diff --git a/action.yml b/action.yml
index 3e24ba5..0c06fe0 100644
--- a/action.yml
+++ b/action.yml
@@ -38,6 +38,12 @@ outputs:
     description: 'SHA-256 canonical digest of the final evaluation receipt.'
   summary-markdown:
     description: 'Human-readable markdown summary of the evaluation findings.'
+  target-kind:
+    description: 'Evaluation target kind (head, merge, or merge_group).'
+  tested-sha:
+    description: 'Exact commit SHA evaluated and used as the Check Run head_sha.'
+  head-sha:
+    description: 'Exact pull-request head SHA recorded in the evaluation.'
 
 runs:
   using: 'node24'
diff --git a/dist/action/index.js b/dist/action/index.js
index e5ad2b6..3d23258 100644
--- a/dist/action/index.js
+++ b/dist/action/index.js
@@ -4,4 +4,4 @@ import{createRequire as e}from"module";var t={2210:(e,t,r)=>{Object.defineProper
               || ${a} === "boolean" || ${s} === null`).assign(c,(0,o._)`[${s}]`)}}}function assignParentData({gen:e,parentData:t,parentDataProperty:r},n){e.if((0,o._)`${t} !== undefined`,()=>e.assign((0,o._)`${t}[${r}]`,n))}function checkDataType(e,t,r,n=c.Correct){const s=n===c.Correct?o.operators.EQ:o.operators.NEQ;let i;switch(e){case"null":return(0,o._)`${t} ${s} null`;case"array":i=(0,o._)`Array.isArray(${t})`;break;case"object":i=(0,o._)`${t} && typeof ${t} == "object" && !Array.isArray(${t})`;break;case"integer":i=numCond((0,o._)`!(${t} % 1) && !isNaN(${t})`);break;case"number":i=numCond();break;default:return(0,o._)`typeof ${t} ${s} ${e}`}return n===c.Correct?i:(0,o.not)(i);function numCond(e=o.nil){return(0,o.and)((0,o._)`typeof ${t} == "number"`,e,r?(0,o._)`isFinite(${t})`:o.nil)}}t.checkDataType=checkDataType;function checkDataTypes(e,t,r,n){if(e.length===1){return checkDataType(e[0],t,r,n)}let s;const i=(0,a.toHash)(e);if(i.array&&i.object){const e=(0,o._)`typeof ${t} != "object"`;s=i.null?e:(0,o._)`!${t} || ${e}`;delete i.null;delete i.array;delete i.object}else{s=o.nil}if(i.number)delete i.integer;for(const e in i)s=(0,o.and)(s,checkDataType(e,t,r,n));return s}t.checkDataTypes=checkDataTypes;const d={message:({schema:e})=>`must be ${e}`,params:({schema:e,schemaValue:t})=>typeof e=="string"?(0,o._)`{type: ${e}}`:(0,o._)`{type: ${t}}`};function reportTypeError(e){const t=getTypeErrorContext(e);(0,i.reportError)(t,d)}t.reportTypeError=reportTypeError;function getTypeErrorContext(e){const{gen:t,data:r,schema:n}=e;const s=(0,a.schemaRefOrVal)(e,n,"type");return{gen:t,keyword:"type",data:r,schema:n.type,schemaCode:s,schemaValue:s,parentSchema:n,params:{},it:e}}},1699:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.assignDefaults=void 0;const n=r(1436);const s=r(4464);function assignDefaults(e,t){const{properties:r,items:n}=e.schema;if(t==="object"&&r){for(const t in r){assignDefault(e,t,r[t].default)}}else if(t==="array"&&Array.isArray(n)){n.forEach((t,r)=>assignDefault(e,r,t.default))}}t.assignDefaults=assignDefaults;function assignDefault(e,t,r){const{gen:i,compositeRule:o,data:a,opts:c}=e;if(r===undefined)return;const u=(0,n._)`${a}${(0,n.getProperty)(t)}`;if(o){(0,s.checkStrictMode)(e,`default is ignored for: ${u}`);return}let d=(0,n._)`${u} === undefined`;if(c.useDefaults==="empty"){d=(0,n._)`${d} || ${u} === null || ${u} === ""`}i.if(d,(0,n._)`${u} = ${(0,n.stringify)(r)}`)}},7881:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.getData=t.KeywordCxt=t.validateFunctionCode=void 0;const n=r(5346);const s=r(6685);const i=r(7692);const o=r(6685);const a=r(1699);const c=r(5202);const u=r(6200);const d=r(1436);const l=r(630);const p=r(4090);const f=r(4464);const h=r(1283);function validateFunctionCode(e){if(isSchemaObj(e)){checkKeywords(e);if(schemaCxtHasRules(e)){topSchemaObjCode(e);return}}validateFunction(e,()=>(0,n.topBoolOrEmptySchema)(e))}t.validateFunctionCode=validateFunctionCode;function validateFunction({gen:e,validateName:t,schema:r,schemaEnv:n,opts:s},i){if(s.code.es5){e.func(t,(0,d._)`${l.default.data}, ${l.default.valCxt}`,n.$async,()=>{e.code((0,d._)`"use strict"; ${funcSourceUrl(r,s)}`);destructureValCxtES5(e,s);e.code(i)})}else{e.func(t,(0,d._)`${l.default.data}, ${destructureValCxt(s)}`,n.$async,()=>e.code(funcSourceUrl(r,s)).code(i))}}function destructureValCxt(e){return(0,d._)`{${l.default.instancePath}="", ${l.default.parentData}, ${l.default.parentDataProperty}, ${l.default.rootData}=${l.default.data}${e.dynamicRef?(0,d._)`, ${l.default.dynamicAnchors}={}`:d.nil}}={}`}function destructureValCxtES5(e,t){e.if(l.default.valCxt,()=>{e.var(l.default.instancePath,(0,d._)`${l.default.valCxt}.${l.default.instancePath}`);e.var(l.default.parentData,(0,d._)`${l.default.valCxt}.${l.default.parentData}`);e.var(l.default.parentDataProperty,(0,d._)`${l.default.valCxt}.${l.default.parentDataProperty}`);e.var(l.default.rootData,(0,d._)`${l.default.valCxt}.${l.default.rootData}`);if(t.dynamicRef)e.var(l.default.dynamicAnchors,(0,d._)`${l.default.valCxt}.${l.default.dynamicAnchors}`)},()=>{e.var(l.default.instancePath,(0,d._)`""`);e.var(l.default.parentData,(0,d._)`undefined`);e.var(l.default.parentDataProperty,(0,d._)`undefined`);e.var(l.default.rootData,l.default.data);if(t.dynamicRef)e.var(l.default.dynamicAnchors,(0,d._)`{}`)})}function topSchemaObjCode(e){const{schema:t,opts:r,gen:n}=e;validateFunction(e,()=>{if(r.$comment&&t.$comment)commentKeyword(e);checkNoDefault(e);n.let(l.default.vErrors,null);n.let(l.default.errors,0);if(r.unevaluated)resetEvaluated(e);typeAndKeywords(e);returnResults(e)});return}function resetEvaluated(e){const{gen:t,validateName:r}=e;e.evaluated=t.const("evaluated",(0,d._)`${r}.evaluated`);t.if((0,d._)`${e.evaluated}.dynamicProps`,()=>t.assign((0,d._)`${e.evaluated}.props`,(0,d._)`undefined`));t.if((0,d._)`${e.evaluated}.dynamicItems`,()=>t.assign((0,d._)`${e.evaluated}.items`,(0,d._)`undefined`))}function funcSourceUrl(e,t){const r=typeof e=="object"&&e[t.schemaId];return r&&(t.code.source||t.code.process)?(0,d._)`/*# sourceURL=${r} */`:d.nil}function subschemaCode(e,t){if(isSchemaObj(e)){checkKeywords(e);if(schemaCxtHasRules(e)){subSchemaObjCode(e,t);return}}(0,n.boolOrEmptySchema)(e,t)}function schemaCxtHasRules({schema:e,self:t}){if(typeof e=="boolean")return!e;for(const r in e)if(t.RULES.all[r])return true;return false}function isSchemaObj(e){return typeof e.schema!="boolean"}function subSchemaObjCode(e,t){const{schema:r,gen:n,opts:s}=e;if(s.$comment&&r.$comment)commentKeyword(e);updateContext(e);checkAsyncSchema(e);const i=n.const("_errs",l.default.errors);typeAndKeywords(e,i);n.var(t,(0,d._)`${i} === ${l.default.errors}`)}function checkKeywords(e){(0,f.checkUnknownRules)(e);checkRefsAndKeywords(e)}function typeAndKeywords(e,t){if(e.opts.jtd)return schemaKeywords(e,[],false,t);const r=(0,s.getSchemaTypes)(e.schema);const n=(0,s.coerceAndCheckDataType)(e,r);schemaKeywords(e,r,!n,t)}function checkRefsAndKeywords(e){const{schema:t,errSchemaPath:r,opts:n,self:s}=e;if(t.$ref&&n.ignoreKeywordsWithRef&&(0,f.schemaHasRulesButRef)(t,s.RULES)){s.logger.warn(`$ref: keywords ignored in schema at path "${r}"`)}}function checkNoDefault(e){const{schema:t,opts:r}=e;if(t.default!==undefined&&r.useDefaults&&r.strictSchema){(0,f.checkStrictMode)(e,"default is ignored in the schema root")}}function updateContext(e){const t=e.schema[e.opts.schemaId];if(t)e.baseId=(0,p.resolveUrl)(e.opts.uriResolver,e.baseId,t)}function checkAsyncSchema(e){if(e.schema.$async&&!e.schemaEnv.$async)throw new Error("async schema in sync schema")}function commentKeyword({gen:e,schemaEnv:t,schema:r,errSchemaPath:n,opts:s}){const i=r.$comment;if(s.$comment===true){e.code((0,d._)`${l.default.self}.logger.log(${i})`)}else if(typeof s.$comment=="function"){const r=(0,d.str)`${n}/$comment`;const s=e.scopeValue("root",{ref:t.root});e.code((0,d._)`${l.default.self}.opts.$comment(${i}, ${r}, ${s}.schema)`)}}function returnResults(e){const{gen:t,schemaEnv:r,validateName:n,ValidationError:s,opts:i}=e;if(r.$async){t.if((0,d._)`${l.default.errors} === 0`,()=>t.return(l.default.data),()=>t.throw((0,d._)`new ${s}(${l.default.vErrors})`))}else{t.assign((0,d._)`${n}.errors`,l.default.vErrors);if(i.unevaluated)assignEvaluated(e);t.return((0,d._)`${l.default.errors} === 0`)}}function assignEvaluated({gen:e,evaluated:t,props:r,items:n}){if(r instanceof d.Name)e.assign((0,d._)`${t}.props`,r);if(n instanceof d.Name)e.assign((0,d._)`${t}.items`,n)}function schemaKeywords(e,t,r,n){const{gen:s,schema:a,data:c,allErrors:u,opts:p,self:h}=e;const{RULES:m}=h;if(a.$ref&&(p.ignoreKeywordsWithRef||!(0,f.schemaHasRulesButRef)(a,m))){s.block(()=>keywordCode(e,"$ref",m.all.$ref.definition));return}if(!p.jtd)checkStrictTypes(e,t);s.block(()=>{for(const e of m.rules)groupKeywords(e);groupKeywords(m.post)});function groupKeywords(f){if(!(0,i.shouldUseGroup)(a,f))return;if(f.type){s.if((0,o.checkDataType)(f.type,c,p.strictNumbers));iterateKeywords(e,f);if(t.length===1&&t[0]===f.type&&r){s.else();(0,o.reportTypeError)(e)}s.endIf()}else{iterateKeywords(e,f)}if(!u)s.if((0,d._)`${l.default.errors} === ${n||0}`)}}function iterateKeywords(e,t){const{gen:r,schema:n,opts:{useDefaults:s}}=e;if(s)(0,a.assignDefaults)(e,t.type);r.block(()=>{for(const r of t.rules){if((0,i.shouldUseRule)(n,r)){keywordCode(e,r.keyword,r.definition,t.type)}}})}function checkStrictTypes(e,t){if(e.schemaEnv.meta||!e.opts.strictTypes)return;checkContextTypes(e,t);if(!e.opts.allowUnionTypes)checkMultipleTypes(e,t);checkKeywordTypes(e,e.dataTypes)}function checkContextTypes(e,t){if(!t.length)return;if(!e.dataTypes.length){e.dataTypes=t;return}t.forEach(t=>{if(!includesType(e.dataTypes,t)){strictTypesError(e,`type "${t}" not allowed by context "${e.dataTypes.join(",")}"`)}});narrowSchemaTypes(e,t)}function checkMultipleTypes(e,t){if(t.length>1&&!(t.length===2&&t.includes("null"))){strictTypesError(e,"use allowUnionTypes to allow union type keyword")}}function checkKeywordTypes(e,t){const r=e.self.RULES.all;for(const n in r){const s=r[n];if(typeof s=="object"&&(0,i.shouldUseRule)(e.schema,s)){const{type:r}=s.definition;if(r.length&&!r.some(e=>hasApplicableType(t,e))){strictTypesError(e,`missing type "${r.join(",")}" for keyword "${n}"`)}}}}function hasApplicableType(e,t){return e.includes(t)||t==="number"&&e.includes("integer")}function includesType(e,t){return e.includes(t)||t==="integer"&&e.includes("number")}function narrowSchemaTypes(e,t){const r=[];for(const n of e.dataTypes){if(includesType(t,n))r.push(n);else if(t.includes("integer")&&n==="number")r.push("integer")}e.dataTypes=r}function strictTypesError(e,t){const r=e.schemaEnv.baseId+e.errSchemaPath;t+=` at "${r}" (strictTypes)`;(0,f.checkStrictMode)(e,t,e.opts.strictTypes)}class KeywordCxt{constructor(e,t,r){(0,c.validateKeywordUsage)(e,t,r);this.gen=e.gen;this.allErrors=e.allErrors;this.keyword=r;this.data=e.data;this.schema=e.schema[r];this.$data=t.$data&&e.opts.$data&&this.schema&&this.schema.$data;this.schemaValue=(0,f.schemaRefOrVal)(e,this.schema,r,this.$data);this.schemaType=t.schemaType;this.parentSchema=e.schema;this.params={};this.it=e;this.def=t;if(this.$data){this.schemaCode=e.gen.const("vSchema",getData(this.$data,e))}else{this.schemaCode=this.schemaValue;if(!(0,c.validSchemaType)(this.schema,t.schemaType,t.allowUndefined)){throw new Error(`${r} value must be ${JSON.stringify(t.schemaType)}`)}}if("code"in t?t.trackErrors:t.errors!==false){this.errsCount=e.gen.const("_errs",l.default.errors)}}result(e,t,r){this.failResult((0,d.not)(e),t,r)}failResult(e,t,r){this.gen.if(e);if(r)r();else this.error();if(t){this.gen.else();t();if(this.allErrors)this.gen.endIf()}else{if(this.allErrors)this.gen.endIf();else this.gen.else()}}pass(e,t){this.failResult((0,d.not)(e),undefined,t)}fail(e){if(e===undefined){this.error();if(!this.allErrors)this.gen.if(false);return}this.gen.if(e);this.error();if(this.allErrors)this.gen.endIf();else this.gen.else()}fail$data(e){if(!this.$data)return this.fail(e);const{schemaCode:t}=this;this.fail((0,d._)`${t} !== undefined && (${(0,d.or)(this.invalid$data(),e)})`)}error(e,t,r){if(t){this.setParams(t);this._error(e,r);this.setParams({});return}this._error(e,r)}_error(e,t){(e?h.reportExtraError:h.reportError)(this,this.def.error,t)}$dataError(){(0,h.reportError)(this,this.def.$dataError||h.keyword$DataError)}reset(){if(this.errsCount===undefined)throw new Error('add "trackErrors" to keyword definition');(0,h.resetErrorsCount)(this.gen,this.errsCount)}ok(e){if(!this.allErrors)this.gen.if(e)}setParams(e,t){if(t)Object.assign(this.params,e);else this.params=e}block$data(e,t,r=d.nil){this.gen.block(()=>{this.check$data(e,r);t()})}check$data(e=d.nil,t=d.nil){if(!this.$data)return;const{gen:r,schemaCode:n,schemaType:s,def:i}=this;r.if((0,d.or)((0,d._)`${n} === undefined`,t));if(e!==d.nil)r.assign(e,true);if(s.length||i.validateSchema){r.elseIf(this.invalid$data());this.$dataError();if(e!==d.nil)r.assign(e,false)}r.else()}invalid$data(){const{gen:e,schemaCode:t,schemaType:r,def:n,it:s}=this;return(0,d.or)(wrong$DataType(),invalid$DataSchema());function wrong$DataType(){if(r.length){if(!(t instanceof d.Name))throw new Error("ajv implementation error");const e=Array.isArray(r)?r:[r];return(0,d._)`${(0,o.checkDataTypes)(e,t,s.opts.strictNumbers,o.DataType.Wrong)}`}return d.nil}function invalid$DataSchema(){if(n.validateSchema){const r=e.scopeValue("validate$data",{ref:n.validateSchema});return(0,d._)`!${r}(${t})`}return d.nil}}subschema(e,t){const r=(0,u.getSubschema)(this.it,e);(0,u.extendSubschemaData)(r,this.it,e);(0,u.extendSubschemaMode)(r,e);const n={...this.it,...r,items:undefined,props:undefined};subschemaCode(n,t);return n}mergeEvaluated(e,t){const{it:r,gen:n}=this;if(!r.opts.unevaluated)return;if(r.props!==true&&e.props!==undefined){r.props=f.mergeEvaluated.props(n,e.props,r.props,t)}if(r.items!==true&&e.items!==undefined){r.items=f.mergeEvaluated.items(n,e.items,r.items,t)}}mergeValidEvaluated(e,t){const{it:r,gen:n}=this;if(r.opts.unevaluated&&(r.props!==true||r.items!==true)){n.if(t,()=>this.mergeEvaluated(e,d.Name));return true}}}t.KeywordCxt=KeywordCxt;function keywordCode(e,t,r,n){const s=new KeywordCxt(e,r,t);if("code"in r){r.code(s,n)}else if(s.$data&&r.validate){(0,c.funcKeywordCode)(s,r)}else if("macro"in r){(0,c.macroKeywordCode)(s,r)}else if(r.compile||r.validate){(0,c.funcKeywordCode)(s,r)}}const m=/^\/(?:[^~]|~0|~1)*$/;const g=/^([0-9]+)(#|\/(?:[^~]|~0|~1)*)?$/;function getData(e,{dataLevel:t,dataNames:r,dataPathArr:n}){let s;let i;if(e==="")return l.default.rootData;if(e[0]==="/"){if(!m.test(e))throw new Error(`Invalid JSON-pointer: ${e}`);s=e;i=l.default.rootData}else{const o=g.exec(e);if(!o)throw new Error(`Invalid JSON-pointer: ${e}`);const a=+o[1];s=o[2];if(s==="#"){if(a>=t)throw new Error(errorMsg("property/index",a));return n[t-a]}if(a>t)throw new Error(errorMsg("data",a));i=r[t-a];if(!s)return i}let o=i;const a=s.split("/");for(const e of a){if(e){i=(0,d._)`${i}${(0,d.getProperty)((0,f.unescapeJsonPointer)(e))}`;o=(0,d._)`${o} && ${i}`}}return o;function errorMsg(e,r){return`Cannot access ${e} ${r} levels up, current level is ${t}`}}t.getData=getData},5202:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.validateKeywordUsage=t.validSchemaType=t.funcKeywordCode=t.macroKeywordCode=void 0;const n=r(1436);const s=r(630);const i=r(8484);const o=r(1283);function macroKeywordCode(e,t){const{gen:r,keyword:s,schema:i,parentSchema:o,it:a}=e;const c=t.macro.call(a.self,i,o,a);const u=useKeyword(r,s,c);if(a.opts.validateSchema!==false)a.self.validateSchema(c,true);const d=r.name("valid");e.subschema({schema:c,schemaPath:n.nil,errSchemaPath:`${a.errSchemaPath}/${s}`,topSchemaRef:u,compositeRule:true},d);e.pass(d,()=>e.error(true))}t.macroKeywordCode=macroKeywordCode;function funcKeywordCode(e,t){var r;const{gen:o,keyword:a,schema:c,parentSchema:u,$data:d,it:l}=e;checkAsyncKeyword(l,t);const p=!d&&t.compile?t.compile.call(l.self,c,u,l):t.validate;const f=useKeyword(o,a,p);const h=o.let("valid");e.block$data(h,validateKeyword);e.ok((r=t.valid)!==null&&r!==void 0?r:h);function validateKeyword(){if(t.errors===false){assignValid();if(t.modifying)modifyData(e);reportErrs(()=>e.error())}else{const r=t.async?validateAsync():validateSync();if(t.modifying)modifyData(e);reportErrs(()=>addErrs(e,r))}}function validateAsync(){const e=o.let("ruleErrs",null);o.try(()=>assignValid((0,n._)`await `),t=>o.assign(h,false).if((0,n._)`${t} instanceof ${l.ValidationError}`,()=>o.assign(e,(0,n._)`${t}.errors`),()=>o.throw(t)));return e}function validateSync(){const e=(0,n._)`${f}.errors`;o.assign(e,null);assignValid(n.nil);return e}function assignValid(r=(t.async?(0,n._)`await `:n.nil)){const a=l.opts.passContext?s.default.this:s.default.self;const c=!("compile"in t&&!d||t.schema===false);o.assign(h,(0,n._)`${r}${(0,i.callValidateCode)(e,f,a,c)}`,t.modifying)}function reportErrs(e){var r;o.if((0,n.not)((r=t.valid)!==null&&r!==void 0?r:h),e)}}t.funcKeywordCode=funcKeywordCode;function modifyData(e){const{gen:t,data:r,it:s}=e;t.if(s.parentData,()=>t.assign(r,(0,n._)`${s.parentData}[${s.parentDataProperty}]`))}function addErrs(e,t){const{gen:r}=e;r.if((0,n._)`Array.isArray(${t})`,()=>{r.assign(s.default.vErrors,(0,n._)`${s.default.vErrors} === null ? ${t} : ${s.default.vErrors}.concat(${t})`).assign(s.default.errors,(0,n._)`${s.default.vErrors}.length`);(0,o.extendErrors)(e)},()=>e.error())}function checkAsyncKeyword({schemaEnv:e},t){if(t.async&&!e.$async)throw new Error("async keyword in sync schema")}function useKeyword(e,t,r){if(r===undefined)throw new Error(`keyword "${t}" failed to compile`);return e.scopeValue("keyword",typeof r=="function"?{ref:r}:{ref:r,code:(0,n.stringify)(r)})}function validSchemaType(e,t,r=false){return!t.length||t.some(t=>t==="array"?Array.isArray(e):t==="object"?e&&typeof e=="object"&&!Array.isArray(e):typeof e==t||r&&typeof e=="undefined")}t.validSchemaType=validSchemaType;function validateKeywordUsage({schema:e,opts:t,self:r,errSchemaPath:n},s,i){if(Array.isArray(s.keyword)?!s.keyword.includes(i):s.keyword!==i){throw new Error("ajv implementation error")}const o=s.dependencies;if(o===null||o===void 0?void 0:o.some(t=>!Object.prototype.hasOwnProperty.call(e,t))){throw new Error(`parent schema must have dependencies of ${i}: ${o.join(",")}`)}if(s.validateSchema){const o=s.validateSchema(e[i]);if(!o){const e=`keyword "${i}" value is invalid at path "${n}": `+r.errorsText(s.validateSchema.errors);if(t.validateSchema==="log")r.logger.error(e);else throw new Error(e)}}}t.validateKeywordUsage=validateKeywordUsage},6200:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.extendSubschemaMode=t.extendSubschemaData=t.getSubschema=void 0;const n=r(1436);const s=r(4464);function getSubschema(e,{keyword:t,schemaProp:r,schema:i,schemaPath:o,errSchemaPath:a,topSchemaRef:c}){if(t!==undefined&&i!==undefined){throw new Error('both "keyword" and "schema" passed, only one allowed')}if(t!==undefined){const i=e.schema[t];return r===undefined?{schema:i,schemaPath:(0,n._)`${e.schemaPath}${(0,n.getProperty)(t)}`,errSchemaPath:`${e.errSchemaPath}/${t}`}:{schema:i[r],schemaPath:(0,n._)`${e.schemaPath}${(0,n.getProperty)(t)}${(0,n.getProperty)(r)}`,errSchemaPath:`${e.errSchemaPath}/${t}/${(0,s.escapeFragment)(r)}`}}if(i!==undefined){if(o===undefined||a===undefined||c===undefined){throw new Error('"schemaPath", "errSchemaPath" and "topSchemaRef" are required with "schema"')}return{schema:i,schemaPath:o,topSchemaRef:c,errSchemaPath:a}}throw new Error('either "keyword" or "schema" must be passed')}t.getSubschema=getSubschema;function extendSubschemaData(e,t,{dataProp:r,dataPropType:i,data:o,dataTypes:a,propertyName:c}){if(o!==undefined&&r!==undefined){throw new Error('both "data" and "dataProp" passed, only one allowed')}const{gen:u}=t;if(r!==undefined){const{errorPath:o,dataPathArr:a,opts:c}=t;const d=u.let("data",(0,n._)`${t.data}${(0,n.getProperty)(r)}`,true);dataContextProps(d);e.errorPath=(0,n.str)`${o}${(0,s.getErrorPath)(r,i,c.jsPropertySyntax)}`;e.parentDataProperty=(0,n._)`${r}`;e.dataPathArr=[...a,e.parentDataProperty]}if(o!==undefined){const t=o instanceof n.Name?o:u.let("data",o,true);dataContextProps(t);if(c!==undefined)e.propertyName=c}if(a)e.dataTypes=a;function dataContextProps(r){e.data=r;e.dataLevel=t.dataLevel+1;e.dataTypes=[];t.definedProperties=new Set;e.parentData=t.data;e.dataNames=[...t.dataNames,r]}}t.extendSubschemaData=extendSubschemaData;function extendSubschemaMode(e,{jtdDiscriminator:t,jtdMetadata:r,compositeRule:n,createErrors:s,allErrors:i}){if(n!==undefined)e.compositeRule=n;if(s!==undefined)e.createErrors=s;if(i!==undefined)e.allErrors=i;e.jtdDiscriminator=t;e.jtdMetadata=r}t.extendSubschemaMode=extendSubschemaMode},3893:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.CodeGen=t.Name=t.nil=t.stringify=t.str=t._=t.KeywordCxt=void 0;var n=r(7881);Object.defineProperty(t,"KeywordCxt",{enumerable:true,get:function(){return n.KeywordCxt}});var s=r(1436);Object.defineProperty(t,"_",{enumerable:true,get:function(){return s._}});Object.defineProperty(t,"str",{enumerable:true,get:function(){return s.str}});Object.defineProperty(t,"stringify",{enumerable:true,get:function(){return s.stringify}});Object.defineProperty(t,"nil",{enumerable:true,get:function(){return s.nil}});Object.defineProperty(t,"Name",{enumerable:true,get:function(){return s.Name}});Object.defineProperty(t,"CodeGen",{enumerable:true,get:function(){return s.CodeGen}});const i=r(3021);const o=r(3162);const a=r(7353);const c=r(2718);const u=r(1436);const d=r(4090);const l=r(6685);const p=r(4464);const f=r(3837);const h=r(6285);const defaultRegExp=(e,t)=>new RegExp(e,t);defaultRegExp.code="new RegExp";const m=["removeAdditional","useDefaults","coerceTypes"];const g=new Set(["validate","serialize","parse","wrapper","root","schema","keyword","pattern","formats","validate$data","func","obj","Error"]);const v={errorDataPath:"",format:"`validateFormats: false` can be used instead.",nullable:'"nullable" keyword is supported by default.',jsonPointers:"Deprecated jsPropertySyntax can be used instead.",extendRefs:"Deprecated ignoreKeywordsWithRef can be used instead.",missingRefs:"Pass empty schema with $id that should be ignored to ajv.addSchema.",processCode:"Use option `code: {process: (code, schemaEnv: object) => string}`",sourceCode:"Use option `code: {source: true}`",strictDefaults:"It is default now, see option `strict`.",strictKeywords:"It is default now, see option `strict`.",uniqueItems:'"uniqueItems" keyword is always validated.',unknownFormats:"Disable strict mode or pass `true` to `ajv.addFormat` (or `formats` option).",cache:"Map is used as cache, schema object as key.",serialize:"Map is used as cache, schema object as key.",ajvErrors:"It is default now."};const y={ignoreKeywordsWithRef:"",jsPropertySyntax:"",unicode:'"minLength"/"maxLength" account for unicode characters by default.'};const b=200;function requiredOptions(e){var t,r,n,s,i,o,a,c,u,d,l,p,f,m,g,v,y,w,$,S,k,E,I,R,P;const C=e.strict;const A=(t=e.code)===null||t===void 0?void 0:t.optimize;const T=A===true||A===undefined?1:A||0;const O=(n=(r=e.code)===null||r===void 0?void 0:r.regExp)!==null&&n!==void 0?n:defaultRegExp;const q=(s=e.uriResolver)!==null&&s!==void 0?s:h.default;return{strictSchema:(o=(i=e.strictSchema)!==null&&i!==void 0?i:C)!==null&&o!==void 0?o:true,strictNumbers:(c=(a=e.strictNumbers)!==null&&a!==void 0?a:C)!==null&&c!==void 0?c:true,strictTypes:(d=(u=e.strictTypes)!==null&&u!==void 0?u:C)!==null&&d!==void 0?d:"log",strictTuples:(p=(l=e.strictTuples)!==null&&l!==void 0?l:C)!==null&&p!==void 0?p:"log",strictRequired:(m=(f=e.strictRequired)!==null&&f!==void 0?f:C)!==null&&m!==void 0?m:false,code:e.code?{...e.code,optimize:T,regExp:O}:{optimize:T,regExp:O},loopRequired:(g=e.loopRequired)!==null&&g!==void 0?g:b,loopEnum:(v=e.loopEnum)!==null&&v!==void 0?v:b,meta:(y=e.meta)!==null&&y!==void 0?y:true,messages:(w=e.messages)!==null&&w!==void 0?w:true,inlineRefs:($=e.inlineRefs)!==null&&$!==void 0?$:true,schemaId:(S=e.schemaId)!==null&&S!==void 0?S:"$id",addUsedSchema:(k=e.addUsedSchema)!==null&&k!==void 0?k:true,validateSchema:(E=e.validateSchema)!==null&&E!==void 0?E:true,validateFormats:(I=e.validateFormats)!==null&&I!==void 0?I:true,unicodeRegExp:(R=e.unicodeRegExp)!==null&&R!==void 0?R:true,int32range:(P=e.int32range)!==null&&P!==void 0?P:true,uriResolver:q}}class Ajv{constructor(e={}){this.schemas={};this.refs={};this.formats=Object.create(null);this._compilations=new Set;this._loading={};this._cache=new Map;e=this.opts={...e,...requiredOptions(e)};const{es5:t,lines:r}=this.opts.code;this.scope=new u.ValueScope({scope:{},prefixes:g,es5:t,lines:r});this.logger=getLogger(e.logger);const n=e.validateFormats;e.validateFormats=false;this.RULES=(0,a.getRules)();checkOptions.call(this,v,e,"NOT SUPPORTED");checkOptions.call(this,y,e,"DEPRECATED","warn");this._metaOpts=getMetaSchemaOptions.call(this);if(e.formats)addInitialFormats.call(this);this._addVocabularies();this._addDefaultMetaSchema();if(e.keywords)addInitialKeywords.call(this,e.keywords);if(typeof e.meta=="object")this.addMetaSchema(e.meta);addInitialSchemas.call(this);e.validateFormats=n}_addVocabularies(){this.addKeyword("$async")}_addDefaultMetaSchema(){const{$data:e,meta:t,schemaId:r}=this.opts;let n=f;if(r==="id"){n={...f};n.id=n.$id;delete n.$id}if(t&&e)this.addMetaSchema(n,n[r],false)}defaultMeta(){const{meta:e,schemaId:t}=this.opts;return this.opts.defaultMeta=typeof e=="object"?e[t]||e:undefined}validate(e,t){let r;if(typeof e=="string"){r=this.getSchema(e);if(!r)throw new Error(`no schema with key or ref "${e}"`)}else{r=this.compile(e)}const n=r(t);if(!("$async"in r))this.errors=r.errors;return n}compile(e,t){const r=this._addSchema(e,t);return r.validate||this._compileSchemaEnv(r)}compileAsync(e,t){if(typeof this.opts.loadSchema!="function"){throw new Error("options.loadSchema should be a function")}const{loadSchema:r}=this.opts;return runCompileAsync.call(this,e,t);async function runCompileAsync(e,t){await loadMetaSchema.call(this,e.$schema);const r=this._addSchema(e,t);return r.validate||_compileAsync.call(this,r)}async function loadMetaSchema(e){if(e&&!this.getSchema(e)){await runCompileAsync.call(this,{$ref:e},true)}}async function _compileAsync(e){try{return this._compileSchemaEnv(e)}catch(t){if(!(t instanceof o.default))throw t;checkLoaded.call(this,t);await loadMissingSchema.call(this,t.missingSchema);return _compileAsync.call(this,e)}}function checkLoaded({missingSchema:e,missingRef:t}){if(this.refs[e]){throw new Error(`AnySchema ${e} is loaded but ${t} cannot be resolved`)}}async function loadMissingSchema(e){const r=await _loadSchema.call(this,e);if(!this.refs[e])await loadMetaSchema.call(this,r.$schema);if(!this.refs[e])this.addSchema(r,e,t)}async function _loadSchema(e){const t=this._loading[e];if(t)return t;try{return await(this._loading[e]=r(e))}finally{delete this._loading[e]}}}addSchema(e,t,r,n=this.opts.validateSchema){if(Array.isArray(e)){for(const t of e)this.addSchema(t,undefined,r,n);return this}let s;if(typeof e==="object"){const{schemaId:t}=this.opts;s=e[t];if(s!==undefined&&typeof s!="string"){throw new Error(`schema ${t} must be string`)}}t=(0,d.normalizeId)(t||s);this._checkUnique(t);this.schemas[t]=this._addSchema(e,r,t,n,true);return this}addMetaSchema(e,t,r=this.opts.validateSchema){this.addSchema(e,t,true,r);return this}validateSchema(e,t){if(typeof e=="boolean")return true;let r;r=e.$schema;if(r!==undefined&&typeof r!="string"){throw new Error("$schema must be a string")}r=r||this.opts.defaultMeta||this.defaultMeta();if(!r){this.logger.warn("meta-schema not available");this.errors=null;return true}const n=this.validate(r,e);if(!n&&t){const e="schema is invalid: "+this.errorsText();if(this.opts.validateSchema==="log")this.logger.error(e);else throw new Error(e)}return n}getSchema(e){let t;while(typeof(t=getSchEnv.call(this,e))=="string")e=t;if(t===undefined){const{schemaId:r}=this.opts;const n=new c.SchemaEnv({schema:{},schemaId:r});t=c.resolveSchema.call(this,n,e);if(!t)return;this.refs[e]=t}return t.validate||this._compileSchemaEnv(t)}removeSchema(e){if(e instanceof RegExp){this._removeAllSchemas(this.schemas,e);this._removeAllSchemas(this.refs,e);return this}switch(typeof e){case"undefined":this._removeAllSchemas(this.schemas);this._removeAllSchemas(this.refs);this._cache.clear();return this;case"string":{const t=getSchEnv.call(this,e);if(typeof t=="object")this._cache.delete(t.schema);delete this.schemas[e];delete this.refs[e];return this}case"object":{const t=e;this._cache.delete(t);let r=e[this.opts.schemaId];if(r){r=(0,d.normalizeId)(r);delete this.schemas[r];delete this.refs[r]}return this}default:throw new Error("ajv.removeSchema: invalid parameter")}}addVocabulary(e){for(const t of e)this.addKeyword(t);return this}addKeyword(e,t){let r;if(typeof e=="string"){r=e;if(typeof t=="object"){this.logger.warn("these parameters are deprecated, see docs for addKeyword");t.keyword=r}}else if(typeof e=="object"&&t===undefined){t=e;r=t.keyword;if(Array.isArray(r)&&!r.length){throw new Error("addKeywords: keyword must be string or non-empty array")}}else{throw new Error("invalid addKeywords parameters")}checkKeyword.call(this,r,t);if(!t){(0,p.eachItem)(r,e=>addRule.call(this,e));return this}keywordMetaschema.call(this,t);const n={...t,type:(0,l.getJSONTypes)(t.type),schemaType:(0,l.getJSONTypes)(t.schemaType)};(0,p.eachItem)(r,n.type.length===0?e=>addRule.call(this,e,n):e=>n.type.forEach(t=>addRule.call(this,e,n,t)));return this}getKeyword(e){const t=this.RULES.all[e];return typeof t=="object"?t.definition:!!t}removeKeyword(e){const{RULES:t}=this;delete t.keywords[e];delete t.all[e];for(const r of t.rules){const t=r.rules.findIndex(t=>t.keyword===e);if(t>=0)r.rules.splice(t,1)}return this}addFormat(e,t){if(typeof t=="string")t=new RegExp(t);this.formats[e]=t;return this}errorsText(e=this.errors,{separator:t=", ",dataVar:r="data"}={}){if(!e||e.length===0)return"No errors";return e.map(e=>`${r}${e.instancePath} ${e.message}`).reduce((e,r)=>e+t+r)}$dataMetaSchema(e,t){const r=this.RULES.all;e=JSON.parse(JSON.stringify(e));for(const n of t){const t=n.split("/").slice(1);let s=e;for(const e of t)s=s[e];for(const e in r){const t=r[e];if(typeof t!="object")continue;const{$data:n}=t.definition;const i=s[e];if(n&&i)s[e]=schemaOrData(i)}}return e}_removeAllSchemas(e,t){for(const r in e){const n=e[r];if(!t||t.test(r)){if(typeof n=="string"){delete e[r]}else if(n&&!n.meta){this._cache.delete(n.schema);delete e[r]}}}}_addSchema(e,t,r,n=this.opts.validateSchema,s=this.opts.addUsedSchema){let i;const{schemaId:o}=this.opts;if(typeof e=="object"){i=e[o]}else{if(this.opts.jtd)throw new Error("schema must be object");else if(typeof e!="boolean")throw new Error("schema must be object or boolean")}let a=this._cache.get(e);if(a!==undefined)return a;r=(0,d.normalizeId)(i||r);const u=d.getSchemaRefs.call(this,e,r);a=new c.SchemaEnv({schema:e,schemaId:o,meta:t,baseId:r,localRefs:u});this._cache.set(a.schema,a);if(s&&!r.startsWith("#")){if(r)this._checkUnique(r);this.refs[r]=a}if(n)this.validateSchema(e,true);return a}_checkUnique(e){if(this.schemas[e]||this.refs[e]){throw new Error(`schema with key or id "${e}" already exists`)}}_compileSchemaEnv(e){if(e.meta)this._compileMetaSchema(e);else c.compileSchema.call(this,e);if(!e.validate)throw new Error("ajv implementation error");return e.validate}_compileMetaSchema(e){const t=this.opts;this.opts=this._metaOpts;try{c.compileSchema.call(this,e)}finally{this.opts=t}}}Ajv.ValidationError=i.default;Ajv.MissingRefError=o.default;t["default"]=Ajv;function checkOptions(e,t,r,n="error"){for(const s in e){const i=s;if(i in t)this.logger[n](`${r}: option ${s}. ${e[i]}`)}}function getSchEnv(e){e=(0,d.normalizeId)(e);return this.schemas[e]||this.refs[e]}function addInitialSchemas(){const e=this.opts.schemas;if(!e)return;if(Array.isArray(e))this.addSchema(e);else for(const t in e)this.addSchema(e[t],t)}function addInitialFormats(){for(const e in this.opts.formats){const t=this.opts.formats[e];if(t)this.addFormat(e,t)}}function addInitialKeywords(e){if(Array.isArray(e)){this.addVocabulary(e);return}this.logger.warn("keywords option as map is deprecated, pass array");for(const t in e){const r=e[t];if(!r.keyword)r.keyword=t;this.addKeyword(r)}}function getMetaSchemaOptions(){const e={...this.opts};for(const t of m)delete e[t];return e}const w={log(){},warn(){},error(){}};function getLogger(e){if(e===false)return w;if(e===undefined)return console;if(e.log&&e.warn&&e.error)return e;throw new Error("logger must implement log, warn and error methods")}const $=/^[a-z_$][a-z0-9_$:-]*$/i;function checkKeyword(e,t){const{RULES:r}=this;(0,p.eachItem)(e,e=>{if(r.keywords[e])throw new Error(`Keyword ${e} is already defined`);if(!$.test(e))throw new Error(`Keyword ${e} has invalid name`)});if(!t)return;if(t.$data&&!("code"in t||"validate"in t)){throw new Error('$data keyword must have "code" or "validate" function')}}function addRule(e,t,r){var n;const s=t===null||t===void 0?void 0:t.post;if(r&&s)throw new Error('keyword with "post" flag cannot have "type"');const{RULES:i}=this;let o=s?i.post:i.rules.find(({type:e})=>e===r);if(!o){o={type:r,rules:[]};i.rules.push(o)}i.keywords[e]=true;if(!t)return;const a={keyword:e,definition:{...t,type:(0,l.getJSONTypes)(t.type),schemaType:(0,l.getJSONTypes)(t.schemaType)}};if(t.before)addBeforeRule.call(this,o,a,t.before);else o.rules.push(a);i.all[e]=a;(n=t.implements)===null||n===void 0?void 0:n.forEach(e=>this.addKeyword(e))}function addBeforeRule(e,t,r){const n=e.rules.findIndex(e=>e.keyword===r);if(n>=0){e.rules.splice(n,0,t)}else{e.rules.push(t);this.logger.warn(`rule ${r} is not defined`)}}function keywordMetaschema(e){let{metaSchema:t}=e;if(t===undefined)return;if(e.$data&&this.opts.$data)t=schemaOrData(t);e.validateSchema=this.compile(t,true)}const S={$ref:"https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#"};function schemaOrData(e){return{anyOf:[e,S]}}},3995:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1678);const s=r(7216);const i=r(9547);const o=r(8226);const a=r(518);const c=r(4588);const u=r(5707);const d=r(7082);const l=["/properties"];function addMetaSchema2020(e){[n,s,i,o,a,with$data(this,c),u,with$data(this,d)].forEach(e=>this.addMetaSchema(e,undefined,false));return this;function with$data(t,r){return e?t.$dataMetaSchema(r,l):r}}t["default"]=addMetaSchema2020},4951:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(3430);n.code='require("ajv/dist/runtime/equal").default';t["default"]=n},6214:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});function ucs2length(e){const t=e.length;let r=0;let n=0;let s;while(n<t){r++;s=e.charCodeAt(n++);if(s>=55296&&s<=56319&&n<t){s=e.charCodeAt(n);if((s&64512)===56320)n++}}return r}t["default"]=ucs2length;ucs2length.code='require("ajv/dist/runtime/ucs2length").default'},6285:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(4352);n.code='require("ajv/dist/runtime/uri").default';t["default"]=n},3021:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});class ValidationError extends Error{constructor(e){super("validation failed");this.errors=e;this.ajv=this.validation=true}}t["default"]=ValidationError},3448:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.validateAdditionalItems=void 0;const n=r(1436);const s=r(4464);const i={message:({params:{len:e}})=>(0,n.str)`must NOT have more than ${e} items`,params:({params:{len:e}})=>(0,n._)`{limit: ${e}}`};const o={keyword:"additionalItems",type:"array",schemaType:["boolean","object"],before:"uniqueItems",error:i,code(e){const{parentSchema:t,it:r}=e;const{items:n}=t;if(!Array.isArray(n)){(0,s.checkStrictMode)(r,'"additionalItems" is ignored when "items" is not an array of schemas');return}validateAdditionalItems(e,n)}};function validateAdditionalItems(e,t){const{gen:r,schema:i,data:o,keyword:a,it:c}=e;c.items=true;const u=r.const("len",(0,n._)`${o}.length`);if(i===false){e.setParams({len:t.length});e.pass((0,n._)`${u} <= ${t.length}`)}else if(typeof i=="object"&&!(0,s.alwaysValidSchema)(c,i)){const s=r.var("valid",(0,n._)`${u} <= ${t.length}`);r.if((0,n.not)(s),()=>validateItems(s));e.ok(s)}function validateItems(i){r.forRange("i",t.length,u,t=>{e.subschema({keyword:a,dataProp:t,dataPropType:s.Type.Num},i);if(!c.allErrors)r.if((0,n.not)(i),()=>r.break())})}}t.validateAdditionalItems=validateAdditionalItems;t["default"]=o},2431:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8484);const s=r(1436);const i=r(630);const o=r(4464);const a={message:"must NOT have additional properties",params:({params:e})=>(0,s._)`{additionalProperty: ${e.additionalProperty}}`};const c={keyword:"additionalProperties",type:["object"],schemaType:["boolean","object"],allowUndefined:true,trackErrors:true,error:a,code(e){const{gen:t,schema:r,parentSchema:a,data:c,errsCount:u,it:d}=e;if(!u)throw new Error("ajv implementation error");const{allErrors:l,opts:p}=d;d.props=true;if(p.removeAdditional!=="all"&&(0,o.alwaysValidSchema)(d,r))return;const f=(0,n.allSchemaProperties)(a.properties);const h=(0,n.allSchemaProperties)(a.patternProperties);checkAdditionalProperties();e.ok((0,s._)`${u} === ${i.default.errors}`);function checkAdditionalProperties(){t.forIn("key",c,e=>{if(!f.length&&!h.length)additionalPropertyCode(e);else t.if(isAdditional(e),()=>additionalPropertyCode(e))})}function isAdditional(r){let i;if(f.length>8){const e=(0,o.schemaRefOrVal)(d,a.properties,"properties");i=(0,n.isOwnProperty)(t,e,r)}else if(f.length){i=(0,s.or)(...f.map(e=>(0,s._)`${r} === ${e}`))}else{i=s.nil}if(h.length){i=(0,s.or)(i,...h.map(t=>(0,s._)`${(0,n.usePattern)(e,t)}.test(${r})`))}return(0,s.not)(i)}function deleteAdditional(e){t.code((0,s._)`delete ${c}[${e}]`)}function additionalPropertyCode(n){if(p.removeAdditional==="all"||p.removeAdditional&&r===false){deleteAdditional(n);return}if(r===false){e.setParams({additionalProperty:n});e.error();if(!l)t.break();return}if(typeof r=="object"&&!(0,o.alwaysValidSchema)(d,r)){const r=t.name("valid");if(p.removeAdditional==="failing"){applyAdditionalSchema(n,r,false);t.if((0,s.not)(r),()=>{e.reset();deleteAdditional(n)})}else{applyAdditionalSchema(n,r);if(!l)t.if((0,s.not)(r),()=>t.break())}}}function applyAdditionalSchema(t,r,n){const s={keyword:"additionalProperties",dataProp:t,dataPropType:o.Type.Str};if(n===false){Object.assign(s,{compositeRule:true,createErrors:false,allErrors:false})}e.subschema(s,r)}}};t["default"]=c},9205:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(4464);const s={keyword:"allOf",schemaType:"array",code(e){const{gen:t,schema:r,it:s}=e;if(!Array.isArray(r))throw new Error("ajv implementation error");const i=t.name("valid");r.forEach((t,r)=>{if((0,n.alwaysValidSchema)(s,t))return;const o=e.subschema({keyword:"allOf",schemaProp:r},i);e.ok(i);e.mergeEvaluated(o)})}};t["default"]=s},9380:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8484);const s={keyword:"anyOf",schemaType:"array",trackErrors:true,code:n.validateUnion,error:{message:"must match a schema in anyOf"}};t["default"]=s},6182:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:({params:{min:e,max:t}})=>t===undefined?(0,n.str)`must contain at least ${e} valid item(s)`:(0,n.str)`must contain at least ${e} and no more than ${t} valid item(s)`,params:({params:{min:e,max:t}})=>t===undefined?(0,n._)`{minContains: ${e}}`:(0,n._)`{minContains: ${e}, maxContains: ${t}}`};const o={keyword:"contains",type:"array",schemaType:["object","boolean"],before:"uniqueItems",trackErrors:true,error:i,code(e){const{gen:t,schema:r,parentSchema:i,data:o,it:a}=e;let c;let u;const{minContains:d,maxContains:l}=i;if(a.opts.next){c=d===undefined?1:d;u=l}else{c=1}const p=t.const("len",(0,n._)`${o}.length`);e.setParams({min:c,max:u});if(u===undefined&&c===0){(0,s.checkStrictMode)(a,`"minContains" == 0 without "maxContains": "contains" keyword ignored`);return}if(u!==undefined&&c>u){(0,s.checkStrictMode)(a,`"minContains" > "maxContains" is always invalid`);e.fail();return}if((0,s.alwaysValidSchema)(a,r)){let t=(0,n._)`${p} >= ${c}`;if(u!==undefined)t=(0,n._)`${t} && ${p} <= ${u}`;e.pass(t);return}a.items=true;const f=t.name("valid");if(u===undefined&&c===1){validateItems(f,()=>t.if(f,()=>t.break()))}else if(c===0){t.let(f,true);if(u!==undefined)t.if((0,n._)`${o}.length > 0`,validateItemsWithCount)}else{t.let(f,false);validateItemsWithCount()}e.result(f,()=>e.reset());function validateItemsWithCount(){const e=t.name("_valid");const r=t.let("count",0);validateItems(e,()=>t.if(e,()=>checkLimits(r)))}function validateItems(r,n){t.forRange("i",0,p,t=>{e.subschema({keyword:"contains",dataProp:t,dataPropType:s.Type.Num,compositeRule:true},r);n()})}function checkLimits(e){t.code((0,n._)`${e}++`);if(u===undefined){t.if((0,n._)`${e} >= ${c}`,()=>t.assign(f,true).break())}else{t.if((0,n._)`${e} > ${u}`,()=>t.assign(f,false).break());if(c===1)t.assign(f,true);else t.if((0,n._)`${e} >= ${c}`,()=>t.assign(f,true))}}}};t["default"]=o},5826:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.validateSchemaDeps=t.validatePropertyDeps=t.error=void 0;const n=r(1436);const s=r(4464);const i=r(8484);t.error={message:({params:{property:e,depsCount:t,deps:r}})=>{const s=t===1?"property":"properties";return(0,n.str)`must have ${s} ${r} when property ${e} is present`},params:({params:{property:e,depsCount:t,deps:r,missingProperty:s}})=>(0,n._)`{property: ${e},
     missingProperty: ${s},
     depsCount: ${t},
-    deps: ${r}}`};const o={keyword:"dependencies",type:"object",schemaType:"object",error:t.error,code(e){const[t,r]=splitDependencies(e);validatePropertyDeps(e,t);validateSchemaDeps(e,r)}};function splitDependencies({schema:e}){const t={};const r={};for(const n in e){if(n==="__proto__")continue;const s=Array.isArray(e[n])?t:r;s[n]=e[n]}return[t,r]}function validatePropertyDeps(e,t=e.schema){const{gen:r,data:s,it:o}=e;if(Object.keys(t).length===0)return;const a=r.let("missing");for(const c in t){const u=t[c];if(u.length===0)continue;const d=(0,i.propertyInData)(r,s,c,o.opts.ownProperties);e.setParams({property:c,depsCount:u.length,deps:u.join(", ")});if(o.allErrors){r.if(d,()=>{for(const t of u){(0,i.checkReportMissingProp)(e,t)}})}else{r.if((0,n._)`${d} && (${(0,i.checkMissingProp)(e,u,a)})`);(0,i.reportMissingProp)(e,a);r.else()}}}t.validatePropertyDeps=validatePropertyDeps;function validateSchemaDeps(e,t=e.schema){const{gen:r,data:n,keyword:o,it:a}=e;const c=r.name("valid");for(const u in t){if((0,s.alwaysValidSchema)(a,t[u]))continue;r.if((0,i.propertyInData)(r,n,u,a.opts.ownProperties),()=>{const t=e.subschema({keyword:o,schemaProp:u},c);e.mergeValidEvaluated(t,c)},()=>r.var(c,true));e.ok(c)}}t.validateSchemaDeps=validateSchemaDeps;t["default"]=o},3818:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(5826);const s={keyword:"dependentSchemas",type:"object",schemaType:"object",code:e=>(0,n.validateSchemaDeps)(e)};t["default"]=s},8584:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:({params:e})=>(0,n.str)`must match "${e.ifClause}" schema`,params:({params:e})=>(0,n._)`{failingKeyword: ${e.ifClause}}`};const o={keyword:"if",schemaType:["object","boolean"],trackErrors:true,error:i,code(e){const{gen:t,parentSchema:r,it:i}=e;if(r.then===undefined&&r.else===undefined){(0,s.checkStrictMode)(i,'"if" without "then" and "else" is ignored')}const o=hasSchema(i,"then");const a=hasSchema(i,"else");if(!o&&!a)return;const c=t.let("valid",true);const u=t.name("_valid");validateIf();e.reset();if(o&&a){const r=t.let("ifClause");e.setParams({ifClause:r});t.if(u,validateClause("then",r),validateClause("else",r))}else if(o){t.if(u,validateClause("then"))}else{t.if((0,n.not)(u),validateClause("else"))}e.pass(c,()=>e.error(true));function validateIf(){const t=e.subschema({keyword:"if",compositeRule:true,createErrors:false,allErrors:false},u);e.mergeEvaluated(t)}function validateClause(r,s){return()=>{const i=e.subschema({keyword:r},u);t.assign(c,u);e.mergeValidEvaluated(i,c);if(s)t.assign(s,(0,n._)`${r}`);else e.setParams({ifClause:r})}}}};function hasSchema(e,t){const r=e.schema[t];return r!==undefined&&!(0,s.alwaysValidSchema)(e,r)}t["default"]=o},8775:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(3448);const s=r(6467);const i=r(5791);const o=r(2959);const a=r(6182);const c=r(5826);const u=r(1372);const d=r(2431);const l=r(8778);const p=r(664);const f=r(8350);const h=r(9380);const m=r(2490);const g=r(9205);const v=r(8584);const y=r(6829);function getApplicator(e=false){const t=[f.default,h.default,m.default,g.default,v.default,y.default,u.default,d.default,c.default,l.default,p.default];if(e)t.push(s.default,o.default);else t.push(n.default,i.default);t.push(a.default);return t}t["default"]=getApplicator},5791:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.validateTuple=void 0;const n=r(1436);const s=r(4464);const i=r(8484);const o={keyword:"items",type:"array",schemaType:["object","array","boolean"],before:"uniqueItems",code(e){const{schema:t,it:r}=e;if(Array.isArray(t))return validateTuple(e,"additionalItems",t);r.items=true;if((0,s.alwaysValidSchema)(r,t))return;e.ok((0,i.validateArray)(e))}};function validateTuple(e,t,r=e.schema){const{gen:i,parentSchema:o,data:a,keyword:c,it:u}=e;checkStrictTuple(o);if(u.opts.unevaluated&&r.length&&u.items!==true){u.items=s.mergeEvaluated.items(i,r.length,u.items)}const d=i.name("valid");const l=i.const("len",(0,n._)`${a}.length`);r.forEach((t,r)=>{if((0,s.alwaysValidSchema)(u,t))return;i.if((0,n._)`${l} > ${r}`,()=>e.subschema({keyword:c,schemaProp:r,dataProp:r},d));e.ok(d)});function checkStrictTuple(e){const{opts:n,errSchemaPath:i}=u;const o=r.length;const a=o===e.minItems&&(o===e.maxItems||e[t]===false);if(n.strictTuples&&!a){const e=`"${c}" is ${o}-tuple, but minItems or maxItems/${t} are not specified or different at path "${i}"`;(0,s.checkStrictMode)(u,e,n.strictTuples)}}}t.validateTuple=validateTuple;t["default"]=o},2959:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(8484);const o=r(3448);const a={message:({params:{len:e}})=>(0,n.str)`must NOT have more than ${e} items`,params:({params:{len:e}})=>(0,n._)`{limit: ${e}}`};const c={keyword:"items",type:"array",schemaType:["object","boolean"],before:"uniqueItems",error:a,code(e){const{schema:t,parentSchema:r,it:n}=e;const{prefixItems:a}=r;n.items=true;if((0,s.alwaysValidSchema)(n,t))return;if(a)(0,o.validateAdditionalItems)(e,a);else e.ok((0,i.validateArray)(e))}};t["default"]=c},8350:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(4464);const s={keyword:"not",schemaType:["object","boolean"],trackErrors:true,code(e){const{gen:t,schema:r,it:s}=e;if((0,n.alwaysValidSchema)(s,r)){e.fail();return}const i=t.name("valid");e.subschema({keyword:"not",compositeRule:true,createErrors:false,allErrors:false},i);e.failResult(i,()=>e.reset(),()=>e.error())},error:{message:"must NOT be valid"}};t["default"]=s},2490:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:"must match exactly one schema in oneOf",params:({params:e})=>(0,n._)`{passingSchemas: ${e.passing}}`};const o={keyword:"oneOf",schemaType:"array",trackErrors:true,error:i,code(e){const{gen:t,schema:r,parentSchema:i,it:o}=e;if(!Array.isArray(r))throw new Error("ajv implementation error");if(o.opts.discriminator&&i.discriminator)return;const a=r;const c=t.let("valid",false);const u=t.let("passing",null);const d=t.name("_valid");e.setParams({passing:u});t.block(validateOneOf);e.result(c,()=>e.reset(),()=>e.error(true));function validateOneOf(){a.forEach((r,i)=>{let a;if((0,s.alwaysValidSchema)(o,r)){t.var(d,true)}else{a=e.subschema({keyword:"oneOf",schemaProp:i,compositeRule:true},d)}if(i>0){t.if((0,n._)`${d} && ${c}`).assign(c,false).assign(u,(0,n._)`[${u}, ${i}]`).else()}t.if(d,()=>{t.assign(c,true);t.assign(u,i);if(a)e.mergeEvaluated(a,n.Name)})})}}};t["default"]=o},664:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8484);const s=r(1436);const i=r(4464);const o=r(4464);const a={keyword:"patternProperties",type:"object",schemaType:"object",code(e){const{gen:t,schema:r,data:a,parentSchema:c,it:u}=e;const{opts:d}=u;const l=(0,n.allSchemaProperties)(r);const p=l.filter(e=>(0,i.alwaysValidSchema)(u,r[e]));if(l.length===0||p.length===l.length&&(!u.opts.unevaluated||u.props===true)){return}const f=d.strictSchema&&!d.allowMatchingProperties&&c.properties;const h=t.name("valid");if(u.props!==true&&!(u.props instanceof s.Name)){u.props=(0,o.evaluatedPropsToName)(t,u.props)}const{props:m}=u;validatePatternProperties();function validatePatternProperties(){for(const e of l){if(f)checkMatchingProperties(e);if(u.allErrors){validateProperties(e)}else{t.var(h,true);validateProperties(e);t.if(h)}}}function checkMatchingProperties(e){for(const t in f){if(new RegExp(e).test(t)){(0,i.checkStrictMode)(u,`property ${t} matches pattern ${e} (use allowMatchingProperties)`)}}}function validateProperties(r){t.forIn("key",a,i=>{t.if((0,s._)`${(0,n.usePattern)(e,r)}.test(${i})`,()=>{const n=p.includes(r);if(!n){e.subschema({keyword:"patternProperties",schemaProp:r,dataProp:i,dataPropType:o.Type.Str},h)}if(u.opts.unevaluated&&m!==true){t.assign((0,s._)`${m}[${i}]`,true)}else if(!n&&!u.allErrors){t.if((0,s.not)(h),()=>t.break())}})})}}};t["default"]=a},6467:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(5791);const s={keyword:"prefixItems",type:"array",schemaType:["array"],before:"uniqueItems",code:e=>(0,n.validateTuple)(e,"items")};t["default"]=s},8778:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(7881);const s=r(8484);const i=r(4464);const o=r(2431);const a={keyword:"properties",type:"object",schemaType:"object",code(e){const{gen:t,schema:r,parentSchema:a,data:c,it:u}=e;if(u.opts.removeAdditional==="all"&&a.additionalProperties===undefined){o.default.code(new n.KeywordCxt(u,o.default,"additionalProperties"))}const d=(0,s.allSchemaProperties)(r);for(const e of d){u.definedProperties.add(e)}if(u.opts.unevaluated&&d.length&&u.props!==true){u.props=i.mergeEvaluated.props(t,(0,i.toHash)(d),u.props)}const l=d.filter(e=>!(0,i.alwaysValidSchema)(u,r[e]));if(l.length===0)return;const p=t.name("valid");for(const r of l){if(hasDefault(r)){applyPropertySchema(r)}else{t.if((0,s.propertyInData)(t,c,r,u.opts.ownProperties));applyPropertySchema(r);if(!u.allErrors)t.else().var(p,true);t.endIf()}e.it.definedProperties.add(r);e.ok(p)}function hasDefault(e){return u.opts.useDefaults&&!u.compositeRule&&r[e].default!==undefined}function applyPropertySchema(t){e.subschema({keyword:"properties",schemaProp:t,dataProp:t},p)}}};t["default"]=a},1372:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:"property name must be valid",params:({params:e})=>(0,n._)`{propertyName: ${e.propertyName}}`};const o={keyword:"propertyNames",type:"object",schemaType:["object","boolean"],error:i,code(e){const{gen:t,schema:r,data:i,it:o}=e;if((0,s.alwaysValidSchema)(o,r))return;const a=t.name("valid");t.forIn("key",i,r=>{e.setParams({propertyName:r});e.subschema({keyword:"propertyNames",data:r,dataTypes:["string"],propertyName:r,compositeRule:true},a);t.if((0,n.not)(a),()=>{e.error(true);if(!o.allErrors)t.break()})});e.ok(a)}};t["default"]=o},6829:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(4464);const s={keyword:["then","else"],schemaType:["object","boolean"],code({keyword:e,parentSchema:t,it:r}){if(t.if===undefined)(0,n.checkStrictMode)(r,`"${e}" without "if" is ignored`)}};t["default"]=s},8484:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.validateUnion=t.validateArray=t.usePattern=t.callValidateCode=t.schemaProperties=t.allSchemaProperties=t.noPropertyInData=t.propertyInData=t.isOwnProperty=t.hasPropFunc=t.reportMissingProp=t.checkMissingProp=t.checkReportMissingProp=void 0;const n=r(1436);const s=r(4464);const i=r(630);const o=r(4464);function checkReportMissingProp(e,t){const{gen:r,data:s,it:i}=e;r.if(noPropertyInData(r,s,t,i.opts.ownProperties),()=>{e.setParams({missingProperty:(0,n._)`${t}`},true);e.error()})}t.checkReportMissingProp=checkReportMissingProp;function checkMissingProp({gen:e,data:t,it:{opts:r}},s,i){return(0,n.or)(...s.map(s=>(0,n.and)(noPropertyInData(e,t,s,r.ownProperties),(0,n._)`${i} = ${s}`)))}t.checkMissingProp=checkMissingProp;function reportMissingProp(e,t){e.setParams({missingProperty:t},true);e.error()}t.reportMissingProp=reportMissingProp;function hasPropFunc(e){return e.scopeValue("func",{ref:Object.prototype.hasOwnProperty,code:(0,n._)`Object.prototype.hasOwnProperty`})}t.hasPropFunc=hasPropFunc;function isOwnProperty(e,t,r){return(0,n._)`${hasPropFunc(e)}.call(${t}, ${r})`}t.isOwnProperty=isOwnProperty;function propertyInData(e,t,r,s){const i=(0,n._)`${t}${(0,n.getProperty)(r)} !== undefined`;return s?(0,n._)`${i} && ${isOwnProperty(e,t,r)}`:i}t.propertyInData=propertyInData;function noPropertyInData(e,t,r,s){const i=(0,n._)`${t}${(0,n.getProperty)(r)} === undefined`;return s?(0,n.or)(i,(0,n.not)(isOwnProperty(e,t,r))):i}t.noPropertyInData=noPropertyInData;function allSchemaProperties(e){return e?Object.keys(e).filter(e=>e!=="__proto__"):[]}t.allSchemaProperties=allSchemaProperties;function schemaProperties(e,t){return allSchemaProperties(t).filter(r=>!(0,s.alwaysValidSchema)(e,t[r]))}t.schemaProperties=schemaProperties;function callValidateCode({schemaCode:e,data:t,it:{gen:r,topSchemaRef:s,schemaPath:o,errorPath:a},it:c},u,d,l){const p=l?(0,n._)`${e}, ${t}, ${s}${o}`:t;const f=[[i.default.instancePath,(0,n.strConcat)(i.default.instancePath,a)],[i.default.parentData,c.parentData],[i.default.parentDataProperty,c.parentDataProperty],[i.default.rootData,i.default.rootData]];if(c.opts.dynamicRef)f.push([i.default.dynamicAnchors,i.default.dynamicAnchors]);const h=(0,n._)`${p}, ${r.object(...f)}`;return d!==n.nil?(0,n._)`${u}.call(${d}, ${h})`:(0,n._)`${u}(${h})`}t.callValidateCode=callValidateCode;const a=(0,n._)`new RegExp`;function usePattern({gen:e,it:{opts:t}},r){const s=t.unicodeRegExp?"u":"";const{regExp:i}=t.code;const c=i(r,s);return e.scopeValue("pattern",{key:c.toString(),ref:c,code:(0,n._)`${i.code==="new RegExp"?a:(0,o.useFunc)(e,i)}(${r}, ${s})`})}t.usePattern=usePattern;function validateArray(e){const{gen:t,data:r,keyword:i,it:o}=e;const a=t.name("valid");if(o.allErrors){const e=t.let("valid",true);validateItems(()=>t.assign(e,false));return e}t.var(a,true);validateItems(()=>t.break());return a;function validateItems(o){const c=t.const("len",(0,n._)`${r}.length`);t.forRange("i",0,c,r=>{e.subschema({keyword:i,dataProp:r,dataPropType:s.Type.Num},a);t.if((0,n.not)(a),o)})}}t.validateArray=validateArray;function validateUnion(e){const{gen:t,schema:r,keyword:i,it:o}=e;if(!Array.isArray(r))throw new Error("ajv implementation error");const a=r.some(e=>(0,s.alwaysValidSchema)(o,e));if(a&&!o.opts.unevaluated)return;const c=t.let("valid",false);const u=t.name("_valid");t.block(()=>r.forEach((r,s)=>{const o=e.subschema({keyword:i,schemaProp:s,compositeRule:true},u);t.assign(c,(0,n._)`${c} || ${u}`);const a=e.mergeValidEvaluated(o,u);if(!a)t.if((0,n.not)(c))}));e.result(c,()=>e.reset(),()=>e.error(true))}t.validateUnion=validateUnion},9872:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});const r={keyword:"id",code(){throw new Error('NOT SUPPORTED: keyword "id", use "$id" for schema ID')}};t["default"]=r},7397:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(9872);const s=r(2996);const i=["$schema","$id","$defs","$vocabulary",{keyword:"$comment"},"definitions",n.default,s.default];t["default"]=i},2996:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.callRef=t.getValidate=void 0;const n=r(3162);const s=r(8484);const i=r(1436);const o=r(630);const a=r(2718);const c=r(4464);const u={keyword:"$ref",schemaType:"string",code(e){const{gen:t,schema:r,it:s}=e;const{baseId:o,schemaEnv:c,validateName:u,opts:d,self:l}=s;const{root:p}=c;if((r==="#"||r==="#/")&&o===p.baseId)return callRootRef();const f=a.resolveRef.call(l,p,o,r);if(f===undefined)throw new n.default(s.opts.uriResolver,o,r);if(f instanceof a.SchemaEnv)return callValidate(f);return inlineRefSchema(f);function callRootRef(){if(c===p)return callRef(e,u,c,c.$async);const r=t.scopeValue("root",{ref:p});return callRef(e,(0,i._)`${r}.validate`,p,p.$async)}function callValidate(t){const r=getValidate(e,t);callRef(e,r,t,t.$async)}function inlineRefSchema(n){const s=t.scopeValue("schema",d.code.source===true?{ref:n,code:(0,i.stringify)(n)}:{ref:n});const o=t.name("valid");const a=e.subschema({schema:n,dataTypes:[],schemaPath:i.nil,topSchemaRef:s,errSchemaPath:r},o);e.mergeEvaluated(a);e.ok(o)}}};function getValidate(e,t){const{gen:r}=e;return t.validate?r.scopeValue("validate",{ref:t.validate}):(0,i._)`${r.scopeValue("wrapper",{ref:t})}.validate`}t.getValidate=getValidate;function callRef(e,t,r,n){const{gen:a,it:u}=e;const{allErrors:d,schemaEnv:l,opts:p}=u;const f=p.passContext?o.default.this:i.nil;if(n)callAsyncRef();else callSyncRef();function callAsyncRef(){if(!l.$async)throw new Error("async schema referenced by sync schema");const r=a.let("valid");a.try(()=>{a.code((0,i._)`await ${(0,s.callValidateCode)(e,t,f)}`);addEvaluatedFrom(t);if(!d)a.assign(r,true)},e=>{a.if((0,i._)`!(${e} instanceof ${u.ValidationError})`,()=>a.throw(e));addErrorsFrom(e);if(!d)a.assign(r,false)});e.ok(r)}function callSyncRef(){e.result((0,s.callValidateCode)(e,t,f),()=>addEvaluatedFrom(t),()=>addErrorsFrom(t))}function addErrorsFrom(e){const t=(0,i._)`${e}.errors`;a.assign(o.default.vErrors,(0,i._)`${o.default.vErrors} === null ? ${t} : ${o.default.vErrors}.concat(${t})`);a.assign(o.default.errors,(0,i._)`${o.default.vErrors}.length`)}function addEvaluatedFrom(e){var t;if(!u.opts.unevaluated)return;const n=(t=r===null||r===void 0?void 0:r.validate)===null||t===void 0?void 0:t.evaluated;if(u.props!==true){if(n&&!n.dynamicProps){if(n.props!==undefined){u.props=c.mergeEvaluated.props(a,n.props,u.props)}}else{const t=a.var("props",(0,i._)`${e}.evaluated.props`);u.props=c.mergeEvaluated.props(a,t,u.props,i.Name)}}if(u.items!==true){if(n&&!n.dynamicItems){if(n.items!==undefined){u.items=c.mergeEvaluated.items(a,n.items,u.items)}}else{const t=a.var("items",(0,i._)`${e}.evaluated.items`);u.items=c.mergeEvaluated.items(a,t,u.items,i.Name)}}}}t.callRef=callRef;t["default"]=u},8886:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(7115);const i=r(2718);const o=r(3162);const a=r(4464);const c={message:({params:{discrError:e,tagName:t}})=>e===s.DiscrError.Tag?`tag "${t}" must be string`:`value of tag "${t}" must be in oneOf`,params:({params:{discrError:e,tag:t,tagName:r}})=>(0,n._)`{error: ${e}, tag: ${r}, tagValue: ${t}}`};const u={keyword:"discriminator",type:"object",schemaType:"object",error:c,code(e){const{gen:t,data:r,schema:c,parentSchema:u,it:d}=e;const{oneOf:l}=u;if(!d.opts.discriminator){throw new Error("discriminator: requires discriminator option")}const p=c.propertyName;if(typeof p!="string")throw new Error("discriminator: requires propertyName");if(c.mapping)throw new Error("discriminator: mapping is not supported");if(!l)throw new Error("discriminator: requires oneOf keyword");const f=t.let("valid",false);const h=t.const("tag",(0,n._)`${r}${(0,n.getProperty)(p)}`);t.if((0,n._)`typeof ${h} == "string"`,()=>validateMapping(),()=>e.error(false,{discrError:s.DiscrError.Tag,tag:h,tagName:p}));e.ok(f);function validateMapping(){const r=getMapping();t.if(false);for(const e in r){t.elseIf((0,n._)`${h} === ${e}`);t.assign(f,applyTagSchema(r[e]))}t.else();e.error(false,{discrError:s.DiscrError.Mapping,tag:h,tagName:p});t.endIf()}function applyTagSchema(r){const s=t.name("valid");const i=e.subschema({keyword:"oneOf",schemaProp:r},s);e.mergeEvaluated(i,n.Name);return s}function getMapping(){var e;const t={};const r=hasRequired(u);let n=true;for(let t=0;t<l.length;t++){let s=l[t];if((s===null||s===void 0?void 0:s.$ref)&&!(0,a.schemaHasRulesButRef)(s,d.self.RULES)){const e=s.$ref;s=i.resolveRef.call(d.self,d.schemaEnv.root,d.baseId,e);if(s instanceof i.SchemaEnv)s=s.schema;if(s===undefined)throw new o.default(d.opts.uriResolver,d.baseId,e)}const c=(e=s===null||s===void 0?void 0:s.properties)===null||e===void 0?void 0:e[p];if(typeof c!="object"){throw new Error(`discriminator: oneOf subschemas (or referenced schemas) must have "properties/${p}"`)}n=n&&(r||hasRequired(s));addMappings(c,t)}if(!n)throw new Error(`discriminator: "${p}" must be required`);return t;function hasRequired({required:e}){return Array.isArray(e)&&e.includes(p)}function addMappings(e,t){if(e.const){addMapping(e.const,t)}else if(e.enum){for(const r of e.enum){addMapping(r,t)}}else{throw new Error(`discriminator: "properties/${p}" must have "const" or "enum"`)}}function addMapping(e,r){if(typeof e!="string"||e in t){throw new Error(`discriminator: "${p}" values must be unique strings`)}t[e]=r}}}};t["default"]=u},7115:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.DiscrError=void 0;var r;(function(e){e["Tag"]="tag";e["Mapping"]="mapping"})(r||(t.DiscrError=r={}))},4298:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(7397);const s=r(5481);const i=r(8775);const o=r(9923);const a=r(7844);const c=r(2010);const u=r(2601);const d=r(6620);const l=[o.default,n.default,s.default,(0,i.default)(true),u.default,d.metadataVocabulary,d.contentVocabulary,a.default,c.default];t["default"]=l},8639:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.dynamicAnchor=void 0;const n=r(1436);const s=r(630);const i=r(2718);const o=r(2996);const a={keyword:"$dynamicAnchor",schemaType:"string",code:e=>dynamicAnchor(e,e.schema)};function dynamicAnchor(e,t){const{gen:r,it:i}=e;i.schemaEnv.root.dynamicAnchors[t]=true;const o=(0,n._)`${s.default.dynamicAnchors}${(0,n.getProperty)(t)}`;const a=i.errSchemaPath==="#"?i.validateName:_getValidate(e);r.if((0,n._)`!${o}`,()=>r.assign(o,a))}t.dynamicAnchor=dynamicAnchor;function _getValidate(e){const{schemaEnv:t,schema:r,self:n}=e.it;const{root:s,baseId:a,localRefs:c,meta:u}=t.root;const{schemaId:d}=n.opts;const l=new i.SchemaEnv({schema:r,schemaId:d,root:s,baseId:a,localRefs:c,meta:u});i.compileSchema.call(n,l);return(0,o.getValidate)(e,l)}t["default"]=a},5065:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.dynamicRef=void 0;const n=r(1436);const s=r(630);const i=r(2996);const o={keyword:"$dynamicRef",schemaType:"string",code:e=>dynamicRef(e,e.schema)};function dynamicRef(e,t){const{gen:r,keyword:o,it:a}=e;if(t[0]!=="#")throw new Error(`"${o}" only supports hash fragment reference`);const c=t.slice(1);if(a.allErrors){_dynamicRef()}else{const t=r.let("valid",false);_dynamicRef(t);e.ok(t)}function _dynamicRef(e){if(a.schemaEnv.root.dynamicAnchors[c]){const t=r.let("_v",(0,n._)`${s.default.dynamicAnchors}${(0,n.getProperty)(c)}`);r.if(t,_callRef(t,e),_callRef(a.validateName,e))}else{_callRef(a.validateName,e)()}}function _callRef(t,n){return n?()=>r.block(()=>{(0,i.callRef)(e,t);r.let(n,true)}):()=>(0,i.callRef)(e,t)}}t.dynamicRef=dynamicRef;t["default"]=o},9923:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8639);const s=r(5065);const i=r(9982);const o=r(1794);const a=[n.default,s.default,i.default,o.default];t["default"]=a},9982:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8639);const s=r(4464);const i={keyword:"$recursiveAnchor",schemaType:"boolean",code(e){if(e.schema)(0,n.dynamicAnchor)(e,"");else(0,s.checkStrictMode)(e.it,"$recursiveAnchor: false is ignored")}};t["default"]=i},1794:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(5065);const s={keyword:"$recursiveRef",schemaType:"string",code:e=>(0,n.dynamicRef)(e,e.schema)};t["default"]=s},6402:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s={message:({schemaCode:e})=>(0,n.str)`must match format "${e}"`,params:({schemaCode:e})=>(0,n._)`{format: ${e}}`};const i={keyword:"format",type:["number","string"],schemaType:"string",$data:true,error:s,code(e,t){const{gen:r,data:s,$data:i,schema:o,schemaCode:a,it:c}=e;const{opts:u,errSchemaPath:d,schemaEnv:l,self:p}=c;if(!u.validateFormats)return;if(i)validate$DataFormat();else validateFormat();function validate$DataFormat(){const i=r.scopeValue("formats",{ref:p.formats,code:u.code.formats});const o=r.const("fDef",(0,n._)`${i}[${a}]`);const c=r.let("fType");const d=r.let("format");r.if((0,n._)`typeof ${o} == "object" && !(${o} instanceof RegExp)`,()=>r.assign(c,(0,n._)`${o}.type || "string"`).assign(d,(0,n._)`${o}.validate`),()=>r.assign(c,(0,n._)`"string"`).assign(d,o));e.fail$data((0,n.or)(unknownFmt(),invalidFmt()));function unknownFmt(){if(u.strictSchema===false)return n.nil;return(0,n._)`${a} && !${d}`}function invalidFmt(){const e=l.$async?(0,n._)`(${o}.async ? await ${d}(${s}) : ${d}(${s}))`:(0,n._)`${d}(${s})`;const r=(0,n._)`(typeof ${d} == "function" ? ${e} : ${d}.test(${s}))`;return(0,n._)`${d} && ${d} !== true && ${c} === ${t} && !${r}`}}function validateFormat(){const i=p.formats[o];if(!i){unknownFormat();return}if(i===true)return;const[a,c,f]=getFormat(i);if(a===t)e.pass(validCondition());function unknownFormat(){if(u.strictSchema===false){p.logger.warn(unknownMsg());return}throw new Error(unknownMsg());function unknownMsg(){return`unknown format "${o}" ignored in schema at path "${d}"`}}function getFormat(e){const t=e instanceof RegExp?(0,n.regexpCode)(e):u.code.formats?(0,n._)`${u.code.formats}${(0,n.getProperty)(o)}`:undefined;const s=r.scopeValue("formats",{key:o,ref:e,code:t});if(typeof e=="object"&&!(e instanceof RegExp)){return[e.type||"string",e.validate,(0,n._)`${s}.validate`]}return["string",e,s]}function validCondition(){if(typeof i=="object"&&!(i instanceof RegExp)&&i.async){if(!l.$async)throw new Error("async format in sync schema");return(0,n._)`await ${f}(${s})`}return typeof c=="function"?(0,n._)`${f}(${s})`:(0,n._)`${f}.test(${s})`}}}};t["default"]=i},2601:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(6402);const s=[n.default];t["default"]=s},6620:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.contentVocabulary=t.metadataVocabulary=void 0;t.metadataVocabulary=["title","description","default","deprecated","readOnly","writeOnly","examples"];t.contentVocabulary=["contentMediaType","contentEncoding","contentSchema"]},7844:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(643);const s=r(3818);const i=r(3907);const o=[n.default,s.default,i.default];t["default"]=o},2010:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(6855);const s=r(4144);const i=[n.default,s.default];t["default"]=i},4144:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:({params:{len:e}})=>(0,n.str)`must NOT have more than ${e} items`,params:({params:{len:e}})=>(0,n._)`{limit: ${e}}`};const o={keyword:"unevaluatedItems",type:"array",schemaType:["boolean","object"],error:i,code(e){const{gen:t,schema:r,data:i,it:o}=e;const a=o.items||0;if(a===true)return;const c=t.const("len",(0,n._)`${i}.length`);if(r===false){e.setParams({len:a});e.fail((0,n._)`${c} > ${a}`)}else if(typeof r=="object"&&!(0,s.alwaysValidSchema)(o,r)){const r=t.var("valid",(0,n._)`${c} <= ${a}`);t.if((0,n.not)(r),()=>validateItems(r,a));e.ok(r)}o.items=true;function validateItems(r,i){t.forRange("i",i,c,i=>{e.subschema({keyword:"unevaluatedItems",dataProp:i,dataPropType:s.Type.Num},r);if(!o.allErrors)t.if((0,n.not)(r),()=>t.break())})}}};t["default"]=o},6855:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(630);const o={message:"must NOT have unevaluated properties",params:({params:e})=>(0,n._)`{unevaluatedProperty: ${e.unevaluatedProperty}}`};const a={keyword:"unevaluatedProperties",type:"object",schemaType:["boolean","object"],trackErrors:true,error:o,code(e){const{gen:t,schema:r,data:o,errsCount:a,it:c}=e;if(!a)throw new Error("ajv implementation error");const{allErrors:u,props:d}=c;if(d instanceof n.Name){t.if((0,n._)`${d} !== true`,()=>t.forIn("key",o,e=>t.if(unevaluatedDynamic(d,e),()=>unevaluatedPropCode(e))))}else if(d!==true){t.forIn("key",o,e=>d===undefined?unevaluatedPropCode(e):t.if(unevaluatedStatic(d,e),()=>unevaluatedPropCode(e)))}c.props=true;e.ok((0,n._)`${a} === ${i.default.errors}`);function unevaluatedPropCode(i){if(r===false){e.setParams({unevaluatedProperty:i});e.error();if(!u)t.break();return}if(!(0,s.alwaysValidSchema)(c,r)){const r=t.name("valid");e.subschema({keyword:"unevaluatedProperties",dataProp:i,dataPropType:s.Type.Str},r);if(!u)t.if((0,n.not)(r),()=>t.break())}}function unevaluatedDynamic(e,t){return(0,n._)`!${e} || !${e}[${t}]`}function unevaluatedStatic(e,t){const r=[];for(const s in e){if(e[s]===true)r.push((0,n._)`${t} !== ${s}`)}return(0,n.and)(...r)}}};t["default"]=a},8026:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(4951);const o={message:"must be equal to constant",params:({schemaCode:e})=>(0,n._)`{allowedValue: ${e}}`};const a={keyword:"const",$data:true,error:o,code(e){const{gen:t,data:r,$data:o,schemaCode:a,schema:c}=e;if(o||c&&typeof c=="object"){e.fail$data((0,n._)`!${(0,s.useFunc)(t,i.default)}(${r}, ${a})`)}else{e.fail((0,n._)`${c} !== ${r}`)}}};t["default"]=a},643:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(5826);const s={keyword:"dependentRequired",type:"object",schemaType:"object",error:n.error,code:e=>(0,n.validatePropertyDeps)(e)};t["default"]=s},3200:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(4951);const o={message:"must be equal to one of the allowed values",params:({schemaCode:e})=>(0,n._)`{allowedValues: ${e}}`};const a={keyword:"enum",schemaType:"array",$data:true,error:o,code(e){const{gen:t,data:r,$data:o,schema:a,schemaCode:c,it:u}=e;if(!o&&a.length===0)throw new Error("enum must have non-empty array");const d=a.length>=u.opts.loopEnum;let l;const getEql=()=>l!==null&&l!==void 0?l:l=(0,s.useFunc)(t,i.default);let p;if(d||o){p=t.let("valid");e.block$data(p,loopEnum)}else{if(!Array.isArray(a))throw new Error("ajv implementation error");const e=t.const("vSchema",c);p=(0,n.or)(...a.map((t,r)=>equalCode(e,r)))}e.pass(p);function loopEnum(){t.assign(p,false);t.forOf("v",c,e=>t.if((0,n._)`${getEql()}(${r}, ${e})`,()=>t.assign(p,true).break()))}function equalCode(e,t){const s=a[t];return typeof s==="object"&&s!==null?(0,n._)`${getEql()}(${r}, ${e}[${t}])`:(0,n._)`${r} === ${s}`}}};t["default"]=a},5481:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(3723);const s=r(8132);const i=r(6962);const o=r(6023);const a=r(895);const c=r(4504);const u=r(6296);const d=r(5132);const l=r(8026);const p=r(3200);const f=[n.default,s.default,i.default,o.default,a.default,c.default,u.default,d.default,{keyword:"type",schemaType:["string","array"]},{keyword:"nullable",schemaType:"boolean"},l.default,p.default];t["default"]=f},3907:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(4464);const s={keyword:["maxContains","minContains"],type:"array",schemaType:"number",code({keyword:e,parentSchema:t,it:r}){if(t.contains===undefined){(0,n.checkStrictMode)(r,`"${e}" without "contains" is ignored`)}}};t["default"]=s},6296:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s={message({keyword:e,schemaCode:t}){const r=e==="maxItems"?"more":"fewer";return(0,n.str)`must NOT have ${r} than ${t} items`},params:({schemaCode:e})=>(0,n._)`{limit: ${e}}`};const i={keyword:["maxItems","minItems"],type:"array",schemaType:"number",$data:true,error:s,code(e){const{keyword:t,data:r,schemaCode:s}=e;const i=t==="maxItems"?n.operators.GT:n.operators.LT;e.fail$data((0,n._)`${r}.length ${i} ${s}`)}};t["default"]=i},6962:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(6214);const o={message({keyword:e,schemaCode:t}){const r=e==="maxLength"?"more":"fewer";return(0,n.str)`must NOT have ${r} than ${t} characters`},params:({schemaCode:e})=>(0,n._)`{limit: ${e}}`};const a={keyword:["maxLength","minLength"],type:"string",schemaType:"number",$data:true,error:o,code(e){const{keyword:t,data:r,schemaCode:o,it:a}=e;const c=t==="maxLength"?n.operators.GT:n.operators.LT;const u=a.opts.unicode===false?(0,n._)`${r}.length`:(0,n._)`${(0,s.useFunc)(e.gen,i.default)}(${r})`;e.fail$data((0,n._)`${u} ${c} ${o}`)}};t["default"]=a},3723:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=n.operators;const i={maximum:{okStr:"<=",ok:s.LTE,fail:s.GT},minimum:{okStr:">=",ok:s.GTE,fail:s.LT},exclusiveMaximum:{okStr:"<",ok:s.LT,fail:s.GTE},exclusiveMinimum:{okStr:">",ok:s.GT,fail:s.LTE}};const o={message:({keyword:e,schemaCode:t})=>(0,n.str)`must be ${i[e].okStr} ${t}`,params:({keyword:e,schemaCode:t})=>(0,n._)`{comparison: ${i[e].okStr}, limit: ${t}}`};const a={keyword:Object.keys(i),type:"number",schemaType:"number",$data:true,error:o,code(e){const{keyword:t,data:r,schemaCode:s}=e;e.fail$data((0,n._)`${r} ${i[t].fail} ${s} || isNaN(${r})`)}};t["default"]=a},895:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s={message({keyword:e,schemaCode:t}){const r=e==="maxProperties"?"more":"fewer";return(0,n.str)`must NOT have ${r} than ${t} properties`},params:({schemaCode:e})=>(0,n._)`{limit: ${e}}`};const i={keyword:["maxProperties","minProperties"],type:"object",schemaType:"number",$data:true,error:s,code(e){const{keyword:t,data:r,schemaCode:s}=e;const i=t==="maxProperties"?n.operators.GT:n.operators.LT;e.fail$data((0,n._)`Object.keys(${r}).length ${i} ${s}`)}};t["default"]=i},8132:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s={message:({schemaCode:e})=>(0,n.str)`must be multiple of ${e}`,params:({schemaCode:e})=>(0,n._)`{multipleOf: ${e}}`};const i={keyword:"multipleOf",type:"number",schemaType:"number",$data:true,error:s,code(e){const{gen:t,data:r,schemaCode:s,it:i}=e;const o=i.opts.multipleOfPrecision;const a=t.let("res");const c=o?(0,n._)`Math.abs(Math.round(${a}) - ${a}) > 1e-${o}`:(0,n._)`${a} !== parseInt(${a})`;e.fail$data((0,n._)`(${s} === 0 || (${a} = ${r}/${s}, ${c}))`)}};t["default"]=i},6023:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8484);const s=r(4464);const i=r(1436);const o={message:({schemaCode:e})=>(0,i.str)`must match pattern "${e}"`,params:({schemaCode:e})=>(0,i._)`{pattern: ${e}}`};const a={keyword:"pattern",type:"string",schemaType:"string",$data:true,error:o,code(e){const{gen:t,data:r,$data:o,schema:a,schemaCode:c,it:u}=e;const d=u.opts.unicodeRegExp?"u":"";if(o){const{regExp:n}=u.opts.code;const o=n.code==="new RegExp"?(0,i._)`new RegExp`:(0,s.useFunc)(t,n);const a=t.let("valid");t.try(()=>t.assign(a,(0,i._)`${o}(${c}, ${d}).test(${r})`),()=>t.assign(a,false));e.fail$data((0,i._)`!${a}`)}else{const t=(0,n.usePattern)(e,a);e.fail$data((0,i._)`!${t}.test(${r})`)}}};t["default"]=a},4504:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8484);const s=r(1436);const i=r(4464);const o={message:({params:{missingProperty:e}})=>(0,s.str)`must have required property '${e}'`,params:({params:{missingProperty:e}})=>(0,s._)`{missingProperty: ${e}}`};const a={keyword:"required",type:"object",schemaType:"array",$data:true,error:o,code(e){const{gen:t,schema:r,schemaCode:o,data:a,$data:c,it:u}=e;const{opts:d}=u;if(!c&&r.length===0)return;const l=r.length>=d.loopRequired;if(u.allErrors)allErrorsMode();else exitOnErrorMode();if(d.strictRequired){const t=e.parentSchema.properties;const{definedProperties:n}=e.it;for(const e of r){if((t===null||t===void 0?void 0:t[e])===undefined&&!n.has(e)){const t=u.schemaEnv.baseId+u.errSchemaPath;const r=`required property "${e}" is not defined at "${t}" (strictRequired)`;(0,i.checkStrictMode)(u,r,u.opts.strictRequired)}}}function allErrorsMode(){if(l||c){e.block$data(s.nil,loopAllRequired)}else{for(const t of r){(0,n.checkReportMissingProp)(e,t)}}}function exitOnErrorMode(){const s=t.let("missing");if(l||c){const r=t.let("valid",true);e.block$data(r,()=>loopUntilMissing(s,r));e.ok(r)}else{t.if((0,n.checkMissingProp)(e,r,s));(0,n.reportMissingProp)(e,s);t.else()}}function loopAllRequired(){t.forOf("prop",o,r=>{e.setParams({missingProperty:r});t.if((0,n.noPropertyInData)(t,a,r,d.ownProperties),()=>e.error())})}function loopUntilMissing(r,i){e.setParams({missingProperty:r});t.forOf(r,o,()=>{t.assign(i,(0,n.propertyInData)(t,a,r,d.ownProperties));t.if((0,s.not)(i),()=>{e.error();t.break()})},s.nil)}}};t["default"]=a},5132:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(6685);const s=r(1436);const i=r(4464);const o=r(4951);const a={message:({params:{i:e,j:t}})=>(0,s.str)`must NOT have duplicate items (items ## ${t} and ${e} are identical)`,params:({params:{i:e,j:t}})=>(0,s._)`{i: ${e}, j: ${t}}`};const c={keyword:"uniqueItems",type:"array",schemaType:"boolean",$data:true,error:a,code(e){const{gen:t,data:r,$data:a,schema:c,parentSchema:u,schemaCode:d,it:l}=e;if(!a&&!c)return;const p=t.let("valid");const f=u.items?(0,n.getSchemaTypes)(u.items):[];e.block$data(p,validateUniqueItems,(0,s._)`${d} === false`);e.ok(p);function validateUniqueItems(){const n=t.let("i",(0,s._)`${r}.length`);const i=t.let("j");e.setParams({i:n,j:i});t.assign(p,true);t.if((0,s._)`${n} > 1`,()=>(canOptimize()?loopN:loopN2)(n,i))}function canOptimize(){return f.length>0&&!f.some(e=>e==="object"||e==="array")}function loopN(i,o){const a=t.name("item");const c=(0,n.checkDataTypes)(f,a,l.opts.strictNumbers,n.DataType.Wrong);const u=t.const("indices",(0,s._)`{}`);t.for((0,s._)`;${i}--;`,()=>{t.let(a,(0,s._)`${r}[${i}]`);t.if(c,(0,s._)`continue`);if(f.length>1)t.if((0,s._)`typeof ${a} == "string"`,(0,s._)`${a} += "_"`);t.if((0,s._)`typeof ${u}[${a}] == "number"`,()=>{t.assign(o,(0,s._)`${u}[${a}]`);e.error();t.assign(p,false).break()}).code((0,s._)`${u}[${a}] = ${i}`)})}function loopN2(n,a){const c=(0,i.useFunc)(t,o.default);const u=t.name("outer");t.label(u).for((0,s._)`;${n}--;`,()=>t.for((0,s._)`${a} = ${n}; ${a}--;`,()=>t.if((0,s._)`${c}(${r}[${n}], ${r}[${a}])`,()=>{e.error();t.assign(p,false).break(u)})))}}};t["default"]=c},3430:e=>{e.exports=function equal(e,t){if(e===t)return true;if(e&&t&&typeof e=="object"&&typeof t=="object"){if(e.constructor!==t.constructor)return false;var r,n,s;if(Array.isArray(e)){r=e.length;if(r!=t.length)return false;for(n=r;n--!==0;)if(!equal(e[n],t[n]))return false;return true}if(e.constructor===RegExp)return e.source===t.source&&e.flags===t.flags;if(e.valueOf!==Object.prototype.valueOf)return e.valueOf()===t.valueOf();if(e.toString!==Object.prototype.toString)return e.toString()===t.toString();s=Object.keys(e);r=s.length;if(r!==Object.keys(t).length)return false;for(n=r;n--!==0;)if(!Object.prototype.hasOwnProperty.call(t,s[n]))return false;for(n=r;n--!==0;){var i=s[n];if(!equal(e[i],t[i]))return false}return true}return e!==e&&t!==t}},1167:e=>{var t=e.exports=function(e,t,r){if(typeof t=="function"){r=t;t={}}r=t.cb||r;var n=typeof r=="function"?r:r.pre||function(){};var s=r.post||function(){};_traverse(t,n,s,e,"",e)};t.keywords={additionalItems:true,items:true,contains:true,additionalProperties:true,propertyNames:true,not:true,if:true,then:true,else:true};t.arrayKeywords={items:true,allOf:true,anyOf:true,oneOf:true};t.propsKeywords={$defs:true,definitions:true,properties:true,patternProperties:true,dependencies:true};t.skipKeywords={default:true,enum:true,const:true,required:true,maximum:true,minimum:true,exclusiveMaximum:true,exclusiveMinimum:true,multipleOf:true,maxLength:true,minLength:true,pattern:true,format:true,maxItems:true,minItems:true,uniqueItems:true,maxProperties:true,minProperties:true};function _traverse(e,r,n,s,i,o,a,c,u,d){if(s&&typeof s=="object"&&!Array.isArray(s)){r(s,i,o,a,c,u,d);for(var l in s){var p=s[l];if(Array.isArray(p)){if(l in t.arrayKeywords){for(var f=0;f<p.length;f++)_traverse(e,r,n,p[f],i+"/"+l+"/"+f,o,i,l,s,f)}}else if(l in t.propsKeywords){if(p&&typeof p=="object"){for(var h in p)_traverse(e,r,n,p[h],i+"/"+l+"/"+escapeJsonPtr(h),o,i,l,s,h)}}else if(l in t.keywords||e.allKeys&&!(l in t.skipKeywords)){_traverse(e,r,n,p,i+"/"+l,o,i,l,s)}}n(s,i,o,a,c,u,d)}}function escapeJsonPtr(e){return e.replace(/~/g,"~0").replace(/\//g,"~1")}},1552:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.canonicalJson=canonicalJson;t.sha256Digest=sha256Digest;t.sha256Text=sha256Text;t.compareTextUnit=compareTextUnit;const n=r(7598);function canonicalize(e){if(Array.isArray(e))return e.map(canonicalize);if(e!==null&&typeof e==="object"){const t=e;return Object.fromEntries(Object.keys(t).sort().map(e=>[e,canonicalize(t[e])]))}return e}function canonicalJson(e){return JSON.stringify(canonicalize(e))}function sha256Digest(e){return`sha256:${(0,n.createHash)("sha256").update(canonicalJson(e)).digest("hex")}`}function sha256Text(e){return`sha256:${(0,n.createHash)("sha256").update(e).digest("hex")}`}function compareTextUnit(e,t){if(e<t)return-1;if(e>t)return 1;return 0}},3457:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.MAX_NESTED_ENTRIES=t.MAX_STRING_LENGTH=t.MAX_COLLECTION_ITEMS=void 0;t.MAX_COLLECTION_ITEMS=3e3;t.MAX_STRING_LENGTH=1e5;t.MAX_NESTED_ENTRIES=1e4},395:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.STATUS_PRECEDENCE=void 0;t.determineFinalStatus=determineFinalStatus;t.STATUS_PRECEDENCE=[{status:"policy_ambiguous",condition:"an unknown policy/authority requirement exists"},{status:"evidence_missing",condition:"an evidence requirement is unknown"},{status:"human_review_required",condition:"a human-gate requirement failed"},{status:"blocked",condition:"an enforceable blocking requirement failed"},{status:"ready_for_review",condition:"no higher-precedence condition exists"}];function determineFinalStatus(e){if(e.some(e=>e.result==="unknown"&&e.severity!=="evidence")){return"policy_ambiguous"}if(e.some(e=>e.result==="unknown"&&e.severity==="evidence")){return"evidence_missing"}if(e.some(e=>e.result==="failed"&&e.severity==="human_gate")){return"human_review_required"}if(e.some(e=>e.result==="failed"&&e.severity==="block")){return"blocked"}return"ready_for_review"}},6875:function(e,t,r){var n=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:true});t.ContractValidationError=void 0;t.assertPatchgatePolicy=assertPatchgatePolicy;t.assertEvaluationInput=assertEvaluationInput;t.assertContributionReceipt=assertContributionReceipt;t.parseEvaluationInputJson=parseEvaluationInputJson;const s=r(2210);const i=r(395);const o=r(3457);const a=r(1552);const c=r(1140);const u=r(5291);const d=n(r(3578));const l=n(r(6537));const p=n(r(5761));const f=new s.Ajv2020({allErrors:true,strict:true});f.addSchema(d.default);f.addSchema(l.default);f.addSchema(p.default);const h=f.getSchema("https://patchgate.dev/schemas/patchgate-policy/0.1");const m=f.getSchema("https://patchgate.dev/schemas/evaluation-input/0.1");const g=f.getSchema("https://patchgate.dev/schemas/contribution-receipt/0.1");class ContractValidationError extends Error{issues;diagnosticId;constructor(e,t=[],r="CONTRACT_INVALID"){super(e);this.name="ContractValidationError";this.issues=t;this.diagnosticId=r}}t.ContractValidationError=ContractValidationError;function fail(e,t="CONTRACT_INVALID"){throw new ContractValidationError(e,[],t)}function validate(e,t,r){if(t(e))return;const n=(t.errors??[]).map(e=>`${e.instancePath||"/"} ${e.message??"is invalid"}`).join("; ");throw new ContractValidationError(`${r} is invalid${n.length>0?`: ${n}`:""}`,t.errors??[],"SCHEMA_INVALID")}function isRecord(e){return e!==null&&typeof e==="object"&&!Array.isArray(e)}function assertString(e,t){if(e.trim().length===0)fail(`${t} must contain a non-whitespace character`);if(e.length>o.MAX_STRING_LENGTH)fail(`${t} exceeds the parser safety limit`,"RESOURCE_LIMIT_EXCEEDED")}function assertUniqueStrings(e,t){if(new Set(e).size!==e.length)fail(`${t} must not contain duplicates`,"DUPLICATE_IDENTITY")}function assertCollectionSize(e,t){if(e.length>o.MAX_COLLECTION_ITEMS)fail(`${t} exceeds the maximum accepted collection size`,"RESOURCE_LIMIT_EXCEEDED")}function assertNestedEntryCount(e,t){if(e.length>o.MAX_NESTED_ENTRIES)fail(`${t} exceeds the maximum nested-entry limit`,"RESOURCE_LIMIT_EXCEEDED")}function assertPolicySemantics(e){assertNestedEntryCount(e.requiredChecks??[],"policy required checks");assertNestedEntryCount(e.sensitivePaths??[],"policy sensitive paths");assertNestedEntryCount(e.policyChanges?.paths??[],"policy change paths");const t=[...(e.requiredChecks??[]).map(e=>e.id),...(e.sensitivePaths??[]).map(e=>e.id)];const r=t.find((e,r)=>t.indexOf(e)!==r);if(r!==undefined)fail(`policy rule id must be unique: ${r}`,"DUPLICATE_RULE_ID");for(const t of e.requiredChecks??[]){assertNestedEntryCount(t.acceptableConclusions,`required check ${t.id} acceptable conclusions`);assertString(t.id,"required check id");assertString(t.name,`required check ${t.id} name`);t.acceptableConclusions.forEach(e=>assertString(e,`required check ${t.id} conclusion`));if(t.acceptableConclusions.length===0)fail(`required check ${t.id} must declare at least one acceptable conclusion`);if(t.expectedSource.kind==="github_app_expected"&&t.expectedSource.appId===undefined)fail(`required check ${t.id} must identify expected immutable App identity`);if(t.expectedSource.kind==="github_actions_workflow"&&(t.expectedSource.appId===undefined||t.expectedSource.workflowId===undefined&&t.expectedSource.workflowPath===undefined)){fail(`required check ${t.id} must identify expected workflow identity`)}}for(const t of e.sensitivePaths??[]){assertNestedEntryCount(t.patterns,`sensitive path rule ${t.id} patterns`);assertNestedEntryCount(t.requiredReviewers,`sensitive path rule ${t.id} reviewers`);assertString(t.id,"sensitive path rule id");t.patterns.forEach(e=>assertString(e,`sensitive path rule ${t.id} pattern`));t.requiredReviewers.forEach(e=>assertString(e,`sensitive path rule ${t.id} reviewer`));if(t.requiredCount<1||!Number.isInteger(t.requiredCount))fail(`sensitive path rule ${t.id} requiredCount must be a positive integer`)}for(const t of Object.values(e.reviewability?.budgets??{})){if(!Number.isInteger(t)||t<0)fail("reviewability budgets must be non-negative integers")}}function assertPatchgatePolicy(e){validate(e,h,"PatchGate policy");assertPolicySemantics(e)}function assertNativeControlsContract(e,t,r,n){const s=e?.branchProtection;const i=e?.rulesets;const o=t.find(e=>e.kind==="branch_protection");if(s!==undefined){if(o===undefined)fail(`${n} requires an enforced branch-protection policy source`,"NATIVE_CONTROL_SOURCE_MISSING");if(o.revision!==r)fail(`${n} branch-protection source must be bound to baseSha`,"POLICY_SOURCE_REVISION_MISMATCH");if(o.digest!==(0,a.sha256Digest)(s))fail(`${n} branch-protection digest does not match the normalized native control`,"NATIVE_CONTROL_DIGEST_MISMATCH");const e=s.requiredChecks.map(e=>`${e.context}\0${e.appId??""}`);assertUniqueStrings(e,`${n} branch-protection required checks`);const t=s.requiredChecks.length>0||s.requiredApprovals>0||s.requireCodeOwnerReviews||s.requireLastPushApproval||s.requiredReviewThreadResolution;if(s.decisionBearing!==t)fail(`${n} branch-protection decision-bearing flag is inconsistent`,"NATIVE_CONTROL_INCONSISTENT")}if(i!==undefined){const e=t.find(e=>e.kind==="ruleset");if(e===undefined)fail(`${n} requires an enforced ruleset policy source`,"NATIVE_CONTROL_SOURCE_MISSING");if(e.revision!==r)fail(`${n} ruleset source must be bound to baseSha`,"POLICY_SOURCE_REVISION_MISMATCH");if(e.digest!==(0,a.sha256Digest)(i))fail(`${n} ruleset digest does not match the normalized native controls`,"NATIVE_CONTROL_DIGEST_MISMATCH");assertUniqueStrings(i.map(e=>String(e.id)),`${n} ruleset IDs`);for(const e of i){const t=e.requiredChecks.map(e=>`${e.context}\0${e.appId??""}`);assertUniqueStrings(t,`${n} ruleset ${e.id} required checks`);const r=e.enforcement==="active"&&e.applicable&&e.ruleTypes.length>0;if(e.decisionBearing!==r)fail(`${n} ruleset ${e.id} decision-bearing flag is inconsistent`,"NATIVE_CONTROL_INCONSISTENT")}}}function validateObservationMeta(e,t,r){const n=Array.isArray(e)?e:[e];assertCollectionSize(n,`${t} observation metadata`);for(const e of n){assertUtcTimestamp(e.retrievedAt,`${t}.retrievedAt`);assertString(e.source.kind,`${t}.source.kind`);assertString(e.source.identity,`${t}.source.identity`);if(e.revision!==undefined)assertString(e.revision,`${t}.revision`);if(e.nextCursor!==undefined)assertString(e.nextCursor,`${t}.nextCursor`);if(e.complete&&e.permissionState!=="sufficient")fail(`${t} complete observation requires sufficient permission`,"OBSERVATION_INVARIANT");if(e.complete&&(e.truncated===true||e.nextCursor!==undefined))fail(`${t} complete observation cannot be truncated or paginated`,"OBSERVATION_INVARIANT");if(e.normalizedDigest!==undefined&&e.normalizedDigest!==r)fail(`${t} normalizedDigest does not match its normalized items`,"OBSERVATION_DIGEST_MISMATCH");if(e.complete&&e.normalizedDigest===undefined)fail(`${t} complete observation requires normalizedDigest`,"OBSERVATION_INVARIANT")}}function assertObservationRevision(e,t,r){if(e.revision!==undefined&&e.revision!==t)fail(`${r}.revision must match ${t}`,"OBSERVATION_INVARIANT")}function assertObservationContract(e){const t=e.observations;if(t.policySources.length!==e.policySources.length)fail("policy source observation metadata must correspond one-to-one with policy sources","OBSERVATION_INVARIANT");for(let r=0;r<t.policySources.length;r+=1){const n=t.policySources[r];const s=e.policySources[r];if(n.source.identity!==s.identity)fail("policy source observation metadata cannot be swapped between source records","OBSERVATION_INVARIANT");assertObservationRevision(n,s.revision,`observations.policySources[${r}]`);validateObservationMeta(n,`observations.policySources[${r}]`,(0,c.normalizedObservationDigest)(e,"policySources"))}const r=[["changedPaths",t.changedPaths],["linkedIssues",t.linkedIssues],["reviews",t.reviews],["checks",t.checks],["ownership",t.ownership],["reviewability",t.reviewability]];for(const[t,n]of r){if(Array.isArray(n))fail(`observations.${t} must contain one observation metadata record`,"OBSERVATION_INVARIANT");const r=t==="ownership"?e.revisions.baseSha:t==="changedPaths"||t==="linkedIssues"?e.revisions.headSha:e.revisions.testedSha;assertObservationRevision(n,r,`observations.${t}`);validateObservationMeta(n,`observations.${t}`,(0,c.normalizedObservationDigest)(e,t))}}function assertCheckSemantics(e){const t=new Set;const r=new Set;for(const n of e.checks){assertString(n.name,"check name");assertString(n.testedSha,`check ${n.name} testedSha`);if(n.conclusion!==undefined)assertString(n.conclusion,`check ${n.name} conclusion`);if(n.status==="completed"&&n.conclusion===undefined)fail(`completed check ${n.name} must record a conclusion`,"CHECK_CONCLUSION_MISSING");assertUtcTimestamp(n.retrievedAt,"check retrievedAt");if(n.checkRunId!==undefined){if(t.has(n.checkRunId))fail(`duplicate checkRunId ${n.checkRunId}`,"DUPLICATE_EVIDENCE_ID");t.add(n.checkRunId)}if(n.workflowRunId!==undefined&&n.workflowRunAttempt!==undefined){const e=`${n.workflowRunId}:${n.workflowRunAttempt}:${n.name}:${n.testedSha}`;if(r.has(e))fail(`duplicate workflow run identity ${e}`,"DUPLICATE_EVIDENCE_ID");r.add(e)}if(n.sourceStrength==="github_app_expected"&&(n.appId===undefined||n.checkRunId===undefined))fail(`GitHub App check ${n.name} must record appId and checkRunId`,"CHECK_IDENTITY_MISSING");if(n.sourceStrength==="github_actions_workflow"&&(n.appId===undefined||n.workflowRunId===undefined||n.workflowRunAttempt===undefined||n.event===undefined||n.workflowId===undefined&&n.workflowPath===undefined)){fail(`GitHub Actions check ${n.name} must record appId, workflow identity, run identity, attempt, and event`,"CHECK_IDENTITY_MISSING")}if(e.revisions.targetKind==="merge_group"&&n.event!==undefined&&n.event!=="merge_group")fail(`check ${n.name} event is incompatible with merge_group target`,"TARGET_INVARIANT")}}function assertReviewSemantics(e){const t=new Set;const r=new Set;for(const n of e.reviews){if(t.has(n.reviewId))fail(`duplicate reviewId ${n.reviewId}`,"DUPLICATE_EVIDENCE_ID");t.add(n.reviewId);assertString(n.login,"reviewer login");assertString(n.commitId,`review ${n.login} commitId`);if(r.has(n.actorId)&&n.active&&n.state==="APPROVED"){}r.add(n.actorId);assertUniqueStrings(n.teams,`review ${n.login} teams`);if(new Set(n.teamIds).size!==n.teamIds.length)fail(`review ${n.login} teamIds must be unique`,"DUPLICATE_IDENTITY");assertString(n.qualification.source.kind,`review ${n.login} qualification source kind`);assertString(n.qualification.source.identity,`review ${n.login} qualification source identity`);if(n.qualification.revision!==undefined)assertString(n.qualification.revision,`review ${n.login} qualification revision`);if(n.qualification.revision!==undefined&&n.qualification.revision!==e.revisions.testedSha)fail(`review ${n.login} qualification revision must match testedSha`,"OBSERVATION_INVARIANT");const s=n.qualification.principalBindings??[];const i=s.map(e=>`${e.kind}\0${e.configuredPrincipal}\0${e.immutableId}`);assertUniqueStrings(i,`review ${n.login} qualification principals`);for(const e of s){assertString(e.configuredPrincipal,`review ${n.login} configured principal`);if(!Number.isInteger(e.immutableId)||e.immutableId<1)fail(`review ${n.login} qualification principal must have an immutable positive ID`,"OBSERVATION_INVARIANT")}}}function assertInputVersion(e){if(!isRecord(e)||e.schemaVersion===undefined)fail("evaluation input must declare schemaVersion","INPUT_VERSION_REQUIRED");if(e.schemaVersion!=="0.1")fail(`unsupported evaluation input schemaVersion: ${String(e.schemaVersion)}`,"INPUT_VERSION_UNSUPPORTED")}function assertEvaluationInput(e){assertInputVersion(e);validate(e,m,"evaluation input");const t=e;if(t.policy!==null)assertPatchgatePolicy(t.policy);assertString(t.repository.owner,"repository owner");assertString(t.repository.name,"repository name");assertString(t.revisions.baseSha,"baseSha");assertString(t.revisions.headSha,"headSha");assertString(t.revisions.testedSha,"testedSha");if(t.revisions.targetKind==="head"&&t.revisions.testedSha!==t.revisions.headSha)fail("head evaluation testedSha must equal headSha","TARGET_INVARIANT");if(t.revisions.targetKind==="merge"&&(t.revisions.mergeSha===undefined||t.revisions.testedSha!==t.revisions.mergeSha))fail("merge evaluation testedSha must equal the declared mergeSha","TARGET_INVARIANT");if(t.revisions.targetKind==="merge_group"&&(t.revisions.mergeGroupSha===undefined||t.revisions.testedSha!==t.revisions.mergeGroupSha))fail("merge-group evaluation testedSha must equal the declared mergeGroupSha","TARGET_INVARIANT");assertCollectionSize(t.policySources,"policy sources");assertCollectionSize(t.changedPaths,"changed paths");assertCollectionSize(t.linkedIssues,"linked issues");assertCollectionSize(t.reviews,"reviews");assertCollectionSize(t.checks,"checks");assertCollectionSize(t.ownershipRequirements,"ownership requirements");const r=t.policySources.map(e=>`${e.kind}\0${e.identity}`);assertUniqueStrings(r,"policy source identities");for(const e of t.policySources){assertString(e.identity,"policy source identity");assertString(e.revision,`policy source ${e.identity} revision`);if(e.revision!==t.revisions.baseSha)fail(`policy source ${e.identity} must be bound to baseSha`,"POLICY_SOURCE_REVISION_MISMATCH")}assertNativeControlsContract(t.nativeControls,t.policySources,t.revisions.baseSha,"evaluation input nativeControls");assertUniqueStrings(t.changedPaths,"changed paths");t.changedPaths.forEach(e=>assertString(e,"changed path"));const n=t.linkedIssues.map(e=>`${e.repository.toLowerCase()}#${e.number}`);assertUniqueStrings(n,"linked issues");const s=t.linkedIssues.map(e=>`${e.repositoryId}\0${e.issueId}`);assertUniqueStrings(s,"linked issue immutable identities");for(const e of t.linkedIssues){assertString(e.repositoryId,"linked issue repositoryId");assertString(e.issueId,"linked issue issueId")}const i=t.ownershipRequirements.map(e=>e.id);assertUniqueStrings(i,"ownership requirement ids");for(const e of t.ownershipRequirements){assertString(e.id,"ownership requirement id");assertUniqueStrings(e.owners,`ownership requirement ${e.id} owners`);e.owners.forEach(t=>assertString(t,`ownership requirement ${e.id} owner`));if(e.requiredCount<1||!Number.isInteger(e.requiredCount))fail(`ownership requirement ${e.id} requiredCount must be a positive integer`)}assertCheckSemantics(t);assertReviewSemantics(t);if(t.reviewability!==undefined)assertUniqueStrings(t.reviewability.ownershipDomains,"reviewability ownership domains");assertObservationContract(t)}function refSet(e){const t=new Set;for(const e of["changedPaths","linkedIssues","reviews","checks","ownership","reviewability"])t.add(`observation:${e}`);for(const r of e.checks){const e=(0,u.evidenceReference)(r);if(e.length>0)t.add(e)}for(const r of e.linkedIssues)if(r.linked)t.add(`issue:${r.repository}#${r.number}:${r.issueId}`);for(const r of e.reviews)t.add(`review:${r.reviewId}:actor:${r.actorId}:${r.commitId}`);return t}function reviewMatchesQualifiedPrincipal(e,t){if(t.length===0)return true;const r=e.qualification.principalBindings??[];return t.some(t=>r.some(r=>r.configuredPrincipal===t&&r.membershipState==="active"&&(r.kind==="user"?t===e.login||t===`@${e.login}`:e.teams.includes(t)&&e.teamIds.includes(r.immutableId))))}function assertReceiptEvidenceIntegrity(e){const t=refSet(e.evidence);const r=new Set(e.policySources.map(e=>`policy-source:${e.identity}`));for(const n of e.requirements){for(const e of n.evidenceRefs){if(!t.has(e)&&!r.has(e))fail(`requirement ${n.id} references missing evidence ${e}`,"RECEIPT_REFERENCE_MISSING")}if(n.result==="passed"&&["issue_linkage","required_check","ownership","human_handoff"].includes(n.ruleClass)&&n.evidenceRefs.length===0)fail(`passed requirement ${n.id} must reference selected evidence`,"RECEIPT_REFERENCE_MISSING");if(n.result==="passed"&&n.ruleClass==="issue_linkage"){const t=n.evidenceRefs.filter(e=>e.startsWith("issue:"));if(t.length===0||t.some(t=>{const r=/^issue:([^#]+)#(\d+):(.+)$/.exec(t);return r===null||!e.evidence.linkedIssues.some(e=>e.repository===r[1]&&e.number===Number(r[2])&&e.issueId===r[3]&&e.linked)}))fail(`passed issue requirement ${n.id} must reference verified linked issue evidence`,"RECEIPT_EVIDENCE_INCONSISTENT")}if(n.result==="passed"&&(n.ruleClass==="ownership"||n.ruleClass==="human_handoff")){const t=n.evidenceRefs.filter(e=>e.startsWith("review:"));const r=n.ruleClass==="human_handoff"?e.humanGates.find(e=>e.id===n.id.slice("handoff.".length))?.requiredReviewers??[]:e.evidence.ownershipRequirements.find(e=>e.id===n.id.slice("ownership.".length))?.owners??[];const s=new Set;if(t.length===0||t.some(t=>{const n=/^review:(\d+):actor:(\d+):(.+)$/.exec(t);if(n===null)return true;const i=e.evidence.reviews.find(e=>e.reviewId===Number(n[1])&&e.actorId===Number(n[2])&&e.commitId===n[3]);if(i===undefined||!i.qualified||!i.active||i.state!=="APPROVED"||i.commitId!==e.revisions.testedSha||i.qualification.complete!==true||i.qualification.permissionState!=="sufficient"||i.isAuthor||i.isBot||!reviewMatchesQualifiedPrincipal(i,r))return true;s.add(i.actorId);return false}))fail(`passed ${n.ruleClass} requirement ${n.id} must reference qualified current review evidence`,"RECEIPT_EVIDENCE_INCONSISTENT");const i=n.ruleClass==="human_handoff"?e.humanGates.find(e=>e.id===n.id.slice("handoff.".length))?.requiredCount:e.evidence.ownershipRequirements.find(e=>e.id===n.id.slice("ownership.".length))?.requiredCount;const o=n.observed?.requiredCount;const a=n.observed?.approvedCount;if(i===undefined||!Number.isInteger(i)||i<1||o!==i){fail(`passed ${n.ruleClass} requirement ${n.id} must preserve its configured requiredCount`,"RECEIPT_EVIDENCE_INCONSISTENT")}if(s.size<i||a!==s.size){fail(`passed ${n.ruleClass} requirement ${n.id} does not have enough distinct approved actors`,"RECEIPT_EVIDENCE_INCONSISTENT")}}if(n.result==="passed"&&n.ruleClass==="required_check"){for(const t of n.evidenceRefs){const r=e.evidence.checks.find(e=>t===(0,u.evidenceReference)(e));if(r===undefined||r.testedSha!==e.revisions.testedSha||r.status!=="completed"||r.conclusion===undefined)fail(`passed check requirement ${n.id} selected invalid evidence`,"RECEIPT_EVIDENCE_INCONSISTENT");const s=n.observed??{};const i=s.selectedEvidenceRef;if(typeof i==="string"&&i!==t)fail(`passed check requirement ${n.id} selected evidence reference is inconsistent`,"RECEIPT_EVIDENCE_INCONSISTENT");if(s.name!==r.name||s.testedSha!==r.testedSha||s.target!==e.revisions.targetKind||s.resolution!=="passed"){fail(`passed check requirement ${n.id} selected check name, target, or resolution is inconsistent`,"RECEIPT_EVIDENCE_INCONSISTENT")}if(s.selectedConclusion!==r.conclusion||!Array.isArray(s.acceptableConclusions)||!s.acceptableConclusions.includes(r.conclusion)){fail(`passed check requirement ${n.id} selected an unacceptable conclusion`,"RECEIPT_EVIDENCE_INCONSISTENT")}const o=s.sourceConstraint;if(o!=="unconstrained"&&(s.expectedSourceKind!==r.sourceStrength||s.expectedAppId!==r.appId)){fail(`passed check requirement ${n.id} does not match its expected immutable source`,"RECEIPT_EVIDENCE_INCONSISTENT")}const a=[["expectedAppSlug",r.appSlug],["expectedWorkflowId",r.workflowId],["expectedWorkflowPath",r.workflowPath],["expectedEvent",r.event]];for(const[e,t]of a)if(s[e]!==undefined&&s[e]!==t)fail(`passed check requirement ${n.id} expected ${e} is inconsistent`,"RECEIPT_EVIDENCE_INCONSISTENT");if(o!=="unconstrained"&&o!=="app_id"&&r.sourceStrength==="github_actions_workflow"&&s.expectedWorkflowId===undefined&&s.expectedWorkflowPath===undefined){fail(`passed check requirement ${n.id} must preserve its expected workflow identity`,"RECEIPT_EVIDENCE_INCONSISTENT")}const c=[["sourceStrength",r?.sourceStrength],["appId",r?.appId],["checkRunId",r?.checkRunId],["workflowId",r?.workflowId],["workflowPath",r?.workflowPath],["workflowRunId",r?.workflowRunId],["workflowRunAttempt",r?.workflowRunAttempt],["event",r?.event]];for(const[e,t]of c)if(s[e]!==undefined&&s[e]!==t)fail(`passed check requirement ${n.id} selected ${e} is inconsistent`,"RECEIPT_EVIDENCE_INCONSISTENT")}}const s=e.evidence.checks.flatMap(e=>e.checkRunId===undefined?[]:[e.checkRunId]);if(new Set(s).size!==s.length)fail("receipt evidence contains duplicate checkRunId values","DUPLICATE_EVIDENCE_ID");const i=e.evidence.checks.flatMap(e=>e.workflowRunId===undefined||e.workflowRunAttempt===undefined?[]:[`${e.workflowRunId}:${e.workflowRunAttempt}:${e.name}:${e.testedSha}`]);if(new Set(i).size!==i.length)fail("receipt evidence contains duplicate workflow run identities","DUPLICATE_EVIDENCE_ID")}for(const t of e.humanGates){const r=e.requirements.find(e=>e.id===`handoff.${t.id}`);if(r===undefined)fail(`human gate ${t.id} has no matching requirement`,"RECEIPT_GATE_INCONSISTENT");const n=new Set(e.evidence.reviews.filter(r=>r.active&&r.state==="APPROVED"&&r.commitId===e.revisions.testedSha&&r.qualified&&r.qualification.complete&&r.qualification.permissionState==="sufficient"&&!r.isAuthor&&!r.isBot&&reviewMatchesQualifiedPrincipal(r,t.requiredReviewers)).map(e=>`actor:${e.actorId}`));if(!Number.isInteger(t.requiredCount)||t.requiredCount<1)fail(`human gate ${t.id} has an invalid requiredCount`,"RECEIPT_GATE_INCONSISTENT");if(t.approvedBy.some(e=>!n.has(e)))fail(`human gate ${t.id} references an unavailable approved actor`,"RECEIPT_GATE_INCONSISTENT");const s=new Set(r.evidenceRefs.filter(e=>e.startsWith("review:")).map(e=>{const t=/^review:\d+:actor:(\d+):/.exec(e);return t===null?undefined:`actor:${t[1]}`}).filter(e=>e!==undefined));const i=new Set(t.approvedBy);if(i.size!==t.approvedBy.length||i.size!==s.size||[...i].some(e=>!s.has(e)))fail(`human gate ${t.id} approvedBy does not exactly match its requirement evidence`,"RECEIPT_GATE_INCONSISTENT");const o=i.size>=t.requiredCount;if(t.satisfied!==o||t.satisfied!==(r.result==="passed"))fail(`human gate ${t.id} does not match its required approval count or requirement`,"RECEIPT_GATE_INCONSISTENT")}}function assertReceiptObservationContract(e){const t={policySources:e.policySources,changedPaths:e.changedPaths,linkedIssues:e.evidence.linkedIssues,reviews:e.evidence.reviews,checks:e.evidence.checks,ownershipRequirements:e.evidence.ownershipRequirements,reviewability:e.reviewability};const expected=e=>(0,c.normalizedObservationDigest)(t,e);if(e.observations.policySources.length!==e.policySources.length)fail("receipt policy source observation metadata must correspond one-to-one with policy sources","OBSERVATION_INVARIANT");for(let t=0;t<e.observations.policySources.length;t+=1){const r=e.observations.policySources[t];if(r.source.identity!==e.policySources[t].identity)fail("receipt policy source observation metadata cannot be swapped","OBSERVATION_INVARIANT");assertObservationRevision(r,e.policySources[t].revision,`receipt.observations.policySources[${t}]`);validateObservationMeta(r,`receipt.observations.policySources[${t}]`,expected("policySources"))}const r=[["changedPaths",e.observations.changedPaths],["linkedIssues",e.observations.linkedIssues],["reviews",e.observations.reviews],["checks",e.observations.checks],["ownership",e.observations.ownership],["reviewability",e.observations.reviewability]];for(const[t,n]of r){const r=t==="ownership"?e.revisions.baseSha:t==="changedPaths"||t==="linkedIssues"?e.revisions.headSha:e.revisions.testedSha;assertObservationRevision(n,r,`receipt.observations.${t}`);validateObservationMeta(n,`receipt.observations.${t}`,expected(t))}}function assertContributionReceipt(e){validate(e,g,"ContributionReceipt");const t=e;assertUtcTimestamp(t.evaluatedAt,"evaluatedAt");const r=t.requirements.map(e=>e.id);assertUniqueStrings(r,"ContributionReceipt requirement id");const n=(0,i.determineFinalStatus)(t.requirements);if(t.final.status!==n)fail(`ContributionReceipt final status must be ${n}`,"RECEIPT_STATE_INCONSISTENT");const s=t.requirements.filter(e=>e.result!=="passed").map(e=>e.id);if(s.length!==t.final.reasonIds.length||s.some((e,r)=>t.final.reasonIds[r]!==e))fail("ContributionReceipt reasonIds do not match its non-passing requirements","RECEIPT_STATE_INCONSISTENT");const o=t.policySources.map(e=>`${e.kind}\0${e.identity}`);assertUniqueStrings(o,"ContributionReceipt policy source identities");for(const e of t.policySources)if(e.revision!==t.revisions.baseSha)fail(`ContributionReceipt policy source ${e.identity} must be bound to baseSha`,"POLICY_SOURCE_REVISION_MISMATCH");assertNativeControlsContract(t.nativeControls,t.policySources,t.revisions.baseSha,"ContributionReceipt nativeControls");const a=t.policySources.find(e=>e.kind==="patchgate"&&(e.identity==="patchgate.yml"||e.identity===".github/patchgate.yml"));if(a!==undefined&&a.digest!==t.policyDigest)fail("ContributionReceipt policyDigest does not match patchgate.yml source digest","RECEIPT_EVIDENCE_INCONSISTENT");for(const e of t.evidence.checks)assertUtcTimestamp(e.retrievedAt,"check retrievedAt");const u=t.evidence.reviews.map(e=>e.reviewId);assertUniqueStrings(u.map(String),"ContributionReceipt review identities");for(const e of t.evidence.reviews)if(e.qualification.revision!==undefined&&e.qualification.revision!==t.revisions.testedSha)fail(`ContributionReceipt review ${e.reviewId} qualification must be bound to testedSha`,"OBSERVATION_INVARIANT");assertReceiptObservationContract(t);assertReceiptEvidenceIntegrity(t);const d=(0,c.receiptDigest)(t);if(t.receiptDigest!==d)fail("ContributionReceipt receiptDigest does not match its deterministic receipt core","RECEIPT_DIGEST_MISMATCH")}function assertUtcTimestamp(e,t){const r=e.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{3}))?Z$/);if(r===null)fail(`${t} must be a UTC ISO-8601 timestamp`,"TIMESTAMP_INVALID");const n=Date.parse(e);if(!Number.isFinite(n))fail(`${t} must be a valid timestamp`,"TIMESTAMP_INVALID");const s=r[2]===undefined?`${r[1]}.000Z`:e;if(new Date(n).toISOString()!==s)fail(`${t} must be a valid calendar timestamp`,"TIMESTAMP_INVALID")}function parseEvaluationInputJson(e){let t;try{t=JSON.parse(e)}catch(e){const t=e instanceof Error?e.message:"malformed JSON";fail(`evaluation input JSON is malformed: ${t}`,"JSON_MALFORMED")}assertEvaluationInput(t);return t}},1780:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.evaluateValidated=evaluateValidated;t.deliverReceipt=deliverReceipt;const n=r(395);const s=r(1140);const i=r(5291);const o=r(311);const a="patchgate.yml";function isPatchgatePolicySource(e){return e.kind==="patchgate"&&(e.identity==="patchgate.yml"||e.identity===".github/patchgate.yml")}function compareIds(e,t){return e.id<t.id?-1:e.id>t.id?1:0}function requirement(e){return{...e,evidenceRefs:e.evidenceRefs??[]}}function policyObservationComplete(e){return e.observations.policySources.length>0&&e.observations.policySources.every(e=>e.complete&&e.permissionState==="sufficient")}function groupAvailable(e,t){if(t==="policySources")return policyObservationComplete(e);const r=e.observations[t];return!Array.isArray(r)&&r.complete&&r.permissionState==="sufficient"}function hasPatchgateSource(e){if(!policyObservationComplete(e))return false;if(e.policy===null)return false;const t=e.policySources.filter(e=>isPatchgatePolicySource(e)&&e.authority==="enforced");if(t.length!==1)return false;const r=t[0];return r.revision===e.revisions.baseSha&&r.digest===e.policyDigest&&r.contractDigest===(0,s.normalizedPolicyDigest)(e.policy)}function hasBasePolicySource(e,t){return e.policySources.some(r=>r.kind===t&&r.revision===e.revisions.baseSha&&r.authority==="enforced")}function matchedPath(e,t){return t.some(t=>{const r=t.replace(/[.+^${}()|[\]\\?]/g,"\\$&").replace(/\*\*/g,"\0").replace(/\*/g,"[^/]*").replace(/\u0000/g,".*");const n=new RegExp(`^${r}$`);return e.some(e=>n.test(e))})}function changedPolicyPaths(e,t){const r=e.policySources.filter(isPatchgatePolicySource).map(e=>e.identity);return[a,...r,...t.policyChanges?.paths??[]]}function qualifiedApprovals(e,t,r){const n=new Map;for(const t of e.filter(e=>e.active)){const e=n.get(t.actorId)??[];e.push(t);n.set(t.actorId,e)}const s=[];for(const e of n.values()){if(e.some(e=>e.state!=="APPROVED"))continue;const n=e.find(e=>e.state==="APPROVED"&&e.commitId===t&&e.qualified&&e.qualification.complete&&e.qualification.permissionState==="sufficient"&&!e.isAuthor&&!e.isBot&&principalMatches(e,r));if(n!==undefined)s.push(n)}return s}function hasUnknownQualification(e,t,r){return e.some(e=>e.active&&e.state==="APPROVED"&&e.commitId===t&&!e.isAuthor&&!e.isBot&&(r.length===0||r.includes(e.login)||r.includes(`@${e.login}`)||e.teams.some(e=>r.includes(e)))&&(!e.qualification.complete||e.qualification.permissionState!=="sufficient"||!principalMatches(e,r)))}function principalMatches(e,t){if(t.length===0)return true;const r=e.qualification.principalBindings??[];return t.some(t=>r.some(r=>r.configuredPrincipal===t&&r.membershipState==="active"&&(r.kind==="user"?t===e.login||t===`@${e.login}`:e.teams.includes(t)&&e.teamIds.includes(r.immutableId))))}function observationRequirement(e,t,r){return requirement({id:e,ruleClass:"policy_integrity",authority:"derived",source:`observation:${t}`,result:"unknown",severity:"evidence",observed:{observation:t},remediation:r})}function policyRequirements(e){const t=e.policySources.find(e=>isPatchgatePolicySource(e));const r=t===undefined?[]:[`policy-source:${t.identity}`];if(!policyObservationComplete(e)||e.policy===null||!hasPatchgateSource(e)){return[requirement({id:"policy.base_revision",ruleClass:"policy_integrity",authority:"patchgate",source:a,result:"unknown",severity:"block",remediation:"Load patchgate.yml from the trusted PR base SHA and bind both its raw and normalized contract digests before evaluating the PR.",evidenceRefs:r})]}return[requirement({id:"policy.base_revision",ruleClass:"policy_integrity",authority:"patchgate",source:a,result:"passed",severity:"block",observed:{baseSha:e.revisions.baseSha},remediation:"Keep the policy source bound to the PR base SHA and its normalized contract digest.",evidenceRefs:r})]}function issueRequirements(e,t){if(!t.issueLinkage?.required)return[];if(!groupAvailable(e,"linkedIssues"))return[observationRequirement("observation.linked_issues","linkedIssues","Retrieve complete, permission-sufficient linked-issue metadata; a body-only issue number is not verified linkage.")];const r=e.linkedIssues.filter(e=>e.linked);return[requirement({id:"issue.linkage",ruleClass:"issue_linkage",authority:"patchgate",source:a,result:r.length>0?"passed":"failed",severity:"block",observed:{linkedIssueCount:r.length},remediation:"Link at least one valid issue through GitHub metadata; a body-only number is not sufficient evidence.",evidenceRefs:r.map(e=>`issue:${e.repository}#${e.number}:${e.issueId}`)})]}function checkRequirements(e,t){const r=groupAvailable(e,"checks");return(t.requiredChecks??[]).map(t=>{if(!r)return requirement({id:`check.${t.id}`,ruleClass:"required_check",authority:"patchgate",source:a,result:"unknown",severity:"evidence",observed:{name:t.name,resolution:"observation_incomplete"},remediation:`Retrieve complete check/workflow evidence for ${t.name} from the configured target revision and expected source.`});const n=t.target===e.revisions.targetKind?e.revisions.testedSha:undefined;const s=(0,i.resolveCheckEvidence)(e.checks,t,n);const o=s.status==="passed"||s.status==="failed"?s.evidence:undefined;const c=s.status==="passed"?"passed":s.status==="failed"?"failed":"unknown";const u=o===undefined?{}:{selectedEvidenceRef:(0,i.evidenceReference)(o),selectedConclusion:o.conclusion??"",sourceStrength:o.sourceStrength,...o.appId===undefined?{}:{appId:o.appId},...o.checkRunId===undefined?{}:{checkRunId:o.checkRunId},...o.workflowId===undefined?{}:{workflowId:o.workflowId},...o.workflowPath===undefined?{}:{workflowPath:o.workflowPath},...o.workflowRunId===undefined?{}:{workflowRunId:o.workflowRunId},...o.workflowRunAttempt===undefined?{}:{workflowRunAttempt:o.workflowRunAttempt},...o.event===undefined?{}:{event:o.event}};const d={expectedSourceKind:t.expectedSource.kind,...t.expectedSource.appSlug===undefined?{}:{expectedAppSlug:t.expectedSource.appSlug},...t.expectedSource.appId===undefined?{}:{expectedAppId:t.expectedSource.appId},...t.expectedSource.workflowId===undefined?{}:{expectedWorkflowId:t.expectedSource.workflowId},...t.expectedSource.workflowPath===undefined?{}:{expectedWorkflowPath:t.expectedSource.workflowPath},...t.expectedSource.event===undefined?{}:{expectedEvent:t.expectedSource.event}};return requirement({id:`check.${t.id}`,ruleClass:"required_check",authority:"patchgate",source:a,result:c,severity:s.status==="failed"?"block":"evidence",observed:{name:t.name,target:t.target,testedSha:e.revisions.testedSha,acceptableConclusions:t.acceptableConclusions,resolution:s.status,...s.status==="passed"?{}:{resolutionReason:s.reason},...d,...u},remediation:`Provide a completed ${t.name} check from the expected source on the configured ${t.target} revision.`,evidenceRefs:o===undefined?[]:[(0,i.evidenceReference)(o)]})})}function resolveNativeCheckEvidence(e,t,r,n){const s=e.filter(e=>e.name===t);const o=t.includes(" / ")?t.slice(t.lastIndexOf(" / ")+3):undefined;const a=s.length>0?s:o===undefined?[]:e.filter(e=>e.name===o);if(a.length===0)return{status:"missing",reason:"no_candidate"};const c=a.filter(e=>e.testedSha===r);if(c.length===0)return{status:"missing",reason:"wrong_target"};const u=n===undefined?c:c.filter(e=>e.appId===n);if(u.length===0)return{status:"missing",reason:"wrong_source"};if(u.length>1)return{status:"ambiguous",reason:"duplicate_eligible_candidates"};const d=u[0];if(d.status!=="completed")return{status:"missing",reason:"pending"};if((0,i.evidenceReference)(d).length===0)return{status:"missing",reason:"unattributed_evidence"};const l=["success","neutral","skipped"];if(!l.includes(d.conclusion??""))return{status:"failed",evidence:d,reason:"unacceptable_conclusion"};return{status:"passed",evidence:d}}function nativeCheckRequirementsForSource(e,t){return t.requiredChecks.map((r,n)=>{const s={name:r.context,context:r.context,target:e.revisions.targetKind,testedSha:e.revisions.testedSha,acceptableConclusions:["success","neutral","skipped"],sourceConstraint:r.appId===undefined?"unconstrained":"app_id",...r.appId===undefined?{}:{expectedAppId:r.appId}};if(!groupAvailable(e,"checks"))return requirement({id:`${t.idPrefix}.check.${n+1}`,ruleClass:"required_check",authority:t.authority,source:t.sourceIdentity,result:"unknown",severity:"evidence",observed:{...s,resolution:"observation_incomplete"},remediation:`Retrieve complete check/workflow evidence for the native context ${r.context} on ${e.revisions.testedSha}.`});const o=resolveNativeCheckEvidence(e.checks,r.context,e.revisions.testedSha,r.appId);const a=o.status==="passed"||o.status==="failed"?o.evidence:undefined;const c=o.status==="passed"?"passed":o.status==="failed"?"failed":"unknown";const u=a===undefined?{}:{name:a.name,selectedEvidenceRef:(0,i.evidenceReference)(a),selectedConclusion:a.conclusion??"",expectedSourceKind:a.sourceStrength,...a.appId===undefined?{}:{appId:a.appId},...a.checkRunId===undefined?{}:{checkRunId:a.checkRunId},...a.workflowId===undefined?{}:{workflowId:a.workflowId},...a.workflowPath===undefined?{}:{workflowPath:a.workflowPath},...a.workflowRunId===undefined?{}:{workflowRunId:a.workflowRunId},...a.workflowRunAttempt===undefined?{}:{workflowRunAttempt:a.workflowRunAttempt},...a.event===undefined?{}:{event:a.event}};return requirement({id:`${t.idPrefix}.check.${n+1}`,ruleClass:"required_check",authority:t.authority,source:t.sourceIdentity,result:c,severity:o.status==="failed"?"block":"evidence",observed:{...s,resolution:o.status,...o.status==="passed"?{}:{resolutionReason:o.reason},...u},remediation:r.appId===undefined?`Provide a completed ${r.context} check on ${e.revisions.testedSha}; the native control does not declare a source App, so PatchGate still requires an immutable check/workflow identity.`:`Provide a completed ${r.context} check from GitHub App ${r.appId} on ${e.revisions.testedSha}.`,evidenceRefs:a===undefined?[]:[(0,i.evidenceReference)(a)]})})}function nativeCheckRequirements(e){const t=[];const r=e.nativeControls?.branchProtection;if(r!==undefined){const n=e.policySources.find(e=>e.kind==="branch_protection");t.push({authority:"branch_protection",sourceIdentity:n?.identity??"branch-protection",idPrefix:"native.branch_protection",requiredChecks:r.requiredChecks})}for(const r of e.nativeControls?.rulesets??[]){if(r.enforcement!=="active"||!r.applicable)continue;const n=e.policySources.find(e=>e.kind==="ruleset");t.push({authority:"ruleset",sourceIdentity:n?.identity??"repository-rulesets",idPrefix:`native.ruleset.${r.id}`,requiredChecks:r.requiredChecks})}return t.flatMap(t=>nativeCheckRequirementsForSource(e,t))}function nativeReviewRequirements(e){const t=e.nativeControls?.branchProtection;if(t===undefined)return{requirements:[],gates:[]};const r=e.policySources.find(e=>e.kind==="branch_protection");const n=r?.identity??"branch-protection";const s=[];const i=[];const addGate=(e,t,r,o,a,c,u,d)=>{const l={id:e,reason:t,satisfied:a==="passed",requiredReviewers:r,requiredCount:o,approvedBy:d.map(e=>`actor:${e.actorId}`)};i.push(l);s.push(requirement({id:`handoff.${e}`,ruleClass:"human_handoff",authority:"branch_protection",source:n,result:a,severity:a==="failed"?"human_gate":"evidence",observed:c,remediation:u,evidenceRefs:d.map(e=>`review:${e.reviewId}:actor:${e.actorId}:${e.commitId}`)}))};if(t.requiredApprovals>0){if(!groupAvailable(e,"reviews")){addGate("native.branch_protection.required_approvals",`GitHub branch protection requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,"unknown",{requiredCount:t.requiredApprovals,resolution:"observation_incomplete"},"Retrieve complete review and reviewer-qualification evidence before evaluating the native approval gate.",[])}else if(hasUnknownQualification(e.reviews,e.revisions.testedSha,[])){addGate("native.branch_protection.required_approvals",`GitHub branch protection requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,"unknown",{requiredCount:t.requiredApprovals,resolution:"qualification_unavailable"},"Retrieve sufficient collaborator qualification for current approving reviews before evaluating the native approval gate.",[])}else{const r=qualifiedApprovals(e.reviews,e.revisions.testedSha,[]);addGate("native.branch_protection.required_approvals",`GitHub branch protection requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,r.length>=t.requiredApprovals?"passed":"failed",{requiredCount:t.requiredApprovals,approvedCount:r.length},`Obtain ${t.requiredApprovals} active, qualified, non-author approval(s) on ${e.revisions.testedSha}.`,r)}}if(t.requireCodeOwnerReviews){if(!groupAvailable(e,"ownership")){addGate("native.branch_protection.codeowners","GitHub branch protection requires review from the applicable CODEOWNERS.",[],1,"unknown",{resolution:"ownership_observation_incomplete"},"Retrieve complete CODEOWNERS evidence from the trusted base revision before evaluating the native code-owner gate.",[])}else{for(const t of e.ownershipRequirements){const r=`native.branch_protection.codeowners.${t.id}`;if(hasUnknownQualification(e.reviews,e.revisions.testedSha,t.owners)){addGate(r,`GitHub branch protection requires an applicable CODEOWNERS approval for ${t.id}.`,t.owners,t.requiredCount,"unknown",{requiredCount:t.requiredCount,resolution:"qualification_unavailable"},`Retrieve sufficient qualification for the configured CODEOWNERS principal(s): ${t.owners.join(", ")}.`,[]);continue}const n=qualifiedApprovals(e.reviews,e.revisions.testedSha,t.owners);addGate(r,`GitHub branch protection requires an applicable CODEOWNERS approval for ${t.id}.`,t.owners,t.requiredCount,n.length>=t.requiredCount?"passed":"failed",{requiredCount:t.requiredCount,approvedCount:n.length},`Obtain ${t.requiredCount} active, qualified CODEOWNERS approval(s) for ${t.id}.`,n)}}}if(t.requireLastPushApproval){addGate("native.branch_protection.last_push_approval","GitHub branch protection requires approval from someone other than the last pusher.",[],1,"unknown",{resolution:"last_pusher_identity_unavailable"},"Provide immutable last-pusher identity evidence before evaluating this native control; the current PR snapshot does not include it.",[])}return{requirements:s,gates:i}}function nativeRulesetReviewRequirements(e){const t=[];const r=[];const n=e.policySources.find(e=>e.kind==="ruleset");const s=n?.identity??"repository-rulesets";const addGate=(e,n,i,o,a,c,u,d,l)=>{const p=`native.ruleset.${e}.${n}`;r.push({id:p,reason:i,satisfied:c==="passed",requiredReviewers:o,requiredCount:a,approvedBy:l.map(e=>`actor:${e.actorId}`)});t.push(requirement({id:`handoff.${p}`,ruleClass:"human_handoff",authority:"ruleset",source:s,result:c,severity:c==="failed"?"human_gate":"evidence",observed:u,remediation:d,evidenceRefs:l.map(e=>`review:${e.reviewId}:actor:${e.actorId}:${e.commitId}`)}))};for(const t of e.nativeControls?.rulesets??[]){if(t.enforcement!=="active"||!t.applicable)continue;if(t.requiredApprovals>0){if(!groupAvailable(e,"reviews"))addGate(t.id,"required_approvals",`Ruleset ${t.name} requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,"unknown",{requiredCount:t.requiredApprovals,resolution:"observation_incomplete"},"Retrieve complete review and reviewer-qualification evidence before evaluating the ruleset approval gate.",[]);else if(hasUnknownQualification(e.reviews,e.revisions.testedSha,[]))addGate(t.id,"required_approvals",`Ruleset ${t.name} requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,"unknown",{requiredCount:t.requiredApprovals,resolution:"qualification_unavailable"},"Retrieve sufficient collaborator qualification for current approving reviews before evaluating the ruleset approval gate.",[]);else{const r=qualifiedApprovals(e.reviews,e.revisions.testedSha,[]);addGate(t.id,"required_approvals",`Ruleset ${t.name} requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,r.length>=t.requiredApprovals?"passed":"failed",{requiredCount:t.requiredApprovals,approvedCount:r.length},`Obtain ${t.requiredApprovals} active, qualified, non-author approval(s) on ${e.revisions.testedSha}.`,r)}}if(t.requireCodeOwnerReviews){if(!groupAvailable(e,"ownership"))addGate(t.id,"codeowners",`Ruleset ${t.name} requires applicable CODEOWNERS approval.`,[],1,"unknown",{resolution:"ownership_observation_incomplete"},"Retrieve complete CODEOWNERS evidence from the trusted base revision before evaluating the ruleset code-owner gate.",[]);else for(const r of e.ownershipRequirements){const n=`Ruleset ${t.name} requires applicable CODEOWNERS approval for ${r.id}.`;if(hasUnknownQualification(e.reviews,e.revisions.testedSha,r.owners))addGate(t.id,`codeowners.${r.id}`,n,r.owners,r.requiredCount,"unknown",{requiredCount:r.requiredCount,resolution:"qualification_unavailable"},`Retrieve sufficient qualification for the configured CODEOWNERS principal(s): ${r.owners.join(", ")}.`,[]);else{const s=qualifiedApprovals(e.reviews,e.revisions.testedSha,r.owners);addGate(t.id,`codeowners.${r.id}`,n,r.owners,r.requiredCount,s.length>=r.requiredCount?"passed":"failed",{requiredCount:r.requiredCount,approvedCount:s.length},`Obtain ${r.requiredCount} active, qualified CODEOWNERS approval(s) for ${r.id}.`,s)}}}if(t.requireLastPushApproval)addGate(t.id,"last_push_approval",`Ruleset ${t.name} requires approval from someone other than the last pusher.`,[],1,"unknown",{resolution:"last_pusher_identity_unavailable"},"Provide immutable last-pusher identity evidence before evaluating this ruleset control.",[]);if(t.requiredReviewThreadResolution)addGate(t.id,"review_thread_resolution",`Ruleset ${t.name} requires all review threads to be resolved.`,[],1,"unknown",{resolution:"review_thread_observation_unavailable"},"Provide complete review-thread resolution evidence before evaluating this ruleset control.",[])}return{requirements:t,gates:r}}function ownershipRequirements(e,t){if(!t.ownership?.requireCodeOwnerApproval)return[];if(!hasBasePolicySource(e,"codeowners"))return[observationRequirement("ownership.observation","ownership","Retrieve the complete CODEOWNERS-derived ownership requirement from the trusted base revision and record its source identity.")];if(!groupAvailable(e,"ownership"))return[observationRequirement("ownership.observation","ownership","Retrieve complete CODEOWNERS-derived ownership requirements from the trusted base revision.")];if(e.ownershipRequirements.length===0)return[requirement({id:"ownership.no_match",ruleClass:"ownership",authority:"codeowners",source:"CODEOWNERS@base",result:"passed",severity:"human_gate",observed:{ownershipRequirementCount:0},remediation:"Retain the complete base CODEOWNERS observation proving that no ownership rule matched the changed paths.",evidenceRefs:["observation:ownership"]})];if(!groupAvailable(e,"reviews"))return[observationRequirement("reviews.observation","reviews","Retrieve complete review and reviewer-qualification metadata before evaluating ownership approval.")];if(hasUnknownQualification(e.reviews,e.revisions.testedSha,e.ownershipRequirements.flatMap(e=>e.owners)))return[observationRequirement("reviews.qualification","reviews","Retrieve immutable actor/team qualification and sufficient permission before evaluating ownership approval.")];return e.ownershipRequirements.map(t=>{const r=qualifiedApprovals(e.reviews,e.revisions.testedSha,t.owners);const n=r.length>=t.requiredCount;return requirement({id:`ownership.${t.id}`,ruleClass:"ownership",authority:"codeowners",source:"CODEOWNERS@base",result:n?"passed":"failed",severity:"human_gate",observed:{requiredCount:t.requiredCount,approvedCount:r.length},remediation:`Obtain ${t.requiredCount} active, qualified CODEOWNERS approval on ${e.revisions.testedSha}.`,evidenceRefs:r.map(e=>`review:${e.reviewId}:actor:${e.actorId}:${e.commitId}`)})})}function humanHandoffRequirements(e,t){const r=[];const n=[];if(!groupAvailable(e,"changedPaths")){return{requirements:[observationRequirement("changed_paths.observation","changedPaths","Retrieve the complete changed-path collection before deciding policy-change or sensitive-path matches.")],gates:n}}for(const s of t.sensitivePaths??[]){if(!matchedPath(e.changedPaths,s.patterns))continue;if(!groupAvailable(e,"reviews")){r.push(requirement({id:`handoff.${s.id}`,ruleClass:"human_handoff",authority:"patchgate",source:a,result:"unknown",severity:"evidence",observed:{matched:true,requiredCount:s.requiredCount,resolution:"reviews_unavailable"},remediation:`Retrieve complete qualified-review evidence for sensitive path rule ${s.id}.`}));n.push({id:s.id,reason:`Sensitive path rule matched: ${[...s.patterns].sort().join(", ")}`,satisfied:false,requiredReviewers:s.requiredReviewers,requiredCount:s.requiredCount,approvedBy:[]});continue}if(hasUnknownQualification(e.reviews,e.revisions.testedSha,s.requiredReviewers)){r.push(requirement({id:`handoff.${s.id}`,ruleClass:"human_handoff",authority:"patchgate",source:a,result:"unknown",severity:"evidence",observed:{matched:true,requiredCount:s.requiredCount,resolution:"qualification_unavailable"},remediation:`Retrieve immutable reviewer/team qualification evidence for sensitive path rule ${s.id}.`}));n.push({id:s.id,reason:`Sensitive path rule matched: ${[...s.patterns].sort().join(", ")}`,satisfied:false,requiredReviewers:s.requiredReviewers,requiredCount:s.requiredCount,approvedBy:[]});continue}const t=qualifiedApprovals(e.reviews,e.revisions.testedSha,s.requiredReviewers);const i=t.length>=s.requiredCount;const o={id:s.id,reason:`Sensitive path rule matched: ${[...s.patterns].sort().join(", ")}`,satisfied:i,requiredReviewers:s.requiredReviewers,requiredCount:s.requiredCount,approvedBy:t.map(e=>`actor:${e.actorId}`)};n.push(o);r.push(requirement({id:`handoff.${s.id}`,ruleClass:"human_handoff",authority:"patchgate",source:a,result:i?"passed":"failed",severity:s.humanGate?"human_gate":"block",observed:{matched:true,requiredCount:s.requiredCount,approvedCount:t.length},remediation:`Obtain the configured human approval for ${s.id}; PatchGate cannot force an agent to stop.`,evidenceRefs:t.map(e=>`review:${e.reviewId}:actor:${e.actorId}:${e.commitId}`)}))}if(t.policyChanges!==undefined){if(!matchedPath(e.changedPaths,changedPolicyPaths(e,t)))return{requirements:r,gates:n};const s=t.policyChanges.mode==="advisory"?"advisory":"failed";r.push(requirement({id:"policy.change",ruleClass:"human_handoff",authority:"patchgate",source:a,result:s,severity:t.policyChanges.mode==="blocked"?"block":"human_gate",observed:{changedPaths:e.changedPaths},remediation:"Review and merge the policy change under the trusted base policy; it cannot relax its own PR evaluation.",evidenceRefs:["observation:changedPaths"]}))}return{requirements:r,gates:n}}function reviewabilityRequirements(e,t){if(t.reviewability===undefined)return[];if(!groupAvailable(e,"reviewability")){return[requirement({id:"reviewability.snapshot",ruleClass:"reviewability",authority:"patchgate",source:a,result:t.reviewability.mode==="advisory"?"advisory":"unknown",severity:t.reviewability.mode==="advisory"?"advisory":"evidence",remediation:"Provide a complete reviewability snapshot for the configured mode."})]}if(e.reviewability===undefined){return[requirement({id:"reviewability.snapshot",ruleClass:"reviewability",authority:"patchgate",source:a,result:t.reviewability.mode==="advisory"?"advisory":"unknown",severity:t.reviewability.mode==="advisory"?"advisory":"evidence",remediation:"Provide a normalized reviewability snapshot from the trusted adapter."})]}const r=e.reviewability;const n=[["files",t.reviewability.budgets.maxFiles,r.fileCount,"files"],["ownership_domains",t.reviewability.budgets.maxOwnershipDomains,r.ownershipDomains.length,"ownership domains"],["generated_files",t.reviewability.budgets.maxGeneratedFiles,r.generatedFileCount,"generated files"],["boundaries",t.reviewability.budgets.maxBoundaries,r.boundaryCount,"subsystem boundaries"]];return n.filter(([,e])=>e!==undefined).map(([e,r,n,s])=>{const i=n<=r;return requirement({id:`reviewability.${e}`,ruleClass:"reviewability",authority:"patchgate",source:a,result:i?"passed":t.reviewability?.mode==="blocking"?"failed":"advisory",severity:t.reviewability?.mode==="blocking"?"block":"advisory",observed:{actual:n,limit:r},remediation:`Keep ${s} at or below ${r}, or split the contribution and document the boundary.`,evidenceRefs:["observation:reviewability"]})})}function evaluateValidated(e){const t=policyRequirements(e);const r={requirements:[],gates:[]};t.push(...nativeCheckRequirements(e));const i=nativeReviewRequirements(e);r.requirements.push(...i.requirements);r.gates.push(...i.gates);const a=nativeRulesetReviewRequirements(e);r.requirements.push(...a.requirements);r.gates.push(...a.gates);if(e.policy!==null&&hasPatchgateSource(e)){t.push(...issueRequirements(e,e.policy));t.push(...checkRequirements(e,e.policy));t.push(...ownershipRequirements(e,e.policy));const n=humanHandoffRequirements(e,e.policy);r.requirements.push(...n.requirements);r.gates.push(...n.gates);t.push(...reviewabilityRequirements(e,e.policy))}const c=[...t,...r.requirements].sort(compareIds);const u=structuredClone({schemaVersion:"0.1",evaluatorVersion:o.EVALUATOR_VERSION,repository:e.repository,revisions:e.revisions,policyDigest:e.policyDigest,decisionInputDigest:(0,s.decisionInputDigest)(e),receiptDigest:"sha256:"+"0".repeat(64),changedPaths:e.changedPaths,policySources:e.policySources,observations:e.observations,...e.nativeControls===undefined?{}:{nativeControls:e.nativeControls},evidence:{checks:e.checks,linkedIssues:e.linkedIssues,reviews:e.reviews,ownershipRequirements:e.ownershipRequirements},requirements:c,...e.reviewability===undefined?{}:{reviewability:e.reviewability},humanGates:r.gates.sort(compareIds),final:{status:(0,n.determineFinalStatus)(c),reasonIds:c.filter(e=>e.result!=="passed").map(e=>e.id)}});return{...u,receiptDigest:(0,s.receiptDigest)(u)}}function deliverReceipt(e,t){return{...structuredClone(e),evaluatedAt:t}}},10:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.evaluateValidated=t.deliverReceipt=void 0;t.evaluateContribution=evaluateContribution;const n=r(6875);const s=r(1780);function evaluateContribution(e,t){(0,n.assertEvaluationInput)(e);const r=(0,s.deliverReceipt)((0,s.evaluateValidated)(e),t);(0,n.assertContributionReceipt)(r);return r}var i=r(1780);Object.defineProperty(t,"deliverReceipt",{enumerable:true,get:function(){return i.deliverReceipt}});Object.defineProperty(t,"evaluateValidated",{enumerable:true,get:function(){return i.evaluateValidated}})},1140:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.normalizedPolicyDigest=normalizedPolicyDigest;t.normalizedObservationDigest=normalizedObservationDigest;t.normalizedItemsDigest=normalizedItemsDigest;t.semanticDecisionInput=semanticDecisionInput;t.decisionInputDigest=decisionInputDigest;t.receiptDigest=receiptDigest;const n=r(1552);function sortCanonical(e){return[...e].sort((e,t)=>(0,n.compareTextUnit)((0,n.canonicalJson)(e),(0,n.canonicalJson)(t)))}function sortText(e){return[...e].sort(n.compareTextUnit)}function normalizePolicy(e){if(e===null)return null;return{...e,...e.requiredChecks===undefined?{}:{requiredChecks:sortCanonical(e.requiredChecks.map(e=>({...e,acceptableConclusions:sortText(e.acceptableConclusions)})))},...e.sensitivePaths===undefined?{}:{sensitivePaths:sortCanonical(e.sensitivePaths.map(e=>({...e,patterns:sortText(e.patterns),requiredReviewers:sortText(e.requiredReviewers)})))},...e.policyChanges===undefined?{}:{policyChanges:{...e.policyChanges,paths:sortText(e.policyChanges.paths)}}}}function normalizedPolicyDigest(e){return(0,n.sha256Digest)(normalizePolicy(e))}function semanticObservationMeta(e){const{retrievedAt:t,responseDigest:r,...n}=e;return n}function normalizeObservations(e){return{policySources:sortCanonical(e.policySources.map(semanticObservationMeta)),changedPaths:semanticObservationMeta(e.changedPaths),linkedIssues:semanticObservationMeta(e.linkedIssues),reviews:semanticObservationMeta(e.reviews),checks:semanticObservationMeta(e.checks),ownership:semanticObservationMeta(e.ownership),reviewability:semanticObservationMeta(e.reviewability)}}function normalizedItems(e,t){switch(t){case"policySources":return sortCanonical(e.policySources);case"changedPaths":return sortText(e.changedPaths);case"linkedIssues":return sortCanonical(e.linkedIssues);case"reviews":return sortCanonical(e.reviews.map(e=>({...e,teams:sortText(e.teams),teamIds:[...e.teamIds].sort((e,t)=>e-t)})));case"checks":return sortCanonical(e.checks.map(({retrievedAt:e,...t})=>t));case"ownership":return sortCanonical(e.ownershipRequirements.map(e=>({...e,owners:sortText(e.owners)})));case"reviewability":return e.reviewability===undefined?null:{...e.reviewability,ownershipDomains:sortText(e.reviewability.ownershipDomains)}}}function normalizedObservationDigest(e,t){return(0,n.sha256Digest)(normalizedItems(e,t))}function normalizedItemsDigest(e,t){return(0,n.sha256Digest)(t)}function semanticDecisionInput(e){return{...e,policy:normalizePolicy(e.policy),policySources:sortCanonical(e.policySources),changedPaths:sortText(e.changedPaths),linkedIssues:sortCanonical(e.linkedIssues),reviews:sortCanonical(e.reviews.map(e=>({...e,teams:sortText(e.teams),teamIds:[...e.teamIds].sort((e,t)=>e-t)}))),checks:sortCanonical(e.checks.map(({retrievedAt:e,...t})=>t)),ownershipRequirements:sortCanonical(e.ownershipRequirements.map(e=>({...e,owners:sortText(e.owners)}))),observations:normalizeObservations(e.observations),...e.reviewability===undefined?{}:{reviewability:{...e.reviewability,ownershipDomains:sortText(e.reviewability.ownershipDomains)}}}}function decisionInputDigest(e){return(0,n.sha256Digest)(semanticDecisionInput(e))}function normalizeObserved(e){if(e===undefined)return undefined;return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,Array.isArray(t)?sortText(t):t]))}function receiptDigest(e){const{receiptDigest:t,...r}=e;const s="evaluatedAt"in r?(()=>{const{evaluatedAt:e,...t}=r;return t})():r;const i=s.requirements.map(e=>({...e,...e.observed===undefined?{}:{observed:normalizeObserved(e.observed)},evidenceRefs:sortText(e.evidenceRefs)}));const o=s.humanGates.map(e=>({...e,requiredReviewers:sortText(e.requiredReviewers),approvedBy:sortText(e.approvedBy)}));const a={...s.evidence,checks:sortCanonical(s.evidence.checks.map(({retrievedAt:e,...t})=>t)),linkedIssues:sortCanonical(s.evidence.linkedIssues),reviews:sortCanonical(s.evidence.reviews.map(e=>({...e,teams:sortText(e.teams),teamIds:[...e.teamIds].sort((e,t)=>e-t)}))),ownershipRequirements:sortCanonical(s.evidence.ownershipRequirements.map(e=>({...e,owners:sortText(e.owners)})))};return(0,n.sha256Digest)({...s,changedPaths:sortText(s.changedPaths),policySources:sortCanonical(s.policySources),observations:normalizeObservations(s.observations),requirements:sortCanonical(i),humanGates:sortCanonical(o),final:{...s.final,reasonIds:sortText(s.final.reasonIds)},...s.reviewability===undefined?{}:{reviewability:{...s.reviewability,ownershipDomains:sortText(s.reviewability.ownershipDomains)}},evidence:a})}},5291:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.evidenceReference=evidenceReference;t.resolveCheckEvidence=resolveCheckEvidence;function matchesExpectedSource(e,t){if(e.sourceStrength!==t.kind)return false;if(t.appSlug!==undefined&&e.appSlug!==t.appSlug)return false;if(t.appId!==undefined&&e.appId!==t.appId)return false;if(t.kind==="github_app_expected"){return e.checkRunId!==undefined}if(t.workflowId!==undefined&&e.workflowId!==t.workflowId)return false;if(t.workflowPath!==undefined&&e.workflowPath!==t.workflowPath)return false;if(t.event!==undefined&&e.event!==t.event)return false;return e.workflowRunId!==undefined&&e.workflowRunAttempt!==undefined}function evidenceReference(e){if(e.sourceStrength==="github_app_expected"&&e.checkRunId!==undefined){return`check-run:${e.checkRunId}`}if(e.sourceStrength==="github_actions_workflow"&&e.workflowRunId!==undefined&&e.workflowRunAttempt!==undefined){return`workflow-run:${e.workflowRunId}:attempt:${e.workflowRunAttempt}:check:${encodeURIComponent(e.name)}`}return""}function resolveCheckEvidence(e,t,r){if(r===undefined)return{status:"missing",reason:"wrong_target"};const n=e.filter(e=>e.name===t.name);if(n.length===0)return{status:"missing",reason:"no_candidate"};const s=n.filter(e=>e.testedSha===r);if(s.length===0)return{status:"missing",reason:"wrong_target"};const i=s.filter(e=>matchesExpectedSource(e,t.expectedSource));if(i.length===0)return{status:"missing",reason:"wrong_source"};if(i.length>1)return{status:"ambiguous",reason:"duplicate_eligible_candidates"};const o=i[0];if(o===undefined)return{status:"missing",reason:"no_candidate"};if(o.status!=="completed")return{status:"missing",reason:"pending"};if(!t.acceptableConclusions.includes(o.conclusion??"")){return{status:"failed",evidence:o,reason:"unacceptable_conclusion"}}return{status:"passed",evidence:o}}},2823:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.GITHUB_ACCEPT=t.GITHUB_API_ORIGIN=t.GITHUB_API_VERSION=void 0;t.isRecord=isRecord;t.readString=readString;t.readPositiveInt=readPositiveInt;t.hasArray=hasArray;t.GITHUB_API_VERSION="2026-03-10";t.GITHUB_API_ORIGIN="https://api.github.com";t.GITHUB_ACCEPT="application/vnd.github+json";function isRecord(e){return e!==null&&typeof e==="object"&&!Array.isArray(e)}function readString(e,t){if(!isRecord(e))return undefined;const r=e[t];return typeof r==="string"?r:undefined}function readPositiveInt(e,t){if(!isRecord(e))return undefined;const r=e[t];return typeof r==="number"&&Number.isInteger(r)&&r>0?r:undefined}function hasArray(e,t){return isRecord(e)&&Array.isArray(e[t])}},4835:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectBranchProtection=collectBranchProtection;const n=r(1552);const s=r(2823);const i=r(2355);function parseProtection(e){if(!(0,s.isRecord)(e))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection response was not an object.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(!("required_status_checks"in e)||!("required_pull_request_reviews"in e))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection response omitted required native-control fields.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(e.required_status_checks!==null&&!(0,s.isRecord)(e.required_status_checks))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection required status checks had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(e.required_pull_request_reviews!==null&&!(0,s.isRecord)(e.required_pull_request_reviews))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection review settings had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));const t=(0,s.isRecord)(e.required_status_checks)&&e.required_status_checks!==null?e.required_status_checks:null;const r=(0,s.isRecord)(e.required_pull_request_reviews)&&e.required_pull_request_reviews!==null?e.required_pull_request_reviews:null;if(t!==null&&t.strict!==undefined&&typeof t.strict!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection strict status checking had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(t!==null&&t.contexts!==undefined&&(!Array.isArray(t.contexts)||t.contexts.some(e=>typeof e!=="string"||e.trim().length===0)))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection status-check contexts had an invalid entry.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(t!==null&&t.checks!==undefined&&(!Array.isArray(t.checks)||t.checks.some(e=>!(0,s.isRecord)(e)||typeof e.context!=="string"||e.app_id!==undefined&&e.app_id!==null&&(typeof e.app_id!=="number"||!Number.isInteger(e.app_id)||e.app_id<1))))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection status-check entries had an invalid entry.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.dismiss_stale_reviews!==undefined&&typeof r.dismiss_stale_reviews!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection stale-review setting had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.require_code_owner_reviews!==undefined&&typeof r.require_code_owner_reviews!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection code-owner setting had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.required_approving_review_count!==undefined&&(typeof r.required_approving_review_count!=="number"||!Number.isInteger(r.required_approving_review_count)||r.required_approving_review_count<0))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection approval count had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.require_last_push_approval!==undefined&&typeof r.require_last_push_approval!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection last-push approval setting had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.bypass_pull_request_allowances!==undefined&&!(0,s.isRecord)(r.bypass_pull_request_allowances))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection review bypass allowances had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(e.bypass_pull_request_allowances!==undefined&&!(0,s.isRecord)(e.bypass_pull_request_allowances))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection bypass allowances had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));const n=t===null?null:{...typeof t.strict==="boolean"?{strict:t.strict}:{},...Array.isArray(t.contexts)?{contexts:t.contexts}:{},...Array.isArray(t.checks)?{checks:t.checks.map(e=>({context:e.context,...typeof e.app_id==="number"?{app_id:e.app_id}:{}}))}:{}};const o=r===null?null:{...typeof r.dismiss_stale_reviews==="boolean"?{dismiss_stale_reviews:r.dismiss_stale_reviews}:{},...typeof r.require_code_owner_reviews==="boolean"?{require_code_owner_reviews:r.require_code_owner_reviews}:{},...typeof r.required_approving_review_count==="number"?{required_approving_review_count:r.required_approving_review_count}:{},...typeof r.require_last_push_approval==="boolean"?{require_last_push_approval:r.require_last_push_approval}:{},...(0,s.isRecord)(r.bypass_pull_request_allowances)?{bypass_pull_request_allowances:r.bypass_pull_request_allowances}:{}};return{required_status_checks:n,required_pull_request_reviews:o,...(0,s.isRecord)(e.bypass_pull_request_allowances)?{bypass_pull_request_allowances:e.bypass_pull_request_allowances}:{}}}async function collectBranchProtection(e,t,r,s,o,a=false,c="collection"){const u=new Date(e.clock.now()).toISOString();const d=await e.request({method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/branches/${encodeURIComponent(s)}/protection`},"branch protection",c);if(d.status===404&&a)return{meta:{source:{kind:"github",identity:"branch-protection"},revision:o,retrievedAt:u,complete:true,permissionState:"sufficient",responseDigest:(0,n.sha256Digest)(d.body)},diagnostics:[],decisionBearing:false};if(d.status===403||d.status===404)return{meta:{source:{kind:"github",identity:"branch-protection"},revision:o,retrievedAt:u,complete:false,permissionState:d.status===403?"insufficient":"unknown"},diagnostics:[(0,i.makeDiagnostic)(d.status===403?"GITHUB_PERMISSION_INSUFFICIENT":"GITHUB_RESOURCE_NOT_VISIBLE","Branch-protection visibility is not sufficient to prove native control absence.",{observation:"branchProtection",permissionState:d.status===403?"insufficient":"unknown",remediation:"Grant the documented read capability or keep the native-control snapshot rejected."})],decisionBearing:false};try{const e=parseProtection(d.body);const t=new Map;for(const r of e.required_status_checks?.checks??[]){if(r.context===undefined)continue;const e=t.get(r.context);if(e===undefined||e.appId===undefined&&r.app_id!==undefined&&r.app_id!==null){t.set(r.context,{context:r.context,...r.app_id===undefined||r.app_id===null?{}:{appId:r.app_id}})}}for(const r of e.required_status_checks?.contexts??[])if(!t.has(r))t.set(r,{context:r});const r=[...t.values()].sort((e,t)=>(0,n.compareTextUnit)(e.context,t.context)||(e.appId??0)-(t.appId??0));const i=e.required_pull_request_reviews;const a={requiredChecks:r,requiredApprovals:i?.required_approving_review_count??0,requireCodeOwnerReviews:i?.require_code_owner_reviews??false,requireLastPushApproval:i?.require_last_push_approval??false,staleReviews:i?.dismiss_stale_reviews??false,requiredReviewThreadResolution:false,bypassVisible:i?.bypass_pull_request_allowances!==undefined,decisionBearing:r.length>0||(i?.required_approving_review_count??0)>0||i?.require_code_owner_reviews===true||i?.require_last_push_approval===true};return{protection:a,source:{kind:"branch_protection",identity:`branch-protection:${s}`,revision:o,digest:(0,n.sha256Digest)(a),authority:"enforced"},meta:{source:{kind:"github",identity:"branch-protection"},revision:o,retrievedAt:u,complete:true,permissionState:"sufficient",responseDigest:(0,n.sha256Digest)(d.body)},diagnostics:[],decisionBearing:a.decisionBearing}}catch(e){const t=e instanceof i.GitHubAdapterError?e.diagnostic:(0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection normalization failed.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2});return{meta:{source:{kind:"github",identity:"branch-protection"},revision:o,retrievedAt:u,complete:false,permissionState:t.permissionState},diagnostics:[t],decisionBearing:false}}}},1165:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.capabilityReport=capabilityReport;function capabilityReport(e,t,r,n,s,i){return{authKind:t,apiOrigin:r,apiVersion:n,...e===undefined?{}:{repository:{owner:e.owner,name:e.name,repositoryId:e.repositoryId},target:{pullRequest:e.pullRequestNumber,baseSha:e.baseSha,headSha:e.headSha,testedSha:e.testedSha,targetKind:e.targetKind}},observations:s,diagnostics:i,supportedPlatform:r==="https://api.github.com"?"github.com":"ghes_unsupported"}}},3538:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectChangedPaths=collectChangedPaths;const n=r(1552);const s=r(2823);const i=r(6299);const o=r(2355);const a=r(1914);function normalizePath(e,t){const r=(0,a.safeAllowlistedString)(e,t,1e5);if(r.startsWith("/")||/^[A-Za-z]:[\\/]/.test(r)||r.includes("\0")||r.split(/[\\/]/).some(e=>e===".."||e==="."))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_PATH_INVALID",`${t} is absolute or traversal-shaped.`,{observation:"changedPaths",remediation:"Discard the snapshot and inspect the GitHub changed-file response."}));return r}function parseFiles(e){if(!Array.isArray(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The changed-files response was not an array.",{observation:"changedPaths",snapshotEvaluable:false,exitCode:2}));return e.map((e,t)=>{if(!(0,s.isRecord)(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Changed-file item ${t} was not an object.`,{observation:"changedPaths",snapshotEvaluable:false,exitCode:2}));const r=(0,s.readString)(e,"filename");const n=(0,s.readString)(e,"status");if(r===undefined||n===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Changed-file item ${t} lacked filename or status.`,{observation:"changedPaths",snapshotEvaluable:false,exitCode:2}));const i=(0,s.readString)(e,"previous_filename");return{path:normalizePath(r,`changed file ${t}`),status:(0,a.safeAllowlistedString)(n,`changed file ${t} status`,64),...i===undefined?{}:{previousPath:normalizePath(i,`renamed file ${t}`)}}})}function pageCollectionToResult(e,t,r){const s=new Set;for(const t of e.items){s.add(t.path);if(t.previousPath!==undefined)s.add(t.previousPath)}let i=e.complete;const a=[...e.diagnostics];if(e.items.length>=3e3){i=false;t.budget.recordCap("github_file_ceiling_3000");a.push((0,o.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","GitHub file retrieval reached the documented 3,000-file ceiling; completeness cannot be proven.",{observation:"changedPaths",remediation:"Split the pull request or use a deliberately supported larger-file retrieval strategy."}))}const c=[...e.items].sort((e,t)=>(0,n.compareTextUnit)(e.path,t.path)||(0,n.compareTextUnit)(e.status,t.status));return{files:c,paths:[...s].sort(),meta:{source:{kind:"github",identity:"pull-request-files"},revision:r,retrievedAt:new Date(t.clock.now()).toISOString(),complete:i,permissionState:e.permissionState,responseDigest:(0,n.sha256Digest)(e.pageDigests)},diagnostics:a}}async function collectChangedPaths(e,t,r,n,s,o="collection"){const a=await(0,i.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/pulls/${n}/files`,query:{per_page:100}},"changedPaths",parseFiles,e=>`${e.path}\0${e.previousPath??""}`,{phase:o});return pageCollectionToResult(a,e,s)}},6250:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectChecks=collectChecks;const n=r(1552);const s=r(2823);const i=r(6299);const o=r(7665);const a=r(2355);const c=r(1914);function parseCheckRuns(e){if(!(0,s.isRecord)(e)||!Array.isArray(e.check_runs))throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The check-runs response was malformed.",{observation:"checks",snapshotEvaluable:false,exitCode:2}));const t=(0,s.readPositiveInt)(e,"total_count");if(t!==undefined&&t>1e3)throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","The check-runs response cannot prove all check suites beyond GitHub's 1,000-suite limit.",{observation:"checks"}));return e.check_runs.map((e,t)=>{if(!(0,s.isRecord)(e))throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Check run ${t} was malformed.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));const r=(0,s.readPositiveInt)(e,"id");const n=(0,s.readString)(e,"name");const i=(0,s.readString)(e,"status");const o=(0,s.readString)(e,"head_sha");if(r===undefined||n===undefined||i===undefined||o===undefined)throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Check run ${t} lacked immutable identity fields.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));if(i!=="queued"&&i!=="in_progress"&&i!=="completed")throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Check run ${r} had an unsupported status.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));const u=(0,s.readString)(e,"conclusion");const d=(0,s.isRecord)(e.app)?{id:(0,s.readPositiveInt)(e.app,"id"),slug:(0,s.readString)(e.app,"slug")}:undefined;const l=(0,s.isRecord)(e.check_suite)?{id:(0,s.readPositiveInt)(e.check_suite,"id")}:undefined;if(l?.id===undefined)throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Check run ${r} lacked an immutable check-suite relation.`,{observation:"checks"}));return{id:r,name:(0,c.safeAllowlistedString)(n,`check ${r} name`,500),status:i,head_sha:o,...u===undefined?{}:{conclusion:u},...d===undefined?{}:{app:{...d.id===undefined?{}:{id:d.id},...d.slug===undefined?{}:{slug:d.slug}}},check_suite:{id:l.id}}})}function workflowsForCheck(e,t){const r=e.check_suite?.id;return t.filter(t=>t.check_suite_id===r&&t.head_sha===e.head_sha)}function isActionsApp(e,t){return e===15368&&t?.toLowerCase()==="github-actions"}async function collectChecks(e,t,r,s,c="collection"){const u=new Date(e.clock.now()).toISOString();const d=[];const l=await(0,i.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/commits/${encodeURIComponent(s)}/check-runs`,query:{per_page:100,filter:"all"}},"checks",parseCheckRuns,e=>String(e.id),{phase:c});const p=await(0,o.collectWorkflowRuns)(e,t,r,s,c);d.push(...l.diagnostics,...p.diagnostics);const f=[];const h=new Set;const m=new Set;for(const e of l.items){if(h.has(e.id)){d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Duplicate check-run identity ${e.id} was returned.`,{observation:"checks"}));continue}h.add(e.id);if(e.head_sha!==s)continue;const t=workflowsForCheck(e,p.items);if(t.length>1){d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Check run ${e.id} matched multiple workflow run attempts for the same immutable suite and SHA.`,{observation:"checks",remediation:"Use a documented immutable rerun selector or keep workflow evidence incomplete."}))}const r=t.length===1?t[0]:undefined;const n=t.length>1;if(r!==undefined){const t=`${r.id}:${r.run_attempt}:${e.name}`;if(m.has(t))d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Duplicate workflow run identity ${t} was returned.`,{observation:"checks"}));m.add(t)}const i=e.app?.id;const o=e.app?.slug;const c=i===15368!==(o?.toLowerCase()==="github-actions");if(c)d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Check run ${e.id} reported a partial GitHub Actions App identity.`,{observation:"checks",remediation:"Require the immutable GitHub Actions App ID and slug pair before accepting workflow evidence."}));if(r!==undefined&&i!==undefined&&isActionsApp(i,o)&&!c){f.push({name:e.name,status:e.status,...e.conclusion===undefined||e.conclusion===null?{}:{conclusion:e.conclusion},testedSha:e.head_sha,...o===undefined?{}:{appSlug:o},appId:i,checkRunId:e.id,checkSuiteId:e.check_suite?.id,workflowId:r.workflow_id,...r.path===undefined?{}:{workflowPath:r.path},workflowRunId:r.id,workflowRunAttempt:r.run_attempt,event:r.event,sourceStrength:"github_actions_workflow",retrievedAt:u})}else if(r!==undefined&&i!==undefined){d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Check run ${e.id} had a workflow relation but its App identity was not the GitHub Actions allowlist entry.`,{observation:"checks",remediation:"Verify the immutable GitHub Actions App identity before using workflow-bound evidence."}));f.push({name:e.name,status:e.status,...e.conclusion===undefined||e.conclusion===null?{}:{conclusion:e.conclusion},testedSha:e.head_sha,checkSuiteId:e.check_suite?.id,sourceStrength:"unattributed",retrievedAt:u})}else if(i!==undefined&&!n&&!isActionsApp(i,o)){f.push({name:e.name,status:e.status,...e.conclusion===undefined||e.conclusion===null?{}:{conclusion:e.conclusion},testedSha:e.head_sha,...o===undefined?{}:{appSlug:o},appId:i,checkRunId:e.id,checkSuiteId:e.check_suite?.id,sourceStrength:"github_app_expected",retrievedAt:u})}else{f.push({name:e.name,status:e.status,...e.conclusion===undefined||e.conclusion===null?{}:{conclusion:e.conclusion},testedSha:e.head_sha,checkSuiteId:e.check_suite?.id,sourceStrength:"unattributed",retrievedAt:u})}}const g=l.complete&&p.complete&&d.length===0;const v={source:{kind:"github",identity:"check-runs"},revision:s,retrievedAt:u,complete:l.complete,permissionState:l.permissionState,responseDigest:(0,n.sha256Digest)(l.pageDigests)};const y={source:{kind:"github",identity:"workflow-runs"},revision:s,retrievedAt:u,complete:p.complete,permissionState:p.permissionState,responseDigest:(0,n.sha256Digest)(p.pageDigests)};return{checks:f,checkRunsMeta:v,workflowMeta:y,meta:{source:{kind:"github",identity:"check-runs+workflow-runs"},revision:s,retrievedAt:u,complete:g,permissionState:l.permissionState==="sufficient"&&p.permissionState==="sufficient"&&g?"sufficient":l.permissionState==="insufficient"||p.permissionState==="insufficient"?"insufficient":"unknown",responseDigest:(0,n.sha256Digest)({checkPages:l.pageDigests,workflowPages:p.pageDigests})},diagnostics:d}}},6584:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.GitHubClient=void 0;t.createFetchTransport=createFetchTransport;const n=r(2355);const s=r(2823);const i=r(5254);const o=r(8129);const a={pullRequestClosingIssues:`query PullRequestClosingIssues($owner: String!, $name: String!, $number: Int!, $first: Int!, $after: String) { repository(owner: $owner, name: $name) { pullRequest(number: $number) { closingIssuesReferences(first: $first, after: $after, userLinkedOnly: true) { nodes { id repository { nameWithOwner id } number } pageInfo { hasNextPage endCursor } } } } }`};const c=new Set(["link","etag","last-modified","x-ratelimit-remaining","x-ratelimit-reset","x-ratelimit-resource","retry-after","x-github-api-version","content-type","location"]);function trustedOrigin(e){const t=new URL(e);if(t.protocol!=="https:"||t.username.length>0||t.password.length>0||t.pathname!=="/"||t.search.length>0||t.hash.length>0)throw new Error("GitHub API origin must be a trusted HTTPS origin without credentials or path components");return t.origin}function safeHeaders(e){const t={};for(const[r,n]of e.entries()){const e=r.toLowerCase();if(!c.has(e))continue;if(e==="link")t.link=n;else if(e==="etag")t.etag=n;else if(e==="last-modified")t["last-modified"]=n;else if(e==="x-ratelimit-remaining")t["x-ratelimit-remaining"]=n;else if(e==="x-ratelimit-reset")t["x-ratelimit-reset"]=n;else if(e==="x-ratelimit-resource")t["x-ratelimit-resource"]=n;else if(e==="retry-after")t["retry-after"]=n;else if(e==="x-github-api-version")t["x-github-api-version"]=n;else if(e==="content-type")t["content-type"]=n;else if(e==="location")t.location=n}return t}function parseBody(e,t){if(e.length===0)return null;if(t?.toLowerCase().includes("json")||e.trimStart().startsWith("{")||e.trimStart().startsWith("[")){try{return JSON.parse(e)}catch{return e}}return e}function encodeRequestUrl(e,t){if(!t.path.startsWith("/")||t.path.startsWith("//")||t.path.includes("\0"))throw new Error("GitHub request path is invalid");const r=new URL(t.path,e);if(r.origin!==e||r.protocol!=="https:"||r.username.length>0||r.password.length>0)throw new Error("GitHub request origin is not trusted");if(t.query!==undefined){for(const[e,n]of Object.entries(t.query))r.searchParams.set(e,String(n))}return r}function createFetchTransport(e={}){const t=e.origin??s.GITHUB_API_ORIGIN;const r=trustedOrigin(t);const i=e.apiVersion??s.GITHUB_API_VERSION;const o=e.userAgent??"patchgate-github-adapter/0.1";const c=e.maxResponseBytes??2*1024*1024;const u=15e3;return{async request(t){if(t.method==="GET"&&(t.operation!==undefined||t.variables!==undefined))throw new Error("GET request cannot carry a GraphQL operation");const d=encodeRequestUrl(r,t);const l=new Headers({Accept:s.GITHUB_ACCEPT,"X-GitHub-Api-Version":i,"User-Agent":o});if(e.token!==undefined)l.set("Authorization",`Bearer ${e.token}`);if(t.method==="POST"){if(t.operation!=="pullRequestClosingIssues"||t.path!=="/graphql"||t.variables===undefined)throw new Error("GraphQL operation is not allowlisted");l.set("Content-Type","application/json")}const p=new AbortController;const f=setTimeout(()=>p.abort(),u);try{const e=await fetch(d,{method:t.method,headers:l,redirect:"manual",signal:p.signal,...t.method==="POST"?{body:JSON.stringify({query:a.pullRequestClosingIssues,operationName:"PullRequestClosingIssues",variables:t.variables})}:{}});const r=new Uint8Array(await e.arrayBuffer());if(r.byteLength>c)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_TOO_LARGE","GitHub response exceeded the configured byte budget.",{remediation:"Reduce the requested collection or raise the bounded response limit after review."}));const s=new TextDecoder("utf-8",{fatal:false}).decode(r);return{status:e.status,headers:safeHeaders(e.headers),body:parseBody(s,e.headers.get("content-type")??undefined),bytes:r.byteLength}}catch(e){if(e instanceof n.GitHubAdapterError)throw e;if(e instanceof Error&&e.name==="AbortError")throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_TIMEOUT","GitHub request timed out.",{retryable:true}));throw e}finally{clearTimeout(f)}}}}class GitHubClient{transport;budget;origin;apiVersion;authKind;clock;constructor(e,t=new i.BudgetLedger,r={}){this.transport=e;this.budget=t;this.origin=trustedOrigin(r.origin??s.GITHUB_API_ORIGIN);this.apiVersion=r.apiVersion??s.GITHUB_API_VERSION;this.authKind=r.token===undefined?"mock":"authenticated_token";this.clock=r.clock??{now:()=>Date.now(),sleep:async e=>new Promise(t=>setTimeout(t,e))}}async request(e,t,r="collection"){if(e.method==="POST"&&(e.path!=="/graphql"||e.operation!=="pullRequestClosingIssues"||e.variables===undefined))throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_API_UNSUPPORTED","The requested POST operation is not allowlisted.",{remediation:"Use only the documented read-only GraphQL operation."}));if(e.method==="GET"&&(e.operation!==undefined||e.variables!==undefined))throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_API_UNSUPPORTED","The requested GET operation carried unexpected GraphQL data.",{remediation:"Use a plain allowlisted REST GET request."}));let s=0;while(true){this.budget.beginRequest(r);try{const r=await this.transport.request(e);if(!Number.isInteger(r.bytes)||r.bytes<0||r.bytes>this.budget.limits.maxResponseBytes)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_TOO_LARGE","The injected GitHub response exceeded the configured response byte budget.",{remediation:"Discard the response and keep the bounded response limit enforced by the transport."}));this.budget.recordResponseBytes(r.bytes);const i=r.headers["x-ratelimit-remaining"]===undefined?undefined:Number(r.headers["x-ratelimit-remaining"]);const a=r.headers["x-ratelimit-reset"]===undefined?undefined:Number(r.headers["x-ratelimit-reset"]);this.budget.recordRateLimit(Number.isFinite(i)?i:undefined,Number.isFinite(a)?a:undefined,r.headers["x-ratelimit-resource"]);if(r.status===304)this.budget.recordConditional(true);if(r.status>=200&&r.status<300){this.budget.recordSuccess();return r}if(r.status===401)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_AUTH_INVALID","GitHub rejected the configured credential.",{remediation:"Use a read-only credential with the documented repository and organization permissions."}));if(r.status===304)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_CACHE_IDENTITY_MISMATCH","GitHub returned 304 but no validated authenticated cache body is available for reuse.",{remediation:"Retry without conditional cache state or use the deferred no-cache adapter path."}));if(r.status===302||r.status>=300&&r.status<400)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_REDIRECT","GitHub returned a redirect; the adapter never follows redirects.",{remediation:"Use the configured GitHub API origin and inspect the endpoint configuration."}));const c=r.status===429||r.status===403&&(r.headers["retry-after"]!==undefined||r.headers["x-ratelimit-remaining"]==="0");const u=c||r.status>=500;if(u&&s<this.budget.limits.maxRetriesPerRequest){s+=1;await(0,o.boundedRetryDelay)(c?r.headers["retry-after"]===undefined?"primary_rate_limit":"secondary_rate_limit":"server_5xx",r.headers,this.budget,this.clock);continue}this.budget.recordFailure();if(c)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RATE_LIMITED",`GitHub rate-limited the ${t} request.`,{remediation:"Wait for the bounded reset/retry window and rerun the snapshot.",permissionState:"unknown"}));if(r.status===403)return r;if(r.status===404)return r;throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`GitHub returned HTTP ${r.status} for the ${t} request.`,{remediation:"Inspect the endpoint capability and rerun against the same immutable target."}))}catch(e){if(e instanceof n.GitHubAdapterError){if(e.diagnostic.retryable&&s<this.budget.limits.maxRetriesPerRequest){s+=1;await(0,o.boundedRetryDelay)(e.diagnostic.id==="GITHUB_TIMEOUT"?"network_timeout":"server_5xx",{},this.budget,this.clock);continue}this.budget.recordFailure();throw e}this.budget.recordFailure();throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The injected GitHub transport failed without a safe response.",{snapshotEvaluable:false,exitCode:2}))}}}}t.GitHubClient=GitHubClient},3506:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectCodeowners=collectCodeowners;const n=r(2823);const s=r(2355);const i=r(1914);const o=r(1552);const a=[".github/CODEOWNERS","CODEOWNERS","docs/CODEOWNERS"];function tokenize(e){const t=[];let r="";let n=false;for(const s of e){if(n){r+=s;n=false;continue}if(s==="\\"){n=true;continue}if(/\s/.test(s)){if(r.length>0){t.push(r);r=""}continue}r+=s}if(n)r+="\\";if(r.length>0)t.push(r);return t}function parseRules(e){const t=[];const r=[];e.split(/\r?\n/).forEach((e,n)=>{const o=[...e].findIndex((t,r)=>t==="#"&&(r===0||/\s/.test(e[r-1]??"")));const a=o>=0?e.slice(0,o):e;if(a.trim().length===0)return;const c=tokenize(a);if(c.length<2){r.push((0,s.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`CODEOWNERS line ${n+1} is invalid under the supported subset.`,{observation:"ownership",remediation:"Use a valid CODEOWNERS pattern followed by at least one owner."}));return}const u=c[0];if(u.startsWith("!")||u.includes("[")||u.includes("]")||u.includes("?")){r.push((0,s.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`CODEOWNERS line ${n+1} uses syntax outside the declared safe subset.`,{observation:"ownership",remediation:"Avoid negation, character classes, and unsupported wildcard syntax until a full conformance parser is adopted."}));return}const d=c.slice(1).map(e=>(0,i.safeAllowlistedString)(e,`CODEOWNERS line ${n+1} owner`,500));if(d.some(e=>e.startsWith("@")&&!e.slice(1).includes("/")&&e.slice(1).length===0)){r.push((0,s.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`CODEOWNERS line ${n+1} contains an empty owner.`,{observation:"ownership"}));return}t.push({pattern:(0,i.safeAllowlistedString)(u,`CODEOWNERS line ${n+1} pattern`,1e5),owners:d,line:n+1})});return{rules:t,diagnostics:r}}function patternRegExp(e){const t=e.startsWith("/");const r=e.replace(/^\//,"").replace(/\/$/,"/**");const n=r.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\0").replace(/\*/g,"[^/]*").replace(/\u0000/g,".*");return new RegExp(t||r.includes("/")?`^${n}$`:`^(?:.*/)?${n}$`)}function matchedOwners(e,t){let r=[];for(const n of e)if(patternRegExp(n.pattern).test(t))r=n.owners;return r}function decodeContent(e,t,r){if(!(0,n.isRecord)(e))throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS response for ${t} was not an object.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}));const i=(0,n.readString)(e,"content");const o=(0,n.readString)(e,"encoding");const a=(0,n.readPositiveInt)(e,"size");if((0,n.readString)(e,"path")!==t||i===undefined||o!=="base64"||a===undefined)throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS response for ${t} had an unexpected encoding or identity.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}));if(a>r)throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_TOO_LARGE",`CODEOWNERS ${t} exceeded the response cap.`,{observation:"ownership"}));const c=i.replace(/\s+/g,"");if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(c))throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS ${t} was not valid base64.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}));const u=Buffer.from(c,"base64");if(u.length!==a)throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS ${t} size did not match its bytes.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}));try{return new TextDecoder("utf-8",{fatal:true}).decode(u)}catch{throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS ${t} was not valid UTF-8.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}))}}async function collectCodeowners(e,t,r,n,i,c=false,u="collection"){const d=new Date(e.clock.now()).toISOString();const l=[];let p;let f;let h;for(const i of a){const a=await e.request({method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/contents/${i.split("/").map(encodeURIComponent).join("/")}`,query:{ref:n}},`CODEOWNERS:${i}`,u);if(a.status===200){p=i;f=decodeContent(a.body,i,e.budget.limits.maxResponseBytes);h=(0,o.sha256Text)(f);break}if(a.status===403){l.push((0,s.makeDiagnostic)("GITHUB_PERMISSION_INSUFFICIENT",`GitHub denied CODEOWNERS lookup at ${i}.`,{observation:"ownership",permissionState:"insufficient"}));break}if(a.status!==404||!c){l.push((0,s.makeDiagnostic)("GITHUB_RESOURCE_NOT_VISIBLE",`CODEOWNERS lookup at ${i} was not proven absent.`,{observation:"ownership",permissionState:"unknown"}));break}}if(f===undefined||p===undefined||h===undefined){const e=c&&l.length===0;return{requirements:[],meta:{source:{kind:"github",identity:"codeowners"},revision:n,retrievedAt:d,complete:e,permissionState:e?"sufficient":l.some(e=>e.permissionState==="insufficient")?"insufficient":"unknown",responseDigest:(0,o.sha256Digest)(l)},diagnostics:l}}const m=parseRules(f);l.push(...m.diagnostics);const g=new Map;for(const e of i){const t=matchedOwners(m.rules,e);if(t.length===0)continue;if(t.some(e=>e.startsWith("@")&&!e.slice(1).includes("/")&&e.slice(1).length>0))l.push((0,s.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`CODEOWNERS owner syntax without an organization-qualified team is not used for authenticated qualification: ${t.join(", ")}.`,{observation:"ownership",remediation:"Use @org/team for team owners or a user owner that can be qualified through the collaborator endpoint."}));const r=JSON.stringify([...t].sort());const n=g.get(r)??[];n.push(e);g.set(r,n)}const v=[...g.entries()].sort(([e],[t])=>(0,o.compareTextUnit)(e,t)).map(([e],t)=>({id:`codeowners.${t+1}`,owners:JSON.parse(e),requiredCount:1}));const y=l.length===0;return{requirements:v,selectedPath:p,source:{kind:"codeowners",identity:p,revision:n,digest:h,authority:"enforced"},meta:{source:{kind:"github",identity:p},revision:n,retrievedAt:d,complete:y,permissionState:y?"sufficient":"unknown",responseDigest:(0,o.sha256Digest)({rawDigest:h,rules:m.rules})},diagnostics:l}}},2355:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.GitHubAdapterError=void 0;t.makeDiagnostic=makeDiagnostic;t.diagnosticFrom=diagnosticFrom;const r="Inspect the authenticated read-only capability and rerun the snapshot against the same target SHA.";function makeDiagnostic(e,t,n={}){const s=n.snapshotEvaluable??true;return{id:e,message:t,remediation:n.remediation??r,...n.observation===undefined?{}:{observation:n.observation},complete:n.complete??false,permissionState:n.permissionState??"unknown",retryable:n.retryable??false,snapshotEvaluable:s,exitCode:n.exitCode??(s?1:2)}}class GitHubAdapterError extends Error{diagnostic;constructor(e){super(e.message);this.name="GitHubAdapterError";this.diagnostic=e}}t.GitHubAdapterError=GitHubAdapterError;function diagnosticFrom(e,t="GITHUB_RESPONSE_MALFORMED"){if(e instanceof GitHubAdapterError)return e.diagnostic;const r=e instanceof Error?e.message:"GitHub adapter operation failed";return makeDiagnostic(t,r,{snapshotEvaluable:false,exitCode:2})}},7369:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.resolvePullRequestIdentity=resolvePullRequestIdentity;t.sameSnapshotIdentity=sameSnapshotIdentity;const n=r(1552);const s=r(1914);const i=r(2823);const o=r(2355);function requireObject(e,t){if(!(0,i.isRecord)(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`${t} response was not an object.`,{snapshotEvaluable:false,exitCode:2}));return e}function parseRepository(e){const t=requireObject(e,"repository");const r=(0,i.readPositiveInt)(t,"id");const n=(0,i.readString)(t,"name");const s=(0,i.readString)(t,"full_name");if(r===undefined||n===undefined||s===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Repository identity fields were missing.",{snapshotEvaluable:false,exitCode:2}));const a=(0,i.readString)(t,"default_branch");return{id:r,name:n,full_name:s,...a===undefined?{}:{default_branch:a}}}function parseUser(e){if(!(0,i.isRecord)(e))return undefined;const t=(0,i.readPositiveInt)(e,"id");const r=(0,i.readString)(e,"login");if(t===undefined||r===undefined)return undefined;const n=(0,i.readString)(e,"type");return{id:t,login:r,...n===undefined?{}:{type:n}}}function parseRepositoryRef(e,t){const r=requireObject(e,t);const n=(0,i.readPositiveInt)(r,"id");if(n===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`${t} repository ID was missing.`,{snapshotEvaluable:false,exitCode:2}));const s=(0,i.readString)(r,"full_name");const a=(0,i.readString)(r,"name");return{id:n,...s===undefined?{}:{full_name:s},...a===undefined?{}:{name:a}}}function parsePullRequest(e){const t=requireObject(e,"pull request");const r=(0,i.readPositiveInt)(t,"id");const n=(0,i.readPositiveInt)(t,"number");const a=requireObject(t.base,"pull request base");const c=requireObject(t.head,"pull request head");const u=(0,i.readString)(a,"ref");const d=(0,i.readString)(a,"sha");const l=(0,i.readString)(c,"ref");const p=(0,i.readString)(c,"sha");if(r===undefined||n===undefined||u===undefined||d===undefined||l===undefined||p===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Pull-request target identity fields were missing.",{snapshotEvaluable:false,exitCode:2}));const f=(0,s.safeAllowlistedString)(u,"pull request base ref",500);const h=(0,s.safeAllowlistedString)(d,"pull request base SHA",200);const m=(0,s.safeAllowlistedString)(l,"pull request head ref",500);const g=(0,s.safeAllowlistedString)(p,"pull request head SHA",200);const v=t.merge_commit_sha;if(v!==undefined&&v!==null&&typeof v!=="string")throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Pull-request merge_commit_sha was malformed.",{snapshotEvaluable:false,exitCode:2}));const y=parseUser(t.user);const b=v===undefined||v===null?undefined:(0,s.safeAllowlistedString)(v,"pull request merge SHA",200);return{id:r,number:n,base:{ref:f,sha:h,repo:parseRepositoryRef(a.repo,"base")},head:{ref:m,sha:g,repo:parseRepositoryRef(c.repo,"head")},...b===undefined?{}:{merge_commit_sha:b},...y===undefined?{}:{user:y}}}function normalizedName(e,t){const r=(0,s.safeAllowlistedString)(e.trim(),t,200);if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/.test(r))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_IDENTITY_MISMATCH",`${t} must be a GitHub-compatible repository segment.`,{snapshotEvaluable:false,exitCode:2}));return r}async function resolvePullRequestIdentity(e,t,r="collection"){if(t.eventKind==="merge_group"||t.targetKind==="merge_group"||t.pullNumber===undefined){throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_API_UNSUPPORTED","The current scalar EvaluationInput cannot represent authenticated merge-group membership.",{remediation:"Use a pull_request head/merge target, or add a versioned merge-group identity contract before enabling merge-queue evaluation.",snapshotEvaluable:false,exitCode:2}))}const s=normalizedName(t.owner,"repository owner");const i=normalizedName(t.name,"repository name");if(!Number.isInteger(t.pullNumber)||t.pullNumber<1)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_IDENTITY_MISMATCH","Pull-request number must be a positive integer.",{snapshotEvaluable:false,exitCode:2}));const a=await e.request({method:"GET",path:`/repos/${encodeURIComponent(s)}/${encodeURIComponent(i)}`},"repository identity",r);if(a.status===403||a.status===404)throw new o.GitHubAdapterError((0,o.makeDiagnostic)(a.status===403?"GITHUB_PERMISSION_INSUFFICIENT":"GITHUB_RESOURCE_NOT_VISIBLE","Repository identity is not visible to the configured credential.",{permissionState:a.status===403?"insufficient":"unknown",snapshotEvaluable:false,exitCode:2}));const c=parseRepository(a.body);const u=await e.request({method:"GET",path:`/repos/${encodeURIComponent(s)}/${encodeURIComponent(i)}/pulls/${t.pullNumber}`},"pull-request identity",r);if(u.status===403||u.status===404)throw new o.GitHubAdapterError((0,o.makeDiagnostic)(u.status===403?"GITHUB_PERMISSION_INSUFFICIENT":"GITHUB_RESOURCE_NOT_VISIBLE","Pull-request identity is not visible to the configured credential.",{permissionState:u.status===403?"insufficient":"unknown",snapshotEvaluable:false,exitCode:2}));const d=parsePullRequest(u.body);if(d.number!==t.pullNumber||c.name.toLowerCase()!==i.toLowerCase()||c.full_name.toLowerCase()!==`${s}/${i}`.toLowerCase()){throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_IDENTITY_MISMATCH","GitHub returned a repository or pull-request identity different from the trusted request.",{snapshotEvaluable:false,exitCode:2}))}if(d.base.repo.id!==c.id||d.base.repo.full_name!==undefined&&d.base.repo.full_name.toLowerCase()!==c.full_name.toLowerCase())throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_IDENTITY_MISMATCH","The pull request base repository identity did not match the repository identity read from the API.",{snapshotEvaluable:false,exitCode:2}));const l=typeof d.merge_commit_sha==="string"?d.merge_commit_sha:undefined;const p=t.targetKind==="merge"?"merge":"head";if(p==="merge"&&l===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_API_UNSUPPORTED","The pull request has no immutable merge SHA for the requested merge target.",{remediation:"Evaluate the head target or wait for GitHub to provide a merge commit SHA.",snapshotEvaluable:false,exitCode:2}));const f=p==="merge"?l:d.head.sha;const h={apiOrigin:e.origin,apiVersion:e.apiVersion,repositoryId:c.id,owner:s,name:i,pullRequestId:d.id,pullRequestNumber:d.number,eventKind:"pull_request",baseRef:d.base.ref,baseSha:d.base.sha,headRepositoryId:d.head.repo.id,headRef:d.head.ref,headSha:d.head.sha,...l===undefined?{}:{mergeSha:l},testedSha:f,targetKind:p,...d.user?.id===undefined?{}:{authorId:d.user.id}};return{...h,retrievalStartedAt:new Date(e.clock.now()).toISOString(),provenanceDigest:(0,n.sha256Digest)(h)}}function sameSnapshotIdentity(e,t){return e.provenanceDigest===t.provenanceDigest&&e.repositoryId===t.repositoryId&&e.pullRequestId===t.pullRequestId&&e.pullRequestNumber===t.pullRequestNumber&&e.owner===t.owner&&e.name===t.name&&e.eventKind===t.eventKind&&e.baseRef===t.baseRef&&e.baseSha===t.baseSha&&e.headRepositoryId===t.headRepositoryId&&e.headRef===t.headRef&&e.headSha===t.headSha&&e.mergeSha===t.mergeSha&&e.testedSha===t.testedSha&&e.targetKind===t.targetKind}},6047:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectLinkedIssues=collectLinkedIssues;const n=r(1552);const s=r(2823);const i=r(2355);const o=r(1914);function parseIssue(e){if(!(0,s.isRecord)(e)||!(0,s.isRecord)(e.repository))return undefined;const t=(0,s.readString)(e.repository,"nameWithOwner");const r=(0,s.readString)(e.repository,"id");const n=(0,s.readPositiveInt)(e,"number");const i=(0,s.readString)(e,"id");if(t===undefined||n===undefined||r===undefined||i===undefined)return undefined;return{repository:{nameWithOwner:(0,o.safeAllowlistedString)(t,"linked issue repository",500),id:(0,o.safeAllowlistedString)(r,"linked issue repository ID",500)},number:n,id:(0,o.safeAllowlistedString)(i,"linked issue ID",500)}}async function collectLinkedIssues(e,t,r,a,c,u="collection"){const d=[];const l=[];let p=null;let f=true;let h=0;const m=new Set;const g=new Set;const v=[];const y=new Date(e.clock.now()).toISOString();while(true){h+=1;if(!e.budget.recordPage("linkedIssues")){f=false;l.push((0,i.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","Linked-issue pagination exceeded the bounded page budget.",{observation:"linkedIssues"}));break}try{const c=await e.request({method:"POST",path:"/graphql",operation:"pullRequestClosingIssues",variables:{owner:t,name:r,number:a,first:100,after:p}},"linkedIssues",u);v.push((0,n.sha256Digest)((0,o.redactForReport)({status:c.status,headers:c.headers,body:c.body})));if(c.status===403||c.status===404){f=false;l.push((0,i.makeDiagnostic)(c.status===403?"GITHUB_PERMISSION_INSUFFICIENT":"GITHUB_RESOURCE_NOT_VISIBLE","Native linked-issue relationship is not visible to the configured credential.",{observation:"linkedIssues",permissionState:c.status===403?"insufficient":"unknown"}));break}if(!(0,s.isRecord)(c.body))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The linked-issue GraphQL response was not an object.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2}));if(Array.isArray(c.body.errors)&&c.body.errors.length>0)throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_API_UNSUPPORTED","GitHub returned GraphQL errors or partial linked-issue data.",{observation:"linkedIssues",remediation:"Grant the required read capability or keep issue linkage non-ready."}));const y=c.body.data;if(!(0,s.isRecord)(y)||!(0,s.isRecord)(y.repository)||!(0,s.isRecord)(y.repository.pullRequest)||!(0,s.isRecord)(y.repository.pullRequest.closingIssuesReferences))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_API_UNSUPPORTED","GitHub did not expose the documented closingIssuesReferences connection.",{observation:"linkedIssues"}));const b=y.repository.pullRequest.closingIssuesReferences;const w=b.nodes;if(!Array.isArray(w))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The linked-issue node list was missing or malformed.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2}));const $=b.pageInfo;if(!(0,s.isRecord)($)||typeof $.hasNextPage!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The linked-issue pageInfo was missing or malformed.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2}));for(const e of w){const n=(0,s.isRecord)(e)&&e.issue!==undefined?e.issue:e;const o=parseIssue(n);if(o===undefined){f=false;l.push((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","A linked-issue node lacked immutable repository/number identity.",{observation:"linkedIssues"}));continue}if(o.repository.nameWithOwner.toLowerCase()!==`${t}/${r}`.toLowerCase()){f=false;l.push((0,i.makeDiagnostic)("GITHUB_API_UNSUPPORTED","Cross-repository linked issues are outside the current v0.1 evaluator contract.",{observation:"linkedIssues",remediation:"Use same-repository native linked issues or add a versioned cross-repository policy contract."}));continue}const a=`${o.repository.nameWithOwner.toLowerCase()}#${o.number}`;const c=o.repository.id;const u=o.id;if(c===undefined||u===undefined)throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","A linked issue lost immutable identity during normalization.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2}));const p=`${c}\0${u}`;if(m.has(a)||g.has(p))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","The linked-issue connection repeated an issue identity.",{observation:"linkedIssues"}));m.add(a);g.add(p);d.push({repository:o.repository.nameWithOwner,number:o.number,repositoryId:c,issueId:u,linked:true})}if($.hasNextPage!==true)break;const S=typeof $.endCursor==="string"?$.endCursor:undefined;if(S===undefined||S.length===0||h>=e.budget.limits.maxPagesPerGroup){f=false;l.push((0,i.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","Linked-issue pagination did not provide a safe bounded cursor.",{observation:"linkedIssues"}));break}p=S}catch(e){const t=e instanceof i.GitHubAdapterError?e.diagnostic:(0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Linked-issue retrieval failed at the API boundary.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2});f=false;l.push(t);break}}return{issues:d.sort((e,t)=>(0,n.compareTextUnit)(e.repository,t.repository)||e.number-t.number),meta:{source:{kind:"github",identity:"graphql:closingIssuesReferences"},revision:c,retrievedAt:y,complete:f,permissionState:f?"sufficient":l.some(e=>e.permissionState==="insufficient")?"insufficient":"unknown",responseDigest:(0,n.sha256Digest)(v)},diagnostics:l}}},6299:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.parseNextLink=parseNextLink;t.collectPaginated=collectPaginated;const n=r(1552);const s=r(2355);function parseLinkParts(e){return e.split(/,(?=\s*<)/).flatMap(e=>{const t=/^\s*<([^>]+)>\s*(.*)$/.exec(e);if(t===null)return[];const r=t[2]??"";const n=/rel\s*=\s*"([^"]+)"/i.exec(r)?.[1]??/rel\s*=\s*([^;\s]+)/i.exec(r)?.[1]??"";const s=t[1];if(s===undefined)return[];return[{url:s,rel:n.split(/\s+/).filter(Boolean)}]})}function parseNextLink(e,t){if(e===undefined)return undefined;const r=parseLinkParts(e).find(e=>e.rel.includes("next"));if(r===undefined)return undefined;const n=new URL(r.url,t);if(n.origin!==t||n.protocol!=="https:"||n.username.length>0||n.password.length>0){throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","GitHub pagination pointed outside the configured API origin.",{remediation:"Discard the snapshot and rerun with a trusted GitHub API origin."}))}return n.toString()}function requestFromNextUrl(e,t){const r=new URL(e);if(r.origin!==t)throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","The next-page URL origin changed.",{remediation:"Discard the snapshot and inspect the API response provenance."}));const n={};for(const[e,t]of r.searchParams.entries())n[e]=t;return{method:"GET",path:r.pathname,...Object.keys(n).length===0?{}:{query:n}}}async function collectPaginated(e,t,r,i,o,a={}){const c=[];const u=[];const d=[];const l=new Set;const p=new Set;let f=t;let h=true;let m="sufficient";const g=a.maxItems??e.budget.limits.maxItemsPerGroup;const v=a.pageSize??(typeof t.query?.per_page==="number"?t.query.per_page:100);while(true){try{const t=await e.request(f,r,a.phase??"collection");if(t.status===403){h=false;m="insufficient";u.push((0,s.makeDiagnostic)("GITHUB_PERMISSION_INSUFFICIENT",`GitHub denied the ${r} collection.`,{observation:r,permissionState:m,remediation:`Grant the minimum read permission for ${r}, or keep the dependent requirement non-ready.`}));break}if(t.status===404&&a.allowConfirmedAbsence===true){h=true;m="sufficient";break}if(t.status===404){h=false;m="unknown";u.push((0,s.makeDiagnostic)("GITHUB_RESOURCE_NOT_VISIBLE",`GitHub did not expose the ${r} resource.`,{observation:r,permissionState:m,remediation:`Confirm repository visibility and endpoint permission for ${r}; a hidden 404 is not treated as absence.`}));break}const y=JSON.stringify(f);if(l.has(y))throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`The ${r} pagination cursor repeated.`,{observation:r}));l.add(y);const b=i(t.body);d.push((0,n.sha256Digest)(t.body));if(!e.budget.recordPage(r)){h=false;u.push((0,s.makeDiagnostic)("GITHUB_PAGINATION_LIMIT",`The ${r} pagination budget was exhausted.`,{observation:r,remediation:"Rerun with a bounded page budget that proves the complete collection."}));break}for(const t of b){if(c.length>=g){e.budget.recordItemCap(r);h=false;u.push((0,s.makeDiagnostic)("GITHUB_ITEM_LIMIT",`The ${r} item budget was exhausted.`,{observation:r,remediation:"Reduce the collection or raise the reviewed item cap; truncated evidence cannot satisfy a requirement."}));break}const n=o(t);if(p.has(n))throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`The ${r} collection repeated an immutable item identity.`,{observation:r,remediation:"Discard the snapshot; repeated page data cannot be promoted to complete evidence."}));p.add(n);c.push(t)}if(!h)break;const w=parseNextLink(t.headers.link,e.origin);if(w===undefined&&b.length>=v){h=false;u.push((0,s.makeDiagnostic)("GITHUB_PAGINATION_LIMIT",`The ${r} response reached its page-size boundary without a trusted next link.`,{observation:r,remediation:"Require a trustworthy end-of-pagination signal before treating the collection as complete."}))}if(w===undefined)break;f=requestFromNextUrl(w,e.origin)}catch(e){const t=(0,s.diagnosticFrom)(e);u.push(t);h=false;m=t.permissionState;break}}return{items:c,complete:h,permissionState:m,diagnostics:u,pageDigests:d}}},5435:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.qualifyReviews=qualifyReviews;const n=r(1552);const s=r(2823);const i={read:1,triage:2,write:3,push:3,maintain:4,admin:5};function sufficientPermission(e){return e!==undefined&&(i[e.toLowerCase()]??0)>=3}function configuredTeamPrincipal(e){const t=e.startsWith("@")?e.slice(1):e;const r=t.indexOf("/");if(r<=0||r===t.length-1)return undefined;return{org:t.slice(0,r),slug:t.slice(r+1)}}function configuredUserPrincipal(e,t){return e===t||e===`@${t}`}async function collaborator(e,t,r,n,i){const o=await e.request({method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/collaborators/${encodeURIComponent(n)}/permission`},"reviewer permission",i);if(o.status===403)return{state:"insufficient"};if(o.status===404)return{state:"unknown"};if(!(0,s.isRecord)(o.body))return{state:"unknown"};const a=(0,s.isRecord)(o.body.user)?(0,s.readPositiveInt)(o.body.user,"id"):undefined;const c=(0,s.readString)(o.body,"permission")??(0,s.readString)(o.body,"role_name");return{state:sufficientPermission(c)?"sufficient":"insufficient",...a===undefined?{}:{id:a}}}async function teamMembership(e,t,r,n,i){const o=await e.request({method:"GET",path:`/orgs/${encodeURIComponent(t)}/teams/${encodeURIComponent(r)}`},"team identity",i);if(o.status===403||o.status===404||!(0,s.isRecord)(o.body))return{state:o.status===403?"insufficient":"unknown"};const a=(0,s.readPositiveInt)(o.body,"id");if(a===undefined)return{state:"unknown"};const c=await e.request({method:"GET",path:`/orgs/${encodeURIComponent(t)}/teams/${encodeURIComponent(r)}/memberships/${encodeURIComponent(n)}`},"team membership",i);if(c.status===403||c.status===404||!(0,s.isRecord)(c.body))return{state:c.status===403?"insufficient":"unknown"};const u=(0,s.readString)(c.body,"state");if(u!=="active"&&u!=="pending")return{state:"unknown"};return{state:u==="active"?"sufficient":"unknown",principal:{configuredPrincipal:`@${t}/${r}`,kind:"team",immutableId:a,membershipState:u}}}async function qualifyReviews(e,t,r,s,i,o="collection"){const a=[];const c=[];const u=[];const d=[];const l=new Date(e.clock.now()).toISOString();for(const n of t){if(n.isAuthor||n.isBot){c.push(n);continue}const t=await collaborator(e,r,s,n.login,o);u.push(t.state);const a=[];const l=[];const p=[];let f=t.state==="sufficient";let h=t.state!=="unknown";let m=t.state;for(const r of i){const s=configuredTeamPrincipal(r);if(s!==undefined){const r=await teamMembership(e,s.org,s.slug,n.login,o);d.push(r.state);if(r.principal!==undefined){a.push(r.principal);l.push(r.principal.immutableId);p.push(`@${s.org}/${s.slug}`)}if(r.state!=="sufficient"){h=false;m=r.state}f=f&&r.state==="sufficient"&&t.state==="sufficient"}else if(configuredUserPrincipal(r,n.login)){const e={configuredPrincipal:r,kind:"user",immutableId:t.id??n.actorId,membershipState:t.state==="sufficient"?"active":"unknown"};a.push(e);f=f&&t.state==="sufficient"}}if(i.length>0&&a.length===0)f=false;if(t.state==="unknown")h=false;c.push({...n,qualified:f,teams:[...new Set(p)],teamIds:[...new Set(l)],qualification:{...n.qualification,complete:h,permissionState:m,principalBindings:a}})}const aggregate=(e,t,r)=>{const s=e.length===0||e.includes("unknown")?"unknown":e.includes("insufficient")?"insufficient":"sufficient";return{source:{kind:"github",identity:t},...r===undefined?{}:{revision:r},retrievedAt:l,complete:s==="sufficient",permissionState:s,responseDigest:(0,n.sha256Digest)(e)}};return{reviews:c,diagnostics:a,collaboratorMeta:aggregate(u,"collaborator-permission"),teamMeta:aggregate(d,"team-identity+membership")}}},1914:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.safeAllowlistedString=safeAllowlistedString;t.safeDisplayText=safeDisplayText;t.redactUrl=redactUrl;t.redactHeaders=redactHeaders;t.redactForReport=redactForReport;t.assertRedacted=assertRedacted;t.sanitizeFixture=sanitizeFixture;const n=r(2355);const s=/authorization|cookie|token|secret|password|private[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|api[_-]?key|apikey|credential|body|comment|email|raw[_-]?error|workflow[_-]?log|artifact/i;const i=/[\u0000-\u0009\u000B-\u000D\u000E-\u001F\u007F\u001B\u202A-\u202E\u2066-\u2069]/g;const o=/([?&](?:access_token|token|secret|key|signature|authorization)=)[^&]*/gi;const a=/[?&](?:access_token|token|secret|key|signature|authorization)=(?!\[REDACTED\])[^&]*/i;const c=/(?:bearer\s+|(?:api[_-]?key|apikey|access[_-]?token|client[_-]?secret|password|credential)\s*[:=]\s*)[^\s,;]+/gi;const u=/(?:bearer\s+|(?:api[_-]?key|apikey|access[_-]?token|client[_-]?secret|password|credential)\s*[:=]\s*)(?!\[REDACTED\])[^\s,;]+/i;function safeAllowlistedString(e,t,r=1e4){if(e.length===0||e.length>r||i.test(e)){i.lastIndex=0;throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`${t} contains unsafe or oversized text.`,{remediation:`Remove control characters and keep ${t} within the bounded adapter limit.`,snapshotEvaluable:false,exitCode:2}))}i.lastIndex=0;return e}function safeDisplayText(e,t,r=4e3){const n=e.length>r?e.slice(0,r):e;return safeAllowlistedString(n.replace(/[\r\n]+/g," "),t,r)}function redactUrl(e){try{const t=new URL(e);t.username="";t.password="";t.search=t.search.replace(o,"$1[REDACTED]");t.hash="";return t.toString()}catch{return e.replace(o,"$1[REDACTED]")}}function redactHeaders(e){const t={};for(const[r,n]of Object.entries(e)){t[r]=/authorization|cookie|token|secret|password/i.test(r)?"[REDACTED]":typeof n==="string"&&/^https?:\/\//.test(n)?redactUrl(n):sanitize(e[r])}return t}function sanitize(e){if(Array.isArray(e))return e.map(sanitize);if(e!==null&&typeof e==="object"){const t={};for(const[r,n]of Object.entries(e)){if(s.test(r))continue;t[r]=sanitize(n)}return t}if(typeof e==="string")return e.replace(o,"$1[REDACTED]").replace(c,"[REDACTED]").replace(i,"�");return e}function redactForReport(e){return sanitize(e)}function assertRedacted(e){function visit(e,t){if(Array.isArray(e)){e.forEach((e,r)=>visit(e,`${t}[${r}]`));return}if(e!==null&&typeof e==="object"){for(const[r,n]of Object.entries(e)){if(s.test(r))throw new Error(`forbidden redaction key at ${t}.${r}`);visit(n,`${t}.${r}`)}}if(typeof e==="string"&&(i.test(e)||a.test(e)||u.test(e))){i.lastIndex=0;throw new Error(`secret-like query at ${t}`)}i.lastIndex=0;o.lastIndex=0}visit(e,"$")}function sanitizeFixture(e){const t=redactForReport(e);assertRedacted(t);return t}},5254:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.BudgetLedger=t.DEFAULT_REQUEST_BUDGETS=void 0;const n=r(2355);t.DEFAULT_REQUEST_BUDGETS={maxRequests:160,finalizationReserveRequests:64,maxPagesPerGroup:32,maxRetriesPerRequest:2,maxRetries:8,maxResponseBytes:2*1024*1024,maxItemsPerGroup:3e3,maxRetryDelayMs:5e3,maxCumulativeSleepMs:1e4};class BudgetLedger{limits;evidence={requests:{attempted:0,succeeded:0,failed:0,finalizationAttempted:0},pagesByGroup:{},retriesByReason:{},responseBytes:0,retryAfterObservedMs:[],conditionalRequests:0,conditional304:0,caps:[],cumulativeSleepMs:0};constructor(e={}){this.limits={...t.DEFAULT_REQUEST_BUDGETS,...e};if(this.limits.finalizationReserveRequests<1||this.limits.finalizationReserveRequests>=this.limits.maxRequests){throw new Error("finalizationReserveRequests must be smaller than maxRequests and positive")}}beginRequest(e){const t=this.evidence.requests.attempted+1;const r=this.limits.maxRequests-this.limits.finalizationReserveRequests;if(e==="collection"&&t>r){this.recordCap("request_budget_collection");throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_REQUEST_BUDGET","The collection request budget was exhausted before finalization.",{remediation:"Reduce the snapshot scope or raise the bounded collection budget; the adapter did not consume the finalization reserve.",complete:false,snapshotEvaluable:true}))}if(e==="finalization"&&this.evidence.requests.finalizationAttempted>=this.limits.finalizationReserveRequests){this.recordCap("request_budget_finalization");throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_REQUEST_BUDGET","The reserved finalization request budget was exhausted.",{remediation:"Retry the entire snapshot with a larger bounded finalization reserve; no snapshot was accepted.",complete:false,snapshotEvaluable:false,exitCode:2}))}this.evidence.requests.attempted=t;if(e==="finalization")this.evidence.requests.finalizationAttempted+=1}recordSuccess(){this.evidence.requests.succeeded+=1}recordFailure(){this.evidence.requests.failed+=1}recordResponseBytes(e){this.evidence.responseBytes+=e}recordPage(e){const t=(this.evidence.pagesByGroup[e]??0)+1;this.evidence.pagesByGroup[e]=t;if(t>this.limits.maxPagesPerGroup){this.recordCap(`page_budget:${e}`);return false}return true}recordItemCap(e){this.recordCap(`item_budget:${e}`)}recordCap(e){if(!this.evidence.caps.includes(e))this.evidence.caps.push(e)}recordRetry(e){const t=Object.values(this.evidence.retriesByReason).reduce((e,t)=>e+t,0);if(t>=this.limits.maxRetries){this.recordCap("retry_budget");return false}this.evidence.retriesByReason[e]=(this.evidence.retriesByReason[e]??0)+1;return true}recordRetryAfter(e){this.evidence.retryAfterObservedMs.push(e)}recordRateLimit(e,t,r){this.evidence.primaryRate={...e===undefined?{}:{remaining:e},...t===undefined?{}:{resetAt:t},...r===undefined?{}:{resource:r}}}recordConditional(e=false){this.evidence.conditionalRequests+=1;if(e)this.evidence.conditional304+=1}recordSleep(e){if(e<0||this.evidence.cumulativeSleepMs+e>this.limits.maxCumulativeSleepMs){this.recordCap("retry_sleep_budget");return false}this.evidence.cumulativeSleepMs+=e;return true}snapshot(){return structuredClone(this.evidence)}}t.BudgetLedger=BudgetLedger},8129:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.parseRetryDelay=parseRetryDelay;t.boundedRetryDelay=boundedRetryDelay;const n=r(2355);function parseRetryDelay(e,t,r){const n=e["retry-after"];if(n!==undefined){const e=Number(n);if(Number.isFinite(e)&&e>=0){const t=Math.min(Math.floor(e*1e3),r);return{delayMs:t,observedMs:t}}}const s=e["x-ratelimit-reset"];if(s!==undefined){const e=Number(s)*1e3;if(Number.isFinite(e)&&e>t){const n=Math.min(Math.floor(e-t),r);return{delayMs:n,observedMs:n}}}return{delayMs:0}}async function boundedRetryDelay(e,t,r,s){const i=parseRetryDelay(t,s.now(),r.limits.maxRetryDelayMs);if(i.observedMs!==undefined)r.recordRetryAfter(i.observedMs);if(!r.recordRetry(e)){throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RETRY_EXHAUSTED",`GitHub retry budget exhausted for ${e}.`,{remediation:"Retry the complete snapshot later; no partial response was promoted to decision evidence.",complete:false,permissionState:e.includes("rate_limit")?"unknown":"sufficient"}))}if(!r.recordSleep(i.delayMs)){throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RATE_LIMITED","The bounded GitHub retry sleep budget was exhausted.",{remediation:"Wait for the reported GitHub limit to reset, then rerun the read-only snapshot.",complete:false,permissionState:"unknown"}))}if(i.delayMs>0)await s.sleep(i.delayMs)}},5426:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectReviews=collectReviews;const n=r(1552);const s=r(2823);const i=r(6299);const o=r(2355);const a=r(1914);function reviewTime(e){return e.submitted_at===undefined||e.submitted_at===null?0:Date.parse(e.submitted_at)}function parseReviews(e){if(!Array.isArray(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The pull-request reviews response was not an array.",{observation:"reviews",snapshotEvaluable:false,exitCode:2}));return e.map((e,t)=>{if(!(0,s.isRecord)(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Review ${t} was malformed.`,{observation:"reviews",snapshotEvaluable:false,exitCode:2}));const r=(0,s.readPositiveInt)(e,"id");const n=(0,s.readString)(e,"state");const i=(0,s.readString)(e,"commit_id");if(r===undefined||n===undefined||i===undefined||!(0,s.isRecord)(e.user))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Review ${t} lacked immutable actor/state/commit identity.`,{observation:"reviews",snapshotEvaluable:false,exitCode:2}));const a=(0,s.readPositiveInt)(e.user,"id");const c=(0,s.readString)(e.user,"login");if(a===undefined||c===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Review ${r} lacked actor identity.`,{observation:"reviews",snapshotEvaluable:false,exitCode:2}));if(n!=="APPROVED"&&n!=="CHANGES_REQUESTED"&&n!=="COMMENTED"&&n!=="DISMISSED")throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`Review ${r} had an unsupported state ${n}.`,{observation:"reviews"}));const u=(0,s.readString)(e,"submitted_at");if(u!==undefined&&!Number.isFinite(Date.parse(u)))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Review ${r} had an invalid submitted_at timestamp.`,{observation:"reviews",snapshotEvaluable:false,exitCode:2}));const d=(0,s.readString)(e,"author_association");const l=(0,s.readString)(e.user,"type");return{id:r,user:{id:a,login:c,...l===undefined?{}:{type:l}},state:n,commit_id:i,...u===undefined?{}:{submitted_at:u},...d===undefined?{}:{author_association:d}}})}async function collectReviews(e,t,r,s,c,u,d="collection"){const l=await(0,i.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/pulls/${s}/reviews`,query:{per_page:100}},"reviews",parseReviews,e=>String(e.id),{phase:d});const p=[...l.diagnostics];const f=new Map;for(const e of l.items){const t=e.user?.id??0;const r=f.get(t);if(r===undefined||reviewTime(e)>reviewTime(r)||reviewTime(e)===reviewTime(r)&&e.id>r.id)f.set(t,e)}const h=l.items.map(e=>{const t=e.user;if(t===null||t===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","A review actor was unexpectedly absent after parsing.",{observation:"reviews",snapshotEvaluable:false,exitCode:2}));const r=f.get(t.id);const n=r?.state;const s=r?.id===e.id&&n!=="DISMISSED";const i=t.type==="Bot"||t.login.endsWith("[bot]");return{reviewId:e.id,actorId:t.id,login:(0,a.safeAllowlistedString)(t.login,`review ${e.id} login`,200),state:e.state,commitId:e.commit_id,qualified:false,teams:[],teamIds:[],qualification:{source:{kind:"github",identity:"collaborator-permission"},revision:c,complete:!i,permissionState:i?"sufficient":"unknown"},isAuthor:u!==undefined&&u===t.id,isBot:i,active:s}});const m=new Date(e.clock.now()).toISOString();const g={source:{kind:"github",identity:"collaborator-permission"},revision:c,retrievedAt:m,complete:l.complete,permissionState:l.permissionState,responseDigest:(0,n.sha256Digest)([])};const v={source:{kind:"github",identity:"team-identity+membership"},revision:c,retrievedAt:m,complete:l.complete,permissionState:l.permissionState,responseDigest:(0,n.sha256Digest)([])};return{reviews:h,meta:{source:{kind:"github",identity:"pull-request-reviews"},revision:c,retrievedAt:m,complete:l.complete,permissionState:l.permissionState,responseDigest:(0,n.sha256Digest)(l.pageDigests)},collaboratorMeta:g,teamMeta:v,diagnostics:p}}},7092:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectRulesets=collectRulesets;const n=r(1552);const s=r(2823);const i=r(6299);const o=r(2355);function emptyControls(){return{requiredChecks:[],requiredApprovals:0,requireCodeOwnerReviews:false,requireLastPushApproval:false,staleReviews:false,requiredReviewThreadResolution:false,unsupported:false,complete:true}}function safePattern(e){return!/[?\[\]]/.test(e)}function matchesRefPattern(e,t){if(e==="~ALL"||e===t)return true;if(e==="~DEFAULT_BRANCH"||!e.includes("*")||!safePattern(e))return false;const r=e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*");return new RegExp(`^${r}$`).test(t)}function parseRefConditions(e,t){if(e===undefined)return{applicable:true,complete:true};if(!(0,s.isRecord)(e)||!(0,s.isRecord)(e.ref_name))return{applicable:false,complete:false};const r=e.ref_name.include;const n=e.ref_name.exclude;if(!Array.isArray(r)||n!==undefined&&!Array.isArray(n))return{applicable:false,complete:false};const i=r.filter(e=>typeof e==="string");const o=n===undefined?[]:n.filter(e=>typeof e==="string");const a=i.length===r.length&&o.length===(Array.isArray(n)?n.length:0)&&[...i,...o].every(safePattern)&&![...i,...o].includes("~DEFAULT_BRANCH");const c=`refs/heads/${t}`;const u=i.length===0||i.some(e=>matchesRefPattern(e,c));const d=o.some(e=>matchesRefPattern(e,c));return{applicable:u&&!d,complete:a}}function mergeCheck(e,t){const r=e.find(e=>e.context===t.context);if(r===undefined)e.push(t);else if(r.appId===undefined&&t.appId!==undefined)r.appId=t.appId}function parseRuleControls(e){const t=emptyControls();if(!Array.isArray(e))return{ruleTypes:[],controls:{...t,complete:false}};const r=[];for(const n of e){if(!(0,s.isRecord)(n)||typeof n.type!=="string"||n.type.trim().length===0){t.complete=false;continue}const e=n.type;r.push(e);if(e==="required_status_checks"){const e=(0,s.isRecord)(n.parameters)?n.parameters:undefined;const r=e?.required_status_checks;if(!Array.isArray(r)){t.complete=false;continue}for(const e of r){if(!(0,s.isRecord)(e)||typeof e.context!=="string"||e.context.trim().length===0){t.complete=false;continue}const r=e.integration_id;if(r!==undefined&&r!==null&&(typeof r!=="number"||!Number.isInteger(r)||r<1)){t.complete=false;continue}mergeCheck(t.requiredChecks,{context:e.context,...typeof r==="number"?{appId:r}:{}})}continue}if(e==="pull_request"){const e=(0,s.isRecord)(n.parameters)?n.parameters:undefined;const r=e?.required_approving_review_count;const i=e?.require_code_owner_review;const o=e?.require_last_push_approval;const a=e?.dismiss_stale_reviews_on_push;const c=e?.required_review_thread_resolution;if(typeof r!=="number"||!Number.isInteger(r)||r<0||typeof i!=="boolean"||typeof o!=="boolean"||typeof a!=="boolean"||typeof c!=="boolean"){t.complete=false}else{t.requiredApprovals=Math.max(t.requiredApprovals,r);t.requireCodeOwnerReviews=t.requireCodeOwnerReviews||i;t.requireLastPushApproval=t.requireLastPushApproval||o;t.staleReviews=t.staleReviews||a;t.requiredReviewThreadResolution=t.requiredReviewThreadResolution||c}const u=e?.allowed_merge_methods;if(u!==undefined&&(!Array.isArray(u)||u.some(e=>typeof e!=="string")||!["merge","squash","rebase"].every(e=>u.includes(e))))t.unsupported=true;continue}t.unsupported=true}t.requiredChecks.sort((e,t)=>(0,n.compareTextUnit)(e.context,t.context)||(e.appId??0)-(t.appId??0));return{ruleTypes:[...new Set(r)].sort(),controls:t}}function parseRulesets(e,t){if(!Array.isArray(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The repository rulesets response was not an array.",{observation:"rulesets",snapshotEvaluable:false,exitCode:2}));return e.map((e,r)=>{if(!(0,s.isRecord)(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Ruleset ${r} was malformed.`,{observation:"rulesets",snapshotEvaluable:false,exitCode:2}));const n=(0,s.readPositiveInt)(e,"id");const i=(0,s.readString)(e,"name");const a=(0,s.readString)(e,"enforcement");if(n===undefined||i===undefined||a===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Ruleset ${r} lacked identity or enforcement.`,{observation:"rulesets",snapshotEvaluable:false,exitCode:2}));const c=(0,s.readString)(e,"source_type")??"unknown";const u=(0,s.readString)(e,"source")??"unknown";const d=(0,s.readString)(e,"target")??"branch";const l=a==="active"||a==="evaluate"||a==="disabled";const p=parseRuleControls(e.rules);const f=parseRefConditions(e.conditions,t);const h=Array.isArray(e.bypass_actors);const m=d==="branch"&&f.applicable;const g=a==="active"&&m&&(p.ruleTypes.length>0||p.controls.unsupported);const v=l&&f.complete&&p.controls.complete&&(!g||h)&&(!g||!p.controls.unsupported);const y=p.controls;return{id:n,name:i,sourceType:c,source:u,enforcement:a==="active"||a==="evaluate"||a==="disabled"?a:"unknown",applicable:m,requiredChecks:y.requiredChecks,requiredApprovals:y.requiredApprovals,requireCodeOwnerReviews:y.requireCodeOwnerReviews,requireLastPushApproval:y.requireLastPushApproval,staleReviews:y.staleReviews,requiredReviewThreadResolution:y.requiredReviewThreadResolution,bypassVisible:h,ruleTypes:p.ruleTypes,decisionBearing:g,complete:v}})}async function collectRulesets(e,t,r,s,a,c=false,u="collection"){const d=new Date(e.clock.now()).toISOString();try{const l=await(0,i.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/rulesets`,query:{includes_parents:true,per_page:100}},"rulesets",e=>parseRulesets(e,s),e=>String(e.id),{phase:u,allowConfirmedAbsence:c,pageSize:100});const p=l.items;const f=p.map(({complete:e,...t})=>t);const h=p.every(e=>e.complete);const m=[...l.diagnostics];if(!h)m.push((0,o.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","A native ruleset had unsupported enforcement, condition, bypass visibility, or rule semantics.",{observation:"rulesets",remediation:"Use only the supported required-status-check and pull-request subset, or extend the versioned native-control contract before evaluating."}));const g=f.some(e=>e.applicable&&e.decisionBearing);const v=l.complete&&h&&m.length===0;return{rulesets:f,...v?{source:{kind:"ruleset",identity:"repository-rulesets",revision:a,digest:(0,n.sha256Digest)(f),authority:"enforced"}}:{},meta:{source:{kind:"github",identity:"repository-rulesets"},revision:a,retrievedAt:d,complete:v,permissionState:v?"sufficient":l.permissionState,responseDigest:(0,n.sha256Digest)(l.pageDigests)},diagnostics:m,decisionBearing:v&&g}}catch(e){const t=e instanceof o.GitHubAdapterError?e.diagnostic:(0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Ruleset normalization failed.",{observation:"rulesets",snapshotEvaluable:false,exitCode:2});return{rulesets:[],meta:{source:{kind:"github",identity:"repository-rulesets"},revision:a,retrievedAt:d,complete:false,permissionState:t.permissionState},diagnostics:[t],decisionBearing:false}}}},861:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.buildGitHubSnapshot=buildGitHubSnapshot;const n=r(1552);const s=r(6875);const i=r(1140);const o=r(1165);const a=r(3538);const c=r(3506);const u=r(6047);const d=r(6250);const l=r(5426);const p=r(5435);const f=r(7092);const h=r(4835);const m=r(2355);const g=r(7369);const v=r(7969);function unique(e){return[...new Set(e)].sort()}function reviewability(e){const t=unique(e.paths.map(e=>e.split("/")[0]??"root"));const r=e.files.filter(e=>/(^|\/)(generated|dist|vendor)(\/|$)|\.(lock|snap)$/.test(e.path)).length;return{fileCount:e.files.length,ownershipDomains:t,generatedFileCount:r,boundaryCount:t.length}}function metaWithDigest(e,t,r){const{normalizedDigest:n,...s}=e;return r?{...s,normalizedDigest:t}:s}function sourceMeta(e,t){return{...t,source:{kind:t.source.kind,identity:e.identity}}}function policySources(e){return[e.policy.source,e.codeowners.source,e.rulesets.source,e.branchProtection.source].filter(e=>e!==undefined)}function buildInput(e,t){const r=policySources(t);const s=t.policy.rawBytesDigest??t.policy.artifact?.digest??(0,n.sha256Text)("");const o={schemaVersion:"0.1",repository:{owner:e.owner,name:e.name,pullRequest:e.pullRequestNumber},revisions:{baseSha:e.baseSha,headSha:e.headSha,...e.mergeSha===undefined?{}:{mergeSha:e.mergeSha},testedSha:e.testedSha,targetKind:e.targetKind},policy:t.policy.artifact?.policy??null,policySources:r,policyDigest:s,changedPaths:t.changed.paths,linkedIssues:t.linked.issues,reviews:t.reviews.reviews,checks:t.checks.checks,ownershipRequirements:t.codeowners.requirements,...t.branchProtection.protection===undefined&&t.rulesets.rulesets.length===0?{}:{nativeControls:{...t.branchProtection.protection===undefined?{}:{branchProtection:t.branchProtection.protection},...t.rulesets.rulesets.length===0?{}:{rulesets:t.rulesets.rulesets}}},reviewability:t.reviewability};const a={policySources:r.map(e=>sourceMeta(e,e.kind==="patchgate"?t.policy.meta:e.kind==="codeowners"?t.codeowners.meta:e.kind==="ruleset"?t.rulesets.meta:t.branchProtection.meta)),changedPaths:t.changed.meta,linkedIssues:t.linked.meta,reviews:t.reviews.meta,checks:t.checks.meta,ownership:{...t.codeowners.meta,complete:t.codeowners.meta.complete&&t.changed.meta.complete,permissionState:t.codeowners.meta.complete&&t.changed.meta.complete?t.codeowners.meta.permissionState:"unknown"},reviewability:{source:{kind:"github",identity:"reviewability"},revision:e.testedSha,retrievedAt:t.changed.meta.retrievedAt,complete:t.changed.meta.complete,permissionState:t.changed.meta.complete?"sufficient":"unknown"}};const c={...o,observations:a};const u={policySources:a.policySources.map(e=>metaWithDigest(e,(0,i.normalizedObservationDigest)(c,"policySources"),e.complete)),changedPaths:metaWithDigest(a.changedPaths,(0,i.normalizedObservationDigest)(c,"changedPaths"),a.changedPaths.complete),linkedIssues:metaWithDigest(a.linkedIssues,(0,i.normalizedObservationDigest)(c,"linkedIssues"),a.linkedIssues.complete),reviews:metaWithDigest(a.reviews,(0,i.normalizedObservationDigest)(c,"reviews"),a.reviews.complete),checks:metaWithDigest(a.checks,(0,i.normalizedObservationDigest)(c,"checks"),a.checks.complete),ownership:metaWithDigest(a.ownership,(0,i.normalizedObservationDigest)(c,"ownership"),a.ownership.complete),reviewability:metaWithDigest(a.reviewability,(0,i.normalizedObservationDigest)(c,"reviewability"),a.reviewability.complete)};return{...o,observations:u}}async function collectAll(e,t,n,s){const i=n.allowConfirmedAbsence??false;const o=await Promise.all([r.e(815),r.e(113)]).then(r.bind(r,3113)).then(({fetchTrustedBasePolicy:r})=>r(e,t.owner,t.name,t.baseSha,i,s));const m=await(0,a.collectChangedPaths)(e,t.owner,t.name,t.pullRequestNumber,t.headSha,s);const g=await(0,c.collectCodeowners)(e,t.owner,t.name,t.baseSha,m.paths,i,s);const v=await(0,u.collectLinkedIssues)(e,t.owner,t.name,t.pullRequestNumber,t.headSha,s);const y=await(0,d.collectChecks)(e,t.owner,t.name,t.testedSha,s);const b=await(0,l.collectReviews)(e,t.owner,t.name,t.pullRequestNumber,t.testedSha,t.authorId,s);const w=unique([...t.owner.length>0?[]:[],...g.requirements.flatMap(e=>e.owners),...o.artifact?.policy.sensitivePaths?.flatMap(e=>e.requiredReviewers)??[]]);const $=await(0,p.qualifyReviews)(e,b.reviews,t.owner,t.name,w,s);const S={...b,reviews:$.reviews,collaboratorMeta:$.collaboratorMeta,teamMeta:$.teamMeta,diagnostics:[...b.diagnostics,...$.diagnostics]};const k=await(0,f.collectRulesets)(e,t.owner,t.name,t.baseRef,t.baseSha,i,s);const E=await(0,h.collectBranchProtection)(e,t.owner,t.name,t.baseRef,t.baseSha,i,s);return{policy:o,changed:m,codeowners:g,linked:v,checks:y,reviews:S,rulesets:k,branchProtection:E,reviewability:reviewability(m)}}function allDiagnostics(e){return[...e.policy.diagnostics,...e.changed.diagnostics,...e.codeowners.diagnostics,...e.linked.diagnostics,...e.checks.diagnostics,...e.reviews.diagnostics,...e.rulesets.diagnostics,...e.branchProtection.diagnostics]}function inputGroupDigests(e){return{policySources:(0,i.normalizedObservationDigest)(e,"policySources"),changedPaths:(0,i.normalizedObservationDigest)(e,"changedPaths"),linkedIssues:(0,i.normalizedObservationDigest)(e,"linkedIssues"),reviews:(0,i.normalizedObservationDigest)(e,"reviews"),checks:(0,i.normalizedObservationDigest)(e,"checks"),ownership:(0,i.normalizedObservationDigest)(e,"ownership"),reviewability:(0,i.normalizedObservationDigest)(e,"reviewability")}}function fatalNativeDiagnostic(e){if(!e.rulesets.meta.complete||!e.branchProtection.meta.complete)return(0,m.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","Native ruleset or branch-protection visibility is incomplete; the current evaluator cannot safely treat unknown native controls as absent.",{remediation:"Grant the documented native-control read permissions and rerun, or keep the native-control snapshot rejected.",snapshotEvaluable:false,exitCode:2});return undefined}function capabilityObservations(e){return[{endpoint:"contents/patchgate.yml or .github/patchgate.yml",capability:"contents:read",state:e.policy.meta.permissionState,affectedRequirements:["policy.base_revision"],remediation:"Grant Contents: read or keep policy authority ambiguous."},{endpoint:"pulls/files",capability:"pull requests:read",state:e.changed.meta.permissionState,affectedRequirements:["changed_paths","ownership","human_handoff"],remediation:"Grant Pull requests: read."},{endpoint:"graphql:closingIssuesReferences",capability:"pull requests:read",state:e.linked.meta.permissionState,affectedRequirements:["issue.linkage"],remediation:"Grant the documented GraphQL/pull-request read capability; body-only issue text is not a substitute."},{endpoint:"commits/{testedSha}/check-runs",capability:"checks:read",state:e.checks.checkRunsMeta.permissionState,affectedRequirements:["required_check"],remediation:"Grant Checks: read for the exact tested SHA."},{endpoint:"actions/runs?head_sha",capability:"actions:read",state:e.checks.workflowMeta.permissionState,affectedRequirements:["required_check"],remediation:"Grant Actions: read so workflow ID, run attempt, event and suite relation can be verified."},{endpoint:"pulls/reviews",capability:"pull requests:read",state:e.reviews.meta.permissionState,affectedRequirements:["ownership","human_handoff"],remediation:"Grant Pull requests: read and collaborator/team visibility."},{endpoint:"collaborators/{login}/permission",capability:"repository collaborator visibility",state:e.reviews.collaboratorMeta.permissionState,affectedRequirements:["ownership","human_handoff"],remediation:"Grant collaborator permission visibility; an unverified reviewer is not qualified."},{endpoint:"teams/{slug}+memberships/{login}",capability:"organization members:read",state:e.reviews.teamMeta.permissionState,affectedRequirements:["ownership","human_handoff"],remediation:"Grant team identity and membership visibility, or keep team-backed qualification unknown."},{endpoint:"contents/CODEOWNERS@base",capability:"contents:read",state:e.codeowners.meta.permissionState,affectedRequirements:["ownership"],remediation:"Grant Contents: read for the CODEOWNERS search order at base SHA."},{endpoint:"rulesets+branch-protection",capability:"metadata/administration:read",state:e.rulesets.meta.complete&&e.branchProtection.meta.complete?"sufficient":"unknown",affectedRequirements:["native controls"],remediation:"Grant native-control read permissions; inaccessible controls are not absent."}]}async function buildGitHubSnapshot(e,t,r={}){let n;try{if(r.allowConfirmedAbsence===true&&t.authKind!=="mock")throw new m.GitHubAdapterError((0,m.makeDiagnostic)("GITHUB_API_UNSUPPORTED","Confirmed resource absence is available only for recorded/mock transports; live 404 responses remain unknown.",{remediation:"Remove --allow-confirmed-absence from live retrieval or use an explicit authenticated absence contract.",snapshotEvaluable:false,exitCode:2}));n=await(0,g.resolvePullRequestIdentity)(t,e);const i=await collectAll(t,n,r,"collection");const a=fatalNativeDiagnostic(i);if(a!==undefined)return{kind:"rejected",diagnostic:a,metrics:t.budget.snapshot(),capability:(0,o.capabilityReport)(n,t.authKind,t.origin,t.apiVersion,capabilityObservations(i),allDiagnostics(i))};const c=buildInput(n,i);(0,s.assertEvaluationInput)(c);const u=inputGroupDigests(c);const d=await(0,g.resolvePullRequestIdentity)(t,e,"finalization");(0,v.assertTargetStable)(n,d);const l=await collectAll(t,d,r,"finalization");const p=fatalNativeDiagnostic(l);if(p!==undefined)return{kind:"rejected",diagnostic:p,metrics:t.budget.snapshot(),capability:(0,o.capabilityReport)(n,t.authKind,t.origin,t.apiVersion,capabilityObservations(l),allDiagnostics(l))};const f=buildInput(d,l);(0,s.assertEvaluationInput)(f);const h=inputGroupDigests(f);for(const e of Object.keys(u))(0,v.assertObservationStable)(e,u[e],h[e]);if(i.policy.rawDigest!==l.policy.rawDigest)throw new m.GitHubAdapterError((0,m.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","The trusted base policy changed during finalization.",{observation:"policySources",snapshotEvaluable:false,exitCode:2}));if(i.rulesets.source?.digest!==l.rulesets.source?.digest||i.branchProtection.source?.digest!==l.branchProtection.source?.digest)throw new m.GitHubAdapterError((0,m.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","Native control provenance changed during finalization.",{observation:"policySources",snapshotEvaluable:false,exitCode:2}));const y=allDiagnostics(i);const b=(0,o.capabilityReport)(n,t.authKind,t.origin,t.apiVersion,capabilityObservations(i),y);return{kind:"built",input:c,identity:n,diagnostics:y,metrics:t.budget.snapshot(),capability:b}}catch(e){const r=(0,m.diagnosticFrom)(e,"GITHUB_PROVENANCE_AMBIGUOUS");const s=n===undefined?[{endpoint:"repos/{owner}/{name}",capability:"repository metadata:read",state:r.permissionState,affectedRequirements:["repository.identity"],remediation:"Grant repository metadata read and pull-request visibility to the authenticated read-only credential."}]:[];return{kind:"rejected",diagnostic:r,metrics:t.budget.snapshot(),capability:(0,o.capabilityReport)(n,t.authKind,t.origin,t.apiVersion,s,[r])}}}},7969:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.assertTargetStable=assertTargetStable;t.assertObservationStable=assertObservationStable;const n=r(2355);const s=r(7369);function assertTargetStable(e,t){if(!(0,s.sameSnapshotIdentity)(e,t))throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_TARGET_CHANGED","The pull-request target identity changed during snapshot finalization.",{remediation:"Discard the snapshot and rerun the complete read-only evaluation against the new base/head/merge identity.",snapshotEvaluable:false,exitCode:2}))}function assertObservationStable(e,t,r){if(t!==r)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`The ${e} observation changed during snapshot finalization.`,{observation:e,remediation:"Discard the complete snapshot and rerun; do not patch old observations with new data.",snapshotEvaluable:false,exitCode:2}))}},7665:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectWorkflowRuns=collectWorkflowRuns;const n=r(2823);const s=r(6299);const i=r(2355);function parseRuns(e){if(!(0,n.isRecord)(e)||!Array.isArray(e.workflow_runs))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The workflow-runs response was malformed.",{observation:"checks",snapshotEvaluable:false,exitCode:2}));const t=(0,n.readPositiveInt)(e,"total_count");if(t!==undefined&&t>1e3)throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","The workflow-runs search exceeded GitHub's documented 1,000-result search limit.",{observation:"checks",remediation:"Narrow the workflow-run query or treat required workflow evidence as incomplete."}));return e.workflow_runs.map((e,t)=>{if(!(0,n.isRecord)(e))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Workflow run ${t} was malformed.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));const r=(0,n.readPositiveInt)(e,"id");const s=(0,n.readString)(e,"head_sha");const o=(0,n.readString)(e,"event");const a=(0,n.readPositiveInt)(e,"workflow_id");const c=(0,n.readString)(e,"status");const u=(0,n.readPositiveInt)(e,"run_attempt");if(r===undefined||s===undefined||o===undefined||a===undefined||c===undefined||u===undefined)throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Workflow run ${t} lacked immutable identity fields.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));const d=(0,n.readString)(e,"path");const l=(0,n.readString)(e,"conclusion");const p=(0,n.readPositiveInt)(e,"check_suite_id");return{id:r,head_sha:s,event:o,workflow_id:a,status:c,run_attempt:u,...d===undefined?{}:{path:d},...l===undefined?{}:{conclusion:l},...p===undefined?{}:{check_suite_id:p}}})}async function collectWorkflowRuns(e,t,r,n,i="collection"){return(0,s.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/actions/runs`,query:{head_sha:n,per_page:100}},"workflows",parseRuns,e=>`${e.id}:${e.run_attempt}`,{phase:i})}},311:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.EVALUATOR_VERSION=void 0;t.EVALUATOR_VERSION="0.1.0-dev"},181:t=>{t.exports=e(import.meta.url)("buffer")},1421:t=>{t.exports=e(import.meta.url)("node:child_process")},7598:t=>{t.exports=e(import.meta.url)("node:crypto")},3024:t=>{t.exports=e(import.meta.url)("node:fs")},1455:t=>{t.exports=e(import.meta.url)("node:fs/promises")},6760:t=>{t.exports=e(import.meta.url)("node:path")},7975:t=>{t.exports=e(import.meta.url)("node:util")},932:t=>{t.exports=e(import.meta.url)("process")},4352:(e,t,r)=>{const{normalizeIPv6:n,removeDotSegments:s,recomposeAuthority:i,normalizePercentEncoding:o,normalizePathEncoding:a,escapePreservingEscapes:c,reescapeHostDelimiters:u,isIPv4:d,nonSimpleDomain:l}=r(5077);const{SCHEMES:p,getSchemeHandler:f}=r(5300);function normalize(e,t){if(typeof e==="string"){e=normalizeString(e,t)}else if(typeof e==="object"){e=parse(serialize(e,t),t)}return e}function resolve(e,t,r){const n=r?Object.assign({scheme:"null"},r):{scheme:"null"};const{parsed:s,malformedAuthorityOrPort:i}=parseWithStatus(e,n);const{parsed:o,malformedAuthorityOrPort:a}=parseWithStatus(t,n);if(i||a){throw new Error(s.error||o.error||"URI is malformed.")}const c=resolveComponent(s,o,n,true);n.skipEscape=true;return serialize(c,n)}function resolveComponent(e,t,r,n){const i={};if(!n){e=parse(serialize(e,r),r);t=parse(serialize(t,r),r)}r=r||{};if(!r.tolerant&&t.scheme){i.scheme=t.scheme;i.userinfo=t.userinfo;i.host=t.host;i.port=t.port;i.path=s(t.path||"");i.query=t.query}else{if(t.userinfo!==undefined||t.host!==undefined||t.port!==undefined){i.userinfo=t.userinfo;i.host=t.host;i.port=t.port;i.path=s(t.path||"");i.query=t.query}else{if(!t.path){i.path=e.path;if(t.query!==undefined){i.query=t.query}else{i.query=e.query}}else{if(t.path[0]==="/"){i.path=s(t.path)}else{if((e.userinfo!==undefined||e.host!==undefined||e.port!==undefined)&&!e.path){i.path="/"+t.path}else if(!e.path){i.path=t.path}else{i.path=e.path.slice(0,e.path.lastIndexOf("/")+1)+t.path}i.path=s(i.path)}i.query=t.query}i.userinfo=e.userinfo;i.host=e.host;i.port=e.port}i.scheme=e.scheme}i.fragment=t.fragment;return i}function equal(e,t,r){const n=normalizeComparableURI(e,r);const s=normalizeComparableURI(t,r);return n!==undefined&&s!==undefined&&n.toLowerCase()===s.toLowerCase()}function serialize(e,t){const r={host:e.host,scheme:e.scheme,userinfo:e.userinfo,port:e.port,path:e.path,query:e.query,nid:e.nid,nss:e.nss,uuid:e.uuid,fragment:e.fragment,reference:e.reference,resourceName:e.resourceName,secure:e.secure,error:""};const n=Object.assign({},t);const a=[];const u=f(n.scheme||r.scheme);if(u&&u.serialize)u.serialize(r,n);if(r.path!==undefined){if(!n.skipEscape){r.path=c(r.path);if(r.scheme!==undefined){r.path=r.path.split("%3A").join(":")}}else{r.path=o(r.path)}}if(n.reference!=="suffix"&&r.scheme){a.push(r.scheme,":")}const d=i(r);if(d!==undefined){if(n.reference!=="suffix"){a.push("//")}a.push(d);if(r.path&&r.path[0]!=="/"){a.push("/")}}if(r.path!==undefined){let e=r.path;if(!n.absolutePath&&(!u||!u.absolutePath)){e=s(e)}if(d===undefined&&e[0]==="/"&&e[1]==="/"){e="/%2F"+e.slice(2)}a.push(e)}if(r.query!==undefined){a.push("?",r.query)}if(r.fragment!==undefined){a.push("#",r.fragment)}return a.join("")}const h=/^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;const m=/^(?:[^#/:?]+:)?\/\/([^/?#]*)/;const g=/^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;function getParseError(e,t){if(t[2]!==undefined&&e.path&&e.path[0]!=="/"){return'URI path must start with "/" when authority is present.'}if(typeof e.port==="number"&&(e.port<0||e.port>65535)){return"URI port is malformed."}return undefined}function parseWithStatus(e,t){const r=Object.assign({},t);const s={scheme:undefined,userinfo:undefined,host:"",port:undefined,path:"",query:undefined,fragment:undefined};let i=false;let o=false;if(r.reference==="suffix"){if(r.scheme){e=r.scheme+":"+e}else{e="//"+e}}const c=e.match(m);if(c!==null&&c[1].indexOf("\\")!==-1){s.error="URI authority must not contain a literal backslash.";i=true}const p=e.match(g);if(p!==null){const e=p[1];const t=e.replace(/[\t\n\r]/g,"");if(t.length>=2){if(t.slice(0,2)!=="//"){s.error=s.error||"URI authority must not contain a literal backslash.";i=true}else if(e.length!==t.length){s.error=s.error||"URI authority introducer must not contain whitespace.";i=true}}}const v=e.match(h);if(v){s.scheme=v[1];s.userinfo=v[3];s.host=v[4];s.port=parseInt(v[5],10);s.path=v[6]||"";s.query=v[7];s.fragment=v[8];if(isNaN(s.port)){s.port=v[5]}const t=getParseError(s,v);if(t!==undefined){s.error=s.error||t;i=true}if(s.host){const e=d(s.host);if(e===false){const e=n(s.host);s.host=e.host.toLowerCase();o=e.isIPV6}else{o=true}}if(s.scheme===undefined&&s.userinfo===undefined&&s.host===undefined&&s.port===undefined&&s.query===undefined&&!s.path){s.reference="same-document"}else if(s.scheme===undefined){s.reference="relative"}else if(s.fragment===undefined){s.reference="absolute"}else{s.reference="uri"}if(r.reference&&r.reference!=="suffix"&&r.reference!==s.reference){s.error=s.error||"URI is not a "+r.reference+" reference."}const c=f(r.scheme||s.scheme);if(!r.unicodeSupport&&(!c||!c.unicodeSupport)){if(s.host&&(r.domainHost||c&&c.domainHost)&&o===false&&l(s.host)){try{s.host=new URL("http://"+s.host).hostname}catch(e){s.error=s.error||"Host's domain name can not be converted to ASCII: "+e}}}if(!c||c&&!c.skipNormalize){if(e.indexOf("%")!==-1){if(s.scheme!==undefined){s.scheme=unescape(s.scheme)}if(s.host!==undefined){s.host=u(unescape(s.host),o)}}if(s.path){s.path=a(s.path)}if(s.fragment){try{s.fragment=encodeURI(decodeURIComponent(s.fragment))}catch{s.error=s.error||"URI malformed"}}}if(c&&c.parse){c.parse(s,r)}}else{s.error=s.error||"URI can not be parsed."}return{parsed:s,malformedAuthorityOrPort:i}}function parse(e,t){return parseWithStatus(e,t).parsed}function normalizeString(e,t){return normalizeStringWithStatus(e,t).normalized}function normalizeStringWithStatus(e,t){const{parsed:r,malformedAuthorityOrPort:n}=parseWithStatus(e,t);return{normalized:n?e:serialize(r,t),malformedAuthorityOrPort:n}}function normalizeComparableURI(e,t){if(typeof e==="string"){const{normalized:r,malformedAuthorityOrPort:n}=normalizeStringWithStatus(e,t);return n?undefined:r}if(typeof e==="object"){return serialize(e,t)}}const v={SCHEMES:p,normalize:normalize,resolve:resolve,resolveComponent:resolveComponent,equal:equal,serialize:serialize,parse:parse};e.exports=v;e.exports["default"]=v;e.exports.fastUri=v},5300:(e,t,r)=>{const{isUUID:n}=r(5077);const s=/([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;const i=["http","https","ws","wss","urn","urn:uuid"];function isValidSchemeName(e){return i.indexOf(e)!==-1}function wsIsSecure(e){if(e.secure===true){return true}else if(e.secure===false){return false}else if(e.scheme){return e.scheme.length===3&&(e.scheme[0]==="w"||e.scheme[0]==="W")&&(e.scheme[1]==="s"||e.scheme[1]==="S")&&(e.scheme[2]==="s"||e.scheme[2]==="S")}else{return false}}function httpParse(e){if(!e.host){e.error=e.error||"HTTP URIs must have a host."}return e}function httpSerialize(e){const t=String(e.scheme).toLowerCase()==="https";if(e.port===(t?443:80)||e.port===""){e.port=undefined}if(!e.path){e.path="/"}return e}function wsParse(e){e.secure=wsIsSecure(e);e.resourceName=(e.path||"/")+(e.query?"?"+e.query:"");e.path=undefined;e.query=undefined;return e}function wsSerialize(e){if(e.port===(wsIsSecure(e)?443:80)||e.port===""){e.port=undefined}if(typeof e.secure==="boolean"){e.scheme=e.secure?"wss":"ws";e.secure=undefined}if(e.resourceName){const[t,r]=e.resourceName.split("?");e.path=t&&t!=="/"?t:undefined;e.query=r;e.resourceName=undefined}e.fragment=undefined;return e}function urnParse(e,t){if(!e.path){e.error="URN can not be parsed";return e}const r=e.path.match(s);if(r){const n=t.scheme||e.scheme||"urn";e.nid=r[1].toLowerCase();e.nss=r[2];const s=`${n}:${t.nid||e.nid}`;const i=getSchemeHandler(s);e.path=undefined;if(i){e=i.parse(e,t)}}else{e.error=e.error||"URN can not be parsed."}return e}function urnSerialize(e,t){if(e.nid===undefined){throw new Error("URN without nid cannot be serialized")}const r=t.scheme||e.scheme||"urn";const n=e.nid.toLowerCase();const s=`${r}:${t.nid||n}`;const i=getSchemeHandler(s);if(i){e=i.serialize(e,t)}const o=e;const a=e.nss;o.path=`${n||t.nid}:${a}`;t.skipEscape=true;return o}function urnuuidParse(e,t){const r=e;r.uuid=r.nss;r.nss=undefined;if(!t.tolerant&&(!r.uuid||!n(r.uuid))){r.error=r.error||"UUID is not valid."}return r}function urnuuidSerialize(e){const t=e;t.nss=(e.uuid||"").toLowerCase();return t}const o={scheme:"http",domainHost:true,parse:httpParse,serialize:httpSerialize};const a={scheme:"https",domainHost:o.domainHost,parse:httpParse,serialize:httpSerialize};const c={scheme:"ws",domainHost:true,parse:wsParse,serialize:wsSerialize};const u={scheme:"wss",domainHost:c.domainHost,parse:c.parse,serialize:c.serialize};const d={scheme:"urn",parse:urnParse,serialize:urnSerialize,skipNormalize:true};const l={scheme:"urn:uuid",parse:urnuuidParse,serialize:urnuuidSerialize,skipNormalize:true};const p={http:o,https:a,ws:c,wss:u,urn:d,"urn:uuid":l};Object.setPrototypeOf(p,null);function getSchemeHandler(e){return e&&(p[e]||p[e.toLowerCase()])||undefined}e.exports={wsIsSecure:wsIsSecure,SCHEMES:p,isValidSchemeName:isValidSchemeName,getSchemeHandler:getSchemeHandler}},5077:e=>{const t=RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);const r=RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);const n=RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);const s=RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);const i=RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);function stringArrayToHexStripped(e){let t="";let r=0;let n=0;for(n=0;n<e.length;n++){r=e[n].charCodeAt(0);if(r===48){continue}if(!(r>=48&&r<=57||r>=65&&r<=70||r>=97&&r<=102)){return""}t+=e[n];break}for(n+=1;n<e.length;n++){r=e[n].charCodeAt(0);if(!(r>=48&&r<=57||r>=65&&r<=70||r>=97&&r<=102)){return""}t+=e[n]}return t}const o=RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);function consumeIsZone(e){e.length=0;return true}function consumeHextets(e,t,r){if(e.length){const n=stringArrayToHexStripped(e);if(n!==""){t.push(n)}else{r.error=true;return false}e.length=0}return true}function getIPV6(e){let t=0;const r={error:false,address:"",zone:""};const n=[];const s=[];let i=false;let o=false;let a=consumeHextets;for(let c=0;c<e.length;c++){const u=e[c];if(u==="["||u==="]"){continue}if(u===":"){if(i===true){o=true}if(!a(s,n,r)){break}if(++t>7){r.error=true;break}if(c>0&&e[c-1]===":"){i=true}n.push(":");continue}else if(u==="%"){if(!a(s,n,r)){break}a=consumeIsZone}else{s.push(u);continue}}if(s.length){if(a===consumeIsZone){r.zone=s.join("")}else if(o){n.push(s.join(""))}else{n.push(stringArrayToHexStripped(s))}}r.address=n.join("");return r}function normalizeIPv6(e){if(findToken(e,":")<2){return{host:e,isIPV6:false}}const t=getIPV6(e);if(!t.error){let e=t.address;let r=t.address;if(t.zone){e+="%"+t.zone;r+="%25"+t.zone}return{host:e,isIPV6:true,escapedHost:r}}else{return{host:e,isIPV6:false}}}function findToken(e,t){let r=0;for(let n=0;n<e.length;n++){if(e[n]===t)r++}return r}function removeDotSegments(e){let t=e;const r=[];let n=-1;let s=0;while(s=t.length){if(s===1){if(t==="."){break}else if(t==="/"){r.push("/");break}else{r.push(t);break}}else if(s===2){if(t[0]==="."){if(t[1]==="."){break}else if(t[1]==="/"){t=t.slice(2);continue}}else if(t[0]==="/"){if(t[1]==="."||t[1]==="/"){r.push("/");break}}}else if(s===3){if(t==="/.."){if(r.length!==0){r.pop()}r.push("/");break}}if(t[0]==="."){if(t[1]==="."){if(t[2]==="/"){t=t.slice(3);continue}}else if(t[1]==="/"){t=t.slice(2);continue}}else if(t[0]==="/"){if(t[1]==="."){if(t[2]==="/"){t=t.slice(2);continue}else if(t[2]==="."){if(t[3]==="/"){t=t.slice(3);if(r.length!==0){r.pop()}continue}}}}if((n=t.indexOf("/",1))===-1){r.push(t);break}else{r.push(t.slice(0,n));t=t.slice(n)}}return r.join("")}const a={"@":"%40","/":"%2F","?":"%3F","#":"%23",":":"%3A"};const c=/[@/?#:]/g;const u=/[@/?#]/g;function reescapeHostDelimiters(e,t){const r=t?u:c;r.lastIndex=0;return e.replace(r,e=>a[e])}function normalizePercentEncoding(e,t=false){if(e.indexOf("%")===-1){return e}let r="";for(let i=0;i<e.length;i++){if(e[i]==="%"&&i+2<e.length){const o=e.slice(i+1,i+3);if(n(o)){const e=o.toUpperCase();const n=String.fromCharCode(parseInt(e,16));if(t&&s(n)){r+=n}else{r+="%"+e}i+=2;continue}}r+=e[i]}return r}function normalizePathEncoding(e){let t="";for(let r=0;r<e.length;r++){if(e[r]==="%"&&r+2<e.length){const i=e.slice(r+1,r+3);if(n(i)){const e=i.toUpperCase();const n=String.fromCharCode(parseInt(e,16));if(n!=="."&&s(n)){t+=n}else{t+="%"+e}r+=2;continue}}if(i(e[r])){t+=e[r]}else{t+=escape(e[r])}}return t}function escapePreservingEscapes(e){let t="";for(let r=0;r<e.length;r++){if(e[r]==="%"&&r+2<e.length){const s=e.slice(r+1,r+3);if(n(s)){t+="%"+s.toUpperCase();r+=2;continue}}t+=escape(e[r])}return t}function recomposeAuthority(e){const t=[];if(e.userinfo!==undefined){t.push(e.userinfo);t.push("@")}if(e.host!==undefined){let n=unescape(e.host);if(!r(n)){const e=normalizeIPv6(n);if(e.isIPV6===true){n=`[${e.escapedHost}]`}else{n=reescapeHostDelimiters(n,false)}}t.push(n)}if(typeof e.port==="number"||typeof e.port==="string"){t.push(":");t.push(String(e.port))}return t.length?t.join(""):undefined}e.exports={nonSimpleDomain:o,recomposeAuthority:recomposeAuthority,reescapeHostDelimiters:reescapeHostDelimiters,normalizePercentEncoding:normalizePercentEncoding,normalizePathEncoding:normalizePathEncoding,escapePreservingEscapes:escapePreservingEscapes,removeDotSegments:removeDotSegments,isIPv4:r,isUUID:t,normalizeIPv6:normalizeIPv6,stringArrayToHexStripped:stringArrayToHexStripped}},3837:e=>{e.exports=JSON.parse('{"$id":"https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#","description":"Meta-schema for $data reference (JSON AnySchema extension proposal)","type":"object","required":["$data"],"properties":{"$data":{"type":"string","anyOf":[{"format":"relative-json-pointer"},{"format":"json-pointer"}]}},"additionalProperties":false}')},7216:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/applicator","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/applicator":true},"$dynamicAnchor":"meta","title":"Applicator vocabulary meta-schema","type":["object","boolean"],"properties":{"prefixItems":{"$ref":"#/$defs/schemaArray"},"items":{"$dynamicRef":"#meta"},"contains":{"$dynamicRef":"#meta"},"additionalProperties":{"$dynamicRef":"#meta"},"properties":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"default":{}},"patternProperties":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"propertyNames":{"format":"regex"},"default":{}},"dependentSchemas":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"default":{}},"propertyNames":{"$dynamicRef":"#meta"},"if":{"$dynamicRef":"#meta"},"then":{"$dynamicRef":"#meta"},"else":{"$dynamicRef":"#meta"},"allOf":{"$ref":"#/$defs/schemaArray"},"anyOf":{"$ref":"#/$defs/schemaArray"},"oneOf":{"$ref":"#/$defs/schemaArray"},"not":{"$dynamicRef":"#meta"}},"$defs":{"schemaArray":{"type":"array","minItems":1,"items":{"$dynamicRef":"#meta"}}}}')},8226:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/content","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/content":true},"$dynamicAnchor":"meta","title":"Content vocabulary meta-schema","type":["object","boolean"],"properties":{"contentEncoding":{"type":"string"},"contentMediaType":{"type":"string"},"contentSchema":{"$dynamicRef":"#meta"}}}')},518:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/core","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/core":true},"$dynamicAnchor":"meta","title":"Core vocabulary meta-schema","type":["object","boolean"],"properties":{"$id":{"$ref":"#/$defs/uriReferenceString","$comment":"Non-empty fragments not allowed.","pattern":"^[^#]*#?$"},"$schema":{"$ref":"#/$defs/uriString"},"$ref":{"$ref":"#/$defs/uriReferenceString"},"$anchor":{"$ref":"#/$defs/anchorString"},"$dynamicRef":{"$ref":"#/$defs/uriReferenceString"},"$dynamicAnchor":{"$ref":"#/$defs/anchorString"},"$vocabulary":{"type":"object","propertyNames":{"$ref":"#/$defs/uriString"},"additionalProperties":{"type":"boolean"}},"$comment":{"type":"string"},"$defs":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"}}},"$defs":{"anchorString":{"type":"string","pattern":"^[A-Za-z_][-A-Za-z0-9._]*$"},"uriString":{"type":"string","format":"uri"},"uriReferenceString":{"type":"string","format":"uri-reference"}}}')},4588:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/format-annotation","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/format-annotation":true},"$dynamicAnchor":"meta","title":"Format vocabulary meta-schema for annotation results","type":["object","boolean"],"properties":{"format":{"type":"string"}}}')},5707:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/meta-data","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/meta-data":true},"$dynamicAnchor":"meta","title":"Meta-data vocabulary meta-schema","type":["object","boolean"],"properties":{"title":{"type":"string"},"description":{"type":"string"},"default":true,"deprecated":{"type":"boolean","default":false},"readOnly":{"type":"boolean","default":false},"writeOnly":{"type":"boolean","default":false},"examples":{"type":"array","items":true}}}')},9547:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/unevaluated","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/unevaluated":true},"$dynamicAnchor":"meta","title":"Unevaluated applicator vocabulary meta-schema","type":["object","boolean"],"properties":{"unevaluatedItems":{"$dynamicRef":"#meta"},"unevaluatedProperties":{"$dynamicRef":"#meta"}}}')},7082:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/validation","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/validation":true},"$dynamicAnchor":"meta","title":"Validation vocabulary meta-schema","type":["object","boolean"],"properties":{"type":{"anyOf":[{"$ref":"#/$defs/simpleTypes"},{"type":"array","items":{"$ref":"#/$defs/simpleTypes"},"minItems":1,"uniqueItems":true}]},"const":true,"enum":{"type":"array","items":true},"multipleOf":{"type":"number","exclusiveMinimum":0},"maximum":{"type":"number"},"exclusiveMaximum":{"type":"number"},"minimum":{"type":"number"},"exclusiveMinimum":{"type":"number"},"maxLength":{"$ref":"#/$defs/nonNegativeInteger"},"minLength":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"pattern":{"type":"string","format":"regex"},"maxItems":{"$ref":"#/$defs/nonNegativeInteger"},"minItems":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"uniqueItems":{"type":"boolean","default":false},"maxContains":{"$ref":"#/$defs/nonNegativeInteger"},"minContains":{"$ref":"#/$defs/nonNegativeInteger","default":1},"maxProperties":{"$ref":"#/$defs/nonNegativeInteger"},"minProperties":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"required":{"$ref":"#/$defs/stringArray"},"dependentRequired":{"type":"object","additionalProperties":{"$ref":"#/$defs/stringArray"}}},"$defs":{"nonNegativeInteger":{"type":"integer","minimum":0},"nonNegativeIntegerDefault0":{"$ref":"#/$defs/nonNegativeInteger","default":0},"simpleTypes":{"enum":["array","boolean","integer","null","number","object","string"]},"stringArray":{"type":"array","items":{"type":"string"},"uniqueItems":true,"default":[]}}}')},1678:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/schema","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/core":true,"https://json-schema.org/draft/2020-12/vocab/applicator":true,"https://json-schema.org/draft/2020-12/vocab/unevaluated":true,"https://json-schema.org/draft/2020-12/vocab/validation":true,"https://json-schema.org/draft/2020-12/vocab/meta-data":true,"https://json-schema.org/draft/2020-12/vocab/format-annotation":true,"https://json-schema.org/draft/2020-12/vocab/content":true},"$dynamicAnchor":"meta","title":"Core and Validation specifications meta-schema","allOf":[{"$ref":"meta/core"},{"$ref":"meta/applicator"},{"$ref":"meta/unevaluated"},{"$ref":"meta/validation"},{"$ref":"meta/meta-data"},{"$ref":"meta/format-annotation"},{"$ref":"meta/content"}],"type":["object","boolean"],"$comment":"This meta-schema also defines keywords that have appeared in previous drafts in order to prevent incompatible extensions as they remain in common use.","properties":{"definitions":{"$comment":"\\"definitions\\" has been replaced by \\"$defs\\".","type":"object","additionalProperties":{"$dynamicRef":"#meta"},"deprecated":true,"default":{}},"dependencies":{"$comment":"\\"dependencies\\" has been split and replaced by \\"dependentSchemas\\" and \\"dependentRequired\\" in order to serve their differing semantics.","type":"object","additionalProperties":{"anyOf":[{"$dynamicRef":"#meta"},{"$ref":"meta/validation#/$defs/stringArray"}]},"deprecated":true,"default":{}},"$recursiveAnchor":{"$comment":"\\"$recursiveAnchor\\" has been replaced by \\"$dynamicAnchor\\".","$ref":"meta/core#/$defs/anchorString","deprecated":true},"$recursiveRef":{"$comment":"\\"$recursiveRef\\" has been replaced by \\"$dynamicRef\\".","$ref":"meta/core#/$defs/uriReferenceString","deprecated":true}}}')},5761:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://patchgate.dev/schemas/contribution-receipt/0.1","title":"ContributionReceipt","type":"object","additionalProperties":false,"required":["schemaVersion","evaluatorVersion","repository","revisions","policyDigest","decisionInputDigest","receiptDigest","changedPaths","policySources","observations","evidence","requirements","humanGates","final","evaluatedAt"],"properties":{"schemaVersion":{"const":"0.1"},"evaluatorVersion":{"type":"string","pattern":"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\\\\+[0-9A-Za-z.-]+)?$"},"repository":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/repository"},"revisions":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/revisions"},"policyDigest":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/digest"},"decisionInputDigest":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/digest"},"receiptDigest":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/digest"},"changedPaths":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true},"policySources":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/policySource"}},"nativeControls":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nativeControls"},"observations":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/observations"},"evidence":{"type":"object","additionalProperties":false,"required":["checks","linkedIssues","reviews","ownershipRequirements"],"properties":{"checks":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/check"}},"linkedIssues":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/linkedIssue"}},"reviews":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/review"}},"ownershipRequirements":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/ownershipRequirement"}}}},"requirements":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/requirement"}},"reviewability":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/reviewabilitySnapshot"},"humanGates":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/humanGate"}},"final":{"type":"object","additionalProperties":false,"required":["status","reasonIds"],"properties":{"status":{"enum":["ready_for_review","blocked","human_review_required","evidence_missing","policy_ambiguous"]},"reasonIds":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true}}},"evaluatedAt":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/timestamp"}},"$defs":{"requirement":{"type":"object","additionalProperties":false,"required":["id","ruleClass","authority","source","result","severity","remediation","evidenceRefs"],"properties":{"id":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"ruleClass":{"enum":["policy_integrity","issue_linkage","required_check","ownership","human_handoff","reviewability"]},"authority":{"enum":["patchgate","codeowners","ruleset","branch_protection","derived"]},"source":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"result":{"enum":["passed","failed","unknown","advisory"]},"severity":{"enum":["block","human_gate","evidence","advisory"]},"observed":{"type":"object","additionalProperties":{"anyOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"}}]}},"remediation":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"evidenceRefs":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true}},"$comment":"failed + evidence is never emitted; status precedence would otherwise treat it as ready_for_review","not":{"properties":{"result":{"const":"failed"},"severity":{"const":"evidence"}},"required":["result","severity"]}},"humanGate":{"type":"object","additionalProperties":false,"required":["id","reason","satisfied","requiredReviewers","requiredCount","approvedBy"],"properties":{"id":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"reason":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"satisfied":{"type":"boolean"},"requiredReviewers":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true},"requiredCount":{"type":"integer","minimum":1},"approvedBy":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true}}}}}')},6537:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://patchgate.dev/schemas/evaluation-input/0.1","title":"PatchGate evaluation input","type":"object","additionalProperties":false,"required":["schemaVersion","repository","revisions","policy","policySources","policyDigest","changedPaths","linkedIssues","reviews","checks","ownershipRequirements","observations"],"properties":{"schemaVersion":{"const":"0.1"},"repository":{"$ref":"#/$defs/repository"},"revisions":{"$ref":"#/$defs/revisions"},"policy":{"anyOf":[{"$ref":"https://patchgate.dev/schemas/patchgate-policy/0.1"},{"type":"null"}]},"policySources":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/policySource"}},"policyDigest":{"$ref":"#/$defs/digest"},"changedPaths":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"linkedIssues":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/linkedIssue"}},"reviews":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/review"}},"checks":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/check"}},"ownershipRequirements":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/ownershipRequirement"}},"nativeControls":{"$ref":"#/$defs/nativeControls"},"reviewability":{"$ref":"#/$defs/reviewabilitySnapshot"},"observations":{"$ref":"#/$defs/observations"}},"$defs":{"nonBlank":{"type":"string","minLength":1,"pattern":".*\\\\S.*","maxLength":100000},"digest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"},"timestamp":{"type":"string","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}:\\\\d{2}:\\\\d{2}(?:\\\\.\\\\d{3})?Z$"},"repository":{"type":"object","additionalProperties":false,"required":["owner","name","pullRequest"],"properties":{"owner":{"$ref":"#/$defs/nonBlank"},"name":{"$ref":"#/$defs/nonBlank"},"pullRequest":{"type":"integer","minimum":1}}},"revisions":{"type":"object","additionalProperties":false,"required":["baseSha","headSha","testedSha","targetKind"],"properties":{"baseSha":{"$ref":"#/$defs/nonBlank"},"headSha":{"$ref":"#/$defs/nonBlank"},"mergeSha":{"$ref":"#/$defs/nonBlank"},"mergeGroupSha":{"$ref":"#/$defs/nonBlank"},"testedSha":{"$ref":"#/$defs/nonBlank"},"targetKind":{"enum":["head","merge","merge_group"]}}},"policySource":{"type":"object","additionalProperties":false,"required":["kind","identity","revision","digest","authority"],"properties":{"kind":{"enum":["patchgate","codeowners","ruleset","branch_protection"]},"identity":{"$ref":"#/$defs/nonBlank"},"revision":{"$ref":"#/$defs/nonBlank"},"digest":{"$ref":"#/$defs/digest"},"contractDigest":{"$ref":"#/$defs/digest"},"authority":{"const":"enforced"}}},"observationSource":{"type":"object","additionalProperties":false,"required":["kind","identity"],"properties":{"kind":{"$ref":"#/$defs/nonBlank"},"identity":{"$ref":"#/$defs/nonBlank"}}},"observationMeta":{"type":"object","additionalProperties":false,"required":["source","retrievedAt","complete","permissionState"],"properties":{"source":{"$ref":"#/$defs/observationSource"},"revision":{"$ref":"#/$defs/nonBlank"},"retrievedAt":{"$ref":"#/$defs/timestamp"},"complete":{"type":"boolean"},"permissionState":{"enum":["sufficient","insufficient","unknown"]},"normalizedDigest":{"$ref":"#/$defs/digest"},"responseDigest":{"$ref":"#/$defs/digest"},"truncated":{"type":"boolean"},"nextCursor":{"$ref":"#/$defs/nonBlank"}}},"observations":{"type":"object","additionalProperties":false,"required":["policySources","changedPaths","linkedIssues","reviews","checks","ownership","reviewability"],"properties":{"policySources":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/observationMeta"}},"changedPaths":{"$ref":"#/$defs/observationMeta"},"linkedIssues":{"$ref":"#/$defs/observationMeta"},"reviews":{"$ref":"#/$defs/observationMeta"},"checks":{"$ref":"#/$defs/observationMeta"},"ownership":{"$ref":"#/$defs/observationMeta"},"reviewability":{"$ref":"#/$defs/observationMeta"}}},"linkedIssue":{"type":"object","additionalProperties":false,"required":["repository","number","repositoryId","issueId","linked"],"properties":{"repository":{"$ref":"#/$defs/nonBlank"},"number":{"type":"integer","minimum":1},"repositoryId":{"$ref":"#/$defs/nonBlank"},"issueId":{"$ref":"#/$defs/nonBlank"},"linked":{"type":"boolean"}}},"qualification":{"type":"object","additionalProperties":false,"required":["source","complete","permissionState"],"properties":{"source":{"$ref":"#/$defs/observationSource"},"revision":{"$ref":"#/$defs/nonBlank"},"complete":{"type":"boolean"},"permissionState":{"enum":["sufficient","insufficient","unknown"]},"principalBindings":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/qualificationPrincipal"},"uniqueItems":true}}},"qualificationPrincipal":{"type":"object","additionalProperties":false,"required":["configuredPrincipal","kind","immutableId","membershipState"],"properties":{"configuredPrincipal":{"$ref":"#/$defs/nonBlank"},"kind":{"enum":["user","team"]},"immutableId":{"type":"integer","minimum":1},"membershipState":{"enum":["active","pending","unknown"]}}},"review":{"type":"object","additionalProperties":false,"required":["reviewId","actorId","login","state","commitId","qualified","teams","teamIds","qualification","isAuthor","isBot","active"],"properties":{"reviewId":{"type":"integer","minimum":1},"actorId":{"type":"integer","minimum":1},"login":{"$ref":"#/$defs/nonBlank"},"state":{"enum":["APPROVED","CHANGES_REQUESTED","COMMENTED","DISMISSED"]},"commitId":{"$ref":"#/$defs/nonBlank"},"qualified":{"type":"boolean"},"teams":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"teamIds":{"type":"array","maxItems":3000,"items":{"type":"integer","minimum":1},"uniqueItems":true},"qualification":{"$ref":"#/$defs/qualification"},"isAuthor":{"type":"boolean"},"isBot":{"type":"boolean"},"active":{"type":"boolean"}}},"check":{"type":"object","additionalProperties":false,"required":["name","status","testedSha","sourceStrength","retrievedAt"],"allOf":[{"if":{"properties":{"status":{"const":"completed"}},"required":["status"]},"then":{"properties":{"conclusion":{"$ref":"#/$defs/nonBlank"}},"required":["conclusion"]}},{"if":{"properties":{"sourceStrength":{"const":"github_app_expected"}},"required":["sourceStrength"]},"then":{"properties":{"appId":{"type":"integer","minimum":1},"checkRunId":{"type":"integer","minimum":1}},"required":["appId","checkRunId"]}},{"if":{"properties":{"sourceStrength":{"const":"github_actions_workflow"}},"required":["sourceStrength"]},"then":{"properties":{"appId":{"type":"integer","minimum":1},"workflowRunId":{"type":"integer","minimum":1},"workflowRunAttempt":{"type":"integer","minimum":1},"event":{"$ref":"#/$defs/nonBlank"}},"required":["appId","workflowRunId","workflowRunAttempt","event"]}}],"properties":{"name":{"$ref":"#/$defs/nonBlank"},"status":{"enum":["queued","in_progress","completed"]},"conclusion":{"$ref":"#/$defs/nonBlank"},"testedSha":{"$ref":"#/$defs/nonBlank"},"appSlug":{"$ref":"#/$defs/nonBlank"},"appId":{"type":"integer","minimum":1},"checkRunId":{"type":"integer","minimum":1},"checkSuiteId":{"type":"integer","minimum":1},"workflowId":{"type":"integer","minimum":1},"workflowPath":{"$ref":"#/$defs/nonBlank"},"workflowRunId":{"type":"integer","minimum":1},"workflowRunAttempt":{"type":"integer","minimum":1},"event":{"$ref":"#/$defs/nonBlank"},"sourceStrength":{"enum":["github_app_expected","github_actions_workflow","unattributed"]},"retrievedAt":{"$ref":"#/$defs/timestamp"}}},"ownershipRequirement":{"type":"object","additionalProperties":false,"required":["id","owners","requiredCount"],"properties":{"id":{"$ref":"#/$defs/nonBlank"},"owners":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"requiredCount":{"type":"integer","minimum":1}}},"nativeBranchProtectionCheck":{"type":"object","additionalProperties":false,"required":["context"],"properties":{"context":{"$ref":"#/$defs/nonBlank"},"appId":{"type":"integer","minimum":1}}},"nativeBranchProtection":{"type":"object","additionalProperties":false,"required":["requiredChecks","requiredApprovals","requireCodeOwnerReviews","requireLastPushApproval","staleReviews","requiredReviewThreadResolution","bypassVisible","decisionBearing"],"properties":{"requiredChecks":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nativeBranchProtectionCheck"},"uniqueItems":true},"requiredApprovals":{"type":"integer","minimum":0},"requireCodeOwnerReviews":{"type":"boolean"},"requireLastPushApproval":{"type":"boolean"},"staleReviews":{"type":"boolean"},"requiredReviewThreadResolution":{"type":"boolean"},"bypassVisible":{"type":"boolean"},"decisionBearing":{"type":"boolean"}}},"nativeRuleset":{"type":"object","additionalProperties":false,"required":["id","name","sourceType","source","enforcement","applicable","ruleTypes","requiredChecks","requiredApprovals","requireCodeOwnerReviews","requireLastPushApproval","staleReviews","requiredReviewThreadResolution","bypassVisible","decisionBearing"],"properties":{"id":{"type":"integer","minimum":1},"name":{"$ref":"#/$defs/nonBlank"},"sourceType":{"$ref":"#/$defs/nonBlank"},"source":{"$ref":"#/$defs/nonBlank"},"enforcement":{"enum":["active","evaluate","disabled","unknown"]},"applicable":{"type":"boolean"},"ruleTypes":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"requiredChecks":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nativeBranchProtectionCheck"},"uniqueItems":true},"requiredApprovals":{"type":"integer","minimum":0},"requireCodeOwnerReviews":{"type":"boolean"},"requireLastPushApproval":{"type":"boolean"},"staleReviews":{"type":"boolean"},"requiredReviewThreadResolution":{"type":"boolean"},"bypassVisible":{"type":"boolean"},"decisionBearing":{"type":"boolean"}}},"nativeControls":{"type":"object","additionalProperties":false,"properties":{"branchProtection":{"$ref":"#/$defs/nativeBranchProtection"},"rulesets":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nativeRuleset"},"uniqueItems":true}}},"reviewabilitySnapshot":{"type":"object","additionalProperties":false,"required":["fileCount","ownershipDomains","generatedFileCount","boundaryCount"],"properties":{"fileCount":{"type":"integer","minimum":0},"ownershipDomains":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"generatedFileCount":{"type":"integer","minimum":0},"boundaryCount":{"type":"integer","minimum":0}}}}}')},3578:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://patchgate.dev/schemas/patchgate-policy/0.1","title":"PatchGate policy","type":"object","additionalProperties":false,"required":["version"],"properties":{"version":{"const":1},"issueLinkage":{"type":"object","additionalProperties":false,"required":["required"],"properties":{"required":{"type":"boolean"}}},"requiredChecks":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/requiredCheck"},"uniqueItems":true},"ownership":{"type":"object","additionalProperties":false,"required":["requireCodeOwnerApproval"],"properties":{"requireCodeOwnerApproval":{"type":"boolean"}}},"sensitivePaths":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/sensitivePathRule"},"uniqueItems":true},"policyChanges":{"$ref":"#/$defs/policyChanges"},"reviewability":{"$ref":"#/$defs/reviewability"}},"$defs":{"expectedSource":{"type":"object","additionalProperties":false,"required":["kind"],"properties":{"kind":{"enum":["github_app_expected","github_actions_workflow"]},"appSlug":{"type":"string","minLength":1,"pattern":".*\\\\S.*"},"appId":{"type":"integer","minimum":1},"workflowId":{"type":"integer","minimum":1},"workflowPath":{"type":"string","minLength":1,"pattern":".*\\\\S.*"},"event":{"type":"string","minLength":1,"pattern":".*\\\\S.*"}}},"requiredCheck":{"type":"object","additionalProperties":false,"required":["id","name","target","acceptableConclusions","expectedSource"],"properties":{"id":{"type":"string","minLength":1},"name":{"type":"string","minLength":1},"target":{"enum":["head","merge","merge_group"]},"acceptableConclusions":{"type":"array","maxItems":3000,"items":{"type":"string","minLength":1},"minItems":1,"uniqueItems":true},"expectedSource":{"$ref":"#/$defs/expectedSource"}}},"sensitivePathRule":{"type":"object","additionalProperties":false,"required":["id","patterns","requiredReviewers","requiredCount","humanGate"],"properties":{"id":{"type":"string","minLength":1},"patterns":{"type":"array","maxItems":3000,"items":{"type":"string","minLength":1},"minItems":1,"uniqueItems":true},"requiredReviewers":{"type":"array","maxItems":3000,"items":{"type":"string","minLength":1},"minItems":1,"uniqueItems":true},"requiredCount":{"type":"integer","minimum":1},"humanGate":{"type":"boolean"}}},"policyChanges":{"type":"object","additionalProperties":false,"required":["mode","paths"],"properties":{"mode":{"enum":["advisory","human_review","blocked"]},"paths":{"type":"array","maxItems":3000,"items":{"type":"string","minLength":1},"minItems":1,"uniqueItems":true}}},"reviewability":{"type":"object","additionalProperties":false,"required":["mode","budgets"],"properties":{"mode":{"enum":["advisory","blocking"]},"budgets":{"type":"object","additionalProperties":false,"properties":{"maxFiles":{"type":"integer","minimum":0},"maxOwnershipDomains":{"type":"integer","minimum":0},"maxGeneratedFiles":{"type":"integer","minimum":0},"maxBoundaries":{"type":"integer","minimum":0}}}}}}}')}};var r={};function __nccwpck_require__(e){var n=r[e];if(n!==undefined){return n.exports}var s=r[e]={exports:{}};var i=true;try{t[e].call(s.exports,s,s.exports,__nccwpck_require__);i=false}finally{if(i)delete r[e]}return s.exports}__nccwpck_require__.m=t;if(typeof __nccwpck_require__!=="undefined")__nccwpck_require__.ab=decodeURIComponent(new URL(".",import.meta.url).pathname).slice(import.meta.url.match(/^file:\/\/\/\w:/)?1:0,-1)+"/";(()=>{__nccwpck_require__.f={};__nccwpck_require__.e=e=>Promise.all(Object.keys(__nccwpck_require__.f).reduce((t,r)=>{__nccwpck_require__.f[r](e,t);return t},[]))})();(()=>{__nccwpck_require__.u=e=>""+e+".index.js"})();(()=>{__nccwpck_require__.o=(e,t)=>Object.prototype.hasOwnProperty.call(e,t)})();(()=>{var e={792:0};var installChunk=t=>{var{ids:r,modules:n,runtime:s}=t;var i,o,a=0;for(i in n){if(__nccwpck_require__.o(n,i)){__nccwpck_require__.m[i]=n[i]}}if(s)s(__nccwpck_require__);for(;a<r.length;a++){o=r[a];if(__nccwpck_require__.o(e,o)&&e[o]){e[o][0]()}e[r[a]]=0}};__nccwpck_require__.f.j=(t,r)=>{var n=__nccwpck_require__.o(e,t)?e[t]:undefined;if(n!==0){if(n){r.push(n[1])}else{if(true){var s=import("./"+__nccwpck_require__.u(t)).then(installChunk,r=>{if(e[t]!==0)e[t]=undefined;throw r});var s=Promise.race([s,new Promise(r=>n=e[t]=[r])]);r.push(n[1]=s)}}}}})();var n={};(()=>{var e=n;Object.defineProperty(e,"BJ",{value:true});e.HC=parseActionInputs;e.oV=setActionOutput;e.Jc=appendStepSummary;e._U=shouldFailAction;e.Pz=snapshotRejectionExitCode;e.dW=formatMarkdownSummary;e.Cs=runAction;e.BL=upsertCheckRun;e.Wg=upsertRejectionCheckRun;const t=__nccwpck_require__(7598);const r=__nccwpck_require__(3024);const s=__nccwpck_require__(6760);const i=__nccwpck_require__(10);const o=__nccwpck_require__(2823);const a=__nccwpck_require__(6584);const c=__nccwpck_require__(861);const u=64e3;function actionInput(e,t,r){const n=e[`INPUT_${t}`];if(n!==undefined&&n.trim().length>0)return n;return e[`INPUT_${r}`]}function parseActionInputs(e=process.env){const t=actionInput(e,"FAIL-ON","FAIL_ON")?.trim()||"blocked";const r=["never","blocked","human_review_required","evidence_missing","policy_ambiguous"];const n=r.includes(t)?t:"blocked";const s=actionInput(e,"REPORT-PATH","REPORT_PATH")?.trim()||"patchgate-receipt.json";const i=actionInput(e,"CHECK-NAME","CHECK_NAME")?.trim()||"PatchGate Review Gate";assertActionText(s,"report-path",500);assertActionText(i,"check-name",200);return{failOn:n,githubToken:actionInput(e,"GITHUB-TOKEN","GITHUB_TOKEN")?.trim()||e.GITHUB_TOKEN?.trim()||"",reportPath:s,createCheckRun:(actionInput(e,"CREATE-CHECK-RUN","CREATE_CHECK_RUN")??"true").trim().toLowerCase()==="true",checkName:i}}function assertActionText(e,t,r){if(e.length===0||e.length>r||/[\u0000-\u001F\u007F]/.test(e)){throw new Error(`PatchGate Action ${t} contains unsafe or oversized text.`)}}function setActionOutput(e,n,s=process.env){const i=s.GITHUB_OUTPUT;if(i&&(0,r.existsSync)(i)){assertActionText(e,"output name",200);const s=`patchgate_${(0,t.randomUUID)()}`;let o=s;while(n.includes(o))o=`${s}_${(0,t.randomUUID)()}`;if(n.includes("\n")||n.includes("\r")){(0,r.appendFileSync)(i,`${e}<<${o}\n${n}\n${o}\n`,"utf8")}else{assertActionText(n,`output ${e}`,1e6);(0,r.appendFileSync)(i,`${e}=${n}\n`,"utf8")}}}function appendStepSummary(e,t=process.env){const n=t.GITHUB_STEP_SUMMARY;if(n&&(0,r.existsSync)(n)){(0,r.appendFileSync)(n,`${e}\n`,"utf8")}}function markdownCell(e){return e.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g,"").replace(/[\r\n]+/g," ").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/\|/g,"&#124;").replace(/`/g,"&#96;")}function resolveReportPath(e,t){const r=(0,s.resolve)(t.GITHUB_WORKSPACE?.trim()||process.cwd());if(e.startsWith("/")||e.includes("\\"))throw new Error("PatchGate Action report-path must be a relative POSIX path inside GITHUB_WORKSPACE.");const n=(0,s.resolve)(r,e);const i=n===r?"":n.slice(r.length+1);if(i===""||i===".."||i.startsWith("../"))throw new Error("PatchGate Action report-path must stay inside GITHUB_WORKSPACE.");return n}function shouldFailAction(e,t){if(t==="never")return false;if(t===e)return true;if(t==="blocked"){return e==="blocked"||e==="evidence_missing"||e==="policy_ambiguous"}if(t==="human_review_required"){return e==="blocked"||e==="human_review_required"||e==="evidence_missing"||e==="policy_ambiguous"}return false}function snapshotRejectionExitCode(e){return shouldFailAction("evidence_missing",e)?1:0}function formatMarkdownSummary(e){const t={ready_for_review:"✅",blocked:"🛑",human_review_required:"👤",evidence_missing:"🔍",policy_ambiguous:"⚠️"};const r=t[e.final.status]??"ℹ️";const n=`### ${r} PatchGate Review Gate: \`${e.final.status.toUpperCase()}\``;const s=`**Repository:** \`${e.repository.owner}/${e.repository.name}\` PR #${e.repository.pullRequest}  \n**Target Commit:** \`${e.revisions.testedSha.slice(0,7)}\` | **Base SHA:** \`${e.revisions.baseSha.slice(0,7)}\`  \n**Policy Digest:** \`${e.policyDigest.slice(0,18)}...\`  \n**Receipt Digest:** \`${e.receiptDigest.slice(0,18)}...\``;const i=e.requirements.map(e=>{const t=e.result==="passed"?"✅ Passed":e.result==="failed"?"❌ Failed":e.result==="advisory"?"ℹ️ Advisory":"❓ Unknown";return`| \`${markdownCell(e.id)}\` | ${t} | \`${markdownCell(e.severity)}\` | ${markdownCell(e.remediation)} |`});const o=`| Requirement | Result | Severity | Remediation |\n|---|---|---|---|\n${i.join("\n")}`;let a="";if(e.humanGates.length>0){const t=e.humanGates.map(e=>{const t=e.satisfied?"✅ Satisfied":"⏳ Pending Approval";const r=e.requiredReviewers.join(", ")||"None";const n=e.approvedBy.join(", ")||"None";return`| \`${markdownCell(e.id)}\` | ${t} | ${markdownCell(r)} (need ${e.requiredCount}) | ${markdownCell(n)} | ${markdownCell(e.reason)} |`});a=`\n\n#### 👤 Human Review Boundaries\n| Gate ID | Status | Required Reviewers | Approved By | Reason |\n|---|---|---|---|---|\n${t.join("\n")}`}let c="";if(e.reviewability){const t=e.reviewability;c=`\n\n#### 📊 Reviewability Signals\n- **Changed Files:** \`${t.fileCount}\`\n- **Generated Files:** \`${t.generatedFileCount}\`\n- **Ownership Domains:** \`${t.ownershipDomains.join(", ")||"none"}\` (\`${t.boundaryCount}\` boundaries)`}const d=`\n\n<details>\n<summary>🔐 <b>Audit & Provenance Metadata</b></summary>\n\n- **Evaluator Version:** \`${e.evaluatorVersion}\`\n- **Schema Version:** \`${e.schemaVersion}\`\n- **Evaluated At:** \`${e.evaluatedAt}\`\n- **Decision Input Digest:** \`${e.decisionInputDigest}\`\n- **Receipt Digest:** \`${e.receiptDigest}\`\n- **Policy Sources:** ${e.policySources.map(e=>`\`${e.kind}:${e.identity}@${e.revision.slice(0,7)}\``).join(", ")||"none"}\n\n</details>`;const l=`${n}\n\n${s}\n\n${o}${a}${c}${d}\n`;return l.length<=u?l:`${l.slice(0,u-120)}\n\n> Summary truncated to keep GitHub Action output bounded. The full receipt remains at the configured report path.\n`}async function runAction(e=process.env){const t=parseActionInputs(e);const n=e.GITHUB_EVENT_PATH;if(!n||!(0,r.existsSync)(n)){console.error("PatchGate Action: GITHUB_EVENT_PATH is missing or does not exist.");return 2}let o;try{o=JSON.parse((0,r.readFileSync)(n,"utf8"))}catch(e){console.error("PatchGate Action: Failed to parse GITHUB_EVENT_PATH payload as JSON.",e);return 2}const u=e.GITHUB_EVENT_NAME||"pull_request";if(u==="merge_group"){const r="PatchGate does not yet support authenticated merge-group membership in the current scalar contract.";setActionOutput("status","evidence_missing",e);appendStepSummary(`### ⚠️ PatchGate Unsupported Target\n\n**Event:** \`merge_group\`  \n**Status:** \`evidence_missing\`  \n**Remediation:** Use a pull_request head/merge target or extend the versioned merge-group contract before enforcing this event.\n`,e);console.warn(`PatchGate Action: ${r}`);return shouldFailAction("evidence_missing",t.failOn)?1:0}if(u!=="pull_request"&&u!=="pull_request_target"){console.log(`PatchGate Action: Skipping execution for unsupported event '${u}'. Only pull_request events are evaluated.`);return 0}const l=o.pull_request?.number;const p=o.repository?.owner?.login||o.repository?.owner?.name;const f=o.repository?.name;if(l===undefined||p===undefined||f===undefined){console.error("PatchGate Action: Pull request number or repository identity is missing from event payload.");return 2}if(!t.githubToken){console.error("PatchGate Action: GitHub token is missing. Provide github-token input or GITHUB_TOKEN environment variable.");return 2}const h=(0,a.createFetchTransport)({token:t.githubToken,userAgent:"patchgate-action/0.1.0"});const m=new a.GitHubClient(h,undefined,{token:t.githubToken});const g={owner:p,name:f,pullNumber:l,eventKind:"pull_request",targetKind:"head"};console.log(`PatchGate Action: Building snapshot for ${p}/${f}#${l}...`);const v=await(0,c.buildGitHubSnapshot)(g,m);if(v.kind==="rejected"){const r=v.diagnostic;console.error(`PatchGate Action: Snapshot rejected — [${r.id}] ${r.message}`);if(r.remediation){console.error(`Remediation: ${r.remediation}`)}const n=`### ❌ PatchGate Snapshot Rejected\n\n**Diagnostic:** \`${r.id}\`  \n**Message:** ${r.message}  \n**Remediation:** ${r.remediation??"None"}\n`;setActionOutput("status","evidence_missing",e);setActionOutput("summary-markdown",n,e);appendStepSummary(n,e);if(t.createCheckRun&&t.githubToken){const e=o.pull_request?.head?.sha;if(e===undefined){console.warn("PatchGate Action: Event payload has no pull-request head SHA; rejection check-run was not posted.")}else{await upsertRejectionCheckRun({owner:p,name:f,headSha:e,checkName:t.checkName,diagnostic:{id:r.id,message:r.message,remediation:r.remediation},summaryMarkdown:n,token:t.githubToken})}}return snapshotRejectionExitCode(t.failOn)}const y=(new Date).toISOString();const b=(0,i.evaluateContribution)(v.input,y);let w;try{w=resolveReportPath(t.reportPath,e)}catch(e){console.error(`PatchGate Action: ${e instanceof Error?e.message:String(e)}`);return 2}try{(0,r.mkdirSync)((0,s.dirname)(w),{recursive:true});(0,r.writeFileSync)(w,JSON.stringify(b,null,2),"utf8");console.log(`PatchGate Action: ContributionReceipt written to ${w}`)}catch(e){console.warn(`PatchGate Action: Could not write receipt report file: ${e instanceof Error?e.message:String(e)}`)}const $=formatMarkdownSummary(b);setActionOutput("status",b.final.status,e);setActionOutput("receipt-path",w,e);setActionOutput("decision-input-digest",b.decisionInputDigest,e);setActionOutput("receipt-digest",b.receiptDigest,e);setActionOutput("summary-markdown",$,e);appendStepSummary($,e);console.log(`\n========================================`);console.log(`PatchGate Evaluation Result: ${b.final.status.toUpperCase()}`);console.log(`Decision Input Digest: ${b.decisionInputDigest}`);console.log(`Receipt Digest:        ${b.receiptDigest}`);console.log(`========================================\n`);if(t.createCheckRun&&t.githubToken){await d({owner:p,name:f,headSha:b.revisions.testedSha,checkName:t.checkName,status:b.final.status,receipt:b,summaryMarkdown:$,token:t.githubToken})}if(shouldFailAction(b.final.status,t.failOn)){console.error(`PatchGate Action: Evaluation result '${b.final.status}' triggered fail-on policy '${t.failOn}'.`);return 1}console.log(`PatchGate Action: Evaluation passed review-readiness gate.`);return 0}async function deliverCheckRun(e,t,r=fetch){try{const n=`https://api.github.com/repos/${encodeURIComponent(e.owner)}/${encodeURIComponent(e.name)}`;const s=`${n}/commits/${encodeURIComponent(e.headSha)}/check-runs?check_name=${encodeURIComponent(t.name)}&filter=latest&per_page=100`;const i=await r(s,{method:"GET",redirect:"error",headers:{Authorization:`Bearer ${e.token}`,Accept:o.GITHUB_ACCEPT,"X-GitHub-Api-Version":o.GITHUB_API_VERSION,"User-Agent":"patchgate-action/0.1.0"}});if(!i.ok){console.warn(`PatchGate Action: Notice — Could not look up an existing check-run (HTTP ${i.status}); no check-run write was attempted.`);return}const a=await i.json();const c=Array.isArray(a.check_runs)?a.check_runs.filter(r=>r.id!==undefined&&r.name===t.name&&r.head_sha===e.headSha).sort((e,t)=>(t.id??0)-(e.id??0))[0]:undefined;const u=c?.id===undefined?`${n}/check-runs`:`${n}/check-runs/${c.id}`;const d=await r(u,{method:c?.id===undefined?"POST":"PATCH",redirect:"error",headers:{Authorization:`Bearer ${e.token}`,Accept:o.GITHUB_ACCEPT,"X-GitHub-Api-Version":o.GITHUB_API_VERSION,"User-Agent":"patchgate-action/0.1.0","Content-Type":"application/json"},body:JSON.stringify(t)});if(!d.ok){console.warn(`PatchGate Action: Notice — Could not post check-run (HTTP ${d.status}). Verify that 'checks: write' permission is granted.`)}else{console.log(`PatchGate Action: Check run '${t.name}' successfully ${c?.id===undefined?"created":"updated"} with conclusion '${t.conclusion}'.`)}}catch(e){console.warn(`PatchGate Action: Check run posting skipped (${e instanceof Error?e.message:String(e)}).`)}}async function upsertCheckRun(e,t=fetch){const r={ready_for_review:"success",blocked:"failure",human_review_required:"action_required",evidence_missing:"neutral",policy_ambiguous:"neutral"};const n={name:e.checkName,head_sha:e.headSha,status:"completed",conclusion:r[e.status],completed_at:(new Date).toISOString(),output:{title:`PatchGate: ${e.status.toUpperCase().replace(/_/g," ")}`,summary:e.summaryMarkdown,text:`Receipt Digest: \`${e.receipt.receiptDigest}\`\nDecision Input Digest: \`${e.receipt.decisionInputDigest}\`\nEvaluated At: ${e.receipt.evaluatedAt}`}};await deliverCheckRun(e,n,t)}async function upsertRejectionCheckRun(e,t=fetch){const r={name:e.checkName,head_sha:e.headSha,status:"completed",conclusion:"neutral",completed_at:(new Date).toISOString(),output:{title:"PatchGate: SNAPSHOT REJECTED",summary:e.summaryMarkdown,text:`Diagnostic: ${e.diagnostic.id}\nRemediation: ${e.diagnostic.remediation??"None"}`}};await deliverCheckRun(e,r,t)}const d=upsertCheckRun;function isDirectActionEntrypoint(){const e=process.argv[1];return e!==undefined&&/[\\/]dist[\\/]action[\\/]index\.js$/.test(e)}if(process.env.GITHUB_ACTIONS==="true"&&isDirectActionEntrypoint()){runAction().then(e=>{if(e!==0)process.exit(e)}).catch(e=>{console.error("PatchGate Action: Unhandled error in action runner:",e);process.exit(2)})}})();var s=n.BJ;var i=n.Jc;var o=n.dW;var a=n.HC;var c=n.Cs;var u=n.oV;var d=n._U;var l=n.Pz;var p=n.BL;var f=n.Wg;export{s as __esModule,i as appendStepSummary,o as formatMarkdownSummary,a as parseActionInputs,c as runAction,u as setActionOutput,d as shouldFailAction,l as snapshotRejectionExitCode,p as upsertCheckRun,f as upsertRejectionCheckRun};
\ No newline at end of file
+    deps: ${r}}`};const o={keyword:"dependencies",type:"object",schemaType:"object",error:t.error,code(e){const[t,r]=splitDependencies(e);validatePropertyDeps(e,t);validateSchemaDeps(e,r)}};function splitDependencies({schema:e}){const t={};const r={};for(const n in e){if(n==="__proto__")continue;const s=Array.isArray(e[n])?t:r;s[n]=e[n]}return[t,r]}function validatePropertyDeps(e,t=e.schema){const{gen:r,data:s,it:o}=e;if(Object.keys(t).length===0)return;const a=r.let("missing");for(const c in t){const u=t[c];if(u.length===0)continue;const d=(0,i.propertyInData)(r,s,c,o.opts.ownProperties);e.setParams({property:c,depsCount:u.length,deps:u.join(", ")});if(o.allErrors){r.if(d,()=>{for(const t of u){(0,i.checkReportMissingProp)(e,t)}})}else{r.if((0,n._)`${d} && (${(0,i.checkMissingProp)(e,u,a)})`);(0,i.reportMissingProp)(e,a);r.else()}}}t.validatePropertyDeps=validatePropertyDeps;function validateSchemaDeps(e,t=e.schema){const{gen:r,data:n,keyword:o,it:a}=e;const c=r.name("valid");for(const u in t){if((0,s.alwaysValidSchema)(a,t[u]))continue;r.if((0,i.propertyInData)(r,n,u,a.opts.ownProperties),()=>{const t=e.subschema({keyword:o,schemaProp:u},c);e.mergeValidEvaluated(t,c)},()=>r.var(c,true));e.ok(c)}}t.validateSchemaDeps=validateSchemaDeps;t["default"]=o},3818:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(5826);const s={keyword:"dependentSchemas",type:"object",schemaType:"object",code:e=>(0,n.validateSchemaDeps)(e)};t["default"]=s},8584:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:({params:e})=>(0,n.str)`must match "${e.ifClause}" schema`,params:({params:e})=>(0,n._)`{failingKeyword: ${e.ifClause}}`};const o={keyword:"if",schemaType:["object","boolean"],trackErrors:true,error:i,code(e){const{gen:t,parentSchema:r,it:i}=e;if(r.then===undefined&&r.else===undefined){(0,s.checkStrictMode)(i,'"if" without "then" and "else" is ignored')}const o=hasSchema(i,"then");const a=hasSchema(i,"else");if(!o&&!a)return;const c=t.let("valid",true);const u=t.name("_valid");validateIf();e.reset();if(o&&a){const r=t.let("ifClause");e.setParams({ifClause:r});t.if(u,validateClause("then",r),validateClause("else",r))}else if(o){t.if(u,validateClause("then"))}else{t.if((0,n.not)(u),validateClause("else"))}e.pass(c,()=>e.error(true));function validateIf(){const t=e.subschema({keyword:"if",compositeRule:true,createErrors:false,allErrors:false},u);e.mergeEvaluated(t)}function validateClause(r,s){return()=>{const i=e.subschema({keyword:r},u);t.assign(c,u);e.mergeValidEvaluated(i,c);if(s)t.assign(s,(0,n._)`${r}`);else e.setParams({ifClause:r})}}}};function hasSchema(e,t){const r=e.schema[t];return r!==undefined&&!(0,s.alwaysValidSchema)(e,r)}t["default"]=o},8775:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(3448);const s=r(6467);const i=r(5791);const o=r(2959);const a=r(6182);const c=r(5826);const u=r(1372);const d=r(2431);const l=r(8778);const p=r(664);const f=r(8350);const h=r(9380);const m=r(2490);const g=r(9205);const v=r(8584);const y=r(6829);function getApplicator(e=false){const t=[f.default,h.default,m.default,g.default,v.default,y.default,u.default,d.default,c.default,l.default,p.default];if(e)t.push(s.default,o.default);else t.push(n.default,i.default);t.push(a.default);return t}t["default"]=getApplicator},5791:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.validateTuple=void 0;const n=r(1436);const s=r(4464);const i=r(8484);const o={keyword:"items",type:"array",schemaType:["object","array","boolean"],before:"uniqueItems",code(e){const{schema:t,it:r}=e;if(Array.isArray(t))return validateTuple(e,"additionalItems",t);r.items=true;if((0,s.alwaysValidSchema)(r,t))return;e.ok((0,i.validateArray)(e))}};function validateTuple(e,t,r=e.schema){const{gen:i,parentSchema:o,data:a,keyword:c,it:u}=e;checkStrictTuple(o);if(u.opts.unevaluated&&r.length&&u.items!==true){u.items=s.mergeEvaluated.items(i,r.length,u.items)}const d=i.name("valid");const l=i.const("len",(0,n._)`${a}.length`);r.forEach((t,r)=>{if((0,s.alwaysValidSchema)(u,t))return;i.if((0,n._)`${l} > ${r}`,()=>e.subschema({keyword:c,schemaProp:r,dataProp:r},d));e.ok(d)});function checkStrictTuple(e){const{opts:n,errSchemaPath:i}=u;const o=r.length;const a=o===e.minItems&&(o===e.maxItems||e[t]===false);if(n.strictTuples&&!a){const e=`"${c}" is ${o}-tuple, but minItems or maxItems/${t} are not specified or different at path "${i}"`;(0,s.checkStrictMode)(u,e,n.strictTuples)}}}t.validateTuple=validateTuple;t["default"]=o},2959:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(8484);const o=r(3448);const a={message:({params:{len:e}})=>(0,n.str)`must NOT have more than ${e} items`,params:({params:{len:e}})=>(0,n._)`{limit: ${e}}`};const c={keyword:"items",type:"array",schemaType:["object","boolean"],before:"uniqueItems",error:a,code(e){const{schema:t,parentSchema:r,it:n}=e;const{prefixItems:a}=r;n.items=true;if((0,s.alwaysValidSchema)(n,t))return;if(a)(0,o.validateAdditionalItems)(e,a);else e.ok((0,i.validateArray)(e))}};t["default"]=c},8350:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(4464);const s={keyword:"not",schemaType:["object","boolean"],trackErrors:true,code(e){const{gen:t,schema:r,it:s}=e;if((0,n.alwaysValidSchema)(s,r)){e.fail();return}const i=t.name("valid");e.subschema({keyword:"not",compositeRule:true,createErrors:false,allErrors:false},i);e.failResult(i,()=>e.reset(),()=>e.error())},error:{message:"must NOT be valid"}};t["default"]=s},2490:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:"must match exactly one schema in oneOf",params:({params:e})=>(0,n._)`{passingSchemas: ${e.passing}}`};const o={keyword:"oneOf",schemaType:"array",trackErrors:true,error:i,code(e){const{gen:t,schema:r,parentSchema:i,it:o}=e;if(!Array.isArray(r))throw new Error("ajv implementation error");if(o.opts.discriminator&&i.discriminator)return;const a=r;const c=t.let("valid",false);const u=t.let("passing",null);const d=t.name("_valid");e.setParams({passing:u});t.block(validateOneOf);e.result(c,()=>e.reset(),()=>e.error(true));function validateOneOf(){a.forEach((r,i)=>{let a;if((0,s.alwaysValidSchema)(o,r)){t.var(d,true)}else{a=e.subschema({keyword:"oneOf",schemaProp:i,compositeRule:true},d)}if(i>0){t.if((0,n._)`${d} && ${c}`).assign(c,false).assign(u,(0,n._)`[${u}, ${i}]`).else()}t.if(d,()=>{t.assign(c,true);t.assign(u,i);if(a)e.mergeEvaluated(a,n.Name)})})}}};t["default"]=o},664:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8484);const s=r(1436);const i=r(4464);const o=r(4464);const a={keyword:"patternProperties",type:"object",schemaType:"object",code(e){const{gen:t,schema:r,data:a,parentSchema:c,it:u}=e;const{opts:d}=u;const l=(0,n.allSchemaProperties)(r);const p=l.filter(e=>(0,i.alwaysValidSchema)(u,r[e]));if(l.length===0||p.length===l.length&&(!u.opts.unevaluated||u.props===true)){return}const f=d.strictSchema&&!d.allowMatchingProperties&&c.properties;const h=t.name("valid");if(u.props!==true&&!(u.props instanceof s.Name)){u.props=(0,o.evaluatedPropsToName)(t,u.props)}const{props:m}=u;validatePatternProperties();function validatePatternProperties(){for(const e of l){if(f)checkMatchingProperties(e);if(u.allErrors){validateProperties(e)}else{t.var(h,true);validateProperties(e);t.if(h)}}}function checkMatchingProperties(e){for(const t in f){if(new RegExp(e).test(t)){(0,i.checkStrictMode)(u,`property ${t} matches pattern ${e} (use allowMatchingProperties)`)}}}function validateProperties(r){t.forIn("key",a,i=>{t.if((0,s._)`${(0,n.usePattern)(e,r)}.test(${i})`,()=>{const n=p.includes(r);if(!n){e.subschema({keyword:"patternProperties",schemaProp:r,dataProp:i,dataPropType:o.Type.Str},h)}if(u.opts.unevaluated&&m!==true){t.assign((0,s._)`${m}[${i}]`,true)}else if(!n&&!u.allErrors){t.if((0,s.not)(h),()=>t.break())}})})}}};t["default"]=a},6467:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(5791);const s={keyword:"prefixItems",type:"array",schemaType:["array"],before:"uniqueItems",code:e=>(0,n.validateTuple)(e,"items")};t["default"]=s},8778:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(7881);const s=r(8484);const i=r(4464);const o=r(2431);const a={keyword:"properties",type:"object",schemaType:"object",code(e){const{gen:t,schema:r,parentSchema:a,data:c,it:u}=e;if(u.opts.removeAdditional==="all"&&a.additionalProperties===undefined){o.default.code(new n.KeywordCxt(u,o.default,"additionalProperties"))}const d=(0,s.allSchemaProperties)(r);for(const e of d){u.definedProperties.add(e)}if(u.opts.unevaluated&&d.length&&u.props!==true){u.props=i.mergeEvaluated.props(t,(0,i.toHash)(d),u.props)}const l=d.filter(e=>!(0,i.alwaysValidSchema)(u,r[e]));if(l.length===0)return;const p=t.name("valid");for(const r of l){if(hasDefault(r)){applyPropertySchema(r)}else{t.if((0,s.propertyInData)(t,c,r,u.opts.ownProperties));applyPropertySchema(r);if(!u.allErrors)t.else().var(p,true);t.endIf()}e.it.definedProperties.add(r);e.ok(p)}function hasDefault(e){return u.opts.useDefaults&&!u.compositeRule&&r[e].default!==undefined}function applyPropertySchema(t){e.subschema({keyword:"properties",schemaProp:t,dataProp:t},p)}}};t["default"]=a},1372:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:"property name must be valid",params:({params:e})=>(0,n._)`{propertyName: ${e.propertyName}}`};const o={keyword:"propertyNames",type:"object",schemaType:["object","boolean"],error:i,code(e){const{gen:t,schema:r,data:i,it:o}=e;if((0,s.alwaysValidSchema)(o,r))return;const a=t.name("valid");t.forIn("key",i,r=>{e.setParams({propertyName:r});e.subschema({keyword:"propertyNames",data:r,dataTypes:["string"],propertyName:r,compositeRule:true},a);t.if((0,n.not)(a),()=>{e.error(true);if(!o.allErrors)t.break()})});e.ok(a)}};t["default"]=o},6829:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(4464);const s={keyword:["then","else"],schemaType:["object","boolean"],code({keyword:e,parentSchema:t,it:r}){if(t.if===undefined)(0,n.checkStrictMode)(r,`"${e}" without "if" is ignored`)}};t["default"]=s},8484:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.validateUnion=t.validateArray=t.usePattern=t.callValidateCode=t.schemaProperties=t.allSchemaProperties=t.noPropertyInData=t.propertyInData=t.isOwnProperty=t.hasPropFunc=t.reportMissingProp=t.checkMissingProp=t.checkReportMissingProp=void 0;const n=r(1436);const s=r(4464);const i=r(630);const o=r(4464);function checkReportMissingProp(e,t){const{gen:r,data:s,it:i}=e;r.if(noPropertyInData(r,s,t,i.opts.ownProperties),()=>{e.setParams({missingProperty:(0,n._)`${t}`},true);e.error()})}t.checkReportMissingProp=checkReportMissingProp;function checkMissingProp({gen:e,data:t,it:{opts:r}},s,i){return(0,n.or)(...s.map(s=>(0,n.and)(noPropertyInData(e,t,s,r.ownProperties),(0,n._)`${i} = ${s}`)))}t.checkMissingProp=checkMissingProp;function reportMissingProp(e,t){e.setParams({missingProperty:t},true);e.error()}t.reportMissingProp=reportMissingProp;function hasPropFunc(e){return e.scopeValue("func",{ref:Object.prototype.hasOwnProperty,code:(0,n._)`Object.prototype.hasOwnProperty`})}t.hasPropFunc=hasPropFunc;function isOwnProperty(e,t,r){return(0,n._)`${hasPropFunc(e)}.call(${t}, ${r})`}t.isOwnProperty=isOwnProperty;function propertyInData(e,t,r,s){const i=(0,n._)`${t}${(0,n.getProperty)(r)} !== undefined`;return s?(0,n._)`${i} && ${isOwnProperty(e,t,r)}`:i}t.propertyInData=propertyInData;function noPropertyInData(e,t,r,s){const i=(0,n._)`${t}${(0,n.getProperty)(r)} === undefined`;return s?(0,n.or)(i,(0,n.not)(isOwnProperty(e,t,r))):i}t.noPropertyInData=noPropertyInData;function allSchemaProperties(e){return e?Object.keys(e).filter(e=>e!=="__proto__"):[]}t.allSchemaProperties=allSchemaProperties;function schemaProperties(e,t){return allSchemaProperties(t).filter(r=>!(0,s.alwaysValidSchema)(e,t[r]))}t.schemaProperties=schemaProperties;function callValidateCode({schemaCode:e,data:t,it:{gen:r,topSchemaRef:s,schemaPath:o,errorPath:a},it:c},u,d,l){const p=l?(0,n._)`${e}, ${t}, ${s}${o}`:t;const f=[[i.default.instancePath,(0,n.strConcat)(i.default.instancePath,a)],[i.default.parentData,c.parentData],[i.default.parentDataProperty,c.parentDataProperty],[i.default.rootData,i.default.rootData]];if(c.opts.dynamicRef)f.push([i.default.dynamicAnchors,i.default.dynamicAnchors]);const h=(0,n._)`${p}, ${r.object(...f)}`;return d!==n.nil?(0,n._)`${u}.call(${d}, ${h})`:(0,n._)`${u}(${h})`}t.callValidateCode=callValidateCode;const a=(0,n._)`new RegExp`;function usePattern({gen:e,it:{opts:t}},r){const s=t.unicodeRegExp?"u":"";const{regExp:i}=t.code;const c=i(r,s);return e.scopeValue("pattern",{key:c.toString(),ref:c,code:(0,n._)`${i.code==="new RegExp"?a:(0,o.useFunc)(e,i)}(${r}, ${s})`})}t.usePattern=usePattern;function validateArray(e){const{gen:t,data:r,keyword:i,it:o}=e;const a=t.name("valid");if(o.allErrors){const e=t.let("valid",true);validateItems(()=>t.assign(e,false));return e}t.var(a,true);validateItems(()=>t.break());return a;function validateItems(o){const c=t.const("len",(0,n._)`${r}.length`);t.forRange("i",0,c,r=>{e.subschema({keyword:i,dataProp:r,dataPropType:s.Type.Num},a);t.if((0,n.not)(a),o)})}}t.validateArray=validateArray;function validateUnion(e){const{gen:t,schema:r,keyword:i,it:o}=e;if(!Array.isArray(r))throw new Error("ajv implementation error");const a=r.some(e=>(0,s.alwaysValidSchema)(o,e));if(a&&!o.opts.unevaluated)return;const c=t.let("valid",false);const u=t.name("_valid");t.block(()=>r.forEach((r,s)=>{const o=e.subschema({keyword:i,schemaProp:s,compositeRule:true},u);t.assign(c,(0,n._)`${c} || ${u}`);const a=e.mergeValidEvaluated(o,u);if(!a)t.if((0,n.not)(c))}));e.result(c,()=>e.reset(),()=>e.error(true))}t.validateUnion=validateUnion},9872:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});const r={keyword:"id",code(){throw new Error('NOT SUPPORTED: keyword "id", use "$id" for schema ID')}};t["default"]=r},7397:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(9872);const s=r(2996);const i=["$schema","$id","$defs","$vocabulary",{keyword:"$comment"},"definitions",n.default,s.default];t["default"]=i},2996:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.callRef=t.getValidate=void 0;const n=r(3162);const s=r(8484);const i=r(1436);const o=r(630);const a=r(2718);const c=r(4464);const u={keyword:"$ref",schemaType:"string",code(e){const{gen:t,schema:r,it:s}=e;const{baseId:o,schemaEnv:c,validateName:u,opts:d,self:l}=s;const{root:p}=c;if((r==="#"||r==="#/")&&o===p.baseId)return callRootRef();const f=a.resolveRef.call(l,p,o,r);if(f===undefined)throw new n.default(s.opts.uriResolver,o,r);if(f instanceof a.SchemaEnv)return callValidate(f);return inlineRefSchema(f);function callRootRef(){if(c===p)return callRef(e,u,c,c.$async);const r=t.scopeValue("root",{ref:p});return callRef(e,(0,i._)`${r}.validate`,p,p.$async)}function callValidate(t){const r=getValidate(e,t);callRef(e,r,t,t.$async)}function inlineRefSchema(n){const s=t.scopeValue("schema",d.code.source===true?{ref:n,code:(0,i.stringify)(n)}:{ref:n});const o=t.name("valid");const a=e.subschema({schema:n,dataTypes:[],schemaPath:i.nil,topSchemaRef:s,errSchemaPath:r},o);e.mergeEvaluated(a);e.ok(o)}}};function getValidate(e,t){const{gen:r}=e;return t.validate?r.scopeValue("validate",{ref:t.validate}):(0,i._)`${r.scopeValue("wrapper",{ref:t})}.validate`}t.getValidate=getValidate;function callRef(e,t,r,n){const{gen:a,it:u}=e;const{allErrors:d,schemaEnv:l,opts:p}=u;const f=p.passContext?o.default.this:i.nil;if(n)callAsyncRef();else callSyncRef();function callAsyncRef(){if(!l.$async)throw new Error("async schema referenced by sync schema");const r=a.let("valid");a.try(()=>{a.code((0,i._)`await ${(0,s.callValidateCode)(e,t,f)}`);addEvaluatedFrom(t);if(!d)a.assign(r,true)},e=>{a.if((0,i._)`!(${e} instanceof ${u.ValidationError})`,()=>a.throw(e));addErrorsFrom(e);if(!d)a.assign(r,false)});e.ok(r)}function callSyncRef(){e.result((0,s.callValidateCode)(e,t,f),()=>addEvaluatedFrom(t),()=>addErrorsFrom(t))}function addErrorsFrom(e){const t=(0,i._)`${e}.errors`;a.assign(o.default.vErrors,(0,i._)`${o.default.vErrors} === null ? ${t} : ${o.default.vErrors}.concat(${t})`);a.assign(o.default.errors,(0,i._)`${o.default.vErrors}.length`)}function addEvaluatedFrom(e){var t;if(!u.opts.unevaluated)return;const n=(t=r===null||r===void 0?void 0:r.validate)===null||t===void 0?void 0:t.evaluated;if(u.props!==true){if(n&&!n.dynamicProps){if(n.props!==undefined){u.props=c.mergeEvaluated.props(a,n.props,u.props)}}else{const t=a.var("props",(0,i._)`${e}.evaluated.props`);u.props=c.mergeEvaluated.props(a,t,u.props,i.Name)}}if(u.items!==true){if(n&&!n.dynamicItems){if(n.items!==undefined){u.items=c.mergeEvaluated.items(a,n.items,u.items)}}else{const t=a.var("items",(0,i._)`${e}.evaluated.items`);u.items=c.mergeEvaluated.items(a,t,u.items,i.Name)}}}}t.callRef=callRef;t["default"]=u},8886:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(7115);const i=r(2718);const o=r(3162);const a=r(4464);const c={message:({params:{discrError:e,tagName:t}})=>e===s.DiscrError.Tag?`tag "${t}" must be string`:`value of tag "${t}" must be in oneOf`,params:({params:{discrError:e,tag:t,tagName:r}})=>(0,n._)`{error: ${e}, tag: ${r}, tagValue: ${t}}`};const u={keyword:"discriminator",type:"object",schemaType:"object",error:c,code(e){const{gen:t,data:r,schema:c,parentSchema:u,it:d}=e;const{oneOf:l}=u;if(!d.opts.discriminator){throw new Error("discriminator: requires discriminator option")}const p=c.propertyName;if(typeof p!="string")throw new Error("discriminator: requires propertyName");if(c.mapping)throw new Error("discriminator: mapping is not supported");if(!l)throw new Error("discriminator: requires oneOf keyword");const f=t.let("valid",false);const h=t.const("tag",(0,n._)`${r}${(0,n.getProperty)(p)}`);t.if((0,n._)`typeof ${h} == "string"`,()=>validateMapping(),()=>e.error(false,{discrError:s.DiscrError.Tag,tag:h,tagName:p}));e.ok(f);function validateMapping(){const r=getMapping();t.if(false);for(const e in r){t.elseIf((0,n._)`${h} === ${e}`);t.assign(f,applyTagSchema(r[e]))}t.else();e.error(false,{discrError:s.DiscrError.Mapping,tag:h,tagName:p});t.endIf()}function applyTagSchema(r){const s=t.name("valid");const i=e.subschema({keyword:"oneOf",schemaProp:r},s);e.mergeEvaluated(i,n.Name);return s}function getMapping(){var e;const t={};const r=hasRequired(u);let n=true;for(let t=0;t<l.length;t++){let s=l[t];if((s===null||s===void 0?void 0:s.$ref)&&!(0,a.schemaHasRulesButRef)(s,d.self.RULES)){const e=s.$ref;s=i.resolveRef.call(d.self,d.schemaEnv.root,d.baseId,e);if(s instanceof i.SchemaEnv)s=s.schema;if(s===undefined)throw new o.default(d.opts.uriResolver,d.baseId,e)}const c=(e=s===null||s===void 0?void 0:s.properties)===null||e===void 0?void 0:e[p];if(typeof c!="object"){throw new Error(`discriminator: oneOf subschemas (or referenced schemas) must have "properties/${p}"`)}n=n&&(r||hasRequired(s));addMappings(c,t)}if(!n)throw new Error(`discriminator: "${p}" must be required`);return t;function hasRequired({required:e}){return Array.isArray(e)&&e.includes(p)}function addMappings(e,t){if(e.const){addMapping(e.const,t)}else if(e.enum){for(const r of e.enum){addMapping(r,t)}}else{throw new Error(`discriminator: "properties/${p}" must have "const" or "enum"`)}}function addMapping(e,r){if(typeof e!="string"||e in t){throw new Error(`discriminator: "${p}" values must be unique strings`)}t[e]=r}}}};t["default"]=u},7115:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.DiscrError=void 0;var r;(function(e){e["Tag"]="tag";e["Mapping"]="mapping"})(r||(t.DiscrError=r={}))},4298:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(7397);const s=r(5481);const i=r(8775);const o=r(9923);const a=r(7844);const c=r(2010);const u=r(2601);const d=r(6620);const l=[o.default,n.default,s.default,(0,i.default)(true),u.default,d.metadataVocabulary,d.contentVocabulary,a.default,c.default];t["default"]=l},8639:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.dynamicAnchor=void 0;const n=r(1436);const s=r(630);const i=r(2718);const o=r(2996);const a={keyword:"$dynamicAnchor",schemaType:"string",code:e=>dynamicAnchor(e,e.schema)};function dynamicAnchor(e,t){const{gen:r,it:i}=e;i.schemaEnv.root.dynamicAnchors[t]=true;const o=(0,n._)`${s.default.dynamicAnchors}${(0,n.getProperty)(t)}`;const a=i.errSchemaPath==="#"?i.validateName:_getValidate(e);r.if((0,n._)`!${o}`,()=>r.assign(o,a))}t.dynamicAnchor=dynamicAnchor;function _getValidate(e){const{schemaEnv:t,schema:r,self:n}=e.it;const{root:s,baseId:a,localRefs:c,meta:u}=t.root;const{schemaId:d}=n.opts;const l=new i.SchemaEnv({schema:r,schemaId:d,root:s,baseId:a,localRefs:c,meta:u});i.compileSchema.call(n,l);return(0,o.getValidate)(e,l)}t["default"]=a},5065:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.dynamicRef=void 0;const n=r(1436);const s=r(630);const i=r(2996);const o={keyword:"$dynamicRef",schemaType:"string",code:e=>dynamicRef(e,e.schema)};function dynamicRef(e,t){const{gen:r,keyword:o,it:a}=e;if(t[0]!=="#")throw new Error(`"${o}" only supports hash fragment reference`);const c=t.slice(1);if(a.allErrors){_dynamicRef()}else{const t=r.let("valid",false);_dynamicRef(t);e.ok(t)}function _dynamicRef(e){if(a.schemaEnv.root.dynamicAnchors[c]){const t=r.let("_v",(0,n._)`${s.default.dynamicAnchors}${(0,n.getProperty)(c)}`);r.if(t,_callRef(t,e),_callRef(a.validateName,e))}else{_callRef(a.validateName,e)()}}function _callRef(t,n){return n?()=>r.block(()=>{(0,i.callRef)(e,t);r.let(n,true)}):()=>(0,i.callRef)(e,t)}}t.dynamicRef=dynamicRef;t["default"]=o},9923:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8639);const s=r(5065);const i=r(9982);const o=r(1794);const a=[n.default,s.default,i.default,o.default];t["default"]=a},9982:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8639);const s=r(4464);const i={keyword:"$recursiveAnchor",schemaType:"boolean",code(e){if(e.schema)(0,n.dynamicAnchor)(e,"");else(0,s.checkStrictMode)(e.it,"$recursiveAnchor: false is ignored")}};t["default"]=i},1794:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(5065);const s={keyword:"$recursiveRef",schemaType:"string",code:e=>(0,n.dynamicRef)(e,e.schema)};t["default"]=s},6402:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s={message:({schemaCode:e})=>(0,n.str)`must match format "${e}"`,params:({schemaCode:e})=>(0,n._)`{format: ${e}}`};const i={keyword:"format",type:["number","string"],schemaType:"string",$data:true,error:s,code(e,t){const{gen:r,data:s,$data:i,schema:o,schemaCode:a,it:c}=e;const{opts:u,errSchemaPath:d,schemaEnv:l,self:p}=c;if(!u.validateFormats)return;if(i)validate$DataFormat();else validateFormat();function validate$DataFormat(){const i=r.scopeValue("formats",{ref:p.formats,code:u.code.formats});const o=r.const("fDef",(0,n._)`${i}[${a}]`);const c=r.let("fType");const d=r.let("format");r.if((0,n._)`typeof ${o} == "object" && !(${o} instanceof RegExp)`,()=>r.assign(c,(0,n._)`${o}.type || "string"`).assign(d,(0,n._)`${o}.validate`),()=>r.assign(c,(0,n._)`"string"`).assign(d,o));e.fail$data((0,n.or)(unknownFmt(),invalidFmt()));function unknownFmt(){if(u.strictSchema===false)return n.nil;return(0,n._)`${a} && !${d}`}function invalidFmt(){const e=l.$async?(0,n._)`(${o}.async ? await ${d}(${s}) : ${d}(${s}))`:(0,n._)`${d}(${s})`;const r=(0,n._)`(typeof ${d} == "function" ? ${e} : ${d}.test(${s}))`;return(0,n._)`${d} && ${d} !== true && ${c} === ${t} && !${r}`}}function validateFormat(){const i=p.formats[o];if(!i){unknownFormat();return}if(i===true)return;const[a,c,f]=getFormat(i);if(a===t)e.pass(validCondition());function unknownFormat(){if(u.strictSchema===false){p.logger.warn(unknownMsg());return}throw new Error(unknownMsg());function unknownMsg(){return`unknown format "${o}" ignored in schema at path "${d}"`}}function getFormat(e){const t=e instanceof RegExp?(0,n.regexpCode)(e):u.code.formats?(0,n._)`${u.code.formats}${(0,n.getProperty)(o)}`:undefined;const s=r.scopeValue("formats",{key:o,ref:e,code:t});if(typeof e=="object"&&!(e instanceof RegExp)){return[e.type||"string",e.validate,(0,n._)`${s}.validate`]}return["string",e,s]}function validCondition(){if(typeof i=="object"&&!(i instanceof RegExp)&&i.async){if(!l.$async)throw new Error("async format in sync schema");return(0,n._)`await ${f}(${s})`}return typeof c=="function"?(0,n._)`${f}(${s})`:(0,n._)`${f}.test(${s})`}}}};t["default"]=i},2601:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(6402);const s=[n.default];t["default"]=s},6620:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.contentVocabulary=t.metadataVocabulary=void 0;t.metadataVocabulary=["title","description","default","deprecated","readOnly","writeOnly","examples"];t.contentVocabulary=["contentMediaType","contentEncoding","contentSchema"]},7844:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(643);const s=r(3818);const i=r(3907);const o=[n.default,s.default,i.default];t["default"]=o},2010:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(6855);const s=r(4144);const i=[n.default,s.default];t["default"]=i},4144:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i={message:({params:{len:e}})=>(0,n.str)`must NOT have more than ${e} items`,params:({params:{len:e}})=>(0,n._)`{limit: ${e}}`};const o={keyword:"unevaluatedItems",type:"array",schemaType:["boolean","object"],error:i,code(e){const{gen:t,schema:r,data:i,it:o}=e;const a=o.items||0;if(a===true)return;const c=t.const("len",(0,n._)`${i}.length`);if(r===false){e.setParams({len:a});e.fail((0,n._)`${c} > ${a}`)}else if(typeof r=="object"&&!(0,s.alwaysValidSchema)(o,r)){const r=t.var("valid",(0,n._)`${c} <= ${a}`);t.if((0,n.not)(r),()=>validateItems(r,a));e.ok(r)}o.items=true;function validateItems(r,i){t.forRange("i",i,c,i=>{e.subschema({keyword:"unevaluatedItems",dataProp:i,dataPropType:s.Type.Num},r);if(!o.allErrors)t.if((0,n.not)(r),()=>t.break())})}}};t["default"]=o},6855:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(630);const o={message:"must NOT have unevaluated properties",params:({params:e})=>(0,n._)`{unevaluatedProperty: ${e.unevaluatedProperty}}`};const a={keyword:"unevaluatedProperties",type:"object",schemaType:["boolean","object"],trackErrors:true,error:o,code(e){const{gen:t,schema:r,data:o,errsCount:a,it:c}=e;if(!a)throw new Error("ajv implementation error");const{allErrors:u,props:d}=c;if(d instanceof n.Name){t.if((0,n._)`${d} !== true`,()=>t.forIn("key",o,e=>t.if(unevaluatedDynamic(d,e),()=>unevaluatedPropCode(e))))}else if(d!==true){t.forIn("key",o,e=>d===undefined?unevaluatedPropCode(e):t.if(unevaluatedStatic(d,e),()=>unevaluatedPropCode(e)))}c.props=true;e.ok((0,n._)`${a} === ${i.default.errors}`);function unevaluatedPropCode(i){if(r===false){e.setParams({unevaluatedProperty:i});e.error();if(!u)t.break();return}if(!(0,s.alwaysValidSchema)(c,r)){const r=t.name("valid");e.subschema({keyword:"unevaluatedProperties",dataProp:i,dataPropType:s.Type.Str},r);if(!u)t.if((0,n.not)(r),()=>t.break())}}function unevaluatedDynamic(e,t){return(0,n._)`!${e} || !${e}[${t}]`}function unevaluatedStatic(e,t){const r=[];for(const s in e){if(e[s]===true)r.push((0,n._)`${t} !== ${s}`)}return(0,n.and)(...r)}}};t["default"]=a},8026:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(4951);const o={message:"must be equal to constant",params:({schemaCode:e})=>(0,n._)`{allowedValue: ${e}}`};const a={keyword:"const",$data:true,error:o,code(e){const{gen:t,data:r,$data:o,schemaCode:a,schema:c}=e;if(o||c&&typeof c=="object"){e.fail$data((0,n._)`!${(0,s.useFunc)(t,i.default)}(${r}, ${a})`)}else{e.fail((0,n._)`${c} !== ${r}`)}}};t["default"]=a},643:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(5826);const s={keyword:"dependentRequired",type:"object",schemaType:"object",error:n.error,code:e=>(0,n.validatePropertyDeps)(e)};t["default"]=s},3200:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(4951);const o={message:"must be equal to one of the allowed values",params:({schemaCode:e})=>(0,n._)`{allowedValues: ${e}}`};const a={keyword:"enum",schemaType:"array",$data:true,error:o,code(e){const{gen:t,data:r,$data:o,schema:a,schemaCode:c,it:u}=e;if(!o&&a.length===0)throw new Error("enum must have non-empty array");const d=a.length>=u.opts.loopEnum;let l;const getEql=()=>l!==null&&l!==void 0?l:l=(0,s.useFunc)(t,i.default);let p;if(d||o){p=t.let("valid");e.block$data(p,loopEnum)}else{if(!Array.isArray(a))throw new Error("ajv implementation error");const e=t.const("vSchema",c);p=(0,n.or)(...a.map((t,r)=>equalCode(e,r)))}e.pass(p);function loopEnum(){t.assign(p,false);t.forOf("v",c,e=>t.if((0,n._)`${getEql()}(${r}, ${e})`,()=>t.assign(p,true).break()))}function equalCode(e,t){const s=a[t];return typeof s==="object"&&s!==null?(0,n._)`${getEql()}(${r}, ${e}[${t}])`:(0,n._)`${r} === ${s}`}}};t["default"]=a},5481:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(3723);const s=r(8132);const i=r(6962);const o=r(6023);const a=r(895);const c=r(4504);const u=r(6296);const d=r(5132);const l=r(8026);const p=r(3200);const f=[n.default,s.default,i.default,o.default,a.default,c.default,u.default,d.default,{keyword:"type",schemaType:["string","array"]},{keyword:"nullable",schemaType:"boolean"},l.default,p.default];t["default"]=f},3907:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(4464);const s={keyword:["maxContains","minContains"],type:"array",schemaType:"number",code({keyword:e,parentSchema:t,it:r}){if(t.contains===undefined){(0,n.checkStrictMode)(r,`"${e}" without "contains" is ignored`)}}};t["default"]=s},6296:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s={message({keyword:e,schemaCode:t}){const r=e==="maxItems"?"more":"fewer";return(0,n.str)`must NOT have ${r} than ${t} items`},params:({schemaCode:e})=>(0,n._)`{limit: ${e}}`};const i={keyword:["maxItems","minItems"],type:"array",schemaType:"number",$data:true,error:s,code(e){const{keyword:t,data:r,schemaCode:s}=e;const i=t==="maxItems"?n.operators.GT:n.operators.LT;e.fail$data((0,n._)`${r}.length ${i} ${s}`)}};t["default"]=i},6962:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=r(4464);const i=r(6214);const o={message({keyword:e,schemaCode:t}){const r=e==="maxLength"?"more":"fewer";return(0,n.str)`must NOT have ${r} than ${t} characters`},params:({schemaCode:e})=>(0,n._)`{limit: ${e}}`};const a={keyword:["maxLength","minLength"],type:"string",schemaType:"number",$data:true,error:o,code(e){const{keyword:t,data:r,schemaCode:o,it:a}=e;const c=t==="maxLength"?n.operators.GT:n.operators.LT;const u=a.opts.unicode===false?(0,n._)`${r}.length`:(0,n._)`${(0,s.useFunc)(e.gen,i.default)}(${r})`;e.fail$data((0,n._)`${u} ${c} ${o}`)}};t["default"]=a},3723:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s=n.operators;const i={maximum:{okStr:"<=",ok:s.LTE,fail:s.GT},minimum:{okStr:">=",ok:s.GTE,fail:s.LT},exclusiveMaximum:{okStr:"<",ok:s.LT,fail:s.GTE},exclusiveMinimum:{okStr:">",ok:s.GT,fail:s.LTE}};const o={message:({keyword:e,schemaCode:t})=>(0,n.str)`must be ${i[e].okStr} ${t}`,params:({keyword:e,schemaCode:t})=>(0,n._)`{comparison: ${i[e].okStr}, limit: ${t}}`};const a={keyword:Object.keys(i),type:"number",schemaType:"number",$data:true,error:o,code(e){const{keyword:t,data:r,schemaCode:s}=e;e.fail$data((0,n._)`${r} ${i[t].fail} ${s} || isNaN(${r})`)}};t["default"]=a},895:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s={message({keyword:e,schemaCode:t}){const r=e==="maxProperties"?"more":"fewer";return(0,n.str)`must NOT have ${r} than ${t} properties`},params:({schemaCode:e})=>(0,n._)`{limit: ${e}}`};const i={keyword:["maxProperties","minProperties"],type:"object",schemaType:"number",$data:true,error:s,code(e){const{keyword:t,data:r,schemaCode:s}=e;const i=t==="maxProperties"?n.operators.GT:n.operators.LT;e.fail$data((0,n._)`Object.keys(${r}).length ${i} ${s}`)}};t["default"]=i},8132:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(1436);const s={message:({schemaCode:e})=>(0,n.str)`must be multiple of ${e}`,params:({schemaCode:e})=>(0,n._)`{multipleOf: ${e}}`};const i={keyword:"multipleOf",type:"number",schemaType:"number",$data:true,error:s,code(e){const{gen:t,data:r,schemaCode:s,it:i}=e;const o=i.opts.multipleOfPrecision;const a=t.let("res");const c=o?(0,n._)`Math.abs(Math.round(${a}) - ${a}) > 1e-${o}`:(0,n._)`${a} !== parseInt(${a})`;e.fail$data((0,n._)`(${s} === 0 || (${a} = ${r}/${s}, ${c}))`)}};t["default"]=i},6023:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8484);const s=r(4464);const i=r(1436);const o={message:({schemaCode:e})=>(0,i.str)`must match pattern "${e}"`,params:({schemaCode:e})=>(0,i._)`{pattern: ${e}}`};const a={keyword:"pattern",type:"string",schemaType:"string",$data:true,error:o,code(e){const{gen:t,data:r,$data:o,schema:a,schemaCode:c,it:u}=e;const d=u.opts.unicodeRegExp?"u":"";if(o){const{regExp:n}=u.opts.code;const o=n.code==="new RegExp"?(0,i._)`new RegExp`:(0,s.useFunc)(t,n);const a=t.let("valid");t.try(()=>t.assign(a,(0,i._)`${o}(${c}, ${d}).test(${r})`),()=>t.assign(a,false));e.fail$data((0,i._)`!${a}`)}else{const t=(0,n.usePattern)(e,a);e.fail$data((0,i._)`!${t}.test(${r})`)}}};t["default"]=a},4504:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(8484);const s=r(1436);const i=r(4464);const o={message:({params:{missingProperty:e}})=>(0,s.str)`must have required property '${e}'`,params:({params:{missingProperty:e}})=>(0,s._)`{missingProperty: ${e}}`};const a={keyword:"required",type:"object",schemaType:"array",$data:true,error:o,code(e){const{gen:t,schema:r,schemaCode:o,data:a,$data:c,it:u}=e;const{opts:d}=u;if(!c&&r.length===0)return;const l=r.length>=d.loopRequired;if(u.allErrors)allErrorsMode();else exitOnErrorMode();if(d.strictRequired){const t=e.parentSchema.properties;const{definedProperties:n}=e.it;for(const e of r){if((t===null||t===void 0?void 0:t[e])===undefined&&!n.has(e)){const t=u.schemaEnv.baseId+u.errSchemaPath;const r=`required property "${e}" is not defined at "${t}" (strictRequired)`;(0,i.checkStrictMode)(u,r,u.opts.strictRequired)}}}function allErrorsMode(){if(l||c){e.block$data(s.nil,loopAllRequired)}else{for(const t of r){(0,n.checkReportMissingProp)(e,t)}}}function exitOnErrorMode(){const s=t.let("missing");if(l||c){const r=t.let("valid",true);e.block$data(r,()=>loopUntilMissing(s,r));e.ok(r)}else{t.if((0,n.checkMissingProp)(e,r,s));(0,n.reportMissingProp)(e,s);t.else()}}function loopAllRequired(){t.forOf("prop",o,r=>{e.setParams({missingProperty:r});t.if((0,n.noPropertyInData)(t,a,r,d.ownProperties),()=>e.error())})}function loopUntilMissing(r,i){e.setParams({missingProperty:r});t.forOf(r,o,()=>{t.assign(i,(0,n.propertyInData)(t,a,r,d.ownProperties));t.if((0,s.not)(i),()=>{e.error();t.break()})},s.nil)}}};t["default"]=a},5132:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});const n=r(6685);const s=r(1436);const i=r(4464);const o=r(4951);const a={message:({params:{i:e,j:t}})=>(0,s.str)`must NOT have duplicate items (items ## ${t} and ${e} are identical)`,params:({params:{i:e,j:t}})=>(0,s._)`{i: ${e}, j: ${t}}`};const c={keyword:"uniqueItems",type:"array",schemaType:"boolean",$data:true,error:a,code(e){const{gen:t,data:r,$data:a,schema:c,parentSchema:u,schemaCode:d,it:l}=e;if(!a&&!c)return;const p=t.let("valid");const f=u.items?(0,n.getSchemaTypes)(u.items):[];e.block$data(p,validateUniqueItems,(0,s._)`${d} === false`);e.ok(p);function validateUniqueItems(){const n=t.let("i",(0,s._)`${r}.length`);const i=t.let("j");e.setParams({i:n,j:i});t.assign(p,true);t.if((0,s._)`${n} > 1`,()=>(canOptimize()?loopN:loopN2)(n,i))}function canOptimize(){return f.length>0&&!f.some(e=>e==="object"||e==="array")}function loopN(i,o){const a=t.name("item");const c=(0,n.checkDataTypes)(f,a,l.opts.strictNumbers,n.DataType.Wrong);const u=t.const("indices",(0,s._)`{}`);t.for((0,s._)`;${i}--;`,()=>{t.let(a,(0,s._)`${r}[${i}]`);t.if(c,(0,s._)`continue`);if(f.length>1)t.if((0,s._)`typeof ${a} == "string"`,(0,s._)`${a} += "_"`);t.if((0,s._)`typeof ${u}[${a}] == "number"`,()=>{t.assign(o,(0,s._)`${u}[${a}]`);e.error();t.assign(p,false).break()}).code((0,s._)`${u}[${a}] = ${i}`)})}function loopN2(n,a){const c=(0,i.useFunc)(t,o.default);const u=t.name("outer");t.label(u).for((0,s._)`;${n}--;`,()=>t.for((0,s._)`${a} = ${n}; ${a}--;`,()=>t.if((0,s._)`${c}(${r}[${n}], ${r}[${a}])`,()=>{e.error();t.assign(p,false).break(u)})))}}};t["default"]=c},3430:e=>{e.exports=function equal(e,t){if(e===t)return true;if(e&&t&&typeof e=="object"&&typeof t=="object"){if(e.constructor!==t.constructor)return false;var r,n,s;if(Array.isArray(e)){r=e.length;if(r!=t.length)return false;for(n=r;n--!==0;)if(!equal(e[n],t[n]))return false;return true}if(e.constructor===RegExp)return e.source===t.source&&e.flags===t.flags;if(e.valueOf!==Object.prototype.valueOf)return e.valueOf()===t.valueOf();if(e.toString!==Object.prototype.toString)return e.toString()===t.toString();s=Object.keys(e);r=s.length;if(r!==Object.keys(t).length)return false;for(n=r;n--!==0;)if(!Object.prototype.hasOwnProperty.call(t,s[n]))return false;for(n=r;n--!==0;){var i=s[n];if(!equal(e[i],t[i]))return false}return true}return e!==e&&t!==t}},1167:e=>{var t=e.exports=function(e,t,r){if(typeof t=="function"){r=t;t={}}r=t.cb||r;var n=typeof r=="function"?r:r.pre||function(){};var s=r.post||function(){};_traverse(t,n,s,e,"",e)};t.keywords={additionalItems:true,items:true,contains:true,additionalProperties:true,propertyNames:true,not:true,if:true,then:true,else:true};t.arrayKeywords={items:true,allOf:true,anyOf:true,oneOf:true};t.propsKeywords={$defs:true,definitions:true,properties:true,patternProperties:true,dependencies:true};t.skipKeywords={default:true,enum:true,const:true,required:true,maximum:true,minimum:true,exclusiveMaximum:true,exclusiveMinimum:true,multipleOf:true,maxLength:true,minLength:true,pattern:true,format:true,maxItems:true,minItems:true,uniqueItems:true,maxProperties:true,minProperties:true};function _traverse(e,r,n,s,i,o,a,c,u,d){if(s&&typeof s=="object"&&!Array.isArray(s)){r(s,i,o,a,c,u,d);for(var l in s){var p=s[l];if(Array.isArray(p)){if(l in t.arrayKeywords){for(var f=0;f<p.length;f++)_traverse(e,r,n,p[f],i+"/"+l+"/"+f,o,i,l,s,f)}}else if(l in t.propsKeywords){if(p&&typeof p=="object"){for(var h in p)_traverse(e,r,n,p[h],i+"/"+l+"/"+escapeJsonPtr(h),o,i,l,s,h)}}else if(l in t.keywords||e.allKeys&&!(l in t.skipKeywords)){_traverse(e,r,n,p,i+"/"+l,o,i,l,s)}}n(s,i,o,a,c,u,d)}}function escapeJsonPtr(e){return e.replace(/~/g,"~0").replace(/\//g,"~1")}},1552:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.canonicalJson=canonicalJson;t.sha256Digest=sha256Digest;t.sha256Text=sha256Text;t.compareTextUnit=compareTextUnit;const n=r(7598);function canonicalize(e){if(Array.isArray(e))return e.map(canonicalize);if(e!==null&&typeof e==="object"){const t=e;return Object.fromEntries(Object.keys(t).sort().map(e=>[e,canonicalize(t[e])]))}return e}function canonicalJson(e){return JSON.stringify(canonicalize(e))}function sha256Digest(e){return`sha256:${(0,n.createHash)("sha256").update(canonicalJson(e)).digest("hex")}`}function sha256Text(e){return`sha256:${(0,n.createHash)("sha256").update(e).digest("hex")}`}function compareTextUnit(e,t){if(e<t)return-1;if(e>t)return 1;return 0}},3457:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.MAX_NESTED_ENTRIES=t.MAX_STRING_LENGTH=t.MAX_COLLECTION_ITEMS=void 0;t.MAX_COLLECTION_ITEMS=3e3;t.MAX_STRING_LENGTH=1e5;t.MAX_NESTED_ENTRIES=1e4},395:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.STATUS_PRECEDENCE=void 0;t.determineFinalStatus=determineFinalStatus;t.STATUS_PRECEDENCE=[{status:"policy_ambiguous",condition:"an unknown policy/authority requirement exists"},{status:"evidence_missing",condition:"an evidence requirement is unknown"},{status:"human_review_required",condition:"a human-gate requirement failed"},{status:"blocked",condition:"an enforceable blocking requirement failed"},{status:"ready_for_review",condition:"no higher-precedence condition exists"}];function determineFinalStatus(e){if(e.some(e=>e.result==="unknown"&&e.severity!=="evidence")){return"policy_ambiguous"}if(e.some(e=>e.result==="unknown"&&e.severity==="evidence")){return"evidence_missing"}if(e.some(e=>e.result==="failed"&&e.severity==="human_gate")){return"human_review_required"}if(e.some(e=>e.result==="failed"&&e.severity==="block")){return"blocked"}return"ready_for_review"}},6875:function(e,t,r){var n=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:true});t.ContractValidationError=void 0;t.assertPatchgatePolicy=assertPatchgatePolicy;t.assertEvaluationInput=assertEvaluationInput;t.assertContributionReceipt=assertContributionReceipt;t.parseEvaluationInputJson=parseEvaluationInputJson;const s=r(2210);const i=r(395);const o=r(3457);const a=r(1552);const c=r(1140);const u=r(5291);const d=n(r(3578));const l=n(r(6537));const p=n(r(5761));const f=new s.Ajv2020({allErrors:true,strict:true});f.addSchema(d.default);f.addSchema(l.default);f.addSchema(p.default);const h=f.getSchema("https://patchgate.dev/schemas/patchgate-policy/0.1");const m=f.getSchema("https://patchgate.dev/schemas/evaluation-input/0.1");const g=f.getSchema("https://patchgate.dev/schemas/contribution-receipt/0.1");class ContractValidationError extends Error{issues;diagnosticId;constructor(e,t=[],r="CONTRACT_INVALID"){super(e);this.name="ContractValidationError";this.issues=t;this.diagnosticId=r}}t.ContractValidationError=ContractValidationError;function fail(e,t="CONTRACT_INVALID"){throw new ContractValidationError(e,[],t)}function validate(e,t,r){if(t(e))return;const n=(t.errors??[]).map(e=>`${e.instancePath||"/"} ${e.message??"is invalid"}`).join("; ");throw new ContractValidationError(`${r} is invalid${n.length>0?`: ${n}`:""}`,t.errors??[],"SCHEMA_INVALID")}function isRecord(e){return e!==null&&typeof e==="object"&&!Array.isArray(e)}function assertString(e,t){if(e.trim().length===0)fail(`${t} must contain a non-whitespace character`);if(e.length>o.MAX_STRING_LENGTH)fail(`${t} exceeds the parser safety limit`,"RESOURCE_LIMIT_EXCEEDED")}function assertUniqueStrings(e,t){if(new Set(e).size!==e.length)fail(`${t} must not contain duplicates`,"DUPLICATE_IDENTITY")}function assertCollectionSize(e,t){if(e.length>o.MAX_COLLECTION_ITEMS)fail(`${t} exceeds the maximum accepted collection size`,"RESOURCE_LIMIT_EXCEEDED")}function assertNestedEntryCount(e,t){if(e.length>o.MAX_NESTED_ENTRIES)fail(`${t} exceeds the maximum nested-entry limit`,"RESOURCE_LIMIT_EXCEEDED")}function assertPolicySemantics(e){assertNestedEntryCount(e.requiredChecks??[],"policy required checks");assertNestedEntryCount(e.sensitivePaths??[],"policy sensitive paths");assertNestedEntryCount(e.policyChanges?.paths??[],"policy change paths");const t=[...(e.requiredChecks??[]).map(e=>e.id),...(e.sensitivePaths??[]).map(e=>e.id)];const r=t.find((e,r)=>t.indexOf(e)!==r);if(r!==undefined)fail(`policy rule id must be unique: ${r}`,"DUPLICATE_RULE_ID");for(const t of e.requiredChecks??[]){assertNestedEntryCount(t.acceptableConclusions,`required check ${t.id} acceptable conclusions`);assertString(t.id,"required check id");assertString(t.name,`required check ${t.id} name`);t.acceptableConclusions.forEach(e=>assertString(e,`required check ${t.id} conclusion`));if(t.acceptableConclusions.length===0)fail(`required check ${t.id} must declare at least one acceptable conclusion`);if(t.expectedSource.kind==="github_app_expected"&&t.expectedSource.appId===undefined)fail(`required check ${t.id} must identify expected immutable App identity`);if(t.expectedSource.kind==="github_actions_workflow"&&(t.expectedSource.appId===undefined||t.expectedSource.workflowId===undefined&&t.expectedSource.workflowPath===undefined)){fail(`required check ${t.id} must identify expected workflow identity`)}}for(const t of e.sensitivePaths??[]){assertNestedEntryCount(t.patterns,`sensitive path rule ${t.id} patterns`);assertNestedEntryCount(t.requiredReviewers,`sensitive path rule ${t.id} reviewers`);assertString(t.id,"sensitive path rule id");t.patterns.forEach(e=>assertString(e,`sensitive path rule ${t.id} pattern`));t.requiredReviewers.forEach(e=>assertString(e,`sensitive path rule ${t.id} reviewer`));if(t.requiredCount<1||!Number.isInteger(t.requiredCount))fail(`sensitive path rule ${t.id} requiredCount must be a positive integer`)}for(const t of Object.values(e.reviewability?.budgets??{})){if(!Number.isInteger(t)||t<0)fail("reviewability budgets must be non-negative integers")}}function assertPatchgatePolicy(e){validate(e,h,"PatchGate policy");assertPolicySemantics(e)}function assertNativeControlsContract(e,t,r,n){const s=e?.branchProtection;const i=e?.rulesets;const o=t.find(e=>e.kind==="branch_protection");if(s!==undefined){if(o===undefined)fail(`${n} requires an enforced branch-protection policy source`,"NATIVE_CONTROL_SOURCE_MISSING");if(o.revision!==r)fail(`${n} branch-protection source must be bound to baseSha`,"POLICY_SOURCE_REVISION_MISMATCH");if(o.digest!==(0,a.sha256Digest)(s))fail(`${n} branch-protection digest does not match the normalized native control`,"NATIVE_CONTROL_DIGEST_MISMATCH");const e=s.requiredChecks.map(e=>`${e.context}\0${e.appId??""}`);assertUniqueStrings(e,`${n} branch-protection required checks`);const t=s.requiredChecks.length>0||s.requiredApprovals>0||s.requireCodeOwnerReviews||s.requireLastPushApproval||s.requiredReviewThreadResolution;if(s.decisionBearing!==t)fail(`${n} branch-protection decision-bearing flag is inconsistent`,"NATIVE_CONTROL_INCONSISTENT")}if(i!==undefined){const e=t.find(e=>e.kind==="ruleset");if(e===undefined)fail(`${n} requires an enforced ruleset policy source`,"NATIVE_CONTROL_SOURCE_MISSING");if(e.revision!==r)fail(`${n} ruleset source must be bound to baseSha`,"POLICY_SOURCE_REVISION_MISMATCH");if(e.digest!==(0,a.sha256Digest)(i))fail(`${n} ruleset digest does not match the normalized native controls`,"NATIVE_CONTROL_DIGEST_MISMATCH");assertUniqueStrings(i.map(e=>String(e.id)),`${n} ruleset IDs`);for(const e of i){const t=e.requiredChecks.map(e=>`${e.context}\0${e.appId??""}`);assertUniqueStrings(t,`${n} ruleset ${e.id} required checks`);const r=e.enforcement==="active"&&e.applicable&&e.ruleTypes.length>0;if(e.decisionBearing!==r)fail(`${n} ruleset ${e.id} decision-bearing flag is inconsistent`,"NATIVE_CONTROL_INCONSISTENT")}}}function validateObservationMeta(e,t,r){const n=Array.isArray(e)?e:[e];assertCollectionSize(n,`${t} observation metadata`);for(const e of n){assertUtcTimestamp(e.retrievedAt,`${t}.retrievedAt`);assertString(e.source.kind,`${t}.source.kind`);assertString(e.source.identity,`${t}.source.identity`);if(e.revision!==undefined)assertString(e.revision,`${t}.revision`);if(e.nextCursor!==undefined)assertString(e.nextCursor,`${t}.nextCursor`);if(e.complete&&e.permissionState!=="sufficient")fail(`${t} complete observation requires sufficient permission`,"OBSERVATION_INVARIANT");if(e.complete&&(e.truncated===true||e.nextCursor!==undefined))fail(`${t} complete observation cannot be truncated or paginated`,"OBSERVATION_INVARIANT");if(e.normalizedDigest!==undefined&&e.normalizedDigest!==r)fail(`${t} normalizedDigest does not match its normalized items`,"OBSERVATION_DIGEST_MISMATCH");if(e.complete&&e.normalizedDigest===undefined)fail(`${t} complete observation requires normalizedDigest`,"OBSERVATION_INVARIANT")}}function assertObservationRevision(e,t,r){if(e.revision!==undefined&&e.revision!==t)fail(`${r}.revision must match ${t}`,"OBSERVATION_INVARIANT")}function assertObservationContract(e){const t=e.observations;if(t.policySources.length!==e.policySources.length)fail("policy source observation metadata must correspond one-to-one with policy sources","OBSERVATION_INVARIANT");for(let r=0;r<t.policySources.length;r+=1){const n=t.policySources[r];const s=e.policySources[r];if(n.source.identity!==s.identity)fail("policy source observation metadata cannot be swapped between source records","OBSERVATION_INVARIANT");assertObservationRevision(n,s.revision,`observations.policySources[${r}]`);validateObservationMeta(n,`observations.policySources[${r}]`,(0,c.normalizedObservationDigest)(e,"policySources"))}const r=[["changedPaths",t.changedPaths],["linkedIssues",t.linkedIssues],["reviews",t.reviews],["checks",t.checks],["ownership",t.ownership],["reviewability",t.reviewability]];for(const[t,n]of r){if(Array.isArray(n))fail(`observations.${t} must contain one observation metadata record`,"OBSERVATION_INVARIANT");const r=t==="ownership"?e.revisions.baseSha:t==="changedPaths"||t==="linkedIssues"?e.revisions.headSha:e.revisions.testedSha;assertObservationRevision(n,r,`observations.${t}`);validateObservationMeta(n,`observations.${t}`,(0,c.normalizedObservationDigest)(e,t))}}function assertCheckSemantics(e){const t=new Set;const r=new Set;for(const n of e.checks){assertString(n.name,"check name");assertString(n.testedSha,`check ${n.name} testedSha`);if(n.conclusion!==undefined)assertString(n.conclusion,`check ${n.name} conclusion`);if(n.status==="completed"&&n.conclusion===undefined)fail(`completed check ${n.name} must record a conclusion`,"CHECK_CONCLUSION_MISSING");assertUtcTimestamp(n.retrievedAt,"check retrievedAt");if(n.checkRunId!==undefined){if(t.has(n.checkRunId))fail(`duplicate checkRunId ${n.checkRunId}`,"DUPLICATE_EVIDENCE_ID");t.add(n.checkRunId)}if(n.workflowRunId!==undefined&&n.workflowRunAttempt!==undefined){const e=`${n.workflowRunId}:${n.workflowRunAttempt}:${n.name}:${n.testedSha}`;if(r.has(e))fail(`duplicate workflow run identity ${e}`,"DUPLICATE_EVIDENCE_ID");r.add(e)}if(n.sourceStrength==="github_app_expected"&&(n.appId===undefined||n.checkRunId===undefined))fail(`GitHub App check ${n.name} must record appId and checkRunId`,"CHECK_IDENTITY_MISSING");if(n.sourceStrength==="github_actions_workflow"&&(n.appId===undefined||n.workflowRunId===undefined||n.workflowRunAttempt===undefined||n.event===undefined||n.workflowId===undefined&&n.workflowPath===undefined)){fail(`GitHub Actions check ${n.name} must record appId, workflow identity, run identity, attempt, and event`,"CHECK_IDENTITY_MISSING")}if(e.revisions.targetKind==="merge_group"&&n.event!==undefined&&n.event!=="merge_group")fail(`check ${n.name} event is incompatible with merge_group target`,"TARGET_INVARIANT")}}function assertReviewSemantics(e){const t=new Set;const r=new Set;for(const n of e.reviews){if(t.has(n.reviewId))fail(`duplicate reviewId ${n.reviewId}`,"DUPLICATE_EVIDENCE_ID");t.add(n.reviewId);assertString(n.login,"reviewer login");assertString(n.commitId,`review ${n.login} commitId`);if(r.has(n.actorId)&&n.active&&n.state==="APPROVED"){}r.add(n.actorId);assertUniqueStrings(n.teams,`review ${n.login} teams`);if(new Set(n.teamIds).size!==n.teamIds.length)fail(`review ${n.login} teamIds must be unique`,"DUPLICATE_IDENTITY");assertString(n.qualification.source.kind,`review ${n.login} qualification source kind`);assertString(n.qualification.source.identity,`review ${n.login} qualification source identity`);if(n.qualification.revision!==undefined)assertString(n.qualification.revision,`review ${n.login} qualification revision`);if(n.qualification.revision!==undefined&&n.qualification.revision!==e.revisions.testedSha)fail(`review ${n.login} qualification revision must match testedSha`,"OBSERVATION_INVARIANT");const s=n.qualification.principalBindings??[];const i=s.map(e=>`${e.kind}\0${e.configuredPrincipal}\0${e.immutableId}`);assertUniqueStrings(i,`review ${n.login} qualification principals`);for(const e of s){assertString(e.configuredPrincipal,`review ${n.login} configured principal`);if(!Number.isInteger(e.immutableId)||e.immutableId<1)fail(`review ${n.login} qualification principal must have an immutable positive ID`,"OBSERVATION_INVARIANT")}}}function assertInputVersion(e){if(!isRecord(e)||e.schemaVersion===undefined)fail("evaluation input must declare schemaVersion","INPUT_VERSION_REQUIRED");if(e.schemaVersion!=="0.1")fail(`unsupported evaluation input schemaVersion: ${String(e.schemaVersion)}`,"INPUT_VERSION_UNSUPPORTED")}function assertEvaluationInput(e){assertInputVersion(e);validate(e,m,"evaluation input");const t=e;if(t.policy!==null)assertPatchgatePolicy(t.policy);assertString(t.repository.owner,"repository owner");assertString(t.repository.name,"repository name");assertString(t.revisions.baseSha,"baseSha");assertString(t.revisions.headSha,"headSha");assertString(t.revisions.testedSha,"testedSha");if(t.revisions.targetKind==="head"&&t.revisions.testedSha!==t.revisions.headSha)fail("head evaluation testedSha must equal headSha","TARGET_INVARIANT");if(t.revisions.targetKind==="merge"&&(t.revisions.mergeSha===undefined||t.revisions.testedSha!==t.revisions.mergeSha))fail("merge evaluation testedSha must equal the declared mergeSha","TARGET_INVARIANT");if(t.revisions.targetKind==="merge_group"&&(t.revisions.mergeGroupSha===undefined||t.revisions.testedSha!==t.revisions.mergeGroupSha))fail("merge-group evaluation testedSha must equal the declared mergeGroupSha","TARGET_INVARIANT");assertCollectionSize(t.policySources,"policy sources");assertCollectionSize(t.changedPaths,"changed paths");assertCollectionSize(t.linkedIssues,"linked issues");assertCollectionSize(t.reviews,"reviews");assertCollectionSize(t.checks,"checks");assertCollectionSize(t.ownershipRequirements,"ownership requirements");const r=t.policySources.map(e=>`${e.kind}\0${e.identity}`);assertUniqueStrings(r,"policy source identities");for(const e of t.policySources){assertString(e.identity,"policy source identity");assertString(e.revision,`policy source ${e.identity} revision`);if(e.revision!==t.revisions.baseSha)fail(`policy source ${e.identity} must be bound to baseSha`,"POLICY_SOURCE_REVISION_MISMATCH")}assertNativeControlsContract(t.nativeControls,t.policySources,t.revisions.baseSha,"evaluation input nativeControls");assertUniqueStrings(t.changedPaths,"changed paths");t.changedPaths.forEach(e=>assertString(e,"changed path"));const n=t.linkedIssues.map(e=>`${e.repository.toLowerCase()}#${e.number}`);assertUniqueStrings(n,"linked issues");const s=t.linkedIssues.map(e=>`${e.repositoryId}\0${e.issueId}`);assertUniqueStrings(s,"linked issue immutable identities");for(const e of t.linkedIssues){assertString(e.repositoryId,"linked issue repositoryId");assertString(e.issueId,"linked issue issueId")}const i=t.ownershipRequirements.map(e=>e.id);assertUniqueStrings(i,"ownership requirement ids");for(const e of t.ownershipRequirements){assertString(e.id,"ownership requirement id");assertUniqueStrings(e.owners,`ownership requirement ${e.id} owners`);e.owners.forEach(t=>assertString(t,`ownership requirement ${e.id} owner`));if(e.requiredCount<1||!Number.isInteger(e.requiredCount))fail(`ownership requirement ${e.id} requiredCount must be a positive integer`)}assertCheckSemantics(t);assertReviewSemantics(t);if(t.reviewability!==undefined)assertUniqueStrings(t.reviewability.ownershipDomains,"reviewability ownership domains");assertObservationContract(t)}function refSet(e){const t=new Set;for(const e of["changedPaths","linkedIssues","reviews","checks","ownership","reviewability"])t.add(`observation:${e}`);for(const r of e.checks){const e=(0,u.evidenceReference)(r);if(e.length>0)t.add(e)}for(const r of e.linkedIssues)if(r.linked)t.add(`issue:${r.repository}#${r.number}:${r.issueId}`);for(const r of e.reviews)t.add(`review:${r.reviewId}:actor:${r.actorId}:${r.commitId}`);return t}function reviewMatchesQualifiedPrincipal(e,t){if(t.length===0)return true;const r=e.qualification.principalBindings??[];return t.some(t=>r.some(r=>r.configuredPrincipal===t&&r.membershipState==="active"&&(r.kind==="user"?t===e.login||t===`@${e.login}`:e.teams.includes(t)&&e.teamIds.includes(r.immutableId))))}function assertReceiptEvidenceIntegrity(e){const t=refSet(e.evidence);const r=new Set(e.policySources.map(e=>`policy-source:${e.identity}`));for(const n of e.requirements){for(const e of n.evidenceRefs){if(!t.has(e)&&!r.has(e))fail(`requirement ${n.id} references missing evidence ${e}`,"RECEIPT_REFERENCE_MISSING")}if(n.result==="passed"&&["issue_linkage","required_check","ownership","human_handoff"].includes(n.ruleClass)&&n.evidenceRefs.length===0)fail(`passed requirement ${n.id} must reference selected evidence`,"RECEIPT_REFERENCE_MISSING");if(n.result==="passed"&&n.ruleClass==="issue_linkage"){const t=n.evidenceRefs.filter(e=>e.startsWith("issue:"));if(t.length===0||t.some(t=>{const r=/^issue:([^#]+)#(\d+):(.+)$/.exec(t);return r===null||!e.evidence.linkedIssues.some(e=>e.repository===r[1]&&e.number===Number(r[2])&&e.issueId===r[3]&&e.linked)}))fail(`passed issue requirement ${n.id} must reference verified linked issue evidence`,"RECEIPT_EVIDENCE_INCONSISTENT")}if(n.result==="passed"&&(n.ruleClass==="ownership"||n.ruleClass==="human_handoff")){const t=n.evidenceRefs.filter(e=>e.startsWith("review:"));const r=n.ruleClass==="human_handoff"?e.humanGates.find(e=>e.id===n.id.slice("handoff.".length))?.requiredReviewers??[]:e.evidence.ownershipRequirements.find(e=>e.id===n.id.slice("ownership.".length))?.owners??[];const s=new Set;if(t.length===0||t.some(t=>{const n=/^review:(\d+):actor:(\d+):(.+)$/.exec(t);if(n===null)return true;const i=e.evidence.reviews.find(e=>e.reviewId===Number(n[1])&&e.actorId===Number(n[2])&&e.commitId===n[3]);if(i===undefined||!i.qualified||!i.active||i.state!=="APPROVED"||i.commitId!==e.revisions.testedSha||i.qualification.complete!==true||i.qualification.permissionState!=="sufficient"||i.isAuthor||i.isBot||!reviewMatchesQualifiedPrincipal(i,r))return true;s.add(i.actorId);return false}))fail(`passed ${n.ruleClass} requirement ${n.id} must reference qualified current review evidence`,"RECEIPT_EVIDENCE_INCONSISTENT");const i=n.ruleClass==="human_handoff"?e.humanGates.find(e=>e.id===n.id.slice("handoff.".length))?.requiredCount:e.evidence.ownershipRequirements.find(e=>e.id===n.id.slice("ownership.".length))?.requiredCount;const o=n.observed?.requiredCount;const a=n.observed?.approvedCount;if(i===undefined||!Number.isInteger(i)||i<1||o!==i){fail(`passed ${n.ruleClass} requirement ${n.id} must preserve its configured requiredCount`,"RECEIPT_EVIDENCE_INCONSISTENT")}if(s.size<i||a!==s.size){fail(`passed ${n.ruleClass} requirement ${n.id} does not have enough distinct approved actors`,"RECEIPT_EVIDENCE_INCONSISTENT")}}if(n.result==="passed"&&n.ruleClass==="required_check"){for(const t of n.evidenceRefs){const r=e.evidence.checks.find(e=>t===(0,u.evidenceReference)(e));if(r===undefined||r.testedSha!==e.revisions.testedSha||r.status!=="completed"||r.conclusion===undefined)fail(`passed check requirement ${n.id} selected invalid evidence`,"RECEIPT_EVIDENCE_INCONSISTENT");const s=n.observed??{};const i=s.selectedEvidenceRef;if(typeof i==="string"&&i!==t)fail(`passed check requirement ${n.id} selected evidence reference is inconsistent`,"RECEIPT_EVIDENCE_INCONSISTENT");if(s.name!==r.name||s.testedSha!==r.testedSha||s.target!==e.revisions.targetKind||s.resolution!=="passed"){fail(`passed check requirement ${n.id} selected check name, target, or resolution is inconsistent`,"RECEIPT_EVIDENCE_INCONSISTENT")}if(s.selectedConclusion!==r.conclusion||!Array.isArray(s.acceptableConclusions)||!s.acceptableConclusions.includes(r.conclusion)){fail(`passed check requirement ${n.id} selected an unacceptable conclusion`,"RECEIPT_EVIDENCE_INCONSISTENT")}const o=s.sourceConstraint;if(o!=="unconstrained"&&(s.expectedSourceKind!==r.sourceStrength||s.expectedAppId!==r.appId)){fail(`passed check requirement ${n.id} does not match its expected immutable source`,"RECEIPT_EVIDENCE_INCONSISTENT")}const a=[["expectedAppSlug",r.appSlug],["expectedWorkflowId",r.workflowId],["expectedWorkflowPath",r.workflowPath],["expectedEvent",r.event]];for(const[e,t]of a)if(s[e]!==undefined&&s[e]!==t)fail(`passed check requirement ${n.id} expected ${e} is inconsistent`,"RECEIPT_EVIDENCE_INCONSISTENT");if(o!=="unconstrained"&&o!=="app_id"&&r.sourceStrength==="github_actions_workflow"&&s.expectedWorkflowId===undefined&&s.expectedWorkflowPath===undefined){fail(`passed check requirement ${n.id} must preserve its expected workflow identity`,"RECEIPT_EVIDENCE_INCONSISTENT")}const c=[["sourceStrength",r?.sourceStrength],["appId",r?.appId],["checkRunId",r?.checkRunId],["workflowId",r?.workflowId],["workflowPath",r?.workflowPath],["workflowRunId",r?.workflowRunId],["workflowRunAttempt",r?.workflowRunAttempt],["event",r?.event]];for(const[e,t]of c)if(s[e]!==undefined&&s[e]!==t)fail(`passed check requirement ${n.id} selected ${e} is inconsistent`,"RECEIPT_EVIDENCE_INCONSISTENT")}}const s=e.evidence.checks.flatMap(e=>e.checkRunId===undefined?[]:[e.checkRunId]);if(new Set(s).size!==s.length)fail("receipt evidence contains duplicate checkRunId values","DUPLICATE_EVIDENCE_ID");const i=e.evidence.checks.flatMap(e=>e.workflowRunId===undefined||e.workflowRunAttempt===undefined?[]:[`${e.workflowRunId}:${e.workflowRunAttempt}:${e.name}:${e.testedSha}`]);if(new Set(i).size!==i.length)fail("receipt evidence contains duplicate workflow run identities","DUPLICATE_EVIDENCE_ID")}for(const t of e.humanGates){const r=e.requirements.find(e=>e.id===`handoff.${t.id}`);if(r===undefined)fail(`human gate ${t.id} has no matching requirement`,"RECEIPT_GATE_INCONSISTENT");const n=new Set(e.evidence.reviews.filter(r=>r.active&&r.state==="APPROVED"&&r.commitId===e.revisions.testedSha&&r.qualified&&r.qualification.complete&&r.qualification.permissionState==="sufficient"&&!r.isAuthor&&!r.isBot&&reviewMatchesQualifiedPrincipal(r,t.requiredReviewers)).map(e=>`actor:${e.actorId}`));if(!Number.isInteger(t.requiredCount)||t.requiredCount<1)fail(`human gate ${t.id} has an invalid requiredCount`,"RECEIPT_GATE_INCONSISTENT");if(t.approvedBy.some(e=>!n.has(e)))fail(`human gate ${t.id} references an unavailable approved actor`,"RECEIPT_GATE_INCONSISTENT");const s=new Set(r.evidenceRefs.filter(e=>e.startsWith("review:")).map(e=>{const t=/^review:\d+:actor:(\d+):/.exec(e);return t===null?undefined:`actor:${t[1]}`}).filter(e=>e!==undefined));const i=new Set(t.approvedBy);if(i.size!==t.approvedBy.length||i.size!==s.size||[...i].some(e=>!s.has(e)))fail(`human gate ${t.id} approvedBy does not exactly match its requirement evidence`,"RECEIPT_GATE_INCONSISTENT");const o=i.size>=t.requiredCount;if(t.satisfied!==o||t.satisfied!==(r.result==="passed"))fail(`human gate ${t.id} does not match its required approval count or requirement`,"RECEIPT_GATE_INCONSISTENT")}}function assertReceiptObservationContract(e){const t={policySources:e.policySources,changedPaths:e.changedPaths,linkedIssues:e.evidence.linkedIssues,reviews:e.evidence.reviews,checks:e.evidence.checks,ownershipRequirements:e.evidence.ownershipRequirements,reviewability:e.reviewability};const expected=e=>(0,c.normalizedObservationDigest)(t,e);if(e.observations.policySources.length!==e.policySources.length)fail("receipt policy source observation metadata must correspond one-to-one with policy sources","OBSERVATION_INVARIANT");for(let t=0;t<e.observations.policySources.length;t+=1){const r=e.observations.policySources[t];if(r.source.identity!==e.policySources[t].identity)fail("receipt policy source observation metadata cannot be swapped","OBSERVATION_INVARIANT");assertObservationRevision(r,e.policySources[t].revision,`receipt.observations.policySources[${t}]`);validateObservationMeta(r,`receipt.observations.policySources[${t}]`,expected("policySources"))}const r=[["changedPaths",e.observations.changedPaths],["linkedIssues",e.observations.linkedIssues],["reviews",e.observations.reviews],["checks",e.observations.checks],["ownership",e.observations.ownership],["reviewability",e.observations.reviewability]];for(const[t,n]of r){const r=t==="ownership"?e.revisions.baseSha:t==="changedPaths"||t==="linkedIssues"?e.revisions.headSha:e.revisions.testedSha;assertObservationRevision(n,r,`receipt.observations.${t}`);validateObservationMeta(n,`receipt.observations.${t}`,expected(t))}}function assertContributionReceipt(e){validate(e,g,"ContributionReceipt");const t=e;assertUtcTimestamp(t.evaluatedAt,"evaluatedAt");const r=t.requirements.map(e=>e.id);assertUniqueStrings(r,"ContributionReceipt requirement id");const n=(0,i.determineFinalStatus)(t.requirements);if(t.final.status!==n)fail(`ContributionReceipt final status must be ${n}`,"RECEIPT_STATE_INCONSISTENT");const s=t.requirements.filter(e=>e.result!=="passed").map(e=>e.id);if(s.length!==t.final.reasonIds.length||s.some((e,r)=>t.final.reasonIds[r]!==e))fail("ContributionReceipt reasonIds do not match its non-passing requirements","RECEIPT_STATE_INCONSISTENT");const o=t.policySources.map(e=>`${e.kind}\0${e.identity}`);assertUniqueStrings(o,"ContributionReceipt policy source identities");for(const e of t.policySources)if(e.revision!==t.revisions.baseSha)fail(`ContributionReceipt policy source ${e.identity} must be bound to baseSha`,"POLICY_SOURCE_REVISION_MISMATCH");assertNativeControlsContract(t.nativeControls,t.policySources,t.revisions.baseSha,"ContributionReceipt nativeControls");const a=t.policySources.find(e=>e.kind==="patchgate"&&(e.identity==="patchgate.yml"||e.identity===".github/patchgate.yml"));if(a!==undefined&&a.digest!==t.policyDigest)fail("ContributionReceipt policyDigest does not match patchgate.yml source digest","RECEIPT_EVIDENCE_INCONSISTENT");for(const e of t.evidence.checks)assertUtcTimestamp(e.retrievedAt,"check retrievedAt");const u=t.evidence.reviews.map(e=>e.reviewId);assertUniqueStrings(u.map(String),"ContributionReceipt review identities");for(const e of t.evidence.reviews)if(e.qualification.revision!==undefined&&e.qualification.revision!==t.revisions.testedSha)fail(`ContributionReceipt review ${e.reviewId} qualification must be bound to testedSha`,"OBSERVATION_INVARIANT");assertReceiptObservationContract(t);assertReceiptEvidenceIntegrity(t);const d=(0,c.receiptDigest)(t);if(t.receiptDigest!==d)fail("ContributionReceipt receiptDigest does not match its deterministic receipt core","RECEIPT_DIGEST_MISMATCH")}function assertUtcTimestamp(e,t){const r=e.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{3}))?Z$/);if(r===null)fail(`${t} must be a UTC ISO-8601 timestamp`,"TIMESTAMP_INVALID");const n=Date.parse(e);if(!Number.isFinite(n))fail(`${t} must be a valid timestamp`,"TIMESTAMP_INVALID");const s=r[2]===undefined?`${r[1]}.000Z`:e;if(new Date(n).toISOString()!==s)fail(`${t} must be a valid calendar timestamp`,"TIMESTAMP_INVALID")}function parseEvaluationInputJson(e){let t;try{t=JSON.parse(e)}catch(e){const t=e instanceof Error?e.message:"malformed JSON";fail(`evaluation input JSON is malformed: ${t}`,"JSON_MALFORMED")}assertEvaluationInput(t);return t}},1780:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.evaluateValidated=evaluateValidated;t.deliverReceipt=deliverReceipt;const n=r(395);const s=r(1140);const i=r(5291);const o=r(311);const a="patchgate.yml";function isPatchgatePolicySource(e){return e.kind==="patchgate"&&(e.identity==="patchgate.yml"||e.identity===".github/patchgate.yml")}function compareIds(e,t){return e.id<t.id?-1:e.id>t.id?1:0}function requirement(e){return{...e,evidenceRefs:e.evidenceRefs??[]}}function policyObservationComplete(e){return e.observations.policySources.length>0&&e.observations.policySources.every(e=>e.complete&&e.permissionState==="sufficient")}function groupAvailable(e,t){if(t==="policySources")return policyObservationComplete(e);const r=e.observations[t];return!Array.isArray(r)&&r.complete&&r.permissionState==="sufficient"}function hasPatchgateSource(e){if(!policyObservationComplete(e))return false;if(e.policy===null)return false;const t=e.policySources.filter(e=>isPatchgatePolicySource(e)&&e.authority==="enforced");if(t.length!==1)return false;const r=t[0];return r.revision===e.revisions.baseSha&&r.digest===e.policyDigest&&r.contractDigest===(0,s.normalizedPolicyDigest)(e.policy)}function hasBasePolicySource(e,t){return e.policySources.some(r=>r.kind===t&&r.revision===e.revisions.baseSha&&r.authority==="enforced")}function matchedPath(e,t){return t.some(t=>{const r=t.replace(/[.+^${}()|[\]\\?]/g,"\\$&").replace(/\*\*/g,"\0").replace(/\*/g,"[^/]*").replace(/\u0000/g,".*");const n=new RegExp(`^${r}$`);return e.some(e=>n.test(e))})}function changedPolicyPaths(e,t){const r=e.policySources.filter(isPatchgatePolicySource).map(e=>e.identity);return[a,...r,...t.policyChanges?.paths??[]]}function qualifiedApprovals(e,t,r){const n=new Map;for(const t of e.filter(e=>e.active)){const e=n.get(t.actorId)??[];e.push(t);n.set(t.actorId,e)}const s=[];for(const e of n.values()){if(e.some(e=>e.state!=="APPROVED"))continue;const n=e.find(e=>e.state==="APPROVED"&&e.commitId===t&&e.qualified&&e.qualification.complete&&e.qualification.permissionState==="sufficient"&&!e.isAuthor&&!e.isBot&&principalMatches(e,r));if(n!==undefined)s.push(n)}return s}function hasUnknownQualification(e,t,r){return e.some(e=>e.active&&e.state==="APPROVED"&&e.commitId===t&&!e.isAuthor&&!e.isBot&&(r.length===0||r.includes(e.login)||r.includes(`@${e.login}`)||e.teams.some(e=>r.includes(e)))&&(!e.qualification.complete||e.qualification.permissionState!=="sufficient"||!principalMatches(e,r)))}function principalMatches(e,t){if(t.length===0)return true;const r=e.qualification.principalBindings??[];return t.some(t=>r.some(r=>r.configuredPrincipal===t&&r.membershipState==="active"&&(r.kind==="user"?t===e.login||t===`@${e.login}`:e.teams.includes(t)&&e.teamIds.includes(r.immutableId))))}function observationRequirement(e,t,r){return requirement({id:e,ruleClass:"policy_integrity",authority:"derived",source:`observation:${t}`,result:"unknown",severity:"evidence",observed:{observation:t},remediation:r})}function policyRequirements(e){const t=e.policySources.find(e=>isPatchgatePolicySource(e));const r=t===undefined?[]:[`policy-source:${t.identity}`];if(!policyObservationComplete(e)||e.policy===null||!hasPatchgateSource(e)){return[requirement({id:"policy.base_revision",ruleClass:"policy_integrity",authority:"patchgate",source:a,result:"unknown",severity:"block",remediation:"Load patchgate.yml from the trusted PR base SHA and bind both its raw and normalized contract digests before evaluating the PR.",evidenceRefs:r})]}return[requirement({id:"policy.base_revision",ruleClass:"policy_integrity",authority:"patchgate",source:a,result:"passed",severity:"block",observed:{baseSha:e.revisions.baseSha},remediation:"Keep the policy source bound to the PR base SHA and its normalized contract digest.",evidenceRefs:r})]}function issueRequirements(e,t){if(!t.issueLinkage?.required)return[];if(!groupAvailable(e,"linkedIssues"))return[observationRequirement("observation.linked_issues","linkedIssues","Retrieve complete, permission-sufficient linked-issue metadata; a body-only issue number is not verified linkage.")];const r=e.linkedIssues.filter(e=>e.linked);return[requirement({id:"issue.linkage",ruleClass:"issue_linkage",authority:"patchgate",source:a,result:r.length>0?"passed":"failed",severity:"block",observed:{linkedIssueCount:r.length},remediation:"Link at least one valid issue through GitHub metadata; a body-only number is not sufficient evidence.",evidenceRefs:r.map(e=>`issue:${e.repository}#${e.number}:${e.issueId}`)})]}function checkRequirements(e,t){const r=groupAvailable(e,"checks");return(t.requiredChecks??[]).map(t=>{if(!r)return requirement({id:`check.${t.id}`,ruleClass:"required_check",authority:"patchgate",source:a,result:"unknown",severity:"evidence",observed:{name:t.name,resolution:"observation_incomplete"},remediation:`Retrieve complete check/workflow evidence for ${t.name} from the configured target revision and expected source.`});const n=t.target===e.revisions.targetKind?e.revisions.testedSha:undefined;const s=(0,i.resolveCheckEvidence)(e.checks,t,n);const o=s.status==="passed"||s.status==="failed"?s.evidence:undefined;const c=s.status==="passed"?"passed":s.status==="failed"?"failed":"unknown";const u=o===undefined?{}:{selectedEvidenceRef:(0,i.evidenceReference)(o),selectedConclusion:o.conclusion??"",sourceStrength:o.sourceStrength,...o.appId===undefined?{}:{appId:o.appId},...o.checkRunId===undefined?{}:{checkRunId:o.checkRunId},...o.workflowId===undefined?{}:{workflowId:o.workflowId},...o.workflowPath===undefined?{}:{workflowPath:o.workflowPath},...o.workflowRunId===undefined?{}:{workflowRunId:o.workflowRunId},...o.workflowRunAttempt===undefined?{}:{workflowRunAttempt:o.workflowRunAttempt},...o.event===undefined?{}:{event:o.event}};const d={expectedSourceKind:t.expectedSource.kind,...t.expectedSource.appSlug===undefined?{}:{expectedAppSlug:t.expectedSource.appSlug},...t.expectedSource.appId===undefined?{}:{expectedAppId:t.expectedSource.appId},...t.expectedSource.workflowId===undefined?{}:{expectedWorkflowId:t.expectedSource.workflowId},...t.expectedSource.workflowPath===undefined?{}:{expectedWorkflowPath:t.expectedSource.workflowPath},...t.expectedSource.event===undefined?{}:{expectedEvent:t.expectedSource.event}};return requirement({id:`check.${t.id}`,ruleClass:"required_check",authority:"patchgate",source:a,result:c,severity:s.status==="failed"?"block":"evidence",observed:{name:t.name,target:t.target,testedSha:e.revisions.testedSha,acceptableConclusions:t.acceptableConclusions,resolution:s.status,...s.status==="passed"?{}:{resolutionReason:s.reason},...d,...u},remediation:`Provide a completed ${t.name} check from the expected source on the configured ${t.target} revision.`,evidenceRefs:o===undefined?[]:[(0,i.evidenceReference)(o)]})})}function resolveNativeCheckEvidence(e,t,r,n){const s=e.filter(e=>e.name===t);const o=t.includes(" / ")?t.slice(t.lastIndexOf(" / ")+3):undefined;const a=s.length>0?s:o===undefined?[]:e.filter(e=>e.name===o);if(a.length===0)return{status:"missing",reason:"no_candidate"};const c=a.filter(e=>e.testedSha===r);if(c.length===0)return{status:"missing",reason:"wrong_target"};const u=n===undefined?c:c.filter(e=>e.appId===n);if(u.length===0)return{status:"missing",reason:"wrong_source"};if(u.length>1)return{status:"ambiguous",reason:"duplicate_eligible_candidates"};const d=u[0];if(d.status!=="completed")return{status:"missing",reason:"pending"};if((0,i.evidenceReference)(d).length===0)return{status:"missing",reason:"unattributed_evidence"};const l=["success","neutral","skipped"];if(!l.includes(d.conclusion??""))return{status:"failed",evidence:d,reason:"unacceptable_conclusion"};return{status:"passed",evidence:d}}function nativeCheckRequirementsForSource(e,t){return t.requiredChecks.map((r,n)=>{const s={name:r.context,context:r.context,target:e.revisions.targetKind,testedSha:e.revisions.testedSha,acceptableConclusions:["success","neutral","skipped"],sourceConstraint:r.appId===undefined?"unconstrained":"app_id",...r.appId===undefined?{}:{expectedAppId:r.appId}};if(!groupAvailable(e,"checks"))return requirement({id:`${t.idPrefix}.check.${n+1}`,ruleClass:"required_check",authority:t.authority,source:t.sourceIdentity,result:"unknown",severity:"evidence",observed:{...s,resolution:"observation_incomplete"},remediation:`Retrieve complete check/workflow evidence for the native context ${r.context} on ${e.revisions.testedSha}.`});const o=resolveNativeCheckEvidence(e.checks,r.context,e.revisions.testedSha,r.appId);const a=o.status==="passed"||o.status==="failed"?o.evidence:undefined;const c=o.status==="passed"?"passed":o.status==="failed"?"failed":"unknown";const u=a===undefined?{}:{name:a.name,selectedEvidenceRef:(0,i.evidenceReference)(a),selectedConclusion:a.conclusion??"",expectedSourceKind:a.sourceStrength,...a.appId===undefined?{}:{appId:a.appId},...a.checkRunId===undefined?{}:{checkRunId:a.checkRunId},...a.workflowId===undefined?{}:{workflowId:a.workflowId},...a.workflowPath===undefined?{}:{workflowPath:a.workflowPath},...a.workflowRunId===undefined?{}:{workflowRunId:a.workflowRunId},...a.workflowRunAttempt===undefined?{}:{workflowRunAttempt:a.workflowRunAttempt},...a.event===undefined?{}:{event:a.event}};return requirement({id:`${t.idPrefix}.check.${n+1}`,ruleClass:"required_check",authority:t.authority,source:t.sourceIdentity,result:c,severity:o.status==="failed"?"block":"evidence",observed:{...s,resolution:o.status,...o.status==="passed"?{}:{resolutionReason:o.reason},...u},remediation:r.appId===undefined?`Provide a completed ${r.context} check on ${e.revisions.testedSha}; the native control does not declare a source App, so PatchGate still requires an immutable check/workflow identity.`:`Provide a completed ${r.context} check from GitHub App ${r.appId} on ${e.revisions.testedSha}.`,evidenceRefs:a===undefined?[]:[(0,i.evidenceReference)(a)]})})}function nativeCheckRequirements(e){const t=[];const r=e.nativeControls?.branchProtection;if(r!==undefined){const n=e.policySources.find(e=>e.kind==="branch_protection");t.push({authority:"branch_protection",sourceIdentity:n?.identity??"branch-protection",idPrefix:"native.branch_protection",requiredChecks:r.requiredChecks})}for(const r of e.nativeControls?.rulesets??[]){if(r.enforcement!=="active"||!r.applicable)continue;const n=e.policySources.find(e=>e.kind==="ruleset");t.push({authority:"ruleset",sourceIdentity:n?.identity??"repository-rulesets",idPrefix:`native.ruleset.${r.id}`,requiredChecks:r.requiredChecks})}return t.flatMap(t=>nativeCheckRequirementsForSource(e,t))}function nativeReviewRequirements(e){const t=e.nativeControls?.branchProtection;if(t===undefined)return{requirements:[],gates:[]};const r=e.policySources.find(e=>e.kind==="branch_protection");const n=r?.identity??"branch-protection";const s=[];const i=[];const addGate=(e,t,r,o,a,c,u,d)=>{const l={id:e,reason:t,satisfied:a==="passed",requiredReviewers:r,requiredCount:o,approvedBy:d.map(e=>`actor:${e.actorId}`)};i.push(l);s.push(requirement({id:`handoff.${e}`,ruleClass:"human_handoff",authority:"branch_protection",source:n,result:a,severity:a==="failed"?"human_gate":"evidence",observed:c,remediation:u,evidenceRefs:d.map(e=>`review:${e.reviewId}:actor:${e.actorId}:${e.commitId}`)}))};if(t.requiredApprovals>0){if(!groupAvailable(e,"reviews")){addGate("native.branch_protection.required_approvals",`GitHub branch protection requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,"unknown",{requiredCount:t.requiredApprovals,resolution:"observation_incomplete"},"Retrieve complete review and reviewer-qualification evidence before evaluating the native approval gate.",[])}else if(hasUnknownQualification(e.reviews,e.revisions.testedSha,[])){addGate("native.branch_protection.required_approvals",`GitHub branch protection requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,"unknown",{requiredCount:t.requiredApprovals,resolution:"qualification_unavailable"},"Retrieve sufficient collaborator qualification for current approving reviews before evaluating the native approval gate.",[])}else{const r=qualifiedApprovals(e.reviews,e.revisions.testedSha,[]);addGate("native.branch_protection.required_approvals",`GitHub branch protection requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,r.length>=t.requiredApprovals?"passed":"failed",{requiredCount:t.requiredApprovals,approvedCount:r.length},`Obtain ${t.requiredApprovals} active, qualified, non-author approval(s) on ${e.revisions.testedSha}.`,r)}}if(t.requireCodeOwnerReviews){if(!groupAvailable(e,"ownership")){addGate("native.branch_protection.codeowners","GitHub branch protection requires review from the applicable CODEOWNERS.",[],1,"unknown",{resolution:"ownership_observation_incomplete"},"Retrieve complete CODEOWNERS evidence from the trusted base revision before evaluating the native code-owner gate.",[])}else{for(const t of e.ownershipRequirements){const r=`native.branch_protection.codeowners.${t.id}`;if(hasUnknownQualification(e.reviews,e.revisions.testedSha,t.owners)){addGate(r,`GitHub branch protection requires an applicable CODEOWNERS approval for ${t.id}.`,t.owners,t.requiredCount,"unknown",{requiredCount:t.requiredCount,resolution:"qualification_unavailable"},`Retrieve sufficient qualification for the configured CODEOWNERS principal(s): ${t.owners.join(", ")}.`,[]);continue}const n=qualifiedApprovals(e.reviews,e.revisions.testedSha,t.owners);addGate(r,`GitHub branch protection requires an applicable CODEOWNERS approval for ${t.id}.`,t.owners,t.requiredCount,n.length>=t.requiredCount?"passed":"failed",{requiredCount:t.requiredCount,approvedCount:n.length},`Obtain ${t.requiredCount} active, qualified CODEOWNERS approval(s) for ${t.id}.`,n)}}}if(t.requireLastPushApproval){addGate("native.branch_protection.last_push_approval","GitHub branch protection requires approval from someone other than the last pusher.",[],1,"unknown",{resolution:"last_pusher_identity_unavailable"},"Provide immutable last-pusher identity evidence before evaluating this native control; the current PR snapshot does not include it.",[])}return{requirements:s,gates:i}}function nativeRulesetReviewRequirements(e){const t=[];const r=[];const n=e.policySources.find(e=>e.kind==="ruleset");const s=n?.identity??"repository-rulesets";const addGate=(e,n,i,o,a,c,u,d,l)=>{const p=`native.ruleset.${e}.${n}`;r.push({id:p,reason:i,satisfied:c==="passed",requiredReviewers:o,requiredCount:a,approvedBy:l.map(e=>`actor:${e.actorId}`)});t.push(requirement({id:`handoff.${p}`,ruleClass:"human_handoff",authority:"ruleset",source:s,result:c,severity:c==="failed"?"human_gate":"evidence",observed:u,remediation:d,evidenceRefs:l.map(e=>`review:${e.reviewId}:actor:${e.actorId}:${e.commitId}`)}))};for(const t of e.nativeControls?.rulesets??[]){if(t.enforcement!=="active"||!t.applicable)continue;if(t.requiredApprovals>0){if(!groupAvailable(e,"reviews"))addGate(t.id,"required_approvals",`Ruleset ${t.name} requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,"unknown",{requiredCount:t.requiredApprovals,resolution:"observation_incomplete"},"Retrieve complete review and reviewer-qualification evidence before evaluating the ruleset approval gate.",[]);else if(hasUnknownQualification(e.reviews,e.revisions.testedSha,[]))addGate(t.id,"required_approvals",`Ruleset ${t.name} requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,"unknown",{requiredCount:t.requiredApprovals,resolution:"qualification_unavailable"},"Retrieve sufficient collaborator qualification for current approving reviews before evaluating the ruleset approval gate.",[]);else{const r=qualifiedApprovals(e.reviews,e.revisions.testedSha,[]);addGate(t.id,"required_approvals",`Ruleset ${t.name} requires ${t.requiredApprovals} approving review(s).`,[],t.requiredApprovals,r.length>=t.requiredApprovals?"passed":"failed",{requiredCount:t.requiredApprovals,approvedCount:r.length},`Obtain ${t.requiredApprovals} active, qualified, non-author approval(s) on ${e.revisions.testedSha}.`,r)}}if(t.requireCodeOwnerReviews){if(!groupAvailable(e,"ownership"))addGate(t.id,"codeowners",`Ruleset ${t.name} requires applicable CODEOWNERS approval.`,[],1,"unknown",{resolution:"ownership_observation_incomplete"},"Retrieve complete CODEOWNERS evidence from the trusted base revision before evaluating the ruleset code-owner gate.",[]);else for(const r of e.ownershipRequirements){const n=`Ruleset ${t.name} requires applicable CODEOWNERS approval for ${r.id}.`;if(hasUnknownQualification(e.reviews,e.revisions.testedSha,r.owners))addGate(t.id,`codeowners.${r.id}`,n,r.owners,r.requiredCount,"unknown",{requiredCount:r.requiredCount,resolution:"qualification_unavailable"},`Retrieve sufficient qualification for the configured CODEOWNERS principal(s): ${r.owners.join(", ")}.`,[]);else{const s=qualifiedApprovals(e.reviews,e.revisions.testedSha,r.owners);addGate(t.id,`codeowners.${r.id}`,n,r.owners,r.requiredCount,s.length>=r.requiredCount?"passed":"failed",{requiredCount:r.requiredCount,approvedCount:s.length},`Obtain ${r.requiredCount} active, qualified CODEOWNERS approval(s) for ${r.id}.`,s)}}}if(t.requireLastPushApproval)addGate(t.id,"last_push_approval",`Ruleset ${t.name} requires approval from someone other than the last pusher.`,[],1,"unknown",{resolution:"last_pusher_identity_unavailable"},"Provide immutable last-pusher identity evidence before evaluating this ruleset control.",[]);if(t.requiredReviewThreadResolution)addGate(t.id,"review_thread_resolution",`Ruleset ${t.name} requires all review threads to be resolved.`,[],1,"unknown",{resolution:"review_thread_observation_unavailable"},"Provide complete review-thread resolution evidence before evaluating this ruleset control.",[])}return{requirements:t,gates:r}}function ownershipRequirements(e,t){if(!t.ownership?.requireCodeOwnerApproval)return[];if(!hasBasePolicySource(e,"codeowners"))return[observationRequirement("ownership.observation","ownership","Retrieve the complete CODEOWNERS-derived ownership requirement from the trusted base revision and record its source identity.")];if(!groupAvailable(e,"ownership"))return[observationRequirement("ownership.observation","ownership","Retrieve complete CODEOWNERS-derived ownership requirements from the trusted base revision.")];if(e.ownershipRequirements.length===0)return[requirement({id:"ownership.no_match",ruleClass:"ownership",authority:"codeowners",source:"CODEOWNERS@base",result:"passed",severity:"human_gate",observed:{ownershipRequirementCount:0},remediation:"Retain the complete base CODEOWNERS observation proving that no ownership rule matched the changed paths.",evidenceRefs:["observation:ownership"]})];if(!groupAvailable(e,"reviews"))return[observationRequirement("reviews.observation","reviews","Retrieve complete review and reviewer-qualification metadata before evaluating ownership approval.")];if(hasUnknownQualification(e.reviews,e.revisions.testedSha,e.ownershipRequirements.flatMap(e=>e.owners)))return[observationRequirement("reviews.qualification","reviews","Retrieve immutable actor/team qualification and sufficient permission before evaluating ownership approval.")];return e.ownershipRequirements.map(t=>{const r=qualifiedApprovals(e.reviews,e.revisions.testedSha,t.owners);const n=r.length>=t.requiredCount;return requirement({id:`ownership.${t.id}`,ruleClass:"ownership",authority:"codeowners",source:"CODEOWNERS@base",result:n?"passed":"failed",severity:"human_gate",observed:{requiredCount:t.requiredCount,approvedCount:r.length},remediation:`Obtain ${t.requiredCount} active, qualified CODEOWNERS approval on ${e.revisions.testedSha}.`,evidenceRefs:r.map(e=>`review:${e.reviewId}:actor:${e.actorId}:${e.commitId}`)})})}function humanHandoffRequirements(e,t){const r=[];const n=[];if(!groupAvailable(e,"changedPaths")){return{requirements:[observationRequirement("changed_paths.observation","changedPaths","Retrieve the complete changed-path collection before deciding policy-change or sensitive-path matches.")],gates:n}}for(const s of t.sensitivePaths??[]){if(!matchedPath(e.changedPaths,s.patterns))continue;if(!groupAvailable(e,"reviews")){r.push(requirement({id:`handoff.${s.id}`,ruleClass:"human_handoff",authority:"patchgate",source:a,result:"unknown",severity:"evidence",observed:{matched:true,requiredCount:s.requiredCount,resolution:"reviews_unavailable"},remediation:`Retrieve complete qualified-review evidence for sensitive path rule ${s.id}.`}));n.push({id:s.id,reason:`Sensitive path rule matched: ${[...s.patterns].sort().join(", ")}`,satisfied:false,requiredReviewers:s.requiredReviewers,requiredCount:s.requiredCount,approvedBy:[]});continue}if(hasUnknownQualification(e.reviews,e.revisions.testedSha,s.requiredReviewers)){r.push(requirement({id:`handoff.${s.id}`,ruleClass:"human_handoff",authority:"patchgate",source:a,result:"unknown",severity:"evidence",observed:{matched:true,requiredCount:s.requiredCount,resolution:"qualification_unavailable"},remediation:`Retrieve immutable reviewer/team qualification evidence for sensitive path rule ${s.id}.`}));n.push({id:s.id,reason:`Sensitive path rule matched: ${[...s.patterns].sort().join(", ")}`,satisfied:false,requiredReviewers:s.requiredReviewers,requiredCount:s.requiredCount,approvedBy:[]});continue}const t=qualifiedApprovals(e.reviews,e.revisions.testedSha,s.requiredReviewers);const i=t.length>=s.requiredCount;const o={id:s.id,reason:`Sensitive path rule matched: ${[...s.patterns].sort().join(", ")}`,satisfied:i,requiredReviewers:s.requiredReviewers,requiredCount:s.requiredCount,approvedBy:t.map(e=>`actor:${e.actorId}`)};n.push(o);r.push(requirement({id:`handoff.${s.id}`,ruleClass:"human_handoff",authority:"patchgate",source:a,result:i?"passed":"failed",severity:s.humanGate?"human_gate":"block",observed:{matched:true,requiredCount:s.requiredCount,approvedCount:t.length},remediation:`Obtain the configured human approval for ${s.id}; PatchGate cannot force an agent to stop.`,evidenceRefs:t.map(e=>`review:${e.reviewId}:actor:${e.actorId}:${e.commitId}`)}))}if(t.policyChanges!==undefined){if(!matchedPath(e.changedPaths,changedPolicyPaths(e,t)))return{requirements:r,gates:n};const s=t.policyChanges.mode==="advisory"?"advisory":"failed";r.push(requirement({id:"policy.change",ruleClass:"human_handoff",authority:"patchgate",source:a,result:s,severity:t.policyChanges.mode==="blocked"?"block":"human_gate",observed:{changedPaths:e.changedPaths},remediation:"Review and merge the policy change under the trusted base policy; it cannot relax its own PR evaluation.",evidenceRefs:["observation:changedPaths"]}))}return{requirements:r,gates:n}}function reviewabilityRequirements(e,t){if(t.reviewability===undefined)return[];if(!groupAvailable(e,"reviewability")){return[requirement({id:"reviewability.snapshot",ruleClass:"reviewability",authority:"patchgate",source:a,result:t.reviewability.mode==="advisory"?"advisory":"unknown",severity:t.reviewability.mode==="advisory"?"advisory":"evidence",remediation:"Provide a complete reviewability snapshot for the configured mode."})]}if(e.reviewability===undefined){return[requirement({id:"reviewability.snapshot",ruleClass:"reviewability",authority:"patchgate",source:a,result:t.reviewability.mode==="advisory"?"advisory":"unknown",severity:t.reviewability.mode==="advisory"?"advisory":"evidence",remediation:"Provide a normalized reviewability snapshot from the trusted adapter."})]}const r=e.reviewability;const n=[["files",t.reviewability.budgets.maxFiles,r.fileCount,"files"],["ownership_domains",t.reviewability.budgets.maxOwnershipDomains,r.ownershipDomains.length,"ownership domains"],["generated_files",t.reviewability.budgets.maxGeneratedFiles,r.generatedFileCount,"generated files"],["boundaries",t.reviewability.budgets.maxBoundaries,r.boundaryCount,"subsystem boundaries"]];return n.filter(([,e])=>e!==undefined).map(([e,r,n,s])=>{const i=n<=r;return requirement({id:`reviewability.${e}`,ruleClass:"reviewability",authority:"patchgate",source:a,result:i?"passed":t.reviewability?.mode==="blocking"?"failed":"advisory",severity:t.reviewability?.mode==="blocking"?"block":"advisory",observed:{actual:n,limit:r},remediation:`Keep ${s} at or below ${r}, or split the contribution and document the boundary.`,evidenceRefs:["observation:reviewability"]})})}function evaluateValidated(e){const t=policyRequirements(e);const r={requirements:[],gates:[]};t.push(...nativeCheckRequirements(e));const i=nativeReviewRequirements(e);r.requirements.push(...i.requirements);r.gates.push(...i.gates);const a=nativeRulesetReviewRequirements(e);r.requirements.push(...a.requirements);r.gates.push(...a.gates);if(e.policy!==null&&hasPatchgateSource(e)){t.push(...issueRequirements(e,e.policy));t.push(...checkRequirements(e,e.policy));t.push(...ownershipRequirements(e,e.policy));const n=humanHandoffRequirements(e,e.policy);r.requirements.push(...n.requirements);r.gates.push(...n.gates);t.push(...reviewabilityRequirements(e,e.policy))}const c=[...t,...r.requirements].sort(compareIds);const u=structuredClone({schemaVersion:"0.1",evaluatorVersion:o.EVALUATOR_VERSION,repository:e.repository,revisions:e.revisions,policyDigest:e.policyDigest,decisionInputDigest:(0,s.decisionInputDigest)(e),receiptDigest:"sha256:"+"0".repeat(64),changedPaths:e.changedPaths,policySources:e.policySources,observations:e.observations,...e.nativeControls===undefined?{}:{nativeControls:e.nativeControls},evidence:{checks:e.checks,linkedIssues:e.linkedIssues,reviews:e.reviews,ownershipRequirements:e.ownershipRequirements},requirements:c,...e.reviewability===undefined?{}:{reviewability:e.reviewability},humanGates:r.gates.sort(compareIds),final:{status:(0,n.determineFinalStatus)(c),reasonIds:c.filter(e=>e.result!=="passed").map(e=>e.id)}});return{...u,receiptDigest:(0,s.receiptDigest)(u)}}function deliverReceipt(e,t){return{...structuredClone(e),evaluatedAt:t}}},10:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.evaluateValidated=t.deliverReceipt=void 0;t.evaluateContribution=evaluateContribution;const n=r(6875);const s=r(1780);function evaluateContribution(e,t){(0,n.assertEvaluationInput)(e);const r=(0,s.deliverReceipt)((0,s.evaluateValidated)(e),t);(0,n.assertContributionReceipt)(r);return r}var i=r(1780);Object.defineProperty(t,"deliverReceipt",{enumerable:true,get:function(){return i.deliverReceipt}});Object.defineProperty(t,"evaluateValidated",{enumerable:true,get:function(){return i.evaluateValidated}})},1140:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.normalizedPolicyDigest=normalizedPolicyDigest;t.normalizedObservationDigest=normalizedObservationDigest;t.normalizedItemsDigest=normalizedItemsDigest;t.semanticDecisionInput=semanticDecisionInput;t.decisionInputDigest=decisionInputDigest;t.receiptDigest=receiptDigest;const n=r(1552);function sortCanonical(e){return[...e].sort((e,t)=>(0,n.compareTextUnit)((0,n.canonicalJson)(e),(0,n.canonicalJson)(t)))}function sortText(e){return[...e].sort(n.compareTextUnit)}function normalizePolicy(e){if(e===null)return null;return{...e,...e.requiredChecks===undefined?{}:{requiredChecks:sortCanonical(e.requiredChecks.map(e=>({...e,acceptableConclusions:sortText(e.acceptableConclusions)})))},...e.sensitivePaths===undefined?{}:{sensitivePaths:sortCanonical(e.sensitivePaths.map(e=>({...e,patterns:sortText(e.patterns),requiredReviewers:sortText(e.requiredReviewers)})))},...e.policyChanges===undefined?{}:{policyChanges:{...e.policyChanges,paths:sortText(e.policyChanges.paths)}}}}function normalizedPolicyDigest(e){return(0,n.sha256Digest)(normalizePolicy(e))}function semanticObservationMeta(e){const{retrievedAt:t,responseDigest:r,...n}=e;return n}function normalizeObservations(e){return{policySources:sortCanonical(e.policySources.map(semanticObservationMeta)),changedPaths:semanticObservationMeta(e.changedPaths),linkedIssues:semanticObservationMeta(e.linkedIssues),reviews:semanticObservationMeta(e.reviews),checks:semanticObservationMeta(e.checks),ownership:semanticObservationMeta(e.ownership),reviewability:semanticObservationMeta(e.reviewability)}}function normalizedItems(e,t){switch(t){case"policySources":return sortCanonical(e.policySources);case"changedPaths":return sortText(e.changedPaths);case"linkedIssues":return sortCanonical(e.linkedIssues);case"reviews":return sortCanonical(e.reviews.map(e=>({...e,teams:sortText(e.teams),teamIds:[...e.teamIds].sort((e,t)=>e-t)})));case"checks":return sortCanonical(e.checks.map(({retrievedAt:e,...t})=>t));case"ownership":return sortCanonical(e.ownershipRequirements.map(e=>({...e,owners:sortText(e.owners)})));case"reviewability":return e.reviewability===undefined?null:{...e.reviewability,ownershipDomains:sortText(e.reviewability.ownershipDomains)}}}function normalizedObservationDigest(e,t){return(0,n.sha256Digest)(normalizedItems(e,t))}function normalizedItemsDigest(e,t){return(0,n.sha256Digest)(t)}function semanticDecisionInput(e){return{...e,policy:normalizePolicy(e.policy),policySources:sortCanonical(e.policySources),changedPaths:sortText(e.changedPaths),linkedIssues:sortCanonical(e.linkedIssues),reviews:sortCanonical(e.reviews.map(e=>({...e,teams:sortText(e.teams),teamIds:[...e.teamIds].sort((e,t)=>e-t)}))),checks:sortCanonical(e.checks.map(({retrievedAt:e,...t})=>t)),ownershipRequirements:sortCanonical(e.ownershipRequirements.map(e=>({...e,owners:sortText(e.owners)}))),observations:normalizeObservations(e.observations),...e.reviewability===undefined?{}:{reviewability:{...e.reviewability,ownershipDomains:sortText(e.reviewability.ownershipDomains)}}}}function decisionInputDigest(e){return(0,n.sha256Digest)(semanticDecisionInput(e))}function normalizeObserved(e){if(e===undefined)return undefined;return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,Array.isArray(t)?sortText(t):t]))}function receiptDigest(e){const{receiptDigest:t,...r}=e;const s="evaluatedAt"in r?(()=>{const{evaluatedAt:e,...t}=r;return t})():r;const i=s.requirements.map(e=>({...e,...e.observed===undefined?{}:{observed:normalizeObserved(e.observed)},evidenceRefs:sortText(e.evidenceRefs)}));const o=s.humanGates.map(e=>({...e,requiredReviewers:sortText(e.requiredReviewers),approvedBy:sortText(e.approvedBy)}));const a={...s.evidence,checks:sortCanonical(s.evidence.checks.map(({retrievedAt:e,...t})=>t)),linkedIssues:sortCanonical(s.evidence.linkedIssues),reviews:sortCanonical(s.evidence.reviews.map(e=>({...e,teams:sortText(e.teams),teamIds:[...e.teamIds].sort((e,t)=>e-t)}))),ownershipRequirements:sortCanonical(s.evidence.ownershipRequirements.map(e=>({...e,owners:sortText(e.owners)})))};return(0,n.sha256Digest)({...s,changedPaths:sortText(s.changedPaths),policySources:sortCanonical(s.policySources),observations:normalizeObservations(s.observations),requirements:sortCanonical(i),humanGates:sortCanonical(o),final:{...s.final,reasonIds:sortText(s.final.reasonIds)},...s.reviewability===undefined?{}:{reviewability:{...s.reviewability,ownershipDomains:sortText(s.reviewability.ownershipDomains)}},evidence:a})}},5291:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.evidenceReference=evidenceReference;t.resolveCheckEvidence=resolveCheckEvidence;function matchesExpectedSource(e,t){if(e.sourceStrength!==t.kind)return false;if(t.appSlug!==undefined&&e.appSlug!==t.appSlug)return false;if(t.appId!==undefined&&e.appId!==t.appId)return false;if(t.kind==="github_app_expected"){return e.checkRunId!==undefined}if(t.workflowId!==undefined&&e.workflowId!==t.workflowId)return false;if(t.workflowPath!==undefined&&e.workflowPath!==t.workflowPath)return false;if(t.event!==undefined&&e.event!==t.event)return false;return e.workflowRunId!==undefined&&e.workflowRunAttempt!==undefined}function evidenceReference(e){if(e.sourceStrength==="github_app_expected"&&e.checkRunId!==undefined){return`check-run:${e.checkRunId}`}if(e.sourceStrength==="github_actions_workflow"&&e.workflowRunId!==undefined&&e.workflowRunAttempt!==undefined){return`workflow-run:${e.workflowRunId}:attempt:${e.workflowRunAttempt}:check:${encodeURIComponent(e.name)}`}return""}function resolveCheckEvidence(e,t,r){if(r===undefined)return{status:"missing",reason:"wrong_target"};const n=e.filter(e=>e.name===t.name);if(n.length===0)return{status:"missing",reason:"no_candidate"};const s=n.filter(e=>e.testedSha===r);if(s.length===0)return{status:"missing",reason:"wrong_target"};const i=s.filter(e=>matchesExpectedSource(e,t.expectedSource));if(i.length===0)return{status:"missing",reason:"wrong_source"};if(i.length>1)return{status:"ambiguous",reason:"duplicate_eligible_candidates"};const o=i[0];if(o===undefined)return{status:"missing",reason:"no_candidate"};if(o.status!=="completed")return{status:"missing",reason:"pending"};if(!t.acceptableConclusions.includes(o.conclusion??"")){return{status:"failed",evidence:o,reason:"unacceptable_conclusion"}}return{status:"passed",evidence:o}}},2823:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.GITHUB_ACCEPT=t.GITHUB_API_ORIGIN=t.GITHUB_API_VERSION=void 0;t.isRecord=isRecord;t.readString=readString;t.readPositiveInt=readPositiveInt;t.hasArray=hasArray;t.GITHUB_API_VERSION="2026-03-10";t.GITHUB_API_ORIGIN="https://api.github.com";t.GITHUB_ACCEPT="application/vnd.github+json";function isRecord(e){return e!==null&&typeof e==="object"&&!Array.isArray(e)}function readString(e,t){if(!isRecord(e))return undefined;const r=e[t];return typeof r==="string"?r:undefined}function readPositiveInt(e,t){if(!isRecord(e))return undefined;const r=e[t];return typeof r==="number"&&Number.isInteger(r)&&r>0?r:undefined}function hasArray(e,t){return isRecord(e)&&Array.isArray(e[t])}},4835:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectBranchProtection=collectBranchProtection;const n=r(1552);const s=r(2823);const i=r(2355);function parseProtection(e){if(!(0,s.isRecord)(e))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection response was not an object.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(!("required_status_checks"in e)||!("required_pull_request_reviews"in e))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection response omitted required native-control fields.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(e.required_status_checks!==null&&!(0,s.isRecord)(e.required_status_checks))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection required status checks had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(e.required_pull_request_reviews!==null&&!(0,s.isRecord)(e.required_pull_request_reviews))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection review settings had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));const t=(0,s.isRecord)(e.required_status_checks)&&e.required_status_checks!==null?e.required_status_checks:null;const r=(0,s.isRecord)(e.required_pull_request_reviews)&&e.required_pull_request_reviews!==null?e.required_pull_request_reviews:null;if(t!==null&&t.strict!==undefined&&typeof t.strict!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection strict status checking had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(t!==null&&t.contexts!==undefined&&(!Array.isArray(t.contexts)||t.contexts.some(e=>typeof e!=="string"||e.trim().length===0)))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection status-check contexts had an invalid entry.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(t!==null&&t.checks!==undefined&&(!Array.isArray(t.checks)||t.checks.some(e=>!(0,s.isRecord)(e)||typeof e.context!=="string"||e.app_id!==undefined&&e.app_id!==null&&(typeof e.app_id!=="number"||!Number.isInteger(e.app_id)||e.app_id<1))))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection status-check entries had an invalid entry.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.dismiss_stale_reviews!==undefined&&typeof r.dismiss_stale_reviews!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection stale-review setting had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.require_code_owner_reviews!==undefined&&typeof r.require_code_owner_reviews!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection code-owner setting had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.required_approving_review_count!==undefined&&(typeof r.required_approving_review_count!=="number"||!Number.isInteger(r.required_approving_review_count)||r.required_approving_review_count<0))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection approval count had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.require_last_push_approval!==undefined&&typeof r.require_last_push_approval!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection last-push approval setting had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(r!==null&&r.bypass_pull_request_allowances!==undefined&&!(0,s.isRecord)(r.bypass_pull_request_allowances))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection review bypass allowances had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));if(e.bypass_pull_request_allowances!==undefined&&!(0,s.isRecord)(e.bypass_pull_request_allowances))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection bypass allowances had an invalid shape.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2}));const n=t===null?null:{...typeof t.strict==="boolean"?{strict:t.strict}:{},...Array.isArray(t.contexts)?{contexts:t.contexts}:{},...Array.isArray(t.checks)?{checks:t.checks.map(e=>({context:e.context,...typeof e.app_id==="number"?{app_id:e.app_id}:{}}))}:{}};const o=r===null?null:{...typeof r.dismiss_stale_reviews==="boolean"?{dismiss_stale_reviews:r.dismiss_stale_reviews}:{},...typeof r.require_code_owner_reviews==="boolean"?{require_code_owner_reviews:r.require_code_owner_reviews}:{},...typeof r.required_approving_review_count==="number"?{required_approving_review_count:r.required_approving_review_count}:{},...typeof r.require_last_push_approval==="boolean"?{require_last_push_approval:r.require_last_push_approval}:{},...(0,s.isRecord)(r.bypass_pull_request_allowances)?{bypass_pull_request_allowances:r.bypass_pull_request_allowances}:{}};return{required_status_checks:n,required_pull_request_reviews:o,...(0,s.isRecord)(e.bypass_pull_request_allowances)?{bypass_pull_request_allowances:e.bypass_pull_request_allowances}:{}}}async function collectBranchProtection(e,t,r,s,o,a=false,c="collection"){const u=new Date(e.clock.now()).toISOString();const d=await e.request({method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/branches/${encodeURIComponent(s)}/protection`},"branch protection",c);if(d.status===404&&a)return{meta:{source:{kind:"github",identity:"branch-protection"},revision:o,retrievedAt:u,complete:true,permissionState:"sufficient",responseDigest:(0,n.sha256Digest)(d.body)},diagnostics:[],decisionBearing:false};if(d.status===403||d.status===404)return{meta:{source:{kind:"github",identity:"branch-protection"},revision:o,retrievedAt:u,complete:false,permissionState:d.status===403?"insufficient":"unknown"},diagnostics:[(0,i.makeDiagnostic)(d.status===403?"GITHUB_PERMISSION_INSUFFICIENT":"GITHUB_RESOURCE_NOT_VISIBLE","Branch-protection visibility is not sufficient to prove native control absence.",{observation:"branchProtection",permissionState:d.status===403?"insufficient":"unknown",remediation:"Grant the documented read capability or keep the native-control snapshot rejected."})],decisionBearing:false};try{const e=parseProtection(d.body);const t=new Map;for(const r of e.required_status_checks?.checks??[]){if(r.context===undefined)continue;const e=t.get(r.context);if(e===undefined||e.appId===undefined&&r.app_id!==undefined&&r.app_id!==null){t.set(r.context,{context:r.context,...r.app_id===undefined||r.app_id===null?{}:{appId:r.app_id}})}}for(const r of e.required_status_checks?.contexts??[])if(!t.has(r))t.set(r,{context:r});const r=[...t.values()].sort((e,t)=>(0,n.compareTextUnit)(e.context,t.context)||(e.appId??0)-(t.appId??0));const i=e.required_pull_request_reviews;const a={requiredChecks:r,requiredApprovals:i?.required_approving_review_count??0,requireCodeOwnerReviews:i?.require_code_owner_reviews??false,requireLastPushApproval:i?.require_last_push_approval??false,staleReviews:i?.dismiss_stale_reviews??false,requiredReviewThreadResolution:false,bypassVisible:i?.bypass_pull_request_allowances!==undefined,decisionBearing:r.length>0||(i?.required_approving_review_count??0)>0||i?.require_code_owner_reviews===true||i?.require_last_push_approval===true};return{protection:a,source:{kind:"branch_protection",identity:`branch-protection:${s}`,revision:o,digest:(0,n.sha256Digest)(a),authority:"enforced"},meta:{source:{kind:"github",identity:"branch-protection"},revision:o,retrievedAt:u,complete:true,permissionState:"sufficient",responseDigest:(0,n.sha256Digest)(d.body)},diagnostics:[],decisionBearing:a.decisionBearing}}catch(e){const t=e instanceof i.GitHubAdapterError?e.diagnostic:(0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Branch-protection normalization failed.",{observation:"branchProtection",snapshotEvaluable:false,exitCode:2});return{meta:{source:{kind:"github",identity:"branch-protection"},revision:o,retrievedAt:u,complete:false,permissionState:t.permissionState},diagnostics:[t],decisionBearing:false}}}},1165:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.capabilityReport=capabilityReport;function capabilityReport(e,t,r,n,s,i){return{authKind:t,apiOrigin:r,apiVersion:n,...e===undefined?{}:{repository:{owner:e.owner,name:e.name,repositoryId:e.repositoryId},target:{pullRequest:e.pullRequestNumber,baseSha:e.baseSha,headSha:e.headSha,testedSha:e.testedSha,targetKind:e.targetKind}},observations:s,diagnostics:i,supportedPlatform:r==="https://api.github.com"?"github.com":"ghes_unsupported"}}},3538:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectChangedPaths=collectChangedPaths;const n=r(1552);const s=r(2823);const i=r(6299);const o=r(2355);const a=r(1914);function normalizePath(e,t){const r=(0,a.safeAllowlistedString)(e,t,1e5);if(r.startsWith("/")||/^[A-Za-z]:[\\/]/.test(r)||r.includes("\0")||r.split(/[\\/]/).some(e=>e===".."||e==="."))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_PATH_INVALID",`${t} is absolute or traversal-shaped.`,{observation:"changedPaths",remediation:"Discard the snapshot and inspect the GitHub changed-file response."}));return r}function parseFiles(e){if(!Array.isArray(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The changed-files response was not an array.",{observation:"changedPaths",snapshotEvaluable:false,exitCode:2}));return e.map((e,t)=>{if(!(0,s.isRecord)(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Changed-file item ${t} was not an object.`,{observation:"changedPaths",snapshotEvaluable:false,exitCode:2}));const r=(0,s.readString)(e,"filename");const n=(0,s.readString)(e,"status");if(r===undefined||n===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Changed-file item ${t} lacked filename or status.`,{observation:"changedPaths",snapshotEvaluable:false,exitCode:2}));const i=(0,s.readString)(e,"previous_filename");return{path:normalizePath(r,`changed file ${t}`),status:(0,a.safeAllowlistedString)(n,`changed file ${t} status`,64),...i===undefined?{}:{previousPath:normalizePath(i,`renamed file ${t}`)}}})}function pageCollectionToResult(e,t,r){const s=new Set;for(const t of e.items){s.add(t.path);if(t.previousPath!==undefined)s.add(t.previousPath)}let i=e.complete;const a=[...e.diagnostics];if(e.items.length>=3e3){i=false;t.budget.recordCap("github_file_ceiling_3000");a.push((0,o.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","GitHub file retrieval reached the documented 3,000-file ceiling; completeness cannot be proven.",{observation:"changedPaths",remediation:"Split the pull request or use a deliberately supported larger-file retrieval strategy."}))}const c=[...e.items].sort((e,t)=>(0,n.compareTextUnit)(e.path,t.path)||(0,n.compareTextUnit)(e.status,t.status));return{files:c,paths:[...s].sort(),meta:{source:{kind:"github",identity:"pull-request-files"},revision:r,retrievedAt:new Date(t.clock.now()).toISOString(),complete:i,permissionState:e.permissionState,responseDigest:(0,n.sha256Digest)(e.pageDigests)},diagnostics:a}}async function collectChangedPaths(e,t,r,n,s,o="collection"){const a=await(0,i.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/pulls/${n}/files`,query:{per_page:100}},"changedPaths",parseFiles,e=>`${e.path}\0${e.previousPath??""}`,{phase:o});return pageCollectionToResult(a,e,s)}},6250:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectChecks=collectChecks;const n=r(1552);const s=r(2823);const i=r(6299);const o=r(7665);const a=r(2355);const c=r(1914);function parseCheckRuns(e){if(!(0,s.isRecord)(e)||!Array.isArray(e.check_runs))throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The check-runs response was malformed.",{observation:"checks",snapshotEvaluable:false,exitCode:2}));const t=(0,s.readPositiveInt)(e,"total_count");if(t!==undefined&&t>1e3)throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","The check-runs response cannot prove all check suites beyond GitHub's 1,000-suite limit.",{observation:"checks"}));return e.check_runs.map((e,t)=>{if(!(0,s.isRecord)(e))throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Check run ${t} was malformed.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));const r=(0,s.readPositiveInt)(e,"id");const n=(0,s.readString)(e,"name");const i=(0,s.readString)(e,"status");const o=(0,s.readString)(e,"head_sha");if(r===undefined||n===undefined||i===undefined||o===undefined)throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Check run ${t} lacked immutable identity fields.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));if(i!=="queued"&&i!=="in_progress"&&i!=="completed")throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Check run ${r} had an unsupported status.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));const u=(0,s.readString)(e,"conclusion");const d=(0,s.isRecord)(e.app)?{id:(0,s.readPositiveInt)(e.app,"id"),slug:(0,s.readString)(e.app,"slug")}:undefined;const l=(0,s.isRecord)(e.check_suite)?{id:(0,s.readPositiveInt)(e.check_suite,"id")}:undefined;if(l?.id===undefined)throw new a.GitHubAdapterError((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Check run ${r} lacked an immutable check-suite relation.`,{observation:"checks"}));return{id:r,name:(0,c.safeAllowlistedString)(n,`check ${r} name`,500),status:i,head_sha:o,...u===undefined?{}:{conclusion:u},...d===undefined?{}:{app:{...d.id===undefined?{}:{id:d.id},...d.slug===undefined?{}:{slug:d.slug}}},check_suite:{id:l.id}}})}function workflowsForCheck(e,t){const r=e.check_suite?.id;return t.filter(t=>t.check_suite_id===r&&t.head_sha===e.head_sha)}function isActionsApp(e,t){return e===15368&&t?.toLowerCase()==="github-actions"}async function collectChecks(e,t,r,s,c="collection"){const u=new Date(e.clock.now()).toISOString();const d=[];const l=await(0,i.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/commits/${encodeURIComponent(s)}/check-runs`,query:{per_page:100,filter:"all"}},"checks",parseCheckRuns,e=>String(e.id),{phase:c});const p=await(0,o.collectWorkflowRuns)(e,t,r,s,c);d.push(...l.diagnostics,...p.diagnostics);const f=[];const h=new Set;const m=new Set;for(const e of l.items){if(h.has(e.id)){d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Duplicate check-run identity ${e.id} was returned.`,{observation:"checks"}));continue}h.add(e.id);if(e.head_sha!==s)continue;const t=workflowsForCheck(e,p.items);if(t.length>1){d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Check run ${e.id} matched multiple workflow run attempts for the same immutable suite and SHA.`,{observation:"checks",remediation:"Use a documented immutable rerun selector or keep workflow evidence incomplete."}))}const r=t.length===1?t[0]:undefined;const n=t.length>1;if(r!==undefined){const t=`${r.id}:${r.run_attempt}:${e.name}`;if(m.has(t))d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Duplicate workflow run identity ${t} was returned.`,{observation:"checks"}));m.add(t)}const i=e.app?.id;const o=e.app?.slug;const c=i===15368!==(o?.toLowerCase()==="github-actions");if(c)d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Check run ${e.id} reported a partial GitHub Actions App identity.`,{observation:"checks",remediation:"Require the immutable GitHub Actions App ID and slug pair before accepting workflow evidence."}));if(r!==undefined&&i!==undefined&&isActionsApp(i,o)&&!c){f.push({name:e.name,status:e.status,...e.conclusion===undefined||e.conclusion===null?{}:{conclusion:e.conclusion},testedSha:e.head_sha,...o===undefined?{}:{appSlug:o},appId:i,checkRunId:e.id,checkSuiteId:e.check_suite?.id,workflowId:r.workflow_id,...r.path===undefined?{}:{workflowPath:r.path},workflowRunId:r.id,workflowRunAttempt:r.run_attempt,event:r.event,sourceStrength:"github_actions_workflow",retrievedAt:u})}else if(r!==undefined&&i!==undefined){d.push((0,a.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`Check run ${e.id} had a workflow relation but its App identity was not the GitHub Actions allowlist entry.`,{observation:"checks",remediation:"Verify the immutable GitHub Actions App identity before using workflow-bound evidence."}));f.push({name:e.name,status:e.status,...e.conclusion===undefined||e.conclusion===null?{}:{conclusion:e.conclusion},testedSha:e.head_sha,checkSuiteId:e.check_suite?.id,sourceStrength:"unattributed",retrievedAt:u})}else if(i!==undefined&&!n&&!isActionsApp(i,o)){f.push({name:e.name,status:e.status,...e.conclusion===undefined||e.conclusion===null?{}:{conclusion:e.conclusion},testedSha:e.head_sha,...o===undefined?{}:{appSlug:o},appId:i,checkRunId:e.id,checkSuiteId:e.check_suite?.id,sourceStrength:"github_app_expected",retrievedAt:u})}else{f.push({name:e.name,status:e.status,...e.conclusion===undefined||e.conclusion===null?{}:{conclusion:e.conclusion},testedSha:e.head_sha,checkSuiteId:e.check_suite?.id,sourceStrength:"unattributed",retrievedAt:u})}}const g=l.complete&&p.complete&&d.length===0;const v={source:{kind:"github",identity:"check-runs"},revision:s,retrievedAt:u,complete:l.complete,permissionState:l.permissionState,responseDigest:(0,n.sha256Digest)(l.pageDigests)};const y={source:{kind:"github",identity:"workflow-runs"},revision:s,retrievedAt:u,complete:p.complete,permissionState:p.permissionState,responseDigest:(0,n.sha256Digest)(p.pageDigests)};return{checks:f,checkRunsMeta:v,workflowMeta:y,meta:{source:{kind:"github",identity:"check-runs+workflow-runs"},revision:s,retrievedAt:u,complete:g,permissionState:l.permissionState==="sufficient"&&p.permissionState==="sufficient"&&g?"sufficient":l.permissionState==="insufficient"||p.permissionState==="insufficient"?"insufficient":"unknown",responseDigest:(0,n.sha256Digest)({checkPages:l.pageDigests,workflowPages:p.pageDigests})},diagnostics:d}}},6584:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.GitHubClient=void 0;t.createFetchTransport=createFetchTransport;const n=r(2355);const s=r(2823);const i=r(5254);const o=r(8129);const a={pullRequestClosingIssues:`query PullRequestClosingIssues($owner: String!, $name: String!, $number: Int!, $first: Int!, $after: String) { repository(owner: $owner, name: $name) { pullRequest(number: $number) { closingIssuesReferences(first: $first, after: $after, userLinkedOnly: true) { nodes { id repository { nameWithOwner id } number } pageInfo { hasNextPage endCursor } } } } }`};const c=new Set(["link","etag","last-modified","x-ratelimit-remaining","x-ratelimit-reset","x-ratelimit-resource","retry-after","x-github-api-version","content-type","location"]);function trustedOrigin(e){const t=new URL(e);if(t.protocol!=="https:"||t.username.length>0||t.password.length>0||t.pathname!=="/"||t.search.length>0||t.hash.length>0)throw new Error("GitHub API origin must be a trusted HTTPS origin without credentials or path components");return t.origin}function safeHeaders(e){const t={};for(const[r,n]of e.entries()){const e=r.toLowerCase();if(!c.has(e))continue;if(e==="link")t.link=n;else if(e==="etag")t.etag=n;else if(e==="last-modified")t["last-modified"]=n;else if(e==="x-ratelimit-remaining")t["x-ratelimit-remaining"]=n;else if(e==="x-ratelimit-reset")t["x-ratelimit-reset"]=n;else if(e==="x-ratelimit-resource")t["x-ratelimit-resource"]=n;else if(e==="retry-after")t["retry-after"]=n;else if(e==="x-github-api-version")t["x-github-api-version"]=n;else if(e==="content-type")t["content-type"]=n;else if(e==="location")t.location=n}return t}function parseBody(e,t){if(e.length===0)return null;if(t?.toLowerCase().includes("json")||e.trimStart().startsWith("{")||e.trimStart().startsWith("[")){try{return JSON.parse(e)}catch{return e}}return e}function encodeRequestUrl(e,t){if(!t.path.startsWith("/")||t.path.startsWith("//")||t.path.includes("\0"))throw new Error("GitHub request path is invalid");const r=new URL(t.path,e);if(r.origin!==e||r.protocol!=="https:"||r.username.length>0||r.password.length>0)throw new Error("GitHub request origin is not trusted");if(t.query!==undefined){for(const[e,n]of Object.entries(t.query))r.searchParams.set(e,String(n))}return r}function createFetchTransport(e={}){const t=e.origin??s.GITHUB_API_ORIGIN;const r=trustedOrigin(t);const i=e.apiVersion??s.GITHUB_API_VERSION;const o=e.userAgent??"patchgate-github-adapter/0.1";const c=e.maxResponseBytes??2*1024*1024;const u=15e3;return{async request(t){if(t.method==="GET"&&(t.operation!==undefined||t.variables!==undefined))throw new Error("GET request cannot carry a GraphQL operation");const d=encodeRequestUrl(r,t);const l=new Headers({Accept:s.GITHUB_ACCEPT,"X-GitHub-Api-Version":i,"User-Agent":o});if(e.token!==undefined)l.set("Authorization",`Bearer ${e.token}`);if(t.method==="POST"){if(t.operation!=="pullRequestClosingIssues"||t.path!=="/graphql"||t.variables===undefined)throw new Error("GraphQL operation is not allowlisted");l.set("Content-Type","application/json")}const p=new AbortController;const f=setTimeout(()=>p.abort(),u);try{const e=await fetch(d,{method:t.method,headers:l,redirect:"manual",signal:p.signal,...t.method==="POST"?{body:JSON.stringify({query:a.pullRequestClosingIssues,operationName:"PullRequestClosingIssues",variables:t.variables})}:{}});const r=new Uint8Array(await e.arrayBuffer());if(r.byteLength>c)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_TOO_LARGE","GitHub response exceeded the configured byte budget.",{remediation:"Reduce the requested collection or raise the bounded response limit after review."}));const s=new TextDecoder("utf-8",{fatal:false}).decode(r);return{status:e.status,headers:safeHeaders(e.headers),body:parseBody(s,e.headers.get("content-type")??undefined),bytes:r.byteLength}}catch(e){if(e instanceof n.GitHubAdapterError)throw e;if(e instanceof Error&&e.name==="AbortError")throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_TIMEOUT","GitHub request timed out.",{retryable:true}));throw e}finally{clearTimeout(f)}}}}class GitHubClient{transport;budget;origin;apiVersion;authKind;clock;constructor(e,t=new i.BudgetLedger,r={}){this.transport=e;this.budget=t;this.origin=trustedOrigin(r.origin??s.GITHUB_API_ORIGIN);this.apiVersion=r.apiVersion??s.GITHUB_API_VERSION;this.authKind=r.token===undefined?"mock":"authenticated_token";this.clock=r.clock??{now:()=>Date.now(),sleep:async e=>new Promise(t=>setTimeout(t,e))}}async request(e,t,r="collection"){if(e.method==="POST"&&(e.path!=="/graphql"||e.operation!=="pullRequestClosingIssues"||e.variables===undefined))throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_API_UNSUPPORTED","The requested POST operation is not allowlisted.",{remediation:"Use only the documented read-only GraphQL operation."}));if(e.method==="GET"&&(e.operation!==undefined||e.variables!==undefined))throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_API_UNSUPPORTED","The requested GET operation carried unexpected GraphQL data.",{remediation:"Use a plain allowlisted REST GET request."}));let s=0;while(true){this.budget.beginRequest(r);try{const r=await this.transport.request(e);if(!Number.isInteger(r.bytes)||r.bytes<0||r.bytes>this.budget.limits.maxResponseBytes)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_TOO_LARGE","The injected GitHub response exceeded the configured response byte budget.",{remediation:"Discard the response and keep the bounded response limit enforced by the transport."}));this.budget.recordResponseBytes(r.bytes);const i=r.headers["x-ratelimit-remaining"]===undefined?undefined:Number(r.headers["x-ratelimit-remaining"]);const a=r.headers["x-ratelimit-reset"]===undefined?undefined:Number(r.headers["x-ratelimit-reset"]);this.budget.recordRateLimit(Number.isFinite(i)?i:undefined,Number.isFinite(a)?a:undefined,r.headers["x-ratelimit-resource"]);if(r.status===304)this.budget.recordConditional(true);if(r.status>=200&&r.status<300){this.budget.recordSuccess();return r}if(r.status===401)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_AUTH_INVALID","GitHub rejected the configured credential.",{remediation:"Use a read-only credential with the documented repository and organization permissions."}));if(r.status===304)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_CACHE_IDENTITY_MISMATCH","GitHub returned 304 but no validated authenticated cache body is available for reuse.",{remediation:"Retry without conditional cache state or use the deferred no-cache adapter path."}));if(r.status===302||r.status>=300&&r.status<400)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_REDIRECT","GitHub returned a redirect; the adapter never follows redirects.",{remediation:"Use the configured GitHub API origin and inspect the endpoint configuration."}));const c=r.status===429||r.status===403&&(r.headers["retry-after"]!==undefined||r.headers["x-ratelimit-remaining"]==="0");const u=c||r.status>=500;if(u&&s<this.budget.limits.maxRetriesPerRequest){s+=1;await(0,o.boundedRetryDelay)(c?r.headers["retry-after"]===undefined?"primary_rate_limit":"secondary_rate_limit":"server_5xx",r.headers,this.budget,this.clock);continue}this.budget.recordFailure();if(c)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RATE_LIMITED",`GitHub rate-limited the ${t} request.`,{remediation:"Wait for the bounded reset/retry window and rerun the snapshot.",permissionState:"unknown"}));if(r.status===403)return r;if(r.status===404)return r;throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`GitHub returned HTTP ${r.status} for the ${t} request.`,{remediation:"Inspect the endpoint capability and rerun against the same immutable target."}))}catch(e){if(e instanceof n.GitHubAdapterError){if(e.diagnostic.retryable&&s<this.budget.limits.maxRetriesPerRequest){s+=1;await(0,o.boundedRetryDelay)(e.diagnostic.id==="GITHUB_TIMEOUT"?"network_timeout":"server_5xx",{},this.budget,this.clock);continue}this.budget.recordFailure();throw e}this.budget.recordFailure();throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The injected GitHub transport failed without a safe response.",{snapshotEvaluable:false,exitCode:2}))}}}}t.GitHubClient=GitHubClient},3506:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectCodeowners=collectCodeowners;const n=r(2823);const s=r(2355);const i=r(1914);const o=r(1552);const a=[".github/CODEOWNERS","CODEOWNERS","docs/CODEOWNERS"];function tokenize(e){const t=[];let r="";let n=false;for(const s of e){if(n){r+=s;n=false;continue}if(s==="\\"){n=true;continue}if(/\s/.test(s)){if(r.length>0){t.push(r);r=""}continue}r+=s}if(n)r+="\\";if(r.length>0)t.push(r);return t}function parseRules(e){const t=[];const r=[];e.split(/\r?\n/).forEach((e,n)=>{const o=[...e].findIndex((t,r)=>t==="#"&&(r===0||/\s/.test(e[r-1]??"")));const a=o>=0?e.slice(0,o):e;if(a.trim().length===0)return;const c=tokenize(a);if(c.length<2){r.push((0,s.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`CODEOWNERS line ${n+1} is invalid under the supported subset.`,{observation:"ownership",remediation:"Use a valid CODEOWNERS pattern followed by at least one owner."}));return}const u=c[0];if(u.startsWith("!")||u.includes("[")||u.includes("]")||u.includes("?")){r.push((0,s.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`CODEOWNERS line ${n+1} uses syntax outside the declared safe subset.`,{observation:"ownership",remediation:"Avoid negation, character classes, and unsupported wildcard syntax until a full conformance parser is adopted."}));return}const d=c.slice(1).map(e=>(0,i.safeAllowlistedString)(e,`CODEOWNERS line ${n+1} owner`,500));if(d.some(e=>e.startsWith("@")&&!e.slice(1).includes("/")&&e.slice(1).length===0)){r.push((0,s.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`CODEOWNERS line ${n+1} contains an empty owner.`,{observation:"ownership"}));return}t.push({pattern:(0,i.safeAllowlistedString)(u,`CODEOWNERS line ${n+1} pattern`,1e5),owners:d,line:n+1})});return{rules:t,diagnostics:r}}function patternRegExp(e){const t=e.startsWith("/");const r=e.replace(/^\//,"").replace(/\/$/,"/**");const n=r.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\0").replace(/\*/g,"[^/]*").replace(/\u0000/g,".*");return new RegExp(t||r.includes("/")?`^${n}$`:`^(?:.*/)?${n}$`)}function matchedOwners(e,t){let r=[];for(const n of e)if(patternRegExp(n.pattern).test(t))r=n.owners;return r}function decodeContent(e,t,r){if(!(0,n.isRecord)(e))throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS response for ${t} was not an object.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}));const i=(0,n.readString)(e,"content");const o=(0,n.readString)(e,"encoding");const a=(0,n.readPositiveInt)(e,"size");if((0,n.readString)(e,"path")!==t||i===undefined||o!=="base64"||a===undefined)throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS response for ${t} had an unexpected encoding or identity.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}));if(a>r)throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_TOO_LARGE",`CODEOWNERS ${t} exceeded the response cap.`,{observation:"ownership"}));const c=i.replace(/\s+/g,"");if(!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(c))throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS ${t} was not valid base64.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}));const u=Buffer.from(c,"base64");if(u.length!==a)throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS ${t} size did not match its bytes.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}));try{return new TextDecoder("utf-8",{fatal:true}).decode(u)}catch{throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`CODEOWNERS ${t} was not valid UTF-8.`,{observation:"ownership",snapshotEvaluable:false,exitCode:2}))}}async function collectCodeowners(e,t,r,n,i,c=false,u="collection"){const d=new Date(e.clock.now()).toISOString();const l=[];let p;let f;let h;for(const i of a){const a=await e.request({method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/contents/${i.split("/").map(encodeURIComponent).join("/")}`,query:{ref:n}},`CODEOWNERS:${i}`,u);if(a.status===200){p=i;f=decodeContent(a.body,i,e.budget.limits.maxResponseBytes);h=(0,o.sha256Text)(f);break}if(a.status===403){l.push((0,s.makeDiagnostic)("GITHUB_PERMISSION_INSUFFICIENT",`GitHub denied CODEOWNERS lookup at ${i}.`,{observation:"ownership",permissionState:"insufficient"}));break}if(a.status!==404||!c){l.push((0,s.makeDiagnostic)("GITHUB_RESOURCE_NOT_VISIBLE",`CODEOWNERS lookup at ${i} was not proven absent.`,{observation:"ownership",permissionState:"unknown"}));break}}if(f===undefined||p===undefined||h===undefined){const e=c&&l.length===0;return{requirements:[],meta:{source:{kind:"github",identity:"codeowners"},revision:n,retrievedAt:d,complete:e,permissionState:e?"sufficient":l.some(e=>e.permissionState==="insufficient")?"insufficient":"unknown",responseDigest:(0,o.sha256Digest)(l)},diagnostics:l}}const m=parseRules(f);l.push(...m.diagnostics);const g=new Map;for(const e of i){const t=matchedOwners(m.rules,e);if(t.length===0)continue;if(t.some(e=>e.startsWith("@")&&!e.slice(1).includes("/")&&e.slice(1).length>0))l.push((0,s.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`CODEOWNERS owner syntax without an organization-qualified team is not used for authenticated qualification: ${t.join(", ")}.`,{observation:"ownership",remediation:"Use @org/team for team owners or a user owner that can be qualified through the collaborator endpoint."}));const r=JSON.stringify([...t].sort());const n=g.get(r)??[];n.push(e);g.set(r,n)}const v=[...g.entries()].sort(([e],[t])=>(0,o.compareTextUnit)(e,t)).map(([e],t)=>({id:`codeowners.${t+1}`,owners:JSON.parse(e),requiredCount:1}));const y=l.length===0;return{requirements:v,selectedPath:p,source:{kind:"codeowners",identity:p,revision:n,digest:h,authority:"enforced"},meta:{source:{kind:"github",identity:p},revision:n,retrievedAt:d,complete:y,permissionState:y?"sufficient":"unknown",responseDigest:(0,o.sha256Digest)({rawDigest:h,rules:m.rules})},diagnostics:l}}},2355:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.GitHubAdapterError=void 0;t.makeDiagnostic=makeDiagnostic;t.diagnosticFrom=diagnosticFrom;const r="Inspect the authenticated read-only capability and rerun the snapshot against the same target SHA.";function makeDiagnostic(e,t,n={}){const s=n.snapshotEvaluable??true;return{id:e,message:t,remediation:n.remediation??r,...n.observation===undefined?{}:{observation:n.observation},complete:n.complete??false,permissionState:n.permissionState??"unknown",retryable:n.retryable??false,snapshotEvaluable:s,exitCode:n.exitCode??(s?1:2)}}class GitHubAdapterError extends Error{diagnostic;constructor(e){super(e.message);this.name="GitHubAdapterError";this.diagnostic=e}}t.GitHubAdapterError=GitHubAdapterError;function diagnosticFrom(e,t="GITHUB_RESPONSE_MALFORMED"){if(e instanceof GitHubAdapterError)return e.diagnostic;const r=e instanceof Error?e.message:"GitHub adapter operation failed";return makeDiagnostic(t,r,{snapshotEvaluable:false,exitCode:2})}},7369:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.resolvePullRequestIdentity=resolvePullRequestIdentity;t.sameSnapshotIdentity=sameSnapshotIdentity;const n=r(1552);const s=r(1914);const i=r(2823);const o=r(2355);function requireObject(e,t){if(!(0,i.isRecord)(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`${t} response was not an object.`,{snapshotEvaluable:false,exitCode:2}));return e}function parseRepository(e){const t=requireObject(e,"repository");const r=(0,i.readPositiveInt)(t,"id");const n=(0,i.readString)(t,"name");const s=(0,i.readString)(t,"full_name");if(r===undefined||n===undefined||s===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Repository identity fields were missing.",{snapshotEvaluable:false,exitCode:2}));const a=(0,i.readString)(t,"default_branch");return{id:r,name:n,full_name:s,...a===undefined?{}:{default_branch:a}}}function parseUser(e){if(!(0,i.isRecord)(e))return undefined;const t=(0,i.readPositiveInt)(e,"id");const r=(0,i.readString)(e,"login");if(t===undefined||r===undefined)return undefined;const n=(0,i.readString)(e,"type");return{id:t,login:r,...n===undefined?{}:{type:n}}}function parseRepositoryRef(e,t){const r=requireObject(e,t);const n=(0,i.readPositiveInt)(r,"id");if(n===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`${t} repository ID was missing.`,{snapshotEvaluable:false,exitCode:2}));const s=(0,i.readString)(r,"full_name");const a=(0,i.readString)(r,"name");return{id:n,...s===undefined?{}:{full_name:s},...a===undefined?{}:{name:a}}}function parsePullRequest(e){const t=requireObject(e,"pull request");const r=(0,i.readPositiveInt)(t,"id");const n=(0,i.readPositiveInt)(t,"number");const a=requireObject(t.base,"pull request base");const c=requireObject(t.head,"pull request head");const u=(0,i.readString)(a,"ref");const d=(0,i.readString)(a,"sha");const l=(0,i.readString)(c,"ref");const p=(0,i.readString)(c,"sha");if(r===undefined||n===undefined||u===undefined||d===undefined||l===undefined||p===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Pull-request target identity fields were missing.",{snapshotEvaluable:false,exitCode:2}));const f=(0,s.safeAllowlistedString)(u,"pull request base ref",500);const h=(0,s.safeAllowlistedString)(d,"pull request base SHA",200);const m=(0,s.safeAllowlistedString)(l,"pull request head ref",500);const g=(0,s.safeAllowlistedString)(p,"pull request head SHA",200);const v=t.merge_commit_sha;if(v!==undefined&&v!==null&&typeof v!=="string")throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Pull-request merge_commit_sha was malformed.",{snapshotEvaluable:false,exitCode:2}));const y=parseUser(t.user);const b=v===undefined||v===null?undefined:(0,s.safeAllowlistedString)(v,"pull request merge SHA",200);return{id:r,number:n,base:{ref:f,sha:h,repo:parseRepositoryRef(a.repo,"base")},head:{ref:m,sha:g,repo:parseRepositoryRef(c.repo,"head")},...b===undefined?{}:{merge_commit_sha:b},...y===undefined?{}:{user:y}}}function normalizedName(e,t){const r=(0,s.safeAllowlistedString)(e.trim(),t,200);if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/.test(r))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_IDENTITY_MISMATCH",`${t} must be a GitHub-compatible repository segment.`,{snapshotEvaluable:false,exitCode:2}));return r}async function resolvePullRequestIdentity(e,t,r="collection"){if(t.eventKind==="merge_group"||t.targetKind==="merge_group"||t.pullNumber===undefined){throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_API_UNSUPPORTED","The current scalar EvaluationInput cannot represent authenticated merge-group membership.",{remediation:"Use a pull_request head/merge target, or add a versioned merge-group identity contract before enabling merge-queue evaluation.",snapshotEvaluable:false,exitCode:2}))}const i=normalizedName(t.owner,"repository owner");const a=normalizedName(t.name,"repository name");const c=t.expectedHeadSha===undefined?undefined:(0,s.safeAllowlistedString)(t.expectedHeadSha,"expected pull-request head SHA",200);if(!Number.isInteger(t.pullNumber)||t.pullNumber<1)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_IDENTITY_MISMATCH","Pull-request number must be a positive integer.",{snapshotEvaluable:false,exitCode:2}));const u=await e.request({method:"GET",path:`/repos/${encodeURIComponent(i)}/${encodeURIComponent(a)}`},"repository identity",r);if(u.status===403||u.status===404)throw new o.GitHubAdapterError((0,o.makeDiagnostic)(u.status===403?"GITHUB_PERMISSION_INSUFFICIENT":"GITHUB_RESOURCE_NOT_VISIBLE","Repository identity is not visible to the configured credential.",{permissionState:u.status===403?"insufficient":"unknown",snapshotEvaluable:false,exitCode:2}));const d=parseRepository(u.body);const l=await e.request({method:"GET",path:`/repos/${encodeURIComponent(i)}/${encodeURIComponent(a)}/pulls/${t.pullNumber}`},"pull-request identity",r);if(l.status===403||l.status===404)throw new o.GitHubAdapterError((0,o.makeDiagnostic)(l.status===403?"GITHUB_PERMISSION_INSUFFICIENT":"GITHUB_RESOURCE_NOT_VISIBLE","Pull-request identity is not visible to the configured credential.",{permissionState:l.status===403?"insufficient":"unknown",snapshotEvaluable:false,exitCode:2}));const p=parsePullRequest(l.body);if(p.number!==t.pullNumber||d.name.toLowerCase()!==a.toLowerCase()||d.full_name.toLowerCase()!==`${i}/${a}`.toLowerCase()){throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_IDENTITY_MISMATCH","GitHub returned a repository or pull-request identity different from the trusted request.",{snapshotEvaluable:false,exitCode:2}))}if(p.base.repo.id!==d.id||p.base.repo.full_name!==undefined&&p.base.repo.full_name.toLowerCase()!==d.full_name.toLowerCase())throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_IDENTITY_MISMATCH","The pull request base repository identity did not match the repository identity read from the API.",{snapshotEvaluable:false,exitCode:2}));if(c!==undefined&&p.head.sha!==c){throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_TARGET_CHANGED","The workflow event head SHA no longer matches the live pull-request head SHA.",{remediation:"Discard this run and let the workflow rerun for the current pull-request head; do not evaluate or publish a result for a different revision.",snapshotEvaluable:false,exitCode:2}))}const f=typeof p.merge_commit_sha==="string"?p.merge_commit_sha:undefined;const h=t.targetKind==="merge"?"merge":"head";if(h==="merge"&&f===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_API_UNSUPPORTED","The pull request has no immutable merge SHA for the requested merge target.",{remediation:"Evaluate the head target or wait for GitHub to provide a merge commit SHA.",snapshotEvaluable:false,exitCode:2}));const m=h==="merge"?f:p.head.sha;const g={apiOrigin:e.origin,apiVersion:e.apiVersion,repositoryId:d.id,owner:i,name:a,pullRequestId:p.id,pullRequestNumber:p.number,eventKind:"pull_request",baseRef:p.base.ref,baseSha:p.base.sha,headRepositoryId:p.head.repo.id,headRef:p.head.ref,headSha:p.head.sha,...f===undefined?{}:{mergeSha:f},testedSha:m,targetKind:h,...p.user?.id===undefined?{}:{authorId:p.user.id}};return{...g,retrievalStartedAt:new Date(e.clock.now()).toISOString(),provenanceDigest:(0,n.sha256Digest)(g)}}function sameSnapshotIdentity(e,t){return e.provenanceDigest===t.provenanceDigest&&e.repositoryId===t.repositoryId&&e.pullRequestId===t.pullRequestId&&e.pullRequestNumber===t.pullRequestNumber&&e.owner===t.owner&&e.name===t.name&&e.eventKind===t.eventKind&&e.baseRef===t.baseRef&&e.baseSha===t.baseSha&&e.headRepositoryId===t.headRepositoryId&&e.headRef===t.headRef&&e.headSha===t.headSha&&e.mergeSha===t.mergeSha&&e.testedSha===t.testedSha&&e.targetKind===t.targetKind}},6047:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectLinkedIssues=collectLinkedIssues;const n=r(1552);const s=r(2823);const i=r(2355);const o=r(1914);function parseIssue(e){if(!(0,s.isRecord)(e)||!(0,s.isRecord)(e.repository))return undefined;const t=(0,s.readString)(e.repository,"nameWithOwner");const r=(0,s.readString)(e.repository,"id");const n=(0,s.readPositiveInt)(e,"number");const i=(0,s.readString)(e,"id");if(t===undefined||n===undefined||r===undefined||i===undefined)return undefined;return{repository:{nameWithOwner:(0,o.safeAllowlistedString)(t,"linked issue repository",500),id:(0,o.safeAllowlistedString)(r,"linked issue repository ID",500)},number:n,id:(0,o.safeAllowlistedString)(i,"linked issue ID",500)}}async function collectLinkedIssues(e,t,r,a,c,u="collection"){const d=[];const l=[];let p=null;let f=true;let h=0;const m=new Set;const g=new Set;const v=[];const y=new Date(e.clock.now()).toISOString();while(true){h+=1;if(!e.budget.recordPage("linkedIssues")){f=false;l.push((0,i.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","Linked-issue pagination exceeded the bounded page budget.",{observation:"linkedIssues"}));break}try{const c=await e.request({method:"POST",path:"/graphql",operation:"pullRequestClosingIssues",variables:{owner:t,name:r,number:a,first:100,after:p}},"linkedIssues",u);v.push((0,n.sha256Digest)((0,o.redactForReport)({status:c.status,headers:c.headers,body:c.body})));if(c.status===403||c.status===404){f=false;l.push((0,i.makeDiagnostic)(c.status===403?"GITHUB_PERMISSION_INSUFFICIENT":"GITHUB_RESOURCE_NOT_VISIBLE","Native linked-issue relationship is not visible to the configured credential.",{observation:"linkedIssues",permissionState:c.status===403?"insufficient":"unknown"}));break}if(!(0,s.isRecord)(c.body))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The linked-issue GraphQL response was not an object.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2}));if(Array.isArray(c.body.errors)&&c.body.errors.length>0)throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_API_UNSUPPORTED","GitHub returned GraphQL errors or partial linked-issue data.",{observation:"linkedIssues",remediation:"Grant the required read capability or keep issue linkage non-ready."}));const y=c.body.data;if(!(0,s.isRecord)(y)||!(0,s.isRecord)(y.repository)||!(0,s.isRecord)(y.repository.pullRequest)||!(0,s.isRecord)(y.repository.pullRequest.closingIssuesReferences))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_API_UNSUPPORTED","GitHub did not expose the documented closingIssuesReferences connection.",{observation:"linkedIssues"}));const b=y.repository.pullRequest.closingIssuesReferences;const w=b.nodes;if(!Array.isArray(w))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The linked-issue node list was missing or malformed.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2}));const $=b.pageInfo;if(!(0,s.isRecord)($)||typeof $.hasNextPage!=="boolean")throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The linked-issue pageInfo was missing or malformed.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2}));for(const e of w){const n=(0,s.isRecord)(e)&&e.issue!==undefined?e.issue:e;const o=parseIssue(n);if(o===undefined){f=false;l.push((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","A linked-issue node lacked immutable repository/number identity.",{observation:"linkedIssues"}));continue}if(o.repository.nameWithOwner.toLowerCase()!==`${t}/${r}`.toLowerCase()){f=false;l.push((0,i.makeDiagnostic)("GITHUB_API_UNSUPPORTED","Cross-repository linked issues are outside the current v0.1 evaluator contract.",{observation:"linkedIssues",remediation:"Use same-repository native linked issues or add a versioned cross-repository policy contract."}));continue}const a=`${o.repository.nameWithOwner.toLowerCase()}#${o.number}`;const c=o.repository.id;const u=o.id;if(c===undefined||u===undefined)throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","A linked issue lost immutable identity during normalization.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2}));const p=`${c}\0${u}`;if(m.has(a)||g.has(p))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","The linked-issue connection repeated an issue identity.",{observation:"linkedIssues"}));m.add(a);g.add(p);d.push({repository:o.repository.nameWithOwner,number:o.number,repositoryId:c,issueId:u,linked:true})}if($.hasNextPage!==true)break;const S=typeof $.endCursor==="string"?$.endCursor:undefined;if(S===undefined||S.length===0||h>=e.budget.limits.maxPagesPerGroup){f=false;l.push((0,i.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","Linked-issue pagination did not provide a safe bounded cursor.",{observation:"linkedIssues"}));break}p=S}catch(e){const t=e instanceof i.GitHubAdapterError?e.diagnostic:(0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Linked-issue retrieval failed at the API boundary.",{observation:"linkedIssues",snapshotEvaluable:false,exitCode:2});f=false;l.push(t);break}}return{issues:d.sort((e,t)=>(0,n.compareTextUnit)(e.repository,t.repository)||e.number-t.number),meta:{source:{kind:"github",identity:"graphql:closingIssuesReferences"},revision:c,retrievedAt:y,complete:f,permissionState:f?"sufficient":l.some(e=>e.permissionState==="insufficient")?"insufficient":"unknown",responseDigest:(0,n.sha256Digest)(v)},diagnostics:l}}},6299:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.parseNextLink=parseNextLink;t.collectPaginated=collectPaginated;const n=r(1552);const s=r(2355);function parseLinkParts(e){return e.split(/,(?=\s*<)/).flatMap(e=>{const t=/^\s*<([^>]+)>\s*(.*)$/.exec(e);if(t===null)return[];const r=t[2]??"";const n=/rel\s*=\s*"([^"]+)"/i.exec(r)?.[1]??/rel\s*=\s*([^;\s]+)/i.exec(r)?.[1]??"";const s=t[1];if(s===undefined)return[];return[{url:s,rel:n.split(/\s+/).filter(Boolean)}]})}function parseNextLink(e,t){if(e===undefined)return undefined;const r=parseLinkParts(e).find(e=>e.rel.includes("next"));if(r===undefined)return undefined;const n=new URL(r.url,t);if(n.origin!==t||n.protocol!=="https:"||n.username.length>0||n.password.length>0){throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","GitHub pagination pointed outside the configured API origin.",{remediation:"Discard the snapshot and rerun with a trusted GitHub API origin."}))}return n.toString()}function requestFromNextUrl(e,t){const r=new URL(e);if(r.origin!==t)throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","The next-page URL origin changed.",{remediation:"Discard the snapshot and inspect the API response provenance."}));const n={};for(const[e,t]of r.searchParams.entries())n[e]=t;return{method:"GET",path:r.pathname,...Object.keys(n).length===0?{}:{query:n}}}async function collectPaginated(e,t,r,i,o,a={}){const c=[];const u=[];const d=[];const l=new Set;const p=new Set;let f=t;let h=true;let m="sufficient";const g=a.maxItems??e.budget.limits.maxItemsPerGroup;const v=a.pageSize??(typeof t.query?.per_page==="number"?t.query.per_page:100);while(true){try{const t=await e.request(f,r,a.phase??"collection");if(t.status===403){h=false;m="insufficient";u.push((0,s.makeDiagnostic)("GITHUB_PERMISSION_INSUFFICIENT",`GitHub denied the ${r} collection.`,{observation:r,permissionState:m,remediation:`Grant the minimum read permission for ${r}, or keep the dependent requirement non-ready.`}));break}if(t.status===404&&a.allowConfirmedAbsence===true){h=true;m="sufficient";break}if(t.status===404){h=false;m="unknown";u.push((0,s.makeDiagnostic)("GITHUB_RESOURCE_NOT_VISIBLE",`GitHub did not expose the ${r} resource.`,{observation:r,permissionState:m,remediation:`Confirm repository visibility and endpoint permission for ${r}; a hidden 404 is not treated as absence.`}));break}const y=JSON.stringify(f);if(l.has(y))throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`The ${r} pagination cursor repeated.`,{observation:r}));l.add(y);const b=i(t.body);d.push((0,n.sha256Digest)(t.body));if(!e.budget.recordPage(r)){h=false;u.push((0,s.makeDiagnostic)("GITHUB_PAGINATION_LIMIT",`The ${r} pagination budget was exhausted.`,{observation:r,remediation:"Rerun with a bounded page budget that proves the complete collection."}));break}for(const t of b){if(c.length>=g){e.budget.recordItemCap(r);h=false;u.push((0,s.makeDiagnostic)("GITHUB_ITEM_LIMIT",`The ${r} item budget was exhausted.`,{observation:r,remediation:"Reduce the collection or raise the reviewed item cap; truncated evidence cannot satisfy a requirement."}));break}const n=o(t);if(p.has(n))throw new s.GitHubAdapterError((0,s.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`The ${r} collection repeated an immutable item identity.`,{observation:r,remediation:"Discard the snapshot; repeated page data cannot be promoted to complete evidence."}));p.add(n);c.push(t)}if(!h)break;const w=parseNextLink(t.headers.link,e.origin);if(w===undefined&&b.length>=v){h=false;u.push((0,s.makeDiagnostic)("GITHUB_PAGINATION_LIMIT",`The ${r} response reached its page-size boundary without a trusted next link.`,{observation:r,remediation:"Require a trustworthy end-of-pagination signal before treating the collection as complete."}))}if(w===undefined)break;f=requestFromNextUrl(w,e.origin)}catch(e){const t=(0,s.diagnosticFrom)(e);u.push(t);h=false;m=t.permissionState;break}}return{items:c,complete:h,permissionState:m,diagnostics:u,pageDigests:d}}},5435:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.qualifyReviews=qualifyReviews;const n=r(1552);const s=r(2823);const i={read:1,triage:2,write:3,push:3,maintain:4,admin:5};function sufficientPermission(e){return e!==undefined&&(i[e.toLowerCase()]??0)>=3}function configuredTeamPrincipal(e){const t=e.startsWith("@")?e.slice(1):e;const r=t.indexOf("/");if(r<=0||r===t.length-1)return undefined;return{org:t.slice(0,r),slug:t.slice(r+1)}}function configuredUserPrincipal(e,t){return e===t||e===`@${t}`}async function collaborator(e,t,r,n,i){const o=await e.request({method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/collaborators/${encodeURIComponent(n)}/permission`},"reviewer permission",i);if(o.status===403)return{state:"insufficient"};if(o.status===404)return{state:"unknown"};if(!(0,s.isRecord)(o.body))return{state:"unknown"};const a=(0,s.isRecord)(o.body.user)?(0,s.readPositiveInt)(o.body.user,"id"):undefined;const c=(0,s.readString)(o.body,"permission")??(0,s.readString)(o.body,"role_name");return{state:sufficientPermission(c)?"sufficient":"insufficient",...a===undefined?{}:{id:a}}}async function teamMembership(e,t,r,n,i){const o=await e.request({method:"GET",path:`/orgs/${encodeURIComponent(t)}/teams/${encodeURIComponent(r)}`},"team identity",i);if(o.status===403||o.status===404||!(0,s.isRecord)(o.body))return{state:o.status===403?"insufficient":"unknown"};const a=(0,s.readPositiveInt)(o.body,"id");if(a===undefined)return{state:"unknown"};const c=await e.request({method:"GET",path:`/orgs/${encodeURIComponent(t)}/teams/${encodeURIComponent(r)}/memberships/${encodeURIComponent(n)}`},"team membership",i);if(c.status===403||c.status===404||!(0,s.isRecord)(c.body))return{state:c.status===403?"insufficient":"unknown"};const u=(0,s.readString)(c.body,"state");if(u!=="active"&&u!=="pending")return{state:"unknown"};return{state:u==="active"?"sufficient":"unknown",principal:{configuredPrincipal:`@${t}/${r}`,kind:"team",immutableId:a,membershipState:u}}}async function qualifyReviews(e,t,r,s,i,o="collection"){const a=[];const c=[];const u=[];const d=[];const l=new Date(e.clock.now()).toISOString();for(const n of t){if(n.isAuthor||n.isBot){c.push(n);continue}const t=await collaborator(e,r,s,n.login,o);u.push(t.state);const a=[];const l=[];const p=[];let f=i.length===0&&t.state==="sufficient";let h=false;for(const r of i){const s=configuredTeamPrincipal(r);if(s!==undefined){const r=await teamMembership(e,s.org,s.slug,n.login,o);d.push(r.state);if(r.principal!==undefined){a.push(r.principal);l.push(r.principal.immutableId);p.push(`@${s.org}/${s.slug}`)}if(r.state==="sufficient"&&t.state==="sufficient")f=true;if(r.state!=="sufficient")h=true}else if(configuredUserPrincipal(r,n.login)){const e={configuredPrincipal:r,kind:"user",immutableId:t.id??n.actorId,membershipState:t.state==="sufficient"?"active":"unknown"};a.push(e);if(t.state==="sufficient")f=true}}const m=t.state==="sufficient"&&f;const g=t.state!=="unknown"&&(m||!h);const v=m?"sufficient":t.state==="unknown"||h?"unknown":"insufficient";c.push({...n,qualified:m,teams:[...new Set(p)],teamIds:[...new Set(l)],qualification:{...n.qualification,complete:g,permissionState:v,principalBindings:a}})}const aggregate=(e,t,r)=>{const s=e.length===0||e.includes("unknown")?"unknown":e.includes("insufficient")?"insufficient":"sufficient";return{source:{kind:"github",identity:t},...r===undefined?{}:{revision:r},retrievedAt:l,complete:s==="sufficient",permissionState:s,responseDigest:(0,n.sha256Digest)(e)}};return{reviews:c,diagnostics:a,collaboratorMeta:aggregate(u,"collaborator-permission"),teamMeta:aggregate(d,"team-identity+membership")}}},1914:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.safeAllowlistedString=safeAllowlistedString;t.safeDisplayText=safeDisplayText;t.redactUrl=redactUrl;t.redactHeaders=redactHeaders;t.redactForReport=redactForReport;t.assertRedacted=assertRedacted;t.sanitizeFixture=sanitizeFixture;const n=r(2355);const s=/authorization|cookie|token|secret|password|private[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|api[_-]?key|apikey|credential|body|comment|email|raw[_-]?error|workflow[_-]?log|artifact/i;const i=/[\u0000-\u0009\u000B-\u000D\u000E-\u001F\u007F\u001B\u202A-\u202E\u2066-\u2069]/g;const o=/([?&](?:access_token|token|secret|key|signature|authorization)=)[^&]*/gi;const a=/[?&](?:access_token|token|secret|key|signature|authorization)=(?!\[REDACTED\])[^&]*/i;const c=/(?:bearer\s+|(?:api[_-]?key|apikey|access[_-]?token|client[_-]?secret|password|credential)\s*[:=]\s*)[^\s,;]+/gi;const u=/(?:bearer\s+|(?:api[_-]?key|apikey|access[_-]?token|client[_-]?secret|password|credential)\s*[:=]\s*)(?!\[REDACTED\])[^\s,;]+/i;function safeAllowlistedString(e,t,r=1e4){if(e.length===0||e.length>r||i.test(e)){i.lastIndex=0;throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`${t} contains unsafe or oversized text.`,{remediation:`Remove control characters and keep ${t} within the bounded adapter limit.`,snapshotEvaluable:false,exitCode:2}))}i.lastIndex=0;return e}function safeDisplayText(e,t,r=4e3){const n=e.length>r?e.slice(0,r):e;return safeAllowlistedString(n.replace(/[\r\n]+/g," "),t,r)}function redactUrl(e){try{const t=new URL(e);t.username="";t.password="";t.search=t.search.replace(o,"$1[REDACTED]");t.hash="";return t.toString()}catch{return e.replace(o,"$1[REDACTED]")}}function redactHeaders(e){const t={};for(const[r,n]of Object.entries(e)){t[r]=/authorization|cookie|token|secret|password/i.test(r)?"[REDACTED]":typeof n==="string"&&/^https?:\/\//.test(n)?redactUrl(n):sanitize(e[r])}return t}function sanitize(e){if(Array.isArray(e))return e.map(sanitize);if(e!==null&&typeof e==="object"){const t={};for(const[r,n]of Object.entries(e)){if(s.test(r))continue;t[r]=sanitize(n)}return t}if(typeof e==="string")return e.replace(o,"$1[REDACTED]").replace(c,"[REDACTED]").replace(i,"�");return e}function redactForReport(e){return sanitize(e)}function assertRedacted(e){function visit(e,t){if(Array.isArray(e)){e.forEach((e,r)=>visit(e,`${t}[${r}]`));return}if(e!==null&&typeof e==="object"){for(const[r,n]of Object.entries(e)){if(s.test(r))throw new Error(`forbidden redaction key at ${t}.${r}`);visit(n,`${t}.${r}`)}}if(typeof e==="string"&&(i.test(e)||a.test(e)||u.test(e))){i.lastIndex=0;throw new Error(`secret-like query at ${t}`)}i.lastIndex=0;o.lastIndex=0}visit(e,"$")}function sanitizeFixture(e){const t=redactForReport(e);assertRedacted(t);return t}},5254:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.BudgetLedger=t.DEFAULT_REQUEST_BUDGETS=void 0;const n=r(2355);t.DEFAULT_REQUEST_BUDGETS={maxRequests:160,finalizationReserveRequests:64,maxPagesPerGroup:32,maxRetriesPerRequest:2,maxRetries:8,maxResponseBytes:2*1024*1024,maxItemsPerGroup:3e3,maxRetryDelayMs:5e3,maxCumulativeSleepMs:1e4};class BudgetLedger{limits;evidence={requests:{attempted:0,succeeded:0,failed:0,finalizationAttempted:0},pagesByGroup:{},retriesByReason:{},responseBytes:0,retryAfterObservedMs:[],conditionalRequests:0,conditional304:0,caps:[],cumulativeSleepMs:0};constructor(e={}){this.limits={...t.DEFAULT_REQUEST_BUDGETS,...e};if(this.limits.finalizationReserveRequests<1||this.limits.finalizationReserveRequests>=this.limits.maxRequests){throw new Error("finalizationReserveRequests must be smaller than maxRequests and positive")}}beginRequest(e){const t=this.evidence.requests.attempted+1;const r=this.limits.maxRequests-this.limits.finalizationReserveRequests;if(e==="collection"&&t>r){this.recordCap("request_budget_collection");throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_REQUEST_BUDGET","The collection request budget was exhausted before finalization.",{remediation:"Reduce the snapshot scope or raise the bounded collection budget; the adapter did not consume the finalization reserve.",complete:false,snapshotEvaluable:true}))}if(e==="finalization"&&this.evidence.requests.finalizationAttempted>=this.limits.finalizationReserveRequests){this.recordCap("request_budget_finalization");throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_REQUEST_BUDGET","The reserved finalization request budget was exhausted.",{remediation:"Retry the entire snapshot with a larger bounded finalization reserve; no snapshot was accepted.",complete:false,snapshotEvaluable:false,exitCode:2}))}this.evidence.requests.attempted=t;if(e==="finalization")this.evidence.requests.finalizationAttempted+=1}recordSuccess(){this.evidence.requests.succeeded+=1}recordFailure(){this.evidence.requests.failed+=1}recordResponseBytes(e){this.evidence.responseBytes+=e}recordPage(e){const t=(this.evidence.pagesByGroup[e]??0)+1;this.evidence.pagesByGroup[e]=t;if(t>this.limits.maxPagesPerGroup){this.recordCap(`page_budget:${e}`);return false}return true}recordItemCap(e){this.recordCap(`item_budget:${e}`)}recordCap(e){if(!this.evidence.caps.includes(e))this.evidence.caps.push(e)}recordRetry(e){const t=Object.values(this.evidence.retriesByReason).reduce((e,t)=>e+t,0);if(t>=this.limits.maxRetries){this.recordCap("retry_budget");return false}this.evidence.retriesByReason[e]=(this.evidence.retriesByReason[e]??0)+1;return true}recordRetryAfter(e){this.evidence.retryAfterObservedMs.push(e)}recordRateLimit(e,t,r){this.evidence.primaryRate={...e===undefined?{}:{remaining:e},...t===undefined?{}:{resetAt:t},...r===undefined?{}:{resource:r}}}recordConditional(e=false){this.evidence.conditionalRequests+=1;if(e)this.evidence.conditional304+=1}recordSleep(e){if(e<0||this.evidence.cumulativeSleepMs+e>this.limits.maxCumulativeSleepMs){this.recordCap("retry_sleep_budget");return false}this.evidence.cumulativeSleepMs+=e;return true}snapshot(){return structuredClone(this.evidence)}}t.BudgetLedger=BudgetLedger},8129:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.parseRetryDelay=parseRetryDelay;t.boundedRetryDelay=boundedRetryDelay;const n=r(2355);function parseRetryDelay(e,t,r){const n=e["retry-after"];if(n!==undefined){const e=Number(n);if(Number.isFinite(e)&&e>=0){const t=Math.min(Math.floor(e*1e3),r);return{delayMs:t,observedMs:t}}}const s=e["x-ratelimit-reset"];if(s!==undefined){const e=Number(s)*1e3;if(Number.isFinite(e)&&e>t){const n=Math.min(Math.floor(e-t),r);return{delayMs:n,observedMs:n}}}return{delayMs:0}}async function boundedRetryDelay(e,t,r,s){const i=parseRetryDelay(t,s.now(),r.limits.maxRetryDelayMs);if(i.observedMs!==undefined)r.recordRetryAfter(i.observedMs);if(!r.recordRetry(e)){throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RETRY_EXHAUSTED",`GitHub retry budget exhausted for ${e}.`,{remediation:"Retry the complete snapshot later; no partial response was promoted to decision evidence.",complete:false,permissionState:e.includes("rate_limit")?"unknown":"sufficient"}))}if(!r.recordSleep(i.delayMs)){throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_RATE_LIMITED","The bounded GitHub retry sleep budget was exhausted.",{remediation:"Wait for the reported GitHub limit to reset, then rerun the read-only snapshot.",complete:false,permissionState:"unknown"}))}if(i.delayMs>0)await s.sleep(i.delayMs)}},5426:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectReviews=collectReviews;const n=r(1552);const s=r(2823);const i=r(6299);const o=r(2355);const a=r(1914);function reviewTime(e){return e.submitted_at===undefined||e.submitted_at===null?0:Date.parse(e.submitted_at)}function parseReviews(e){if(!Array.isArray(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The pull-request reviews response was not an array.",{observation:"reviews",snapshotEvaluable:false,exitCode:2}));return e.map((e,t)=>{if(!(0,s.isRecord)(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Review ${t} was malformed.`,{observation:"reviews",snapshotEvaluable:false,exitCode:2}));const r=(0,s.readPositiveInt)(e,"id");const n=(0,s.readString)(e,"state");const i=(0,s.readString)(e,"commit_id");if(r===undefined||n===undefined||i===undefined||!(0,s.isRecord)(e.user))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Review ${t} lacked immutable actor/state/commit identity.`,{observation:"reviews",snapshotEvaluable:false,exitCode:2}));const a=(0,s.readPositiveInt)(e.user,"id");const c=(0,s.readString)(e.user,"login");if(a===undefined||c===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Review ${r} lacked actor identity.`,{observation:"reviews",snapshotEvaluable:false,exitCode:2}));if(n!=="APPROVED"&&n!=="CHANGES_REQUESTED"&&n!=="COMMENTED"&&n!=="DISMISSED")throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_API_UNSUPPORTED",`Review ${r} had an unsupported state ${n}.`,{observation:"reviews"}));const u=(0,s.readString)(e,"submitted_at");if(u!==undefined&&!Number.isFinite(Date.parse(u)))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Review ${r} had an invalid submitted_at timestamp.`,{observation:"reviews",snapshotEvaluable:false,exitCode:2}));const d=(0,s.readString)(e,"author_association");const l=(0,s.readString)(e.user,"type");return{id:r,user:{id:a,login:c,...l===undefined?{}:{type:l}},state:n,commit_id:i,...u===undefined?{}:{submitted_at:u},...d===undefined?{}:{author_association:d}}})}async function collectReviews(e,t,r,s,c,u,d="collection"){const l=await(0,i.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/pulls/${s}/reviews`,query:{per_page:100}},"reviews",parseReviews,e=>String(e.id),{phase:d});const p=[...l.diagnostics];const f=new Map;for(const e of l.items){const t=e.user?.id??0;const r=f.get(t);if(r===undefined||reviewTime(e)>reviewTime(r)||reviewTime(e)===reviewTime(r)&&e.id>r.id)f.set(t,e)}const h=l.items.map(e=>{const t=e.user;if(t===null||t===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","A review actor was unexpectedly absent after parsing.",{observation:"reviews",snapshotEvaluable:false,exitCode:2}));const r=f.get(t.id);const n=r?.state;const s=r?.id===e.id&&n!=="DISMISSED";const i=t.type==="Bot"||t.login.endsWith("[bot]");return{reviewId:e.id,actorId:t.id,login:(0,a.safeAllowlistedString)(t.login,`review ${e.id} login`,200),state:e.state,commitId:e.commit_id,qualified:false,teams:[],teamIds:[],qualification:{source:{kind:"github",identity:"collaborator-permission"},revision:c,complete:!i,permissionState:i?"sufficient":"unknown"},isAuthor:u!==undefined&&u===t.id,isBot:i,active:s}});const m=new Date(e.clock.now()).toISOString();const g={source:{kind:"github",identity:"collaborator-permission"},revision:c,retrievedAt:m,complete:l.complete,permissionState:l.permissionState,responseDigest:(0,n.sha256Digest)([])};const v={source:{kind:"github",identity:"team-identity+membership"},revision:c,retrievedAt:m,complete:l.complete,permissionState:l.permissionState,responseDigest:(0,n.sha256Digest)([])};return{reviews:h,meta:{source:{kind:"github",identity:"pull-request-reviews"},revision:c,retrievedAt:m,complete:l.complete,permissionState:l.permissionState,responseDigest:(0,n.sha256Digest)(l.pageDigests)},collaboratorMeta:g,teamMeta:v,diagnostics:p}}},7092:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectRulesets=collectRulesets;const n=r(1552);const s=r(2823);const i=r(6299);const o=r(2355);function emptyControls(){return{requiredChecks:[],requiredApprovals:0,requireCodeOwnerReviews:false,requireLastPushApproval:false,staleReviews:false,requiredReviewThreadResolution:false,unsupported:false,complete:true}}function safePattern(e){return!/[?\[\]]/.test(e)}function matchesRefPattern(e,t){if(e==="~ALL"||e===t)return true;if(e==="~DEFAULT_BRANCH"||!e.includes("*")||!safePattern(e))return false;const r=e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*");return new RegExp(`^${r}$`).test(t)}function parseRefConditions(e,t){if(e===undefined)return{applicable:true,complete:true};if(!(0,s.isRecord)(e)||!(0,s.isRecord)(e.ref_name))return{applicable:false,complete:false};const r=e.ref_name.include;const n=e.ref_name.exclude;if(!Array.isArray(r)||n!==undefined&&!Array.isArray(n))return{applicable:false,complete:false};const i=r.filter(e=>typeof e==="string");const o=n===undefined?[]:n.filter(e=>typeof e==="string");const a=i.length===r.length&&o.length===(Array.isArray(n)?n.length:0)&&[...i,...o].every(safePattern)&&![...i,...o].includes("~DEFAULT_BRANCH");const c=`refs/heads/${t}`;const u=i.length===0||i.some(e=>matchesRefPattern(e,c));const d=o.some(e=>matchesRefPattern(e,c));return{applicable:u&&!d,complete:a}}function mergeCheck(e,t){const r=e.find(e=>e.context===t.context);if(r===undefined)e.push(t);else if(r.appId===undefined&&t.appId!==undefined)r.appId=t.appId}function parseRuleControls(e){const t=emptyControls();if(!Array.isArray(e))return{ruleTypes:[],controls:{...t,complete:false}};const r=[];for(const n of e){if(!(0,s.isRecord)(n)||typeof n.type!=="string"||n.type.trim().length===0){t.complete=false;continue}const e=n.type;r.push(e);if(e==="required_status_checks"){const e=(0,s.isRecord)(n.parameters)?n.parameters:undefined;const r=e?.required_status_checks;if(!Array.isArray(r)){t.complete=false;continue}for(const e of r){if(!(0,s.isRecord)(e)||typeof e.context!=="string"||e.context.trim().length===0){t.complete=false;continue}const r=e.integration_id;if(r!==undefined&&r!==null&&(typeof r!=="number"||!Number.isInteger(r)||r<1)){t.complete=false;continue}mergeCheck(t.requiredChecks,{context:e.context,...typeof r==="number"?{appId:r}:{}})}continue}if(e==="pull_request"){const e=(0,s.isRecord)(n.parameters)?n.parameters:undefined;const r=e?.required_approving_review_count;const i=e?.require_code_owner_review;const o=e?.require_last_push_approval;const a=e?.dismiss_stale_reviews_on_push;const c=e?.required_review_thread_resolution;if(typeof r!=="number"||!Number.isInteger(r)||r<0||typeof i!=="boolean"||typeof o!=="boolean"||typeof a!=="boolean"||typeof c!=="boolean"){t.complete=false}else{t.requiredApprovals=Math.max(t.requiredApprovals,r);t.requireCodeOwnerReviews=t.requireCodeOwnerReviews||i;t.requireLastPushApproval=t.requireLastPushApproval||o;t.staleReviews=t.staleReviews||a;t.requiredReviewThreadResolution=t.requiredReviewThreadResolution||c}const u=e?.allowed_merge_methods;if(u!==undefined&&(!Array.isArray(u)||u.some(e=>typeof e!=="string")||!["merge","squash","rebase"].every(e=>u.includes(e))))t.unsupported=true;continue}t.unsupported=true}t.requiredChecks.sort((e,t)=>(0,n.compareTextUnit)(e.context,t.context)||(e.appId??0)-(t.appId??0));return{ruleTypes:[...new Set(r)].sort(),controls:t}}function parseRulesets(e,t){if(!Array.isArray(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The repository rulesets response was not an array.",{observation:"rulesets",snapshotEvaluable:false,exitCode:2}));return e.map((e,r)=>{if(!(0,s.isRecord)(e))throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Ruleset ${r} was malformed.`,{observation:"rulesets",snapshotEvaluable:false,exitCode:2}));const n=(0,s.readPositiveInt)(e,"id");const i=(0,s.readString)(e,"name");const a=(0,s.readString)(e,"enforcement");if(n===undefined||i===undefined||a===undefined)throw new o.GitHubAdapterError((0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Ruleset ${r} lacked identity or enforcement.`,{observation:"rulesets",snapshotEvaluable:false,exitCode:2}));const c=(0,s.readString)(e,"source_type")??"unknown";const u=(0,s.readString)(e,"source")??"unknown";const d=(0,s.readString)(e,"target")??"branch";const l=a==="active"||a==="evaluate"||a==="disabled";const p=parseRuleControls(e.rules);const f=parseRefConditions(e.conditions,t);const h=Array.isArray(e.bypass_actors);const m=d==="branch"&&f.applicable;const g=a==="active"&&m&&(p.ruleTypes.length>0||p.controls.unsupported);const v=l&&f.complete&&p.controls.complete&&(!g||h)&&(!g||!p.controls.unsupported);const y=p.controls;return{id:n,name:i,sourceType:c,source:u,enforcement:a==="active"||a==="evaluate"||a==="disabled"?a:"unknown",applicable:m,requiredChecks:y.requiredChecks,requiredApprovals:y.requiredApprovals,requireCodeOwnerReviews:y.requireCodeOwnerReviews,requireLastPushApproval:y.requireLastPushApproval,staleReviews:y.staleReviews,requiredReviewThreadResolution:y.requiredReviewThreadResolution,bypassVisible:h,ruleTypes:p.ruleTypes,decisionBearing:g,complete:v}})}async function collectRulesets(e,t,r,s,a,c=false,u="collection"){const d=new Date(e.clock.now()).toISOString();try{const l=await(0,i.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/rulesets`,query:{includes_parents:true,per_page:100}},"rulesets",e=>parseRulesets(e,s),e=>String(e.id),{phase:u,allowConfirmedAbsence:c,pageSize:100});const p=l.items;const f=p.map(({complete:e,...t})=>t);const h=p.every(e=>e.complete);const m=[...l.diagnostics];if(!h)m.push((0,o.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","A native ruleset had unsupported enforcement, condition, bypass visibility, or rule semantics.",{observation:"rulesets",remediation:"Use only the supported required-status-check and pull-request subset, or extend the versioned native-control contract before evaluating."}));const g=f.some(e=>e.applicable&&e.decisionBearing);const v=l.complete&&h&&m.length===0;return{rulesets:f,...v?{source:{kind:"ruleset",identity:"repository-rulesets",revision:a,digest:(0,n.sha256Digest)(f),authority:"enforced"}}:{},meta:{source:{kind:"github",identity:"repository-rulesets"},revision:a,retrievedAt:d,complete:v,permissionState:v?"sufficient":l.permissionState,responseDigest:(0,n.sha256Digest)(l.pageDigests)},diagnostics:m,decisionBearing:v&&g}}catch(e){const t=e instanceof o.GitHubAdapterError?e.diagnostic:(0,o.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","Ruleset normalization failed.",{observation:"rulesets",snapshotEvaluable:false,exitCode:2});return{rulesets:[],meta:{source:{kind:"github",identity:"repository-rulesets"},revision:a,retrievedAt:d,complete:false,permissionState:t.permissionState},diagnostics:[t],decisionBearing:false}}}},861:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.buildGitHubSnapshot=buildGitHubSnapshot;const n=r(1552);const s=r(6875);const i=r(1140);const o=r(1165);const a=r(3538);const c=r(3506);const u=r(6047);const d=r(6250);const l=r(5426);const p=r(5435);const f=r(7092);const h=r(4835);const m=r(2355);const g=r(7369);const v=r(7969);function unique(e){return[...new Set(e)].sort()}function reviewability(e){const t=unique(e.paths.map(e=>e.split("/")[0]??"root"));const r=e.files.filter(e=>/(^|\/)(generated|dist|vendor)(\/|$)|\.(lock|snap)$/.test(e.path)).length;return{fileCount:e.files.length,ownershipDomains:t,generatedFileCount:r,boundaryCount:t.length}}function metaWithDigest(e,t,r){const{normalizedDigest:n,...s}=e;return r?{...s,normalizedDigest:t}:s}function sourceMeta(e,t){return{...t,source:{kind:t.source.kind,identity:e.identity}}}function policySources(e){return[e.policy.source,e.codeowners.source,e.rulesets.source,e.branchProtection.source].filter(e=>e!==undefined)}function buildInput(e,t){const r=policySources(t);const s=t.policy.rawBytesDigest??t.policy.artifact?.digest??(0,n.sha256Text)("");const o={schemaVersion:"0.1",repository:{owner:e.owner,name:e.name,pullRequest:e.pullRequestNumber},revisions:{baseSha:e.baseSha,headSha:e.headSha,...e.mergeSha===undefined?{}:{mergeSha:e.mergeSha},testedSha:e.testedSha,targetKind:e.targetKind},policy:t.policy.artifact?.policy??null,policySources:r,policyDigest:s,changedPaths:t.changed.paths,linkedIssues:t.linked.issues,reviews:t.reviews.reviews,checks:t.checks.checks,ownershipRequirements:t.codeowners.requirements,...t.branchProtection.protection===undefined&&t.rulesets.rulesets.length===0?{}:{nativeControls:{...t.branchProtection.protection===undefined?{}:{branchProtection:t.branchProtection.protection},...t.rulesets.rulesets.length===0?{}:{rulesets:t.rulesets.rulesets}}},reviewability:t.reviewability};const a={policySources:r.map(e=>sourceMeta(e,e.kind==="patchgate"?t.policy.meta:e.kind==="codeowners"?t.codeowners.meta:e.kind==="ruleset"?t.rulesets.meta:t.branchProtection.meta)),changedPaths:t.changed.meta,linkedIssues:t.linked.meta,reviews:t.reviews.meta,checks:t.checks.meta,ownership:{...t.codeowners.meta,complete:t.codeowners.meta.complete&&t.changed.meta.complete,permissionState:t.codeowners.meta.complete&&t.changed.meta.complete?t.codeowners.meta.permissionState:"unknown"},reviewability:{source:{kind:"github",identity:"reviewability"},revision:e.testedSha,retrievedAt:t.changed.meta.retrievedAt,complete:t.changed.meta.complete,permissionState:t.changed.meta.complete?"sufficient":"unknown"}};const c={...o,observations:a};const u={policySources:a.policySources.map(e=>metaWithDigest(e,(0,i.normalizedObservationDigest)(c,"policySources"),e.complete)),changedPaths:metaWithDigest(a.changedPaths,(0,i.normalizedObservationDigest)(c,"changedPaths"),a.changedPaths.complete),linkedIssues:metaWithDigest(a.linkedIssues,(0,i.normalizedObservationDigest)(c,"linkedIssues"),a.linkedIssues.complete),reviews:metaWithDigest(a.reviews,(0,i.normalizedObservationDigest)(c,"reviews"),a.reviews.complete),checks:metaWithDigest(a.checks,(0,i.normalizedObservationDigest)(c,"checks"),a.checks.complete),ownership:metaWithDigest(a.ownership,(0,i.normalizedObservationDigest)(c,"ownership"),a.ownership.complete),reviewability:metaWithDigest(a.reviewability,(0,i.normalizedObservationDigest)(c,"reviewability"),a.reviewability.complete)};return{...o,observations:u}}async function collectAll(e,t,n,s){const i=n.allowConfirmedAbsence??false;const o=await Promise.all([r.e(815),r.e(113)]).then(r.bind(r,3113)).then(({fetchTrustedBasePolicy:r})=>r(e,t.owner,t.name,t.baseSha,i,s));const m=await(0,a.collectChangedPaths)(e,t.owner,t.name,t.pullRequestNumber,t.headSha,s);const g=await(0,c.collectCodeowners)(e,t.owner,t.name,t.baseSha,m.paths,i,s);const v=await(0,u.collectLinkedIssues)(e,t.owner,t.name,t.pullRequestNumber,t.headSha,s);const y=await(0,d.collectChecks)(e,t.owner,t.name,t.testedSha,s);const b=await(0,l.collectReviews)(e,t.owner,t.name,t.pullRequestNumber,t.testedSha,t.authorId,s);const w=unique([...t.owner.length>0?[]:[],...g.requirements.flatMap(e=>e.owners),...o.artifact?.policy.sensitivePaths?.flatMap(e=>e.requiredReviewers)??[]]);const $=await(0,p.qualifyReviews)(e,b.reviews,t.owner,t.name,w,s);const S={...b,reviews:$.reviews,collaboratorMeta:$.collaboratorMeta,teamMeta:$.teamMeta,diagnostics:[...b.diagnostics,...$.diagnostics]};const k=await(0,f.collectRulesets)(e,t.owner,t.name,t.baseRef,t.baseSha,i,s);const E=await(0,h.collectBranchProtection)(e,t.owner,t.name,t.baseRef,t.baseSha,i,s);return{policy:o,changed:m,codeowners:g,linked:v,checks:y,reviews:S,rulesets:k,branchProtection:E,reviewability:reviewability(m)}}function allDiagnostics(e){return[...e.policy.diagnostics,...e.changed.diagnostics,...e.codeowners.diagnostics,...e.linked.diagnostics,...e.checks.diagnostics,...e.reviews.diagnostics,...e.rulesets.diagnostics,...e.branchProtection.diagnostics]}function inputGroupDigests(e){return{policySources:(0,i.normalizedObservationDigest)(e,"policySources"),changedPaths:(0,i.normalizedObservationDigest)(e,"changedPaths"),linkedIssues:(0,i.normalizedObservationDigest)(e,"linkedIssues"),reviews:(0,i.normalizedObservationDigest)(e,"reviews"),checks:(0,i.normalizedObservationDigest)(e,"checks"),ownership:(0,i.normalizedObservationDigest)(e,"ownership"),reviewability:(0,i.normalizedObservationDigest)(e,"reviewability")}}function fatalNativeDiagnostic(e){if(!e.rulesets.meta.complete||!e.branchProtection.meta.complete)return(0,m.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","Native ruleset or branch-protection visibility is incomplete; the current evaluator cannot safely treat unknown native controls as absent.",{remediation:"Grant the documented native-control read permissions and rerun, or keep the native-control snapshot rejected.",snapshotEvaluable:false,exitCode:2});return undefined}function capabilityObservations(e){return[{endpoint:"contents/patchgate.yml or .github/patchgate.yml",capability:"contents:read",state:e.policy.meta.permissionState,affectedRequirements:["policy.base_revision"],remediation:"Grant Contents: read or keep policy authority ambiguous."},{endpoint:"pulls/files",capability:"pull requests:read",state:e.changed.meta.permissionState,affectedRequirements:["changed_paths","ownership","human_handoff"],remediation:"Grant Pull requests: read."},{endpoint:"graphql:closingIssuesReferences",capability:"pull requests:read",state:e.linked.meta.permissionState,affectedRequirements:["issue.linkage"],remediation:"Grant the documented GraphQL/pull-request read capability; body-only issue text is not a substitute."},{endpoint:"commits/{testedSha}/check-runs",capability:"checks:read",state:e.checks.checkRunsMeta.permissionState,affectedRequirements:["required_check"],remediation:"Grant Checks: read for the exact tested SHA."},{endpoint:"actions/runs?head_sha",capability:"actions:read",state:e.checks.workflowMeta.permissionState,affectedRequirements:["required_check"],remediation:"Grant Actions: read so workflow ID, run attempt, event and suite relation can be verified."},{endpoint:"pulls/reviews",capability:"pull requests:read",state:e.reviews.meta.permissionState,affectedRequirements:["ownership","human_handoff"],remediation:"Grant Pull requests: read and collaborator/team visibility."},{endpoint:"collaborators/{login}/permission",capability:"repository collaborator visibility",state:e.reviews.collaboratorMeta.permissionState,affectedRequirements:["ownership","human_handoff"],remediation:"Grant collaborator permission visibility; an unverified reviewer is not qualified."},{endpoint:"teams/{slug}+memberships/{login}",capability:"organization members:read",state:e.reviews.teamMeta.permissionState,affectedRequirements:["ownership","human_handoff"],remediation:"Grant team identity and membership visibility, or keep team-backed qualification unknown."},{endpoint:"contents/CODEOWNERS@base",capability:"contents:read",state:e.codeowners.meta.permissionState,affectedRequirements:["ownership"],remediation:"Grant Contents: read for the CODEOWNERS search order at base SHA."},{endpoint:"rulesets+branch-protection",capability:"metadata/administration:read",state:e.rulesets.meta.complete&&e.branchProtection.meta.complete?"sufficient":"unknown",affectedRequirements:["native controls"],remediation:"Grant native-control read permissions; inaccessible controls are not absent."}]}async function buildGitHubSnapshot(e,t,r={}){let n;try{if(r.allowConfirmedAbsence===true&&t.authKind!=="mock")throw new m.GitHubAdapterError((0,m.makeDiagnostic)("GITHUB_API_UNSUPPORTED","Confirmed resource absence is available only for recorded/mock transports; live 404 responses remain unknown.",{remediation:"Remove --allow-confirmed-absence from live retrieval or use an explicit authenticated absence contract.",snapshotEvaluable:false,exitCode:2}));n=await(0,g.resolvePullRequestIdentity)(t,e);const i=await collectAll(t,n,r,"collection");const a=fatalNativeDiagnostic(i);if(a!==undefined)return{kind:"rejected",diagnostic:a,metrics:t.budget.snapshot(),capability:(0,o.capabilityReport)(n,t.authKind,t.origin,t.apiVersion,capabilityObservations(i),allDiagnostics(i))};const c=buildInput(n,i);(0,s.assertEvaluationInput)(c);const u=inputGroupDigests(c);const d=await(0,g.resolvePullRequestIdentity)(t,e,"finalization");(0,v.assertTargetStable)(n,d);const l=await collectAll(t,d,r,"finalization");const p=fatalNativeDiagnostic(l);if(p!==undefined)return{kind:"rejected",diagnostic:p,metrics:t.budget.snapshot(),capability:(0,o.capabilityReport)(n,t.authKind,t.origin,t.apiVersion,capabilityObservations(l),allDiagnostics(l))};const f=buildInput(d,l);(0,s.assertEvaluationInput)(f);const h=inputGroupDigests(f);for(const e of Object.keys(u))(0,v.assertObservationStable)(e,u[e],h[e]);if(i.policy.rawDigest!==l.policy.rawDigest)throw new m.GitHubAdapterError((0,m.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","The trusted base policy changed during finalization.",{observation:"policySources",snapshotEvaluable:false,exitCode:2}));if(i.rulesets.source?.digest!==l.rulesets.source?.digest||i.branchProtection.source?.digest!==l.branchProtection.source?.digest)throw new m.GitHubAdapterError((0,m.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS","Native control provenance changed during finalization.",{observation:"policySources",snapshotEvaluable:false,exitCode:2}));const y=allDiagnostics(i);const b=(0,o.capabilityReport)(n,t.authKind,t.origin,t.apiVersion,capabilityObservations(i),y);return{kind:"built",input:c,identity:n,diagnostics:y,metrics:t.budget.snapshot(),capability:b}}catch(e){const r=(0,m.diagnosticFrom)(e,"GITHUB_PROVENANCE_AMBIGUOUS");const s=n===undefined?[{endpoint:"repos/{owner}/{name}",capability:"repository metadata:read",state:r.permissionState,affectedRequirements:["repository.identity"],remediation:"Grant repository metadata read and pull-request visibility to the authenticated read-only credential."}]:[];return{kind:"rejected",diagnostic:r,metrics:t.budget.snapshot(),capability:(0,o.capabilityReport)(n,t.authKind,t.origin,t.apiVersion,s,[r])}}}},7969:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.assertTargetStable=assertTargetStable;t.assertObservationStable=assertObservationStable;const n=r(2355);const s=r(7369);function assertTargetStable(e,t){if(!(0,s.sameSnapshotIdentity)(e,t))throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_TARGET_CHANGED","The pull-request target identity changed during snapshot finalization.",{remediation:"Discard the snapshot and rerun the complete read-only evaluation against the new base/head/merge identity.",snapshotEvaluable:false,exitCode:2}))}function assertObservationStable(e,t,r){if(t!==r)throw new n.GitHubAdapterError((0,n.makeDiagnostic)("GITHUB_PROVENANCE_AMBIGUOUS",`The ${e} observation changed during snapshot finalization.`,{observation:e,remediation:"Discard the complete snapshot and rerun; do not patch old observations with new data.",snapshotEvaluable:false,exitCode:2}))}},7665:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:true});t.collectWorkflowRuns=collectWorkflowRuns;const n=r(2823);const s=r(6299);const i=r(2355);function parseRuns(e){if(!(0,n.isRecord)(e)||!Array.isArray(e.workflow_runs))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED","The workflow-runs response was malformed.",{observation:"checks",snapshotEvaluable:false,exitCode:2}));const t=(0,n.readPositiveInt)(e,"total_count");if(t!==undefined&&t>1e3)throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_PAGINATION_LIMIT","The workflow-runs search exceeded GitHub's documented 1,000-result search limit.",{observation:"checks",remediation:"Narrow the workflow-run query or treat required workflow evidence as incomplete."}));return e.workflow_runs.map((e,t)=>{if(!(0,n.isRecord)(e))throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Workflow run ${t} was malformed.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));const r=(0,n.readPositiveInt)(e,"id");const s=(0,n.readString)(e,"head_sha");const o=(0,n.readString)(e,"event");const a=(0,n.readPositiveInt)(e,"workflow_id");const c=(0,n.readString)(e,"status");const u=(0,n.readPositiveInt)(e,"run_attempt");if(r===undefined||s===undefined||o===undefined||a===undefined||c===undefined||u===undefined)throw new i.GitHubAdapterError((0,i.makeDiagnostic)("GITHUB_RESPONSE_MALFORMED",`Workflow run ${t} lacked immutable identity fields.`,{observation:"checks",snapshotEvaluable:false,exitCode:2}));const d=(0,n.readString)(e,"path");const l=(0,n.readString)(e,"conclusion");const p=(0,n.readPositiveInt)(e,"check_suite_id");return{id:r,head_sha:s,event:o,workflow_id:a,status:c,run_attempt:u,...d===undefined?{}:{path:d},...l===undefined?{}:{conclusion:l},...p===undefined?{}:{check_suite_id:p}}})}async function collectWorkflowRuns(e,t,r,n,i="collection"){return(0,s.collectPaginated)(e,{method:"GET",path:`/repos/${encodeURIComponent(t)}/${encodeURIComponent(r)}/actions/runs`,query:{head_sha:n,per_page:100}},"workflows",parseRuns,e=>`${e.id}:${e.run_attempt}`,{phase:i})}},311:(e,t)=>{Object.defineProperty(t,"__esModule",{value:true});t.EVALUATOR_VERSION=void 0;t.EVALUATOR_VERSION="0.1.0-dev"},181:t=>{t.exports=e(import.meta.url)("buffer")},1421:t=>{t.exports=e(import.meta.url)("node:child_process")},7598:t=>{t.exports=e(import.meta.url)("node:crypto")},3024:t=>{t.exports=e(import.meta.url)("node:fs")},1455:t=>{t.exports=e(import.meta.url)("node:fs/promises")},6760:t=>{t.exports=e(import.meta.url)("node:path")},7975:t=>{t.exports=e(import.meta.url)("node:util")},932:t=>{t.exports=e(import.meta.url)("process")},4352:(e,t,r)=>{const{normalizeIPv6:n,removeDotSegments:s,recomposeAuthority:i,normalizePercentEncoding:o,normalizePathEncoding:a,escapePreservingEscapes:c,reescapeHostDelimiters:u,isIPv4:d,nonSimpleDomain:l}=r(5077);const{SCHEMES:p,getSchemeHandler:f}=r(5300);function normalize(e,t){if(typeof e==="string"){e=normalizeString(e,t)}else if(typeof e==="object"){e=parse(serialize(e,t),t)}return e}function resolve(e,t,r){const n=r?Object.assign({scheme:"null"},r):{scheme:"null"};const{parsed:s,malformedAuthorityOrPort:i}=parseWithStatus(e,n);const{parsed:o,malformedAuthorityOrPort:a}=parseWithStatus(t,n);if(i||a){throw new Error(s.error||o.error||"URI is malformed.")}const c=resolveComponent(s,o,n,true);n.skipEscape=true;return serialize(c,n)}function resolveComponent(e,t,r,n){const i={};if(!n){e=parse(serialize(e,r),r);t=parse(serialize(t,r),r)}r=r||{};if(!r.tolerant&&t.scheme){i.scheme=t.scheme;i.userinfo=t.userinfo;i.host=t.host;i.port=t.port;i.path=s(t.path||"");i.query=t.query}else{if(t.userinfo!==undefined||t.host!==undefined||t.port!==undefined){i.userinfo=t.userinfo;i.host=t.host;i.port=t.port;i.path=s(t.path||"");i.query=t.query}else{if(!t.path){i.path=e.path;if(t.query!==undefined){i.query=t.query}else{i.query=e.query}}else{if(t.path[0]==="/"){i.path=s(t.path)}else{if((e.userinfo!==undefined||e.host!==undefined||e.port!==undefined)&&!e.path){i.path="/"+t.path}else if(!e.path){i.path=t.path}else{i.path=e.path.slice(0,e.path.lastIndexOf("/")+1)+t.path}i.path=s(i.path)}i.query=t.query}i.userinfo=e.userinfo;i.host=e.host;i.port=e.port}i.scheme=e.scheme}i.fragment=t.fragment;return i}function equal(e,t,r){const n=normalizeComparableURI(e,r);const s=normalizeComparableURI(t,r);return n!==undefined&&s!==undefined&&n.toLowerCase()===s.toLowerCase()}function serialize(e,t){const r={host:e.host,scheme:e.scheme,userinfo:e.userinfo,port:e.port,path:e.path,query:e.query,nid:e.nid,nss:e.nss,uuid:e.uuid,fragment:e.fragment,reference:e.reference,resourceName:e.resourceName,secure:e.secure,error:""};const n=Object.assign({},t);const a=[];const u=f(n.scheme||r.scheme);if(u&&u.serialize)u.serialize(r,n);if(r.path!==undefined){if(!n.skipEscape){r.path=c(r.path);if(r.scheme!==undefined){r.path=r.path.split("%3A").join(":")}}else{r.path=o(r.path)}}if(n.reference!=="suffix"&&r.scheme){a.push(r.scheme,":")}const d=i(r);if(d!==undefined){if(n.reference!=="suffix"){a.push("//")}a.push(d);if(r.path&&r.path[0]!=="/"){a.push("/")}}if(r.path!==undefined){let e=r.path;if(!n.absolutePath&&(!u||!u.absolutePath)){e=s(e)}if(d===undefined&&e[0]==="/"&&e[1]==="/"){e="/%2F"+e.slice(2)}a.push(e)}if(r.query!==undefined){a.push("?",r.query)}if(r.fragment!==undefined){a.push("#",r.fragment)}return a.join("")}const h=/^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;const m=/^(?:[^#/:?]+:)?\/\/([^/?#]*)/;const g=/^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;function getParseError(e,t){if(t[2]!==undefined&&e.path&&e.path[0]!=="/"){return'URI path must start with "/" when authority is present.'}if(typeof e.port==="number"&&(e.port<0||e.port>65535)){return"URI port is malformed."}return undefined}function parseWithStatus(e,t){const r=Object.assign({},t);const s={scheme:undefined,userinfo:undefined,host:"",port:undefined,path:"",query:undefined,fragment:undefined};let i=false;let o=false;if(r.reference==="suffix"){if(r.scheme){e=r.scheme+":"+e}else{e="//"+e}}const c=e.match(m);if(c!==null&&c[1].indexOf("\\")!==-1){s.error="URI authority must not contain a literal backslash.";i=true}const p=e.match(g);if(p!==null){const e=p[1];const t=e.replace(/[\t\n\r]/g,"");if(t.length>=2){if(t.slice(0,2)!=="//"){s.error=s.error||"URI authority must not contain a literal backslash.";i=true}else if(e.length!==t.length){s.error=s.error||"URI authority introducer must not contain whitespace.";i=true}}}const v=e.match(h);if(v){s.scheme=v[1];s.userinfo=v[3];s.host=v[4];s.port=parseInt(v[5],10);s.path=v[6]||"";s.query=v[7];s.fragment=v[8];if(isNaN(s.port)){s.port=v[5]}const t=getParseError(s,v);if(t!==undefined){s.error=s.error||t;i=true}if(s.host){const e=d(s.host);if(e===false){const e=n(s.host);s.host=e.host.toLowerCase();o=e.isIPV6}else{o=true}}if(s.scheme===undefined&&s.userinfo===undefined&&s.host===undefined&&s.port===undefined&&s.query===undefined&&!s.path){s.reference="same-document"}else if(s.scheme===undefined){s.reference="relative"}else if(s.fragment===undefined){s.reference="absolute"}else{s.reference="uri"}if(r.reference&&r.reference!=="suffix"&&r.reference!==s.reference){s.error=s.error||"URI is not a "+r.reference+" reference."}const c=f(r.scheme||s.scheme);if(!r.unicodeSupport&&(!c||!c.unicodeSupport)){if(s.host&&(r.domainHost||c&&c.domainHost)&&o===false&&l(s.host)){try{s.host=new URL("http://"+s.host).hostname}catch(e){s.error=s.error||"Host's domain name can not be converted to ASCII: "+e}}}if(!c||c&&!c.skipNormalize){if(e.indexOf("%")!==-1){if(s.scheme!==undefined){s.scheme=unescape(s.scheme)}if(s.host!==undefined){s.host=u(unescape(s.host),o)}}if(s.path){s.path=a(s.path)}if(s.fragment){try{s.fragment=encodeURI(decodeURIComponent(s.fragment))}catch{s.error=s.error||"URI malformed"}}}if(c&&c.parse){c.parse(s,r)}}else{s.error=s.error||"URI can not be parsed."}return{parsed:s,malformedAuthorityOrPort:i}}function parse(e,t){return parseWithStatus(e,t).parsed}function normalizeString(e,t){return normalizeStringWithStatus(e,t).normalized}function normalizeStringWithStatus(e,t){const{parsed:r,malformedAuthorityOrPort:n}=parseWithStatus(e,t);return{normalized:n?e:serialize(r,t),malformedAuthorityOrPort:n}}function normalizeComparableURI(e,t){if(typeof e==="string"){const{normalized:r,malformedAuthorityOrPort:n}=normalizeStringWithStatus(e,t);return n?undefined:r}if(typeof e==="object"){return serialize(e,t)}}const v={SCHEMES:p,normalize:normalize,resolve:resolve,resolveComponent:resolveComponent,equal:equal,serialize:serialize,parse:parse};e.exports=v;e.exports["default"]=v;e.exports.fastUri=v},5300:(e,t,r)=>{const{isUUID:n}=r(5077);const s=/([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;const i=["http","https","ws","wss","urn","urn:uuid"];function isValidSchemeName(e){return i.indexOf(e)!==-1}function wsIsSecure(e){if(e.secure===true){return true}else if(e.secure===false){return false}else if(e.scheme){return e.scheme.length===3&&(e.scheme[0]==="w"||e.scheme[0]==="W")&&(e.scheme[1]==="s"||e.scheme[1]==="S")&&(e.scheme[2]==="s"||e.scheme[2]==="S")}else{return false}}function httpParse(e){if(!e.host){e.error=e.error||"HTTP URIs must have a host."}return e}function httpSerialize(e){const t=String(e.scheme).toLowerCase()==="https";if(e.port===(t?443:80)||e.port===""){e.port=undefined}if(!e.path){e.path="/"}return e}function wsParse(e){e.secure=wsIsSecure(e);e.resourceName=(e.path||"/")+(e.query?"?"+e.query:"");e.path=undefined;e.query=undefined;return e}function wsSerialize(e){if(e.port===(wsIsSecure(e)?443:80)||e.port===""){e.port=undefined}if(typeof e.secure==="boolean"){e.scheme=e.secure?"wss":"ws";e.secure=undefined}if(e.resourceName){const[t,r]=e.resourceName.split("?");e.path=t&&t!=="/"?t:undefined;e.query=r;e.resourceName=undefined}e.fragment=undefined;return e}function urnParse(e,t){if(!e.path){e.error="URN can not be parsed";return e}const r=e.path.match(s);if(r){const n=t.scheme||e.scheme||"urn";e.nid=r[1].toLowerCase();e.nss=r[2];const s=`${n}:${t.nid||e.nid}`;const i=getSchemeHandler(s);e.path=undefined;if(i){e=i.parse(e,t)}}else{e.error=e.error||"URN can not be parsed."}return e}function urnSerialize(e,t){if(e.nid===undefined){throw new Error("URN without nid cannot be serialized")}const r=t.scheme||e.scheme||"urn";const n=e.nid.toLowerCase();const s=`${r}:${t.nid||n}`;const i=getSchemeHandler(s);if(i){e=i.serialize(e,t)}const o=e;const a=e.nss;o.path=`${n||t.nid}:${a}`;t.skipEscape=true;return o}function urnuuidParse(e,t){const r=e;r.uuid=r.nss;r.nss=undefined;if(!t.tolerant&&(!r.uuid||!n(r.uuid))){r.error=r.error||"UUID is not valid."}return r}function urnuuidSerialize(e){const t=e;t.nss=(e.uuid||"").toLowerCase();return t}const o={scheme:"http",domainHost:true,parse:httpParse,serialize:httpSerialize};const a={scheme:"https",domainHost:o.domainHost,parse:httpParse,serialize:httpSerialize};const c={scheme:"ws",domainHost:true,parse:wsParse,serialize:wsSerialize};const u={scheme:"wss",domainHost:c.domainHost,parse:c.parse,serialize:c.serialize};const d={scheme:"urn",parse:urnParse,serialize:urnSerialize,skipNormalize:true};const l={scheme:"urn:uuid",parse:urnuuidParse,serialize:urnuuidSerialize,skipNormalize:true};const p={http:o,https:a,ws:c,wss:u,urn:d,"urn:uuid":l};Object.setPrototypeOf(p,null);function getSchemeHandler(e){return e&&(p[e]||p[e.toLowerCase()])||undefined}e.exports={wsIsSecure:wsIsSecure,SCHEMES:p,isValidSchemeName:isValidSchemeName,getSchemeHandler:getSchemeHandler}},5077:e=>{const t=RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);const r=RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);const n=RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);const s=RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);const i=RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);function stringArrayToHexStripped(e){let t="";let r=0;let n=0;for(n=0;n<e.length;n++){r=e[n].charCodeAt(0);if(r===48){continue}if(!(r>=48&&r<=57||r>=65&&r<=70||r>=97&&r<=102)){return""}t+=e[n];break}for(n+=1;n<e.length;n++){r=e[n].charCodeAt(0);if(!(r>=48&&r<=57||r>=65&&r<=70||r>=97&&r<=102)){return""}t+=e[n]}return t}const o=RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);function consumeIsZone(e){e.length=0;return true}function consumeHextets(e,t,r){if(e.length){const n=stringArrayToHexStripped(e);if(n!==""){t.push(n)}else{r.error=true;return false}e.length=0}return true}function getIPV6(e){let t=0;const r={error:false,address:"",zone:""};const n=[];const s=[];let i=false;let o=false;let a=consumeHextets;for(let c=0;c<e.length;c++){const u=e[c];if(u==="["||u==="]"){continue}if(u===":"){if(i===true){o=true}if(!a(s,n,r)){break}if(++t>7){r.error=true;break}if(c>0&&e[c-1]===":"){i=true}n.push(":");continue}else if(u==="%"){if(!a(s,n,r)){break}a=consumeIsZone}else{s.push(u);continue}}if(s.length){if(a===consumeIsZone){r.zone=s.join("")}else if(o){n.push(s.join(""))}else{n.push(stringArrayToHexStripped(s))}}r.address=n.join("");return r}function normalizeIPv6(e){if(findToken(e,":")<2){return{host:e,isIPV6:false}}const t=getIPV6(e);if(!t.error){let e=t.address;let r=t.address;if(t.zone){e+="%"+t.zone;r+="%25"+t.zone}return{host:e,isIPV6:true,escapedHost:r}}else{return{host:e,isIPV6:false}}}function findToken(e,t){let r=0;for(let n=0;n<e.length;n++){if(e[n]===t)r++}return r}function removeDotSegments(e){let t=e;const r=[];let n=-1;let s=0;while(s=t.length){if(s===1){if(t==="."){break}else if(t==="/"){r.push("/");break}else{r.push(t);break}}else if(s===2){if(t[0]==="."){if(t[1]==="."){break}else if(t[1]==="/"){t=t.slice(2);continue}}else if(t[0]==="/"){if(t[1]==="."||t[1]==="/"){r.push("/");break}}}else if(s===3){if(t==="/.."){if(r.length!==0){r.pop()}r.push("/");break}}if(t[0]==="."){if(t[1]==="."){if(t[2]==="/"){t=t.slice(3);continue}}else if(t[1]==="/"){t=t.slice(2);continue}}else if(t[0]==="/"){if(t[1]==="."){if(t[2]==="/"){t=t.slice(2);continue}else if(t[2]==="."){if(t[3]==="/"){t=t.slice(3);if(r.length!==0){r.pop()}continue}}}}if((n=t.indexOf("/",1))===-1){r.push(t);break}else{r.push(t.slice(0,n));t=t.slice(n)}}return r.join("")}const a={"@":"%40","/":"%2F","?":"%3F","#":"%23",":":"%3A"};const c=/[@/?#:]/g;const u=/[@/?#]/g;function reescapeHostDelimiters(e,t){const r=t?u:c;r.lastIndex=0;return e.replace(r,e=>a[e])}function normalizePercentEncoding(e,t=false){if(e.indexOf("%")===-1){return e}let r="";for(let i=0;i<e.length;i++){if(e[i]==="%"&&i+2<e.length){const o=e.slice(i+1,i+3);if(n(o)){const e=o.toUpperCase();const n=String.fromCharCode(parseInt(e,16));if(t&&s(n)){r+=n}else{r+="%"+e}i+=2;continue}}r+=e[i]}return r}function normalizePathEncoding(e){let t="";for(let r=0;r<e.length;r++){if(e[r]==="%"&&r+2<e.length){const i=e.slice(r+1,r+3);if(n(i)){const e=i.toUpperCase();const n=String.fromCharCode(parseInt(e,16));if(n!=="."&&s(n)){t+=n}else{t+="%"+e}r+=2;continue}}if(i(e[r])){t+=e[r]}else{t+=escape(e[r])}}return t}function escapePreservingEscapes(e){let t="";for(let r=0;r<e.length;r++){if(e[r]==="%"&&r+2<e.length){const s=e.slice(r+1,r+3);if(n(s)){t+="%"+s.toUpperCase();r+=2;continue}}t+=escape(e[r])}return t}function recomposeAuthority(e){const t=[];if(e.userinfo!==undefined){t.push(e.userinfo);t.push("@")}if(e.host!==undefined){let n=unescape(e.host);if(!r(n)){const e=normalizeIPv6(n);if(e.isIPV6===true){n=`[${e.escapedHost}]`}else{n=reescapeHostDelimiters(n,false)}}t.push(n)}if(typeof e.port==="number"||typeof e.port==="string"){t.push(":");t.push(String(e.port))}return t.length?t.join(""):undefined}e.exports={nonSimpleDomain:o,recomposeAuthority:recomposeAuthority,reescapeHostDelimiters:reescapeHostDelimiters,normalizePercentEncoding:normalizePercentEncoding,normalizePathEncoding:normalizePathEncoding,escapePreservingEscapes:escapePreservingEscapes,removeDotSegments:removeDotSegments,isIPv4:r,isUUID:t,normalizeIPv6:normalizeIPv6,stringArrayToHexStripped:stringArrayToHexStripped}},3837:e=>{e.exports=JSON.parse('{"$id":"https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#","description":"Meta-schema for $data reference (JSON AnySchema extension proposal)","type":"object","required":["$data"],"properties":{"$data":{"type":"string","anyOf":[{"format":"relative-json-pointer"},{"format":"json-pointer"}]}},"additionalProperties":false}')},7216:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/applicator","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/applicator":true},"$dynamicAnchor":"meta","title":"Applicator vocabulary meta-schema","type":["object","boolean"],"properties":{"prefixItems":{"$ref":"#/$defs/schemaArray"},"items":{"$dynamicRef":"#meta"},"contains":{"$dynamicRef":"#meta"},"additionalProperties":{"$dynamicRef":"#meta"},"properties":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"default":{}},"patternProperties":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"propertyNames":{"format":"regex"},"default":{}},"dependentSchemas":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"default":{}},"propertyNames":{"$dynamicRef":"#meta"},"if":{"$dynamicRef":"#meta"},"then":{"$dynamicRef":"#meta"},"else":{"$dynamicRef":"#meta"},"allOf":{"$ref":"#/$defs/schemaArray"},"anyOf":{"$ref":"#/$defs/schemaArray"},"oneOf":{"$ref":"#/$defs/schemaArray"},"not":{"$dynamicRef":"#meta"}},"$defs":{"schemaArray":{"type":"array","minItems":1,"items":{"$dynamicRef":"#meta"}}}}')},8226:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/content","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/content":true},"$dynamicAnchor":"meta","title":"Content vocabulary meta-schema","type":["object","boolean"],"properties":{"contentEncoding":{"type":"string"},"contentMediaType":{"type":"string"},"contentSchema":{"$dynamicRef":"#meta"}}}')},518:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/core","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/core":true},"$dynamicAnchor":"meta","title":"Core vocabulary meta-schema","type":["object","boolean"],"properties":{"$id":{"$ref":"#/$defs/uriReferenceString","$comment":"Non-empty fragments not allowed.","pattern":"^[^#]*#?$"},"$schema":{"$ref":"#/$defs/uriString"},"$ref":{"$ref":"#/$defs/uriReferenceString"},"$anchor":{"$ref":"#/$defs/anchorString"},"$dynamicRef":{"$ref":"#/$defs/uriReferenceString"},"$dynamicAnchor":{"$ref":"#/$defs/anchorString"},"$vocabulary":{"type":"object","propertyNames":{"$ref":"#/$defs/uriString"},"additionalProperties":{"type":"boolean"}},"$comment":{"type":"string"},"$defs":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"}}},"$defs":{"anchorString":{"type":"string","pattern":"^[A-Za-z_][-A-Za-z0-9._]*$"},"uriString":{"type":"string","format":"uri"},"uriReferenceString":{"type":"string","format":"uri-reference"}}}')},4588:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/format-annotation","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/format-annotation":true},"$dynamicAnchor":"meta","title":"Format vocabulary meta-schema for annotation results","type":["object","boolean"],"properties":{"format":{"type":"string"}}}')},5707:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/meta-data","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/meta-data":true},"$dynamicAnchor":"meta","title":"Meta-data vocabulary meta-schema","type":["object","boolean"],"properties":{"title":{"type":"string"},"description":{"type":"string"},"default":true,"deprecated":{"type":"boolean","default":false},"readOnly":{"type":"boolean","default":false},"writeOnly":{"type":"boolean","default":false},"examples":{"type":"array","items":true}}}')},9547:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/unevaluated","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/unevaluated":true},"$dynamicAnchor":"meta","title":"Unevaluated applicator vocabulary meta-schema","type":["object","boolean"],"properties":{"unevaluatedItems":{"$dynamicRef":"#meta"},"unevaluatedProperties":{"$dynamicRef":"#meta"}}}')},7082:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/validation","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/validation":true},"$dynamicAnchor":"meta","title":"Validation vocabulary meta-schema","type":["object","boolean"],"properties":{"type":{"anyOf":[{"$ref":"#/$defs/simpleTypes"},{"type":"array","items":{"$ref":"#/$defs/simpleTypes"},"minItems":1,"uniqueItems":true}]},"const":true,"enum":{"type":"array","items":true},"multipleOf":{"type":"number","exclusiveMinimum":0},"maximum":{"type":"number"},"exclusiveMaximum":{"type":"number"},"minimum":{"type":"number"},"exclusiveMinimum":{"type":"number"},"maxLength":{"$ref":"#/$defs/nonNegativeInteger"},"minLength":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"pattern":{"type":"string","format":"regex"},"maxItems":{"$ref":"#/$defs/nonNegativeInteger"},"minItems":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"uniqueItems":{"type":"boolean","default":false},"maxContains":{"$ref":"#/$defs/nonNegativeInteger"},"minContains":{"$ref":"#/$defs/nonNegativeInteger","default":1},"maxProperties":{"$ref":"#/$defs/nonNegativeInteger"},"minProperties":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"required":{"$ref":"#/$defs/stringArray"},"dependentRequired":{"type":"object","additionalProperties":{"$ref":"#/$defs/stringArray"}}},"$defs":{"nonNegativeInteger":{"type":"integer","minimum":0},"nonNegativeIntegerDefault0":{"$ref":"#/$defs/nonNegativeInteger","default":0},"simpleTypes":{"enum":["array","boolean","integer","null","number","object","string"]},"stringArray":{"type":"array","items":{"type":"string"},"uniqueItems":true,"default":[]}}}')},1678:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/schema","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/core":true,"https://json-schema.org/draft/2020-12/vocab/applicator":true,"https://json-schema.org/draft/2020-12/vocab/unevaluated":true,"https://json-schema.org/draft/2020-12/vocab/validation":true,"https://json-schema.org/draft/2020-12/vocab/meta-data":true,"https://json-schema.org/draft/2020-12/vocab/format-annotation":true,"https://json-schema.org/draft/2020-12/vocab/content":true},"$dynamicAnchor":"meta","title":"Core and Validation specifications meta-schema","allOf":[{"$ref":"meta/core"},{"$ref":"meta/applicator"},{"$ref":"meta/unevaluated"},{"$ref":"meta/validation"},{"$ref":"meta/meta-data"},{"$ref":"meta/format-annotation"},{"$ref":"meta/content"}],"type":["object","boolean"],"$comment":"This meta-schema also defines keywords that have appeared in previous drafts in order to prevent incompatible extensions as they remain in common use.","properties":{"definitions":{"$comment":"\\"definitions\\" has been replaced by \\"$defs\\".","type":"object","additionalProperties":{"$dynamicRef":"#meta"},"deprecated":true,"default":{}},"dependencies":{"$comment":"\\"dependencies\\" has been split and replaced by \\"dependentSchemas\\" and \\"dependentRequired\\" in order to serve their differing semantics.","type":"object","additionalProperties":{"anyOf":[{"$dynamicRef":"#meta"},{"$ref":"meta/validation#/$defs/stringArray"}]},"deprecated":true,"default":{}},"$recursiveAnchor":{"$comment":"\\"$recursiveAnchor\\" has been replaced by \\"$dynamicAnchor\\".","$ref":"meta/core#/$defs/anchorString","deprecated":true},"$recursiveRef":{"$comment":"\\"$recursiveRef\\" has been replaced by \\"$dynamicRef\\".","$ref":"meta/core#/$defs/uriReferenceString","deprecated":true}}}')},5761:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://patchgate.dev/schemas/contribution-receipt/0.1","title":"ContributionReceipt","type":"object","additionalProperties":false,"required":["schemaVersion","evaluatorVersion","repository","revisions","policyDigest","decisionInputDigest","receiptDigest","changedPaths","policySources","observations","evidence","requirements","humanGates","final","evaluatedAt"],"properties":{"schemaVersion":{"const":"0.1"},"evaluatorVersion":{"type":"string","pattern":"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\\\\+[0-9A-Za-z.-]+)?$"},"repository":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/repository"},"revisions":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/revisions"},"policyDigest":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/digest"},"decisionInputDigest":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/digest"},"receiptDigest":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/digest"},"changedPaths":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true},"policySources":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/policySource"}},"nativeControls":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nativeControls"},"observations":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/observations"},"evidence":{"type":"object","additionalProperties":false,"required":["checks","linkedIssues","reviews","ownershipRequirements"],"properties":{"checks":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/check"}},"linkedIssues":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/linkedIssue"}},"reviews":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/review"}},"ownershipRequirements":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/ownershipRequirement"}}}},"requirements":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/requirement"}},"reviewability":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/reviewabilitySnapshot"},"humanGates":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/humanGate"}},"final":{"type":"object","additionalProperties":false,"required":["status","reasonIds"],"properties":{"status":{"enum":["ready_for_review","blocked","human_review_required","evidence_missing","policy_ambiguous"]},"reasonIds":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true}}},"evaluatedAt":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/timestamp"}},"$defs":{"requirement":{"type":"object","additionalProperties":false,"required":["id","ruleClass","authority","source","result","severity","remediation","evidenceRefs"],"properties":{"id":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"ruleClass":{"enum":["policy_integrity","issue_linkage","required_check","ownership","human_handoff","reviewability"]},"authority":{"enum":["patchgate","codeowners","ruleset","branch_protection","derived"]},"source":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"result":{"enum":["passed","failed","unknown","advisory"]},"severity":{"enum":["block","human_gate","evidence","advisory"]},"observed":{"type":"object","additionalProperties":{"anyOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"}}]}},"remediation":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"evidenceRefs":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true}},"$comment":"failed + evidence is never emitted; status precedence would otherwise treat it as ready_for_review","not":{"properties":{"result":{"const":"failed"},"severity":{"const":"evidence"}},"required":["result","severity"]}},"humanGate":{"type":"object","additionalProperties":false,"required":["id","reason","satisfied","requiredReviewers","requiredCount","approvedBy"],"properties":{"id":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"reason":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"satisfied":{"type":"boolean"},"requiredReviewers":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true},"requiredCount":{"type":"integer","minimum":1},"approvedBy":{"type":"array","maxItems":3000,"items":{"$ref":"https://patchgate.dev/schemas/evaluation-input/0.1#/$defs/nonBlank"},"uniqueItems":true}}}}}')},6537:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://patchgate.dev/schemas/evaluation-input/0.1","title":"PatchGate evaluation input","type":"object","additionalProperties":false,"required":["schemaVersion","repository","revisions","policy","policySources","policyDigest","changedPaths","linkedIssues","reviews","checks","ownershipRequirements","observations"],"properties":{"schemaVersion":{"const":"0.1"},"repository":{"$ref":"#/$defs/repository"},"revisions":{"$ref":"#/$defs/revisions"},"policy":{"anyOf":[{"$ref":"https://patchgate.dev/schemas/patchgate-policy/0.1"},{"type":"null"}]},"policySources":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/policySource"}},"policyDigest":{"$ref":"#/$defs/digest"},"changedPaths":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"linkedIssues":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/linkedIssue"}},"reviews":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/review"}},"checks":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/check"}},"ownershipRequirements":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/ownershipRequirement"}},"nativeControls":{"$ref":"#/$defs/nativeControls"},"reviewability":{"$ref":"#/$defs/reviewabilitySnapshot"},"observations":{"$ref":"#/$defs/observations"}},"$defs":{"nonBlank":{"type":"string","minLength":1,"pattern":".*\\\\S.*","maxLength":100000},"digest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"},"timestamp":{"type":"string","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}:\\\\d{2}:\\\\d{2}(?:\\\\.\\\\d{3})?Z$"},"repository":{"type":"object","additionalProperties":false,"required":["owner","name","pullRequest"],"properties":{"owner":{"$ref":"#/$defs/nonBlank"},"name":{"$ref":"#/$defs/nonBlank"},"pullRequest":{"type":"integer","minimum":1}}},"revisions":{"type":"object","additionalProperties":false,"required":["baseSha","headSha","testedSha","targetKind"],"properties":{"baseSha":{"$ref":"#/$defs/nonBlank"},"headSha":{"$ref":"#/$defs/nonBlank"},"mergeSha":{"$ref":"#/$defs/nonBlank"},"mergeGroupSha":{"$ref":"#/$defs/nonBlank"},"testedSha":{"$ref":"#/$defs/nonBlank"},"targetKind":{"enum":["head","merge","merge_group"]}}},"policySource":{"type":"object","additionalProperties":false,"required":["kind","identity","revision","digest","authority"],"properties":{"kind":{"enum":["patchgate","codeowners","ruleset","branch_protection"]},"identity":{"$ref":"#/$defs/nonBlank"},"revision":{"$ref":"#/$defs/nonBlank"},"digest":{"$ref":"#/$defs/digest"},"contractDigest":{"$ref":"#/$defs/digest"},"authority":{"const":"enforced"}}},"observationSource":{"type":"object","additionalProperties":false,"required":["kind","identity"],"properties":{"kind":{"$ref":"#/$defs/nonBlank"},"identity":{"$ref":"#/$defs/nonBlank"}}},"observationMeta":{"type":"object","additionalProperties":false,"required":["source","retrievedAt","complete","permissionState"],"properties":{"source":{"$ref":"#/$defs/observationSource"},"revision":{"$ref":"#/$defs/nonBlank"},"retrievedAt":{"$ref":"#/$defs/timestamp"},"complete":{"type":"boolean"},"permissionState":{"enum":["sufficient","insufficient","unknown"]},"normalizedDigest":{"$ref":"#/$defs/digest"},"responseDigest":{"$ref":"#/$defs/digest"},"truncated":{"type":"boolean"},"nextCursor":{"$ref":"#/$defs/nonBlank"}}},"observations":{"type":"object","additionalProperties":false,"required":["policySources","changedPaths","linkedIssues","reviews","checks","ownership","reviewability"],"properties":{"policySources":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/observationMeta"}},"changedPaths":{"$ref":"#/$defs/observationMeta"},"linkedIssues":{"$ref":"#/$defs/observationMeta"},"reviews":{"$ref":"#/$defs/observationMeta"},"checks":{"$ref":"#/$defs/observationMeta"},"ownership":{"$ref":"#/$defs/observationMeta"},"reviewability":{"$ref":"#/$defs/observationMeta"}}},"linkedIssue":{"type":"object","additionalProperties":false,"required":["repository","number","repositoryId","issueId","linked"],"properties":{"repository":{"$ref":"#/$defs/nonBlank"},"number":{"type":"integer","minimum":1},"repositoryId":{"$ref":"#/$defs/nonBlank"},"issueId":{"$ref":"#/$defs/nonBlank"},"linked":{"type":"boolean"}}},"qualification":{"type":"object","additionalProperties":false,"required":["source","complete","permissionState"],"properties":{"source":{"$ref":"#/$defs/observationSource"},"revision":{"$ref":"#/$defs/nonBlank"},"complete":{"type":"boolean"},"permissionState":{"enum":["sufficient","insufficient","unknown"]},"principalBindings":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/qualificationPrincipal"},"uniqueItems":true}}},"qualificationPrincipal":{"type":"object","additionalProperties":false,"required":["configuredPrincipal","kind","immutableId","membershipState"],"properties":{"configuredPrincipal":{"$ref":"#/$defs/nonBlank"},"kind":{"enum":["user","team"]},"immutableId":{"type":"integer","minimum":1},"membershipState":{"enum":["active","pending","unknown"]}}},"review":{"type":"object","additionalProperties":false,"required":["reviewId","actorId","login","state","commitId","qualified","teams","teamIds","qualification","isAuthor","isBot","active"],"properties":{"reviewId":{"type":"integer","minimum":1},"actorId":{"type":"integer","minimum":1},"login":{"$ref":"#/$defs/nonBlank"},"state":{"enum":["APPROVED","CHANGES_REQUESTED","COMMENTED","DISMISSED"]},"commitId":{"$ref":"#/$defs/nonBlank"},"qualified":{"type":"boolean"},"teams":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"teamIds":{"type":"array","maxItems":3000,"items":{"type":"integer","minimum":1},"uniqueItems":true},"qualification":{"$ref":"#/$defs/qualification"},"isAuthor":{"type":"boolean"},"isBot":{"type":"boolean"},"active":{"type":"boolean"}}},"check":{"type":"object","additionalProperties":false,"required":["name","status","testedSha","sourceStrength","retrievedAt"],"allOf":[{"if":{"properties":{"status":{"const":"completed"}},"required":["status"]},"then":{"properties":{"conclusion":{"$ref":"#/$defs/nonBlank"}},"required":["conclusion"]}},{"if":{"properties":{"sourceStrength":{"const":"github_app_expected"}},"required":["sourceStrength"]},"then":{"properties":{"appId":{"type":"integer","minimum":1},"checkRunId":{"type":"integer","minimum":1}},"required":["appId","checkRunId"]}},{"if":{"properties":{"sourceStrength":{"const":"github_actions_workflow"}},"required":["sourceStrength"]},"then":{"properties":{"appId":{"type":"integer","minimum":1},"workflowRunId":{"type":"integer","minimum":1},"workflowRunAttempt":{"type":"integer","minimum":1},"event":{"$ref":"#/$defs/nonBlank"}},"required":["appId","workflowRunId","workflowRunAttempt","event"]}}],"properties":{"name":{"$ref":"#/$defs/nonBlank"},"status":{"enum":["queued","in_progress","completed"]},"conclusion":{"$ref":"#/$defs/nonBlank"},"testedSha":{"$ref":"#/$defs/nonBlank"},"appSlug":{"$ref":"#/$defs/nonBlank"},"appId":{"type":"integer","minimum":1},"checkRunId":{"type":"integer","minimum":1},"checkSuiteId":{"type":"integer","minimum":1},"workflowId":{"type":"integer","minimum":1},"workflowPath":{"$ref":"#/$defs/nonBlank"},"workflowRunId":{"type":"integer","minimum":1},"workflowRunAttempt":{"type":"integer","minimum":1},"event":{"$ref":"#/$defs/nonBlank"},"sourceStrength":{"enum":["github_app_expected","github_actions_workflow","unattributed"]},"retrievedAt":{"$ref":"#/$defs/timestamp"}}},"ownershipRequirement":{"type":"object","additionalProperties":false,"required":["id","owners","requiredCount"],"properties":{"id":{"$ref":"#/$defs/nonBlank"},"owners":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"requiredCount":{"type":"integer","minimum":1}}},"nativeBranchProtectionCheck":{"type":"object","additionalProperties":false,"required":["context"],"properties":{"context":{"$ref":"#/$defs/nonBlank"},"appId":{"type":"integer","minimum":1}}},"nativeBranchProtection":{"type":"object","additionalProperties":false,"required":["requiredChecks","requiredApprovals","requireCodeOwnerReviews","requireLastPushApproval","staleReviews","requiredReviewThreadResolution","bypassVisible","decisionBearing"],"properties":{"requiredChecks":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nativeBranchProtectionCheck"},"uniqueItems":true},"requiredApprovals":{"type":"integer","minimum":0},"requireCodeOwnerReviews":{"type":"boolean"},"requireLastPushApproval":{"type":"boolean"},"staleReviews":{"type":"boolean"},"requiredReviewThreadResolution":{"type":"boolean"},"bypassVisible":{"type":"boolean"},"decisionBearing":{"type":"boolean"}}},"nativeRuleset":{"type":"object","additionalProperties":false,"required":["id","name","sourceType","source","enforcement","applicable","ruleTypes","requiredChecks","requiredApprovals","requireCodeOwnerReviews","requireLastPushApproval","staleReviews","requiredReviewThreadResolution","bypassVisible","decisionBearing"],"properties":{"id":{"type":"integer","minimum":1},"name":{"$ref":"#/$defs/nonBlank"},"sourceType":{"$ref":"#/$defs/nonBlank"},"source":{"$ref":"#/$defs/nonBlank"},"enforcement":{"enum":["active","evaluate","disabled","unknown"]},"applicable":{"type":"boolean"},"ruleTypes":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"requiredChecks":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nativeBranchProtectionCheck"},"uniqueItems":true},"requiredApprovals":{"type":"integer","minimum":0},"requireCodeOwnerReviews":{"type":"boolean"},"requireLastPushApproval":{"type":"boolean"},"staleReviews":{"type":"boolean"},"requiredReviewThreadResolution":{"type":"boolean"},"bypassVisible":{"type":"boolean"},"decisionBearing":{"type":"boolean"}}},"nativeControls":{"type":"object","additionalProperties":false,"properties":{"branchProtection":{"$ref":"#/$defs/nativeBranchProtection"},"rulesets":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nativeRuleset"},"uniqueItems":true}}},"reviewabilitySnapshot":{"type":"object","additionalProperties":false,"required":["fileCount","ownershipDomains","generatedFileCount","boundaryCount"],"properties":{"fileCount":{"type":"integer","minimum":0},"ownershipDomains":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/nonBlank"},"uniqueItems":true},"generatedFileCount":{"type":"integer","minimum":0},"boundaryCount":{"type":"integer","minimum":0}}}}}')},3578:e=>{e.exports=JSON.parse('{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://patchgate.dev/schemas/patchgate-policy/0.1","title":"PatchGate policy","type":"object","additionalProperties":false,"required":["version"],"properties":{"version":{"const":1},"issueLinkage":{"type":"object","additionalProperties":false,"required":["required"],"properties":{"required":{"type":"boolean"}}},"requiredChecks":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/requiredCheck"},"uniqueItems":true},"ownership":{"type":"object","additionalProperties":false,"required":["requireCodeOwnerApproval"],"properties":{"requireCodeOwnerApproval":{"type":"boolean"}}},"sensitivePaths":{"type":"array","maxItems":3000,"items":{"$ref":"#/$defs/sensitivePathRule"},"uniqueItems":true},"policyChanges":{"$ref":"#/$defs/policyChanges"},"reviewability":{"$ref":"#/$defs/reviewability"}},"$defs":{"expectedSource":{"type":"object","additionalProperties":false,"required":["kind"],"properties":{"kind":{"enum":["github_app_expected","github_actions_workflow"]},"appSlug":{"type":"string","minLength":1,"pattern":".*\\\\S.*"},"appId":{"type":"integer","minimum":1},"workflowId":{"type":"integer","minimum":1},"workflowPath":{"type":"string","minLength":1,"pattern":".*\\\\S.*"},"event":{"type":"string","minLength":1,"pattern":".*\\\\S.*"}}},"requiredCheck":{"type":"object","additionalProperties":false,"required":["id","name","target","acceptableConclusions","expectedSource"],"properties":{"id":{"type":"string","minLength":1},"name":{"type":"string","minLength":1},"target":{"enum":["head","merge","merge_group"]},"acceptableConclusions":{"type":"array","maxItems":3000,"items":{"type":"string","minLength":1},"minItems":1,"uniqueItems":true},"expectedSource":{"$ref":"#/$defs/expectedSource"}}},"sensitivePathRule":{"type":"object","additionalProperties":false,"required":["id","patterns","requiredReviewers","requiredCount","humanGate"],"properties":{"id":{"type":"string","minLength":1},"patterns":{"type":"array","maxItems":3000,"items":{"type":"string","minLength":1},"minItems":1,"uniqueItems":true},"requiredReviewers":{"type":"array","maxItems":3000,"items":{"type":"string","minLength":1},"minItems":1,"uniqueItems":true},"requiredCount":{"type":"integer","minimum":1},"humanGate":{"type":"boolean"}}},"policyChanges":{"type":"object","additionalProperties":false,"required":["mode","paths"],"properties":{"mode":{"enum":["advisory","human_review","blocked"]},"paths":{"type":"array","maxItems":3000,"items":{"type":"string","minLength":1},"minItems":1,"uniqueItems":true}}},"reviewability":{"type":"object","additionalProperties":false,"required":["mode","budgets"],"properties":{"mode":{"enum":["advisory","blocking"]},"budgets":{"type":"object","additionalProperties":false,"properties":{"maxFiles":{"type":"integer","minimum":0},"maxOwnershipDomains":{"type":"integer","minimum":0},"maxGeneratedFiles":{"type":"integer","minimum":0},"maxBoundaries":{"type":"integer","minimum":0}}}}}}}')}};var r={};function __nccwpck_require__(e){var n=r[e];if(n!==undefined){return n.exports}var s=r[e]={exports:{}};var i=true;try{t[e].call(s.exports,s,s.exports,__nccwpck_require__);i=false}finally{if(i)delete r[e]}return s.exports}__nccwpck_require__.m=t;if(typeof __nccwpck_require__!=="undefined")__nccwpck_require__.ab=decodeURIComponent(new URL(".",import.meta.url).pathname).slice(import.meta.url.match(/^file:\/\/\/\w:/)?1:0,-1)+"/";(()=>{__nccwpck_require__.f={};__nccwpck_require__.e=e=>Promise.all(Object.keys(__nccwpck_require__.f).reduce((t,r)=>{__nccwpck_require__.f[r](e,t);return t},[]))})();(()=>{__nccwpck_require__.u=e=>""+e+".index.js"})();(()=>{__nccwpck_require__.o=(e,t)=>Object.prototype.hasOwnProperty.call(e,t)})();(()=>{var e={792:0};var installChunk=t=>{var{ids:r,modules:n,runtime:s}=t;var i,o,a=0;for(i in n){if(__nccwpck_require__.o(n,i)){__nccwpck_require__.m[i]=n[i]}}if(s)s(__nccwpck_require__);for(;a<r.length;a++){o=r[a];if(__nccwpck_require__.o(e,o)&&e[o]){e[o][0]()}e[r[a]]=0}};__nccwpck_require__.f.j=(t,r)=>{var n=__nccwpck_require__.o(e,t)?e[t]:undefined;if(n!==0){if(n){r.push(n[1])}else{if(true){var s=import("./"+__nccwpck_require__.u(t)).then(installChunk,r=>{if(e[t]!==0)e[t]=undefined;throw r});var s=Promise.race([s,new Promise(r=>n=e[t]=[r])]);r.push(n[1]=s)}}}}})();var n={};(()=>{var e=n;Object.defineProperty(e,"BJ",{value:true});e.HC=parseActionInputs;e.oV=setActionOutput;e.Jc=appendStepSummary;e._U=shouldFailAction;e.Pz=snapshotRejectionExitCode;e.dW=formatMarkdownSummary;e.Cs=runAction;e.BL=upsertCheckRun;e.Wg=upsertRejectionCheckRun;const t=__nccwpck_require__(7598);const r=__nccwpck_require__(3024);const s=__nccwpck_require__(6760);const i=__nccwpck_require__(10);const o=__nccwpck_require__(2823);const a=__nccwpck_require__(6584);const c=__nccwpck_require__(861);const u=64e3;function actionInput(e,t,r){const n=e[`INPUT_${t}`];if(n!==undefined&&n.trim().length>0)return n;return e[`INPUT_${r}`]}function parseActionInputs(e=process.env){const t=actionInput(e,"FAIL-ON","FAIL_ON")?.trim()||"blocked";const r=["never","blocked","human_review_required","evidence_missing","policy_ambiguous"];const n=r.includes(t)?t:"blocked";const s=actionInput(e,"REPORT-PATH","REPORT_PATH")?.trim()||"patchgate-receipt.json";const i=actionInput(e,"CHECK-NAME","CHECK_NAME")?.trim()||"PatchGate Review Gate";assertActionText(s,"report-path",500);assertActionText(i,"check-name",200);return{failOn:n,githubToken:actionInput(e,"GITHUB-TOKEN","GITHUB_TOKEN")?.trim()||e.GITHUB_TOKEN?.trim()||"",reportPath:s,createCheckRun:(actionInput(e,"CREATE-CHECK-RUN","CREATE_CHECK_RUN")??"true").trim().toLowerCase()==="true",checkName:i}}function assertActionText(e,t,r){if(e.length===0||e.length>r||/[\u0000-\u001F\u007F]/.test(e)){throw new Error(`PatchGate Action ${t} contains unsafe or oversized text.`)}}function setActionOutput(e,n,s=process.env){const i=s.GITHUB_OUTPUT;if(i&&(0,r.existsSync)(i)){assertActionText(e,"output name",200);const s=`patchgate_${(0,t.randomUUID)()}`;let o=s;while(n.includes(o))o=`${s}_${(0,t.randomUUID)()}`;if(n.includes("\n")||n.includes("\r")){(0,r.appendFileSync)(i,`${e}<<${o}\n${n}\n${o}\n`,"utf8")}else{assertActionText(n,`output ${e}`,1e6);(0,r.appendFileSync)(i,`${e}=${n}\n`,"utf8")}}}function appendStepSummary(e,t=process.env){const n=t.GITHUB_STEP_SUMMARY;if(n&&(0,r.existsSync)(n)){(0,r.appendFileSync)(n,`${e}\n`,"utf8")}}function markdownCell(e){return e.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g,"").replace(/[\r\n]+/g," ").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/\|/g,"&#124;").replace(/`/g,"&#96;")}function resolveReportPath(e,t){const r=(0,s.resolve)(t.GITHUB_WORKSPACE?.trim()||process.cwd());if(e.startsWith("/")||e.includes("\\"))throw new Error("PatchGate Action report-path must be a relative POSIX path inside GITHUB_WORKSPACE.");const n=(0,s.resolve)(r,e);const i=n===r?"":n.slice(r.length+1);if(i===""||i===".."||i.startsWith("../"))throw new Error("PatchGate Action report-path must stay inside GITHUB_WORKSPACE.");return n}function shouldFailAction(e,t){if(t==="never")return false;if(t===e)return true;if(t==="blocked"){return e==="blocked"||e==="evidence_missing"||e==="policy_ambiguous"}if(t==="human_review_required"){return e==="blocked"||e==="human_review_required"||e==="evidence_missing"||e==="policy_ambiguous"}return false}function snapshotRejectionExitCode(e){return shouldFailAction("evidence_missing",e)?1:0}function formatMarkdownSummary(e){const t={ready_for_review:"✅",blocked:"🛑",human_review_required:"👤",evidence_missing:"🔍",policy_ambiguous:"⚠️"};const r=t[e.final.status]??"ℹ️";const n=`### ${r} PatchGate Review Gate: \`${e.final.status.toUpperCase()}\``;const s=`**Repository:** \`${e.repository.owner}/${e.repository.name}\` PR #${e.repository.pullRequest}<br>\n**Target Kind:** \`${e.revisions.targetKind}\`<br>\n**Tested SHA:** \`${markdownCell(e.revisions.testedSha)}\`<br>\n**PR Head SHA:** \`${markdownCell(e.revisions.headSha)}\`<br>\n**Base SHA:** \`${markdownCell(e.revisions.baseSha)}\`<br>\n**Commit Binding:** ${e.revisions.targetKind==="head"?e.revisions.testedSha===e.revisions.headSha?"✅ `testedSha` equals `headSha`":"❌ `testedSha` does not equal `headSha`":"ℹ️ tested revision is the declared merge target; PR head is recorded separately"}<br>\n**Policy Digest:** \`${e.policyDigest.slice(0,18)}...\`  \n**Receipt Digest:** \`${e.receiptDigest.slice(0,18)}...\``;const i=e.requirements.map(e=>{const t=e.result==="passed"?"✅ Passed":e.result==="failed"?"❌ Failed":e.result==="advisory"?"ℹ️ Advisory":"❓ Unknown";return`| \`${markdownCell(e.id)}\` | ${t} | \`${markdownCell(e.severity)}\` | ${markdownCell(e.remediation)} |`});const o=`| Requirement | Result | Severity | Remediation |\n|---|---|---|---|\n${i.join("\n")}`;let a="";if(e.humanGates.length>0){const t=e.humanGates.map(e=>{const t=e.satisfied?"✅ Satisfied":"⏳ Pending Approval";const r=e.requiredReviewers.join(", ")||"None";const n=e.approvedBy.join(", ")||"None";return`| \`${markdownCell(e.id)}\` | ${t} | ${markdownCell(r)} (need ${e.requiredCount}) | ${markdownCell(n)} | ${markdownCell(e.reason)} |`});a=`\n\n#### 👤 Human Review Boundaries\n| Gate ID | Status | Required Reviewers | Approved By | Reason |\n|---|---|---|---|---|\n${t.join("\n")}`}let c="";if(e.reviewability){const t=e.reviewability;c=`\n\n#### 📊 Reviewability Signals\n- **Changed Files:** \`${t.fileCount}\`\n- **Generated Files:** \`${t.generatedFileCount}\`\n- **Ownership Domains:** \`${t.ownershipDomains.join(", ")||"none"}\` (\`${t.boundaryCount}\` boundaries)`}const d=`\n\n<details>\n<summary>🔐 <b>Audit & Provenance Metadata</b></summary>\n\n- **Evaluator Version:** \`${e.evaluatorVersion}\`\n- **Schema Version:** \`${e.schemaVersion}\`\n- **Evaluated At:** \`${e.evaluatedAt}\`\n- **Decision Input Digest:** \`${e.decisionInputDigest}\`\n- **Receipt Digest:** \`${e.receiptDigest}\`\n- **Policy Sources:** ${e.policySources.map(e=>`\`${e.kind}:${e.identity}@${e.revision.slice(0,7)}\``).join(", ")||"none"}\n\n</details>`;const l=`${n}\n\n${s}\n\n${o}${a}${c}${d}\n`;return l.length<=u?l:`${l.slice(0,u-120)}\n\n> Summary truncated to keep GitHub Action output bounded. The full receipt remains at the configured report path.\n`}async function runAction(e=process.env){const t=parseActionInputs(e);const n=e.GITHUB_EVENT_PATH;if(!n||!(0,r.existsSync)(n)){console.error("PatchGate Action: GITHUB_EVENT_PATH is missing or does not exist.");return 2}let o;try{o=JSON.parse((0,r.readFileSync)(n,"utf8"))}catch(e){console.error("PatchGate Action: Failed to parse GITHUB_EVENT_PATH payload as JSON.",e);return 2}const u=e.GITHUB_EVENT_NAME||"pull_request";if(u==="merge_group"){const r="PatchGate does not yet support authenticated merge-group membership in the current scalar contract.";setActionOutput("status","evidence_missing",e);appendStepSummary(`### ⚠️ PatchGate Unsupported Target\n\n**Event:** \`merge_group\`  \n**Status:** \`evidence_missing\`  \n**Remediation:** Use a pull_request head/merge target or extend the versioned merge-group contract before enforcing this event.\n`,e);console.warn(`PatchGate Action: ${r}`);return shouldFailAction("evidence_missing",t.failOn)?1:0}if(u!=="pull_request"&&u!=="pull_request_target"){console.log(`PatchGate Action: Skipping execution for unsupported event '${u}'. Only pull_request events are evaluated.`);return 0}const l=o.pull_request?.number;const p=o.repository?.owner?.login||o.repository?.owner?.name;const f=o.repository?.name;const h=o.pull_request?.head?.sha;if(typeof l!=="number"||!Number.isInteger(l)||l<1||typeof p!=="string"||p.length===0||typeof f!=="string"||f.length===0||typeof h!=="string"||h.trim().length===0){console.error("PatchGate Action: Pull request number, repository identity, or event head SHA is missing or invalid.");return 2}if(!t.githubToken){console.error("PatchGate Action: GitHub token is missing. Provide github-token input or GITHUB_TOKEN environment variable.");return 2}const m=(0,a.createFetchTransport)({token:t.githubToken,userAgent:"patchgate-action/0.1.0"});const g=new a.GitHubClient(m,undefined,{token:t.githubToken});const v={owner:p,name:f,pullNumber:l,expectedHeadSha:h,eventKind:"pull_request",targetKind:"head"};console.log(`PatchGate Action: Building snapshot for ${p}/${f}#${l}...`);const y=await(0,c.buildGitHubSnapshot)(v,g);if(y.kind==="rejected"){const r=y.diagnostic;console.error(`PatchGate Action: Snapshot rejected — [${r.id}] ${r.message}`);if(r.remediation){console.error(`Remediation: ${r.remediation}`)}const n=`### ❌ PatchGate Snapshot Rejected\n\n**Event PR Head SHA:** \`${markdownCell(h)}\`  \n**Diagnostic:** \`${r.id}\`  \n**Message:** ${r.message}  \n**Remediation:** ${r.remediation??"None"}\n`;setActionOutput("status","evidence_missing",e);setActionOutput("summary-markdown",n,e);appendStepSummary(n,e);if(t.createCheckRun&&t.githubToken){const e=o.pull_request?.head?.sha;if(e===undefined){console.warn("PatchGate Action: Event payload has no pull-request head SHA; rejection check-run was not posted.")}else{await upsertRejectionCheckRun({owner:p,name:f,headSha:e,checkName:t.checkName,diagnostic:{id:r.id,message:r.message,remediation:r.remediation},summaryMarkdown:n,token:t.githubToken})}}return snapshotRejectionExitCode(t.failOn)}const b=(new Date).toISOString();const w=(0,i.evaluateContribution)(y.input,b);let $;try{$=resolveReportPath(t.reportPath,e)}catch(e){console.error(`PatchGate Action: ${e instanceof Error?e.message:String(e)}`);return 2}try{(0,r.mkdirSync)((0,s.dirname)($),{recursive:true});(0,r.writeFileSync)($,JSON.stringify(w,null,2),"utf8");console.log(`PatchGate Action: ContributionReceipt written to ${$}`)}catch(e){console.warn(`PatchGate Action: Could not write receipt report file: ${e instanceof Error?e.message:String(e)}`)}const S=formatMarkdownSummary(w);setActionOutput("status",w.final.status,e);setActionOutput("receipt-path",$,e);setActionOutput("decision-input-digest",w.decisionInputDigest,e);setActionOutput("receipt-digest",w.receiptDigest,e);setActionOutput("target-kind",w.revisions.targetKind,e);setActionOutput("tested-sha",w.revisions.testedSha,e);setActionOutput("head-sha",w.revisions.headSha,e);setActionOutput("summary-markdown",S,e);appendStepSummary(S,e);console.log(`\n========================================`);console.log(`PatchGate Evaluation Result: ${w.final.status.toUpperCase()}`);console.log(`Decision Input Digest: ${w.decisionInputDigest}`);console.log(`Receipt Digest:        ${w.receiptDigest}`);console.log(`========================================\n`);if(t.createCheckRun&&t.githubToken){await d({owner:p,name:f,headSha:w.revisions.testedSha,checkName:t.checkName,status:w.final.status,receipt:w,summaryMarkdown:S,token:t.githubToken})}if(shouldFailAction(w.final.status,t.failOn)){console.error(`PatchGate Action: Evaluation result '${w.final.status}' triggered fail-on policy '${t.failOn}'.`);return 1}console.log(`PatchGate Action: Evaluation passed review-readiness gate.`);return 0}async function deliverCheckRun(e,t,r=fetch){try{const n=`https://api.github.com/repos/${encodeURIComponent(e.owner)}/${encodeURIComponent(e.name)}`;const s=`${n}/commits/${encodeURIComponent(e.headSha)}/check-runs?check_name=${encodeURIComponent(t.name)}&filter=latest&per_page=100`;const i=await r(s,{method:"GET",redirect:"error",headers:{Authorization:`Bearer ${e.token}`,Accept:o.GITHUB_ACCEPT,"X-GitHub-Api-Version":o.GITHUB_API_VERSION,"User-Agent":"patchgate-action/0.1.0"}});if(!i.ok){console.warn(`PatchGate Action: Notice — Could not look up an existing check-run (HTTP ${i.status}); no check-run write was attempted.`);return}const a=await i.json();const c=Array.isArray(a.check_runs)?a.check_runs.filter(r=>r.id!==undefined&&r.name===t.name&&r.head_sha===e.headSha).sort((e,t)=>(t.id??0)-(e.id??0))[0]:undefined;const u=c?.id===undefined?`${n}/check-runs`:`${n}/check-runs/${c.id}`;const d=await r(u,{method:c?.id===undefined?"POST":"PATCH",redirect:"error",headers:{Authorization:`Bearer ${e.token}`,Accept:o.GITHUB_ACCEPT,"X-GitHub-Api-Version":o.GITHUB_API_VERSION,"User-Agent":"patchgate-action/0.1.0","Content-Type":"application/json"},body:JSON.stringify(t)});if(!d.ok){console.warn(`PatchGate Action: Notice — Could not post check-run (HTTP ${d.status}). Verify that 'checks: write' permission is granted.`)}else{console.log(`PatchGate Action: Check run '${t.name}' successfully ${c?.id===undefined?"created":"updated"} with conclusion '${t.conclusion}'.`)}}catch(e){console.warn(`PatchGate Action: Check run posting skipped (${e instanceof Error?e.message:String(e)}).`)}}async function upsertCheckRun(e,t=fetch){if(e.headSha!==e.receipt.revisions.testedSha){throw new Error("PatchGate Action: Check Run head SHA must equal the receipt tested SHA.")}if(e.receipt.revisions.targetKind==="head"&&e.receipt.revisions.testedSha!==e.receipt.revisions.headSha){throw new Error("PatchGate Action: A head-target Check Run requires tested SHA to equal the PR head SHA.")}const r={ready_for_review:"success",blocked:"failure",human_review_required:"action_required",evidence_missing:"neutral",policy_ambiguous:"neutral"};const n={name:e.checkName,head_sha:e.headSha,status:"completed",conclusion:r[e.status],completed_at:(new Date).toISOString(),output:{title:`PatchGate: ${e.status.toUpperCase().replace(/_/g," ")}`,summary:e.summaryMarkdown,text:`Target kind: ${e.receipt.revisions.targetKind}\nTested SHA: \`${e.receipt.revisions.testedSha}\`\nPR head SHA: \`${e.receipt.revisions.headSha}\`\nReceipt Digest: \`${e.receipt.receiptDigest}\`\nDecision Input Digest: \`${e.receipt.decisionInputDigest}\`\nEvaluated At: ${e.receipt.evaluatedAt}`}};await deliverCheckRun(e,n,t)}async function upsertRejectionCheckRun(e,t=fetch){const r={name:e.checkName,head_sha:e.headSha,status:"completed",conclusion:"neutral",completed_at:(new Date).toISOString(),output:{title:"PatchGate: SNAPSHOT REJECTED",summary:e.summaryMarkdown,text:`Target kind: head\nEvent PR head SHA: \`${e.headSha}\`\nDiagnostic: ${e.diagnostic.id}\nRemediation: ${e.diagnostic.remediation??"None"}`}};await deliverCheckRun(e,r,t)}const d=upsertCheckRun;function isDirectActionEntrypoint(){const e=process.argv[1];return e!==undefined&&/[\\/]dist[\\/]action[\\/]index\.js$/.test(e)}if(process.env.GITHUB_ACTIONS==="true"&&isDirectActionEntrypoint()){runAction().then(e=>{if(e!==0)process.exit(e)}).catch(e=>{console.error("PatchGate Action: Unhandled error in action runner:",e);process.exit(2)})}})();var s=n.BJ;var i=n.Jc;var o=n.dW;var a=n.HC;var c=n.Cs;var u=n.oV;var d=n._U;var l=n.Pz;var p=n.BL;var f=n.Wg;export{s as __esModule,i as appendStepSummary,o as formatMarkdownSummary,a as parseActionInputs,c as runAction,u as setActionOutput,d as shouldFailAction,l as snapshotRejectionExitCode,p as upsertCheckRun,f as upsertRejectionCheckRun};
\ No newline at end of file
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 8748cc4..68398e6 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -16,6 +16,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Exact PR-head binding and tested-SHA visibility — 2026-08-27
+- The Action now binds its live API snapshot to the workflow event's exact
+  `pull_request.head.sha`; a changed live head is rejected with
+  `GITHUB_TARGET_CHANGED` before evaluation.
+- Check Run and step-summary output now shows full `testedSha`, `headSha`,
+  `baseSha`, target kind, and the head-binding state. Action outputs also expose
+  `target-kind`, `tested-sha`, and `head-sha` for downstream integrations.
+- The consumer guide documents why the check name remains stable and why a
+  pull-request comment from a QA tool is not automatically verified evidence.
+
 ### evaluate --output alias with fail-closed conflicts — 2026-08-23
 - `evaluate` accepts `--output` as an alias of `--report`, so the
   file-writing flag is uniform across commands. Passing both with different
diff --git a/docs/github-action-usage.md b/docs/github-action-usage.md
index 076fbd8..9aac574 100644
--- a/docs/github-action-usage.md
+++ b/docs/github-action-usage.md
@@ -57,7 +57,8 @@ jobs:
       # github.token cannot read Administration, so native Rulesets /
       # branch-protection snapshots fail closed (correct). A PAT/App token
       # with administration:read is required for a complete native-control
-      # snapshot. beta.5 posts a Check Run for successful evaluations;
+      # snapshot. The Check Run output shows the full tested SHA and its
+      # binding to the PR head; a stale event is rejected before evaluation.
       # snapshot-rejection Check Runs are included in beta.5.
       - name: Run PatchGate Shadow Gate
         uses: daichunghy/patchgate@v0.1.0-beta.5
@@ -139,6 +140,31 @@ consumers should use the tagged Action above, not `uses: ./` after `npm ci`.
 | `receipt-digest` | SHA-256 canonical digest of the evaluation receipt |
 | `decision-input-digest` | SHA-256 canonical digest of the normalized input snapshot |
 | `summary-markdown` | Formatted Markdown summary suitable for step summaries or issue comments |
+| `target-kind` | Evaluation target kind (`head`, `merge`, or `merge_group`) |
+| `tested-sha` | Exact commit SHA evaluated and used as the Check Run `head_sha` |
+| `head-sha` | Exact pull-request head SHA recorded in the evaluation |
+
+### Commit-bound evidence and QAOnFire interoperability
+
+For `pull_request` and `pull_request_target`, the Action binds the live API
+snapshot to `github.event.pull_request.head.sha`. If the pull request advanced
+between event delivery and API collection, PatchGate returns a non-evaluable
+`GITHUB_TARGET_CHANGED` result and does not publish a green result for the
+newer revision. A successful Check Run uses the receipt's exact `testedSha` as
+its API `head_sha`, and the summary displays the full `testedSha` and `headSha`.
+
+Keep `check-name` stable. Do not append a SHA to it: the required-check identity
+is a repository configuration key, while the commit binding belongs in the
+Check Run `head_sha` and output.
+
+QAOnFire currently describes its GitHub App as posting a QA report as a pull-
+request comment. PatchGate treats that comment as context, not verified check
+evidence. The public GitHub App metadata currently lists App ID `3791637`,
+`pull_request` and `issue_comment` events, and no `checks:write` permission, so
+it cannot currently publish a Check Run for a required-check rule. To make a
+QAOnFire result satisfy that rule, the App would need to publish a Check Run
+with the actual target SHA and an identifiable source App; the repository could
+then configure that App explicitly in `patchgate.yml`.
 
 ---
 
diff --git a/docs/implementation-roadmap.md b/docs/implementation-roadmap.md
index 0b06512..ff0447e 100644
--- a/docs/implementation-roadmap.md
+++ b/docs/implementation-roadmap.md
@@ -167,6 +167,22 @@ The authoritative local command is `npm run verify`. The latest project review
 and the live/public-state caveats are recorded in
 [the G4/G0 continuation audit](reviews/2026-08-20-g4-g0-audit.md).
 
+## External feedback checkpoint — 2026-08-27
+
+The first substantive external reply is recorded in [Discussion
+#29](https://github.com/daichunghy/patchgate/discussions/29). `rghetu283`
+recommended making the tested commit visible in check output and ensuring that
+the result is tied to the actual pull-request head. The follow-up implementation
+now checks the workflow event head against the live API head, publishes the
+full commit binding in the Check Run summary and exposes the same values as
+Action outputs. The detailed evidence record is
+[tested-SHA feedback follow-up](reviews/tested-sha-feedback-2026-08-27.md).
+
+This is technical feedback incorporated into the product. It is not a pilot,
+external installation, downstream usage or adoption claim. G4 remains open
+until a consenting consumer repository runs the Action and the observed result
+is reviewed.
+
 ## Project-wide review checkpoint — 2026-08-13
 
 The next local build added a redacted `support-bundle` CLI, API fixture byte
diff --git a/docs/reviews/tested-sha-feedback-2026-08-27.md b/docs/reviews/tested-sha-feedback-2026-08-27.md
new file mode 100644
index 0000000..99a1a9a
--- /dev/null
+++ b/docs/reviews/tested-sha-feedback-2026-08-27.md
@@ -0,0 +1,106 @@
+# Tested-SHA feedback follow-up — 2026-08-27
+
+**Scope:** Investigate the public feedback from `rghetu283` on PatchGate
+Discussion #29 and implement the smallest contract-preserving improvement that
+can be verified locally.
+
+**Validation level:** current source, public-source research, fixture tests and
+repository verification. This record is not evidence of an external pilot or
+an installation in QAOnFire.
+
+## Research conclusion
+
+`rghetu283`'s reply to [Discussion
+#29](https://github.com/daichunghy/patchgate/discussions/29) identified two
+useful practices: show the tested SHA in visible Check Run output and ensure a
+successful result is produced only for the actual pull-request head.
+
+The public [QAOnFire site](https://qaonfire.dev/) and [documentation](https://qaonfire.dev/docs.html)
+describe QAOnFire as a GitHub App that reads a pull request and posts a
+detailed QA report as a pull-request comment. The live GitHub App metadata for
+[`qaonfire`](https://github.com/apps/qaonfire) currently resolves to App ID
+`3791637`, with `pull_request` and `issue_comment` events and
+`contents:write`, `issues:write`, `metadata:read` and `pull_requests:write`
+permissions; it does not request `checks:write`. The
+[QAOnFire architecture note](https://dev.to/radu_ghetu_84dd251b3979e4/building-qaonfire-how-i-used-prompt-caching-to-make-ai-qa-reports-affordable-3i1p)
+describes the worker posting a comment after reading the PR diff; it does not
+establish a PatchGate-verifiable Check Run. This means PatchGate must not treat
+the current QAOnFire comment as required-check evidence.
+
+GitHub's current documentation states that required checks must succeed on the
+latest commit and that earlier-commit checks do not satisfy the requirement.
+The Checks API also models the immutable `head_sha` on each Check Run. The
+feedback therefore maps to two separate product responsibilities: GitHub's
+required-check semantics provide the merge boundary, while PatchGate makes the
+selected SHA observable and rejects an event/API target mismatch before it can
+produce a result.
+
+## Gap found in the implementation
+
+The evaluator already enforced `testedSha === headSha` for a `head` target and
+the adapter already queried checks for the selected SHA. The remaining gaps
+were at the Action boundary:
+
+1. The visible summary showed only a seven-character target prefix, not the
+   full tested SHA or an explicit binding statement.
+2. The Action resolved the current pull-request identity through the API but did
+   not assert that it still matched the event's `pull_request.head.sha`.
+3. Downstream steps could read status and digests, but not the exact target
+   values without parsing the receipt file.
+
+## Implemented changes
+
+- Added optional `expectedHeadSha` to `GitHubSnapshotRequest`.
+- The identity resolver now rejects a live head that differs from that
+  event-bound SHA with `GITHUB_TARGET_CHANGED` and a fail-closed remediation.
+- The Action passes the event head into the snapshot request and requires a
+  non-empty PR event head before making the authenticated snapshot call.
+- Check Run and step-summary output now shows full `testedSha`, `headSha`,
+  `baseSha`, target kind and whether a head-target binding is exact.
+- Added `target-kind`, `tested-sha` and `head-sha` Action outputs.
+- Check Run delivery now refuses a payload whose `head_sha` differs from the
+  receipt's `testedSha`, and also refuses an invalid head-target receipt.
+- Snapshot-rejection Check Runs identify the event PR head SHA without
+  presenting the rejected snapshot as a successful evaluation.
+- Added regression coverage for event/live head mismatch, full summary output
+  and Check Run `head_sha`/text binding.
+- Documented that a QAOnFire PR comment is context only. PatchGate will not
+  treat it as verified evidence without a Check Run carrying an identifiable
+  source and the exact target SHA.
+
+The Check Run name remains stable. A SHA suffix would change the required-check
+identity on every commit; the exact binding belongs in `head_sha` and output.
+
+## Acceptance checks
+
+The implementation is accepted only if all of the following remain true:
+
+- a head-target receipt cannot be built with a different `testedSha`;
+- an Action event whose head differs from the live API head is rejected before
+  evaluation;
+- a successful Check Run uses the receipt's exact `testedSha` as `head_sha`;
+- the visible summary and machine outputs expose the same exact SHA values;
+- a rejected snapshot can produce only the documented neutral/non-ready result;
+- `npm run verify` passes, including the bundled Action and consumer fixture.
+
+## Open dependency
+
+There is no public QAOnFire source repository or Check Run contract available
+in the current research pass, and no permission has been granted to install an
+external App or change that project. A true end-to-end success claim therefore
+requires Radu or an authorized maintainer to run the updated Action in a
+consenting repository, share the resulting Check Run/receipt, and confirm that
+the observed SHA and workflow behavior meet their use case. The current App
+permission boundary means that run can validate interoperability and visible
+SHA binding, but cannot make a QAOnFire comment itself satisfy a required-check
+rule.
+
+## Sources
+
+- [PatchGate Discussion #29](https://github.com/daichunghy/patchgate/discussions/29)
+- [QAOnFire](https://qaonfire.dev/)
+- [QAOnFire documentation](https://qaonfire.dev/docs.html)
+- [QAOnFire GitHub App](https://github.com/apps/qaonfire)
+- [QAOnFire architecture note](https://dev.to/radu_ghetu_84dd251b3979e4/building-qaonfire-how-i-used-prompt-caching-to-make-ai-qa-reports-affordable-3i1p)
+- [GitHub required-status-check troubleshooting](https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks)
+- [GitHub Checks API](https://docs.github.com/en/rest/checks/runs)
diff --git a/src/action/index.ts b/src/action/index.ts
index 0036756..2218d94 100644
--- a/src/action/index.ts
+++ b/src/action/index.ts
@@ -121,8 +121,14 @@ export function formatMarkdownSummary(receipt: ContributionReceipt): string {
   const icon = statusEmoji[receipt.final.status] ?? "ℹ️";
   const title = `### ${icon} PatchGate Review Gate: \`${receipt.final.status.toUpperCase()}\``;
 
-  const repoInfo = `**Repository:** \`${receipt.repository.owner}/${receipt.repository.name}\` PR #${receipt.repository.pullRequest}  
-**Target Commit:** \`${receipt.revisions.testedSha.slice(0, 7)}\` | **Base SHA:** \`${receipt.revisions.baseSha.slice(0, 7)}\`  
+  const repoInfo = `**Repository:** \`${receipt.repository.owner}/${receipt.repository.name}\` PR #${receipt.repository.pullRequest}<br>
+**Target Kind:** \`${receipt.revisions.targetKind}\`<br>
+**Tested SHA:** \`${markdownCell(receipt.revisions.testedSha)}\`<br>
+**PR Head SHA:** \`${markdownCell(receipt.revisions.headSha)}\`<br>
+**Base SHA:** \`${markdownCell(receipt.revisions.baseSha)}\`<br>
+**Commit Binding:** ${receipt.revisions.targetKind === "head"
+    ? receipt.revisions.testedSha === receipt.revisions.headSha ? "✅ `testedSha` equals `headSha`" : "❌ `testedSha` does not equal `headSha`"
+    : "ℹ️ tested revision is the declared merge target; PR head is recorded separately"}<br>
 **Policy Digest:** \`${receipt.policyDigest.slice(0, 18)}...\`  
 **Receipt Digest:** \`${receipt.receiptDigest.slice(0, 18)}...\``;
 
@@ -206,9 +212,10 @@ export async function runAction(env: NodeJS.ProcessEnv = process.env): Promise<n
   const pullNumber = eventPayload.pull_request?.number;
   const owner = eventPayload.repository?.owner?.login || eventPayload.repository?.owner?.name;
   const name = eventPayload.repository?.name;
+  const eventHeadSha = eventPayload.pull_request?.head?.sha;
 
-  if (pullNumber === undefined || owner === undefined || name === undefined) {
-    console.error("PatchGate Action: Pull request number or repository identity is missing from event payload.");
+  if (typeof pullNumber !== "number" || !Number.isInteger(pullNumber) || pullNumber < 1 || typeof owner !== "string" || owner.length === 0 || typeof name !== "string" || name.length === 0 || typeof eventHeadSha !== "string" || eventHeadSha.trim().length === 0) {
+    console.error("PatchGate Action: Pull request number, repository identity, or event head SHA is missing or invalid.");
     return 2;
   }
 
@@ -229,6 +236,7 @@ export async function runAction(env: NodeJS.ProcessEnv = process.env): Promise<n
     owner,
     name,
     pullNumber,
+    expectedHeadSha: eventHeadSha,
     eventKind: "pull_request",
     targetKind: "head",
   };
@@ -242,7 +250,7 @@ export async function runAction(env: NodeJS.ProcessEnv = process.env): Promise<n
     if (diagnostic.remediation) {
       console.error(`Remediation: ${diagnostic.remediation}`);
     }
-    const errorMarkdown = `### ❌ PatchGate Snapshot Rejected\n\n**Diagnostic:** \`${diagnostic.id}\`  \n**Message:** ${diagnostic.message}  \n**Remediation:** ${diagnostic.remediation ?? "None"}\n`;
+    const errorMarkdown = `### ❌ PatchGate Snapshot Rejected\n\n**Event PR Head SHA:** \`${markdownCell(eventHeadSha)}\`  \n**Diagnostic:** \`${diagnostic.id}\`  \n**Message:** ${diagnostic.message}  \n**Remediation:** ${diagnostic.remediation ?? "None"}\n`;
     setActionOutput("status", "evidence_missing", env);
     setActionOutput("summary-markdown", errorMarkdown, env);
     appendStepSummary(errorMarkdown, env);
@@ -288,6 +296,9 @@ export async function runAction(env: NodeJS.ProcessEnv = process.env): Promise<n
   setActionOutput("receipt-path", resolvedReportPath, env);
   setActionOutput("decision-input-digest", receipt.decisionInputDigest, env);
   setActionOutput("receipt-digest", receipt.receiptDigest, env);
+  setActionOutput("target-kind", receipt.revisions.targetKind, env);
+  setActionOutput("tested-sha", receipt.revisions.testedSha, env);
+  setActionOutput("head-sha", receipt.revisions.headSha, env);
   setActionOutput("summary-markdown", summaryMarkdown, env);
   appendStepSummary(summaryMarkdown, env);
 
@@ -325,7 +336,7 @@ export interface CheckRunParams {
   headSha: string;
   checkName: string;
   status: FinalStatus;
-  receipt: Pick<ContributionReceipt, "receiptDigest" | "decisionInputDigest" | "evaluatedAt">;
+  receipt: Pick<ContributionReceipt, "receiptDigest" | "decisionInputDigest" | "evaluatedAt" | "revisions">;
   summaryMarkdown: string;
   token: string;
 }
@@ -387,6 +398,12 @@ async function deliverCheckRun(params: { owner: string; name: string; headSha: s
 }
 
 export async function upsertCheckRun(params: CheckRunParams, fetchImpl: typeof fetch = fetch): Promise<void> {
+  if (params.headSha !== params.receipt.revisions.testedSha) {
+    throw new Error("PatchGate Action: Check Run head SHA must equal the receipt tested SHA.");
+  }
+  if (params.receipt.revisions.targetKind === "head" && params.receipt.revisions.testedSha !== params.receipt.revisions.headSha) {
+    throw new Error("PatchGate Action: A head-target Check Run requires tested SHA to equal the PR head SHA.");
+  }
   const conclusionMap: Record<FinalStatus, "success" | "failure" | "action_required" | "neutral"> = {
     ready_for_review: "success",
     blocked: "failure",
@@ -404,7 +421,7 @@ export async function upsertCheckRun(params: CheckRunParams, fetchImpl: typeof f
     output: {
       title: `PatchGate: ${params.status.toUpperCase().replace(/_/g, " ")}`,
       summary: params.summaryMarkdown,
-      text: `Receipt Digest: \`${params.receipt.receiptDigest}\`\nDecision Input Digest: \`${params.receipt.decisionInputDigest}\`\nEvaluated At: ${params.receipt.evaluatedAt}`,
+      text: `Target kind: ${params.receipt.revisions.targetKind}\nTested SHA: \`${params.receipt.revisions.testedSha}\`\nPR head SHA: \`${params.receipt.revisions.headSha}\`\nReceipt Digest: \`${params.receipt.receiptDigest}\`\nDecision Input Digest: \`${params.receipt.decisionInputDigest}\`\nEvaluated At: ${params.receipt.evaluatedAt}`,
     },
   };
   await deliverCheckRun(params, payload, fetchImpl);
@@ -430,7 +447,7 @@ export async function upsertRejectionCheckRun(params: RejectionCheckRunParams, f
     output: {
       title: "PatchGate: SNAPSHOT REJECTED",
       summary: params.summaryMarkdown,
-      text: `Diagnostic: ${params.diagnostic.id}\nRemediation: ${params.diagnostic.remediation ?? "None"}`,
+      text: `Target kind: head\nEvent PR head SHA: \`${params.headSha}\`\nDiagnostic: ${params.diagnostic.id}\nRemediation: ${params.diagnostic.remediation ?? "None"}`,
     },
   };
   await deliverCheckRun(params, payload, fetchImpl);
diff --git a/src/github/identity.ts b/src/github/identity.ts
index 8be8c60..7754f44 100644
--- a/src/github/identity.ts
+++ b/src/github/identity.ts
@@ -10,6 +10,11 @@ export interface GitHubSnapshotRequest {
   owner: string;
   name: string;
   pullNumber?: number;
+  /**
+   * Optional event-bound assertion used by the Action. When present, the
+   * live pull-request head must still be this exact SHA before evaluation.
+   */
+  expectedHeadSha?: string;
   eventKind: "pull_request" | "merge_group";
   targetKind: "head" | "merge" | "merge_group";
 }
@@ -116,6 +121,9 @@ export async function resolvePullRequestIdentity(
   }
   const owner = normalizedName(request.owner, "repository owner");
   const name = normalizedName(request.name, "repository name");
+  const expectedHeadSha = request.expectedHeadSha === undefined
+    ? undefined
+    : safeAllowlistedString(request.expectedHeadSha, "expected pull-request head SHA", 200);
   if (!Number.isInteger(request.pullNumber) || request.pullNumber < 1) throw new GitHubAdapterError(makeDiagnostic("GITHUB_IDENTITY_MISMATCH", "Pull-request number must be a positive integer.", { snapshotEvaluable: false, exitCode: 2 }));
   const repoResponse = await client.request({ method: "GET", path: `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}` }, "repository identity", phase);
   if (repoResponse.status === 403 || repoResponse.status === 404) throw new GitHubAdapterError(makeDiagnostic(repoResponse.status === 403 ? "GITHUB_PERMISSION_INSUFFICIENT" : "GITHUB_RESOURCE_NOT_VISIBLE", "Repository identity is not visible to the configured credential.", { permissionState: repoResponse.status === 403 ? "insufficient" : "unknown", snapshotEvaluable: false, exitCode: 2 }));
@@ -127,6 +135,13 @@ export async function resolvePullRequestIdentity(
     throw new GitHubAdapterError(makeDiagnostic("GITHUB_IDENTITY_MISMATCH", "GitHub returned a repository or pull-request identity different from the trusted request.", { snapshotEvaluable: false, exitCode: 2 }));
   }
   if (pullRequest.base.repo.id !== repository.id || (pullRequest.base.repo.full_name !== undefined && pullRequest.base.repo.full_name.toLowerCase() !== repository.full_name.toLowerCase())) throw new GitHubAdapterError(makeDiagnostic("GITHUB_IDENTITY_MISMATCH", "The pull request base repository identity did not match the repository identity read from the API.", { snapshotEvaluable: false, exitCode: 2 }));
+  if (expectedHeadSha !== undefined && pullRequest.head.sha !== expectedHeadSha) {
+    throw new GitHubAdapterError(makeDiagnostic("GITHUB_TARGET_CHANGED", "The workflow event head SHA no longer matches the live pull-request head SHA.", {
+      remediation: "Discard this run and let the workflow rerun for the current pull-request head; do not evaluate or publish a result for a different revision.",
+      snapshotEvaluable: false,
+      exitCode: 2,
+    }));
+  }
   const mergeSha = typeof pullRequest.merge_commit_sha === "string" ? pullRequest.merge_commit_sha : undefined;
   const targetKind: "head" | "merge" = request.targetKind === "merge" ? "merge" : "head";
   if (targetKind === "merge" && mergeSha === undefined) throw new GitHubAdapterError(makeDiagnostic("GITHUB_API_UNSUPPORTED", "The pull request has no immutable merge SHA for the requested merge target.", { remediation: "Evaluate the head target or wait for GitHub to provide a merge commit SHA.", snapshotEvaluable: false, exitCode: 2 }));
diff --git a/test/action.test.ts b/test/action.test.ts
index 441e73e..c034891 100644
--- a/test/action.test.ts
+++ b/test/action.test.ts
@@ -139,6 +139,9 @@ describe("GitHub Action runner unit tests", () => {
       const markdown = formatMarkdownSummary(mockReceipt);
       expect(markdown).toContain("### ✅ PatchGate Review Gate: `READY_FOR_REVIEW`");
       expect(markdown).toContain("`patchgate/core` PR #42");
+      expect(markdown).toContain("**Tested SHA:** `abcdef0123456789abcdef0123456789abcdef01`");
+      expect(markdown).toContain("**PR Head SHA:** `abcdef0123456789abcdef0123456789abcdef01`");
+      expect(markdown).toContain("✅ `testedSha` equals `headSha`");
       expect(markdown).toContain("| `policy.base_revision` | ✅ Passed | `block` | Keep policy bound to base SHA. |");
     });
   });
@@ -226,9 +229,9 @@ describe("GitHub Action runner unit tests", () => {
 
     it("updates an existing check run instead of creating a duplicate", async () => {
       const { upsertCheckRun } = await import("../src/action/index.js");
-      const calls: Array<{ url: string; method: string }> = [];
+      const calls: Array<{ url: string; method: string; body?: string | undefined }> = [];
       const fetchMock: typeof fetch = async (input, init) => {
-        calls.push({ url: String(input), method: init?.method ?? "GET" });
+        calls.push({ url: String(input), method: init?.method ?? "GET", body: typeof init?.body === "string" ? init.body : undefined });
         if (init?.method === "GET") return new Response(JSON.stringify({ check_runs: [{ id: 42, name: "PatchGate Review Gate", head_sha: "head-sha" }] }), { status: 200 });
         return new Response("{}", { status: 200 });
       };
@@ -240,10 +243,39 @@ describe("GitHub Action runner unit tests", () => {
         status: "ready_for_review",
         summaryMarkdown: "summary",
         token: "test-token",
-        receipt: { receiptDigest: "sha256:receipt", decisionInputDigest: "sha256:input", evaluatedAt: "2026-08-20T00:00:00Z" },
+        receipt: {
+          receiptDigest: "sha256:receipt",
+          decisionInputDigest: "sha256:input",
+          evaluatedAt: "2026-08-20T00:00:00Z",
+          revisions: { baseSha: "base-sha", headSha: "head-sha", testedSha: "head-sha", targetKind: "head" },
+        },
       }, fetchMock);
       expect(calls.map((call) => call.method)).toEqual(["GET", "PATCH"]);
       expect(calls[1]?.url).toContain("/check-runs/42");
+      const body = JSON.parse(calls[1]?.body ?? "{}") as { head_sha?: string; output?: { text?: string } };
+      expect(body.head_sha).toBe("head-sha");
+      expect(body.output?.text).toContain("Tested SHA: `head-sha`");
+      expect(body.output?.text).toContain("PR head SHA: `head-sha`");
+    });
+
+    it("refuses to publish a Check Run with a mismatched receipt SHA", async () => {
+      const { upsertCheckRun } = await import("../src/action/index.js");
+      const fetchMock: typeof fetch = async () => new Response("{}", { status: 200 });
+      await expect(upsertCheckRun({
+        owner: "example",
+        name: "service",
+        headSha: "different-head-sha",
+        checkName: "PatchGate Review Gate",
+        status: "ready_for_review",
+        summaryMarkdown: "summary",
+        token: "test-token",
+        receipt: {
+          receiptDigest: "sha256:receipt",
+          decisionInputDigest: "sha256:input",
+          evaluatedAt: "2026-08-20T00:00:00Z",
+          revisions: { baseSha: "base-sha", headSha: "head-sha", testedSha: "head-sha", targetKind: "head" },
+        },
+      }, fetchMock)).rejects.toThrow("Check Run head SHA must equal the receipt tested SHA");
     });
 
     it("posts a neutral rejection check run with the diagnostic and remediation", async () => {
diff --git a/test/integration/github-security.test.ts b/test/integration/github-security.test.ts
index 385f40b..76d06ae 100644
--- a/test/integration/github-security.test.ts
+++ b/test/integration/github-security.test.ts
@@ -191,6 +191,14 @@ describe("GitHub adapter trust-boundary probes", () => {
     if (result.kind === "rejected") expect(result.diagnostic.id).toBe("GITHUB_TARGET_CHANGED");
   });
 
+  it("rejects a live head that no longer matches the workflow event head", async () => {
+    const fixture = JSON.parse(await readFile(resolve("fixtures/api/happy-path.json"), "utf8")) as { request: GitHubSnapshotRequest; exchanges: RecordedExchange[] };
+    const request = { ...fixture.request, expectedHeadSha: "event-head-sha" };
+    const result = await buildGitHubSnapshot(request, new GitHubClient(new RecordedGitHubTransport(fixture.exchanges)), { allowConfirmedAbsence: true });
+    expect(result.kind).toBe("rejected");
+    if (result.kind === "rejected") expect(result.diagnostic.id).toBe("GITHUB_TARGET_CHANGED");
+  });
+
   it("does not allow confirmed absence on an authenticated/live transport", async () => {
     const transport = new RecordedGitHubTransport([]);
     const client = new GitHubClient(transport, undefined, { token: "not-a-fixture-token" });