@xenos1996/usa 2.0.0

package/dist/engine/evaluate.js

@@ -0,0 +1,377 @@
+import { execFileSync } from 'node:child_process';
+import { DEFAULT_WEIGHT } from './loader.js';
+/* ------------------------------------------------------------ applicability */
+export function evalPredicate(p, facts) {
+    if (!p)
+        return true;
+    // Programmatic callers can hand us anything (the loader validates
+    // file-loaded packs and warns). Malformed applicability fails closed —
+    // a rule no one can parse must not silently apply to every repo.
+    if (typeof p !== 'object')
+        return false;
+    if (Object.keys(p).length === 0)
+        return true;
+    return evalPredicateKeys(p, facts);
+}
+function evalPredicateKeys(p, facts) {
+    if ('all' in p && Array.isArray(p.all))
+        return p.all.every((x) => evalPredicate(x, facts));
+    if ('any' in p && Array.isArray(p.any))
+        return p.any.some((x) => evalPredicate(x, facts));
+    if ('not' in p && p.not)
+        return !evalPredicate(p.not, facts);
+    if ('fact' in p && typeof p.fact === 'string')
+        return evalFact(p, facts);
+    return false;
+}
+/** One predicate operator per entry — adding an operator means adding a line. */
+const OP_HANDLERS = {
+    absent: (o) => (o.isMetric ? o.metric === undefined : !o.present),
+    exists: (o) => (o.isMetric ? o.metric !== undefined : o.present),
+    eq: (o) => (o.isMetric ? o.metric === Number(o.value) : o.present === Boolean(o.value)),
+    neq: (o) => (o.isMetric ? o.metric !== Number(o.value) : o.present !== Boolean(o.value)),
+    in: (o) => {
+        // Membership only means something for metric facts (numbers). Flag facts
+        // are presence-only — there is no value to test membership against.
+        if (!o.isMetric || !Array.isArray(o.value))
+            return false;
+        return o.value.some((v) => v === o.metric || String(v) === String(o.metric ?? ''));
+    },
+    includes: (o) => {
+        // Same contract as `in`: the metric value must appear in the listed
+        // values. Presence alone never satisfies a value comparison.
+        if (!o.isMetric || !Array.isArray(o.value))
+            return false;
+        return o.value.some((v) => v === o.metric || String(v) === String(o.metric ?? ''));
+    },
+    gt: (o) => typeof o.metric === 'number' && o.metric > Number(o.value ?? 0),
+    lt: (o) => typeof o.metric === 'number' && o.metric < Number(o.value ?? 0),
+    matches: (o) => {
+        if (typeof o.value !== 'string')
+            return false;
+        try {
+            return new RegExp(o.value).test(String(o.metric ?? ''));
+        }
+        catch {
+            // Invalid regex fails closed; the loader warns at pack load time.
+            return false;
+        }
+    },
+};
+function evalFact(p, facts) {
+    const { fact, op = 'exists', value } = p;
+    const isMetric = fact.startsWith('metric:');
+    const key = isMetric ? fact.slice('metric:'.length) : fact;
+    // Unknown operators fail closed (rule skipped), never silently applied.
+    // The loader warns at pack load time; this is the programmatic-API backstop.
+    const handler = OP_HANDLERS[op] ?? (() => false);
+    return handler({
+        isMetric,
+        present: facts.flags.has(fact),
+        metric: facts.metrics[key],
+        value,
+    });
+}
+export function ruleApplies(rule, facts, depth, includeAll = false) {
+    // Forced packs apply wholesale — that is the documented contract of
+    // `include` ("always load, even if appliesWhen says no"). Depth *and*
+    // applicability are both bypassed when the operator forces a pack on.
+    if (includeAll)
+        return true;
+    if (rule.depths && rule.depths.length > 0 && !rule.depths.includes(depth)) {
+        return false;
+    }
+    return evalPredicate(rule.appliesWhen, facts);
+}
+export function packApplies(pack, facts) {
+    return evalPredicate(pack.skipWhen ? { not: pack.skipWhen } : undefined, facts);
+}
+/* -------------------------------------------------------------- evaluation */
+export function evaluateRule(rule, ctx) {
+    const base = {
+        ruleId: rule.id,
+        title: rule.title,
+        section: rule.section,
+        sectionTitle: rule.sectionTitle ?? rule.section,
+        baseSeverity: rule.severity,
+        ruleClass: rule.ruleClass,
+        why: rule.why,
+        evidenceHint: rule.evidence,
+        remediation: rule.remediation,
+        references: rule.references,
+    };
+    if (ctx.disabled.has(rule.id)) {
+        return {
+            ...base,
+            status: 'NOT_APPLICABLE',
+            severity: rule.severity,
+            dampened: false,
+            message: 'Disabled by project configuration.',
+            locations: [],
+        };
+    }
+    const suppressed = ctx.suppressions.get(rule.id);
+    const { status, message, locations } = runCheck(rule, ctx, rule.check);
+    const finding = {
+        ...base,
+        status,
+        severity: rule.severity,
+        dampened: false,
+        message,
+        locations,
+    };
+    if (suppressed && status !== 'PASS' && status !== 'NOT_APPLICABLE') {
+        finding.suppressedReason = suppressed;
+    }
+    return finding;
+}
+function missingOutcome(detail) {
+    return { status: 'MISSING', message: `Not detected — ${detail}.`, locations: [] };
+}
+function passOutcome(detail, locations = []) {
+    return { status: 'PASS', message: `Verified — ${detail}.`, locations };
+}
+function unknownOutcome(message) {
+    return { status: 'UNKNOWN', message, locations: [] };
+}
+function queryGrep(project, check) {
+    return project.grep(check.pattern, check.include, check.exclude ?? [], check.flags ?? '');
+}
+function checkManual(_check, _h) {
+    return unknownOutcome('Requires judgement — no automated evidence recorded.');
+}
+function checkInfo(_check, _h) {
+    return { status: 'NOT_APPLICABLE', message: 'Context only.', locations: [] };
+}
+function checkFileExists(check, h) {
+    const found = check.files.flatMap((f) => h.project.glob([f]));
+    if (found.length === 0)
+        return h.missing(`none of [${check.files.join(', ')}] found`);
+    return h.pass(`found ${found.slice(0, 5).join(', ')}`, found.slice(0, 5).map(toLocation));
+}
+function checkFileAbsent(check, h) {
+    const found = check.files.flatMap((f) => h.project.glob([f]));
+    if (found.length === 0)
+        return h.pass(`none of [${check.files.join(', ')}] present`);
+    return {
+        status: 'FAIL',
+        message: `${found.length} forbidden path(s) present: ${found.slice(0, 5).join(', ')}.`,
+        locations: found.slice(0, 5).map(toLocation),
+    };
+}
+function checkAnyFile(check, h) {
+    const found = h.project.glob(check.patterns);
+    if (found.length === 0)
+        return h.missing(`no files matching ${check.patterns.join(', ')}`);
+    return h.pass(`${found.length} file(s) matching ${check.patterns.join(', ')}`, found.slice(0, 5).map(toLocation));
+}
+function checkGrepPresent(check, h) {
+    const hits = queryGrep(h.project, check);
+    if (hits.length === 0)
+        return h.missing(`pattern not found in ${check.include.join(', ')}`);
+    return h.pass(`${hits.length} match(es)`, toLocations(hits));
+}
+function checkGrepAbsent(check, h) {
+    const hits = queryGrep(h.project, check);
+    if (hits.length === 0)
+        return h.pass(`no matches in ${check.include.join(', ')}`);
+    return {
+        status: 'FAIL',
+        message: `${hits.length} occurrence(s)${describedBy(hits)}`,
+        locations: toLocations(hits),
+    };
+}
+function checkGrepWrong(check, h) {
+    const hits = queryGrep(h.project, check);
+    if (hits.length === 0)
+        return h.pass(`no incorrect usage of \`${trimPattern(check.pattern)}\``);
+    return {
+        status: 'WRONG',
+        message: `${hits.length} instance(s) of an incorrect implementation${describedBy(hits)}`,
+        locations: toLocations(hits),
+    };
+}
+function checkGrepDeprecated(check, h) {
+    const hits = queryGrep(h.project, check);
+    if (hits.length === 0)
+        return h.pass('no deprecated usage detected');
+    return {
+        status: 'DEPRECATED',
+        message: `${hits.length} deprecated usage(s) detected.`,
+        locations: toLocations(hits),
+    };
+}
+function checkFileLinesMax(check, h) {
+    const offenders = [];
+    for (const file of h.project.glob(check.patterns)) {
+        const text = h.project.read(file);
+        if (text === null)
+            continue;
+        const lines = text.split('\n').length;
+        if (lines > check.max_lines)
+            offenders.push({ file, excerpt: `${lines} lines` });
+    }
+    if (offenders.length === 0) {
+        return h.pass(`no file over ${check.max_lines} lines`);
+    }
+    // A god object is a violation (FAIL, 0 credit), not a partial
+    // implementation: WRONG would award 0.15 credit for failing modularity.
+    return {
+        status: 'FAIL',
+        message: `${offenders.length} file(s) exceed ${check.max_lines} lines — likely god objects.`,
+        locations: offenders.slice(0, 8),
+    };
+}
+function checkTrackedPresent(check, h) {
+    const found = h.project.trackedGlob(check.patterns);
+    if (found.length === 0)
+        return h.missing(`nothing matching ${check.patterns.join(', ')} is tracked by git`);
+    return h.pass(`${found.length} tracked file(s)`, found.slice(0, 5).map(toLocation));
+}
+function checkTrackedAbsent(check, h) {
+    const found = h.project.trackedGlob(check.patterns);
+    if (found.length === 0)
+        return h.pass(`no tracked files matching ${check.patterns.join(', ')}`);
+    return {
+        status: 'FAIL',
+        message: `${found.length} tracked file(s) should not be committed: ${found.slice(0, 5).join(', ')}.`,
+        locations: found.slice(0, 5).map(toLocation),
+    };
+}
+function checkJsonPath(check, h) {
+    const files = h.project.glob([check.file]);
+    if (files.length === 0)
+        return h.missing(`${check.file} not found`);
+    const json = h.project.readJson(files[0]);
+    if (json === null)
+        return h.missing(`${check.file} unreadable`);
+    const value = resolvePath(json, check.path);
+    if (value === undefined)
+        return h.missing(`\`${check.path}\` not set in ${check.file}`);
+    if (check.equals !== undefined && value !== check.equals) {
+        return {
+            status: 'WRONG',
+            message: `\`${check.path}\` is ${JSON.stringify(value)}, expected ${JSON.stringify(check.equals)}.`,
+            locations: [toLocation(files[0])],
+        };
+    }
+    return h.pass(`\`${check.path}\` is ${JSON.stringify(value)}`, [toLocation(files[0])]);
+}
+function checkCountMin(check, h) {
+    const n = h.project.count(check.patterns);
+    if (n >= check.min)
+        return h.pass(`${n} file(s), threshold ${check.min}`);
+    // Below threshold means required files are absent — MISSING, not FAIL.
+    // FAIL is a violated condition; MISSING is an absent one (see types.ts).
+    return h.missing(`Found ${n} file(s) matching ${check.patterns.join(', ')} — expected at least ${check.min}.`);
+}
+function runShellCheck(project, run, expected, pass) {
+    try {
+        // NOTE: pack-supplied shell runs synchronously in the audit loop with a
+        // 60 s timeout and a 10 MB output cap. Pack authors get arbitrary shell
+        // by design (opt-in via --allow-commands, UNKNOWN otherwise) — review
+        // third-party packs like production dependencies before enabling.
+        const out = execFileSync('sh', ['-c', run], {
+            cwd: project.root,
+            encoding: 'utf8',
+            timeout: 60_000,
+            maxBuffer: 10 * 1024 * 1024,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim();
+        if (expected === 0) {
+            return pass(`\`${run}\` succeeded${out ? `: ${truncate(out.replace(/\s+/g, ' '), 160)}` : ''}`);
+        }
+        return {
+            status: 'FAIL',
+            message: `\`${run}\` exited 0 but ${expected} was expected.`,
+            locations: [],
+        };
+    }
+    catch (err) {
+        if (expected !== 0)
+            return pass(`\`${run}\` exited non-zero as expected`);
+        const detail = err instanceof Error ? truncate(err.message.replace(/\s+/g, ' '), 200) : '';
+        return {
+            status: 'FAIL',
+            message: `\`${run}\` failed${detail ? `: ${detail}` : ''}.`,
+            locations: [],
+        };
+    }
+}
+function checkCommand(check, h) {
+    if (!h.allowCommands) {
+        return unknownOutcome('Shell check skipped (enable with --allow-commands).');
+    }
+    return runShellCheck(h.project, check.run, check.expect_exit ?? 0, h.pass);
+}
+/** One check kind per entry — adding a kind means adding a line, not a branch. */
+const CHECK_HANDLERS = {
+    manual: checkManual,
+    info: checkInfo,
+    file_exists: checkFileExists,
+    file_absent: checkFileAbsent,
+    any_file: checkAnyFile,
+    grep_present: checkGrepPresent,
+    grep_absent: checkGrepAbsent,
+    grep_wrong: checkGrepWrong,
+    grep_deprecated: checkGrepDeprecated,
+    file_lines_max: checkFileLinesMax,
+    tracked_present: checkTrackedPresent,
+    tracked_absent: checkTrackedAbsent,
+    json_path: checkJsonPath,
+    count_min: checkCountMin,
+    command: checkCommand,
+};
+function runCheck(_rule, ctx, check) {
+    const h = {
+        project: ctx.project,
+        allowCommands: ctx.allowCommands,
+        missing: missingOutcome,
+        pass: passOutcome,
+    };
+    const handler = CHECK_HANDLERS[check.kind];
+    return handler(check, h);
+}
+/* ----------------------------------------------------------------- helpers */
+function toLocation(file) {
+    return { file };
+}
+function toLocations(hits) {
+    return hits.slice(0, 8).map((h) => ({ file: h.file, line: h.line, excerpt: h.excerpt }));
+}
+/**
+ * "…: `api_key: '...'` at src/config.js:3" — the line that actually tripped
+ * the rule, not the regex. A report that quotes its own pattern tells the
+ * reader nothing they can act on.
+ */
+function describedBy(hits) {
+    const first = hits[0];
+    if (!first)
+        return '.';
+    const excerpt = truncate(first.excerpt.trim(), 80);
+    const more = hits.length > 1 ? ` (+${hits.length - 1} more)` : '';
+    return `: \`${excerpt}\` at ${first.file}:${first.line}${more}.`;
+}
+function truncate(s, n) {
+    return s.length <= n ? s : `${s.slice(0, n - 1)}…`;
+}
+function trimPattern(p) {
+    return p.length <= 70 ? p : `${p.slice(0, 69)}…`;
+}
+export function resolvePath(obj, dotted) {
+    let cur = obj;
+    for (const key of dotted.split('.')) {
+        if (cur === null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[key];
+    }
+    return cur;
+}
+/** Effective weight of a rule: explicit override, else the severity default. */
+export function ruleWeight(rule) {
+    return rule.weight ?? DEFAULT_WEIGHT[rule.severity];
+}
+export function severityRank(s) {
+    return { FUTURE: 0, LOW: 1, MEDIUM: 2, HIGH: 3, CRITICAL: 4 }[s];
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/engine/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/engine/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAclD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAW7C,gFAAgF;AAEhF,MAAM,UAAU,aAAa,CAAC,CAAwB,EAAE,KAAY;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,kEAAkE;IAClE,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAY,EAAE,KAAY;IACnD,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1F,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AASD,iFAAiF;AACjF,MAAM,WAAW,GAAiD;IAChE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvF,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxF,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;QACR,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,oEAAoE;QACpE,6DAA6D;QAC7D,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1E,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACb,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAuC,EAAE,KAAY;IACrE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC;QACb,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1B,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAU,EAAE,KAAY,EAAE,KAAY,EAAE,UAAU,GAAG,KAAK;IACpF,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,KAAY;IACtD,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,YAAY,CAAC,IAAU,EAAE,GAAgB;IACvD,MAAM,IAAI,GAAgF;QACxF,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO;QAC/C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;IAEF,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,oCAAoC;YAC7C,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAY;QACvB,GAAG,IAAI;QACP,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,KAAK;QACf,OAAO;QACP,SAAS;KACV,CAAC;IAEF,IAAI,UAAU,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACnE,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,MAAM,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,YAAwB,EAAE;IAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,MAAM,GAAG,EAAE,SAAS,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACvD,CAAC;AAOD,SAAS,SAAS,CAAC,OAAgB,EAAE,KAAgB;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,WAAW,CAAC,MAA0C,EAAE,EAAgB;IAC/E,OAAO,cAAc,CAAC,sDAAsD,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,MAAwC,EAAE,EAAgB;IAC3E,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,eAAe,CACtB,KAA8C,EAC9C,CAAe;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CACtB,KAA8C,EAC9C,CAAe;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrF,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,+BAA+B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACtF,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAA2C,EAAE,CAAe;IAChF,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,KAAK,CAAC,MAAM,qBAAqB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC/D,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAA+C,EAC/C,CAAe;IAEf,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,wBAAwB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CACtB,KAA8C,EAC9C,CAAe;IAEf,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,iBAAiB,WAAW,CAAC,IAAI,CAAC,EAAE;QAC3D,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,KAA6C,EAC7C,CAAe;IAEf,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,2BAA2B,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,8CAA8C,WAAW,CAAC,IAAI,CAAC,EAAE;QACxF,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAkD,EAClD,CAAe;IAEf,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACrE,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,gCAAgC;QACvD,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAiD,EACjD,CAAe;IAEf,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,SAAS,QAAQ,CAAC,CAAC;IACzD,CAAC;IACD,8DAA8D;IAC9D,wEAAwE;IACxE,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,mBAAmB,KAAK,CAAC,SAAS,8BAA8B;QAC5F,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAkD,EAClD,CAAe;IAEf,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,CAAC,OAAO,CAAC,oBAAoB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAiD,EACjD,CAAe;IAEf,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,6CAA6C,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACpG,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAA4C,EAC5C,CAAe;IAEf,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,iBAAiB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACzD,OAAO;YACL,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,KAAK,KAAK,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;YACnG,SAAS,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;SACnC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,aAAa,CACpB,KAA4C,EAC5C,CAAe;IAEf,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,OAAO,CAAC,CAAC,OAAO,CACd,SAAS,CAAC,qBAAqB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,GAAG,GAAG,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAgB,EAChB,GAAW,EACX,QAAgB,EAChB,IAA0B;IAE1B,IAAI,CAAC;QACH,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;YAC1C,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CACT,KAAK,GAAG,eAAe,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,GAAG,mBAAmB,QAAQ,gBAAgB;YAC5D,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,GAAG,YAAY,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;YAC3D,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAA0C,EAAE,CAAe;IAC/E,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,cAAc,CAAC,qDAAqD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,MAAM,cAAc,GAEhB;IACF,MAAM,EAAE,WAAW;IACnB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,eAAe;IAC5B,WAAW,EAAE,eAAe;IAC5B,QAAQ,EAAE,YAAY;IACtB,YAAY,EAAE,gBAAgB;IAC9B,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;IAC1B,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,iBAAiB;IACjC,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,kBAAkB;IAClC,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,aAAa;IACxB,OAAO,EAAE,YAAY;CACtB,CAAC;AAEF,SAAS,QAAQ,CACf,KAAW,EACX,GAAgB,EAChB,KAAY;IAEZ,MAAM,CAAC,GAAiB;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,WAAW;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAoD,CAAC;IAC9F,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAE/E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAuD;IAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAuD;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,OAAO,OAAO,OAAO,SAAS,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,MAAc;IACtD,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9D,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/engine/gate.d.ts

@@ -0,0 +1,19 @@
+import type { AuditReport, Finding, Severity } from '../types.js';
+/**
+ * Findings that should block a build: anything at or above `threshold` that is
+ * neither passing, unverified, nor explicitly accepted by project policy.
+ *
+ * Suppressed findings never block — that is the entire point of recording an
+ * accepted risk in `.usa.yaml`. UNKNOWN never blocks either: "needs a human"
+ * is not "failed", and gating on it would make every manual rule a CI failure.
+ */
+export declare function blockingFindings(report: AuditReport, threshold: Severity): Finding[];
+/**
+ * `--fail-on` gate. Returns a process exit code.
+ *
+ * The ladder is ascending (`FUTURE` … `CRITICAL`), so "at or above" means
+ * *higher* index. Getting this backwards makes `--fail-on critical` fail on
+ * every finding in the report, which is a memorable way to lose a CI pipeline.
+ */
+export declare function evaluateGate(report: AuditReport, failOn: string, quiet: boolean): number;
+//# sourceMappingURL=gate.d.ts.map

package/dist/engine/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/engine/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGlE;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,EAAE,CAUpF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAuBxF"}

package/dist/engine/gate.js

@@ -0,0 +1,47 @@
+import { SEVERITY_LADDER } from './loader.js';
+/**
+ * Findings that should block a build: anything at or above `threshold` that is
+ * neither passing, unverified, nor explicitly accepted by project policy.
+ *
+ * Suppressed findings never block — that is the entire point of recording an
+ * accepted risk in `.usa.yaml`. UNKNOWN never blocks either: "needs a human"
+ * is not "failed", and gating on it would make every manual rule a CI failure.
+ */
+export function blockingFindings(report, threshold) {
+    const open = report.findings.filter((f) => f.status !== 'PASS' &&
+        f.status !== 'NOT_APPLICABLE' &&
+        f.status !== 'UNKNOWN' &&
+        !f.suppressedReason);
+    const min = SEVERITY_LADDER.indexOf(threshold);
+    return open.filter((f) => SEVERITY_LADDER.indexOf(f.severity) >= min);
+}
+/**
+ * `--fail-on` gate. Returns a process exit code.
+ *
+ * The ladder is ascending (`FUTURE` … `CRITICAL`), so "at or above" means
+ * *higher* index. Getting this backwards makes `--fail-on critical` fail on
+ * every finding in the report, which is a memorable way to lose a CI pipeline.
+ */
+export function evaluateGate(report, failOn, quiet) {
+    if (failOn === 'none')
+        return 0;
+    const threshold = failOn.toUpperCase();
+    if (!SEVERITY_LADDER.includes(threshold)) {
+        console.error(`--fail-on must be none or one of ${[...SEVERITY_LADDER].reverse().join('|').toLowerCase()}`);
+        return 2;
+    }
+    const blocking = blockingFindings(report, threshold);
+    if (blocking.length === 0)
+        return 0;
+    if (!quiet) {
+        console.error(`\nGate failed: ${blocking.length} finding(s) at or above ${threshold}.`);
+        for (const f of blocking.slice(0, 10)) {
+            const where = f.locations[0] ? `  (${f.locations[0].file}:${f.locations[0].line})` : '';
+            console.error(`  ${f.severity.padEnd(8)} ${f.ruleId}  ${f.title}${where}`);
+        }
+        if (blocking.length > 10)
+            console.error(`  … and ${blocking.length - 10} more`);
+    }
+    return 1;
+}
+//# sourceMappingURL=gate.js.map

package/dist/engine/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/engine/gate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,SAAmB;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,MAAM;QACnB,CAAC,CAAC,MAAM,KAAK,gBAAgB;QAC7B,CAAC,CAAC,MAAM,KAAK,SAAS;QACtB,CAAC,CAAC,CAAC,gBAAgB,CACtB,CAAC;IACF,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,MAAc,EAAE,KAAc;IAC9E,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAc,CAAC;IACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CACX,oCAAoC,CAAC,GAAG,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAC7F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,kBAAkB,QAAQ,CAAC,MAAM,2BAA2B,SAAS,GAAG,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,WAAW,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/engine/loader.d.ts

@@ -0,0 +1,37 @@
+import type { RuleClass, RulePack, Severity } from '../types.js';
+export declare const SEVERITY_LADDER: Severity[];
+export declare const RULE_CLASSES: RuleClass[];
+export declare const DEFAULT_WEIGHT: Record<Severity, number>;
+export interface LoaderResult {
+    packs: RulePack[];
+    warnings: string[];
+}
+/**
+ * Load a single pack file (not the registry). Used by the evolution CLI to load
+ * a candidate capability pack that is *not* (yet) in `rules/index.yaml`.
+ */
+export declare function loadPackFile(file: string): {
+    pack: RulePack | null;
+    warnings: string[];
+};
+/** Read `rules/index.yaml` and every pack it references. */
+export declare function loadRulePacks(rulesDir: string): LoaderResult;
+/**
+ * Parse a rule pack from YAML text in memory. Shared by the file loader and the
+ * evolution proposal stage, which renders a candidate pack (from the bootstrap
+ * catalog) without ever touching the checked-in registry. `sourceName` is only
+ * used in warnings and as the fallback pack id.
+ */
+export declare function parsePackText(text: string, sourceName: string, seenRuleIds?: Map<string, string>, warnings?: string[]): RulePack | null;
+/**
+ * `applies_when` is author-controlled input to the audit hot loop. An unknown
+ * key, a non-list `all`/`any`, or an uncompilable `matches` regex must warn at
+ * load time, because evaluation fails closed (rule skipped) on all of them.
+ */
+export declare function validatePredicate(p: unknown, where: string, warnings: string[]): void;
+/** Merge config-driven rule overrides onto loaded packs. */
+export declare function applyRuleOverrides(packs: RulePack[], overrides: Record<string, {
+    severity?: Severity;
+    weight?: number;
+}>): void;
+//# sourceMappingURL=loader.d.ts.map

package/dist/engine/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/engine/loader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAsB,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErF,eAAO,MAAM,eAAe,EAAE,QAAQ,EAAoD,CAAC;AAC3F,eAAO,MAAM,YAAY,EAAE,SAAS,EAUnC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAMnD,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAKxF;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CA2B5D;AA4CD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,WAAW,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,EAC5C,QAAQ,GAAE,MAAM,EAAO,GACtB,QAAQ,GAAG,IAAI,CA8CjB;AAqKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAWrF;AAgFD,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,QAAQ,EAAE,EACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAClE,IAAI,CASN"}