@agent-teams/engineering-foundation 0.5.0 → 0.6.0

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.js

@@ -1,200 +1,34 @@
-import { opendir, readFile, realpath, stat } from "node:fs/promises";
-import { isAbsolute, relative, resolve, sep } from "node:path";
-import { CapabilityInputError } from "../../../../../capability-runtime.js";
-import { pathTraversesSymbolicLink } from "../../../../../filesystem-path-safety.js";
-import { assertNotCancelled, parseStrictYamlSource } from "../../../../../strict-yaml.js";
-const MAX_FILE_BYTES = 4 * 1024 * 1024;
-function inputError(code, message) {
-    throw new CapabilityInputError({
-        code,
-        message,
-        phase: "repository-security-evidence",
-        retryable: false
-    });
-}
-function record(value, field) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        inputError("REPOSITORY_SECURITY_EVIDENCE_INVALID", `${field} must be an object.`);
-    }
-    return value;
-}
-function contained(parent, candidate) {
-    const relation = relative(parent, candidate);
-    return relation === "" || (!isAbsolute(relation) && relation !== ".." && !relation.startsWith(`..${sep}`));
-}
-async function safePath(root, repositoryPath, kind) {
-    const candidate = resolve(root, repositoryPath);
-    if (await pathTraversesSymbolicLink(root, candidate)) {
-        inputError("REPOSITORY_SECURITY_SYMLINK_PROHIBITED", `Security evidence cannot traverse a symbolic link: ${repositoryPath}.`);
-    }
-    const canonical = await realpath(candidate).catch(() => inputError("REPOSITORY_SECURITY_EVIDENCE_UNAVAILABLE", `Security evidence is unavailable: ${repositoryPath}.`));
-    if (!contained(root, canonical)) {
-        inputError("REPOSITORY_SECURITY_EVIDENCE_ESCAPE", `Security evidence escapes the repository: ${repositoryPath}.`);
-    }
-    const metadata = await stat(canonical);
-    if ((kind === "directory" && !metadata.isDirectory()) ||
-        (kind === "file" && (!metadata.isFile() || metadata.size > MAX_FILE_BYTES))) {
-        inputError("REPOSITORY_SECURITY_EVIDENCE_INVALID", `Security evidence is not a valid ${kind}: ${repositoryPath}.`);
-    }
-    return canonical;
-}
-function permissions(value, field) {
-    if (value === undefined) {
-        return undefined;
-    }
-    if (value === "read-all" || value === "write-all") {
-        return value;
-    }
-    const input = record(value, field);
-    const result = {};
-    for (const [name, permission] of Object.entries(input)) {
-        if (permission !== "none" && permission !== "read" && permission !== "write") {
-            inputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field}.${name} must be none, read, or write.`);
+import { assertNotCancelled } from "../../../../../strict-yaml.js";
+import { readPublishablePackageEvidence } from "./publishable-package-evidence-reader.js";
+import { resolveConsumerRoot } from "./repository-security-filesystem.js";
+import { repositorySecurityInputError } from "./repository-security-input.js";
+import { readSecurityToolEvidence } from "./security-tool-evidence-reader.js";
+import { readWorkflowDirectoryEvidence } from "./workflow-evidence-reader.js";
+function requireConfiguredWorkflows(workflows, policy) {
+    for (const requiredWorkflow of [policy.dependencyReview.workflowPath, policy.sbomWorkflow]) {
+        if (!workflows.some(({ path }) => path === requiredWorkflow)) {
+            repositorySecurityInputError("REPOSITORY_SECURITY_REQUIRED_WORKFLOW_UNAVAILABLE", `Required security workflow is not discovered: ${requiredWorkflow}.`);
         }
-        result[name] = permission;
     }
-    return Object.freeze(result);
-}
-function triggers(value) {
-    if (typeof value === "string") {
-        return [value];
-    }
-    if (Array.isArray(value)) {
-        if (!value.every((entry) => typeof entry === "string")) {
-            inputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", "Workflow triggers must be strings.");
-        }
-        return Object.freeze(value.toSorted());
-    }
-    return Object.freeze(Object.keys(record(value, "workflow.on")).toSorted());
-}
-function unconditionalTriggers(value) {
-    if (typeof value === "string") {
-        return [value];
-    }
-    if (Array.isArray(value)) {
-        return Object.freeze(value.filter((entry) => typeof entry === "string").toSorted());
-    }
-    const input = record(value, "workflow.on");
-    return Object.freeze(Object.entries(input)
-        .filter(([, configuration]) => {
-        if (configuration === null) {
-            return true;
-        }
-        return (typeof configuration === "object" &&
-            !Array.isArray(configuration) &&
-            Object.keys(configuration).length === 0);
-    })
-        .map(([trigger]) => trigger)
-        .toSorted());
-}
-function steps(value, field) {
-    if (value === undefined) {
-        return [];
-    }
-    if (!Array.isArray(value)) {
-        inputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field} must be an array.`);
-    }
-    return Object.freeze(value.map((entry, index) => {
-        const step = record(entry, `${field}[${index}]`);
-        const stepInputs = step["with"];
-        return Object.freeze({
-            conditional: step["if"] !== undefined,
-            nonBlocking: step["continue-on-error"] !== undefined &&
-                step["continue-on-error"] !== false,
-            inputs: Object.freeze(stepInputs === undefined
-                ? {}
-                : record(stepInputs, `${field}[${index}].with`)),
-            ...(typeof step["uses"] === "string" ? { uses: step["uses"] } : {}),
-            ...(typeof step["run"] === "string" ? { run: step["run"] } : {})
-        });
-    }));
-}
-function workflow(path, source) {
-    const input = record(parseStrictYamlSource(source, `workflow:${path}`), `workflow ${path}`);
-    const jobsInput = record(input["jobs"], `workflow ${path}.jobs`);
-    const jobs = Object.entries(jobsInput).map(([id, value]) => {
-        const job = record(value, `workflow ${path}.jobs.${id}`);
-        const jobPermissions = permissions(job["permissions"], `workflow ${path}.jobs.${id}.permissions`);
-        return Object.freeze({
-            conditional: job["if"] !== undefined,
-            nonBlocking: job["continue-on-error"] !== undefined &&
-                job["continue-on-error"] !== false,
-            id,
-            ...(typeof job["uses"] === "string" ? { uses: job["uses"] } : {}),
-            ...(jobPermissions === undefined ? {} : { permissions: jobPermissions }),
-            steps: steps(job["steps"], `workflow ${path}.jobs.${id}.steps`)
-        });
-    });
-    const workflowPermissions = permissions(input["permissions"], `workflow ${path}.permissions`);
-    return Object.freeze({
-        path,
-        triggers: triggers(input["on"]),
-        unconditionalTriggers: unconditionalTriggers(input["on"]),
-        ...(workflowPermissions === undefined ? {} : { permissions: workflowPermissions }),
-        jobs: Object.freeze(jobs.toSorted((left, right) => left.id.localeCompare(right.id)))
-    });
-}
-async function readWorkflowDirectory(root, policy, signal) {
-    const directory = await safePath(root, policy.workflowDirectory, "directory");
-    const names = [];
-    const handle = await opendir(directory);
-    for await (const entry of handle) {
-        assertNotCancelled(signal);
-        if (entry.isSymbolicLink() || !entry.isFile() || !/\.ya?ml$/iu.test(entry.name)) {
-            inputError("REPOSITORY_SECURITY_WORKFLOW_ENTRY_INVALID", `Workflow directory contains an unsupported entry: ${entry.name}.`);
-        }
-        names.push(entry.name);
-    }
-    const evidence = [];
-    for (const name of names.toSorted()) {
-        const repositoryPath = `${policy.workflowDirectory}/${name}`;
-        const file = await safePath(root, repositoryPath, "file");
-        evidence.push(workflow(repositoryPath, await readFile(file, "utf8")));
-    }
-    return Object.freeze(evidence);
-}
-async function readPackage(root, manifestPath) {
-    const file = await safePath(root, manifestPath, "file");
-    let input;
-    try {
-        input = JSON.parse(await readFile(file, "utf8"));
-    }
-    catch {
-        inputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Package manifest is not valid JSON: ${manifestPath}.`);
-    }
-    const manifest = record(input, `package manifest ${manifestPath}`);
-    if (typeof manifest["name"] !== "string") {
-        inputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Publishable package name is invalid: ${manifestPath}.`);
-    }
-    const files = manifest["files"];
-    if (files !== undefined && (!Array.isArray(files) || !files.every((entry) => typeof entry === "string"))) {
-        inputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Publishable package files must be strings: ${manifestPath}.`);
-    }
-    const publishConfig = manifest["publishConfig"];
-    return Object.freeze({
-        manifestPath,
-        packageName: manifest["name"],
-        ...(files === undefined ? {} : { files: Object.freeze(files) }),
-        provenance: typeof publishConfig === "object" &&
-            publishConfig !== null &&
-            !Array.isArray(publishConfig) &&
-            publishConfig["provenance"] === true
-    });
 }
 export class FilesystemRepositorySecurityReader {
     async read(consumerRoot, policy, signal) {
         assertNotCancelled(signal);
-        const root = await realpath(consumerRoot).catch(() => inputError("CONSUMER_ROOT_UNAVAILABLE", "Consumer root must be an accessible directory."));
-        const [workflows, packages] = await Promise.all([
-            readWorkflowDirectory(root, policy, signal),
-            Promise.all(policy.publishablePackageManifests.map((manifestPath) => readPackage(root, manifestPath)))
+        const root = await resolveConsumerRoot(consumerRoot);
+        const [workflowDirectory, packages] = await Promise.all([
+            readWorkflowDirectoryEvidence(root, policy, signal),
+            Promise.all(policy.publishablePackageManifests.map((manifestPath) => readPublishablePackageEvidence(root, manifestPath)))
         ]);
-        for (const requiredWorkflow of [policy.dependencyReviewWorkflow, policy.sbomWorkflow]) {
-            if (!workflows.some(({ path }) => path === requiredWorkflow)) {
-                inputError("REPOSITORY_SECURITY_REQUIRED_WORKFLOW_UNAVAILABLE", `Required security workflow is not discovered: ${requiredWorkflow}.`);
-            }
-        }
-        return Object.freeze({ workflows, packages: Object.freeze(packages) });
+        requireConfiguredWorkflows(workflowDirectory.workflows, policy);
+        const toolEvidence = await readSecurityToolEvidence(root, policy, workflowDirectory.workflowDigest);
+        return Object.freeze({
+            compositeActions: workflowDirectory.compositeActions,
+            workflows: workflowDirectory.workflows,
+            workflowUses: workflowDirectory.workflowUses,
+            workflowDigest: workflowDirectory.workflowDigest,
+            packages: Object.freeze(packages),
+            toolEvidence: Object.freeze(toolEvidence)
+        });
     }
 }
 //# sourceMappingURL=filesystem-repository-security-reader.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-repository-security-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAY1F,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,SAAS,UAAU,CAAC,IAAY,EAAE,OAAe;IAC/C,MAAM,IAAI,oBAAoB,CAAC;QAC7B,IAAI;QACJ,OAAO;QACP,KAAK,EAAE,8BAA8B;QACrC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,UAAU,CAAC,sCAAsC,EAAE,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,cAAsB,EACtB,IAA0B;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,MAAM,yBAAyB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACrD,UAAU,CACR,wCAAwC,EACxC,sDAAsD,cAAc,GAAG,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CACrD,UAAU,CACR,0CAA0C,EAC1C,qCAAqC,cAAc,GAAG,CACvD,CACF,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAChC,UAAU,CACR,qCAAqC,EACrC,6CAA6C,cAAc,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,IACE,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjD,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,EAC3E,CAAC;QACD,UAAU,CACR,sCAAsC,EACtC,oCAAoC,IAAI,KAAK,cAAc,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC7E,UAAU,CACR,sCAAsC,EACtC,GAAG,KAAK,IAAI,IAAI,gCAAgC,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,sCAAsC,EAAE,oCAAoC,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE;QAC5B,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CACL,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAC3B,QAAQ,EAAE,CACd,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,sCAAsC,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;YACrC,WAAW,EACT,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS;gBACvC,IAAI,CAAC,mBAAmB,CAAC,KAAK,KAAK;YACrC,MAAM,EAAE,MAAM,CAAC,MAAM,CACnB,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,IAAI,KAAK,QAAQ,CAAC,CAClD;YACD,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,YAAY,IAAI,OAAO,CAAC,CAAC;IACjE,MAAM,IAAI,GAA0B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,WAAW,CAChC,GAAG,CAAC,aAAa,CAAC,EAClB,YAAY,IAAI,SAAS,EAAE,cAAc,CAC1C,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YACpC,WAAW,EACT,GAAG,CAAC,mBAAmB,CAAC,KAAK,SAAS;gBACtC,GAAG,CAAC,mBAAmB,CAAC,KAAK,KAAK;YACpC,EAAE;YACF,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;YACxE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,EAAE,QAAQ,CAAC;SAChE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,YAAY,IAAI,cAAc,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,qBAAqB,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;QAClF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;KACrF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,MAAgC,EAChC,MAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChF,UAAU,CACR,4CAA4C,EAC5C,qDAAqD,KAAK,CAAC,IAAI,GAAG,CACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CACR,qCAAqC,EACrC,uCAAuC,YAAY,GAAG,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzC,UAAU,CACR,qCAAqC,EACrC,wCAAwC,YAAY,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzG,UAAU,CACR,qCAAqC,EACrC,8CAA8C,YAAY,GAAG,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC;QAC7B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,UAAU,EACR,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,aAAyC,CAAC,YAAY,CAAC,KAAK,IAAI;KACpE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,kCAAkC;IAC7C,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,MAAgC,EAChC,MAAoB;QAEpB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CACnD,UAAU,CAAC,2BAA2B,EAAE,gDAAgD,CAAC,CAC1F,CAAC;QACF,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;YAC3C,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAC1F;SACF,CAAC,CAAC;QACH,KAAK,MAAM,gBAAgB,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACtF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;gBAC7D,UAAU,CACR,mDAAmD,EACnD,iDAAiD,gBAAgB,GAAG,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"filesystem-repository-security-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAMnE,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,SAAS,0BAA0B,CACjC,SAAkD,EAClD,MAAgC;IAEhC,KAAK,MAAM,gBAAgB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAC7D,4BAA4B,CAC1B,mDAAmD,EACnD,iDAAiD,gBAAgB,GAAG,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,kCAAkC;IAC7C,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,MAAgC,EAChC,MAAoB;QAEpB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;YACnD,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CACtD,8BAA8B,CAAC,IAAI,EAAE,YAAY,CAAC,CACnD,CACF;SACF,CAAC,CAAC;QACH,0BAA0B,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,MAAM,wBAAwB,CACjD,IAAI,EACJ,MAAM,EACN,iBAAiB,CAAC,cAAc,CACjC,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;YACpD,SAAS,EAAE,iBAAiB,CAAC,SAAS;YACtC,YAAY,EAAE,iBAAiB,CAAC,YAAY;YAC5C,cAAc,EAAE,iBAAiB,CAAC,cAAc;YAChD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.d.ts

@@ -0,0 +1,3 @@
+import type { PublishablePackageEvidence } from "../../../application/model/repository-security.js";
+export declare function readPublishablePackageEvidence(root: string, manifestPath: string): Promise<PublishablePackageEvidence>;
+//# sourceMappingURL=publishable-package-evidence-reader.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publishable-package-evidence-reader.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAOpG,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAsCrC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.js

@@ -0,0 +1,31 @@
+import { readRequiredEvidenceFile } from "./repository-security-filesystem.js";
+import { repositorySecurityInputError, requireRecord } from "./repository-security-input.js";
+export async function readPublishablePackageEvidence(root, manifestPath) {
+    let input;
+    try {
+        input = JSON.parse((await readRequiredEvidenceFile(root, manifestPath)).toString("utf8"));
+    }
+    catch {
+        repositorySecurityInputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Package manifest is not valid JSON: ${manifestPath}.`);
+    }
+    const manifest = requireRecord(input, `package manifest ${manifestPath}`);
+    if (typeof manifest["name"] !== "string") {
+        repositorySecurityInputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Publishable package name is invalid: ${manifestPath}.`);
+    }
+    const files = manifest["files"];
+    if (files !== undefined &&
+        (!Array.isArray(files) || !files.every((entry) => typeof entry === "string"))) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Publishable package files must be strings: ${manifestPath}.`);
+    }
+    const publishConfig = manifest["publishConfig"];
+    return Object.freeze({
+        manifestPath,
+        packageName: manifest["name"],
+        ...(files === undefined ? {} : { files: Object.freeze(files) }),
+        provenance: typeof publishConfig === "object" &&
+            publishConfig !== null &&
+            !Array.isArray(publishConfig) &&
+            publishConfig["provenance"] === true
+    });
+}
+//# sourceMappingURL=publishable-package-evidence-reader.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publishable-package-evidence-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/publishable-package-evidence-reader.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,YAAoB;IAEpB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,wBAAwB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B,CAC1B,qCAAqC,EACrC,uCAAuC,YAAY,GAAG,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzC,4BAA4B,CAC1B,qCAAqC,EACrC,wCAAwC,YAAY,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAC7E,CAAC;QACD,4BAA4B,CAC1B,qCAAqC,EACrC,8CAA8C,YAAY,GAAG,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC;QAC7B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,UAAU,EACR,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,aAAyC,CAAC,YAAY,CAAC,KAAK,IAAI;KACpE,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.d.ts

@@ -0,0 +1,6 @@
+export declare function digestEvidence(source: Uint8Array): Promise<string>;
+export declare function digestWorkflowSources(entries: readonly {
+    readonly path: string;
+    readonly source: Uint8Array;
+}[]): Promise<string>;
+//# sourceMappingURL=repository-security-digests.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-digests.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.ts"],"names":[],"mappings":"AA2BA,wBAAsB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAExE;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,EAAE,GACzE,OAAO,CAAC,MAAM,CAAC,CAajB"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.js

@@ -0,0 +1,31 @@
+import { compareBinaryStrings } from "../../../../../binary-string-comparator.js";
+import { repositorySecurityInputError } from "./repository-security-input.js";
+const MAX_WORKFLOW_DIGEST_BYTES = 32 * 1024 * 1024;
+function encode(value) {
+    return new TextEncoder().encode(value);
+}
+async function digestParts(parts) {
+    const totalBytes = parts.reduce((total, part) => total + part.byteLength, 0);
+    if (!Number.isSafeInteger(totalBytes) || totalBytes > MAX_WORKFLOW_DIGEST_BYTES) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_TOO_LARGE", "Security workflow sources exceed the supported digest input size.");
+    }
+    const source = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const part of parts) {
+        source.set(part, offset);
+        offset += part.byteLength;
+    }
+    const hash = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", source.buffer));
+    return `sha256:${Array.from(hash, (value) => value.toString(16).padStart(2, "0")).join("")}`;
+}
+export async function digestEvidence(source) {
+    return digestParts([source]);
+}
+export async function digestWorkflowSources(entries) {
+    const parts = [encode("repository-security-workflows-v1\u0000")];
+    for (const entry of entries.toSorted((left, right) => compareBinaryStrings(left.path, right.path))) {
+        parts.push(encode(entry.path), encode("\u0000"), encode(String(entry.source.byteLength)), encode("\u0000"), entry.source, encode("\u0000"));
+    }
+    return digestParts(parts);
+}
+//# sourceMappingURL=repository-security-digests.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-digests.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-digests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAA4B;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAChF,4BAA4B,CAC1B,wCAAwC,EACxC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA0E;IAE1E,MAAM,KAAK,GAAiB,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnG,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAClB,MAAM,CAAC,QAAQ,CAAC,EAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EACvC,MAAM,CAAC,QAAQ,CAAC,EAChB,KAAK,CAAC,MAAM,EACZ,MAAM,CAAC,QAAQ,CAAC,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-filesystem.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveConsumerRoot(consumerRoot: string): Promise<string>;
+export declare function resolveSafeEvidencePath(root: string, repositoryPath: string): Promise<string>;
+export declare function readRequiredEvidenceFile(root: string, repositoryPath: string): Promise<Buffer>;
+export declare function readOptionalEvidenceFile(root: string, repositoryPath: string): Promise<Buffer | undefined>;
+//# sourceMappingURL=repository-security-filesystem.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-filesystem.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-filesystem.ts"],"names":[],"mappings":"AAiBA,wBAAsB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/E;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AA2BD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgB7B"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-filesystem.js

@@ -0,0 +1,73 @@
+import { realpath, stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { ContainedFileReadError, pathTraversesSymbolicLink, readContainedRegularFile } from "../../../../../filesystem-path-safety.js";
+import { repositorySecurityInputError } from "./repository-security-input.js";
+const MAX_FILE_BYTES = 4 * 1024 * 1024;
+function isContained(parent, candidate) {
+    const relation = relative(parent, candidate);
+    return relation === "" || (!isAbsolute(relation) && relation !== ".." && !relation.startsWith(`..${sep}`));
+}
+export async function resolveConsumerRoot(consumerRoot) {
+    return realpath(consumerRoot).catch(() => repositorySecurityInputError("CONSUMER_ROOT_UNAVAILABLE", "Consumer root must be an accessible directory."));
+}
+export async function resolveSafeEvidencePath(root, repositoryPath) {
+    const candidate = resolve(root, repositoryPath);
+    if (await pathTraversesSymbolicLink(root, candidate)) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_SYMLINK_PROHIBITED", `Security evidence cannot traverse a symbolic link: ${repositoryPath}.`);
+    }
+    const canonical = await realpath(candidate).catch(() => repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_UNAVAILABLE", `Security evidence is unavailable: ${repositoryPath}.`));
+    if (!isContained(root, canonical)) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_ESCAPE", `Security evidence escapes the repository: ${repositoryPath}.`);
+    }
+    const metadata = await stat(canonical);
+    if (!metadata.isDirectory()) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_INVALID", `Security evidence is not a valid directory: ${repositoryPath}.`);
+    }
+    return canonical;
+}
+function mapFileReadFailure(error, repositoryPath) {
+    if (error.failure === "escape") {
+        repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_ESCAPE", `Security evidence escapes the repository: ${repositoryPath}.`);
+    }
+    if (error.failure === "symlink") {
+        repositorySecurityInputError("REPOSITORY_SECURITY_SYMLINK_PROHIBITED", `Security evidence cannot traverse a symbolic link: ${repositoryPath}.`);
+    }
+    if (error.failure === "invalid") {
+        repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_INVALID", `Security evidence is not a valid file: ${repositoryPath}.`);
+    }
+    repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_UNAVAILABLE", `Security evidence is unavailable or changed while reading: ${repositoryPath}.`);
+}
+export async function readRequiredEvidenceFile(root, repositoryPath) {
+    try {
+        return await readContainedRegularFile({
+            candidate: resolve(root, repositoryPath),
+            maxBytes: MAX_FILE_BYTES,
+            root
+        });
+    }
+    catch (error) {
+        if (error instanceof ContainedFileReadError) {
+            mapFileReadFailure(error, repositoryPath);
+        }
+        throw error;
+    }
+}
+export async function readOptionalEvidenceFile(root, repositoryPath) {
+    try {
+        return await readContainedRegularFile({
+            candidate: resolve(root, repositoryPath),
+            maxBytes: MAX_FILE_BYTES,
+            root
+        });
+    }
+    catch (error) {
+        if (error instanceof ContainedFileReadError) {
+            if (error.failure === "missing") {
+                return undefined;
+            }
+            mapFileReadFailure(error, repositoryPath);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=repository-security-filesystem.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-filesystem.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,SAAS,WAAW,CAAC,MAAc,EAAE,SAAiB;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,YAAoB;IAC5D,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CACvC,4BAA4B,CAC1B,2BAA2B,EAC3B,gDAAgD,CACjD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAY,EACZ,cAAsB;IAEtB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,MAAM,yBAAyB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACrD,4BAA4B,CAC1B,wCAAwC,EACxC,sDAAsD,cAAc,GAAG,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CACrD,4BAA4B,CAC1B,0CAA0C,EAC1C,qCAAqC,cAAc,GAAG,CACvD,CACF,CAAC;IACF,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAClC,4BAA4B,CAC1B,qCAAqC,EACrC,6CAA6C,cAAc,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,4BAA4B,CAC1B,sCAAsC,EACtC,+CAA+C,cAAc,GAAG,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA6B,EAAE,cAAsB;IAC/E,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/B,4BAA4B,CAC1B,qCAAqC,EACrC,6CAA6C,cAAc,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,4BAA4B,CAC1B,wCAAwC,EACxC,sDAAsD,cAAc,GAAG,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,4BAA4B,CAC1B,sCAAsC,EACtC,0CAA0C,cAAc,GAAG,CAC5D,CAAC;IACJ,CAAC;IACD,4BAA4B,CAC1B,0CAA0C,EAC1C,8DAA8D,cAAc,GAAG,CAChF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,cAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,MAAM,wBAAwB,CAAC;YACpC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC;YACxC,QAAQ,EAAE,cAAc;YACxB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,cAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,MAAM,wBAAwB,CAAC;YACpC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC;YACxC,QAAQ,EAAE,cAAc;YACxB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-input.d.ts

@@ -0,0 +1,3 @@
+export declare function repositorySecurityInputError(code: string, message: string): never;
+export declare function requireRecord(value: unknown, field: string): Record<string, unknown>;
+//# sourceMappingURL=repository-security-input.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-input.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-input.ts"],"names":[],"mappings":"AAEA,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAOjF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQpF"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-input.js

@@ -0,0 +1,16 @@
+import { CapabilityInputError } from "../../../../../capability-runtime.js";
+export function repositorySecurityInputError(code, message) {
+    throw new CapabilityInputError({
+        code,
+        message,
+        phase: "repository-security-evidence",
+        retryable: false
+    });
+}
+export function requireRecord(value, field) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_EVIDENCE_INVALID", `${field} must be an object.`);
+    }
+    return value;
+}
+//# sourceMappingURL=repository-security-input.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-input.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/repository-security-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,OAAe;IACxE,MAAM,IAAI,oBAAoB,CAAC;QAC7B,IAAI;QACJ,OAAO;QACP,KAAK,EAAE,8BAA8B;QACrC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,KAAa;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,4BAA4B,CAC1B,sCAAsC,EACtC,GAAG,KAAK,qBAAqB,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/security-tool-evidence-reader.d.ts

@@ -0,0 +1,3 @@
+import type { RepositorySecurityPolicy, RepositorySecurityToolEvidence } from "../../../application/model/repository-security.js";
+export declare function readSecurityToolEvidence(root: string, policy: RepositorySecurityPolicy, currentWorkflowDigest: string): Promise<readonly RepositorySecurityToolEvidence[]>;
+//# sourceMappingURL=security-tool-evidence-reader.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/security-tool-evidence-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool-evidence-reader.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/security-tool-evidence-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,wBAAwB,EACxB,8BAA8B,EAE/B,MAAM,mDAAmD,CAAC;AA8G3D,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,wBAAwB,EAChC,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,SAAS,8BAA8B,EAAE,CAAC,CA0BpD"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/security-tool-evidence-reader.js

@@ -0,0 +1,98 @@
+import { configuredRepositorySecurityTools } from "../../../application/model/repository-security.js";
+import { digestEvidence } from "./repository-security-digests.js";
+import { readOptionalEvidenceFile, readRequiredEvidenceFile } from "./repository-security-filesystem.js";
+import { repositorySecurityInputError, requireRecord } from "./repository-security-input.js";
+const SHA_256_DIGEST = /^sha256:[0-9a-f]{64}$/u;
+const EXACT_SEMANTIC_VERSION = /^v?[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+function toolEvidenceError(message) {
+    return repositorySecurityInputError("REPOSITORY_SECURITY_TOOL_EVIDENCE_INVALID", message);
+}
+function requireToolEvidenceString(value, field) {
+    if (typeof value !== "string") {
+        toolEvidenceError(`${field} must be a string.`);
+    }
+    return value;
+}
+function requireToolEvidenceDigest(value, field) {
+    const result = requireToolEvidenceString(value, field);
+    if (!SHA_256_DIGEST.test(result)) {
+        toolEvidenceError(`${field} must be a lowercase sha256 digest.`);
+    }
+    return result;
+}
+function requireToolEvidenceVersion(value, field) {
+    const result = requireToolEvidenceString(value, field);
+    if (!EXACT_SEMANTIC_VERSION.test(result)) {
+        toolEvidenceError(`${field} must be an exact semantic version.`);
+    }
+    return result;
+}
+function parseToolEvidence(source, expectedTool) {
+    let input;
+    try {
+        input = JSON.parse(source.toString("utf8"));
+    }
+    catch {
+        toolEvidenceError(`${expectedTool} evidence is not valid JSON.`);
+    }
+    const value = requireRecord(input, `${expectedTool} evidence`);
+    const expectedFields = [
+        "configDigest",
+        "outcome",
+        "resultDigest",
+        "schemaVersion",
+        "tool",
+        "toolVersion",
+        "workflowDigest"
+    ];
+    const fields = Object.keys(value).toSorted();
+    if (fields.length !== expectedFields.length ||
+        fields.some((field, index) => field !== expectedFields[index])) {
+        toolEvidenceError(`${expectedTool} evidence has unsupported or missing fields.`);
+    }
+    if (value["schemaVersion"] !== 1) {
+        toolEvidenceError(`${expectedTool} evidence schemaVersion must be 1.`);
+    }
+    if (value["tool"] !== expectedTool) {
+        toolEvidenceError(`${expectedTool} evidence tool identity is invalid.`);
+    }
+    const outcome = value["outcome"];
+    if (outcome !== "passed" && outcome !== "failed") {
+        toolEvidenceError(`${expectedTool} evidence outcome must be passed or failed.`);
+    }
+    return Object.freeze({
+        kind: "present",
+        tool: expectedTool,
+        configDigest: requireToolEvidenceDigest(value["configDigest"], `${expectedTool}.configDigest`),
+        outcome,
+        resultDigest: requireToolEvidenceDigest(value["resultDigest"], `${expectedTool}.resultDigest`),
+        toolVersion: requireToolEvidenceVersion(value["toolVersion"], `${expectedTool}.toolVersion`),
+        workflowDigest: requireToolEvidenceDigest(value["workflowDigest"], `${expectedTool}.workflowDigest`)
+    });
+}
+export async function readSecurityToolEvidence(root, policy, currentWorkflowDigest) {
+    return Promise.all(configuredRepositorySecurityTools(policy.toolEvidence).map(async ({ policy: toolPolicy, tool }) => {
+        const configSource = await readRequiredEvidenceFile(root, toolPolicy.configPath);
+        const evidenceSource = await readOptionalEvidenceFile(root, toolPolicy.evidencePath);
+        const resultSource = await readOptionalEvidenceFile(root, toolPolicy.resultPath);
+        if (evidenceSource === undefined || resultSource === undefined) {
+            return Object.freeze({
+                kind: "missing",
+                missing: evidenceSource === undefined ? "evidence" : "result",
+                tool,
+                evidencePath: toolPolicy.evidencePath,
+                resultPath: toolPolicy.resultPath
+            });
+        }
+        const parsed = parseToolEvidence(evidenceSource, tool);
+        return Object.freeze({
+            ...parsed,
+            actualConfigDigest: await digestEvidence(configSource),
+            actualResultDigest: await digestEvidence(resultSource),
+            actualWorkflowDigest: currentWorkflowDigest,
+            evidencePath: toolPolicy.evidencePath,
+            resultPath: toolPolicy.resultPath
+        });
+    }));
+}
+//# sourceMappingURL=security-tool-evidence-reader.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/security-tool-evidence-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-tool-evidence-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/security-tool-evidence-reader.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,iCAAiC,EAAE,MAAM,mDAAmD,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AAExC,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,sBAAsB,GAC1B,sEAAsE,CAAC;AAEzE,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,4BAA4B,CAAC,2CAA2C,EAAE,OAAO,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc,EAAE,KAAa;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,iBAAiB,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc,EAAE,KAAa;IAC9D,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,iBAAiB,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,KAAa;IAC/D,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,iBAAiB,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,YAA8B;IAS9B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,GAAG,YAAY,8BAA8B,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,YAAY,WAAW,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG;QACrB,cAAc;QACd,SAAS;QACT,cAAc;QACd,eAAe;QACf,MAAM;QACN,aAAa;QACb,gBAAgB;KACjB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,IACE,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;QACD,iBAAiB,CAAC,GAAG,YAAY,8CAA8C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,iBAAiB,CAAC,GAAG,YAAY,oCAAoC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;QACnC,iBAAiB,CAAC,GAAG,YAAY,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjD,iBAAiB,CAAC,GAAG,YAAY,6CAA6C,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,SAAkB;QACxB,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,yBAAyB,CACrC,KAAK,CAAC,cAAc,CAAC,EACrB,GAAG,YAAY,eAAe,CAC/B;QACD,OAAO;QACP,YAAY,EAAE,yBAAyB,CACrC,KAAK,CAAC,cAAc,CAAC,EACrB,GAAG,YAAY,eAAe,CAC/B;QACD,WAAW,EAAE,0BAA0B,CACrC,KAAK,CAAC,aAAa,CAAC,EACpB,GAAG,YAAY,cAAc,CAC9B;QACD,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,gBAAgB,CAAC,EACvB,GAAG,YAAY,iBAAiB,CACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,MAAgC,EAChC,qBAA6B;IAE7B,OAAO,OAAO,CAAC,GAAG,CAChB,iCAAiC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;QAChG,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACjF,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACjF,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,IAAI,EAAE,SAAkB;gBACxB,OAAO,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;gBAC7D,IAAI;gBACJ,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,MAAM;YACT,kBAAkB,EAAE,MAAM,cAAc,CAAC,YAAY,CAAC;YACtD,kBAAkB,EAAE,MAAM,cAAc,CAAC,YAAY,CAAC;YACtD,oBAAoB,EAAE,qBAAqB;YAC3C,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-parser.d.ts

@@ -0,0 +1,6 @@
+import type { CompositeActionEvidence, WorkflowEvidence, WorkflowUseEvidence } from "../../../application/model/repository-security.js";
+export declare function parseWorkflow(path: string, source: string): WorkflowEvidence;
+export declare function collectWorkflowUses(workflows: readonly WorkflowEvidence[]): readonly WorkflowUseEvidence[];
+export declare function collectCompositeActionUses(path: string, source: Uint8Array): CompositeActionEvidence;
+export declare function collectCompositeActionWorkflowUses(action: CompositeActionEvidence): readonly WorkflowUseEvidence[];
+//# sourceMappingURL=workflow-evidence-parser.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-evidence-parser.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-parser.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,uBAAuB,EAEvB,gBAAgB,EAIhB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AA2L3D,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CA+B5E;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GACrC,SAAS,mBAAmB,EAAE,CAuBhC;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,GACjB,uBAAuB,CAiBzB;AAED,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,uBAAuB,GAC9B,SAAS,mBAAmB,EAAE,CAchC"}