redlinegate 0.0.1

package/dist/commands/verify.js

@@ -0,0 +1,478 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isRedlineError } from "../core/errors.js";
+import { deselectedCapabilities, labelsCarriedByGate, readConfig, } from "../config/redline-json.js";
+import { loadManifest } from "../render/manifest.js";
+import { render } from "../render/standards.js";
+import { LOCAL_HEADING, LOCAL_RULES_FILE, localSection, readLocalRules } from "../render/vendors.js";
+import { observePullRequestTemplates, } from "../platforms/pull-request-templates.js";
+// Which way the two standards versions run. Neither direction is local drift —
+// the repository is in the state its own `redline init` left it in — but the
+// operator's next move differs, so the finding must not tell someone running a
+// pinned older CLI to re-run init and render the repository backwards.
+//
+// Deliberately forgiving: `standardsVersion` is whatever some earlier CLI
+// wrote, so a segment that will not parse compares as 0 rather than throwing,
+// and versions that differ only outside the numbers (a prerelease or build
+// suffix) are reported as the upstream direction — different, and still not
+// local drift.
+function versionOrder(installed, recorded) {
+    if (installed === recorded)
+        return 'same';
+    const parts = (version) => version.split('.').map((segment) => {
+        const value = Number.parseInt(segment, 10);
+        return Number.isNaN(value) ? 0 : value;
+    });
+    const left = parts(installed);
+    const right = parts(recorded);
+    for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
+        const a = left[i] ?? 0;
+        const b = right[i] ?? 0;
+        if (a !== b)
+            return a > b ? 'newer' : 'older';
+    }
+    return 'newer';
+}
+// What `redline verify` says instead of a failure about a capability this
+// repository declined at onboarding. It is neither a pass it did not earn nor
+// the silence that would leave a reader unable to tell "off because we chose
+// to" from "off because it broke".
+const OFF_BY_CHOICE = 'off by choice';
+// The platform arrives as a thunk, not a value: resolving one builds a host
+// client, which resolves a credential and throws `permission` (exit 3) when
+// there is none. A repository whose only problem is that nobody ran
+// `redline init` must not be told it lacks credentials, so the .redline.json
+// short-circuit below runs before the platform is ever resolved.
+export async function verify(platformFor, opts) {
+    const findings = [];
+    const add = (check, ok, detail) => {
+        findings.push({ check, ok, detail });
+    };
+    // A missing or corrupt .redline.json is a usage problem, not drift: there is
+    // nothing else worth checking, so this short-circuits to a single finding.
+    // The caller (redline verify's exit-code mapping) uses that single-finding
+    // shape to distinguish "not onboarded" (exit 2) from "onboarded but wrong"
+    // (exit 1) without verify() itself owning process exit codes.
+    let config;
+    try {
+        config = readConfig(opts.cwd);
+    }
+    catch (error) {
+        const message = isRedlineError(error) ? error.message : String(error);
+        add('onboarded', false, message);
+        return { findings, ok: false };
+    }
+    if (!config) {
+        add('onboarded', false, `no ${opts.cwd}/.redline.json — run: npx redlinegate init`);
+        return { findings, ok: false };
+    }
+    add('onboarded', true, `profile ${config.profile}, standards v${config.standardsVersion}`);
+    // Every remaining check reads from the host or the filesystem. A thrown
+    // RedlineError('host', ...) from any platform call below is deliberately
+    // left uncaught here: it must propagate out of verify() as a genuine host
+    // failure (exit 4), never get reinterpreted as a capability finding. A
+    // previous task's bug reported a host 404 as two "denied" capabilities,
+    // filing false work against an administrator — that must not repeat here.
+    // One finding for the whole selection, so the report describes the entire
+    // surface rather than falling silent about the parts that were never
+    // installed. Each finding a deselection governs says so again in its own
+    // words below, where a reader looking for that capability will be.
+    const optedOut = deselectedCapabilities(config.menu, config.capabilities);
+    add('capabilities', true, optedOut.length === 0
+        ? 'every capability selected'
+        : `${OFF_BY_CHOICE} at onboarding, so Redline neither installs nor checks them: ${optedOut.join(', ')}${labelsCarriedByGate(config.capabilities)
+            ? '. labels was not deselected: the gate install is what creates them, so a deselected ' +
+                'gate takes them with it'
+            : ''}`);
+    const platform = await platformFor();
+    const ref = await platform.repoRef(opts.cwd);
+    // Read before the policy, because whether anything in this repository can
+    // publish the Redline check is what decides whether a blocking policy is a
+    // working gate or a repository-wide deadlock. Local: no host call.
+    const machinery = platform.readGateMachinery(opts.cwd);
+    const gateOwned = config.capabilities.gate;
+    // A fact about the repository, not about who owns it: a gate file a
+    // deselection stopped maintaining still fires on every pull request until
+    // someone deletes it. Tying this to `gateOwned` made verify say the check was
+    // published and unpublishable in two findings of the same report.
+    const publishesExpected = machinery.present && machinery.publishes === machinery.expected;
+    // Normally not read at all when the repository declined it: whatever policy
+    // is on the host then belongs to a human, and every comparison below would
+    // report their own configuration as Redline's drift. The exception is a
+    // repository Redline itself gave a blocking policy to before the deselection
+    // — that ruleset is still live, still requires the Redline check, and this is
+    // the last place anyone finds out before a pull request hangs forever.
+    const leftBlocking = !config.capabilities.mergePolicy &&
+        config.menu.blockingGate &&
+        !config.pendingAdmin.includes('merge-policy');
+    const policy = config.capabilities.mergePolicy || leftBlocking ? await platform.readPolicy(ref) : null;
+    // Redline applied it, Redline no longer maintains it, and it still requires
+    // the Redline check. Two states, and they are not the same sentence: while
+    // something still publishes that check nothing is blocked and this is a
+    // hazard to name, and once nothing does, every pull request in the repository
+    // is blocked forever and it is a failure.
+    const leftBlockingPolicy = leftBlocking && policy !== null && policy.blocking;
+    const orphanedBlocking = leftBlockingPolicy && !publishesExpected;
+    // Every setting `redline init` applies, not just the blocking flag: an
+    // administrator who turns off code-owner review or approvals leaves the gate
+    // reporting green while the review requirements it was installed for are
+    // gone. CONTRACT with cli/commands/init.ts's applyPolicy call: it applies
+    // requiredApprovals 1, dismissStaleReviews true, requireCodeOwnerReview from
+    // the menu and requireThreadResolution true. Those are literals there and
+    // cannot be imported, so raising init's approval count without raising
+    // MINIMUM_APPROVALS here would leave a repository sitting at the old count
+    // reporting clean. Compared as a floor, not for equality: a team that
+    // requires three approvals is stricter than the standard, and failing them
+    // would fail their own gate on every pull request.
+    const MINIMUM_APPROVALS = 1;
+    const weakened = [];
+    // Settings the host says it cannot attribute to Redline are reported and
+    // never compared — see MergePolicy.unownedSettings.
+    const unowned = policy?.unownedSettings ?? [];
+    const owned = (setting) => !unowned.includes(setting);
+    if (policy !== null) {
+        // First, because they make every comparison below moot: a policy the host
+        // says is not applying is a policy whose settings are readable and inert,
+        // and a policy the host says nothing can satisfy is an outage whoever
+        // configured what. `advisoryReason` was printed inside the detail of a
+        // PASSING finding whose own words were "every pull request will sit
+        // blocked" — Azure sets it in exactly one state (a blocking Status policy
+        // with no Build Validation policy to queue the pipeline) and GitHub never
+        // sets it, so failing on it cannot produce a false positive anywhere.
+        if (policy.notEnforcedReason !== undefined)
+            weakened.push(policy.notEnforcedReason);
+        if (policy.advisoryReason !== undefined)
+            weakened.push(policy.advisoryReason);
+        if (policy.blocking !== config.menu.blockingGate) {
+            weakened.push(`policy is ${policy.blocking ? 'blocking' : 'advisory'}, config says ${config.menu.blockingGate ? 'blocking' : 'advisory'}`);
+        }
+        if (owned('requiredApprovals') && policy.requiredApprovals < MINIMUM_APPROVALS) {
+            weakened.push(`it requires ${policy.requiredApprovals} approval(s), below the ${MINIMUM_APPROVALS} redline init applied`);
+        }
+        if (owned('dismissStaleReviews') && !policy.dismissStaleReviews) {
+            weakened.push('approvals are no longer dismissed when new commits are pushed, so a review of code that is ' +
+                'no longer in the pull request can carry the merge');
+        }
+        if (owned('requireCodeOwnerReview') &&
+            config.menu.sensitivePathReviewers &&
+            !policy.requireCodeOwnerReview) {
+            weakened.push('code-owner review is off, so the sensitive paths in CODEOWNERS no longer require their owner');
+        }
+        if (owned('requireThreadResolution') && !policy.requireThreadResolution) {
+            weakened.push('unresolved review threads no longer block a merge');
+        }
+    }
+    add('merge-policy', config.capabilities.mergePolicy ? policy !== null && weakened.length === 0 : !orphanedBlocking, !config.capabilities.mergePolicy
+        ? orphanedBlocking
+            ? 'the merge policy Redline applied here is still blocking and still requires ' +
+                `${machinery.expected}, which nothing in this repository publishes — every pull request ` +
+                'is blocked until you relax or delete it on the host, or re-select the gate'
+            : leftBlockingPolicy
+                ? `${OFF_BY_CHOICE}, but the merge policy Redline applied here is still blocking and ` +
+                    `still requires ${machinery.expected} — only ${machinery.path} publishes that, and ` +
+                    'Redline no longer maintains it, so deleting it blocks every pull request'
+                : `${OFF_BY_CHOICE} — this repository manages its own branch policy, so Redline applies none ` +
+                    'and compares none'
+        : policy === null
+            ? 'no Redline merge policy found on the host — if this is a repository that was refused ' +
+                'admin rights at onboarding, a plain redline init treats that as settled and will not ' +
+                'retry it: after an administrator grants the rights, run redline init --repair'
+            : `${weakened.length === 0
+                ? `policy is ${policy.blocking ? 'blocking' : 'advisory'} as configured, ${policy.requiredApprovals} approval(s), code-owner review ${policy.requireCodeOwnerReview ? 'on' : 'off'}`
+                : weakened.join('; ')}${unowned.length > 0 ? `; not compared here: ${unowned.join(', ')}` : ''}`);
+    // The check-name comparison is the highest-value check in the product: an
+    // unsatisfiable required-check name silently blocks every pull request.
+    // It runs whenever the host has any pull request to inspect, independent
+    // of whether the live policy currently lists required checks — an
+    // advisory (non-blocking) gate has no required checks by design, but the
+    // check name still needs confirming before anyone promotes it to blocking.
+    // Read from the local checkout, not the host: the file `init` wrote is the
+    // only evidence that separates "the gate has not run on this pull request
+    // yet" — which is not drift, and used to fail healthy repositories daily —
+    // from "the gate is gone or renamed", which is an outage nothing else in
+    // this command observes. render() covers rendered standards artifacts only,
+    // so before this the deletion was invisible.
+    const requiredChecks = policy?.requiredChecks ?? [];
+    // Three separate failures, and they need three different sentences. The
+    // renamed case is not "the policy requires something else": telling an
+    // operator whose job id is already correct to rename it back points them at
+    // a fiction, and it was reachable — an advisory repository requires no
+    // checks, so a rename there used to pass entirely.
+    const renamed = machinery.publishes !== null && machinery.publishes !== machinery.expected;
+    const policyMoved = machinery.publishes !== null &&
+        !renamed &&
+        requiredChecks.length > 0 &&
+        !requiredChecks.includes(machinery.publishes);
+    const machineryHealthy = machinery.present && machinery.publishes !== null && !renamed && !policyMoved;
+    add('gate-machinery', !gateOwned || machineryHealthy, !gateOwned
+        ? machinery.present
+            ? // The file is not deleted by a deselection — deleting a repository's
+                // files is not Redline's to do — so saying Redline installs none here
+                // would describe a state this repository is not in, and would invite
+                // the operator to delete a workflow that is still running. Where a
+                // blocking policy Redline left behind still needs it, this must not
+                // invite that deletion at all: the merge-policy finding above says
+                // the same deletion blocks every pull request.
+                `${OFF_BY_CHOICE} — Redline no longer maintains a gate here, but ${machinery.path} from ` +
+                    `an earlier run is still present and still publishes ${machinery.publishes ?? machinery.expected}` +
+                    `${leftBlockingPolicy
+                        ? ', which the still-blocking merge policy needs — see the merge-policy finding'
+                        : '; it is yours to keep or delete'}`
+            : `${OFF_BY_CHOICE} — this repository publishes its own merge gate, so Redline installs none ` +
+                `at ${machinery.path}`
+        : !machinery.present
+            ? `${machinery.path} is not in this repository, so nothing will ever publish ${machinery.expected}` +
+                `${requiredChecks.includes(machinery.expected) ? ' — which the policy requires' : ''}` +
+                '; re-run redline init'
+            : machinery.publishes === null
+                ? `${machinery.path} no longer publishes ${machinery.expected} — the gate is not triggered by ` +
+                    'pull requests, or the part of the file that reports it has been edited; re-run redline init'
+                : renamed
+                    ? `${machinery.path} publishes ${machinery.publishes} rather than ${machinery.expected}, so no ` +
+                        'policy requiring the Redline gate can ever be satisfied; rename it back or re-run redline init'
+                    : policyMoved
+                        ? `${machinery.path} publishes ${machinery.expected} as installed, but the policy requires ` +
+                            `${requiredChecks.join(', ')} — the policy no longer requires the Redline gate, so fix the ` +
+                            'policy rather than the workflow'
+                        : `${machinery.path} publishes ${machinery.publishes}`);
+    const pr = await platform.latestPullRequestNumber(ref);
+    if (pr === null) {
+        add('check-name-reported', true, 'no pull request yet — open one to confirm the check reports');
+    }
+    else {
+        const reported = await platform.readReportedCheckNames(ref, pr);
+        const required = requiredChecks;
+        const missing = required.filter((name) => !reported.includes(name));
+        // The host is asked about the newest pull request of any state, which on a
+        // healthy repository is routinely one that predates the gate — merged
+        // before onboarding, or never updated since. Nothing Redline-shaped ran on
+        // that head SHA, so the required check being absent from it is evidence of
+        // nothing at all, and reporting a broken contract from it failed healthy
+        // repositories and, through the Azure gate, every pull request in them.
+        // The gate publishes `redline-gate / gate` on GitHub and `redline/gate` on
+        // Azure (github/install.ts REQUIRED_CHECK, azure/policy-types.ts
+        // AZURE_STATUS_GENRE), so a reported name under that prefix is a gate run
+        // — including one published under a name the policy does not require,
+        // which is exactly the misconfiguration worth failing for.
+        //
+        // This path is only safe because the gate-machinery finding below fails
+        // when nothing in the repository can publish the check at all. Soften one
+        // without the other and a deleted or renamed gate reports green while
+        // every pull request in the repository is blocked forever.
+        const gateRan = reported.some((name) => name.toLowerCase().startsWith('redline'));
+        if (required.length > 0 && missing.length > 0 && !gateRan) {
+            add('check-name-reported', true, machineryHealthy
+                ? `no gate run observed yet on PR #${pr} — open or update a pull request to see the gate report ` +
+                    `(the policy requires ${required.join(', ')})`
+                : `no Redline gate run has published anything on PR #${pr}'s head commit — see the ` +
+                    'gate-machinery finding for why');
+        }
+        else if (required.length > 0 && missing.length > 0) {
+            add('check-name-reported', false, `expected ${missing.join(', ')} but PR #${pr} only reported: ${reported.length > 0 ? reported.join(', ') : '(nothing)'} — ${missing.join(', ')} was never reported${
+            // Only a blocking policy blocks. Azure reports required checks off a
+            // Status policy that nothing queues a build for, and telling that
+            // operator every pull request is blocked sends them after the wrong
+            // half of the problem.
+            policy?.blocking === true ? ', so the policy will block every pull request in this repository' : ''}`);
+        }
+        else if (required.length > 0) {
+            add('check-name-reported', true, `required checks reported on PR #${pr}: ${required.join(', ')}`);
+        }
+        else {
+            add('check-name-reported', true, `${gateOwned && config.capabilities.mergePolicy
+                ? 'no required check configured yet (advisory gate)'
+                : // Only the two that decide whether a required check of Redline's
+                    // could exist at all. Naming the rest of the selection here would
+                    // point the reader at capabilities that have nothing to do with it.
+                    `no required check of Redline's — ${[
+                        ...(gateOwned ? [] : ['gate']),
+                        ...(config.capabilities.mergePolicy ? [] : ['merge-policy']),
+                    ].join(', ')} ${OFF_BY_CHOICE}`} — PR #${pr} reported: ${reported.length > 0 ? reported.join(', ') : '(nothing)'}`);
+        }
+    }
+    // Four states, not two — `applied`/`already` are positive answers and
+    // `denied` is a negative one; all three are definite. `unsupported` and
+    // `unknown` are the two ways nothing was answered, and they are not the
+    // same thing (Task 17). `unsupported` is ALSO definite — Advanced Security
+    // is unlicensed on this Azure repository, so no administrator action ever
+    // makes it appear, and it must never fail a plain `redline verify` the way
+    // a real gap does. `unknown` is the indeterminate one — GitHub omits
+    // security_and_analysis for a token without admin permission, and Azure's
+    // enablement endpoint cannot tell "you cannot see this" apart from a
+    // well-formed refusal — so "security floor enabled" must never be printed
+    // on the strength of it either. `--gate` has exactly one caller:
+    // platforms/azure/gate-template.yml, whose "Redline gate" step runs as
+    // `$(System.AccessToken)` — the build service identity, which is not a
+    // repository administrator and so is routinely refused the Advanced
+    // Security enablement endpoint. Failing there for what that identity
+    // structurally cannot see would block every pull request in the
+    // repository, and a gate that always fails is a gate nobody keeps, so the
+    // gate run is told what could not be checked without being failed for it.
+    // (workflows/verify-onboarding.yml, the fleet re-verification job, is
+    // `if: false` and still shells out to a deleted script — it invokes this
+    // CLI nowhere.) A `denied` capability fails in both modes; an `unsupported`
+    // one never fails either.
+    const security = await platform.readSecurityState(ref);
+    const off = security.outcomes.filter((o) => o.status === 'denied').map((o) => o.capability);
+    const unlicensed = security.outcomes
+        .filter((o) => o.status === 'unsupported')
+        .map((o) => o.capability);
+    const unobserved = security.outcomes
+        .filter((o) => o.status === 'unknown')
+        .map((o) => o.capability);
+    const unlicensedDetail = `not available on this repository: ${unlicensed.join(', ')}`;
+    const unobservedDetail = `not confirmed: ${unobserved.join(', ')} — not visible to this token`;
+    add('security-floor', off.length === 0 && (unobserved.length === 0 || opts.gate === true), [
+        off.length > 0 ? `disabled: ${off.join(', ')}` : null,
+        unobserved.length > 0 ? unobservedDetail : null,
+        unlicensed.length > 0 ? unlicensedDetail : null,
+    ]
+        .filter((s) => s !== null)
+        .join('. ') || 'security floor enabled');
+    // Read-only: render() runs in check mode, which reports staleness without
+    // writing or touching the working tree.
+    const manifest = loadManifest(opts.root);
+    const rendered = render({
+        root: opts.root,
+        profile: config.profile,
+        out: opts.cwd,
+        vendors: config.vendors,
+        check: true,
+    });
+    const stale = rendered.stale;
+    // A repository's own rules file is not something the repository can be
+    // failing at: the artifacts trail it until the next render, which is work to
+    // do. The excuse is bounded three ways, because an unbounded one is a drift
+    // bypass in the oversight product itself — the local section is rendered into
+    // four artifacts, and every other managed file (each
+    // `.github/instructions/redline-*.instructions.md`, each per-stack
+    // `.cursor/rules/redline-*.mdc`) can never carry it, so "some stale artifact
+    // lacks the section" excused hand edits the local file had nothing to do
+    // with. It has to be per-path, it has to cover the WHOLE stale set, and a
+    // removal is never explained by a rules file at all.
+    const local = readLocalRules(opts.cwd);
+    const section = local === null ? null : localSection(local);
+    const explainedByLocalRules = (relPath) => {
+        if (!rendered.localRuleFiles.includes(relPath))
+            return false;
+        const path = join(opts.cwd, relPath);
+        if (!existsSync(path))
+            return false; // a missing artifact is stale for its own reason
+        const body = readFileSync(path, 'utf8');
+        // With a rules file present: the artifact does not yet carry the section
+        // this render would give it. With none: it still carries a section this
+        // render would take away — and only when the last run recorded one, which
+        // is what tells "had one and it went away" from a heading a human typed.
+        return section === null ? config.localRules && body.includes(LOCAL_HEADING) : !body.includes(section);
+    };
+    const localStale = stale.length > 0 &&
+        rendered.staleRemovals.length === 0 &&
+        rendered.staleWritten.every(explainedByLocalRules);
+    // Two different things look identical to render(): a repository someone
+    // edited by hand, and a repository the org has moved past. `render()` uses
+    // the *installed* CLI's standards, so every publish of standards/** made
+    // every onboarded repository stale at once — exit 1 everywhere, and a failed
+    // Azure gate on every open pull request, for work only `redline init` can
+    // do. The recorded standardsVersion is what tells them apart.
+    // Direction matters to the operator even though neither direction is drift:
+    // a newer version is a release to adopt, an older one is a pinned CLI
+    // rendering rules this repository has already moved past, and telling the
+    // second operator to re-run init would render the repository backwards.
+    const drift = versionOrder(manifest.version, config.standardsVersion);
+    add('artifacts-current', stale.length === 0 || drift !== 'same' || localStale, stale.length === 0
+        ? `rendered artifacts match standards v${manifest.version}`
+        : drift === 'newer'
+            ? `standards updated upstream (v${config.standardsVersion} → v${manifest.version}) — re-run redline init to adopt: ${stale.join(', ')}`
+            : drift === 'older'
+                ? `this CLI renders standards v${manifest.version}, older than the v${config.standardsVersion} this repository recorded — update the CLI rather than re-running init here: ${stale.join(', ')}`
+                : localStale
+                    ? `this repository's own ${LOCAL_RULES_FILE} has changed since the last render — re-run redline init to fold it in: ${stale.join(', ')}`
+                    : `stale: ${stale.join(', ')}`);
+    // The pull request template is the one thing `redline init` writes that
+    // `verify` could not see, so a repository whose template was deleted, or
+    // whose markers a human half-edited, or which grew an Azure branch template
+    // after onboarding, all looked healthy right up until the next init.
+    const templates = observePullRequestTemplates(platform.host, opts.cwd);
+    const mangled = templates.filter((t) => t.state === 'mangled');
+    const incomplete = templates.filter((t) => t.state === 'incomplete');
+    const describe = (t) => `${t.path}${t.branch ? ' (branch template)' : ''}`;
+    add('pull-request-template', !gateOwned || (templates.length > 0 && mangled.length === 0 && incomplete.length === 0), !gateOwned
+        ? `${OFF_BY_CHOICE} — the pull request template is part of the merge gate this repository declined`
+        : templates.length === 0
+            ? 'no pull request template — every pull request opens with an empty body, which the gate ' +
+                'fails for having no "## Launch readiness" section; run redline init to restore it'
+            : mangled.length > 0
+                ? `${mangled.map(describe).join(', ')} has a broken REDLINE:BEGIN/END marker pair — redline init ` +
+                    'refuses to write to it until a single pair is restored, so nothing here is being maintained'
+                : incomplete.length > 0
+                    ? `${incomplete
+                        .map((t) => `${describe(t)} does not answer ${t.missing.join(' or ')}`)
+                        .join('; ')} — the gate fails a pull request opened from it; run redline init`
+                    : templates
+                        .map((t) => `${describe(t)} — ${t.state === 'managed'
+                        ? 'maintained inside REDLINE markers'
+                        : "answers the gate on its own, so it stays the repository's own file"}`)
+                        .join('; '));
+    // pendingAdmin is a known, recorded state — not drift — so it gets its own
+    // check rather than folding into artifacts-current or security-floor. Every
+    // entry records one thing: `redline init` attempted a write and the host
+    // refused it. Nothing read here can clear that, so every clause below points
+    // at `redline init --repair`, the only run that retries a write a settled
+    // repository would otherwise never attempt again.
+    //
+    // Only a read that answered can produce work for an administrator, and the
+    // same rule the security-floor finding runs on applies here — but the two
+    // unanswered statuses need different advice, not just different wording.
+    // `unsupported` is definite: Advanced Security is not licensed here, so no
+    // administrator action would ever clear it. `unknown` is indeterminate: the
+    // token could not see the setting, and an administrator enabling it is
+    // exactly what clears it. Giving `unknown` the `unsupported` advice had this
+    // finding telling the operator nothing would help while security-floor, on
+    // the same repository, told them to retry with a token that can see it.
+    const statusOf = (capability) => security.outcomes.find((o) => o.capability === capability)?.status ?? null;
+    const withStatus = (...statuses) => config.pendingAdmin.filter((capability) => {
+        const status = statusOf(capability);
+        return status !== null && statuses.includes(status);
+    });
+    const grantedSince = withStatus('applied', 'already');
+    const stillPending = withStatus('denied');
+    // Observed, and the answer was definite: "not here to enable".
+    const unavailable = withStatus('unsupported');
+    // Observed, and nothing was learned.
+    const invisible = withStatus('unknown');
+    // Never read back at all: labels, review-ownership, repo-property, gate and
+    // merge-policy have no read side, so a record of one is exactly as true as
+    // the day it was written and no verify run will ever clear it.
+    const unverifiable = config.pendingAdmin.filter((capability) => statusOf(capability) === null);
+    const clauses = [
+        stillPending.length > 0 ? `an administrator must still enable: ${stillPending.join(', ')}` : null,
+        unavailable.length > 0
+            ? `recorded as pending, but not available on this repository, so no administrator action ` +
+                `would clear it: ${unavailable.join(', ')}`
+            : null,
+        invisible.length > 0
+            ? `recorded as pending and not visible to this token: ${invisible.join(', ')} — an ` +
+                `administrator enabling it is what clears this, so re-read with a token that can see the ` +
+                `setting, then run redline init --repair`
+            : null,
+        unverifiable.length > 0
+            ? `recorded as pending; not verifiable with this token: ${unverifiable.join(', ')} — after an ` +
+                `administrator grants access, a plain redline init will not recheck these; run redline init --repair`
+            : null,
+        grantedSince.length > 0
+            ? `${grantedSince.join(', ')} now granted on the host, but the record is of a refused write and ` +
+                `no read clears it — run redline init --repair to retry the write`
+            : null,
+    ].filter((s) => s !== null);
+    add('pending-admin', 
+    // The security-floor shape, for the same reason: `--gate` has one caller,
+    // the Azure gate template, running as a build service identity that cannot
+    // enable anything. Failing every pull request forever over a record only
+    // `redline init` can clear is a gate nobody keeps. An operator who asks
+    // whether onboarding finished is still told no, in both directions.
+    opts.gate === true ? stillPending.length === 0 : config.pendingAdmin.length === 0, config.pendingAdmin.length === 0
+        ? 'nothing awaiting an administrator'
+        : `partially onboarded — ${clauses.length > 0 ? clauses.join('. ') : 'nothing left outstanding'}`);
+    return { findings, ok: findings.every((f) => f.ok) };
+}
+//# sourceMappingURL=verify.js.map

package/dist/commands/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../cli/commands/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,GAEX,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EACL,2BAA2B,GAE5B,MAAM,wCAAwC,CAAC;AAQhD,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,eAAe;AACf,SAAS,YAAY,CAAC,SAAiB,EAAE,QAAgB;IACvD,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,OAAe,EAAY,EAAE,CAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC,CAAC;IACL,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,mCAAmC;AACnC,MAAM,aAAa,GAAG,eAAe,CAAC;AA2BtC,4EAA4E;AAC5E,4EAA4E;AAC5E,oEAAoE;AACpE,6EAA6E;AAC7E,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,WAA+C,EAC/C,IAAmB;IAEnB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAW,EAAE,MAAc,EAAQ,EAAE;QAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,GAAG,4CAA4C,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,MAAM,CAAC,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3F,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAE1E,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1E,GAAG,CACD,cAAc,EACd,IAAI,EACJ,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,GAAG,aAAa,gEAAgE,QAAQ,CAAC,IAAI,CAC3F,IAAI,CACL,GACC,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;YACtC,CAAC,CAAC,sFAAsF;gBACtF,yBAAyB;YAC3B,CAAC,CAAC,EACN,EAAE,CACP,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7C,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;IAC3C,oEAAoE;IACpE,0EAA0E;IAC1E,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ,CAAC;IAE1F,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,YAAY,GAChB,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW;QAChC,MAAM,CAAC,IAAI,CAAC,YAAY;QACxB,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChD,MAAM,MAAM,GACV,MAAM,CAAC,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,kBAAkB,GAAG,YAAY,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC9E,MAAM,gBAAgB,GAAG,kBAAkB,IAAI,CAAC,iBAAiB,CAAC;IAElE,uEAAuE;IACvE,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,iBAAiB,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,OAAO,GAAG,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,OAAsB,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CACX,aAAa,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,iBACpD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAC1C,EAAE,CACH,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,iBAAiB,GAAG,iBAAiB,EAAE,CAAC;YAC/E,QAAQ,CAAC,IAAI,CACX,eAAe,MAAM,CAAC,iBAAiB,2BAA2B,iBAAiB,uBAAuB,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CACX,6FAA6F;gBAC3F,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IACE,KAAK,CAAC,wBAAwB,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,sBAAsB;YAClC,CAAC,MAAM,CAAC,sBAAsB,EAC9B,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,GAAG,CACD,cAAc,EACd,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAC9F,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW;QAC9B,CAAC,CAAC,gBAAgB;YAChB,CAAC,CAAC,6EAA6E;gBAC7E,GAAG,SAAS,CAAC,QAAQ,oEAAoE;gBACzF,4EAA4E;YAC9E,CAAC,CAAC,kBAAkB;gBAClB,CAAC,CAAC,GAAG,aAAa,oEAAoE;oBACpF,kBAAkB,SAAS,CAAC,QAAQ,WAAW,SAAS,CAAC,IAAI,uBAAuB;oBACpF,0EAA0E;gBAC5E,CAAC,CAAC,GAAG,aAAa,4EAA4E;oBAC5F,mBAAmB;QACzB,CAAC,CAAC,MAAM,KAAK,IAAI;YACf,CAAC,CAAC,uFAAuF;gBACvF,uFAAuF;gBACvF,+EAA+E;YACjF,CAAC,CAAC,GACA,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACjB,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,mBACpD,MAAM,CAAC,iBACT,mCAAmC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE;gBACnF,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CACxB,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClF,CAAC;IAEF,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC;IACpD,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ,CAAC;IAC3F,MAAM,WAAW,GACf,SAAS,CAAC,SAAS,KAAK,IAAI;QAC5B,CAAC,OAAO;QACR,cAAc,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC;IACvG,GAAG,CACD,gBAAgB,EAChB,CAAC,SAAS,IAAI,gBAAgB,EAC9B,CAAC,SAAS;QACR,CAAC,CAAC,SAAS,CAAC,OAAO;YACjB,CAAC,CAAC,qEAAqE;gBACrE,sEAAsE;gBACtE,qEAAqE;gBACrE,mEAAmE;gBACnE,oEAAoE;gBACpE,mEAAmE;gBACnE,+CAA+C;gBAC/C,GAAG,aAAa,mDAAmD,SAAS,CAAC,IAAI,QAAQ;oBACzF,uDAAuD,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,EAAE;oBAClG,GACE,kBAAkB;wBAChB,CAAC,CAAC,8EAA8E;wBAChF,CAAC,CAAC,iCACN,EAAE;YACJ,CAAC,CAAC,GAAG,aAAa,4EAA4E;gBAC5F,MAAM,SAAS,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;YAClB,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,4DAA4D,SAAS,CAAC,QAAQ,EAAE;gBACjG,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtF,uBAAuB;YACzB,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI;gBAC5B,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,wBAAwB,SAAS,CAAC,QAAQ,kCAAkC;oBAC7F,6FAA6F;gBAC/F,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,cAAc,SAAS,CAAC,SAAS,gBAAgB,SAAS,CAAC,QAAQ,UAAU;wBAC9F,gGAAgG;oBAClG,CAAC,CAAC,WAAW;wBACX,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,cAAc,SAAS,CAAC,QAAQ,yCAAyC;4BAC1F,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,gEAAgE;4BAC5F,iCAAiC;wBACnC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,cAAc,SAAS,CAAC,SAAS,EAAE,CACjE,CAAC;IAEF,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,cAAc,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,iEAAiE;QACjE,0EAA0E;QAC1E,sEAAsE;QACtE,2DAA2D;QAC3D,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1D,GAAG,CACD,qBAAqB,EACrB,IAAI,EACJ,gBAAgB;gBACd,CAAC,CAAC,mCAAmC,EAAE,0DAA0D;oBAC/F,wBAAwB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAChD,CAAC,CAAC,qDAAqD,EAAE,2BAA2B;oBAClF,gCAAgC,CACrC,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,GAAG,CACD,qBAAqB,EACrB,KAAK,EACL,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,mBAC1C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAC9C,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;YAC5C,qEAAqE;YACrE,kEAAkE;YAClE,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,EACnG,EAAE,CACH,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;aAAM,CAAC;YACN,GAAG,CACD,qBAAqB,EACrB,IAAI,EACJ,GACE,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW;gBAC1C,CAAC,CAAC,kDAAkD;gBACpD,CAAC,CAAC,iEAAiE;oBACjE,kEAAkE;oBAClE,oEAAoE;oBACpE,oCAAoC;wBAClC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBAC9B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;qBAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,EACnC,UAAU,EAAE,cAAc,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,gEAAgE;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5B,MAAM,gBAAgB,GAAG,qCAAqC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACtF,MAAM,gBAAgB,GAAG,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAC/F,GAAG,CACD,gBAAgB,EAChB,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EACnE;QACE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QACrD,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;QAC/C,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;KAChD;SACE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAC1C,CAAC;IAEF,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,qDAAqD;IACrD,mEAAmE;IACnE,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,qBAAqB,GAAG,CAAC,OAAe,EAAW,EAAE;QACzD,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,iDAAiD;QACtF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxG,CAAC,CAAC;IACF,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QACnC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACrD,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,8DAA8D;IAC9D,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACtE,GAAG,CACD,mBAAmB,EACnB,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,IAAI,UAAU,EACpD,KAAK,CAAC,MAAM,KAAK,CAAC;QAChB,CAAC,CAAC,uCAAuC,QAAQ,CAAC,OAAO,EAAE;QAC3D,CAAC,CAAC,KAAK,KAAK,OAAO;YACjB,CAAC,CAAC,gCAAgC,MAAM,CAAC,gBAAgB,OAAO,QAAQ,CAAC,OAAO,qCAAqC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACvI,CAAC,CAAC,KAAK,KAAK,OAAO;gBACjB,CAAC,CAAC,+BAA+B,QAAQ,CAAC,OAAO,qBAAqB,MAAM,CAAC,gBAAgB,gFAAgF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC/L,CAAC,CAAC,UAAU;oBACV,CAAC,CAAC,yBAAyB,gBAAgB,2EAA2E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACxI,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvC,CAAC;IAEF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,CAAC,CAAsB,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxG,GAAG,CACD,uBAAuB,EACvB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EACvF,CAAC,SAAS;QACR,CAAC,CAAC,GAAG,aAAa,iFAAiF;QACnG,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,yFAAyF;gBACzF,mFAAmF;YACrF,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClB,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D;oBAChG,6FAA6F;gBAC/F,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBACrB,CAAC,CAAC,GAAG,UAAU;yBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;yBACtE,IAAI,CAAC,IAAI,CAAC,mEAAmE;oBAClF,CAAC,CAAC,SAAS;yBACN,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,QAAQ,CAAC,CAAC,CAAC,MACZ,CAAC,CAAC,KAAK,KAAK,SAAS;wBACnB,CAAC,CAAC,mCAAmC;wBACrC,CAAC,CAAC,oEACN,EAAE,CACL;yBACA,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IAEF,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,kDAAkD;IAClD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,CAAC,UAA2B,EAAsC,EAAE,CACnF,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IAC7E,MAAM,UAAU,GAAG,CAAC,GAAG,QAAuC,EAAqB,EAAE,CACnF,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpC,OAAO,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACL,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9C,qCAAqC;IACrC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,4EAA4E;IAC5E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG;QACd,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,uCAAuC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QACjG,WAAW,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,CAAC,wFAAwF;gBACxF,mBAAmB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC7C,CAAC,CAAC,IAAI;QACR,SAAS,CAAC,MAAM,GAAG,CAAC;YAClB,CAAC,CAAC,sDAAsD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAClF,0FAA0F;gBAC1F,yCAAyC;YAC3C,CAAC,CAAC,IAAI;QACR,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,wDAAwD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAC7F,qGAAqG;YACvG,CAAC,CAAC,IAAI;QACR,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE;gBAC/F,kEAAkE;YACpE,CAAC,CAAC,IAAI;KACT,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,GAAG,CACD,eAAe;IACf,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EACjF,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,mCAAmC;QACrC,CAAC,CAAC,yBAAyB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B,EAAE,CACpG,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}