@rasensio/aidlc 1.15.2 → 1.17.0

package/dist/compliance/schema.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Compliance pack validation.
+ *
+ * The whole pack is validated before any part of it is installed, and every
+ * problem is collected rather than the first one thrown. A pack with one
+ * malformed control installs nothing — a partially installed pack is worse than
+ * an absent one, because it looks like a working install.
+ *
+ * Absence is never a default. Every field named in the schema must be present, so
+ * an omitted `reviewed_by` cannot quietly read as "reviewed", and an omitted
+ * `kind` cannot quietly read as `checked-only`.
+ *
+ * Two bounds exist for one reason: **pack text becomes instructions an agent
+ * executes.** Control text is rendered into a review prompt, and a constraint
+ * layer is copied to disk and read on every phase. Both are bounded in length and
+ * both reject `{{` placeholder syntax, because placeholder resolution runs the
+ * guidance pass before the glossary pass deliberately — so a `{{glossary:...}}`
+ * inside a layer body would expand when inlined. Bounding the input closes that at
+ * the source rather than relying on the delivery mechanism to make it unreachable.
+ *
+ * Requirements: compliance-packs/AC-1, AC-2, AC-3, AC-4, AC-5, AC-7, AC-65, AC-105
+ */
+import type { Pack } from './types.js';
+/**
+ * Maximum characters in any single control prose field.
+ *
+ * Sized to hold a full regime clause and its fail condition comfortably while
+ * ruling out a smuggled instruction block. The shipped SOC 2 pack's longest field
+ * is well under half of this.
+ */
+export declare const MAX_CONTROL_FIELD_CHARS = 1000;
+/** Maximum characters across all of a pack's control text. */
+export declare const MAX_PACK_CONTROL_CHARS = 40000;
+/** Maximum characters in a single constraint-layer body. */
+export declare const MAX_LAYER_BODY_CHARS = 20000;
+/** Maximum characters across all of a pack's constraint-layer bodies. */
+export declare const MAX_PACK_LAYER_CHARS = 60000;
+/**
+ * The notice a pack with `reviewed_by: null` must carry in its constraint text.
+ *
+ * Matched case-insensitively as a substring, so a pack may word the surrounding
+ * sentence freely. Held in three places — here, the report generator, and a doctor
+ * check — because a notice that lives only in installed text can be edited away
+ * permanently, since a locally edited layer is preserved forever by design.
+ */
+export declare const UNREVIEWED_NOTICE = "not been reviewed by a compliance practitioner";
+/** The raw text of a pack, as read from disk by the resolver. */
+export interface PackSources {
+    /** Pack directory name, which the metadata's `id` must match. */
+    id: string;
+    /** Contents of `pack.yaml`. */
+    packYaml: string;
+    /** Contents of `controls.yaml`. */
+    controlsYaml: string;
+    /** Layer file name → body, for every layer the pack registers. */
+    layerBodies: Map<string, string>;
+}
+/** Outcome of validating a pack. Every problem, not just the first. */
+export type PackValidation = {
+    ok: true;
+    pack: Pack;
+} | {
+    ok: false;
+    errors: string[];
+};
+/**
+ * Validate a whole pack from its raw sources.
+ *
+ * Pure: takes text, returns a verdict, touches no filesystem. The resolver does
+ * the reading and the containment checks; this decides whether the content is
+ * usable. Nothing is installed unless this returns `ok`.
+ */
+export declare function validatePack(sources: PackSources): PackValidation;
+//# sourceMappingURL=schema.d.ts.map

package/dist/compliance/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/compliance/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAKV,IAAI,EAIL,MAAM,YAAY,CAAC;AAMpB;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,8DAA8D;AAC9D,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAAS,CAAC;AA6B3C;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,mDAAmD,CAAC;AAgUlF,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,uEAAuE;AACvE,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAExF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CAoHjE"}

package/dist/compliance/schema.js

@@ -0,0 +1,474 @@
+/**
+ * Compliance pack validation.
+ *
+ * The whole pack is validated before any part of it is installed, and every
+ * problem is collected rather than the first one thrown. A pack with one
+ * malformed control installs nothing — a partially installed pack is worse than
+ * an absent one, because it looks like a working install.
+ *
+ * Absence is never a default. Every field named in the schema must be present, so
+ * an omitted `reviewed_by` cannot quietly read as "reviewed", and an omitted
+ * `kind` cannot quietly read as `checked-only`.
+ *
+ * Two bounds exist for one reason: **pack text becomes instructions an agent
+ * executes.** Control text is rendered into a review prompt, and a constraint
+ * layer is copied to disk and read on every phase. Both are bounded in length and
+ * both reject `{{` placeholder syntax, because placeholder resolution runs the
+ * guidance pass before the glossary pass deliberately — so a `{{glossary:...}}`
+ * inside a layer body would expand when inlined. Bounding the input closes that at
+ * the source rather than relying on the delivery mechanism to make it unreachable.
+ *
+ * Requirements: compliance-packs/AC-1, AC-2, AC-3, AC-4, AC-5, AC-7, AC-65, AC-105
+ */
+import { parse as parseYaml } from 'yaml';
+// ---------------------------------------------------------------------------
+// Bounds and vocabularies
+// ---------------------------------------------------------------------------
+/**
+ * Maximum characters in any single control prose field.
+ *
+ * Sized to hold a full regime clause and its fail condition comfortably while
+ * ruling out a smuggled instruction block. The shipped SOC 2 pack's longest field
+ * is well under half of this.
+ */
+export const MAX_CONTROL_FIELD_CHARS = 1000;
+/** Maximum characters across all of a pack's control text. */
+export const MAX_PACK_CONTROL_CHARS = 40_000;
+/** Maximum characters in a single constraint-layer body. */
+export const MAX_LAYER_BODY_CHARS = 20_000;
+/** Maximum characters across all of a pack's constraint-layer bodies. */
+export const MAX_PACK_LAYER_CHARS = 60_000;
+/** Placeholder syntax, rejected anywhere in pack text. */
+const PLACEHOLDER_RE = /\{\{/;
+/** A fenced code block, rejected in control prose. */
+const FENCE_RE = /(^|\n)\s*```/;
+/** Pack and layer slugs: lowercase alphanumeric with interior hyphens. */
+const SLUG_RE = /^[a-z][a-z0-9-]*$/;
+/** A regime control id, e.g. `CC8.1`. Deliberately not regime-specific beyond shape. */
+const CONTROL_ID_RE = /^[A-Z]{1,4}[0-9]+(\.[0-9]+)?$/;
+const CONTROL_KINDS = ['evidenced', 'checked-only'];
+const CHECK_KINDS = ['agent', 'mechanical'];
+const SEVERITIES = ['critical', 'major', 'minor', 'info'];
+const ENTITLEMENTS = ['unrestricted'];
+const EXCLUSION_REASONS = ['organizational', 'not-yet-built'];
+const PHASES = [
+    'ideation',
+    'requirements',
+    'design',
+    'implementation',
+    'testing',
+    'deployment',
+    'maintenance',
+];
+/**
+ * The notice a pack with `reviewed_by: null` must carry in its constraint text.
+ *
+ * Matched case-insensitively as a substring, so a pack may word the surrounding
+ * sentence freely. Held in three places — here, the report generator, and a doctor
+ * check — because a notice that lives only in installed text can be edited away
+ * permanently, since a locally edited layer is preserved forever by design.
+ */
+export const UNREVIEWED_NOTICE = 'not been reviewed by a compliance practitioner';
+// ---------------------------------------------------------------------------
+// Small helpers
+// ---------------------------------------------------------------------------
+/** Accumulates problems so a pack is reported whole rather than first-error-only. */
+class Problems {
+    list = [];
+    add(message) {
+        this.list.push(message);
+    }
+    /** Require a non-empty string at `where`. Returns it, or null having recorded why. */
+    str(value, where) {
+        if (typeof value !== 'string') {
+            this.add(`${where}: expected a string, got ${describe(value)}`);
+            return null;
+        }
+        if (value.trim() === '') {
+            this.add(`${where}: must not be empty`);
+            return null;
+        }
+        return value;
+    }
+    /**
+     * Require one of `allowed`.
+     *
+     * Reports the permitted values even when the field is absent or the wrong type.
+     * "expected a string, got nothing" tells a content author that something is
+     * missing but not what to write there, and the vocabulary is the whole point of
+     * an enumerated field.
+     */
+    oneOf(value, where, allowed) {
+        if (typeof value !== 'string' || value.trim() === '') {
+            this.add(`${where}: expected one of ${allowed.join(', ')}, got ${describe(value)}`);
+            return null;
+        }
+        if (!allowed.includes(value)) {
+            this.add(`${where}: expected one of ${allowed.join(', ')}, got '${value}'`);
+            return null;
+        }
+        return value;
+    }
+    /** Bound a prose field's length and reject smuggled syntax. */
+    prose(value, where, max, opts = {}) {
+        if (value.length > max) {
+            this.add(`${where}: ${value.length} characters exceeds the ${max}-character limit`);
+        }
+        if (PLACEHOLDER_RE.test(value)) {
+            this.add(`${where}: must not contain '{{' placeholder syntax`);
+        }
+        if (!opts.allowFences && FENCE_RE.test(value)) {
+            this.add(`${where}: must not contain a fenced code block`);
+        }
+    }
+}
+/** A short, safe description of an unexpected value — never its contents. */
+function describe(value) {
+    if (value === null)
+        return 'null';
+    if (value === undefined)
+        return 'nothing';
+    if (Array.isArray(value))
+        return 'a list';
+    return typeof value;
+}
+/** Parse YAML, returning null rather than throwing. */
+function parseObject(raw, where, problems) {
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch (err) {
+        problems.add(`${where}: is not valid YAML (${err.message})`);
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        problems.add(`${where}: expected a mapping, got ${describe(parsed)}`);
+        return null;
+    }
+    return parsed;
+}
+// ---------------------------------------------------------------------------
+// Field validators
+// ---------------------------------------------------------------------------
+/** Validate `pack.yaml`. `expectedId` is the directory name it must match. */
+function validateMeta(raw, expectedId, problems) {
+    const where = 'pack.yaml';
+    // Every field is required. `reviewed_by` is checked separately because null is
+    // a legitimate value there and `str` would reject it.
+    const id = problems.str(raw.id, `${where}: id`);
+    const regime = problems.str(raw.regime, `${where}: regime`);
+    const version = problems.str(raw.version, `${where}: version`);
+    const entitlement = problems.oneOf(raw.entitlement, `${where}: entitlement`, ENTITLEMENTS);
+    if (id !== null && !SLUG_RE.test(id)) {
+        problems.add(`${where}: id '${id}' must be a lowercase slug`);
+    }
+    if (id !== null && id !== expectedId) {
+        problems.add(`${where}: id '${id}' does not match the pack directory '${expectedId}'`);
+    }
+    if (!Array.isArray(raw.industries)) {
+        problems.add(`${where}: industries: expected a list, got ${describe(raw.industries)}`);
+    }
+    else if (raw.industries.length === 0) {
+        problems.add(`${where}: industries: must name at least one industry, or ['any']`);
+    }
+    else {
+        for (const [i, value] of raw.industries.entries()) {
+            const s = problems.str(value, `${where}: industries[${i}]`);
+            if (s !== null && !SLUG_RE.test(s)) {
+                problems.add(`${where}: industries[${i}]: '${s}' must be a lowercase slug`);
+            }
+        }
+    }
+    // Absent is not null. An omitted field must not read as an unreviewed draft,
+    // and must not read as a reviewed one either.
+    if (!('reviewed_by' in raw)) {
+        problems.add(`${where}: reviewed_by: required — use null for an unreviewed draft`);
+    }
+    else if (raw.reviewed_by !== null && typeof raw.reviewed_by !== 'string') {
+        problems.add(`${where}: reviewed_by: expected a string or null, got ${describe(raw.reviewed_by)}`);
+    }
+    else if (typeof raw.reviewed_by === 'string' && raw.reviewed_by.trim() === '') {
+        problems.add(`${where}: reviewed_by: use null rather than an empty string`);
+    }
+    if (id === null || regime === null || version === null || entitlement === null)
+        return null;
+    if (!Array.isArray(raw.industries))
+        return null;
+    return {
+        id,
+        regime,
+        version,
+        industries: raw.industries.filter((v) => typeof v === 'string'),
+        entitlement,
+        reviewed_by: (raw.reviewed_by ?? null),
+    };
+}
+/** Validate one control entry. */
+function validateControl(raw, index, problems) {
+    const where = `controls.yaml: controls[${index}]`;
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        problems.add(`${where}: expected a mapping, got ${describe(raw)}`);
+        return null;
+    }
+    const r = raw;
+    const id = problems.str(r.id, `${where}: id`);
+    const label = id === null ? where : `controls.yaml: control ${id}`;
+    if (id !== null && !CONTROL_ID_RE.test(id)) {
+        problems.add(`${label}: id '${id}' is not a control id (expected e.g. CC8.1)`);
+    }
+    const kind = problems.oneOf(r.kind, `${label}: kind`, CONTROL_KINDS);
+    const checkKind = problems.oneOf(r.check_kind, `${label}: check_kind`, CHECK_KINDS);
+    const severity = problems.oneOf(r.severity, `${label}: severity`, SEVERITIES);
+    const requires = problems.str(r.requires, `${label}: requires`);
+    const lookAt = problems.str(r.look_at, `${label}: look_at`);
+    const failsWhen = problems.str(r.fails_when, `${label}: fails_when`);
+    for (const [value, field] of [
+        [requires, 'requires'],
+        [lookAt, 'look_at'],
+        [failsWhen, 'fails_when'],
+    ]) {
+        if (value !== null)
+            problems.prose(value, `${label}: ${field}`, MAX_CONTROL_FIELD_CHARS);
+    }
+    if (!Array.isArray(r.phases)) {
+        problems.add(`${label}: phases: expected a list, got ${describe(r.phases)}`);
+    }
+    else if (r.phases.length === 0) {
+        problems.add(`${label}: phases: must name at least one lifecycle phase`);
+    }
+    else {
+        for (const [i, value] of r.phases.entries()) {
+            problems.oneOf(value, `${label}: phases[${i}]`, PHASES);
+        }
+    }
+    // The evidence rule, and the reason it is a rule: a checked-only control has no
+    // evidence, so letting it name an artifact is how a check becomes an attestation.
+    if (kind === 'evidenced') {
+        const artifact = problems.str(r.evidence_artifact, `${label}: evidence_artifact`);
+        if (artifact !== null) {
+            problems.prose(artifact, `${label}: evidence_artifact`, MAX_CONTROL_FIELD_CHARS);
+        }
+    }
+    else if (kind === 'checked-only' && r.evidence_artifact !== undefined) {
+        problems.add(`${label}: evidence_artifact is not allowed on a checked-only control — ` +
+            `the lifecycle trail evidences that the check ran, never that the control operates`);
+    }
+    // A mechanical control must carry something the check can actually apply.
+    if (checkKind === 'mechanical') {
+        const pattern = problems.str(r.pattern, `${label}: pattern`);
+        if (pattern !== null) {
+            try {
+                new RegExp(pattern);
+            }
+            catch (err) {
+                problems.add(`${label}: pattern is not a valid regular expression (${err.message})`);
+            }
+        }
+    }
+    else if (checkKind === 'agent' && r.pattern !== undefined) {
+        problems.add(`${label}: pattern is only meaningful on a mechanical control`);
+    }
+    if (r.references !== undefined) {
+        const references = problems.str(r.references, `${label}: references`);
+        if (references !== null) {
+            problems.prose(references, `${label}: references`, MAX_CONTROL_FIELD_CHARS);
+        }
+    }
+    if (id === null ||
+        kind === null ||
+        checkKind === null ||
+        severity === null ||
+        requires === null ||
+        lookAt === null ||
+        failsWhen === null ||
+        !Array.isArray(r.phases)) {
+        return null;
+    }
+    return {
+        id,
+        kind,
+        check_kind: checkKind,
+        phases: r.phases.filter((p) => PHASES.includes(p)),
+        requires,
+        look_at: lookAt,
+        fails_when: failsWhen,
+        severity,
+        ...(typeof r.pattern === 'string' && { pattern: r.pattern }),
+        ...(typeof r.evidence_artifact === 'string' && { evidence_artifact: r.evidence_artifact }),
+        ...(typeof r.references === 'string' && { references: r.references }),
+    };
+}
+/** Validate one exclusion entry. */
+function validateExclusion(raw, index, problems) {
+    const where = `controls.yaml: excluded[${index}]`;
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        problems.add(`${where}: expected a mapping, got ${describe(raw)}`);
+        return null;
+    }
+    const r = raw;
+    const id = problems.str(r.id, `${where}: id`);
+    if (id !== null && !CONTROL_ID_RE.test(id)) {
+        problems.add(`${where}: id '${id}' is not a control id (expected e.g. CC1.1)`);
+    }
+    const reason = problems.oneOf(r.reason, `${where}: reason`, EXCLUSION_REASONS);
+    if (r.note !== undefined) {
+        const note = problems.str(r.note, `${where}: note`);
+        if (note !== null)
+            problems.prose(note, `${where}: note`, MAX_CONTROL_FIELD_CHARS);
+    }
+    if (id === null || reason === null)
+        return null;
+    return { id, reason, ...(typeof r.note === 'string' && { note: r.note }) };
+}
+/** Validate one layer registration from `pack.yaml`. */
+function validateLayer(raw, index, problems) {
+    const where = `pack.yaml: layers[${index}]`;
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        problems.add(`${where}: expected a mapping, got ${describe(raw)}`);
+        return null;
+    }
+    const r = raw;
+    const name = problems.str(r.name, `${where}: name`);
+    const file = problems.str(r.file, `${where}: file`);
+    if (name !== null && !SLUG_RE.test(name)) {
+        problems.add(`${where}: name '${name}' must be a lowercase slug`);
+    }
+    // Containment is checked by the loader against real directories, using the one
+    // exported `isContainedRelative`. Here we only reject shapes that can never be
+    // valid, so a bad registration fails before any path is built from it.
+    //
+    // The rejected value is deliberately NOT echoed: it is untrusted data that may
+    // be an absolute path, and every message this module emits has to stay free of
+    // them (AC-7). The field label is enough to locate the problem.
+    const containable = file !== null && !file.startsWith('/') && !file.includes('..');
+    if (file !== null && !containable) {
+        problems.add(`${where}: file must be a relative name inside the pack, with no '..' segment`);
+    }
+    // Declared rather than inferred: pack layers are delivered by pointer whatever
+    // their size, so a small layer cannot be inlined into an emitted skill.
+    if (r.always_pointer !== true) {
+        problems.add(`${where}: always_pointer must be true — pack layers are never inlined`);
+    }
+    // An out-of-bounds registration yields no layer at all. Returning one anyway
+    // would carry the bad name into the body check, whose message names the file —
+    // which is how an absolute path reached an error message.
+    if (name === null || file === null || !containable)
+        return null;
+    return { name, file, always_pointer: true };
+}
+/**
+ * Validate a whole pack from its raw sources.
+ *
+ * Pure: takes text, returns a verdict, touches no filesystem. The resolver does
+ * the reading and the containment checks; this decides whether the content is
+ * usable. Nothing is installed unless this returns `ok`.
+ */
+export function validatePack(sources) {
+    const problems = new Problems();
+    const metaRaw = parseObject(sources.packYaml, 'pack.yaml', problems);
+    const controlsRaw = parseObject(sources.controlsYaml, 'controls.yaml', problems);
+    const meta = metaRaw ? validateMeta(metaRaw, sources.id, problems) : null;
+    // Layers
+    const layers = [];
+    if (metaRaw) {
+        if (!Array.isArray(metaRaw.layers)) {
+            problems.add(`pack.yaml: layers: expected a list, got ${describe(metaRaw.layers)}`);
+        }
+        else if (metaRaw.layers.length === 0) {
+            problems.add('pack.yaml: layers: a pack must register at least one constraint layer');
+        }
+        else {
+            for (const [i, raw] of metaRaw.layers.entries()) {
+                const layer = validateLayer(raw, i, problems);
+                if (layer)
+                    layers.push(layer);
+            }
+        }
+    }
+    // Controls
+    const controls = [];
+    const exclusions = [];
+    if (controlsRaw) {
+        if (!Array.isArray(controlsRaw.controls)) {
+            problems.add(`controls.yaml: controls: expected a list, got ${describe(controlsRaw.controls)}`);
+        }
+        else if (controlsRaw.controls.length === 0) {
+            problems.add('controls.yaml: controls: a pack must declare at least one control');
+        }
+        else {
+            for (const [i, raw] of controlsRaw.controls.entries()) {
+                const control = validateControl(raw, i, problems);
+                if (control)
+                    controls.push(control);
+            }
+        }
+        if (!Array.isArray(controlsRaw.excluded)) {
+            problems.add(`controls.yaml: excluded: expected a list, got ${describe(controlsRaw.excluded)}`);
+        }
+        else {
+            for (const [i, raw] of controlsRaw.excluded.entries()) {
+                const exclusion = validateExclusion(raw, i, problems);
+                if (exclusion)
+                    exclusions.push(exclusion);
+            }
+        }
+    }
+    // A control id must not be both covered and excluded — that is a claim and its
+    // retraction in one file, and whichever a reader trusts is a coin flip.
+    const controlIds = new Set(controls.map((c) => c.id));
+    for (const exclusion of exclusions) {
+        if (controlIds.has(exclusion.id)) {
+            problems.add(`controls.yaml: ${exclusion.id} is both covered and excluded`);
+        }
+    }
+    for (const [ids, label] of [
+        [controls.map((c) => c.id), 'controls'],
+        [exclusions.map((e) => e.id), 'excluded'],
+    ]) {
+        const seen = new Set();
+        for (const id of ids) {
+            if (seen.has(id))
+                problems.add(`controls.yaml: ${label}: ${id} appears more than once`);
+            seen.add(id);
+        }
+    }
+    // Layer bodies: bounded, placeholder-free, and — when the pack is an unreviewed
+    // draft — carrying the notice. Fenced blocks are allowed in a layer body, which
+    // is prose an agent reads, but placeholders are not.
+    let totalLayerChars = 0;
+    let noticeFound = false;
+    for (const layer of layers) {
+        const body = sources.layerBodies.get(layer.file);
+        if (body === undefined) {
+            problems.add(`pack.yaml: layer '${layer.name}' registers ${layer.file}, which is missing`);
+            continue;
+        }
+        totalLayerChars += body.length;
+        problems.prose(body, `${layer.file}`, MAX_LAYER_BODY_CHARS, { allowFences: true });
+        if (body.toLowerCase().includes(UNREVIEWED_NOTICE))
+            noticeFound = true;
+    }
+    if (totalLayerChars > MAX_PACK_LAYER_CHARS) {
+        problems.add(`pack layer bodies total ${totalLayerChars} characters, exceeding the ${MAX_PACK_LAYER_CHARS}-character limit`);
+    }
+    const totalControlChars = controls.reduce((sum, c) => sum + c.requires.length + c.look_at.length + c.fails_when.length, 0);
+    if (totalControlChars > MAX_PACK_CONTROL_CHARS) {
+        problems.add(`pack control text totals ${totalControlChars} characters, exceeding the ${MAX_PACK_CONTROL_CHARS}-character limit`);
+    }
+    // The first of the notice's three enforcement points. The other two are the
+    // report generator, which emits it from code, and a doctor check for the case
+    // where someone edits it out of an installed layer.
+    if (meta && meta.reviewed_by === null && layers.length > 0 && !noticeFound) {
+        problems.add(`pack.yaml: reviewed_by is null, so a constraint layer must state that the control text has ` +
+            `'${UNREVIEWED_NOTICE}'`);
+    }
+    if (problems.list.length > 0 || meta === null) {
+        return {
+            ok: false,
+            errors: problems.list.length > 0 ? problems.list : ['pack.yaml: could not be validated'],
+        };
+    }
+    return { ok: true, pack: { meta, controls, exclusions, layers } };
+}
+//# sourceMappingURL=schema.js.map

package/dist/compliance/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/compliance/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAc1C,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,sDAAsD;AACtD,MAAM,QAAQ,GAAG,cAAc,CAAC;AAEhC,0EAA0E;AAC1E,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC,wFAAwF;AACxF,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAEtD,MAAM,aAAa,GAA2B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AAC5E,MAAM,WAAW,GAAgC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACzE,MAAM,UAAU,GAA+B,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACtF,MAAM,YAAY,GAA+B,CAAC,cAAc,CAAC,CAAC;AAClE,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAU,CAAC;AACvE,MAAM,MAAM,GAAyB;IACnC,UAAU;IACV,cAAc;IACd,QAAQ;IACR,gBAAgB;IAChB,SAAS;IACT,YAAY;IACZ,aAAa;CACd,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gDAAgD,CAAC;AAElF,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,qFAAqF;AACrF,MAAM,QAAQ;IACH,IAAI,GAAa,EAAE,CAAC;IAE7B,GAAG,CAAC,OAAe;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,sFAAsF;IACtF,GAAG,CAAC,KAAc,EAAE,KAAa;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,4BAA4B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAmB,KAAc,EAAE,KAAa,EAAE,OAAqB;QAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAU,CAAC;IACpB,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,KAAa,EAAE,KAAa,EAAE,GAAW,EAAE,OAAkC,EAAE;QACnF,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,4CAA4C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CACF;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAS,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,QAAkB;IACjE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,wBAAyB,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,6BAA6B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS,YAAY,CACnB,GAA4B,EAC5B,UAAkB,EAClB,QAAkB;IAElB,MAAM,KAAK,GAAG,WAAW,CAAC;IAE1B,+EAA+E;IAC/E,sDAAsD;IACtD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,KAAK,eAAe,EAAE,YAAY,CAAC,CAAC;IAE3F,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,4BAA4B,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,wCAAwC,UAAU,GAAG,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,sCAAsC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,gBAAgB,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,8CAA8C;IAC9C,IAAI,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,4DAA4D,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC3E,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,iDAAiD,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChF,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,qDAAqD,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,OAAO;QACL,EAAE;QACF,MAAM;QACN,OAAO;QACP,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC5E,WAAW;QACX,WAAW,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAkB;KACxD,CAAC;AACJ,CAAC;AAED,kCAAkC;AAClC,SAAS,eAAe,CAAC,GAAY,EAAE,KAAa,EAAE,QAAkB;IACtE,MAAM,KAAK,GAAG,2BAA2B,KAAK,GAAG,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,6BAA6B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B,EAAE,EAAE,CAAC;IAEnE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,6CAA6C,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,aAAa,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,KAAK,cAAc,EAAE,WAAW,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,KAAK,YAAY,EAAE,UAAU,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC;IAErE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,QAAQ,EAAE,UAAU,CAAC;QACtB,CAAC,MAAM,EAAE,SAAS,CAAC;QACnB,CAAC,SAAS,EAAE,YAAY,CAAC;KACjB,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,IAAI;YAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,KAAK,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,kCAAkC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;SAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,kFAAkF;IAClF,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAClF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxE,QAAQ,CAAC,GAAG,CACV,GAAG,KAAK,iEAAiE;YACvE,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,gDAAiD,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5D,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC;QACtE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,cAAc,EAAE,uBAAuB,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IACE,EAAE,KAAK,IAAI;QACX,IAAI,KAAK,IAAI;QACb,SAAS,KAAK,IAAI;QAClB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,IAAI;QACjB,MAAM,KAAK,IAAI;QACf,SAAS,KAAK,IAAI;QAClB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,EAAE;QACF,IAAI;QACJ,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAE,MAA4B,CAAC,QAAQ,CAAC,CAAW,CAAC,CAAC;QACnG,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,SAAS;QACrB,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;QAC1F,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,oCAAoC;AACpC,SAAS,iBAAiB,CAAC,GAAY,EAAE,KAAa,EAAE,QAAkB;IACxE,MAAM,KAAK,GAAG,2BAA2B,KAAK,GAAG,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,6BAA6B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;IAC9C,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,6CAA6C,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAE/E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;QACpD,IAAI,IAAI,KAAK,IAAI;YAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,wDAAwD;AACxD,SAAS,aAAa,CAAC,GAAY,EAAE,KAAa,EAAE,QAAkB;IACpE,MAAM,KAAK,GAAG,qBAAqB,KAAK,GAAG,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,6BAA6B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;IAEpD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACpE,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,EAAE;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,gEAAgE;IAChE,MAAM,WAAW,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnF,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,sEAAsE,CAAC,CAAC;IAC/F,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,+DAA+D,CAAC,CAAC;IACxF,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,0DAA0D;IAC1D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAoB;IAC/C,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;IAEjF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,SAAS;IACT,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,GAAG,CAAC,2CAA2C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC9C,IAAI,KAAK;oBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,WAAW;IACX,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,iDAAiD,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;aAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;QACpF,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAClD,IAAI,OAAO;oBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,iDAAiD,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtD,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACtD,IAAI,SAAS;oBAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,SAAS,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;QACzB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;QACvC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;KACjC,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,KAAK,KAAK,EAAE,yBAAyB,CAAC,CAAC;YACxF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,qDAAqD;IACrD,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,IAAI,oBAAoB,CAAC,CAAC;YAC3F,SAAS;QACX,CAAC;QACD,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,WAAW,GAAG,IAAI,CAAC;IACzE,CAAC;IACD,IAAI,eAAe,GAAG,oBAAoB,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,CACV,2BAA2B,eAAe,8BAA8B,oBAAoB,kBAAkB,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CACvC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAC5E,CAAC,CACF,CAAC;IACF,IAAI,iBAAiB,GAAG,sBAAsB,EAAE,CAAC;QAC/C,QAAQ,CAAC,GAAG,CACV,4BAA4B,iBAAiB,8BAA8B,sBAAsB,kBAAkB,CACpH,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,oDAAoD;IACpD,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3E,QAAQ,CAAC,GAAG,CACV,6FAA6F;YAC3F,IAAI,iBAAiB,GAAG,CAC3B,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC;SACzF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;AACpE,CAAC"}