forbidden.some((repo) => ref.toLowerCase().startsWith(`${repo}@`)))) {
-        return result(false, 'A policy-excluded duplicate security scanner is declared.');
-    }
-    return result(null, 'Action inventory is observable, but complete stage/tool roles and script-backed gates require explicit execution evidence.');
-}
+export * from '../domain/governance/assessment/predicates.js';
 //# sourceMappingURL=predicates.js.map

package/dist/governance-assessment/predicates.js.map

@@ -1 +1 @@
-{"version":3,"file":"predicates.js","sourceRoot":"","sources":["../../src/governance-assessment/predicates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAUzC,SAAS,MAAM,CAAC,KAAqB,EAAE,MAAc;IACnD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACnH,CAAC;AACD,SAAS,QAAQ,CAAC,OAAgC;IAChD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AACD,SAAS,aAAa,CAAC,OAAgC;IACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AACD,SAAS,UAAU,CAAC,IAA6B;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AACD,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,+BAA+B,KAAK,QAAQ;QACrE,OAAO,MAAM,CAAC,yBAAyB,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,0BAA0B,KAAK,SAAS;QAC/G,OAAO,MAAM,CAAC,6BAA6B,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,MAAM,CAAC,+BAA+B,KAAK,CAAC;QACjD,MAAM,CAAC,yBAAyB,KAAK,KAAK,IAAI,MAAM,CAAC,0BAA0B,KAAK,KAAK;QACzF,MAAM,CAAC,6BAA6B,KAAK,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,aAA4B;IAC5E,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,iBAAiB;QAAE,OAAO,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,aAAa,EAAE,CAAC;IAChH,IAAI,OAAO,KAAK,uBAAuB,IAAI,OAAO,KAAK,sBAAsB;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3H,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAmC,EAAE,GAAW,EAAE,aAA4B;IAE9E,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ;QAC1G,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9F,EAAE,CAAC;YACF,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3F,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAClH,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,aAAa,GAAkB,IAAI;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;IACxG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,sCAAsC,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC;QACvI,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAC;YAC/H,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAAC,CAAC;YACvG,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1I,OAAO,MAAM,CAAC,KAAK,EAAE,4CAA4C,GAAG,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,MAAM,EAAE,oCAAoC,KAAK,IAAI,IAAI,MAAM,CAAC,wBAAwB,KAAK,IAAI;gBACtG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7F,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,4DAA4D,GAAG,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,0EAA0E,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9G,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,2CAA2C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5G,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,EAAE,8DAA8D,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC;AACrL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,YAAqB;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YACnG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,4CAA4C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9G,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,mDAAmD,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAE,CAAC,UAAU,KAAK,aAAa,IAAI,OAAO,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,KAAK,QAAQ;gBAC7F,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,KAAK,YAAY,CAAC;gBACpE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,SAAS,KAAK,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,+FAA+F,CAAC,CAAC;AACxI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAkD,EAAE,CAAC;IACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9G,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,wBAAwB,CAAC,EAAE,CAAC;YACpF,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC1L,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAc,EAAE,IAAuB,EAAE,aAA4B;IAErE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAoF,EAAE,CAAC;IACrG,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aAChH,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAkB,EAAE,UAAmB,EAAE,aAAa,GAAkB,IAAI;IACnH,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,uEAAuE,CAAC,CAAC;IAC7H,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvG,OAAO,MAAM,CAAC,IAAI,EAAE,iEAAiE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACtE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,8BAA8B,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC;QAChH,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,2CAA2C,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACvH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACrD,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;YACxF,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAC/D,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,+DAA+D,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,sFAAsF,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,YAAY,CAAC,QAAwB;IAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AACD,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAA2B;IAC7D,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC7E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,iCAAiC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QAClF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAC,KAAK,EAAE,kCAAkC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YAC9F,OAAO,KAAK,KAAK,KAAK,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,0DAA0D,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC;AAC9J,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAA2B;IAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC;gBACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;wBAAE,SAAS;oBACtC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA2B;IACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACzG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,sDAAsD,CAAC,CAAC;IACzH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QACzD,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;IACvK,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,mGAAmG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACpJ,KAAK,CAAC,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA2B,EAAE,KAAc;IACvE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,2FAA2F,CAAC,CAAC;IACxI,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,iCAAiC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QAClF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;gBAAE,SAAS;YACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,+CAA+C,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YACjG,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,IAAI;oBAAE,OAAO,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,OAAO,QAAQ,CAAC,IAAI,6BAA6B,CAAC,CAAC;gBACnI,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS;oBAAE,OAAO,GAAG,IAAI,CAAC;YAChH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,IAAI,OAAO;QACvE,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,gHAAgH,CAAC,CAAC;AAC7K,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAA2B;IAC1D,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,6CAA6C,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IAC7G,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,MAAM,CAAC,KAAK,EAAE,2DAA2D,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,4HAA4H,CAAC,CAAC;AACpJ,CAAC"}
+{"version":3,"file":"predicates.js","sourceRoot":"","sources":["../../src/governance-assessment/predicates.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC"}

package/dist/governance-assessment/project.d.ts

@@ -1,11 +1,15 @@
-import type { ApprovalEnvelope, PhaseEvidenceRecord, SavedTransitionPlan, UserActivationState } from '../governance-activation/types.js';
-import type { GeneratedArtifact, LiftoffManifest } from '../types.js';
-import { type CommandRunner } from '../process-runner.js';
-import type { AssessmentDiagnostic, AssessmentProjectIdentity, JsonValue, LiveAssessmentScope } from './types.js';
+import type { ApprovalEnvelope, PhaseEvidenceRecord, PhaseId, SavedTransitionPlan, UserActivationState } from '../domain/governance/activation/types.js';
+import type { EvidenceFreshnessContext, EvidenceSelectionResult } from '../domain/governance/activation/evidence.js';
+import type { ActivationInputSnapshot } from '../domain/governance/activation/inputs.js';
+import type { GeneratedArtifact, LiftoffManifest } from '../domain/project/contracts.js';
+import type { AssessmentDiagnostic, AssessmentProjectIdentity, JsonValue } from './types.js';
 import { AssessmentFiles } from './readers.js';
+export { inspectAssessmentGit, repositoryName, resolveAssessmentBoundary } from '../adapters/git/governance-assessment.js';
+export type { AssessmentBoundary, AssessmentBoundaryKind, AssessmentGitFacts } from '../adapters/git/governance-assessment.js';
 export interface AssessmentProject {
+    kind: 'liftoff' | 'git';
     manifest: LiftoffManifest | null;
-    project: LiftoffManifest['project'];
+    project: LiftoffManifest['project'] | null;
     identity: AssessmentProjectIdentity;
     managedEntries: Array<{
         logicalName: string;
@@ -19,19 +23,18 @@ export interface AssessmentProject {
     approvals: ApprovalEnvelope[];
     plans: SavedTransitionPlan[];
     bindingBaseline: string | null;
+    inputSnapshot?: ActivationInputSnapshot;
+    evidenceContexts?: Partial<Record<PhaseId, EvidenceFreshnessContext>>;
+    activationSelections?: Partial<Record<PhaseId, EvidenceSelectionResult>>;
+    historicalActivation?: AssessmentHistoricalActivation;
     invalidEvidence: boolean;
     diagnostics: AssessmentDiagnostic[];
 }
-export declare function inspectAssessmentProject(files: AssessmentFiles): Promise<AssessmentProject>;
-export interface AssessmentGitFacts {
-    repository: {
-        owner: string;
-        name: string;
-        id: string | null;
-    } | null;
-    head: string | null;
-    issues: string[];
-    originState: 'none' | 'verified' | 'unavailable';
+interface AssessmentHistoricalActivation {
+    fingerprint: string;
+    diagnostic: AssessmentDiagnostic;
 }
-export declare function repositoryName(value: string, id?: string | null): LiveAssessmentScope['repository'];
-export declare function inspectAssessmentGit(root: string, runner?: CommandRunner): Promise<AssessmentGitFacts>;
+/** Returns only diagnostic data, never historical proof or update authority. */
+export declare function inspectAssessmentHistoricalActivation(projectRoot: string): Promise<AssessmentHistoricalActivation>;
+export declare function inspectAssessmentProject(files: AssessmentFiles): Promise<AssessmentProject>;
+export declare function ordinaryGitAssessmentProject(): AssessmentProject;