musubix3 0.1.0

package/dist/packages/analysis/src/attestation.js

@@ -0,0 +1,474 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { error } from '../../domain/src/index.js';
+import { digest, exists, files, readText, snapshot, within } from './files.js';
+import { performanceEvidenceHead, validatePerformanceEvidence } from './performance.js';
+import { mutationEvidenceHead, validateMutationEvidence } from './mutation.js';
+import { modelCorrespondenceEvidenceHead, validateModelCorrespondenceEvidence } from './model-correspondence.js';
+import { loadEvidenceOrder } from './order.js';
+import { runProcess } from './process.js';
+import { workflowEvidenceHead } from './workflow.js';
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+            .map(([key, nested]) => `${JSON.stringify(key)}:${canonical(nested)}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+function repositoryName(remote) {
+    return remote.trim().replace(/^git@github\.com:/, '').replace(/^https?:\/\/github\.com\//, '').replace(/\.git$/, '');
+}
+export async function collectEvidenceHeads(root) {
+    const heads = {};
+    const load = async (path) => await exists(within(root, path)) ? JSON.parse(await readText(root, path)) : null;
+    const tdd = await load('.musubix/evidence/tdd.json');
+    const chain = Array.isArray(tdd?.chain) ? tdd.chain : [];
+    if (typeof chain.at(-1)?.recordSha256 === 'string')
+        heads.tdd = chain.at(-1).recordSha256;
+    const workflow = await load('.musubix/evidence/workflow.json');
+    const workflowHead = workflowEvidenceHead(workflow);
+    if (workflowHead)
+        heads.workflow = workflowHead;
+    const changes = await load('.musubix/evidence/changes.json');
+    if (Array.isArray(changes?.changes))
+        heads.changes = digest(canonical(changes.changes));
+    const order = await loadEvidenceOrder(root);
+    if (order?.records.length)
+        heads.order = order.records.at(-1).recordSha256;
+    const formal = await load('.musubix/evidence/formal.json');
+    if (formal) {
+        const result = formal.result;
+        const solver = result?.solver;
+        heads.formal = digest(canonical({
+            fingerprints: formal.fingerprints ?? {},
+            totalRequirements: formal.totalRequirements,
+            modeledRequirements: formal.modeledRequirements,
+            modeledFraction: formal.modeledFraction,
+            artifact: solver?.artifact ?? null,
+            solverStatus: solver?.status,
+            consistency: result?.consistency,
+        }));
+    }
+    const performance = await load('.musubix/evidence/performance.json');
+    if (performance)
+        heads.performance = performanceEvidenceHead(performance);
+    const mutation = await load('.musubix/evidence/mutation.json');
+    if (mutation)
+        heads.mutation = mutationEvidenceHead(mutation);
+    const correspondence = await load('.musubix/evidence/model-correspondence.json');
+    if (correspondence)
+        heads.modelCorrespondence = modelCorrespondenceEvidenceHead(correspondence);
+    const quality = await load('.musubix/evidence/quality.json');
+    if (quality) {
+        const checks = Array.isArray(quality.checks)
+            ? quality.checks.filter((check) => check.name !== 'attestation')
+            : [];
+        const metrics = quality.metrics && typeof quality.metrics === 'object' && !Array.isArray(quality.metrics)
+            ? Object.fromEntries(Object.entries(quality.metrics)
+                .filter(([name]) => name !== 'attestation.errors'))
+            : {};
+        heads.quality = digest(canonical({
+            schemaVersion: quality.schemaVersion,
+            mode: quality.mode,
+            status: checks.every((check) => check.required !== true || check.status === 'pass') ? 'pass' : 'fail',
+            checks: checks.map((check) => ({
+                name: check.name,
+                required: check.required,
+                status: check.status,
+                diagnostics: Array.isArray(check.diagnostics)
+                    ? check.diagnostics.map((diagnostic) => ({
+                        code: diagnostic.code,
+                        severity: diagnostic.severity,
+                        path: diagnostic.path ?? null,
+                        line: diagnostic.line ?? null,
+                    }))
+                    : [],
+            })),
+            metrics,
+        }));
+    }
+    const workspace = await snapshot(root, (await files(root)).filter((path) => !/^\.musubix\/features\/[^/]+\/trace\.json$/.test(path)
+        && !path.endsWith('.tgz')
+        && !/^\.github\/skills\//.test(path)
+        && !/(?:^|\/)(?:logs?|session-logs)\//.test(path)
+        && !/\.jsonl$/.test(path)));
+    heads.workspace = digest(canonical(workspace));
+    return Object.fromEntries(Object.entries(heads).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+}
+async function gitIdentity(root, runner) {
+    const [remote, revision] = await Promise.all([
+        runner('git', ['config', '--get', 'remote.origin.url'], { cwd: root, timeoutMs: 10_000 }),
+        runner('git', ['rev-parse', 'HEAD'], { cwd: root, timeoutMs: 10_000 }),
+    ]);
+    if (remote.status !== 'completed' || remote.exitCode !== 0 || !remote.stdout.trim())
+        throw new Error('Repository remote.origin.url is unavailable.');
+    if (revision.status !== 'completed' || revision.exitCode !== 0 || !/^[a-f0-9]{40,64}$/i.test(revision.stdout.trim())) {
+        throw new Error('A committed Git HEAD is required for CI attestation.');
+    }
+    return { repository: repositoryName(remote.stdout), commitSha: revision.stdout.trim().toLowerCase() };
+}
+export async function createUnsignedAttestation(root, input, runner = runProcess) {
+    if (!input.runId.trim() || !/^[A-Za-z0-9._:-]+$/.test(input.keyId))
+        throw new Error('Attestation runId and keyId are required.');
+    const identity = await gitIdentity(root, runner);
+    return {
+        schemaVersion: 1,
+        ...identity,
+        ci: { provider: input.provider, runId: input.runId },
+        evidenceHeads: await collectEvidenceHeads(root),
+        issuedAt: input.issuedAt ?? new Date().toISOString(),
+        keyId: input.keyId,
+        ...(input.githubOidc ? { githubOidc: input.githubOidc } : {}),
+    };
+}
+function currentCi(environment) {
+    if (environment.GITHUB_ACTIONS === 'true' && environment.GITHUB_RUN_ID) {
+        return {
+            provider: 'github',
+            runId: environment.GITHUB_RUN_ID,
+            ...(environment.GITHUB_REPOSITORY ? { repository: environment.GITHUB_REPOSITORY } : {}),
+            ...(environment.GITHUB_SHA ? { commitSha: environment.GITHUB_SHA.toLowerCase() } : {}),
+        };
+    }
+    if (environment.TF_BUILD === 'True' && environment.BUILD_BUILDID) {
+        return {
+            provider: 'azure-pipelines',
+            runId: environment.BUILD_BUILDID,
+            ...(environment.BUILD_REPOSITORY_NAME ? { repository: environment.BUILD_REPOSITORY_NAME } : {}),
+            ...(environment.BUILD_SOURCEVERSION ? { commitSha: environment.BUILD_SOURCEVERSION.toLowerCase() } : {}),
+        };
+    }
+    if (environment.CI_PROVIDER && environment.CI_RUN_ID)
+        return { provider: 'generic', runId: environment.CI_RUN_ID };
+    return null;
+}
+function ed25519PublicKey(value) {
+    if (/BEGIN [A-Z ]*PRIVATE KEY/.test(value))
+        throw new Error('Private keys are not accepted.');
+    const key = createPublicKey(value);
+    if (key.asymmetricKeyType !== 'ed25519')
+        throw new Error('Signing key is not Ed25519.');
+    return key;
+}
+export function githubOidcAudience(audience, keyBinding, keyId, publicKey) {
+    if (!audience || audience.includes('#'))
+        throw new Error('OIDC audience base must be nonempty and must not contain #.');
+    if (!/^[A-Za-z0-9._:-]+$/.test(keyId))
+        throw new Error('OIDC keyId is invalid.');
+    if (keyBinding === 'key-id')
+        return `${audience}#musubix3-key-id=${encodeURIComponent(keyId)}`;
+    if (!publicKey)
+        throw new Error('OIDC public-key binding requires an Ed25519 public key.');
+    const key = ed25519PublicKey(publicKey);
+    const der = key.export({ type: 'spki', format: 'der' });
+    return `${audience}#musubix3-key-sha256=${createHash('sha256').update(der).digest('base64url')}`;
+}
+function jwtPart(value) {
+    const decoded = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+    if (!decoded || typeof decoded !== 'object' || Array.isArray(decoded))
+        throw new Error('JWT component is not an object.');
+    return decoded;
+}
+function claimString(claims, name) {
+    const value = claims[name];
+    return typeof value === 'string' && value ? value : null;
+}
+function claimNumber(claims, name) {
+    const value = claims[name];
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+async function verifyGithubOidc(attestation, config, options, path) {
+    const diagnostics = [];
+    const oidc = config.githubOidc;
+    if (oidc?.mode !== 'strict')
+        return diagnostics;
+    if (attestation.ci.provider !== 'github') {
+        return [error('ATTESTATION_OIDC_PROVIDER', 'Strict GitHub OIDC requires ci.provider github.', path)];
+    }
+    if (!attestation.githubOidc?.token) {
+        return [error('ATTESTATION_OIDC_MISSING', 'Strict GitHub OIDC requires a signed OIDC token in the attestation.', path)];
+    }
+    const issuer = oidc.issuer ?? 'https://token.actions.githubusercontent.com';
+    const token = attestation.githubOidc.token;
+    if (token.length > 64_000)
+        return [error('ATTESTATION_OIDC_TOKEN', 'GitHub OIDC token is too large.', path)];
+    let header;
+    let claims;
+    let signingInput;
+    let signature;
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts.some((part) => !part))
+            throw new Error('JWT must have three compact parts.');
+        header = jwtPart(parts[0]);
+        claims = jwtPart(parts[1]);
+        signingInput = `${parts[0]}.${parts[1]}`;
+        signature = Buffer.from(parts[2], 'base64url');
+    }
+    catch (cause) {
+        return [error('ATTESTATION_OIDC_TOKEN', `GitHub OIDC token is malformed: ${cause instanceof Error ? cause.message : String(cause)}`, path)];
+    }
+    if (header.alg !== 'RS256' || typeof header.kid !== 'string' || !header.kid) {
+        diagnostics.push(error('ATTESTATION_OIDC_ALGORITHM', 'GitHub OIDC token must use RS256 and identify a signing key.', path));
+    }
+    let jwks = null;
+    if (!diagnostics.length) {
+        try {
+            const fetcher = options.fetch ?? globalThis.fetch;
+            if (!fetcher)
+                throw new Error('fetch is unavailable');
+            const metadataUrl = `${issuer}/.well-known/openid-configuration`;
+            const metadataResponse = await fetcher(metadataUrl, {
+                headers: { accept: 'application/json' },
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!metadataResponse.ok)
+                throw new Error(`issuer metadata returned HTTP ${metadataResponse.status}`);
+            const metadata = await metadataResponse.json();
+            if (metadata.issuer !== issuer || typeof metadata.jwks_uri !== 'string') {
+                throw new Error('issuer metadata does not match the configured GitHub issuer');
+            }
+            const jwksUrl = new URL(metadata.jwks_uri);
+            if (jwksUrl.protocol !== 'https:' || jwksUrl.origin !== new URL(issuer).origin) {
+                throw new Error('issuer metadata returned an untrusted JWKS URI');
+            }
+            const jwksResponse = await fetcher(jwksUrl.toString(), {
+                headers: { accept: 'application/json' },
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!jwksResponse.ok)
+                throw new Error(`JWKS returned HTTP ${jwksResponse.status}`);
+            jwks = await jwksResponse.json();
+        }
+        catch (cause) {
+            diagnostics.push(error('ATTESTATION_OIDC_FETCH', `Unable to retrieve GitHub OIDC verification keys: ${cause instanceof Error ? cause.message : String(cause)}.`, path));
+        }
+    }
+    if (jwks) {
+        const keys = Array.isArray(jwks.keys) ? jwks.keys : [];
+        const jwk = keys.find((candidate) => {
+            if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate))
+                return false;
+            const value = candidate;
+            return value.kid === header.kid && value.kty === 'RSA'
+                && (value.alg === undefined || value.alg === 'RS256')
+                && (value.use === undefined || value.use === 'sig');
+        });
+        if (!jwk)
+            diagnostics.push(error('ATTESTATION_OIDC_KEY', 'GitHub OIDC signing key was not found in the issuer JWKS.', path));
+        else {
+            try {
+                const jwtKey = createPublicKey({ key: jwk, format: 'jwk' });
+                if (jwtKey.asymmetricKeyType !== 'rsa'
+                    || !verify('RSA-SHA256', Buffer.from(signingInput), jwtKey, signature)) {
+                    diagnostics.push(error('ATTESTATION_OIDC_SIGNATURE', 'GitHub OIDC JWT signature verification failed.', path));
+                }
+            }
+            catch {
+                diagnostics.push(error('ATTESTATION_OIDC_SIGNATURE', 'GitHub OIDC JWT signature is malformed or unverifiable.', path));
+            }
+        }
+    }
+    if (claimString(claims, 'iss') !== issuer) {
+        diagnostics.push(error('ATTESTATION_OIDC_ISSUER', 'GitHub OIDC issuer claim does not match the configured issuer.', path));
+    }
+    try {
+        const expectedAudience = githubOidcAudience(oidc.audience, oidc.keyBinding ?? 'public-key', attestation.keyId, oidc.keyBinding === 'key-id' ? undefined : attestation.githubOidc.publicKey);
+        const audience = claims.aud;
+        if (!(audience === expectedAudience
+            || Array.isArray(audience) && audience.every((entry) => typeof entry === 'string') && audience.includes(expectedAudience))) {
+            diagnostics.push(error('ATTESTATION_OIDC_AUDIENCE', 'GitHub OIDC audience does not authorize this attestation signing key.', path));
+        }
+    }
+    catch (cause) {
+        diagnostics.push(error('ATTESTATION_OIDC_KEY_BINDING', cause instanceof Error ? cause.message : String(cause), path));
+    }
+    const now = (options.now ?? (() => new Date()))().getTime() / 1000;
+    const skew = config.maxFutureSkewSeconds ?? 60;
+    const exp = claimNumber(claims, 'exp');
+    const nbf = claimNumber(claims, 'nbf');
+    const iat = claimNumber(claims, 'iat');
+    if (exp === null || nbf === null || iat === null) {
+        diagnostics.push(error('ATTESTATION_OIDC_TIME', 'GitHub OIDC token must contain numeric exp, nbf, and iat claims.', path));
+    }
+    else {
+        if (now > exp + skew)
+            diagnostics.push(error('ATTESTATION_OIDC_EXPIRED', 'GitHub OIDC token has expired.', path));
+        if (nbf > now + skew)
+            diagnostics.push(error('ATTESTATION_OIDC_NOT_BEFORE', 'GitHub OIDC token is not yet valid.', path));
+        if (iat > now + skew)
+            diagnostics.push(error('ATTESTATION_OIDC_ISSUED_AT', 'GitHub OIDC token iat is in the future.', path));
+        if (nbf > exp || iat > exp)
+            diagnostics.push(error('ATTESTATION_OIDC_TIME', 'GitHub OIDC token time claims are inconsistent.', path));
+        const attestationTime = Date.parse(attestation.issuedAt) / 1000;
+        if (attestationTime < iat - skew || attestationTime > exp + skew) {
+            diagnostics.push(error('ATTESTATION_OIDC_ATTESTATION_TIME', 'Attestation was not issued during the OIDC token authorization window.', path));
+        }
+    }
+    const expectedRepository = oidc.repository ?? config.repository ?? attestation.repository;
+    if (claimString(claims, 'repository') !== expectedRepository) {
+        diagnostics.push(error('ATTESTATION_OIDC_REPOSITORY', 'GitHub OIDC repository claim does not match the attested repository.', path));
+    }
+    if (claimString(claims, 'sha')?.toLowerCase() !== attestation.commitSha.toLowerCase()) {
+        diagnostics.push(error('ATTESTATION_OIDC_COMMIT', 'GitHub OIDC sha claim does not match the attested commit.', path));
+    }
+    const runId = claims.run_id;
+    if ((typeof runId !== 'string' && typeof runId !== 'number') || String(runId) !== attestation.ci.runId) {
+        diagnostics.push(error('ATTESTATION_OIDC_RUN', 'GitHub OIDC run_id claim does not match the attested CI run.', path));
+    }
+    if (oidc.workflow && claimString(claims, 'workflow') !== oidc.workflow) {
+        diagnostics.push(error('ATTESTATION_OIDC_WORKFLOW', 'GitHub OIDC workflow claim does not match the configured workflow.', path));
+    }
+    if (oidc.ref && claimString(claims, 'ref') !== oidc.ref) {
+        diagnostics.push(error('ATTESTATION_OIDC_REF', 'GitHub OIDC ref claim does not match the configured ref.', path));
+    }
+    return diagnostics;
+}
+export async function verifyEvidenceAttestation(root, config, runner = runProcess, environment = process.env, options = {}) {
+    if (config.mode === 'off')
+        return { present: false, valid: true, status: 'off', trust: 'none', diagnostics: [] };
+    const path = '.musubix/evidence/attestation.json';
+    if (!await exists(within(root, path))) {
+        const diagnostics = config.mode === 'ci-required'
+            ? [error('ATTESTATION_MISSING', 'CI attestation is required but no signed attestation is present.', path)]
+            : [];
+        return {
+            present: false,
+            valid: config.mode !== 'ci-required',
+            status: config.mode === 'ci-required' ? 'missing' : 'unsigned-local',
+            trust: 'none',
+            diagnostics,
+        };
+    }
+    const diagnostics = [];
+    let attestation;
+    try {
+        attestation = JSON.parse(await readText(root, path));
+        if (attestation.schemaVersion !== 1
+            || Object.keys(attestation).some((key) => !['schemaVersion', 'repository', 'commitSha', 'ci', 'evidenceHeads', 'issuedAt', 'keyId', 'githubOidc', 'signature'].includes(key))
+            || !attestation.repository || !/^[a-f0-9]{40,64}$/i.test(attestation.commitSha)
+            || !['github', 'azure-pipelines', 'generic'].includes(attestation.ci?.provider)
+            || !attestation.ci?.runId || Number.isNaN(Date.parse(attestation.issuedAt)) || !attestation.keyId
+            || !attestation.evidenceHeads || !Object.keys(attestation.evidenceHeads).length
+            || Object.values(attestation.evidenceHeads).some((head) => !/^[a-f0-9]{64}$/i.test(head))
+            || typeof attestation.signature !== 'string')
+            throw new Error('schema mismatch');
+        if (attestation.githubOidc !== undefined) {
+            if (!attestation.githubOidc || typeof attestation.githubOidc !== 'object'
+                || Object.keys(attestation.githubOidc).some((key) => !['token', 'publicKey'].includes(key))
+                || typeof attestation.githubOidc.token !== 'string' || !attestation.githubOidc.token
+                || (attestation.githubOidc.publicKey !== undefined
+                    && (typeof attestation.githubOidc.publicKey !== 'string'
+                        || !attestation.githubOidc.publicKey.includes('BEGIN PUBLIC KEY')))) {
+                throw new Error('GitHub OIDC proof schema mismatch');
+            }
+        }
+    }
+    catch (cause) {
+        return {
+            present: true,
+            valid: false,
+            status: 'invalid',
+            trust: 'none',
+            diagnostics: [error('ATTESTATION_SCHEMA', `Invalid attestation: ${cause instanceof Error ? cause.message : String(cause)}.`, path)],
+        };
+    }
+    const trusted = config.trustedPublicKeys.find((key) => key.id === attestation.keyId);
+    const strictOidc = config.githubOidc?.mode === 'strict';
+    const keyBinding = config.githubOidc?.keyBinding ?? 'public-key';
+    if (strictOidc && keyBinding === 'key-id' && attestation.githubOidc?.publicKey) {
+        diagnostics.push(error('ATTESTATION_OIDC_KEY_BINDING', 'key-id binding must not carry an unrelated ephemeral public key.', path));
+    }
+    let signingKey = null;
+    let trust = 'none';
+    try {
+        if (strictOidc && keyBinding === 'public-key') {
+            if (!attestation.githubOidc?.publicKey)
+                throw new Error('OIDC-authorized ephemeral mode requires githubOidc.publicKey.');
+            signingKey = ed25519PublicKey(attestation.githubOidc.publicKey);
+            trust = 'github-oidc-ephemeral-key';
+        }
+        else if (trusted) {
+            signingKey = ed25519PublicKey(trusted.publicKey);
+            trust = strictOidc ? 'github-oidc-trusted-key' : 'static-trusted-key';
+        }
+        else {
+            diagnostics.push(error('ATTESTATION_KEY_UNTRUSTED', `Attestation key ${attestation.keyId} is not trusted.`, path));
+        }
+    }
+    catch (cause) {
+        diagnostics.push(error('ATTESTATION_SIGNATURE', cause instanceof Error ? cause.message : String(cause), path));
+    }
+    const issuedAt = Date.parse(attestation.issuedAt);
+    const now = (options.now ?? (() => new Date()))().getTime();
+    const futureSkewMs = (config.maxFutureSkewSeconds ?? 60) * 1000;
+    const maxAgeMs = (config.maxAgeSeconds ?? 3600) * 1000;
+    if (issuedAt > now + futureSkewMs) {
+        diagnostics.push(error('ATTESTATION_FUTURE', 'Attestation issuedAt is beyond the configured future clock skew.', path));
+    }
+    if (now - issuedAt > maxAgeMs) {
+        diagnostics.push(error('ATTESTATION_EXPIRED', 'Attestation is older than the configured maximum age.', path));
+    }
+    try {
+        const identity = await gitIdentity(root, runner);
+        if (config.repository && config.repository !== identity.repository)
+            diagnostics.push(error('ATTESTATION_REPOSITORY', 'Configured repository does not match Git remote.origin.url.', path));
+        if (attestation.repository !== (config.repository ?? identity.repository))
+            diagnostics.push(error('ATTESTATION_REPOSITORY', 'Attestation repository does not match the configured repository.', path));
+        if (attestation.commitSha.toLowerCase() !== identity.commitSha)
+            diagnostics.push(error('ATTESTATION_COMMIT', 'Attestation commit SHA does not match Git HEAD.', path));
+    }
+    catch (cause) {
+        diagnostics.push(error('ATTESTATION_GIT', cause instanceof Error ? cause.message : String(cause), path));
+    }
+    const ci = currentCi(environment);
+    if (config.mode === 'ci-required' && !ci)
+        diagnostics.push(error('ATTESTATION_CI_CONTEXT', 'No supported CI provider/run context is available.', path));
+    if (ci && (ci.provider !== attestation.ci.provider || ci.runId !== attestation.ci.runId))
+        diagnostics.push(error('ATTESTATION_CI_RUN', 'Attestation CI provider/run ID does not match the current CI run.', path));
+    if (ci?.repository && ci.repository !== attestation.repository)
+        diagnostics.push(error('ATTESTATION_CI_REPOSITORY', 'Attestation repository does not match the CI repository.', path));
+    if (ci?.commitSha && ci.commitSha !== attestation.commitSha.toLowerCase())
+        diagnostics.push(error('ATTESTATION_CI_COMMIT', 'Attestation commit does not match the CI source revision.', path));
+    const heads = await collectEvidenceHeads(root);
+    if (canonical(heads) !== canonical(attestation.evidenceHeads))
+        diagnostics.push(error('ATTESTATION_EVIDENCE_HEAD', 'Attested evidence heads do not match current evidence.', path));
+    const performance = await validatePerformanceEvidence(root);
+    if (performance.budgets > 0 && !performance.valid) {
+        diagnostics.push(error('ATTESTATION_PERFORMANCE_PROVENANCE', 'Attested performance evidence is no longer traceable to its configured command and fresh report.', path));
+    }
+    const mutation = await validateMutationEvidence(root);
+    if (mutation.present && !mutation.valid) {
+        diagnostics.push(error('ATTESTATION_MUTATION_PROVENANCE', 'Attested mutation evidence is no longer traceable to current source, tests, command, and report evidence.', path));
+    }
+    const correspondence = await validateModelCorrespondenceEvidence(root);
+    if (correspondence.requirements > 0 && !correspondence.valid) {
+        diagnostics.push(error('ATTESTATION_MODEL_CORRESPONDENCE', 'Attested model correspondence evidence is missing, stale, or unproved.', path));
+    }
+    if (strictOidc)
+        diagnostics.push(...await verifyGithubOidc(attestation, config, options, path));
+    if (signingKey) {
+        const { signature, ...unsigned } = attestation;
+        try {
+            if (!verify(null, Buffer.from(canonical(unsigned)), signingKey, Buffer.from(signature, 'base64'))) {
+                diagnostics.push(error('ATTESTATION_SIGNATURE', 'Ed25519 signature verification failed.', path));
+            }
+        }
+        catch {
+            diagnostics.push(error('ATTESTATION_SIGNATURE', 'Ed25519 signature is malformed or unverifiable.', path));
+        }
+    }
+    return {
+        present: true,
+        valid: !diagnostics.length,
+        status: diagnostics.length ? 'invalid' : 'verified',
+        trust: diagnostics.length ? 'none' : trust,
+        diagnostics,
+    };
+}
+export function attestationSigningPayload(value) {
+    return canonical(value);
+}
+//# sourceMappingURL=attestation.js.map

package/dist/packages/analysis/src/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../../../../packages/analysis/src/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAmC,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,KAAK,EAAmB,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AACjH,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAyB,MAAM,eAAe,CAAC;AA2C5E,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aACxD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACvH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAA2C,EAAE,CAC3E,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAuC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,QAAQ;QAAE,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,YAAsB,CAAC;IACrG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAA8C,CAAC,CAAC;IAC1F,IAAI,YAAY;QAAE,KAAK,CAAC,QAAQ,GAAG,YAAY,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,KAAK,EAAE,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,YAAY,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,MAA6C,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,EAAE,MAA6C,CAAC;QACrE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;YAClC,YAAY,EAAE,MAAM,EAAE,MAAM;YAC5B,WAAW,EAAE,MAAM,EAAE,WAAW;SACjC,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACrE,IAAI,WAAW;QAAE,KAAK,CAAC,WAAW,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,KAAK,CAAC,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACjF,IAAI,cAAc;QAAE,KAAK,CAAC,mBAAmB,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAE,OAAO,CAAC,MAAyC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC;YACpG,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;YACvG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAkC,CAAC;iBAC5E,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC;YACrD,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACrG,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC3C,CAAC,CAAE,KAAK,CAAC,WAA8C,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;wBAC3E,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,IAAI;wBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,IAAI;qBAC9B,CAAC,CAAC;oBACH,CAAC,CAAC,EAAE;aACP,CAAC,CAAC;YACH,OAAO;SACR,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACzE,CAAC,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;WACpD,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;WACtB,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;WACjC,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;WAC9C,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACrD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACzF,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;KACvE,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrJ,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,KAMC,EACD,SAAiB,UAAU;IAE3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjI,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,GAAG,QAAQ;QACX,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;QACpD,aAAa,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;QAC/C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,WAA8B;IAC/C,IAAI,WAAW,CAAC,cAAc,KAAK,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;QACvE,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,WAAW,CAAC,aAAa;YAChC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;QACjE,OAAO;YACL,QAAQ,EAAE,iBAAiB;YAC3B,KAAK,EAAE,WAAW,CAAC,aAAa;YAChC,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,GAAG,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,mBAAmB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzG,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,UAAmC,EACnC,KAAa,EACb,SAAkB;IAElB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACxH,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACjF,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,GAAG,QAAQ,oBAAoB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/F,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,OAAO,GAAG,QAAQ,wBAAwB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACxF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1H,OAAO,OAAkC,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,MAA+B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,MAA+B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,WAAgC,EAChC,MAAyB,EACzB,OAAuC,EACvC,IAAY;IAEZ,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,WAAW,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,iDAAiD,EAAE,IAAI,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,qEAAqE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,6CAA6C,CAAC;IAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7G,IAAI,MAA+B,CAAC;IACpC,IAAI,MAA+B,CAAC;IACpC,IAAI,YAAoB,CAAC;IACzB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC7G,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC5B,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC5B,YAAY,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9I,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC5E,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,4BAA4B,EAAE,8DAA8D,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9H,CAAC;IAED,IAAI,IAAI,GAAmC,IAAI,CAAC;IAChD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtD,MAAM,WAAW,GAAG,GAAG,MAAM,mCAAmC,CAAC;YACjE,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE;gBAClD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;YACtG,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAA6B,CAAC;YAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC/E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;gBACrD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAA6B,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,qDAAqD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1K,CAAC;IACH,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YAClC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1F,MAAM,KAAK,GAAG,SAAoC,CAAC;YACnD,OAAO,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK;mBACjD,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC;mBAClD,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,2DAA2D,EAAE,IAAI,CAAC,CAAC,CAAC;aACxH,CAAC;YACJ,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1E,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK;uBACjC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAa,CAAC,EAAE,MAAM,EAAE,SAAU,CAAC,EAAE,CAAC;oBAC3E,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,4BAA4B,EAAE,gDAAgD,EAAE,IAAI,CAAC,CAAC,CAAC;gBAChH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,4BAA4B,EAAE,yDAAyD,EAAE,IAAI,CAAC,CAAC,CAAC;YACzH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC,MAAO,EAAE,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAC3C,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,gEAAgE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,kBAAkB,CACzC,IAAI,CAAC,QAAS,EACd,IAAI,CAAC,UAAU,IAAI,YAAY,EAC/B,WAAW,CAAC,KAAK,EACjB,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAC5E,CAAC;QACF,MAAM,QAAQ,GAAG,MAAO,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,CAAC,QAAQ,KAAK,gBAAgB;eAC9B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;YAC7H,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,uEAAuE,EAAE,IAAI,CAAC,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxH,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,MAAO,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAO,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAO,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,kEAAkE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7H,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,EAAE,gCAAgC,EAAE,IAAI,CAAC,CAAC,CAAC;QAClH,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,EAAE,qCAAqC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1H,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,4BAA4B,EAAE,yCAAyC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7H,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,iDAAiD,EAAE,IAAI,CAAC,CAAC,CAAC;QACtI,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QAChE,IAAI,eAAe,GAAG,GAAG,GAAG,IAAI,IAAI,eAAe,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;YACjE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE,wEAAwE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/I,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,WAAW,CAAC,UAAU,CAAC;IAC1F,IAAI,WAAW,CAAC,MAAO,EAAE,YAAY,CAAC,KAAK,kBAAkB,EAAE,CAAC;QAC9D,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,WAAW,CAAC,MAAO,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACvF,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,2DAA2D,EAAE,IAAI,CAAC,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,KAAK,GAAG,MAAO,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACvG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,8DAA8D,EAAE,IAAI,CAAC,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,MAAO,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,oEAAoE,EAAE,IAAI,CAAC,CAAC,CAAC;IACnI,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,MAAO,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,0DAA0D,EAAE,IAAI,CAAC,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,MAAyB,EACzB,SAAiB,UAAU,EAC3B,cAAiC,OAAO,CAAC,GAAG,EAC5C,UAA0C,EAAE;IAE5C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACjH,MAAM,IAAI,GAAG,oCAAoC,CAAC;IAClD,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,aAAa;YAC/C,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,kEAAkE,EAAE,IAAI,CAAC,CAAC;YAC1G,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,aAAa;YACpC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;YACpE,KAAK,EAAE,MAAM;YACb,WAAW;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,IAAI,WAAgC,CAAC;IACrC,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAwB,CAAC;QAC5E,IAAI,WAAW,CAAC,aAAa,KAAK,CAAC;eAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;eAC1K,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;eAC5E,CAAC,CAAC,QAAQ,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC;eAC5E,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK;eAC9F,CAAC,WAAW,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,MAAM;eAC5E,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;eACtF,OAAO,WAAW,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnF,IAAI,WAAW,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ;mBACpE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;mBACxF,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK;mBACjF,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;uBAC7C,CAAC,OAAO,WAAW,CAAC,UAAU,CAAC,SAAS,KAAK,QAAQ;2BACnD,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;SACpI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,UAAU,IAAI,YAAY,CAAC;IACjE,IAAI,UAAU,IAAI,UAAU,KAAK,QAAQ,IAAI,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;QAC/E,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE,kEAAkE,EAAE,IAAI,CAAC,CAAC,CAAC;IACpI,CAAC;IACD,IAAI,UAAU,GAAqB,IAAI,CAAC;IACxC,IAAI,KAAK,GAAqB,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAC9C,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACzH,UAAU,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAChE,KAAK,GAAG,2BAA2B,CAAC;QACtC,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,mBAAmB,WAAW,CAAC,KAAK,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAChE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IACvD,IAAI,QAAQ,GAAG,GAAG,GAAG,YAAY,EAAE,CAAC;QAClC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,kEAAkE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,GAAG,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC9B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,uDAAuD,EAAE,IAAI,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,6DAA6D,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3L,IAAI,WAAW,CAAC,UAAU,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,kEAAkE,EAAE,IAAI,CAAC,CAAC,CAAC;QACvM,IAAI,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,iDAAiD,EAAE,IAAI,CAAC,CAAC,CAAC;IACzK,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,oDAAoD,EAAE,IAAI,CAAC,CAAC,CAAC;IACxJ,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,KAAK,WAAW,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,KAAK,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,mEAAmE,EAAE,IAAI,CAAC,CAAC,CAAC;IACnN,IAAI,EAAE,EAAE,UAAU,IAAI,EAAE,CAAC,UAAU,KAAK,WAAW,CAAC,UAAU;QAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,0DAA0D,EAAE,IAAI,CAAC,CAAC,CAAC;IACvL,IAAI,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE;QAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,2DAA2D,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/L,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,WAAW,CAAC,aAAa,CAAC;QAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,wDAAwD,EAAE,IAAI,CAAC,CAAC,CAAC;IACpL,MAAM,WAAW,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,WAAW,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAClD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,oCAAoC,EAAE,kGAAkG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1K,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE,2GAA2G,EAAE,IAAI,CAAC,CAAC,CAAC;IAChL,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,mCAAmC,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC7D,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,kCAAkC,EAAE,wEAAwE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9I,CAAC;IACD,IAAI,UAAU;QAAE,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAChG,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAClG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,wCAAwC,EAAE,IAAI,CAAC,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,iDAAiD,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM;QAC1B,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QACnD,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAC1C,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAA0B;IAClE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/dist/packages/analysis/src/change.d.ts

@@ -0,0 +1,53 @@
+import { type Diagnostic } from '../../domain/src/index.js';
+export declare const changePhases: readonly ["impact", "requirements", "design", "red", "implementation", "green", "quality"];
+export type ChangePhase = typeof changePhases[number];
+interface ChangeFingerprints {
+    impact: string;
+    requirements: string;
+    design: string;
+    implementation: string;
+    tests: string;
+    tdd: string;
+    requirementImplementations?: Record<string, {
+        paths: string[];
+        fingerprints: Record<string, string>;
+    }>;
+}
+export interface ChangePhaseEvidence {
+    phase: ChangePhase;
+    order?: number;
+    recordedAt: string;
+    fingerprints: ChangeFingerprints;
+}
+export interface ChangeRecord {
+    changeId: string;
+    requirementIds: string[];
+    phases: Partial<Record<ChangePhase, ChangePhaseEvidence>>;
+}
+export interface ChangeEvidence {
+    schemaVersion: 1;
+    changes: ChangeRecord[];
+}
+export interface ChangeCompleteness {
+    changeId: string;
+    functionalRequirements: number;
+    nonFunctionalRequirements: number;
+    requirements: number;
+    completeRequirements: number;
+    valid: boolean;
+}
+export declare function loadChangeEvidence(root: string): Promise<ChangeEvidence | null>;
+export declare function recordChangePhase(root: string, changeId: string, phase: ChangePhase, requirementIds: string[]): Promise<ChangeEvidence>;
+export declare function validateChangeEvidence(root: string): Promise<{
+    present: boolean;
+    valid: boolean;
+    changes: number;
+    diagnostics: Diagnostic[];
+}>;
+export declare function validateChangeCompleteness(root: string): Promise<{
+    present: boolean;
+    valid: boolean;
+    changes: ChangeCompleteness[];
+    diagnostics: Diagnostic[];
+}>;
+export {};