@intentius/chant 0.13.1 → 0.15.1

package/dist/components/verbs/sign.d.ts

@@ -0,0 +1,222 @@
+/**
+ * `sign` capability — keyless cosign signing + SLSA provenance attestation
+ * (#622, epic #551 follow-up to #610's referrer-attach path and #614's
+ * reproducibility/provenance material). The companion gate is
+ * `./verify.ts`'s `verify` capability.
+ *
+ * **Beginner footgun #1 neutralized: sign the digest, never a tag.** `input`
+ * requires an already-resolved `sha256:` image reference (typically wired
+ * from a prior publish step, `"@Publish.uri"`, which is itself
+ * `repo@sha256:...` — see ./publish.ts) — never a bare tag. A tag is mutable;
+ * signing one says nothing about which bytes were actually signed by the
+ * time someone pulls it. `assertDigestRef` below throws before ever shelling
+ * out if a caller passes a tag-only reference.
+ *
+ * **Beginner footgun #2 neutralized: keyless by default.** Sign via cosign's
+ * keyless flow (a short-lived Fulcio cert bound to an OIDC identity, logged
+ * to the public Rekor transparency log) — `cosign sign --yes <ref>` with no
+ * `--key`. There is no private key file for a first-timer to generate, lose,
+ * leak, or forget to rotate. Key-based signing (`input.key`) is an opt-in
+ * override for teams with an existing KMS/file-based key policy, never the
+ * default — see `buildSignArgs`/`buildAttestArgs` below: `--key` is added
+ * only when `input.key` is explicitly supplied, and it is the *only* thing
+ * that changes about the invocation (still by digest, still attached the
+ * same way).
+ *
+ * **SLSA provenance.** `attestProvenance` builds an in-toto
+ * `https://slsa.dev/provenance/v1` statement from the same
+ * `ProvenanceLink`/`ArtifactReproducibility` material #614's
+ * ./reproducibility.ts already records per build-archive entry (source ref,
+ * artifact digest) plus a builder id and timestamp, then signs+attaches it
+ * via `cosign attest` (keyless by the same default). This reuses #614's
+ * provenance model rather than inventing a second one — the in-toto
+ * statement's `predicate.buildDefinition.resolvedDependencies` /
+ * `.internalParameters` are populated from the same source-ref/digest link a
+ * build archive entry already carries.
+ *
+ * Both `sign` and `attestProvenance` shell out to `cosign` through the
+ * injectable `ProcessRunner` (./process-runner.ts) — mirroring
+ * ./tool-sbom-generator.ts and ./publish.ts's referrer-attach step exactly:
+ * `requireTool` throws `ToolNotAvailableError` with an actionable message if
+ * `cosign` is absent, and no test here ever spawns a real process or talks
+ * to Rekor/Fulcio.
+ */
+import type { Capability } from "../capability.js";
+import { type ProcessRunner } from "./process-runner.js";
+import type { ProvenanceLink } from "./reproducibility.js";
+/**
+ * Thrown when a `sign`/`attest` input's image reference has no `@sha256:...`
+ * digest — refusing to sign a mutable tag (beginner footgun #1) rather than
+ * silently signing whatever the tag happens to resolve to right now.
+ */
+export declare class SignTargetNotDigestError extends Error {
+    readonly ref: string;
+    readonly verb: "sign" | "attest";
+    constructor(ref: string, verb: "sign" | "attest");
+}
+/**
+ * cosign keyless signing config. Keyless is the default story this whole
+ * module encodes — every field here is optional because `cosign sign --yes`
+ * with no flags at all already does the right thing in CI (ambient OIDC from
+ * the CI provider's own token, e.g. GitHub Actions' `id-token: write`).
+ * `identityToken`/`oidcIssuer`/`oidcClientId` are the explicit overrides for
+ * environments without ambient OIDC detection.
+ */
+export interface KeylessSigningConfig {
+    /** Explicit OIDC identity token, when the environment has no ambient CI OIDC cosign can auto-detect. */
+    identityToken?: string;
+    /** OIDC issuer URL override (`cosign sign --oidc-issuer`). */
+    oidcIssuer?: string;
+    /** OIDC client id override (`cosign sign --oidc-client-id`). */
+    oidcClientId?: string;
+    /** Fulcio URL override, for a private Sigstore instance. */
+    fulcioUrl?: string;
+    /** Rekor URL override, for a private transparency log. */
+    rekorUrl?: string;
+}
+/**
+ * Key-based signing override config — opt-in, never the default (see this
+ * module's doc comment). Supplying `input.key` on `sign`/`attestProvenance`
+ * switches the invocation to `cosign sign --key <key>` instead of the keyless
+ * flow; every other part of the invocation (digest-only target, referrer
+ * attach) is unchanged.
+ */
+export interface KeyBasedSigningConfig {
+    /** Key reference cosign accepts: a local path, `kms://...`, `k8s://...`, `azurekms://...`, `awskms://...`, etc. An encrypted key file's password is not accepted here — `ProcessRunner.run` (./process-runner.ts) has no env-var passthrough today, and interpolating a secret into the shell command string would leak it into process listings/logs; supply an unencrypted key reference (e.g. a KMS URI) or export `COSIGN_PASSWORD` in the calling process's own environment instead. */
+    key: string;
+}
+export interface SignInput {
+    /** Digest-qualified image reference to sign, e.g. `"123.dkr.ecr.us-east-1.amazonaws.com/search@sha256:abc..."` — typically wired from a prior publish step's `"@Publish.uri"`. Never a bare tag; see `SignTargetNotDigestError`. */
+    imageRef: string;
+    /** Keyless signing config (OIDC identity + Rekor/Fulcio overrides). Default: cosign's own ambient keyless detection, no explicit config needed. Ignored when `key` is supplied. */
+    keyless?: KeylessSigningConfig;
+    /** Opt-in key-based override — supply to sign with a private/KMS key instead of the keyless default. Not the default; see this module's doc comment. */
+    key?: KeyBasedSigningConfig;
+    /** Annotations to attach to the signature (`cosign sign -a k=v`), e.g. build metadata. */
+    annotations?: Record<string, string>;
+}
+export interface SignOutput {
+    /** The digest-qualified reference that was signed — echoed back for downstream wiring (e.g. into `attestProvenance`/`verify`). */
+    imageRef: string;
+    /** True once `cosign sign` completed without error. */
+    signed: true;
+    /** `"keyless"` or `"key"`, reflecting which flow actually ran. */
+    method: "keyless" | "key";
+}
+/** Build the `cosign sign` argv (as a shell command string) for `input` — factored out so tests can assert on the exact invocation without needing a full mock run. */
+export declare function buildSignArgs(input: SignInput): string;
+/**
+ * Sign an artifact by digest via keyless cosign (default) or an opt-in
+ * key-based override, and attach the signature as an OCI referrer on that
+ * digest — `cosign sign` itself performs the attach (cosign's signatures are
+ * always stored as registry referrers/the legacy tag convention; no separate
+ * `oras attach` step is needed the way SBOM/BOM referrer attach in
+ * ./publish.ts requires one, since cosign natively pushes to the registry).
+ * Refuses to run at all against a non-digest reference (`SignTargetNotDigestError`)
+ * — sign is never invoked for a tag, by construction, before any process is spawned.
+ *
+ * No rollback: an already-signed, content-addressed image's signature is
+ * immutable evidence sitting in the registry — nothing to compensate, the
+ * same opt-out `publish-image`/`generate-sbom` already take for
+ * no-mutable-remote-state operations.
+ */
+export declare function createSignCapability(processRunner?: ProcessRunner): Capability<SignInput, SignOutput>;
+/** Default `sign` capability, backed by the real `ProcessRunner`. */
+export declare const signCapability: Capability<SignInput, SignOutput>;
+/** Minimal in-toto `https://slsa.dev/provenance/v1` predicate — the fields this module can honestly populate from #614's `ProvenanceLink` material, not a full SLSA Level 3+ builder identity/hermeticity claim. */
+export interface SlsaProvenancePredicate {
+    buildDefinition: {
+        buildType: string;
+        externalParameters: Record<string, unknown>;
+        internalParameters?: Record<string, unknown>;
+        resolvedDependencies?: Array<{
+            uri: string;
+            digest?: Record<string, string>;
+        }>;
+    };
+    runDetails: {
+        builder: {
+            id: string;
+        };
+        metadata?: {
+            invocationId?: string;
+            startedOn?: string;
+            finishedOn?: string;
+        };
+    };
+}
+/** The full in-toto statement wrapping the SLSA predicate — what `cosign attest` signs+attaches. */
+export interface InTotoProvenanceStatement {
+    _type: "https://in-toto.io/Statement/v1";
+    predicateType: "https://slsa.dev/provenance/v1";
+    subject: Array<{
+        name: string;
+        digest: {
+            sha256: string;
+        };
+    }>;
+    predicate: SlsaProvenancePredicate;
+}
+export interface BuildProvenanceStatementInput {
+    /** The digest-qualified artifact reference this provenance describes (subject). */
+    imageRef: string;
+    /** Source -> output link, reused from #614 (./reproducibility.ts) rather than re-deriving a second source-of-truth for "what commit produced this." */
+    provenance: ProvenanceLink;
+    /** Builder identity URI, e.g. a CI run URL or `"https://github.com/actions/runner"`. */
+    builderId: string;
+    /** Build type identifier (an arbitrary URI naming the recipe kind, e.g. `"https://chant.dev/build-archive/v1"`). Defaults to a chant-generic build type. */
+    buildType?: string;
+    /** ISO-8601 timestamp of the build's completion. Defaults to `new Date().toISOString()`. */
+    finishedOn?: string;
+    /** CI invocation/run id, when available (e.g. a GitHub Actions run id). */
+    invocationId?: string;
+}
+/**
+ * Build an in-toto SLSA provenance statement for `input.imageRef`, reusing
+ * #614's `ProvenanceLink` (source ref -> artifact digest) as the statement's
+ * `resolvedDependencies`/`internalParameters` material — the honest subset
+ * chant can actually attest to (which source commit, which builder, when),
+ * matching ./reproducibility.ts's "honesty over convenience" stance rather
+ * than fabricating a stronger provenance claim than the build system backs.
+ */
+export declare function buildProvenanceStatement(input: BuildProvenanceStatementInput): InTotoProvenanceStatement;
+export interface AttestProvenanceInput extends BuildProvenanceStatementInput {
+    /** Keyless signing config, same shape/default as `SignInput.keyless`. */
+    keyless?: KeylessSigningConfig;
+    /** Opt-in key-based override, same shape/default as `SignInput.key`. */
+    key?: KeyBasedSigningConfig;
+}
+export interface AttestProvenanceOutput {
+    /** The digest-qualified reference the provenance was attested for. */
+    imageRef: string;
+    /** The in-toto statement that was signed+attached (returned for inspection/logging/tests). */
+    statement: InTotoProvenanceStatement;
+    /** True once `cosign attest` completed without error. */
+    attested: true;
+    /** `"keyless"` or `"key"`, reflecting which flow actually ran. */
+    method: "keyless" | "key";
+}
+/**
+ * Build the `cosign attest` argv (as a shell command string) for a
+ * predicate-type/payload pair. Factored out (like `buildSignArgs`) so tests
+ * can assert on the exact invocation. `--predicate` reads from a scratch
+ * file path (`cosign attest` does not accept the payload on stdin any more
+ * reliably than `oras attach` does — see ./publish.ts's `attachOneReferrer`
+ * for the same scratch-file convention) — the caller passes the path already
+ * written.
+ */
+export declare function buildAttestArgs(input: AttestProvenanceInput, predicatePath: string): string;
+/**
+ * Build an in-toto SLSA provenance statement for a digest-qualified artifact
+ * (reusing #614's `ProvenanceLink` material) and sign+attach it via keyless
+ * `cosign attest` (default) or an opt-in key-based override — attached as a
+ * referrer alongside the signature (`sign`) and SBOM (`generate-sbom`) on
+ * the same digest. Refuses a non-digest `imageRef` the same way `sign` does.
+ *
+ * No rollback: same reasoning as `sign` — an attached, content-addressed
+ * attestation is immutable evidence, nothing to compensate.
+ */
+export declare function createAttestProvenanceCapability(processRunner?: ProcessRunner): Capability<AttestProvenanceInput, AttestProvenanceOutput>;
+/** Default `attest-provenance` capability, backed by the real `ProcessRunner`. */
+export declare const attestProvenanceCapability: Capability<AttestProvenanceInput, AttestProvenanceOutput>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/components/verbs/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAwC,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,GAAG,EAAE,MAAM;aACX,IAAI,EAAE,MAAM,GAAG,QAAQ;gBADvB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,QAAQ;CAQ1C;AAcD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,wGAAwG;IACxG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,6dAA6d;IAC7d,GAAG,EAAE,MAAM,CAAC;CACb;AAsBD,MAAM,WAAW,SAAS;IACxB,oOAAoO;IACpO,QAAQ,EAAE,MAAM,CAAC;IACjB,mLAAmL;IACnL,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,wJAAwJ;IACxJ,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAC5B,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,UAAU;IACzB,kIAAkI;IAClI,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,MAAM,EAAE,IAAI,CAAC;IACb,kEAAkE;IAClE,MAAM,EAAE,SAAS,GAAG,KAAK,CAAC;CAC3B;AAED,uKAAuK;AACvK,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAQtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,GAAE,aAAsC,GACpD,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAUnC;AAED,qEAAqE;AACrE,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC,SAAS,EAAE,UAAU,CAA0B,CAAC;AAIxF,oNAAoN;AACpN,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,oBAAoB,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAAC,CAAC;KAChF,CAAC;IACF,UAAU,EAAE;QACV,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,QAAQ,CAAC,EAAE;YACT,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,UAAU,CAAC,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;CACH;AAED,oGAAoG;AACpG,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,iCAAiC,CAAC;IACzC,aAAa,EAAE,gCAAgC,CAAC;IAChD,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAC7D,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,6BAA6B;IAC5C,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,uJAAuJ;IACvJ,UAAU,EAAE,cAAc,CAAC;IAC3B,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,4JAA4J;IAC5J,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAWD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,yBAAyB,CAsBxG;AAED,MAAM,WAAW,qBAAsB,SAAQ,6BAA6B;IAC1E,yEAAyE;IACzE,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,wEAAwE;IACxE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,SAAS,EAAE,yBAAyB,CAAC;IACrC,yDAAyD;IACzD,QAAQ,EAAE,IAAI,CAAC;IACf,kEAAkE;IAClE,MAAM,EAAE,SAAS,GAAG,KAAK,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,qBAAqB,EAC5B,aAAa,EAAE,MAAM,GACpB,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,aAAa,GAAE,aAAsC,GACpD,UAAU,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAgB3D;AAED,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,EAAE,UAAU,CAAC,qBAAqB,EAAE,sBAAsB,CAC7D,CAAC"}

package/dist/components/verbs/stub.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared helper for building typed capability stubs.
+ *
+ * A stub is fully typed (`kind`, `In`, `Out`) so compositions can wire
+ * output -> input and lint can check the graph, but `run`/`rollback` throw
+ * `CapabilityNotImplementedError` — no cloud calls, no side effects. Cloud
+ * implementations land in a later phase (epic #551).
+ */
+import type { Capability } from "../capability.js";
+/**
+ * Build a stub `Capability<In, Out>` for `kind`. `supportsRollback` also
+ * attaches a `rollback` that throws the same error, so compositions can
+ * already reference `rollback` in typed code ahead of the real implementation.
+ */
+export declare function stubCapability<In, Out>(kind: string, opts?: {
+    rollback?: boolean;
+}): Capability<In, Out>;
+//# sourceMappingURL=stub.d.ts.map

package/dist/components/verbs/stub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/stub.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,GAAG,EACpC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAarB"}

package/dist/components/verbs/tool-sbom-generator.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Real, deep-scan `SbomGenerator` backend (#610, epic #551's "deep external
+ * tool" half of the SBOM story — the counterpart to ./lockfile-sbom-generator.ts's
+ * hermetic, zero-dependency default from #613). Shells out to whichever
+ * external scanner fits the artifact type, through the injectable
+ * `ProcessRunner` (./process-runner.ts, itself mirroring
+ * ./cloud-executor.ts's `CloudExecutor` pattern):
+ *
+ *  - `image` -> `docker buildx build --sbom=true` (BuildKit's native SPDX
+ *    attestation) when a Dockerfile build context is available, otherwise a
+ *    `syft <tarball>` scan of the already-built OCI-layout tarball;
+ *  - `jar`   -> `syft`, or `cyclonedx-maven` when the jar's project directory
+ *    carries a `pom.xml` (a more Maven-native scan than a bytecode-level jar
+ *    scan);
+ *  - `zip`   -> `syft <zip>`;
+ *  - `dir`   -> `syft <dir>`, falling back to `cdxgen <dir>` when `syft` is
+ *    unavailable (`cdxgen`'s "wnat's on disk" mode covers ecosystems syft
+ *    might not have detected).
+ *
+ * Every method resolves the specific tool it needs, checks availability via
+ * `ProcessRunner.available` first, and throws `ToolNotAvailableError`
+ * (./process-runner.ts) with an actionable install hint if the tool is
+ * missing — never a silent empty SBOM. Tests inject `MockProcessRunner`
+ * (./__tests__/mock-process-runner.ts) and assert on the constructed command
+ * line + parsed output; nothing here ever spawns a real process.
+ *
+ * This backend is **not** the process-wide default (see
+ * ./sbom-generator.ts's `notImplementedSbomGenerator` and
+ * ./lockfile-sbom-generator.ts's `lockfileSbomGenerator` module docs for why):
+ * a project opts in explicitly by constructing
+ * `createGenerateSbomCapability(createToolSbomGenerator())` when it wants the
+ * deeper, external-tool-backed scan (e.g. to see an image's base-layer OS
+ * packages, which no lockfile read can see).
+ */
+import { type SbomGenerator } from "./sbom-generator.js";
+import { type ProcessRunner } from "./process-runner.js";
+export interface ToolSbomGeneratorOptions {
+    /** Injected process boundary. Defaults to the real, `child_process`-backed runner. */
+    runner?: ProcessRunner;
+    /** Directory `syft`/`cdxgen`/`cyclonedx-maven` write their output file into before this backend reads it back. Defaults to `node:os`'s tmpdir via each call's own scratch path — see `scratchPath`. */
+    workDir?: string;
+}
+/**
+ * Build a real, deep-scan `SbomGenerator` backend. Every method shells out
+ * through `options.runner` (default: the real `ProcessRunner`); tests should
+ * always pass a `MockProcessRunner` instead.
+ */
+export declare function createToolSbomGenerator(options?: ToolSbomGeneratorOptions): SbomGenerator;
+/** Process-wide, real-tool-backed `SbomGenerator`, ready to inject wherever a project opts into the deep-scan path over ./lockfile-sbom-generator.ts's hermetic default. Never constructed by a test. */
+export declare const toolSbomGenerator: SbomGenerator;
+//# sourceMappingURL=tool-sbom-generator.d.ts.map

package/dist/components/verbs/tool-sbom-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-sbom-generator.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/tool-sbom-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,EASL,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAwC,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAW5F,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,uMAAuM;IACvM,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAsBD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,wBAA6B,GAAG,aAAa,CAiG7F;AAED,yMAAyM;AACzM,eAAO,MAAM,iBAAiB,EAAE,aAAyC,CAAC"}

package/dist/components/verbs/verify.d.ts

@@ -0,0 +1,106 @@
+/**
+ * `verify` capability — the deploy-time signature/provenance gate (#622,
+ * epic #551 follow-up to ./sign.ts's keyless signing + SLSA attestation).
+ * Mirrors `../../lint/policy.ts`'s `policyGate` shape: a step that runs
+ * `cosign verify` (+ `cosign verify-attestation` for provenance) against a
+ * configured identity policy and **throws** on any failure, so composing it
+ * before an apply phase fails the deploy the same way a thrown capability
+ * error already halts `driver.ts`'s step execution — no new failure
+ * mechanism, no gate-signal/human-approval semantics (that is `Gate`,
+ * ../component.ts, a different, durable-runtime-only concept). `verify` is a
+ * synchronous, local-executor-safe capability, exactly like `health-gate`
+ * (./wait-verify.ts).
+ *
+ * **Beginner-safe default policy.** The minimum an identity policy must
+ * declare is `expectedIssuer` + `expectedIdentity` (the OIDC issuer/identity
+ * that must have signed) — "signature present + from the expected identity."
+ * There is no "verify but accept any identity" mode: an identity-less verify
+ * would defeat the point of keyless signing (anyone's Rekor-logged signature
+ * would pass), so `IdentityPolicy` requires both fields, not an optional
+ * pair a beginner could forget to set.
+ *
+ * Routes `cosign verify`/`cosign verify-attestation` through the injectable
+ * `ProcessRunner` (./process-runner.ts), mirroring every other #610/#622
+ * real backend: `requireTool` throws `ToolNotAvailableError` if `cosign` is
+ * absent (a missing verifier is a hard stop, never a silent pass — the
+ * opposite failure mode from ./publish.ts's best-effort referrer attach,
+ * because skipping verification on a missing tool would silently let an
+ * unsigned/wrongly-signed artifact through the gate).
+ */
+import type { Capability } from "../capability.js";
+import { type ProcessRunner } from "./process-runner.js";
+/**
+ * The configured identity an artifact's signature/provenance must match —
+ * "beginner-safe default" per #622: signature present + from the expected
+ * identity, nothing more exotic required out of the box. Both fields are
+ * required (see this module's doc comment for why an identity-less verify
+ * is not offered).
+ */
+export interface IdentityPolicy {
+    /** Expected OIDC issuer, e.g. `"https://token.actions.githubusercontent.com"` for GitHub Actions keyless signing. Passed to `cosign verify --certificate-oidc-issuer`. */
+    expectedIssuer: string;
+    /**
+     * Expected signer identity. For keyless CI signing this is typically the
+     * workflow identity URI cosign embeds in the Fulcio cert (e.g.
+     * `"https://github.com/my-org/my-repo/.github/workflows/release.yml@refs/heads/main"`).
+     * Passed to `cosign verify --certificate-identity`. Supports the same
+     * `--certificate-identity-regexp` escape hatch via `identityIsRegexp`
+     * below, for teams whose identity varies by branch/tag and want one policy
+     * to match a pattern rather than enumerating every literal ref.
+     */
+    expectedIdentity: string;
+    /** Treat `expectedIdentity` as a regexp (`cosign verify --certificate-identity-regexp`) instead of a literal match. Default: false. */
+    identityIsRegexp?: boolean;
+    /** Optional key-based override — verify against a public key instead of the keyless identity policy, mirroring ./sign.ts's opt-in key-based override. Not the default. */
+    key?: string;
+}
+export interface VerifyInput {
+    /** Digest-qualified image reference to verify, e.g. `"@Publish.uri"`/`"@Sign.imageRef"`. */
+    imageRef: string;
+    /** The identity policy the signature must satisfy. */
+    policy: IdentityPolicy;
+    /** Also verify the SLSA provenance attestation (`cosign verify-attestation --type slsaprovenance1`) alongside the signature. Default: true — both #622 outputs are expected present once `sign`+`attest-provenance` have run. */
+    requireProvenance?: boolean;
+}
+export interface VerifyOutput {
+    /** True once every requested check (signature, and provenance if requested) passed. Always `true` when returned — a failure throws instead, so a caller never has to remember to check this field; it exists for symmetry with other capability outputs and for logging. */
+    verified: true;
+    /** Which checks actually ran and passed. */
+    checked: Array<"signature" | "provenance">;
+}
+/**
+ * Thrown when `cosign verify`/`cosign verify-attestation` rejects — wrong
+ * identity, missing signature, tampered artifact, or any other verification
+ * failure `cosign` itself reports. Distinct from `ToolNotAvailableError` so a
+ * caller (and a test) can tell "cosign said no" apart from "cosign isn't
+ * installed." Carries `reason` (cosign's own stderr/message) for whoever is
+ * debugging a failed gate.
+ */
+export declare class VerificationFailedError extends Error {
+    readonly imageRef: string;
+    readonly check: "signature" | "provenance";
+    readonly reason: string;
+    constructor(imageRef: string, check: "signature" | "provenance", reason: string);
+}
+/** Build the `cosign verify` argv (as a shell command string) for `input` — factored out so tests can assert on the exact invocation. */
+export declare function buildVerifySignatureArgs(input: VerifyInput): string;
+/** Build the `cosign verify-attestation` argv (as a shell command string) for `input`. */
+export declare function buildVerifyAttestationArgs(input: VerifyInput): string;
+/**
+ * Gate a deploy on `cosign verify` (signature) + `cosign verify-attestation`
+ * (SLSA provenance, unless `requireProvenance: false`) against `input.policy`
+ * — the digest-anchored counterpart to `../../lint/policy.ts`'s
+ * organizational-policy `policyGate`. Throws `VerificationFailedError` on any
+ * failed check, which halts the composition the same way any other thrown
+ * capability error does (see ../driver.ts) — no separate "gate" plumbing
+ * needed; a `verify` step composed before an `Apply` phase blocks that phase
+ * from ever running on verification failure.
+ *
+ * No rollback: verification is read-only observation of already-published
+ * evidence, nothing to compensate — same reasoning as `health-gate`/`wait-*`
+ * (./wait-verify.ts).
+ */
+export declare function createVerifyCapability(processRunner?: ProcessRunner): Capability<VerifyInput, VerifyOutput>;
+/** Default `verify` capability, backed by the real `ProcessRunner`. */
+export declare const verifyCapability: Capability<VerifyInput, VerifyOutput>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/components/verbs/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAwC,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI5F;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,0KAA0K;IAC1K,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,uIAAuI;IACvI,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0KAA0K;IAC1K,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAID,MAAM,WAAW,WAAW;IAC1B,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,cAAc,CAAC;IACvB,iOAAiO;IACjO,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,4QAA4Q;IAC5Q,QAAQ,EAAE,IAAI,CAAC;IACf,4CAA4C;IAC5C,OAAO,EAAE,KAAK,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,QAAQ,EAAE,MAAM;aAChB,KAAK,EAAE,WAAW,GAAG,YAAY;aACjC,MAAM,EAAE,MAAM;gBAFd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,GAAG,YAAY,EACjC,MAAM,EAAE,MAAM;CAKjC;AAYD,yIAAyI;AACzI,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAKnE;AAED,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAKrE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,GAAE,aAAsC,GACpD,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAmCvC;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,WAAW,EAAE,YAAY,CAA4B,CAAC"}

package/dist/components/verbs/vex.d.ts

@@ -0,0 +1,65 @@
+/**
+ * VEX (Vulnerability Exploitability eXchange) ingestion + suppression (#626).
+ * A scanner (./vuln-scan.ts) flags every known CVE in an SBOM, but most aren't
+ * actually exploitable in context (unreachable code path, already mitigated,
+ * false positive). VEX is where you (or upstream) assert, per CVE, whether it
+ * *actually* affects this artifact. Without it a gate is CVE fatigue — 500
+ * findings, 5 that matter. This module parses VEX and filters findings, and it
+ * **reports** every suppression with its justification — a VEX-suppressed
+ * finding is never silently dropped.
+ *
+ * Two formats: **OpenVEX** (the standalone Sigstore/OpenSSF format) and
+ * **CycloneDX**-embedded VEX (`vulnerabilities[].analysis`). Both reduce to the
+ * same `VexStatement` shape here.
+ */
+import type { VulnFinding } from "./vuln-scan.js";
+/** VEX status for a CVE against an artifact. `not_affected`/`fixed` suppress a finding; `affected`/`under_investigation` keep it (conservative — an unresolved status must not hide a real vuln). */
+export type VexStatus = "not_affected" | "affected" | "fixed" | "under_investigation";
+/** True for statuses that suppress a matching finding from gating. */
+export declare function suppresses(status: VexStatus): boolean;
+/** One VEX assertion: this CVE has this status for this artifact, with an optional human justification. */
+export interface VexStatement {
+    cveId: string;
+    status: VexStatus;
+    /** Why — e.g. `"vulnerable_code_not_in_execute_path"`, `"component_not_present"`. Surfaced on the suppression report so a reviewer sees the reasoning, never a bare "suppressed." */
+    justification?: string;
+}
+/** Parse an OpenVEX JSON document into statements. Unknown statuses / statements missing a vulnerability id are skipped. */
+export declare function parseOpenVex(bytes: string): VexStatement[];
+/** Parse CycloneDX-embedded VEX (`vulnerabilities[].analysis`) into statements. */
+export declare function parseCycloneDxVex(bytes: string): VexStatement[];
+/**
+ * Parse a VEX document of either format — dispatched on shape (`statements` ->
+ * OpenVEX, `vulnerabilities` -> CycloneDX). A malformed/unparseable document
+ * yields NO statements (returns `[]`) rather than throwing: it therefore
+ * suppresses nothing, keeping the gate strict (fail-closed) instead of
+ * crashing on attacker- or typo-supplied input.
+ */
+export declare function parseVexDocument(bytes: string): VexStatement[];
+/** A finding removed from gating by a VEX statement, kept for reporting (never silently dropped). */
+export interface SuppressedFinding {
+    finding: VulnFinding;
+    status: VexStatus;
+    justification?: string;
+}
+/** The result of filtering findings through VEX: what still gates, and what was suppressed (with reasons). */
+export interface VexResult {
+    /** Findings that survived VEX — the gate evaluates these. */
+    gating: VulnFinding[];
+    /** Findings suppressed by a `not_affected`/`fixed` statement, with the statement's justification. */
+    suppressed: SuppressedFinding[];
+}
+/**
+ * Filter `findings` through `statements`. A finding is suppressed only when
+ * some statement for its CVE suppresses it (`not_affected`/`fixed`) AND **no**
+ * statement for that CVE asserts it is `affected`/`under_investigation`.
+ *
+ * This is the conservative merge, deliberately NOT "last statement wins":
+ * when VEX comes from several sources (repo-local files + referrer-attached),
+ * a later `not_affected` must not be able to override an earlier `affected` to
+ * unblock a real vulnerability. Merging VEX can only ever make the gate
+ * *stricter*, never quietly weaker — so an attacker who can append a statement
+ * cannot suppress a finding another source flagged as affected.
+ */
+export declare function applyVex(findings: VulnFinding[], statements: VexStatement[]): VexResult;
+//# sourceMappingURL=vex.d.ts.map

package/dist/components/verbs/vex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/vex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qMAAqM;AACrM,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,qBAAqB,CAAC;AAEtF,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAErD;AAED,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB,qLAAqL;IACrL,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA8BD,4HAA4H;AAC5H,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE,CAU1D;AA6BD,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE,CAS/D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE,CAU9D;AAID,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8GAA8G;AAC9G,MAAM,WAAW,SAAS;IACxB,6DAA6D;IAC7D,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,qGAAqG;IACrG,UAAU,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,SAAS,CAoBvF"}

package/dist/components/verbs/vuln-gate.d.ts

@@ -0,0 +1,91 @@
+/**
+ * `vuln-gate` capability (#626) — the deploy-time gate that closes the
+ * supply-chain loop: scan the SBOM (./vuln-scan.ts) for known CVEs, suppress
+ * the ones VEX says don't matter (./vex.ts), check licenses (./license-policy.ts),
+ * and **throw** on a policy violation so composing it before an apply phase
+ * fails the deploy — the same throw-to-halt mechanism as ./verify.ts and
+ * `policyGate` (../../lint/policy.ts). No new gate plumbing.
+ *
+ * **Beginner-safe default policy:** fail on `severity >= critical AND fixable
+ * AND not VEX-suppressed`; findings at/above the warn severity (default
+ * `high`) that don't reach the fail bar are reported as warnings, not blocked;
+ * license findings are report-only unless `failOnLicense` is set. Everything
+ * is configurable via `chant.config.ts`'s `vulnPolicy` section (see
+ * ../../config.ts `resolveVulnPolicy`). The intent is that a first-timer who
+ * just adds a `vuln-gate` step gets a sensible, non-noisy gate that blocks the
+ * genuinely actionable (critical + fixable) and reports the rest.
+ */
+import type { Capability } from "../capability.js";
+import type { SbomDocument } from "./sbom-generator.js";
+import { type Severity, type VulnFinding, type VulnScanner } from "./vuln-scan.js";
+import { type SuppressedFinding } from "./vex.js";
+import { type LicensePolicy, type LicenseViolation } from "./license-policy.js";
+/** The gate's policy. Defaults (per `resolveVulnPolicy`, ../../config.ts) are beginner-safe: fail critical+fixable, warn high, license report-only. */
+export interface VulnPolicy {
+    /** Minimum severity that FAILS the gate. Default `"critical"`. */
+    failSeverity: Severity;
+    /** When true (default), only *fixable* findings at/above `failSeverity` fail the gate — an unfixable finding can't be actioned by upgrading, so it warns instead of blocking. */
+    fixableOnly: boolean;
+    /** Minimum severity reported as a warning (below `failSeverity`). Default `"high"`. */
+    warnSeverity: Severity;
+    /** License allow/deny policy. Evaluated always; only *blocks* when `failOnLicense` is true. */
+    license?: LicensePolicy;
+    /** Block the deploy on a license violation. Default `false` (report-only) — license posture is context-dependent. */
+    failOnLicense: boolean;
+    /** Block on an `unknown`-severity finding (a scanner that didn't report a severity chant could map). Default `false` — but such a finding is ALWAYS at least warned, never silently dropped, regardless of this flag. Set true for a strict shop that won't ship an unclassifiable finding. */
+    failOnUnknownSeverity: boolean;
+}
+/** Beginner-safe defaults, also encoded in `resolveVulnPolicy` (../../config.ts). */
+export declare const DEFAULT_VULN_POLICY: VulnPolicy;
+export interface VulnGateInput {
+    /** The artifact's SBOM. Scanned in-place unless `findings` is supplied. */
+    sbom: SbomDocument;
+    /** Pre-scanned findings (e.g. from a prior `scan-vulnerabilities` step). If omitted, the gate scans `sbom` itself via the injected scanner. */
+    findings?: VulnFinding[];
+    /** VEX documents (OpenVEX or CycloneDX-embedded), as serialized JSON, applied to suppress findings. */
+    vex?: string[];
+    /** Policy override; merged over `DEFAULT_VULN_POLICY`. */
+    policy?: Partial<VulnPolicy>;
+    /** Artifact digest, for reporting. */
+    digest?: string;
+}
+/** A finding that fails the gate, with why. */
+export interface BlockingFinding {
+    finding: VulnFinding;
+    reason: "severity-threshold" | "unknown-severity";
+}
+export interface VulnGateOutput {
+    /** Always `true` when returned — a violation throws instead (mirrors ./verify.ts's `verified`). */
+    passed: true;
+    /** Findings at/above `warnSeverity` that did not reach the fail bar. */
+    warnings: VulnFinding[];
+    /** Findings suppressed by VEX, with justification (never silently dropped). */
+    suppressed: SuppressedFinding[];
+    /** License findings — reported even when `failOnLicense` is false. */
+    licenseFindings: LicenseViolation[];
+}
+/**
+ * Thrown when the gate blocks a deploy — carries the blocking findings and any
+ * blocking license violations so a reviewer sees exactly what to fix (or VEX).
+ * Distinct from a scanner-not-installed error (`VulnScannerNotImplementedError`/
+ * `ToolNotAvailableError`) so a caller can tell "policy said no" from "no
+ * scanner."
+ */
+export declare class VulnGateFailedError extends Error {
+    readonly blocking: BlockingFinding[];
+    readonly blockingLicenses: LicenseViolation[];
+    constructor(blocking: BlockingFinding[], blockingLicenses: LicenseViolation[]);
+}
+/**
+ * Build the `vuln-gate` capability. Scans `sbom` (or uses supplied `findings`),
+ * applies VEX, evaluates the license policy, and classifies every gating
+ * finding: it BLOCKS (throws `VulnGateFailedError`) any finding at/above
+ * `failSeverity` that satisfies `fixableOnly`, plus license violations when
+ * `failOnLicense`; everything at/above `warnSeverity` below the fail bar is a
+ * warning. On a clean pass it returns the warnings/suppressed/license report
+ * for logging.
+ */
+export declare function createVulnGateCapability(scanner?: VulnScanner): Capability<VulnGateInput, VulnGateOutput>;
+/** Default `vuln-gate` capability (inject a real/mock scanner, or supply `findings`). */
+export declare const vulnGateCapability: Capability<VulnGateInput, VulnGateOutput>;
+//# sourceMappingURL=vuln-gate.d.ts.map

package/dist/components/verbs/vuln-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vuln-gate.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/vuln-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAA8B,KAAK,iBAAiB,EAAqB,MAAM,OAAO,CAAC;AAC9F,OAAO,EAAyB,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpG,uJAAuJ;AACvJ,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,YAAY,EAAE,QAAQ,CAAC;IACvB,iLAAiL;IACjL,WAAW,EAAE,OAAO,CAAC;IACrB,uFAAuF;IACvF,YAAY,EAAE,QAAQ,CAAC;IACvB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,qHAAqH;IACrH,aAAa,EAAE,OAAO,CAAC;IACvB,+RAA+R;IAC/R,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,EAAE,UAMjC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,IAAI,EAAE,YAAY,CAAC;IACnB,+IAA+I;IAC/I,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,uGAAuG;IACvG,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,oBAAoB,GAAG,kBAAkB,CAAC;CACnD;AAED,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,MAAM,EAAE,IAAI,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,+EAA+E;IAC/E,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,sEAAsE;IACtE,eAAe,EAAE,gBAAgB,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,QAAQ,EAAE,eAAe,EAAE;aAC3B,gBAAgB,EAAE,gBAAgB,EAAE;gBADpC,QAAQ,EAAE,eAAe,EAAE,EAC3B,gBAAgB,EAAE,gBAAgB,EAAE;CAUvD;AASD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,WAAkC,GAC1C,UAAU,CAAC,aAAa,EAAE,cAAc,CAAC,CAyC3C;AAED,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,aAAa,EAAE,cAAc,CAA8B,CAAC"}