@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security/api.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=api.test.d.ts.map

package/dist/security/api.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.test.d.ts","sourceRoot":"","sources":["../../src/security/api.test.ts"],"names":[],"mappings":""}

package/dist/security/api.test.js

@@ -0,0 +1,220 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = __importDefault(require("node:test"));
+const api_js_1 = require("./api.js");
+const APP_ID = '11111111-1111-4111-8111-111111111111';
+const RUN_ID = '22222222-2222-4222-8222-222222222222';
+const TOKEN = 'synthetic_security_token_123456789012345';
+const connection = {
+    apiUrl: 'https://latticeai.app',
+    appId: APP_ID,
+    token: TOKEN,
+    connectedAt: '2026-10-20T00:00:00.000Z',
+};
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+}
+function statusBody() {
+    return {
+        app: {
+            id: APP_ID, name: 'Fixture', repositoryIdentity: 'github.com/example/fixture', origin: null,
+            repositoryLockedAt: null, createdAt: '2026-10-20T00:00:00.000Z',
+        },
+        entitledModes: ['scan'],
+        entitlements: [],
+        checkoutEnabled: false,
+        publicationEnabled: false,
+        releaseBlockers: ['commercial_artifact_unavailable'],
+    };
+}
+function fullStatusBody() {
+    return {
+        ...statusBody(),
+        entitledModes: ['scan', 'deep'],
+        entitlements: [{
+                id: '22222222-2222-4222-8222-222222222222',
+                kind: 'security_subscription',
+                providerStatus: 'active',
+                artifactStatus: 'rights_cleared',
+                unitLimit: 50,
+                consumedUnits: 1,
+                reservedUnits: 0,
+                remainingUnits: 49,
+                periodStart: '2026-10-01T00:00:00.000Z',
+                periodEnd: '2026-11-01T00:00:00.000Z',
+                cancelAtPeriodEnd: false,
+                requiredRuntime: {
+                    vsgVersion: '1.0.2',
+                    profileId: 'lattice-candidate-blocked',
+                    profileVersion: '1.0.0',
+                    rulesDigest: '1'.repeat(64),
+                    registryDigest: '2'.repeat(64),
+                    commercialManifestDigest: '3'.repeat(64),
+                    evaluatorDigest: '4'.repeat(64),
+                    catalogDigest: '5'.repeat(64),
+                },
+            }],
+    };
+}
+(0, node_test_1.default)('status sends the token only in the Authorization header and rejects redirects', async () => {
+    const calls = [];
+    const fetcher = async (input, init) => {
+        calls.push({
+            url: String(input),
+            authorization: new Headers(init?.headers).get('authorization'),
+            redirect: init?.redirect,
+        });
+        return json(statusBody());
+    };
+    await (0, api_js_1.getSecurityStatus)(connection, { fetcher: fetcher });
+    strict_1.default.deepEqual(calls, [{
+            url: `https://latticeai.app/api/security/apps/${APP_ID}/status`,
+            authorization: `Bearer ${TOKEN}`,
+            redirect: 'error',
+        }]);
+    strict_1.default.ok(!calls[0].url.includes(TOKEN));
+});
+(0, node_test_1.default)('accepts the exact frozen status DTO including required runtime identity', async () => {
+    const expected = fullStatusBody();
+    const fetcher = async () => json(expected);
+    strict_1.default.deepEqual(await (0, api_js_1.getSecurityStatus)(connection, { fetcher: fetcher }), expected);
+});
+(0, node_test_1.default)('server error text cannot reflect the bearer token', async () => {
+    const fetcher = async () => json({ error: { code: 'unauthorized', message: `bad ${TOKEN}`, retryable: false } }, 401);
+    await strict_1.default.rejects((0, api_js_1.getSecurityStatus)(connection, { fetcher: fetcher }), (error) => error instanceof api_js_1.SecurityApiRequestError
+        && error.status === 401
+        && !error.message.includes(TOKEN)
+        && error.message.includes('[REDACTED]'));
+});
+(0, node_test_1.default)('finish retries identical bytes at most twice for network and 5xx failures', async () => {
+    const bodies = [];
+    let calls = 0;
+    const fetcher = async (_input, init) => {
+        calls += 1;
+        bodies.push(String(init?.body));
+        if (calls === 1)
+            throw new Error('synthetic network failure');
+        if (calls === 2)
+            return json({ error: { code: 'report_rejected', message: 'temporary', retryable: true } }, 503);
+        return json({
+            result: 'finished', runId: RUN_ID, state: 'finished', verdict: 'PASS',
+            completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: true,
+        });
+    };
+    const body = '{"outcome":"completed","report":{"transportVersion":"3.0"}}';
+    const response = await (0, api_js_1.finishSecurityRun)(connection, RUN_ID, body, { fetcher: fetcher });
+    strict_1.default.equal(response.result, 'finished');
+    strict_1.default.equal(calls, 3);
+    strict_1.default.deepEqual(bodies, [body, body, body]);
+});
+(0, node_test_1.default)('finish does not retry a 4xx response', async () => {
+    let calls = 0;
+    const fetcher = async () => {
+        calls += 1;
+        return json({ error: { code: 'idempotency_conflict', message: 'conflict', retryable: false } }, 409);
+    };
+    await strict_1.default.rejects((0, api_js_1.finishSecurityRun)(connection, RUN_ID, '{}', { fetcher: fetcher }), (error) => error instanceof api_js_1.SecurityApiRequestError && error.status === 409);
+    strict_1.default.equal(calls, 1);
+});
+(0, node_test_1.default)('rejects inconsistent successful finish result and terminal state pairs', async () => {
+    const invalid = [
+        { result: 'finished', state: 'reserved', verdict: 'PASS', consumedUnit: true },
+        { result: 'aborted', state: 'finished', verdict: null, consumedUnit: false },
+        { result: 'replay', state: 'aborted', verdict: 'BLOCKED', consumedUnit: false },
+        { result: 'aborted', state: 'aborted', verdict: null, consumedUnit: true },
+    ];
+    for (const fields of invalid) {
+        const fetcher = async () => json({
+            ...fields,
+            runId: RUN_ID,
+            completedAt: '2026-10-20T00:00:00.000Z',
+            contentExpiresAt: null,
+        });
+        await strict_1.default.rejects((0, api_js_1.finishSecurityRun)(connection, RUN_ID, '{}', { fetcher: fetcher }), (error) => error instanceof api_js_1.SecurityApiRequestError && error.code === 'invalid_response');
+    }
+});
+(0, node_test_1.default)('rejects an oversized declared response, cancels it, and never reads its stream', async () => {
+    let opened = false;
+    let cancelled = false;
+    const fetcher = async () => ({
+        status: 200,
+        ok: true,
+        headers: new Headers({ 'Content-Type': 'application/json', 'Content-Length': '262145' }),
+        body: {
+            cancel: async () => { cancelled = true; },
+            getReader: () => { opened = true; throw new Error('must not open'); },
+        },
+    });
+    await strict_1.default.rejects((0, api_js_1.getSecurityStatus)(connection, { fetcher: fetcher }), /exceeded the allowed size/);
+    strict_1.default.equal(opened, false);
+    strict_1.default.equal(cancelled, true);
+});
+(0, node_test_1.default)('rejects and cancels non-JSON responses before reading any bytes', async () => {
+    let opened = false;
+    let cancelled = false;
+    const fetcher = async () => ({
+        status: 200,
+        ok: true,
+        headers: new Headers({ 'Content-Type': 'text/plain' }),
+        body: {
+            cancel: async () => { cancelled = true; },
+            getReader: () => { opened = true; throw new Error('must not open'); },
+        },
+    });
+    await strict_1.default.rejects((0, api_js_1.getSecurityStatus)(connection, { fetcher: fetcher }), /non-JSON response/);
+    strict_1.default.equal(opened, false);
+    strict_1.default.equal(cancelled, true);
+});
+(0, node_test_1.default)('rejects and cancels an invalid declared length before reading any bytes', async () => {
+    let opened = false;
+    let cancelled = false;
+    const fetcher = async () => ({
+        status: 200,
+        ok: true,
+        headers: new Headers({ 'Content-Type': 'application/json', 'Content-Length': 'not-a-number' }),
+        body: {
+            cancel: async () => { cancelled = true; },
+            getReader: () => { opened = true; throw new Error('must not open'); },
+        },
+    });
+    await strict_1.default.rejects((0, api_js_1.getSecurityStatus)(connection, { fetcher: fetcher }), /invalid Content-Length/);
+    strict_1.default.equal(opened, false);
+    strict_1.default.equal(cancelled, true);
+});
+(0, node_test_1.default)('rejects unknown status fields without reflecting sensitive values', async () => {
+    const secret = 'synthetic_nested_billing_secret';
+    const full = fullStatusBody();
+    for (const body of [
+        { ...statusBody(), token: secret },
+        { ...statusBody(), app: { ...statusBody().app, billingSecret: secret } },
+        { ...full, entitlements: [{ ...full.entitlements[0], accountToken: secret }] },
+        {
+            ...full,
+            entitlements: [{
+                    ...full.entitlements[0],
+                    requiredRuntime: { ...full.entitlements[0].requiredRuntime, secret },
+                }],
+        },
+    ]) {
+        const fetcher = async () => json(body);
+        await strict_1.default.rejects((0, api_js_1.getSecurityStatus)(connection, { fetcher: fetcher }), (error) => error instanceof api_js_1.SecurityApiRequestError
+            && error.code === 'invalid_response'
+            && !error.message.includes(secret));
+    }
+});
+(0, node_test_1.default)('stops a chunked response as soon as the streaming cap is exceeded', async () => {
+    const chunk = new Uint8Array(140_000);
+    const fetcher = async () => new Response(new ReadableStream({
+        start(controller) {
+            controller.enqueue(chunk);
+            controller.enqueue(chunk);
+            controller.close();
+        },
+    }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+    await strict_1.default.rejects((0, api_js_1.getSecurityStatus)(connection, { fetcher: fetcher }), /exceeded the allowed size/);
+});
+//# sourceMappingURL=api.test.js.map

package/dist/security/api.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.test.js","sourceRoot":"","sources":["../../src/security/api.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,0DAA6B;AAC7B,qCAAyF;AAGzF,MAAM,MAAM,GAAG,sCAAsC,CAAC;AACtD,MAAM,MAAM,GAAG,sCAAsC,CAAC;AACtD,MAAM,KAAK,GAAG,0CAA0C,CAAC;AACzD,MAAM,UAAU,GAAuB;IACrC,MAAM,EAAE,uBAAuB;IAC/B,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,0BAA0B;CACxC,CAAC;AAEF,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,GAAG,EAAE;YACH,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI;YAC3F,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,0BAA0B;SAChE;QACD,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,YAAY,EAAE,EAAE;QAChB,eAAe,EAAE,KAAK;QACtB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,CAAC,iCAAiC,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,OAAO;QACL,GAAG,UAAU,EAAE;QACf,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QAC/B,YAAY,EAAE,CAAC;gBACb,EAAE,EAAE,sCAAsC;gBAC1C,IAAI,EAAE,uBAAuB;gBAC7B,cAAc,EAAE,QAAQ;gBACxB,cAAc,EAAE,gBAAgB;gBAChC,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,CAAC;gBAChB,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,0BAA0B;gBACvC,SAAS,EAAE,0BAA0B;gBACrC,iBAAiB,EAAE,KAAK;gBACxB,eAAe,EAAE;oBACf,UAAU,EAAE,OAAO;oBACnB,SAAS,EAAE,2BAA2B;oBACtC,cAAc,EAAE,OAAO;oBACvB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9B,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/B,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC9B;aACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,IAAA,mBAAI,EAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC/F,MAAM,KAAK,GAAuF,EAAE,CAAC;IACrG,MAAM,OAAO,GAAG,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAC1E,KAAK,CAAC,IAAI,CAAC;YACT,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC;YAClB,aAAa,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;YAC9D,QAAQ,EAAE,IAAI,EAAE,QAAQ;SACzB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,IAAA,0BAAiB,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,CAAC;IAC1E,gBAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACvB,GAAG,EAAE,2CAA2C,MAAM,SAAS;YAC/D,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC,CAAC;IACJ,gBAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACzF,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,gBAAM,CAAC,SAAS,CAAC,MAAM,IAAA,0BAAiB,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACtH,MAAM,gBAAM,CAAC,OAAO,CAClB,IAAA,0BAAiB,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EACnE,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,gCAAuB;WACvD,KAAK,CAAC,MAAM,KAAK,GAAG;WACpB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;WAC9B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC1C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,KAAK,EAAE,MAA8B,EAAE,IAAkB,EAAE,EAAE;QAC3E,KAAK,IAAI,CAAC,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9D,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACjH,OAAO,IAAI,CAAC;YACV,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM;YACrE,WAAW,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;SACpF,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,6DAA6D,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,IAAA,0BAAiB,EAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,CAAC;IACzG,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvB,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;IACtD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,KAAK,IAAI,CAAC,CAAC;QACX,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACvG,CAAC,CAAC;IACF,MAAM,gBAAM,CAAC,OAAO,CAClB,IAAA,0BAAiB,EAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EACjF,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,gCAAuB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CACrF,CAAC;IACF,gBAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,OAAO,GAAG;QACd,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE;QAC9E,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;QAC5E,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE;QAC/E,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;KAC3E,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;YAC/B,GAAG,MAAM;YACT,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,0BAA0B;YACvC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAClB,IAAA,0BAAiB,EAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EACjF,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,gCAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAClG,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAChG,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG;QACX,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;QACxF,IAAI,EAAE;YACJ,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;YACzC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;SACtE;KACsB,CAAA,CAAC;IAC1B,MAAM,gBAAM,CAAC,OAAO,CAAC,IAAA,0BAAiB,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACvH,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5B,gBAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;IACjF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG;QACX,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;QACtD,IAAI,EAAE;YACJ,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;YACzC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;SACtE;KACsB,CAAA,CAAC;IAC1B,MAAM,gBAAM,CAAC,OAAO,CAAC,IAAA,0BAAiB,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC/G,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5B,gBAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACzF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG;QACX,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;QAC9F,IAAI,EAAE;YACJ,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;YACzC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;SACtE;KACsB,CAAA,CAAC;IAC1B,MAAM,gBAAM,CAAC,OAAO,CAAC,IAAA,0BAAiB,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACpH,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5B,gBAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,MAAM,GAAG,iCAAiC,CAAC;IACjD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI;QACjB,EAAE,GAAG,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QAClC,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE;QACxE,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE;QAC9E;YACE,GAAG,IAAI;YACP,YAAY,EAAE,CAAC;oBACb,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;oBACvB,eAAe,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE;iBACrE,CAAC;SACH;KACF,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,gBAAM,CAAC,OAAO,CAClB,IAAA,0BAAiB,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EACnE,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,gCAAuB;eACvD,KAAK,CAAC,IAAI,KAAK,kBAAkB;eACjC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,cAAc,CAAC;QAC1D,KAAK,CAAC,UAAU;YACd,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,gBAAM,CAAC,OAAO,CAAC,IAAA,0BAAiB,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC,EAAE,2BAA2B,CAAC,CAAC;AACzH,CAAC,CAAC,CAAC"}

package/dist/security/artifact.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityArtifactManifest } from './types.js';
+export interface SecurityArtifactInspection {
+    artifactRoot: string;
+    manifest: SecurityArtifactManifest;
+    manifestSha256: string;
+}
+export declare function inspectSecurityArtifact(artifactRoot: string): Promise<SecurityArtifactInspection>;
+export declare function assertCommercialArtifactEligible(inspection: SecurityArtifactInspection): void;
+export declare function stageSecurityArtifact(sourceRoot: string, outDir: string): Promise<SecurityArtifactInspection>;
+//# sourceMappingURL=artifact.d.ts.map

package/dist/security/artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../src/security/artifact.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAwB,wBAAwB,EAAE,MAAM,YAAY,CAAC;AA2CjF,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,wBAAwB,CAAC;IACnC,cAAc,EAAE,MAAM,CAAC;CACxB;AA0JD,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4BvG;AAED,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,0BAA0B,GAAG,IAAI,CAS7F;AAED,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA0BnH"}

package/dist/security/artifact.js

@@ -0,0 +1,283 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectSecurityArtifact = inspectSecurityArtifact;
+exports.assertCommercialArtifactEligible = assertCommercialArtifactEligible;
+exports.stageSecurityArtifact = stageSecurityArtifact;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const SHA256 = /^[0-9a-f]{64}$/;
+const COMMIT = /^[0-9a-f]{40}$/;
+const QUALIFICATION_RECORDS = new Map([
+    ['licensing/candidates/commercial-rule-candidate.json', '2b305facf86c308dee3131dbc9854abf5291e29546d4fd641bace4bb1b920a9c'],
+    ['licensing/candidates/gitlab-sast-source-notice-bundle.json', '95494e6442be48932743220de45124fb51dc578eddb8d72174f1038c6a2e4011'],
+]);
+const FORBIDDEN_PARTS = new Set(['.git', '.vsg', 'node_modules', '.cache', 'cache', 'reports', 'raw', 'bin-cache']);
+const ALLOWED_FILES = new Set([
+    'LICENSE', 'NOTICE', 'package.json', 'licensing/commercial-components.json',
+    'licensing/candidates/betterleaks-generic-api-key.json',
+    'licensing/candidates/betterleaks-jwt.json',
+    'licensing/candidates/commercial-rule-candidate.json',
+    'licensing/candidates/commercial-runtime-release.json',
+    'licensing/candidates/gitlab-sast-source-evidence.json',
+    'licensing/candidates/gitlab-sast-rule-identities.json',
+    'licensing/candidates/gitlab-sast-source-notice-bundle.json',
+    'licensing/candidates/yara-forge-20260927.json',
+    'licensing/candidates/selected-runtime-coverage.json',
+    'licensing/candidates/malpedia-source-license-evidence.json',
+    'licensing/candidates/apache-source-license-evidence.json',
+    'licensing/candidates/cado-source-declaration-evidence.json',
+    'licensing/candidates/blackberry-source-declaration-evidence.json',
+    'licensing/candidates/blackberry-additional-source-declaration-evidence.json',
+    'licensing/candidates/rule-license-evidence.json',
+    'licensing/candidates/runner-image-composition.json',
+    'licensing/candidates/data-feed-evidence.json',
+    'licensing/notices/betterleaks-1.9.0-MIT.txt',
+    'licensing/notices/gitleaks-generic-origin-782f3104-MIT.txt',
+    'lattice-runtime.mjs', 'lattice-catalog.json',
+]);
+const ALLOWED_PREFIXES = ['bin/', 'src/', 'rules/', 'playbook/', 'tools/registry/', 'licensing/notices/candidate-sources/sha256/'];
+const MANIFEST_KEYS = [
+    'format', 'sourceCommit', 'identity', 'entryPoint', 'exporterPath', 'transportPath',
+    'evaluatorPath', 'releaseEligibility', 'files',
+];
+const APPROVED_COMMERCIAL_MANIFEST_SHA256 = new Set([
+    '8b72ef4bf3dd3c14110e9a7988d0806f33ea2185dfd6215f22636e8b52a3f6e9',
+    '4b2b5cc3c99cd7bd8e47e11debf3d4de89980b8d41d61dd18875466834b471ab',
+    '29838a64b10e779ccaa8e20f9fb1e692859c8b1865c89b9b8b3be10e36982e1f',
+]);
+function sha256(bytes) {
+    return (0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex');
+}
+function safeRelativePath(value) {
+    return typeof value === 'string' && value.length > 0 && !value.includes('\\') && !value.startsWith('/')
+        && !/^[A-Za-z]:/.test(value)
+        && value.split('/').every((part) => part && part !== '.' && part !== '..' && !FORBIDDEN_PARTS.has(part.toLowerCase()));
+}
+function parseFile(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Security artifact file entry is invalid.');
+    const item = value;
+    const path = item.path;
+    if (Object.keys(item).some((key) => !['path', 'sha256', 'bytes'].includes(key))
+        || !safeRelativePath(path)
+        || (!ALLOWED_FILES.has(path) && !ALLOWED_PREFIXES.some((prefix) => path.startsWith(prefix)))
+        || typeof item.sha256 !== 'string' || !SHA256.test(item.sha256)
+        || !Number.isSafeInteger(item.bytes) || item.bytes < 0) {
+        throw new Error('Security artifact file metadata is invalid.');
+    }
+    return { path, sha256: item.sha256, bytes: item.bytes };
+}
+function parseManifest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Security artifact manifest is invalid.');
+    const item = value;
+    const keys = Object.keys(item);
+    if (keys.some((key) => !MANIFEST_KEYS.includes(key)) || MANIFEST_KEYS.some((key) => !keys.includes(key))) {
+        throw new Error('Security artifact manifest fields do not match the frozen interface.');
+    }
+    if (item.format !== 'lattice-security-artifact-v1' || typeof item.sourceCommit !== 'string' || !COMMIT.test(item.sourceCommit)
+        || item.entryPoint !== 'bin/vsg.mjs' || item.exporterPath !== 'src/lattice/export.mjs'
+        || item.transportPath !== 'src/lattice/transport.mjs' || item.evaluatorPath !== 'lattice-runtime.mjs') {
+        throw new Error('Security artifact manifest identity or runtime paths are invalid.');
+    }
+    if (!item.identity || typeof item.identity !== 'object' || Array.isArray(item.identity))
+        throw new Error('Security artifact runtime identity is invalid.');
+    const identity = item.identity;
+    const identityKeys = [
+        'vsgVersion', 'profileId', 'profileVersion', 'rulesDigest', 'registryDigest',
+        'commercialManifestDigest', 'evaluatorDigest', 'catalogDigest',
+    ];
+    if (Object.keys(identity).some((key) => !identityKeys.includes(key)) || identityKeys.some((key) => !Object.hasOwn(identity, key))) {
+        throw new Error('Security artifact runtime identity fields do not match the frozen interface.');
+    }
+    for (const key of ['vsgVersion', 'profileId', 'profileVersion']) {
+        if (typeof identity[key] !== 'string' || identity[key].length === 0)
+            throw new Error(`Security artifact ${key} is invalid.`);
+    }
+    for (const key of ['rulesDigest', 'registryDigest', 'commercialManifestDigest', 'evaluatorDigest', 'catalogDigest']) {
+        if (typeof identity[key] !== 'string' || !SHA256.test(identity[key]))
+            throw new Error(`Security artifact ${key} is invalid.`);
+    }
+    if (!item.releaseEligibility || typeof item.releaseEligibility !== 'object' || Array.isArray(item.releaseEligibility)) {
+        throw new Error('Security artifact release eligibility is invalid.');
+    }
+    const release = item.releaseEligibility;
+    if (typeof release.status !== 'string'
+        || !['blocked', 'approved'].includes(release.status)
+        || !Array.isArray(release.blockers) || release.blockers.some((blocker) => typeof blocker !== 'string' || !blocker)) {
+        throw new Error('Security artifact release eligibility is invalid.');
+    }
+    let approvedRelease = {
+        status: release.status,
+        blockers: [...release.blockers],
+    };
+    if (release.status === 'blocked') {
+        if (Object.keys(release).some((key) => !['status', 'blockers'].includes(key)) || release.blockers.length === 0) {
+            throw new Error('Security artifact blocked eligibility is invalid.');
+        }
+    }
+    else {
+        const approval = release.approval;
+        if (Object.keys(release).some((key) => !['status', 'blockers', 'approval', 'checkoutEnabled', 'paidPublicationEnabled'].includes(key))
+            || release.blockers.length !== 0 || release.checkoutEnabled !== false || release.paidPublicationEnabled !== false
+            || !approval || typeof approval !== 'object' || Array.isArray(approval)) {
+            throw new Error('Security artifact approved eligibility is invalid.');
+        }
+        const approvalRecord = approval;
+        const record = approvalRecord.record;
+        if (Object.keys(approvalRecord).some((key) => !['owner', 'decidedOn', 'record'].includes(key))
+            || approvalRecord.owner !== 'M2 AI, LLC' || typeof approvalRecord.decidedOn !== 'string'
+            || !/^\d{4}-\d{2}-\d{2}$/.test(approvalRecord.decidedOn)
+            || !record || typeof record !== 'object' || Array.isArray(record)) {
+            throw new Error('Security artifact approval record is invalid.');
+        }
+        const recordRef = record;
+        if (Object.keys(recordRef).some((key) => !['path', 'sha256', 'bytes'].includes(key))
+            || recordRef.path !== 'licensing/candidates/commercial-runtime-release.json'
+            || typeof recordRef.sha256 !== 'string' || !SHA256.test(recordRef.sha256)
+            || !Number.isSafeInteger(recordRef.bytes) || recordRef.bytes <= 0) {
+            throw new Error('Security artifact approval record reference is invalid.');
+        }
+        approvedRelease = {
+            status: 'approved', blockers: [], checkoutEnabled: false, paidPublicationEnabled: false,
+            approval: {
+                owner: 'M2 AI, LLC', decidedOn: approvalRecord.decidedOn,
+                record: { path: recordRef.path, sha256: recordRef.sha256, bytes: recordRef.bytes },
+            },
+        };
+    }
+    if (!Array.isArray(item.files) || item.files.length === 0)
+        throw new Error('Security artifact file allowlist is empty.');
+    const files = item.files.map(parseFile);
+    const qualification = files.filter((file) => QUALIFICATION_RECORDS.has(file.path));
+    if (qualification.length > 0 && qualification.length !== QUALIFICATION_RECORDS.size) {
+        throw new Error('Security qualification evidence records must be packaged together.');
+    }
+    if (qualification.some((file) => file.sha256 !== QUALIFICATION_RECORDS.get(file.path))) {
+        throw new Error('Security qualification evidence does not match its reviewed bytes.');
+    }
+    const names = new Set();
+    const lowerNames = new Set();
+    for (const file of files) {
+        const lower = file.path.toLowerCase();
+        if (names.has(file.path) || lowerNames.has(lower))
+            throw new Error(`Security artifact path ${file.path} is duplicate or case-colliding.`);
+        names.add(file.path);
+        lowerNames.add(lower);
+    }
+    for (const required of ['bin/vsg.mjs', 'src/lattice/export.mjs', 'src/lattice/transport.mjs', 'lattice-runtime.mjs']) {
+        if (!names.has(required))
+            throw new Error(`Security artifact is missing ${required}.`);
+    }
+    if (approvedRelease.status === 'approved') {
+        const ref = approvedRelease.approval?.record;
+        const declared = files.find((file) => file.path === ref?.path);
+        if (!declared || declared.sha256 !== ref?.sha256 || declared.bytes !== ref?.bytes) {
+            throw new Error('Security artifact approval record is not bound to its declared bytes.');
+        }
+    }
+    return {
+        format: 'lattice-security-artifact-v1',
+        sourceCommit: item.sourceCommit,
+        identity: identity,
+        entryPoint: 'bin/vsg.mjs',
+        exporterPath: 'src/lattice/export.mjs',
+        transportPath: 'src/lattice/transport.mjs',
+        evaluatorPath: 'lattice-runtime.mjs',
+        releaseEligibility: approvedRelease,
+        files,
+    };
+}
+async function walkFiles(root, current = root, prefix = '') {
+    const output = [];
+    for (const entry of (await node_fs_1.promises.readdir(current, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+        const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+        const target = (0, node_path_1.join)(current, entry.name);
+        const stat = await node_fs_1.promises.lstat(target);
+        if (stat.isSymbolicLink())
+            throw new Error(`Security artifact linked path ${relative} is forbidden.`);
+        if (stat.isDirectory())
+            output.push(...await walkFiles(root, target, relative));
+        else if (stat.isFile())
+            output.push(relative);
+        else
+            throw new Error(`Security artifact non-file path ${relative} is forbidden.`);
+    }
+    return output;
+}
+async function inspectSecurityArtifact(artifactRoot) {
+    const root = await node_fs_1.promises.realpath((0, node_path_1.resolve)(artifactRoot));
+    const manifestPath = (0, node_path_1.join)(root, 'artifact-manifest.json');
+    const manifestStat = await node_fs_1.promises.lstat(manifestPath);
+    if (!manifestStat.isFile() || manifestStat.isSymbolicLink())
+        throw new Error('Security artifact manifest must be a regular file.');
+    const manifestBytes = await node_fs_1.promises.readFile(manifestPath);
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(manifestBytes));
+    }
+    catch {
+        throw new Error('Security artifact manifest is not valid UTF-8 JSON.');
+    }
+    const manifest = parseManifest(value);
+    const declared = new Set(manifest.files.map((item) => item.path));
+    for (const file of manifest.files) {
+        const target = (0, node_path_1.join)(root, ...file.path.split('/'));
+        const relative = target.slice(root.length + 1);
+        if (relative.startsWith(`..${node_path_1.sep}`) || (0, node_path_1.resolve)(target) !== target)
+            throw new Error(`Security artifact path ${file.path} escapes its root.`);
+        const stat = await node_fs_1.promises.lstat(target);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new Error(`Security artifact path ${file.path} is not a regular file.`);
+        const bytes = await node_fs_1.promises.readFile(target);
+        if (bytes.byteLength !== file.bytes || sha256(bytes) !== file.sha256)
+            throw new Error(`Security artifact file ${file.path} failed integrity verification.`);
+    }
+    const actual = (await walkFiles(root)).filter((file) => file !== 'artifact-manifest.json');
+    if (actual.length !== declared.size || actual.some((file) => !declared.has(file))) {
+        throw new Error('Security artifact contains an undeclared file.');
+    }
+    return { artifactRoot: root, manifest, manifestSha256: sha256(manifestBytes) };
+}
+function assertCommercialArtifactEligible(inspection) {
+    const { manifest, manifestSha256 } = inspection;
+    if (manifest.releaseEligibility.status !== 'approved' || manifest.releaseEligibility.blockers.length > 0) {
+        const blockers = manifest.releaseEligibility.blockers.join(', ') || manifest.releaseEligibility.status;
+        throw new Error(`Commercial Security runtime is unavailable: ${blockers}.`);
+    }
+    if (!APPROVED_COMMERCIAL_MANIFEST_SHA256.has(manifestSha256)) {
+        throw new Error('Commercial Security runtime is unavailable: this exact artifact has no CLI release approval.');
+    }
+}
+async function stageSecurityArtifact(sourceRoot, outDir) {
+    const source = await inspectSecurityArtifact(sourceRoot);
+    const target = (0, node_path_1.resolve)(outDir);
+    try {
+        await node_fs_1.promises.lstat(target);
+        throw new Error('Security artifact output directory already exists.');
+    }
+    catch (error) {
+        if (!(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT'))
+            throw error;
+    }
+    await node_fs_1.promises.mkdir((0, node_path_1.dirname)(target), { recursive: true });
+    const staging = `${target}-staging-${process.pid}-${Date.now()}`;
+    await node_fs_1.promises.mkdir(staging, { recursive: false, mode: 0o700 });
+    try {
+        for (const file of source.manifest.files) {
+            const destination = (0, node_path_1.join)(staging, ...file.path.split('/'));
+            await node_fs_1.promises.mkdir((0, node_path_1.dirname)(destination), { recursive: true });
+            await node_fs_1.promises.copyFile((0, node_path_1.join)(source.artifactRoot, ...file.path.split('/')), destination, node_fs_1.constants.COPYFILE_EXCL);
+        }
+        await node_fs_1.promises.copyFile((0, node_path_1.join)(source.artifactRoot, 'artifact-manifest.json'), (0, node_path_1.join)(staging, 'artifact-manifest.json'), node_fs_1.constants.COPYFILE_EXCL);
+        await inspectSecurityArtifact(staging);
+        await node_fs_1.promises.rename(staging, target);
+        return inspectSecurityArtifact(target);
+    }
+    catch (error) {
+        await node_fs_1.promises.rm(staging, { recursive: true, force: true });
+        throw error;
+    }
+}
+//# sourceMappingURL=artifact.js.map

package/dist/security/artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../../src/security/artifact.ts"],"names":[],"mappings":";;AA4MA,0DA4BC;AAED,4EASC;AAED,sDA0BC;AA/QD,6CAAyC;AACzC,qCAAmE;AACnE,yCAAwD;AAGxD,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,CAAC,qDAAqD,EAAE,kEAAkE,CAAC;IAC3H,CAAC,4DAA4D,EAAE,kEAAkE,CAAC;CACnI,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AACpH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,sCAAsC;IAC3E,uDAAuD;IACvD,2CAA2C;IAC3C,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,uDAAuD;IACvD,4DAA4D;IAC5D,+CAA+C;IAC/C,qDAAqD;IACrD,4DAA4D;IAC5D,0DAA0D;IAC1D,4DAA4D;IAC5D,kEAAkE;IAClE,6EAA6E;IAC7E,iDAAiD;IACjD,oDAAoD;IACpD,8CAA8C;IAC9C,6CAA6C;IAC7C,4DAA4D;IAC5D,qBAAqB,EAAE,sBAAsB;CAC9C,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;AACnI,MAAM,aAAa,GAAG;IACpB,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe;IACnF,eAAe,EAAE,oBAAoB,EAAE,OAAO;CAC/C,CAAC;AACF,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAS;IAC1D,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;CACnE,CAAC,CAAC;AAQH,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;WAClG,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;WACzB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WAC1E,CAAC,gBAAgB,CAAC,IAAI,CAAC;WACvB,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;WACzF,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;WAC5D,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAK,IAAI,CAAC,KAAgB,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAe,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3H,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,8BAA8B,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;WACzH,IAAI,CAAC,UAAU,KAAK,aAAa,IAAI,IAAI,CAAC,YAAY,KAAK,wBAAwB;WACnF,IAAI,CAAC,aAAa,KAAK,2BAA2B,IAAI,IAAI,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC3J,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAmC,CAAC;IAC1D,MAAM,YAAY,GAAG;QACnB,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB;QAC5E,0BAA0B,EAAE,iBAAiB,EAAE,eAAe;KAC/D,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAClI,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,cAAc,CAAC,CAAC;IAC/H,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,eAAe,CAAC,EAAE,CAAC;QACpH,IAAI,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,cAAc,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtH,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAA6C,CAAC;IACnE,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;WACjC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;WACjD,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,eAAe,GAAmD;QACpE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAa;KAC5C,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/G,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;eACjI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK,IAAI,OAAO,CAAC,sBAAsB,KAAK,KAAK;eAC9G,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,cAAc,GAAG,QAAmC,CAAC;QAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;eACzF,cAAc,CAAC,KAAK,KAAK,YAAY,IAAI,OAAO,cAAc,CAAC,SAAS,KAAK,QAAQ;eACrF,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;eACrD,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,SAAS,GAAG,MAAiC,CAAC;QACpD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;eAC/E,SAAS,CAAC,IAAI,KAAK,sDAAsD;eACzE,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;eACtE,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,SAAS,CAAC,KAAgB,IAAI,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,GAAG;YAChB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK;YACvF,QAAQ,EAAE;gBACR,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS;gBACxD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,KAAe,EAAE;aAC7F;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,kCAAkC,CAAC,CAAC;QAC1I,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,aAAa,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACrH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,8BAA8B;QACtC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,QAA2D;QACrE,UAAU,EAAE,aAAa;QACzB,YAAY,EAAE,wBAAwB;QACtC,aAAa,EAAE,2BAA2B;QAC1C,aAAa,EAAE,qBAAqB;QACpC,kBAAkB,EAAE,eAAe;QACnC,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,OAAO,GAAG,IAAI,EAAE,MAAM,GAAG,EAAE;IAChE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,kBAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtH,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjE,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,gBAAgB,CAAC,CAAC;QACtG,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC3E,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YACzC,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,gBAAgB,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAAC,YAAoB;IAChE,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,YAAY,CAAC,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,kBAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnI,MAAM,aAAa,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,eAAG,EAAE,CAAC,IAAI,IAAA,mBAAO,EAAC,MAAM,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,oBAAoB,CAAC,CAAC;QAC5I,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,yBAAyB,CAAC,CAAC;QAC3H,MAAM,KAAK,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAgB,gCAAgC,CAAC,UAAsC;IACrF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;IAChD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,KAAK,UAAU,IAAI,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzG,MAAM,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACvG,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CAAC,UAAkB,EAAE,MAAc;IAC5E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,kBAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;IACvG,CAAC;IACD,MAAM,kBAAE,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,MAAM,YAAY,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACjE,MAAM,kBAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3D,MAAM,kBAAE,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAA,gBAAI,EAAC,MAAM,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAW,CAAC,aAAa,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAA,gBAAI,EAAC,MAAM,CAAC,YAAY,EAAE,wBAAwB,CAAC,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,mBAAW,CAAC,aAAa,CAAC,CAAC;QAC3I,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,kBAAE,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/security/artifact.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=artifact.test.d.ts.map

package/dist/security/artifact.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.test.d.ts","sourceRoot":"","sources":["../../src/security/artifact.test.ts"],"names":[],"mappings":""}