@msn-control/liftoff 0.9.9 → 0.10.1

package/dist/governance-activation/credentials.d.ts

@@ -0,0 +1,160 @@
+import { type CommandResult, type CommandRunner } from '../process-runner.js';
+import type { ExternalCommand } from '../types.js';
+import type { ActivationIdentity, CredentialPermissionSet, CredentialPolicy, CredentialPolicyProofMetadata, CredentialRepositoryIdentity, CredentialWorkflowAllowlistEntry } from './types.js';
+import { runnerPreflightDisplayNameTemplate, runnerPreflightPatLifetimeDays, runnerPreflightRotationLeadDays, runnerPreflightSecretName } from './types.js';
+export declare const credentialPolicyPathParts: readonly ['governance', 'credentials', 'preflight-policy.json'];
+export interface CredentialRepositoryInput {
+    id?: string;
+    owner: string;
+    name: string;
+}
+export interface RepositorySecretReadback {
+    repository: CredentialRepositoryIdentity;
+    secretName: typeof runnerPreflightSecretName;
+    updatedAt: string;
+    readbackDigest: string;
+}
+export interface RepositorySecretWriteRequest {
+    repository: CredentialRepositoryIdentity;
+    secretName: typeof runnerPreflightSecretName;
+    value: SensitiveCredentialValue;
+}
+export interface DiscoveredGitHubAppInstallation {
+    installationId: number;
+    appSlug: string;
+    approved: boolean;
+    verified: boolean;
+    selection: 'selected-repository' | 'all-repositories';
+    repositories: readonly CredentialRepositoryIdentity[];
+    permissions: CredentialPermissionSet;
+    permissionsVerifiedAt: string;
+    readbackDigest?: string;
+    token: {
+        canGenerate: boolean;
+        ttlSeconds: number;
+    };
+}
+export interface GitHubCredentialAdapter {
+    discoverAppInstallations(repository: CredentialRepositoryIdentity): Promise<readonly DiscoveredGitHubAppInstallation[]>;
+    readRepositorySecret(repository: CredentialRepositoryIdentity, secretName: typeof runnerPreflightSecretName): Promise<RepositorySecretReadback | null>;
+    setRepositorySecret?(request: RepositorySecretWriteRequest): Promise<RepositorySecretReadback>;
+}
+export interface PatEnrollmentGuidance {
+    authKind: 'fine-grained-pat';
+    displayNameTemplate: typeof runnerPreflightDisplayNameTemplate;
+    displayName: string;
+    secretName: typeof runnerPreflightSecretName;
+    lifetimeDays: typeof runnerPreflightPatLifetimeDays;
+    owner: string;
+    repository: CredentialRepositoryIdentity;
+    selectedRepositoryOnly: true;
+    permissions: CredentialPermissionSet;
+    writes: readonly [];
+    expiresAt: string;
+    rotationLeadDays: typeof runnerPreflightRotationLeadDays;
+    rotationDueAt: string;
+}
+export type CredentialPlan = {
+    authKind: 'github-app';
+    policy: CredentialPolicy;
+    app: DiscoveredGitHubAppInstallation;
+    fallbackGuidance: null;
+    rejectionReasons: readonly string[];
+} | {
+    authKind: 'fine-grained-pat';
+    policy: null;
+    app: null;
+    fallbackGuidance: PatEnrollmentGuidance;
+    rejectionReasons: readonly string[];
+};
+export interface CredentialUsageReference {
+    workflowPath: string;
+    job: string;
+}
+export interface CredentialPolicyUsage {
+    repository: CredentialRepositoryIdentity;
+    permissions: CredentialPermissionSet;
+    references: readonly CredentialUsageReference[];
+    forwardsCredential: boolean;
+    verifiedReadbackDigest?: string;
+    now?: Date;
+}
+export interface CredentialPolicyUsageResult {
+    ready: boolean;
+    status: CredentialPolicy['status'] | 'not-ready';
+    issues: readonly string[];
+}
+export interface CredentialLeakInput {
+    source: 'generated-artifact' | 'process-log' | 'imported-evidence' | 'screenshot-text' | 'chat-text';
+    label: string;
+    text: string;
+}
+export interface CredentialLeakScanResult {
+    status: 'clear' | 'compromised';
+    leaks: readonly {
+        source: CredentialLeakInput['source'];
+        label: string;
+        pattern: string;
+    }[];
+    guidance: readonly string[];
+    unauthorizedRevocationAttempted: false;
+}
+export type MaskedCredentialPrompt = (message: string) => Promise<SensitiveCredentialValue>;
+export interface GitHubCliSecretWriteResult {
+    command: ExternalCommand;
+    result: CommandResult;
+}
+export declare class SensitiveCredentialValue {
+    #private;
+    private constructor();
+    static fromMaskedInput(value: string): SensitiveCredentialValue;
+    use<T>(consumer: (value: string) => T): T;
+    release(): void;
+}
+export declare function inquirerMaskedCredentialPrompt(message: string): Promise<SensitiveCredentialValue>;
+export declare function repositorySecretSetCommand(repository: CredentialRepositoryIdentity, secretName: typeof runnerPreflightSecretName): ExternalCommand;
+export declare function writeRepositorySecretWithGitHubCli(input: {
+    runner: CommandRunner;
+    repository: CredentialRepositoryIdentity;
+    secretName: typeof runnerPreflightSecretName;
+    value: SensitiveCredentialValue;
+    cwd?: string;
+}): Promise<GitHubCliSecretWriteResult>;
+export declare function canonicalCredentialRepository(input: CredentialRepositoryInput): CredentialRepositoryIdentity;
+export declare function repositoryNameFromFullName(fullName: string): string;
+export declare function runnerPreflightDisplayName(repositoryName: string): string;
+export declare function runnerPreflightPermissions(): CredentialPermissionSet;
+export declare function buildPatEnrollmentGuidance(input: {
+    repository: CredentialRepositoryIdentity;
+    now?: Date;
+}): PatEnrollmentGuidance;
+export declare function buildFineGrainedPatCredentialPolicy(input: {
+    repository: CredentialRepositoryIdentity;
+    allowedWorkflows: readonly CredentialWorkflowAllowlistEntry[];
+    createdAt: Date;
+    proof: CredentialPolicyProofMetadata;
+    identity?: ActivationIdentity;
+}): CredentialPolicy;
+export declare function buildGitHubAppCredentialPolicy(input: {
+    repository: CredentialRepositoryIdentity;
+    installation: DiscoveredGitHubAppInstallation;
+    allowedWorkflows: readonly CredentialWorkflowAllowlistEntry[];
+    createdAt: Date;
+    identity?: ActivationIdentity;
+}): CredentialPolicy;
+export declare function appInstallationIssues(installation: DiscoveredGitHubAppInstallation, repository: CredentialRepositoryIdentity): string[];
+export declare function discoverCredentialPlan(input: {
+    adapter: GitHubCredentialAdapter;
+    repository: CredentialRepositoryIdentity;
+    allowedWorkflows: readonly CredentialWorkflowAllowlistEntry[];
+    now?: Date;
+}): Promise<CredentialPlan>;
+export declare function enrollFineGrainedPatCredential(input: {
+    adapter: GitHubCredentialAdapter;
+    prompt: MaskedCredentialPrompt;
+    repository: CredentialRepositoryIdentity;
+    allowedWorkflows: readonly CredentialWorkflowAllowlistEntry[];
+    now?: Date;
+}): Promise<CredentialPolicy>;
+export declare function validateCredentialPolicyUsage(policy: unknown, usage: CredentialPolicyUsage): CredentialPolicyUsageResult;
+export declare function detectCredentialLeaks(inputs: readonly CredentialLeakInput[]): CredentialLeakScanResult;

package/dist/governance-activation/credentials.js

@@ -0,0 +1,403 @@
+import { password } from '@inquirer/prompts';
+import { redactSensitiveText } from '../process-runner.js';
+import { canonicalSha256 } from './canonical-json.js';
+import { currentActivationIdentity } from './graph.js';
+import { credentialPolicySchemaVersion } from './identity.js';
+import { runnerPreflightDisplayNameTemplate, runnerPreflightOrganizationPermissions, runnerPreflightPatLifetimeDays, runnerPreflightRepositoryPermissions, runnerPreflightRotationLeadDays, runnerPreflightSecretName } from './types.js';
+import { validateCredentialPolicy } from './validators.js';
+export const credentialPolicyPathParts = ['governance', 'credentials', 'preflight-policy.json'];
+export class SensitiveCredentialValue {
+    #value;
+    constructor(value) {
+        this.#value = value;
+    }
+    static fromMaskedInput(value) {
+        if (value.length === 0) {
+            throw new Error('Credential input cannot be empty.');
+        }
+        return new SensitiveCredentialValue(value);
+    }
+    use(consumer) {
+        if (this.#value === undefined) {
+            throw new Error('Credential value has already been released.');
+        }
+        return consumer(this.#value);
+    }
+    release() {
+        this.#value = undefined;
+    }
+}
+export async function inquirerMaskedCredentialPrompt(message) {
+    const value = await password({ message, mask: '*' });
+    return SensitiveCredentialValue.fromMaskedInput(value);
+}
+export function repositorySecretSetCommand(repository, secretName) {
+    return {
+        executable: 'gh',
+        args: ['secret', 'set', secretName, '--repo', repository.fullName, '--app', 'actions', '--body-file', '-']
+    };
+}
+export async function writeRepositorySecretWithGitHubCli(input) {
+    const command = repositorySecretSetCommand(input.repository, input.secretName);
+    const result = await input.value.use(async (value) => {
+        const rawResult = await input.runner.run(command, {
+            cwd: input.cwd,
+            stdin: value,
+            redactValues: [value]
+        });
+        return {
+            ...rawResult,
+            stdout: redactSensitiveText(rawResult.stdout, [value]),
+            stderr: redactSensitiveText(rawResult.stderr, [value]),
+            displayCommand: redactSensitiveText(rawResult.displayCommand, [value]),
+            ...(rawResult.errorMessage
+                ? { errorMessage: redactSensitiveText(rawResult.errorMessage, [value]) }
+                : {})
+        };
+    });
+    return { command, result };
+}
+function addDays(date, days) {
+    return new Date(date.getTime() + days * 24 * 60 * 60 * 1000);
+}
+function canonicalIso(date) {
+    return date.toISOString();
+}
+export function canonicalCredentialRepository(input) {
+    const owner = input.owner.trim();
+    const name = input.name.trim();
+    if (!owner || !name || owner.includes('/') || name.includes('/')) {
+        throw new Error('Credential repository owner and name must be non-empty path segments.');
+    }
+    return {
+        id: input.id?.trim() || `${owner}/${name}`,
+        owner,
+        name,
+        fullName: `${owner}/${name}`
+    };
+}
+export function repositoryNameFromFullName(fullName) {
+    const parts = fullName.trim().split('/');
+    const name = parts.at(-1);
+    if (!name) {
+        throw new Error('Repository full name must include a repository name.');
+    }
+    return name.toLowerCase();
+}
+export function runnerPreflightDisplayName(repositoryName) {
+    return runnerPreflightDisplayNameTemplate.replace('<repo>', repositoryNameFromFullName(repositoryName));
+}
+export function runnerPreflightPermissions() {
+    return {
+        repository: [...runnerPreflightRepositoryPermissions],
+        organization: [...runnerPreflightOrganizationPermissions]
+    };
+}
+export function buildPatEnrollmentGuidance(input) {
+    const createdAt = input.now ?? new Date();
+    const expiresAt = addDays(createdAt, runnerPreflightPatLifetimeDays);
+    const rotationDueAt = addDays(expiresAt, -runnerPreflightRotationLeadDays);
+    return {
+        authKind: 'fine-grained-pat',
+        displayNameTemplate: runnerPreflightDisplayNameTemplate,
+        displayName: runnerPreflightDisplayName(input.repository.name),
+        secretName: runnerPreflightSecretName,
+        lifetimeDays: runnerPreflightPatLifetimeDays,
+        owner: input.repository.owner,
+        repository: input.repository,
+        selectedRepositoryOnly: true,
+        permissions: runnerPreflightPermissions(),
+        writes: [],
+        expiresAt: canonicalIso(expiresAt),
+        rotationLeadDays: runnerPreflightRotationLeadDays,
+        rotationDueAt: canonicalIso(rotationDueAt)
+    };
+}
+function digestPayloadFree(value) {
+    return canonicalSha256(value);
+}
+function proofMetadata(input) {
+    return {
+        verifiedAt: input.verifiedAt,
+        readbackDigest: input.readbackDigest,
+        readbackProvider: input.readbackProvider,
+        payloadFree: true
+    };
+}
+function normalizeAllowedWorkflows(allowedWorkflows) {
+    return allowedWorkflows.map((entry, index) => {
+        if (!entry.path || entry.jobs.length === 0) {
+            throw new Error(`Allowed credential workflow ${index} must include a path and at least one job.`);
+        }
+        return {
+            path: entry.path,
+            jobs: [...entry.jobs]
+        };
+    });
+}
+export function buildFineGrainedPatCredentialPolicy(input) {
+    const guidance = buildPatEnrollmentGuidance({ repository: input.repository, now: input.createdAt });
+    return validateCredentialPolicy({
+        schemaVersion: credentialPolicySchemaVersion,
+        identity: input.identity ?? currentActivationIdentity,
+        repository: input.repository,
+        owner: input.repository.owner,
+        authKind: 'fine-grained-pat',
+        displayNameTemplate: runnerPreflightDisplayNameTemplate,
+        displayName: guidance.displayName,
+        secretName: runnerPreflightSecretName,
+        createdAt: canonicalIso(input.createdAt),
+        expiresAt: guidance.expiresAt,
+        rotationLeadDays: runnerPreflightRotationLeadDays,
+        rotationDueAt: guidance.rotationDueAt,
+        permissions: runnerPreflightPermissions(),
+        allowedWorkflows: normalizeAllowedWorkflows(input.allowedWorkflows),
+        nonForwarding: true,
+        status: 'active',
+        proof: input.proof,
+        app: null,
+        pat: {
+            lifetimeDays: runnerPreflightPatLifetimeDays,
+            selectedRepositoryOnly: true,
+            createdBy: 'manual-masked-entry'
+        }
+    });
+}
+export function buildGitHubAppCredentialPolicy(input) {
+    const app = {
+        installationId: input.installation.installationId,
+        appSlug: input.installation.appSlug,
+        selection: 'selected-repository',
+        repositoryFullName: input.repository.fullName,
+        permissionsVerifiedAt: input.installation.permissionsVerifiedAt,
+        token: {
+            strategy: 'installation-token',
+            ttlSeconds: input.installation.token.ttlSeconds,
+            generatedBy: 'github-app'
+        }
+    };
+    const readbackDigest = input.installation.readbackDigest ?? digestPayloadFree({
+        installationId: app.installationId,
+        repository: input.repository.fullName,
+        permissions: runnerPreflightPermissions(),
+        selectedRepositoryOnly: true
+    });
+    const expiresAt = addDays(input.createdAt, runnerPreflightPatLifetimeDays);
+    const rotationDueAt = addDays(expiresAt, -runnerPreflightRotationLeadDays);
+    return validateCredentialPolicy({
+        schemaVersion: credentialPolicySchemaVersion,
+        identity: input.identity ?? currentActivationIdentity,
+        repository: input.repository,
+        owner: input.repository.owner,
+        authKind: 'github-app',
+        displayNameTemplate: runnerPreflightDisplayNameTemplate,
+        displayName: runnerPreflightDisplayName(input.repository.name),
+        secretName: runnerPreflightSecretName,
+        createdAt: canonicalIso(input.createdAt),
+        expiresAt: canonicalIso(expiresAt),
+        rotationLeadDays: runnerPreflightRotationLeadDays,
+        rotationDueAt: canonicalIso(rotationDueAt),
+        permissions: runnerPreflightPermissions(),
+        allowedWorkflows: normalizeAllowedWorkflows(input.allowedWorkflows),
+        nonForwarding: true,
+        status: 'active',
+        proof: proofMetadata({
+            verifiedAt: input.installation.permissionsVerifiedAt,
+            readbackDigest,
+            readbackProvider: 'github-api'
+        }),
+        app,
+        pat: null
+    });
+}
+function sameRepository(left, right) {
+    return left.owner === right.owner &&
+        left.name === right.name &&
+        left.fullName === right.fullName &&
+        left.id === right.id;
+}
+function samePermissionSet(value) {
+    return sameStringSet(value.repository, runnerPreflightRepositoryPermissions) &&
+        sameStringSet(value.organization, runnerPreflightOrganizationPermissions);
+}
+function sameStringSet(left, right) {
+    return left.length === right.length && right.every((entry) => left.includes(entry));
+}
+function writablePermissions(value) {
+    return [...value.repository, ...value.organization].filter((entry) => /(^|:)write$/iu.test(entry));
+}
+export function appInstallationIssues(installation, repository) {
+    const issues = [];
+    if (!installation.approved) {
+        issues.push('GitHub App installation is not already approved.');
+    }
+    if (!installation.verified) {
+        issues.push('GitHub App installation readback is not verified.');
+    }
+    if (installation.selection !== 'selected-repository') {
+        issues.push('GitHub App installation is not selected-repository scoped.');
+    }
+    if (installation.repositories.length !== 1 || !installation.repositories.some((candidate) => sameRepository(candidate, repository))) {
+        issues.push('GitHub App selected repository does not exactly match the current repository.');
+    }
+    if (!samePermissionSet(installation.permissions)) {
+        issues.push('GitHub App permissions do not exactly match runner-preflight read requirements.');
+    }
+    if (writablePermissions(installation.permissions).length > 0) {
+        issues.push('GitHub App exposes write permissions.');
+    }
+    if (!installation.token.canGenerate || installation.token.ttlSeconds <= 0 || installation.token.ttlSeconds > 3600) {
+        issues.push('GitHub App cannot generate bounded short-lived installation tokens.');
+    }
+    return issues;
+}
+export async function discoverCredentialPlan(input) {
+    const now = input.now ?? new Date();
+    const rejectionReasons = [];
+    const installations = await input.adapter.discoverAppInstallations(input.repository);
+    for (const installation of installations) {
+        const issues = appInstallationIssues(installation, input.repository);
+        if (issues.length === 0) {
+            return {
+                authKind: 'github-app',
+                policy: buildGitHubAppCredentialPolicy({
+                    repository: input.repository,
+                    installation,
+                    allowedWorkflows: input.allowedWorkflows,
+                    createdAt: now
+                }),
+                app: installation,
+                fallbackGuidance: null,
+                rejectionReasons
+            };
+        }
+        rejectionReasons.push(...issues);
+    }
+    return {
+        authKind: 'fine-grained-pat',
+        policy: null,
+        app: null,
+        fallbackGuidance: buildPatEnrollmentGuidance({ repository: input.repository, now }),
+        rejectionReasons
+    };
+}
+export async function enrollFineGrainedPatCredential(input) {
+    if (!input.adapter.setRepositorySecret) {
+        throw new Error('Repository-secret adapter does not support in-memory secret writes.');
+    }
+    const createdAt = input.now ?? new Date();
+    const credential = await input.prompt('Paste the fine-grained PAT. Input is masked and is not logged.');
+    try {
+        const readback = await input.adapter.setRepositorySecret({
+            repository: input.repository,
+            secretName: runnerPreflightSecretName,
+            value: credential
+        });
+        if (!sameRepository(readback.repository, input.repository)) {
+            throw new Error('Repository secret readback repository does not match the credential policy repository.');
+        }
+        if (readback.secretName !== runnerPreflightSecretName) {
+            throw new Error('Repository secret readback secret name does not match the fixed credential policy secret.');
+        }
+        return buildFineGrainedPatCredentialPolicy({
+            repository: input.repository,
+            allowedWorkflows: input.allowedWorkflows,
+            createdAt,
+            proof: proofMetadata({
+                verifiedAt: readback.updatedAt,
+                readbackDigest: readback.readbackDigest,
+                readbackProvider: 'github-api'
+            })
+        });
+    }
+    finally {
+        credential.release();
+    }
+}
+export function validateCredentialPolicyUsage(policy, usage) {
+    const validated = validateCredentialPolicy(policy);
+    const issues = [];
+    if (validated.status === 'compromised') {
+        issues.push('Credential policy is compromised and must be revoked and rotated before use.');
+    }
+    if (validated.status === 'expired') {
+        issues.push('Credential policy is already expired.');
+    }
+    if (validated.status === 'expiring') {
+        issues.push('Credential policy is inside its rotation window.');
+    }
+    if (!sameRepository(validated.repository, usage.repository)) {
+        issues.push('Credential policy repository does not match the requested repository.');
+    }
+    if (!samePermissionSet(validated.permissions) || !samePermissionSet(usage.permissions)) {
+        issues.push('Credential permissions must exactly match metadata read, hosted-runners read, and network-configurations read.');
+    }
+    const writable = [...writablePermissions(validated.permissions), ...writablePermissions(usage.permissions)];
+    if (writable.length > 0) {
+        issues.push(`Credential permissions must not include writes: ${writable.join(', ')}.`);
+    }
+    if (usage.forwardsCredential || validated.nonForwarding !== true) {
+        issues.push('Credential forwarding is not allowed.');
+    }
+    for (const reference of usage.references) {
+        const allowed = validated.allowedWorkflows.find((entry) => entry.path === reference.workflowPath);
+        if (!allowed || !allowed.jobs.includes(reference.job)) {
+            issues.push(`Credential use by ${reference.workflowPath}#${reference.job} is outside the exact workflow/job allowlist.`);
+        }
+    }
+    const now = usage.now ?? new Date();
+    if (Date.parse(validated.expiresAt) <= now.getTime()) {
+        issues.push('Credential policy is expired.');
+    }
+    if (Date.parse(validated.rotationDueAt) <= now.getTime()) {
+        issues.push('Credential policy is inside its rotation lead window.');
+    }
+    if (usage.verifiedReadbackDigest !== validated.proof.readbackDigest) {
+        issues.push('Credential policy lacks matching verified payload-free readback.');
+    }
+    if (validated.authKind === 'github-app') {
+        if (!validated.app ||
+            validated.pat !== null ||
+            validated.app.selection !== 'selected-repository' ||
+            validated.app.repositoryFullName !== validated.repository.fullName ||
+            validated.app.token.strategy !== 'installation-token' ||
+            validated.app.token.ttlSeconds <= 0 ||
+            validated.app.token.ttlSeconds > 3600) {
+            issues.push('GitHub App credential policy is not a supported selected-repository installation token configuration.');
+        }
+    }
+    else if (!validated.pat || validated.app !== null) {
+        issues.push('Fine-grained PAT credential policy has inconsistent auth metadata.');
+    }
+    return {
+        ready: issues.length === 0,
+        status: issues.length === 0 ? validated.status : 'not-ready',
+        issues
+    };
+}
+const credentialLeakPatterns = [
+    { name: 'classic-github-token', pattern: /\bgh[oprsu]_[A-Za-z0-9_]{20,}\b/u },
+    { name: 'fine-grained-github-pat', pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/u },
+    { name: 'slack-webhook', pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/u },
+    { name: 'azure-account-key', pattern: /\bAccountKey=[^;\s]+/iu },
+    { name: 'private-key', pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/u }
+];
+export function detectCredentialLeaks(inputs) {
+    const leaks = inputs.flatMap((input) => credentialLeakPatterns
+        .filter((entry) => entry.pattern.test(input.text))
+        .map((entry) => ({ source: input.source, label: input.label, pattern: entry.name })));
+    return {
+        status: leaks.length > 0 ? 'compromised' : 'clear',
+        leaks,
+        guidance: leaks.length === 0
+            ? []
+            : [
+                'Treat the credential as compromised.',
+                'Revoke the exposed credential in GitHub or its issuing system.',
+                'Create a fresh deterministic replacement and rotate the repository secret after verified readback.',
+                'Liftoff did not attempt automatic revocation.'
+            ],
+        unauthorizedRevocationAttempted: false
+    };
+}
+//# sourceMappingURL=credentials.js.map

package/dist/governance-activation/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/governance-activation/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAA0C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACL,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,6BAA6B,EAC9B,MAAM,eAAe,CAAC;AAUvB,OAAO,EACL,kCAAkC,EAClC,sCAAsC,EACtC,8BAA8B,EAC9B,oCAAoC,EACpC,+BAA+B,EAC/B,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,uBAAuB,CAAU,CAAC;AAmHzG,MAAM,OAAO,wBAAwB;IACnC,MAAM,CAAqB;IAE3B,YAAoB,KAAa;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,KAAa;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,GAAG,CAAI,QAA8B;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAAe;IAClE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,OAAO,wBAAwB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,UAAwC,EACxC,UAA4C;IAE5C,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC;KAC3G,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAMxD;IACC,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;YAChD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,CAAC,KAAK,CAAC;SACtB,CAAC,CAAC;QACH,OAAO;YACL,GAAG,SAAS;YACZ,MAAM,EAAE,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,EAAE,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;YACtD,cAAc,EAAE,mBAAmB,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;YACtE,GAAG,CAAC,SAAS,CAAC,YAAY;gBACxB,CAAC,CAAC,EAAE,YAAY,EAAE,mBAAmB,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE;gBACxE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,IAAU,EAAE,IAAY;IACvC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,IAAU;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAgC;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,EAAE;QAC1C,KAAK;QACL,IAAI;QACJ,QAAQ,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,OAAO,kCAAkC,CAAC,OAAO,CAAC,QAAQ,EAAE,0BAA0B,CAAC,cAAc,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,UAAU,EAAE,CAAC,GAAG,oCAAoC,CAAC;QACrD,YAAY,EAAE,CAAC,GAAG,sCAAsC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,+BAA+B,CAAC,CAAC;IAC3E,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,mBAAmB,EAAE,kCAAkC;QACvD,WAAW,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9D,UAAU,EAAE,yBAAyB;QACrC,YAAY,EAAE,8BAA8B;QAC5C,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;QAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,sBAAsB,EAAE,IAAI;QAC5B,WAAW,EAAE,0BAA0B,EAAE;QACzC,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;QAClC,gBAAgB,EAAE,+BAA+B;QACjD,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,KAItB;IACC,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,gBAA6D;IAE7D,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,4CAA4C,CAAC,CAAC;QACpG,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;SACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAMnD;IACC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACpG,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,6BAA6B;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,yBAAyB;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;QAC7B,QAAQ,EAAE,kBAAkB;QAC5B,mBAAmB,EAAE,kCAAkC;QACvD,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,yBAAyB;QACrC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;QACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,+BAA+B;QACjD,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,0BAA0B,EAAE;QACzC,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACnE,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,IAAI;QACT,GAAG,EAAE;YACH,YAAY,EAAE,8BAA8B;YAC5C,sBAAsB,EAAE,IAAI;YAC5B,SAAS,EAAE,qBAAqB;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAM9C;IACC,MAAM,GAAG,GAAgC;QACvC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,cAAc;QACjD,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO;QACnC,SAAS,EAAE,qBAAqB;QAChC,kBAAkB,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;QAC7C,qBAAqB,EAAE,KAAK,CAAC,YAAY,CAAC,qBAAqB;QAC/D,KAAK,EAAE;YACL,QAAQ,EAAE,oBAAoB;YAC9B,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU;YAC/C,WAAW,EAAE,YAAY;SAC1B;KACF,CAAC;IACF,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC,cAAc,IAAI,iBAAiB,CAAC;QAC5E,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;QACrC,WAAW,EAAE,0BAA0B,EAAE;QACzC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,+BAA+B,CAAC,CAAC;IAC3E,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,6BAA6B;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,yBAAyB;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;QAC7B,QAAQ,EAAE,YAAY;QACtB,mBAAmB,EAAE,kCAAkC;QACvD,WAAW,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9D,UAAU,EAAE,yBAAyB;QACrC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;QACxC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;QAClC,gBAAgB,EAAE,+BAA+B;QACjD,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC;QAC1C,WAAW,EAAE,0BAA0B,EAAE;QACzC,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACnE,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,aAAa,CAAC;YACnB,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,qBAAqB;YACpD,cAAc;YACd,gBAAgB,EAAE,YAAY;SAC/B,CAAC;QACF,GAAG;QACH,GAAG,EAAE,IAAI;KACV,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAkC,EAAE,KAAmC;IAC7F,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC/B,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B;IACvD,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,oCAAoC,CAAC;QAC1E,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,IAAuB,EAAE,KAAwB;IACtE,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA8B;IACzD,OAAO,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,YAA6C,EAC7C,UAAwC;IAExC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,YAAY,CAAC,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,YAAY,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACpI,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,mBAAmB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAClH,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,8BAA8B,CAAC;oBACrC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,YAAY;oBACZ,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,GAAG,EAAE,YAAY;gBACjB,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB;aACjB,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,IAAI;QACT,gBAAgB,EAAE,0BAA0B,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QACnF,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAMpD;IACC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC;IACxG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACvD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,yBAAyB;YACrC,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,yBAAyB,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,mCAAmC,CAAC;YACzC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,SAAS;YACT,KAAK,EAAE,aAAa,CAAC;gBACnB,UAAU,EAAE,QAAQ,CAAC,SAAS;gBAC9B,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,gBAAgB,EAAE,YAAY;aAC/B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,MAAe,EACf,KAA4B;IAE5B,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,gHAAgH,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,mDAAmD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,GAAG,+CAA+C,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,KAAK,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACxC,IACE,CAAC,SAAS,CAAC,GAAG;YACd,SAAS,CAAC,GAAG,KAAK,IAAI;YACtB,SAAS,CAAC,GAAG,CAAC,SAAS,KAAK,qBAAqB;YACjD,SAAS,CAAC,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,UAAU,CAAC,QAAQ;YAClE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,oBAAoB;YACrD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC;YACnC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,EACrC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;QAC5D,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,sBAAsB,GAAG;IAC7B,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,kCAAkC,EAAE;IAC7E,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACjF,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAC3F,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAChE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oDAAoD,EAAE;CAC9E,CAAC;AAEX,MAAM,UAAU,qBAAqB,CAAC,MAAsC;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACrC,sBAAsB;SACnB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CACvF,CAAC;IACF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO;QAClD,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,sCAAsC;gBACtC,gEAAgE;gBAChE,oGAAoG;gBACpG,+CAA+C;aAChD;QACL,+BAA+B,EAAE,KAAK;KACvC,CAAC;AACJ,CAAC"}

package/dist/governance-activation/doctor.d.ts

@@ -0,0 +1,10 @@
+import type { LiftoffManifest } from '../types.js';
+export interface GovernanceDoctorCheck {
+    id: string;
+    label: string;
+    severity: 'ok' | 'warn' | 'fail' | 'skipped';
+    state: string;
+    detail: string;
+    remedy?: string;
+}
+export declare function governanceDoctorChecks(projectRoot: string, manifest: LiftoffManifest, now?: Date): Promise<GovernanceDoctorCheck[]>;