@pyric/cli 0.1.0-alpha.10

package/dist/assurance/campaign.js

@@ -0,0 +1,364 @@
+import { runAuthorizationCampaign } from "./runner.js";
+import { runSecurityCases } from "./cases.js";
+import { assertActor, assertInvariant, assertObservation, assertProbe, assertTarget, } from "./validation.js";
+import { ASSURANCE_CAMPAIGN_SCHEMA, AssuranceInputError, } from "./types.js";
+export class AuthorizationCampaign {
+    id;
+    target;
+    context;
+    maxRuns;
+    #actors = new Map();
+    #invariants = new Map();
+    #observations = new Map();
+    #probes = new Map();
+    #report;
+    #verifications = [];
+    #runs = 0;
+    constructor(options) {
+        if (!options.id.trim())
+            throw new AssuranceInputError("campaign id is required.");
+        assertTarget(options.target);
+        this.id = options.id;
+        this.target = options.target;
+        this.context = options.context;
+        const maxRuns = options.safety?.maxRuns ?? 200;
+        if (!Number.isInteger(maxRuns) || maxRuns <= 0) {
+            throw new AssuranceInputError("campaign maxRuns must be a positive integer.");
+        }
+        this.maxRuns = maxRuns;
+    }
+    addActor(actor) {
+        assertActor(actor);
+        this.#addUnique(this.#actors, actor, "actor");
+        return actor;
+    }
+    addInvariant(invariant) {
+        assertInvariant(invariant);
+        this.#addUnique(this.#invariants, invariant, "invariant");
+        return invariant;
+    }
+    addObservation(observation) {
+        assertObservation(observation);
+        if (!this.#actors.has(observation.actorId)) {
+            throw new AssuranceInputError(`observation '${observation.id}' references unknown actor '${observation.actorId}'.`);
+        }
+        this.#addUnique(this.#observations, observation, "observation");
+        return observation;
+    }
+    addProbe(probe) {
+        assertProbe(probe);
+        if (!this.#actors.has(probe.actorId)) {
+            throw new AssuranceInputError(`probe '${probe.id}' references unknown actor '${probe.actorId}'.`);
+        }
+        const invariant = this.#invariants.get(probe.invariantId);
+        if (!invariant) {
+            throw new AssuranceInputError(`probe '${probe.id}' references unknown invariant '${probe.invariantId}'.`);
+        }
+        if (invariant.service !== "cross-service" &&
+            invariant.service !== probe.control.service) {
+            throw new AssuranceInputError(`probe '${probe.id}' service does not match invariant '${invariant.id}'.`);
+        }
+        this.#addUnique(this.#probes, probe, "probe");
+        return probe;
+    }
+    propose(input) {
+        if (!input || typeof input !== "object") {
+            throw new AssuranceInputError("proposal input must be an object.");
+        }
+        if (typeof input.observationId !== "string" ||
+            !input.observationId.trim()) {
+            throw new AssuranceInputError("proposal observationId is required.");
+        }
+        if (typeof input.invariantId !== "string" || !input.invariantId.trim()) {
+            throw new AssuranceInputError("proposal invariantId is required.");
+        }
+        if (!Array.isArray(input.mutations)) {
+            throw new AssuranceInputError("proposal mutations must be an array.");
+        }
+        const observation = this.#observations.get(input.observationId);
+        if (!observation) {
+            throw new AssuranceInputError(`unknown observation '${input.observationId}'.`);
+        }
+        if (!this.#invariants.has(input.invariantId)) {
+            throw new AssuranceInputError(`unknown invariant '${input.invariantId}'.`);
+        }
+        if (input.mutations.length === 0) {
+            throw new AssuranceInputError("at least one mutation is required.");
+        }
+        return input.mutations.map((mutation, index) => {
+            const id = mutation.id ??
+                `${input.observationId}-${mutation.dimension}-${index + 1}`;
+            const probe = {
+                id,
+                actorId: observation.actorId,
+                invariantId: input.invariantId,
+                control: observation.operation,
+                mutation: {
+                    dimension: mutation.dimension,
+                    description: mutation.description,
+                    operation: mutation.operation,
+                },
+            };
+            return this.addProbe(probe);
+        });
+    }
+    spec(probeIds) {
+        const probes = probeIds
+            ? probeIds.map((id) => {
+                const probe = this.#probes.get(id);
+                if (!probe)
+                    throw new AssuranceInputError(`unknown probe '${id}'.`);
+                return probe;
+            })
+            : [...this.#probes.values()];
+        return {
+            schema: ASSURANCE_CAMPAIGN_SCHEMA,
+            id: this.id,
+            target: this.target,
+            actors: [...this.#actors.values()],
+            invariants: [...this.#invariants.values()],
+            probes,
+        };
+    }
+    async run(probeIds) {
+        const count = probeIds?.length ?? this.#probes.size;
+        this.#assertRunBudget(count);
+        const report = await runAuthorizationCampaign(this.spec(probeIds));
+        this.#runs += count;
+        if (!probeIds) {
+            this.#report = report;
+        }
+        else {
+            this.#report = mergeReports(this.#report, report, this.#probes.size);
+        }
+        return report;
+    }
+    inspect(probeId) {
+        const result = this.#report?.results.find((item) => item.probeId === probeId);
+        if (!result) {
+            throw new AssuranceInputError(`probe '${probeId}' has no completed run to inspect.`);
+        }
+        return result;
+    }
+    async minimize(probeId) {
+        const original = this.#probes.get(probeId);
+        if (!original)
+            throw new AssuranceInputError(`unknown probe '${probeId}'.`);
+        const originalResult = this.inspect(probeId);
+        if (originalResult.classification !== "local-counterexample" &&
+            originalResult.classification !== "candidate-signal") {
+            throw new AssuranceInputError(`probe '${probeId}' has no counterexample to minimize.`);
+        }
+        const operation = original.mutation.operation;
+        const data = "data" in operation ? operation.data : undefined;
+        if (original.mutation.dimension !== "payload" ||
+            !data ||
+            typeof data !== "object" ||
+            Array.isArray(data)) {
+            return {
+                probeId,
+                changed: false,
+                removedPayloadFields: [],
+                probe: original,
+                result: originalResult,
+            };
+        }
+        let kept = { ...data };
+        const controlData = "data" in original.control &&
+            original.control.data &&
+            typeof original.control.data === "object" &&
+            !Array.isArray(original.control.data)
+            ? original.control.data
+            : {};
+        const retainsPayloadDelta = (candidate) => Object.keys(candidate).some((field) => stableValue(candidate[field]) !== stableValue(controlData[field]));
+        if (!retainsPayloadDelta(kept)) {
+            return {
+                probeId,
+                changed: false,
+                removedPayloadFields: [],
+                probe: original,
+                result: originalResult,
+            };
+        }
+        this.#assertRunBudget(Object.keys(kept).length);
+        const removedPayloadFields = [];
+        let bestProbe = original;
+        let bestResult = originalResult;
+        for (const field of Object.keys(kept)) {
+            if (Object.keys(kept).length === 1)
+                break;
+            const candidateData = { ...kept };
+            delete candidateData[field];
+            if (!retainsPayloadDelta(candidateData))
+                continue;
+            const candidate = {
+                ...original,
+                id: `${original.id}--min-${field}`,
+                mutation: {
+                    ...original.mutation,
+                    operation: { ...operation, data: candidateData },
+                },
+            };
+            const report = await runAuthorizationCampaign({
+                ...this.spec([probeId]),
+                probes: [candidate],
+            });
+            this.#runs++;
+            const result = report.results[0];
+            if (result.classification === originalResult.classification) {
+                kept = candidateData;
+                removedPayloadFields.push(field);
+                bestProbe = { ...candidate, id: original.id };
+                bestResult = { ...result, probeId: original.id };
+            }
+        }
+        if (removedPayloadFields.length > 0) {
+            this.#probes.set(probeId, bestProbe);
+            this.#report = replaceResult(this.#report, bestResult);
+        }
+        return {
+            probeId,
+            changed: removedPayloadFields.length > 0,
+            removedPayloadFields,
+            probe: bestProbe,
+            result: bestResult,
+        };
+    }
+    exportSecurityCases(options = {}) {
+        if (!this.#report)
+            throw new AssuranceInputError("campaign has not been run.");
+        return this.#report.results
+            .filter((result) => result.classification === "local-counterexample" ||
+            (options.includeCandidates &&
+                result.classification === "candidate-signal"))
+            .map((result) => ({
+            schema: "pyric.assurance.case.v1",
+            id: result.probeId,
+            campaignId: this.id,
+            actorId: result.actorEvidence.actorId,
+            invariant: result.invariant,
+            control: result.control.operation,
+            mutation: result.mutationSpec,
+            expect: result.invariant.expected,
+            qualification: result.qualification,
+        }));
+    }
+    async verifyRules(options) {
+        if (!options.rules || Object.keys(options.rules).length === 0) {
+            throw new AssuranceInputError("candidate rules must include at least one service.");
+        }
+        const cases = this.exportSecurityCases({
+            includeCandidates: options.includeCandidates,
+        });
+        if (cases.length === 0) {
+            throw new AssuranceInputError("campaign has no qualified regression cases to verify.");
+        }
+        this.#assertRunBudget(cases.length);
+        const report = await runSecurityCases({
+            campaignId: options.id ??
+                `${this.id}-verification-${this.#verifications.length + 1}`,
+            target: {
+                ...this.target,
+                rules: { ...this.target.rules, ...options.rules },
+            },
+            actors: [...this.#actors.values()],
+            cases,
+        });
+        this.#runs += cases.length;
+        this.#verifications.push(report);
+        return report;
+    }
+    export() {
+        return {
+            schema: "pyric.assurance.export.v1",
+            campaign: this.spec(),
+            ...(this.context ? { context: this.context } : {}),
+            observations: [...this.#observations.values()],
+            ...(this.#report ? { report: this.#report } : {}),
+            cases: this.#report ? this.exportSecurityCases() : [],
+            ...(this.#verifications.length > 0
+                ? { verifications: [...this.#verifications] }
+                : {}),
+        };
+    }
+    visualization() {
+        return {
+            schema: "pyric.assurance.visualization.v1",
+            campaignId: this.id,
+            ...(this.context ? { context: this.context } : {}),
+            observations: [...this.#observations.values()],
+            probes: [...this.#probes.values()],
+            ...(this.#report ? { report: this.#report } : {}),
+            ...(this.#verifications.length > 0
+                ? { verifications: [...this.#verifications] }
+                : {}),
+        };
+    }
+    get report() {
+        return this.#report;
+    }
+    get observations() {
+        return [...this.#observations.values()];
+    }
+    #addUnique(map, value, label) {
+        if (!value.id.trim())
+            throw new AssuranceInputError(`${label} id is required.`);
+        if (map.has(value.id))
+            throw new AssuranceInputError(`duplicate ${label} id '${value.id}'.`);
+        map.set(value.id, value);
+    }
+    #assertRunBudget(count) {
+        if (this.#runs + count > this.maxRuns) {
+            throw new AssuranceInputError(`campaign run budget exceeded: ${this.#runs + count}/${this.maxRuns} probes.`);
+        }
+    }
+}
+function stableValue(value) {
+    if (value === undefined)
+        return "undefined";
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableValue).join(",")}]`;
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableValue(record[key])}`)
+        .join(",")}}`;
+}
+function mergeReports(existing, incoming, totalProbes) {
+    if (!existing)
+        return incoming;
+    const byId = new Map(existing.results.map((result) => [result.probeId, result]));
+    for (const result of incoming.results)
+        byId.set(result.probeId, result);
+    const results = [...byId.values()];
+    return {
+        ...incoming,
+        results,
+        summary: summarizeResults(results, totalProbes),
+    };
+}
+function replaceResult(report, replacement) {
+    const results = report.results.map((result) => result.probeId === replacement.probeId ? replacement : result);
+    return {
+        ...report,
+        results,
+        summary: summarizeResults(results, results.length),
+    };
+}
+function summarizeResults(results, totalProbes) {
+    return {
+        probes: totalProbes,
+        controlsPassed: results.filter((result) => result.control.decision === "ALLOW").length,
+        localCounterexamples: results.filter((result) => result.classification === "local-counterexample").length,
+        candidateSignals: results.filter((result) => result.classification === "candidate-signal").length,
+        noCounterexamples: results.filter((result) => result.classification === "no-counterexample").length,
+        engineGaps: results.filter((result) => result.classification === "engine-gap").length,
+        invalidProbes: results.filter((result) => result.classification === "invalid-probe").length,
+    };
+}
+export function createAuthorizationCampaign(options) {
+    return new AuthorizationCampaign(options);
+}
+//# sourceMappingURL=campaign.js.map

package/dist/assurance/campaign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign.js","sourceRoot":"","sources":["../../src/assurance/campaign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAepB,MAAM,YAAY,CAAC;AAYpB,MAAM,OAAO,qBAAqB;IACvB,EAAE,CAAS;IACX,MAAM,CAAsB;IAC5B,OAAO,CAAuC;IAC9C,OAAO,CAAS;IAEzB,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IACxD,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,OAAO,CAA0C;IACjD,cAAc,GAAkC,EAAE,CAAC;IACnD,KAAK,GAAG,CAAC,CAAC;IAEV,YAAY,OAA2C;QACrD,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;YACpB,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,GAAG,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,mBAAmB,CAC3B,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,QAAQ,CAAC,KAAqB;QAC5B,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,YAAY,CAAC,SAA4B;QACvC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,cAAc,CAAC,WAAiC;QAC9C,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,WAAW,CAAC,EAAE,+BAA+B,WAAW,CAAC,OAAO,IAAI,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAChE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,KAAqB;QAC5B,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAC3B,UAAU,KAAK,CAAC,EAAE,+BAA+B,KAAK,CAAC,OAAO,IAAI,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAC3B,UAAU,KAAK,CAAC,EAAE,mCAAmC,KAAK,CAAC,WAAW,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,SAAS,CAAC,OAAO,KAAK,eAAe;YACrC,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO,EAC3C,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,KAAK,CAAC,EAAE,uCAAuC,SAAS,CAAC,EAAE,IAAI,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,KAAoB;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QACD,IACE,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;YACvC,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,EAC3B,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,KAAK,CAAC,aAAa,IAAI,CAChD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,KAAK,CAAC,WAAW,IAAI,CAC5C,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,GACN,QAAQ,CAAC,EAAE;gBACX,GAAG,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,SAAS,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAmB;gBAC5B,EAAE;gBACF,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,WAAW,CAAC,SAAS;gBAC9B,QAAQ,EAAE;oBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;iBAC9B;aACF,CAAC;YACF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAmB;QACtB,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;gBACpE,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,yBAAyB;YACjC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAClC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM;SACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAmB;QAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,OAAe;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CACvC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CACnC,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAC3B,UAAU,OAAO,oCAAoC,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,OAAO,IAAI,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,IACE,cAAc,CAAC,cAAc,KAAK,sBAAsB;YACxD,cAAc,CAAC,cAAc,KAAK,kBAAkB,EACpD,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,OAAO,sCAAsC,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IACE,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YACzC,CAAC,IAAI;YACL,OAAO,IAAI,KAAK,QAAQ;YACxB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EACnB,CAAC;YACD,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,oBAAoB,EAAE,EAAE;gBACxB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,cAAc;aACvB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,GAAG,EAAE,GAAI,IAAgC,EAAE,CAAC;QACpD,MAAM,WAAW,GACf,MAAM,IAAI,QAAQ,CAAC,OAAO;YAC1B,QAAQ,CAAC,OAAO,CAAC,IAAI;YACrB,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;YACzC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YACnC,CAAC,CAAE,QAAQ,CAAC,OAAO,CAAC,IAAgC;YACpD,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,mBAAmB,GAAG,CAAC,SAAkC,EAAE,EAAE,CACjE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CACpE,CAAC;QACJ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,oBAAoB,EAAE,EAAE;gBACxB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,cAAc;aACvB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAC1C,IAAI,SAAS,GAAG,QAAQ,CAAC;QACzB,IAAI,UAAU,GAAG,cAAc,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;YAC1C,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC;gBAAE,SAAS;YAClD,MAAM,SAAS,GAAmB;gBAChC,GAAG,QAAQ;gBACX,EAAE,EAAE,GAAG,QAAQ,CAAC,EAAE,SAAS,KAAK,EAAE;gBAClC,QAAQ,EAAE;oBACR,GAAG,QAAQ,CAAC,QAAQ;oBACpB,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,aAAa,EAAsB;iBACrE;aACF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;gBAC5C,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;gBACvB,MAAM,EAAE,CAAC,SAAS,CAAC;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;YAClC,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,CAAC,cAAc,EAAE,CAAC;gBAC5D,IAAI,GAAG,aAAa,CAAC;gBACrB,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,SAAS,GAAG,EAAE,GAAG,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAC9C,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;QACD,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAQ,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,OAAO;YACP,OAAO,EAAE,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACxC,oBAAoB;YACpB,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IAED,mBAAmB,CACjB,UAA2C,EAAE;QAE7C,IAAI,CAAC,IAAI,CAAC,OAAO;YACf,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;aACxB,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,cAAc,KAAK,sBAAsB;YAChD,CAAC,OAAO,CAAC,iBAAiB;gBACxB,MAAM,CAAC,cAAc,KAAK,kBAAkB,CAAC,CAClD;aACA,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,MAAM,EAAE,yBAAkC;YAC1C,EAAE,EAAE,MAAM,CAAC,OAAO;YAClB,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC,OAAO;YACrC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACjC,QAAQ,EAAE,MAAM,CAAC,YAAY;YAC7B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAIjB;QACC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC;YACrC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,mBAAmB,CAC3B,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,UAAU,EACR,OAAO,CAAC,EAAE;gBACV,GAAG,IAAI,CAAC,EAAE,iBAAiB,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE;YAC7D,MAAM,EAAE;gBACN,GAAG,IAAI,CAAC,MAAM;gBACd,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE;aAClD;YACD,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,MAAM,EAAE,2BAA2B;YACnC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;YACrB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO;YACL,MAAM,EAAE,kCAAkC;YAC1C,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC9C,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,YAAY;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,UAAU,CACR,GAAmB,EACnB,KAAQ,EACR,KAAa;QAEb,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;YAClB,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,aAAa,KAAK,QAAQ,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACxE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAC3B,iCAAiC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,UAAU,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACzE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CACnB,QAAiD,EACjD,QAAqC,EACrC,WAAmB;IAEnB,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAC3D,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,QAAQ;QACX,OAAO;QACP,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAAmC,EACnC,WAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAC9D,CAAC;IACF,OAAO;QACL,GAAG,MAAM;QACT,OAAO;QACP,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA+B,EAC/B,WAAmB;IAEnB,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,cAAc,EAAE,OAAO,CAAC,MAAM,CAC5B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAChD,CAAC,MAAM;QACR,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,sBAAsB,CAC7D,CAAC,MAAM;QACR,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,kBAAkB,CACzD,CAAC,MAAM;QACR,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAC/B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,mBAAmB,CAC1D,CAAC,MAAM;QACR,UAAU,EAAE,OAAO,CAAC,MAAM,CACxB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,YAAY,CACnD,CAAC,MAAM;QACR,aAAa,EAAE,OAAO,CAAC,MAAM,CAC3B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,eAAe,CACtD,CAAC,MAAM;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,OAA2C;IAE3C,OAAO,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/assurance/capabilities.d.ts

@@ -0,0 +1,11 @@
+import { type ConformanceVerdict } from "./.generated/conformance-verdicts.js";
+import type { AssuranceProbe, EngineQualification, LocalFirebaseTarget } from "./types.js";
+/**
+ * A probe's `requires` names graph nodes (constructs, registry rows) directly,
+ * and the engine resolves each against the node's derived verdict. The lookup
+ * contains every addressable graph node and is regenerated before compilation;
+ * it is not an authored or committed capability catalog.
+ */
+export declare function verdictOf(nodeId: string): ConformanceVerdict | undefined;
+export declare function qualifyProbe(target: LocalFirebaseTarget, probe: AssuranceProbe): EngineQualification;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/assurance/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/assurance/capabilities.ts"],"names":[],"mappings":"AAoBA,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EACV,cAAc,EAGd,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAIxE;AAmXD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,cAAc,GACpB,mBAAmB,CA6BrB"}