@intentius/chant 0.57.0 → 0.59.0

package/dist/audit/prior-art.d.ts

@@ -0,0 +1,385 @@
+/**
+ * Prior art for chant's audit rules.
+ *
+ * Most of what `chant audit` checks has been checked before by a dedicated
+ * open-source tool: zizmor and poutine for GitHub Actions, hadolint for
+ * Dockerfiles, cfn-lint and cfn_nag for CloudFormation, kube-linter and
+ * kube-score for Kubernetes manifests, gitleaks for secrets, and so on. chant's
+ * rules were written independently against the emitted output, but the ideas
+ * are shared, and the people who wrote them down first deserve the credit.
+ *
+ * A rule declares its lineage as `Lineage[]` on its `RuleMeta` entry: which
+ * tool, which upstream rule, where it is documented, and how the two relate.
+ * `PRIOR_ART` is the registry those entries key into, so a tool is named,
+ * linked and licensed once. The audit rules reference renders both, the
+ * markdown and HTML reports credit the tool beside the finding, and the SARIF
+ * and JSON outputs carry the entries verbatim for consumers.
+ *
+ * Lineage is credit, not authority. `authority` (./catalog.ts) is a standard
+ * or vendor document that says a finding matters; lineage is a tool that
+ * checks the same condition. The two are independent: a rule may have either,
+ * both, or neither, and lineage never changes a rule's category or tier.
+ */
+/** How a chant rule relates to the upstream check it credits. */
+export type LineageRelation = 
+/** Same condition, same scope. */
+"equivalent"
+/** The core condition is shared; one side is narrower or broader, or a different dialect of the same control. */
+ | "overlaps"
+/** chant checks a strict superset of the upstream check. */
+ | "extends";
+/** One credit: an upstream tool's rule that checks what this chant rule checks. */
+export interface Lineage {
+    /** A key of {@link PRIOR_ART}. */
+    tool: PriorArtTool;
+    /** The upstream rule id or check name, in the tool's own vocabulary (e.g. `template-injection`, `DL3007`, `CKV_AWS_18`). Omitted when the tool has no per-rule ids. */
+    rule?: string;
+    /** Where the upstream rule is documented. */
+    url: string;
+    relation: LineageRelation;
+}
+/** A tool (or, for a few families, a vendor validator) that chant's rules credit. */
+export interface PriorArtEntry {
+    name: string;
+    url: string;
+    /** SPDX identifier where confirmed, else "unverified" or "n/a" for documentation. */
+    license: string;
+    /** What kind of thing this is, so the rendered credit is honest about it. */
+    kind: "scanner" | "vendor-validator" | "specification";
+}
+/**
+ * The registry of prior art. Keys are the slugs `Lineage.tool` uses. Populated
+ * from the per-family research recorded in the PR that introduced lineage; the
+ * prior-art sweep (scripts/prior-art-sweep.ts) reads the same table.
+ */
+export declare const PRIOR_ART: {
+    readonly checkov: {
+        readonly name: "Checkov";
+        readonly url: "https://www.checkov.io/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly kics: {
+        readonly name: "KICS";
+        readonly url: "https://docs.kics.io/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly zizmor: {
+        readonly name: "zizmor";
+        readonly url: "https://docs.zizmor.sh/";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "cfn-nag": {
+        readonly name: "cfn_nag";
+        readonly url: "https://github.com/stelligent/cfn_nag";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "gitlab-docs": {
+        readonly name: "GitLab CI/CD YAML reference";
+        readonly url: "https://docs.gitlab.com/ci/yaml/";
+        readonly license: "CC-BY-SA-4.0";
+        readonly kind: "specification";
+    };
+    readonly "guard-rules-registry": {
+        readonly name: "AWS Guard Rules Registry";
+        readonly url: "https://github.com/aws-cloudformation/aws-guard-rules-registry";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly polaris: {
+        readonly name: "Fairwinds Polaris";
+        readonly url: "https://polaris.docs.fairwinds.com/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "kube-linter": {
+        readonly name: "KubeLinter";
+        readonly url: "https://github.com/stackrox/kube-linter";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "kube-score": {
+        readonly name: "kube-score";
+        readonly url: "https://github.com/zegl/kube-score";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "psrule-azure": {
+        readonly name: "PSRule for Azure";
+        readonly url: "https://azure.github.io/PSRule.Rules.Azure/";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "gcp-policy-library": {
+        readonly name: "Google Cloud Policy Library";
+        readonly url: "https://github.com/GoogleCloudPlatform/policy-library";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly poutine: {
+        readonly name: "poutine";
+        readonly url: "https://boostsecurityio.github.io/poutine/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly scorecard: {
+        readonly name: "OpenSSF Scorecard";
+        readonly url: "https://github.com/ossf/scorecard";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "cfn-lint": {
+        readonly name: "cfn-lint";
+        readonly url: "https://github.com/aws-cloudformation/cfn-lint";
+        readonly license: "MIT-0";
+        readonly kind: "scanner";
+    };
+    readonly "controlplane-docs": {
+        readonly name: "Control Plane reference documentation";
+        readonly url: "https://docs.controlplane.com";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly gitleaks: {
+        readonly name: "gitleaks";
+        readonly url: "https://github.com/gitleaks/gitleaks";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly octoscan: {
+        readonly name: "octoscan";
+        readonly url: "https://github.com/synacktiv/octoscan";
+        readonly license: "GPL-3.0";
+        readonly kind: "scanner";
+    };
+    readonly "detect-secrets": {
+        readonly name: "detect-secrets";
+        readonly url: "https://github.com/Yelp/detect-secrets";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly actionlint: {
+        readonly name: "actionlint";
+        readonly url: "https://github.com/rhysd/actionlint";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly trufflehog: {
+        readonly name: "TruffleHog";
+        readonly url: "https://github.com/trufflesecurity/trufflehog";
+        readonly license: "AGPL-3.0";
+        readonly kind: "scanner";
+    };
+    readonly "gixy-ng": {
+        readonly name: "gixy-ng (maintained Gixy fork)";
+        readonly url: "https://github.com/dvershinin/gixy";
+        readonly license: "MPL-2.0";
+        readonly kind: "scanner";
+    };
+    readonly kubesec: {
+        readonly name: "kubesec";
+        readonly url: "https://kubesec.io/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly datree: {
+        readonly name: "Datree";
+        readonly url: "https://hub.datree.io/built-in-rules";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "helm-lint": {
+        readonly name: "helm lint";
+        readonly url: "https://helm.sh/docs/helm/helm_lint/";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly "cedar-validator": {
+        readonly name: "Cedar policy validator";
+        readonly url: "https://docs.cedarpolicy.com/policies/validation.html";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly "flux-docs": {
+        readonly name: "Flux Kustomization API reference";
+        readonly url: "https://fluxcd.io/flux/components/kustomize/kustomizations/";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly hadolint: {
+        readonly name: "hadolint";
+        readonly url: "https://github.com/hadolint/hadolint";
+        readonly license: "GPL-3.0";
+        readonly kind: "scanner";
+    };
+    readonly "agent-audit": {
+        readonly name: "agent-audit";
+        readonly url: "https://github.com/piiiico/agent-audit";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "arm-ttk": {
+        readonly name: "ARM Template Toolkit (arm-ttk)";
+        readonly url: "https://github.com/Azure/arm-ttk";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "bicep-linter": {
+        readonly name: "Bicep linter";
+        readonly url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "cedar-cli": {
+        readonly name: "Cedar CLI";
+        readonly url: "https://github.com/cedar-policy/cedar/tree/main/cedar-policy-cli";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly dockle: {
+        readonly name: "Dockle";
+        readonly url: "https://github.com/goodwithtech/dockle";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "mcp-audit": {
+        readonly name: "mcp-audit (APIsec)";
+        readonly url: "https://github.com/apisec-inc/mcp-audit";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "render-docs": {
+        readonly name: "Render Blueprint YAML reference";
+        readonly url: "https://render.com/docs/blueprint-spec";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "agent-scan": {
+        readonly name: "Snyk Agent Scan (formerly mcp-scan)";
+        readonly url: "https://github.com/invariantlabs-ai/mcp-scan";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "cedar-docs": {
+        readonly name: "Cedar policy language reference";
+        readonly url: "https://docs.cedarpolicy.com/policies/json-format.html";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "cedar-policy-crate": {
+        readonly name: "cedar-policy crate (PolicySet loader)";
+        readonly url: "https://docs.rs/cedar-policy/latest/cedar_policy/";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly "chart-testing": {
+        readonly name: "chart-testing (ct)";
+        readonly url: "https://github.com/helm/chart-testing";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly "fly-docs": {
+        readonly name: "Fly Machines API reference";
+        readonly url: "https://fly.io/docs/machines/api/machines-resource/";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly gixy: {
+        readonly name: "Gixy";
+        readonly url: "https://github.com/yandex/gixy";
+        readonly license: "MPL-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "kube-bench": {
+        readonly name: "kube-bench";
+        readonly url: "https://github.com/aquasecurity/kube-bench";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly pluto: {
+        readonly name: "Pluto";
+        readonly url: "https://github.com/FairwindsOps/pluto";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly choudoufu: {
+        readonly name: "choudoufu";
+        readonly url: "https://github.com/INTENTIUS/choudoufu";
+        readonly license: "MPL-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "tflint-ruleset-terraform": {
+        readonly name: "tflint-ruleset-terraform";
+        readonly url: "https://github.com/terraform-linters/tflint-ruleset-terraform";
+        readonly license: "MPL-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "terraform-sentinel-policies": {
+        readonly name: "HashiCorp reference Sentinel policies";
+        readonly url: "https://github.com/hashicorp/terraform-sentinel-policies";
+        readonly license: "MPL-2.0";
+        readonly kind: "specification";
+    };
+    readonly "hashicorp-style-guide": {
+        readonly name: "HashiCorp Terraform style guide";
+        readonly url: "https://developer.hashicorp.com/terraform/language/style";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "aws-terraform-prescriptive-guidance": {
+        readonly name: "AWS prescriptive guidance for Terraform";
+        readonly url: "https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "gcp-terraform-best-practices": {
+        readonly name: "Google Cloud Terraform best-practices series";
+        readonly url: "https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "tflint-ruleset-redeploy": {
+        readonly name: "tflint-ruleset-redeploy";
+        readonly url: "https://github.com/RedeployAB/tflint-ruleset-redeploy";
+        readonly license: "0BSD";
+        readonly kind: "scanner";
+    };
+    readonly "tflint-ruleset-avm": {
+        readonly name: "tflint-ruleset-avm (Azure Verified Modules)";
+        readonly url: "https://github.com/Azure/tflint-ruleset-avm";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly tfsec: {
+        readonly name: "tfsec";
+        readonly url: "https://github.com/aquasecurity/tfsec";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly semgrep: {
+        readonly name: "Semgrep Registry rules";
+        readonly url: "https://github.com/semgrep/semgrep-rules";
+        readonly license: "Semgrep Rules License v1.0 (proprietary, not an SPDX id)";
+        readonly kind: "scanner";
+    };
+};
+export type PriorArtTool = keyof typeof PRIOR_ART;
+/**
+ * Attach lineage to a catalog in place. A lexicon keeps its lineage in a
+ * sibling `audit-lineage.ts` (one `Record<ruleId, Lineage[]>`) and calls this
+ * once at the bottom of its `audit-catalog.ts`, so the prose metadata and the
+ * credits stay next to each other but the credits can be regenerated by the
+ * prior-art sweep without touching the rule text. Throws at module load if the
+ * lineage names a rule the catalog does not have: a stale id is a bug, not a
+ * silent no-op.
+ */
+export declare function applyLineage<T extends {
+    id: string;
+    lineage?: Lineage[];
+}>(catalog: Record<string, T>, lineage: Record<string, Lineage[]>): void;
+/** Render one lineage entry as "tool rule (relation)" for prose contexts. */
+export declare function lineageLabel(l: Lineage): string;
+//# sourceMappingURL=prior-art.d.ts.map

package/dist/audit/prior-art.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prior-art.d.ts","sourceRoot":"","sources":["../../src/audit/prior-art.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,MAAM,MAAM,eAAe;AACzB,kCAAkC;AAChC,YAAY;AACd,iHAAiH;GAC/G,UAAU;AACZ,4DAA4D;GAC1D,SAAS,CAAC;AAEd,mFAAmF;AACnF,MAAM,WAAW,OAAO;IACtB,kCAAkC;IAClC,IAAI,EAAE,YAAY,CAAC;IACnB,uKAAuK;IACvK,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,IAAI,EAAE,SAAS,GAAG,kBAAkB,GAAG,eAAe,CAAC;CACxD;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkE4B,CAAC;AAEnD,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAElD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,EACxE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,GACjC,IAAI,CAMN;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAG/C"}

package/dist/audit/proof.d.ts

@@ -46,6 +46,22 @@ export declare function extractUnpinnedActions(content: string): Array<{
 }>;
 /** Extract unpinned `image:` references (deduped) from CI YAML. */
 export declare function extractUnpinnedImages(content: string): string[];
+/** One `name = "${expr}"` line, split into the parts the fix reassembles. */
+export interface InterpolationOnlyLine {
+    /** The attribute's name. */
+    name: string;
+    /** The expression inside the interpolation, without the `${` and `}`. */
+    expr: string;
+    /** The same line with the quotes and the `${}` taken off. */
+    unwrapped: string;
+}
+/**
+ * Parse a line whose whole value is one interpolation. Exported because a rule
+ * and its fix have to agree on what counts: the terraform lexicon's TF016
+ * check calls this over a block's source text, and `unwrapInterpolations`
+ * below rewrites exactly the lines it accepts.
+ */
+export declare function interpolationOnlyLine(line: string): InterpolationOnlyLine | undefined;
 /**
  * Produce a deterministic fix + diff for a finding, if one is mechanical.
  * Returns `applied: false` with guidance for non-deterministic findings.

package/dist/audit/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../src/audit/proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,2EAA2E;IAC3E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,4HAA4H;IAC5H,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;CACzD;AAUD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAc9F;AA4BD,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAY/D;AAwCD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,WAAW,CA4C/F;AAqCD,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,MAAM,CAwD/E"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../src/audit/proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,2EAA2E;IAC3E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,4HAA4H;IAC5H,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;CACzD;AAUD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAc9F;AA4BD,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAY/D;AAkED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CASrF;AAaD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,WAAW,CAkD/F;AAqCD,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,MAAM,CAwD/E"}

package/dist/audit/report-html.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report-html.d.ts","sourceRoot":"","sources":["../../src/audit/report-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,EAAqC,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAoF,MAAM,gBAAgB,CAAC;AAEjM,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAmJD,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAoCzF"}
+{"version":3,"file":"report-html.d.ts","sourceRoot":"","sources":["../../src/audit/report-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,EAAqC,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAoF,MAAM,gBAAgB,CAAC;AAEjM,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAwJD,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAoCzF"}

package/dist/audit/report-model.d.ts

@@ -6,7 +6,7 @@
  */
 import type { AuditFinding } from "./core.js";
 import type { UnclaimedFile } from "./discover.js";
-import { type Authority, type Category, type FixKind, type RuleMeta, type Tier } from "./catalog.js";
+import { type Authority, type Category, type FixKind, type Lineage, type RuleMeta, type Tier } from "./catalog.js";
 import { type ProveOptions } from "./proof.js";
 import type { Severity } from "../lint/rule.js";
 /**
@@ -84,6 +84,11 @@ export interface SerializedFinding {
     line?: number;
     /** Redaction-safe fingerprint of a flagged value, when applicable (see `secrets.ts`). */
     fingerprint?: string;
+    /** Set when the finding is an absence rather than a defect — see `PostSynthDiagnostic.missing` (chant #2113). */
+    missing?: {
+        kind: string;
+        scope: string;
+    };
     lexicon: string;
     tier: Tier;
     fixKind: FixKind;
@@ -92,6 +97,8 @@ export interface SerializedFinding {
     title: string;
     remediation: string;
     authority: Authority[];
+    /** Prior art: upstream tools whose rules check the same condition (credit, not authority). */
+    lineage: Lineage[];
     /** Link to this rule's entry in the audit rules reference. */
     docUrl: string;
 }

package/dist/audit/report-model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report-model.d.ts","sourceRoot":"","sources":["../../src/audit/report-model.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAA4B,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5H,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C;;;;;GAKG;AAGH,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAqC,CAAC;AAO3F,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,mFAAmF;IACnF,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,4GAA4G;IAC5G,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC;;;;OAIG;IACH,MAAM,EAAE,IAAI,GAAG,aAAa,CAAC;IAC7B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,oFAAoF;IACpF,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAgB,GAAG,QAAQ,CAW9F;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,MAAM,CAK3E;AAsFD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,UAAU,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IAC9C,iIAAiI;IACjI,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACpC;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,iBAAsB,GAAG,WAAW,CAyCpG;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EAAE,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAA;CAAO,GAC7H,eAAe,CA4BjB"}
+{"version":3,"file":"report-model.d.ts","sourceRoot":"","sources":["../../src/audit/report-model.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAA4B,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1I,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C;;;;;GAKG;AAGH,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAqC,CAAC;AAO3F,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,mFAAmF;IACnF,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,4GAA4G;IAC5G,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iHAAiH;IACjH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,8FAA8F;IAC9F,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC;;;;OAIG;IACH,MAAM,EAAE,IAAI,GAAG,aAAa,CAAC;IAC7B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,oFAAoF;IACpF,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAgB,GAAG,QAAQ,CAW9F;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,MAAM,CAK3E;AAsFD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,UAAU,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IAC9C,iIAAiI;IACjI,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACpC;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,iBAAsB,GAAG,WAAW,CAiDpG;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EAAE,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAA;CAAO,GAC7H,eAAe,CA8BjB"}

package/dist/audit/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/audit/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAc5C,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,iEAAiE;IACjE,UAAU,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACxC,8EAA8E;IAC9E,aAAa,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sHAAsH;IACtH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACtB;AAoDD,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAqCzF"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/audit/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,EAA4B,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB5C,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,iEAAiE;IACjE,UAAU,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACxC,8EAA8E;IAC9E,aAAa,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sHAAsH;IACtH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACtB;AAoDD,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAqCzF"}

package/dist/audit/rules-doc.d.ts

@@ -6,6 +6,9 @@
  * Each rule gets an `### <ID>` heading, which Starlight slugifies to `#<id>`
  * (lowercased) — the anchor `ruleDocUrl()` links to.
  */
+import { type RuleMeta } from "./catalog.js";
+/** Exported for `rules-doc.test.ts` to exercise the alias/deprecated rendering directly against a synthetic `RuleMeta`, without needing a real catalog entry to carry either (chant #2113). */
+export declare function ruleBlock(m: RuleMeta): string;
 /**
  * Render the full audit rules reference page (frontmatter + body). Aggregates
  * the catalog across every audit lexicon (#687) — each provider's rule metadata

package/dist/audit/rules-doc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules-doc.d.ts","sourceRoot":"","sources":["../../src/audit/rules-doc.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA4CH;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAqB5D"}
+{"version":3,"file":"rules-doc.d.ts","sourceRoot":"","sources":["../../src/audit/rules-doc.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAoE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAqE5G,+LAA+L;AAC/L,wBAAgB,SAAS,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAY7C;AAiCD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAqB5D"}

package/dist/audit/secrets.d.ts

@@ -75,6 +75,21 @@ export declare function fingerprintSecret(value: string): string;
  * throwing.
  */
 export declare function parseSecretsConfig(content: string): SecretsScanOptions;
+/**
+ * Shannon entropy in bits per character. Exported so a lexicon's own
+ * secret-shape heuristic can score a candidate on the same scale this
+ * module's SEC010 catch-all uses (the terraform lexicon's
+ * `lint/secret-shape.ts`, #2110) instead of inventing a second one.
+ */
+export declare function shannonEntropy(s: string): number;
+/**
+ * Cheap, format-agnostic "this doesn't look like a real secret" filter.
+ * Exported for the same reason {@link shannonEntropy} is: the placeholder
+ * vocabulary a scanner has to ignore (`changeme`, `example`, `your-api-key`,
+ * a run of one repeated character) is the same wherever the candidate came
+ * from, and a second copy of this list would drift from this one.
+ */
+export declare function looksLikePlaceholder(value: string): boolean;
 /** The high-entropy catch-all's rule id (kept distinct so callers can special-case it). */
 export declare const ENTROPY_RULE_ID = "SEC010";
 /**

package/dist/audit/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/audit/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD;AAkDD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAuBtE;AA2GD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,WAAW,CAAC;AAIxC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAqED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,YAAY,EAAE,CAmEpG"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/audit/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD;AAkDD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAuBtE;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAShD;AAMD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK3D;AAkFD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,WAAW,CAAC;AAIxC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAqED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,YAAY,EAAE,CAmEpG"}

package/dist/audit/terraform-state.d.ts

@@ -0,0 +1,46 @@
+/**
+ * TF023 (#2110): Terraform state, or the `.terraform/` working directory,
+ * committed to the repository.
+ *
+ * Every other rule in the TF family is a post-synth check over a parsed root
+ * module, contributed by the terraform lexicon. This one is not about HCL at
+ * all: the finding is that a path exists in version control, so there is
+ * nothing for `chant build` to check and nothing for the lexicon's parser to
+ * read. It therefore takes the shape `secrets.ts` established and `wrangler.ts`
+ * and `nginx.ts` copied, a path detector plus a check over the discovered file
+ * list, called from the audit CLI beside `scanForSecrets`, with its catalog
+ * entry in core's own `RULE_CATALOG` (./catalog.ts) rather than a lexicon's.
+ * It runs whether or not the terraform lexicon is installed.
+ *
+ * A state file is a committed secret store: it records every attribute of every
+ * managed resource, including the ones providers mark sensitive, in plaintext
+ * JSON. `.terraform/` is milder (providers and vendored modules) but is still
+ * hundreds of megabytes of machine-generated content, and it can hold a
+ * `terraform.tfstate` of its own for the workspace-local backend.
+ *
+ * Pure: no fs, no network, no Node-only global, so it is Workers-safe (epic #350). The
+ * walk that decides which paths reach here is `discover.ts`'s
+ * `collectCandidates`, which is also where a locally ignored path is dropped:
+ * see `isTerraformStatePath` there and `gitignoreCoversTerraformState` below.
+ */
+import type { AuditFinding } from "./core.js";
+/** The minimal file shape the check needs (matches `discover.ts`'s `RepoFile`). */
+export interface ScannableFile {
+    path: string;
+    content: string;
+}
+/** `terraform.tfstate`, `terraform.tfstate.backup`, and any other `*.tfstate`. */
+export declare function isTerraformStateFile(path: string): boolean;
+/** The `.terraform` working directory itself, or anything inside it. */
+export declare function isTerraformWorkDir(path: string): boolean;
+/** Either of the two shapes TF023 reports. */
+export declare function isTerraformStatePath(path: string): boolean;
+export declare function gitignoreCoversTerraformState(gitignore: string, path: string): boolean;
+/**
+ * Report TF023 for every committed state file and `.terraform/` directory in
+ * the file list. One finding per path, and one for the `.terraform` directory
+ * as a whole rather than per file inside it: a vendored provider binary is not
+ * a separate finding from the directory that holds it.
+ */
+export declare function auditTerraformState(files: ScannableFile[]): AuditFinding[];
+//# sourceMappingURL=terraform-state.d.ts.map

package/dist/audit/terraform-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-state.d.ts","sourceRoot":"","sources":["../../src/audit/terraform-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED,8CAA8C;AAC9C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAoBD,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CActF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE,CAuC1E"}

package/dist/build.d.ts

@@ -3,7 +3,8 @@ import type { Serializer, SerializerResult } from "./serializer.js";
 import type { OwnershipMarker } from "./ownership.js";
 import type { BuildError } from "./errors.js";
 import type { IntrinsicDef, BuildRootContributor } from "./lexicon.js";
-import type { BuildParamProvenance } from "./provenance.js";
+import { type BuildParamProvenance } from "./provenance.js";
+import { type FoldProvenance } from "./fold-provenance.js";
 import { DiscoveryError } from "./errors.js";
 import { LexiconOutput } from "./lexicon-output.js";
 import { type FoldDecision } from "./discovery/index.js";
@@ -179,6 +180,21 @@ export interface BuildResult {
      * supplies none.
      */
     buildParams: BuildParamProvenance[];
+    /**
+     * chant #2161 — emitted property path to origin, per entity: which composite
+     * parameter produced the field, which literal the composite fixes, which the
+     * author declared directly, and which this build could not attribute.
+     *
+     * Beside the output on purpose, and never inside it. Nothing here is passed
+     * to a serializer, so it cannot reach the document an applier writes; see
+     * ./fold-provenance.ts's module doc and `fold-provenance-exclusion.test.ts`.
+     *
+     * Every entity with properties appears. The origins are as fine as the build
+     * managed: a run build, or a fold build over a factory outside the
+     * interpretable subset, records `unknown` for a composite's fields rather
+     * than guessing.
+     */
+    foldProvenance: FoldProvenance;
 }
 /**
  * Partitions entities by their lexicon field.

package/dist/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAyB,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,cAAc,EAAiC,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,aAAa,EAAmB,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAKvF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CACb,MAAM,EACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CACtD,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,MAAM,EAAE,GACrB,UAAU,CAgFZ;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,qDAAqD;IACrD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,CAAC;IAC3C,wDAAwD;IACxD,QAAQ,EAAE,aAAa,CAAC;IACxB,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAE9B;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAsBtC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CAuEjB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CA+FjB;AA6ED;8DAC8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,GAChD,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,UAAU,EAAE,EACzB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAWtB;AAwMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,EAC5B,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,SAAsB,EAC3B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAgBtB"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAyB,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAiC,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,aAAa,EAAmB,MAAM,kBAAkB,CAAC;AAQlE,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAKvF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CACb,MAAM,EACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CACtD,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,MAAM,EAAE,GACrB,UAAU,CAgFZ;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,qDAAqD;IACrD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,CAAC;IAC3C,wDAAwD;IACxD,QAAQ,EAAE,aAAa,CAAC;IACxB,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAE9B;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CA6BtC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CAuEjB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CA+FjB;AA6ED;8DAC8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,GAChD,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,UAAU,EAAE,EACzB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAWtB;AA6MD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,EAC5B,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,SAAsB,EAC3B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAgBtB"}