@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security/journal.test.js

@@ -0,0 +1,226 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = __importDefault(require("node:test"));
+const journal_js_1 = require("./journal.js");
+const ID = '11111111-1111-4111-8111-111111111111';
+const journalContext = {
+    recoveryParentId: null,
+    recoveryRootId: null,
+    repo: 'C:\\fixture',
+    outDir: 'C:\\fixture\\.vsg\\security\\output',
+    artifactRoot: 'C:\\fixture\\artifact',
+    artifactManifestSha256: 'a'.repeat(64),
+    repositoryIdentity: 'github.com/example/fixture',
+    retainedCompleted: true,
+    localExit: 0,
+    acknowledgedExit: null,
+};
+(0, node_test_1.default)('retains exact finish bytes without credentials and detects later changes', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-journal-'));
+    try {
+        const body = '{"outcome":"completed","report":{"transportVersion":"3.0"}}';
+        const journal = await (0, journal_js_1.createSecurityPublishJournal)({
+            id: ID,
+            apiUrl: 'https://latticeai.app',
+            appId: '22222222-2222-4222-8222-222222222222',
+            clientRequestId: '33333333-3333-4333-8333-333333333333',
+            entitlementId: '44444444-4444-4444-8444-444444444444',
+            mode: 'scan',
+            parentRunId: null,
+            ...journalContext,
+            runId: '55555555-5555-4555-8555-555555555555',
+            reservationExpiresAt: '2026-10-20T02:00:00.000Z',
+            reportPath: 'C:\\fixture\\sanitized-report.json',
+        }, body, root, new Date('2026-10-20T00:00:00.000Z'));
+        const retained = await (0, journal_js_1.readSecurityPublishJournal)(ID, root);
+        strict_1.default.equal(retained.exactRequestBody, body);
+        strict_1.default.doesNotMatch(JSON.stringify(journal), /token|authorization/i);
+        strict_1.default.ok(journal.requestBodyPath);
+        await node_fs_1.promises.appendFile(journal.requestBodyPath, ' ');
+        await strict_1.default.rejects((0, journal_js_1.readSecurityPublishJournal)(ID, root), /changed after capture/);
+        await node_fs_1.promises.writeFile(journal.requestBodyPath, body);
+        await (0, journal_js_1.removeSecurityPublishJournal)(ID, root);
+        await strict_1.default.rejects(node_fs_1.promises.lstat((0, node_path_1.join)(root, ID)), { code: 'ENOENT' });
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('rejects non-JSON payloads before creating a journal', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-journal-invalid-'));
+    try {
+        await strict_1.default.rejects((0, journal_js_1.createSecurityPublishJournal)({
+            id: ID,
+            apiUrl: 'https://latticeai.app',
+            appId: ID,
+            clientRequestId: ID,
+            entitlementId: ID,
+            mode: 'scan',
+            parentRunId: null,
+            ...journalContext,
+            runId: ID,
+            reservationExpiresAt: '2026-10-20T02:00:00.000Z',
+            reportPath: 'report.json',
+        }, 'not json', root), SyntaxError);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('persists the idempotent begin request before adding the server reservation', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-journal-begin-'));
+    try {
+        const pending = await (0, journal_js_1.createSecurityBeginJournal)({
+            id: ID,
+            apiUrl: 'https://latticeai.app',
+            appId: '22222222-2222-4222-8222-222222222222',
+            clientRequestId: ID,
+            entitlementId: '44444444-4444-4444-8444-444444444444',
+            mode: 'scan',
+            parentRunId: null,
+            ...journalContext,
+            retainedCompleted: false,
+            localExit: null,
+            reportPath: null,
+        }, root);
+        strict_1.default.equal((await (0, journal_js_1.readSecurityJournal)(ID, root)).state, 'begin_pending');
+        const reserved = await (0, journal_js_1.setSecurityJournalReservation)(pending, {
+            runId: '55555555-5555-4555-8555-555555555555',
+            reservationExpiresAt: '2026-10-20T02:00:00.000Z',
+        }, root);
+        strict_1.default.equal(reserved.state, 'reserved');
+        strict_1.default.equal((await (0, journal_js_1.readSecurityJournal)(ID, root)).runId, '55555555-5555-4555-8555-555555555555');
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('creates one durable recovery child under concurrent callers', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-journal-recovery-'));
+    try {
+        await (0, journal_js_1.createSecurityBeginJournal)({
+            id: ID,
+            apiUrl: 'https://latticeai.app',
+            appId: '22222222-2222-4222-8222-222222222222',
+            clientRequestId: ID,
+            entitlementId: '44444444-4444-4444-8444-444444444444',
+            mode: 'report',
+            parentRunId: null,
+            ...journalContext,
+            reportPath: 'C:\\fixture\\.vsg\\security\\output\\lattice-report.json',
+        }, root);
+        const records = await Promise.all(Array.from({ length: 8 }, () => (0, journal_js_1.createOrReadSecurityRecovery)(ID, root)));
+        strict_1.default.equal(new Set(records.map((record) => record.childJournalId)).size, 1);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('creates one immutable acknowledgment receipt across processes and rejects a conflicting terminal result', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-journal-ack-contention-'));
+    const finalJournalId = '77777777-7777-4777-8777-777777777777';
+    const receipt = {
+        version: 1,
+        rootJournalId: ID,
+        finalJournalId,
+        finalRunId: '88888888-8888-4888-8888-888888888888',
+        journalIds: [finalJournalId, ID],
+        apiUrl: 'https://latticeai.app',
+        appId: '22222222-2222-4222-8222-222222222222',
+        localExit: 0,
+        acknowledgedAt: '2026-10-20T00:00:00.000Z',
+    };
+    try {
+        for (const journalId of receipt.journalIds) {
+            const directory = (0, node_path_1.join)(root, journalId);
+            await node_fs_1.promises.mkdir(directory, { recursive: true });
+            await Promise.all([
+                node_fs_1.promises.writeFile((0, node_path_1.join)(directory, 'journal.json'), '{}'),
+                node_fs_1.promises.writeFile((0, node_path_1.join)(directory, 'finish-request.json'), '{}'),
+                node_fs_1.promises.writeFile((0, node_path_1.join)(directory, 'recovery.json'), '{}'),
+            ]);
+        }
+        const journalModule = (0, node_path_1.join)(__dirname, 'journal.js');
+        const childScript = `
+      const { removeSecurityPublishJournal, saveSecurityAcknowledgment } = require(process.env.LATTICE_TEST_JOURNAL_MODULE);
+      (async () => {
+        const receipt = JSON.parse(process.env.LATTICE_TEST_ACK_RECEIPT);
+        const root = process.env.LATTICE_TEST_ACK_ROOT;
+        await saveSecurityAcknowledgment(receipt, root);
+        for (const journalId of receipt.journalIds) await removeSecurityPublishJournal(journalId, root, true);
+      })().catch((error) => { console.error(error); process.exitCode = 1; });
+    `;
+        const runChild = () => new Promise((resolve, reject) => {
+            const child = (0, node_child_process_1.spawn)(process.execPath, ['--eval', childScript], {
+                env: {
+                    ...process.env,
+                    LATTICE_TEST_JOURNAL_MODULE: journalModule,
+                    LATTICE_TEST_ACK_RECEIPT: JSON.stringify(receipt),
+                    LATTICE_TEST_ACK_ROOT: root,
+                },
+                stdio: ['ignore', 'ignore', 'pipe'],
+            });
+            let stderr = '';
+            child.stderr.setEncoding('utf8');
+            child.stderr.on('data', (chunk) => { stderr += chunk; });
+            child.once('error', reject);
+            child.once('exit', (code) => {
+                if (code === 0)
+                    resolve();
+                else
+                    reject(new Error(`acknowledgment child exited ${code}: ${stderr}`));
+            });
+        });
+        await Promise.all(Array.from({ length: 8 }, runChild));
+        strict_1.default.deepEqual(await (0, journal_js_1.readSecurityAcknowledgment)(ID, root), receipt);
+        strict_1.default.deepEqual(await (0, journal_js_1.readSecurityAcknowledgment)(finalJournalId, root), receipt);
+        strict_1.default.deepEqual((await node_fs_1.promises.readdir(root)).sort(), [
+            `${ID}.ack.json`, `${finalJournalId}.ack.json`, ID, finalJournalId,
+        ].sort());
+        strict_1.default.deepEqual(await node_fs_1.promises.readdir((0, node_path_1.join)(root, ID)), ['recovery.json']);
+        strict_1.default.deepEqual(await node_fs_1.promises.readdir((0, node_path_1.join)(root, finalJournalId)), ['recovery.json']);
+        await strict_1.default.rejects((0, journal_js_1.saveSecurityAcknowledgment)({
+            ...receipt,
+            finalRunId: '99999999-9999-4999-8999-999999999999',
+        }, root), /conflicts with an existing terminal result/);
+        strict_1.default.deepEqual(await (0, journal_js_1.readSecurityAcknowledgment)(ID, root), receipt);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('acknowledges before removing finish body and metadata', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-journal-ack-'));
+    try {
+        const pending = await (0, journal_js_1.createSecurityPublishJournal)({
+            id: ID,
+            apiUrl: 'https://latticeai.app',
+            appId: '22222222-2222-4222-8222-222222222222',
+            clientRequestId: ID,
+            entitlementId: '44444444-4444-4444-8444-444444444444',
+            mode: 'scan',
+            parentRunId: null,
+            ...journalContext,
+            runId: '55555555-5555-4555-8555-555555555555',
+            reservationExpiresAt: '2026-10-20T02:00:00.000Z',
+            reportPath: 'C:\\fixture\\sanitized-report.json',
+        }, '{"outcome":"completed","report":{}}', root);
+        const acknowledged = await (0, journal_js_1.markSecurityJournalAcknowledged)(pending, root);
+        strict_1.default.equal((await (0, journal_js_1.readSecurityJournal)(ID, root)).state, 'acknowledged');
+        strict_1.default.equal((await (0, journal_js_1.readSecurityPublishJournal)(ID, root)).exactRequestBody, '{"outcome":"completed","report":{}}');
+        await (0, journal_js_1.removeSecurityPublishJournal)(acknowledged.id, root);
+        await strict_1.default.rejects(node_fs_1.promises.lstat((0, node_path_1.join)(root, ID)), { code: 'ENOENT' });
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=journal.test.js.map

package/dist/security/journal.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.test.js","sourceRoot":"","sources":["../../src/security/journal.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,2DAA2C;AAC3C,qCAAyC;AACzC,qCAAiC;AACjC,yCAAiC;AACjC,0DAA6B;AAC7B,6CAWsB;AAGtB,MAAM,EAAE,GAAG,sCAAsC,CAAC;AAClD,MAAM,cAAc,GAAG;IACrB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,qCAAqC;IAC7C,YAAY,EAAE,uBAAuB;IACrC,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACtC,kBAAkB,EAAE,4BAA4B;IAChD,iBAAiB,EAAE,IAAI;IACvB,SAAS,EAAE,CAAC;IACZ,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAEF,IAAA,mBAAI,EAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,6DAA6D,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAA,yCAA4B,EAAC;YACjD,EAAE,EAAE,EAAE;YACN,MAAM,EAAE,uBAAuB;YAC/B,KAAK,EAAE,sCAAsC;YAC7C,eAAe,EAAE,sCAAsC;YACvD,aAAa,EAAE,sCAAsC;YACrD,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,IAAI;YACjB,GAAG,cAAc;YACjB,KAAK,EAAE,sCAAsC;YAC7C,oBAAoB,EAAE,0BAA0B;YAChD,UAAU,EAAE,oCAAoC;SACjD,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAA,uCAA0B,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5D,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC9C,gBAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACrE,gBAAM,CAAC,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEnC,MAAM,kBAAE,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,IAAA,uCAA0B,EAAC,EAAE,EAAE,IAAI,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACpF,MAAM,kBAAE,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,IAAA,yCAA4B,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,gBAAM,CAAC,OAAO,CAAC,kBAAE,CAAC,KAAK,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,kBAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAClB,IAAA,yCAA4B,EAAC;YAC3B,EAAE,EAAE,EAAE;YACN,MAAM,EAAE,uBAAuB;YAC/B,KAAK,EAAE,EAAE;YACT,eAAe,EAAE,EAAE;YACnB,aAAa,EAAE,EAAE;YACjB,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,IAAI;YACjB,GAAG,cAAc;YACjB,KAAK,EAAE,EAAE;YACT,oBAAoB,EAAE,0BAA0B;YAChD,UAAU,EAAE,aAAa;SAC1B,EAAE,UAAU,EAAE,IAAI,CAAC,EACpB,WAAW,CACZ,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,kBAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;IAC5F,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,uCAA0B,EAAC;YAC/C,EAAE,EAAE,EAAE;YACN,MAAM,EAAE,uBAAuB;YAC/B,KAAK,EAAE,sCAAsC;YAC7C,eAAe,EAAE,EAAE;YACnB,aAAa,EAAE,sCAAsC;YACrD,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,IAAI;YACjB,GAAG,cAAc;YACjB,iBAAiB,EAAE,KAAK;YACxB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;SACjB,EAAE,IAAI,CAAC,CAAC;QACT,gBAAM,CAAC,KAAK,CAAC,CAAC,MAAM,IAAA,gCAAmB,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAA,0CAA6B,EAAC,OAAO,EAAE;YAC5D,KAAK,EAAE,sCAAsC;YAC7C,oBAAoB,EAAE,0BAA0B;SACjD,EAAE,IAAI,CAAC,CAAC;QACT,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACzC,gBAAM,CAAC,KAAK,CAAC,CAAC,MAAM,IAAA,gCAAmB,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;IACpG,CAAC;YAAS,CAAC;QACT,MAAM,kBAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oCAAoC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,IAAA,uCAA0B,EAAC;YAC/B,EAAE,EAAE,EAAE;YACN,MAAM,EAAE,uBAAuB;YAC/B,KAAK,EAAE,sCAAsC;YAC7C,eAAe,EAAE,EAAE;YACnB,aAAa,EAAE,sCAAsC;YACrD,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,IAAI;YACjB,GAAG,cAAc;YACjB,UAAU,EAAE,0DAA0D;SACvE,EAAE,IAAI,CAAC,CAAC;QACT,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,yCAA4B,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3G,gBAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;YAAS,CAAC;QACT,MAAM,kBAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;IACzH,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,0CAA0C,CAAC,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,sCAAsC,CAAC;IAC9D,MAAM,OAAO,GAAkC;QAC7C,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,EAAE;QACjB,cAAc;QACd,UAAU,EAAE,sCAAsC;QAClD,UAAU,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QAChC,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,sCAAsC;QAC7C,SAAS,EAAE,CAAC;QACZ,cAAc,EAAE,0BAA0B;KAC3C,CAAC;IACF,IAAI,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACxC,MAAM,kBAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,kBAAE,CAAC,SAAS,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC;gBACnD,kBAAE,CAAC,SAAS,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,IAAI,CAAC;gBAC1D,kBAAE,CAAC,SAAS,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG;;;;;;;;KAQnB,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE;gBAC7D,GAAG,EAAE;oBACH,GAAG,OAAO,CAAC,GAAG;oBACd,2BAA2B,EAAE,aAAa;oBAC1C,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBACjD,qBAAqB,EAAE,IAAI;iBAC5B;gBACD,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,IAAI,IAAI,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAC;;oBACrB,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,gBAAM,CAAC,SAAS,CAAC,MAAM,IAAA,uCAA0B,EAAC,EAAE,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,gBAAM,CAAC,SAAS,CAAC,MAAM,IAAA,uCAA0B,EAAC,cAAc,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAClF,gBAAM,CAAC,SAAS,CAAC,CAAC,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;YAChD,GAAG,EAAE,WAAW,EAAE,GAAG,cAAc,WAAW,EAAE,EAAE,EAAE,cAAc;SACnE,CAAC,IAAI,EAAE,CAAC,CAAC;QACV,gBAAM,CAAC,SAAS,CAAC,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QACtE,gBAAM,CAAC,SAAS,CAAC,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAElF,MAAM,gBAAM,CAAC,OAAO,CAAC,IAAA,uCAA0B,EAAC;YAC9C,GAAG,OAAO;YACV,UAAU,EAAE,sCAAsC;SACnD,EAAE,IAAI,CAAC,EAAE,4CAA4C,CAAC,CAAC;QACxD,gBAAM,CAAC,SAAS,CAAC,MAAM,IAAA,uCAA0B,EAAC,EAAE,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,MAAM,kBAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;IACvE,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,yCAA4B,EAAC;YACjD,EAAE,EAAE,EAAE;YACN,MAAM,EAAE,uBAAuB;YAC/B,KAAK,EAAE,sCAAsC;YAC7C,eAAe,EAAE,EAAE;YACnB,aAAa,EAAE,sCAAsC;YACrD,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,IAAI;YACjB,GAAG,cAAc;YACjB,KAAK,EAAE,sCAAsC;YAC7C,oBAAoB,EAAE,0BAA0B;YAChD,UAAU,EAAE,oCAAoC;SACjD,EAAE,qCAAqC,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,IAAA,4CAA+B,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1E,gBAAM,CAAC,KAAK,CAAC,CAAC,MAAM,IAAA,gCAAmB,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC1E,gBAAM,CAAC,KAAK,CAAC,CAAC,MAAM,IAAA,uCAA0B,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;QACnH,MAAM,IAAA,yCAA4B,EAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,gBAAM,CAAC,OAAO,CAAC,kBAAE,CAAC,KAAK,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,kBAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/security/package-verifier.d.ts

@@ -0,0 +1,15 @@
+import type { SecurityArtifactInspection } from './artifact.js';
+export interface NpmPackFile {
+    path: string;
+    size: number;
+}
+export interface NpmPackResult {
+    filename: string;
+    shasum: string;
+    integrity: string;
+    files: NpmPackFile[];
+}
+export declare function assertVerifiedOutputOutsideStage(stageRoot: string, outputRoot: string): void;
+export declare function verifySecurityPackageListing(pack: NpmPackResult, inspection: SecurityArtifactInspection, manifestBytes: number): void;
+export declare function verifyPackedTarballDigest(pack: NpmPackResult, tarball: Uint8Array): void;
+//# sourceMappingURL=package-verifier.d.ts.map

package/dist/security/package-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-verifier.d.ts","sourceRoot":"","sources":["../../src/security/package-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAOhE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAO5F;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,0BAA0B,EACtC,aAAa,EAAE,MAAM,GACpB,IAAI,CA+BN;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAMxF"}

package/dist/security/package-verifier.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertVerifiedOutputOutsideStage = assertVerifiedOutputOutsideStage;
+exports.verifySecurityPackageListing = verifySecurityPackageListing;
+exports.verifyPackedTarballDigest = verifyPackedTarballDigest;
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+const SHA1 = /^[0-9a-f]{40}$/;
+const FORBIDDEN_PACKAGE_PARTS = new Set([
+    '.git', '.vsg', 'node_modules', 'raw', 'cache', 'security-connections.json', 'credentials.json', 'security-pending',
+]);
+function assertVerifiedOutputOutsideStage(stageRoot, outputRoot) {
+    const fold = (value) => process.platform === 'win32' ? value.toLowerCase() : value;
+    const stage = fold((0, node_path_1.resolve)(stageRoot));
+    const output = fold((0, node_path_1.resolve)(outputRoot));
+    if (output === stage || output.startsWith(`${stage}${node_path_1.sep}`)) {
+        throw new Error('Commercial Security verified output must be outside dist/security-runtime.');
+    }
+}
+function verifySecurityPackageListing(pack, inspection, manifestBytes) {
+    if (!pack || typeof pack.filename !== 'string' || !pack.filename.endsWith('.tgz')
+        || typeof pack.shasum !== 'string' || !SHA1.test(pack.shasum)
+        || typeof pack.integrity !== 'string' || !pack.integrity.startsWith('sha512-')
+        || !Array.isArray(pack.files) || pack.files.length === 0) {
+        throw new Error('Commercial Security npm pack result is invalid.');
+    }
+    const seen = new Set();
+    const lower = new Set();
+    for (const file of pack.files) {
+        if (!file || typeof file.path !== 'string' || !file.path || file.path.includes('\\')
+            || !Number.isSafeInteger(file.size) || file.size < 0)
+            throw new Error('Commercial Security npm pack file entry is invalid.');
+        const folded = file.path.toLowerCase();
+        if (seen.has(file.path) || lower.has(folded))
+            throw new Error(`Commercial Security npm pack path ${file.path} is duplicate or case-colliding.`);
+        if (file.path.split('/').some((part) => FORBIDDEN_PACKAGE_PARTS.has(part.toLowerCase()))) {
+            throw new Error(`Commercial Security npm package contains forbidden path ${file.path}.`);
+        }
+        seen.add(file.path);
+        lower.add(folded);
+    }
+    const prefix = 'dist/security-runtime/';
+    const expected = new Map([[`${prefix}artifact-manifest.json`, manifestBytes]]);
+    for (const file of inspection.manifest.files)
+        expected.set(`${prefix}${file.path}`, file.bytes);
+    const actualSecurityFiles = pack.files.filter((file) => file.path.startsWith(prefix));
+    if (actualSecurityFiles.length !== expected.size)
+        throw new Error('Commercial Security npm package file list does not match the artifact manifest.');
+    for (const file of actualSecurityFiles) {
+        if (expected.get(file.path) !== file.size)
+            throw new Error(`Commercial Security npm package file ${file.path} has an unexpected size.`);
+    }
+    for (const path of expected.keys()) {
+        if (!seen.has(path))
+            throw new Error(`Commercial Security npm package is missing ${path}.`);
+    }
+}
+function verifyPackedTarballDigest(pack, tarball) {
+    const sha1 = (0, node_crypto_1.createHash)('sha1').update(tarball).digest('hex');
+    const integrity = `sha512-${(0, node_crypto_1.createHash)('sha512').update(tarball).digest('base64')}`;
+    if (pack.shasum !== sha1 || pack.integrity !== integrity) {
+        throw new Error('Commercial Security npm tarball digest does not match npm pack output.');
+    }
+}
+//# sourceMappingURL=package-verifier.js.map

package/dist/security/package-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-verifier.js","sourceRoot":"","sources":["../../src/security/package-verifier.ts"],"names":[],"mappings":";;AAqBA,4EAOC;AAED,oEAmCC;AAED,8DAMC;AAzED,6CAAyC;AACzC,yCAAyC;AAGzC,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAC9B,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,kBAAkB;CACpH,CAAC,CAAC;AAcH,SAAgB,gCAAgC,CAAC,SAAiB,EAAE,UAAkB;IACpF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAA,mBAAO,EAAC,UAAU,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,eAAG,EAAE,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAgB,4BAA4B,CAC1C,IAAmB,EACnB,UAAsC,EACtC,aAAqB;IAErB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;WAC5E,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;WAC1D,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;WAC3E,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;eAC/E,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC/H,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,IAAI,kCAAkC,CAAC,CAAC;QAChJ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,2DAA2D,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiB,CAAC,CAAC,GAAG,MAAM,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/F,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAChG,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,IAAI,mBAAmB,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrJ,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;IAC1I,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,GAAG,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CAAC,IAAmB,EAAE,OAAmB;IAChF,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,UAAU,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/security/package-verifier.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=package-verifier.test.d.ts.map

package/dist/security/package-verifier.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-verifier.test.d.ts","sourceRoot":"","sources":["../../src/security/package-verifier.test.ts"],"names":[],"mappings":""}

package/dist/security/package-verifier.test.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+const node_test_1 = __importDefault(require("node:test"));
+const package_verifier_js_1 = require("./package-verifier.js");
+function inspection() {
+    return {
+        artifactRoot: 'fixture', manifestSha256: 'f'.repeat(64),
+        manifest: {
+            format: 'lattice-security-artifact-v1', sourceCommit: 'a'.repeat(40),
+            identity: {
+                vsgVersion: '1.0.2', profileId: 'commercial-default', profileVersion: '1.0.0',
+                rulesDigest: '1'.repeat(64), registryDigest: '2'.repeat(64), commercialManifestDigest: '3'.repeat(64),
+                evaluatorDigest: '4'.repeat(64), catalogDigest: '5'.repeat(64),
+            },
+            entryPoint: 'bin/vsg.mjs', exporterPath: 'src/lattice/export.mjs',
+            transportPath: 'src/lattice/transport.mjs', evaluatorPath: 'lattice-runtime.mjs',
+            releaseEligibility: { status: 'approved', blockers: [] },
+            files: [{ path: 'bin/vsg.mjs', sha256: '6'.repeat(64), bytes: 12 }],
+        },
+    };
+}
+function pack() {
+    const bytes = new TextEncoder().encode('synthetic tarball');
+    return {
+        filename: 'latticeai-cli-0.8.4.tgz',
+        shasum: (0, node_crypto_1.createHash)('sha1').update(bytes).digest('hex'),
+        integrity: `sha512-${(0, node_crypto_1.createHash)('sha512').update(bytes).digest('base64')}`,
+        files: [
+            { path: 'package.json', size: 100 },
+            { path: 'dist/security-runtime/artifact-manifest.json', size: 40 },
+            { path: 'dist/security-runtime/bin/vsg.mjs', size: 12 },
+        ],
+    };
+}
+(0, node_test_1.default)('synthetic approved package fixture requires the exact staged file list and matching tarball digests', () => {
+    const result = pack();
+    (0, package_verifier_js_1.verifySecurityPackageListing)(result, inspection(), 40);
+    (0, package_verifier_js_1.verifyPackedTarballDigest)(result, new TextEncoder().encode('synthetic tarball'));
+    strict_1.default.throws(() => (0, package_verifier_js_1.verifySecurityPackageListing)({ ...result, files: result.files.slice(0, -1) }, inspection(), 40), /file list/);
+    strict_1.default.throws(() => (0, package_verifier_js_1.verifySecurityPackageListing)({
+        ...result, files: [...result.files, { path: 'dist/security-runtime/src/RAW/secret', size: 1 }],
+    }, inspection(), 40), /forbidden path/);
+    strict_1.default.throws(() => (0, package_verifier_js_1.verifyPackedTarballDigest)(result, new TextEncoder().encode('changed')), /digest/);
+});
+(0, node_test_1.default)('requires retained verified output outside the temporary staged runtime', () => {
+    const stage = (0, node_path_1.resolve)('fixture', 'package', 'dist', 'security-runtime');
+    strict_1.default.throws(() => (0, package_verifier_js_1.assertVerifiedOutputOutsideStage)(stage, stage), /outside dist\/security-runtime/);
+    strict_1.default.throws(() => (0, package_verifier_js_1.assertVerifiedOutputOutsideStage)(stage, (0, node_path_1.join)(stage, 'verified')), /outside dist\/security-runtime/);
+    strict_1.default.doesNotThrow(() => (0, package_verifier_js_1.assertVerifiedOutputOutsideStage)(stage, (0, node_path_1.resolve)('fixture', 'verified-package')));
+});
+//# sourceMappingURL=package-verifier.test.js.map

package/dist/security/package-verifier.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-verifier.test.js","sourceRoot":"","sources":["../../src/security/package-verifier.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,6CAAyC;AACzC,yCAA0C;AAC1C,0DAA6B;AAC7B,+DAK+B;AAG/B,SAAS,UAAU;IACjB,OAAO;QACL,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE;YACR,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,OAAO;gBAC7E,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrG,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;aAC/D;YACD,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB;YACjE,aAAa,EAAE,2BAA2B,EAAE,aAAa,EAAE,qBAAqB;YAChF,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;YACxD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;SACpE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI;IACX,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC5D,OAAO;QACL,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACtD,SAAS,EAAE,UAAU,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC1E,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE;YACnC,EAAE,IAAI,EAAE,8CAA8C,EAAE,IAAI,EAAE,EAAE,EAAE;YAClE,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,EAAE,EAAE;SACxD;KACF,CAAC;AACJ,CAAC;AAED,IAAA,mBAAI,EAAC,qGAAqG,EAAE,GAAG,EAAE;IAC/G,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;IACtB,IAAA,kDAA4B,EAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,IAAA,+CAAyB,EAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACjF,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,kDAA4B,EAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IAClI,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,kDAA4B,EAAC;QAC/C,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;KAC/F,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACxC,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,+CAAyB,EAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACxE,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,sDAAgC,EAAC,KAAK,EAAE,KAAK,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACtG,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,sDAAgC,EAAC,KAAK,EAAE,IAAA,gBAAI,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACxH,gBAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAA,sDAAgC,EAAC,KAAK,EAAE,IAAA,mBAAO,EAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAC7G,CAAC,CAAC,CAAC"}

package/dist/security/runtime.d.ts

@@ -0,0 +1,43 @@
+import { spawn } from 'node:child_process';
+import type { SecurityArtifactInspection } from './artifact.js';
+import type { SecurityRunMode } from './types.js';
+export interface RunSecurityRuntimeOptions {
+    inspection: SecurityArtifactInspection;
+    repo: string;
+    outDir: string;
+    runId: string;
+    mode: SecurityRunMode;
+    repositoryIdentity: string;
+    validateCredentials?: boolean;
+    releaseUrl?: string;
+    base?: string;
+    compare?: string;
+    env?: NodeJS.ProcessEnv;
+    spawnProcess?: typeof spawn;
+}
+export interface ExportSecurityReportOptions {
+    inspection: SecurityArtifactInspection;
+    repo: string;
+    outDir: string;
+    runId: string;
+    mode: SecurityRunMode;
+    repositoryIdentity: string;
+    writeLocalReport?: boolean;
+}
+declare function scrubRuntimeEnvironment(source: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function runSecurityRuntime(options: RunSecurityRuntimeOptions): Promise<{
+    exitCode: 0 | 1 | 2 | 3;
+    report: unknown | null;
+    compactReport: unknown | null;
+    reportPath: string | null;
+}>;
+export declare function exportSecurityReport(options: ExportSecurityReportOptions): Promise<{
+    report: unknown;
+    compactReport: unknown;
+    reportPath: string;
+}>;
+export declare const securityRuntimeInternals: {
+    scrubRuntimeEnvironment: typeof scrubRuntimeEnvironment;
+};
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/security/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/security/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAI3C,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAiBlD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,0BAA0B,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,0BAA0B,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,iBAAS,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAM7E;AAQD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC;IACpF,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC,CA2BD;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACxF,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,CAuBD;AAED,eAAO,MAAM,wBAAwB;;CAA8B,CAAC"}

package/dist/security/runtime.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityRuntimeInternals = void 0;
+exports.runSecurityRuntime = runSecurityRuntime;
+exports.exportSecurityReport = exportSecurityReport;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
+function scrubRuntimeEnvironment(source) {
+    const result = { ...source };
+    for (const key of Object.keys(result)) {
+        if (/^LATTICE_/i.test(key))
+            delete result[key];
+    }
+    return result;
+}
+async function importFrozenModule(file, expectedExport) {
+    const module = await import((0, node_url_1.pathToFileURL)(file).href);
+    if (typeof module[expectedExport] !== 'function')
+        throw new Error(`Security runtime module is missing ${expectedExport}.`);
+    return module;
+}
+async function runSecurityRuntime(options) {
+    const artifactRoot = options.inspection.artifactRoot;
+    const entryPoint = (0, node_path_1.join)(artifactRoot, ...options.inspection.manifest.entryPoint.split('/'));
+    const repo = (0, node_path_1.resolve)(options.repo);
+    const outDir = (0, node_path_1.resolve)(options.outDir);
+    const argv = [entryPoint, options.mode, repo, '--out', outDir];
+    if ((options.mode === 'deep' || options.mode === 'release') && !options.validateCredentials)
+        argv.push('--no-validate');
+    if (options.mode === 'release' && options.releaseUrl)
+        argv.push('--url', options.releaseUrl);
+    if (options.base && options.mode !== 'report')
+        argv.push('--base', options.base);
+    if (options.compare && options.mode !== 'report')
+        argv.push('--compare', options.compare);
+    const exitCode = await new Promise((resolveExit, reject) => {
+        const child = (options.spawnProcess ?? node_child_process_1.spawn)(process.execPath, argv, {
+            cwd: repo,
+            env: scrubRuntimeEnvironment(options.env ?? process.env),
+            shell: false,
+            stdio: 'inherit',
+            windowsHide: true,
+        });
+        child.once('error', reject);
+        child.once('exit', (code, signal) => resolveExit(signal ? 2 : (code ?? 2)));
+    });
+    if (![0, 1, 2, 3].includes(exitCode))
+        throw new Error(`Security runtime returned unsupported exit code ${exitCode}.`);
+    if (exitCode === 3)
+        return { exitCode, report: null, compactReport: null, reportPath: null };
+    const exported = await exportSecurityReport({ ...options, repo, outDir, writeLocalReport: true });
+    return { exitCode: exitCode, ...exported };
+}
+async function exportSecurityReport(options) {
+    const artifactRoot = options.inspection.artifactRoot;
+    const exporterFile = (0, node_path_1.join)(artifactRoot, ...options.inspection.manifest.exporterPath.split('/'));
+    const transportFile = (0, node_path_1.join)(artifactRoot, ...options.inspection.manifest.transportPath.split('/'));
+    const repo = (0, node_path_1.resolve)(options.repo);
+    const outDir = (0, node_path_1.resolve)(options.outDir);
+    const exporter = await importFrozenModule(exporterFile, 'exportLatticeReport');
+    const transport = await importFrozenModule(transportFile, 'encodeLatticeReportV3');
+    const report = await exporter.exportLatticeReport({
+        repo,
+        outDir,
+        runId: options.runId,
+        mode: options.mode,
+        artifactRoot,
+        repositoryIdentity: options.repositoryIdentity,
+    });
+    const compactReport = transport.encodeLatticeReportV3(report);
+    const reportPath = (0, node_path_1.join)(outDir, 'lattice-report.json');
+    if (options.writeLocalReport !== false) {
+        await node_fs_1.promises.mkdir((0, node_path_1.dirname)(reportPath), { recursive: true });
+        await node_fs_1.promises.writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`, { encoding: 'utf8', flag: 'w' });
+    }
+    return { report, compactReport, reportPath };
+}
+exports.securityRuntimeInternals = { scrubRuntimeEnvironment };
+//# sourceMappingURL=runtime.js.map

package/dist/security/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/security/runtime.ts"],"names":[],"mappings":";;;AA6DA,gDAgCC;AAED,oDA2BC;AA1HD,2DAA2C;AAC3C,qCAAyC;AACzC,yCAAmD;AACnD,uCAAyC;AA4CzC,SAAS,uBAAuB,CAAC,MAAyB;IACxD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAI,IAAY,EAAE,cAAsB;IACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC,IAAI,CAA4B,CAAC;IACjF,IAAI,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,GAAG,CAAC,CAAC;IAC3H,OAAO,MAAW,CAAC;AACrB,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,OAAkC;IAMzE,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IACrD,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxH,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1F,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE;QACjE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,0BAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;YACpE,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,uBAAuB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;YACxD,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,GAAG,CAAC,CAAC;IACtH,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAE7F,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IAClG,OAAO,EAAE,QAAQ,EAAE,QAAyB,EAAE,GAAG,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,OAAoC;IAK7E,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IACrD,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAwB,YAAY,EAAE,qBAAqB,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAyB,aAAa,EAAE,uBAAuB,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC;QAChD,IAAI;QACJ,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;QACvC,MAAM,kBAAE,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,kBAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC;AAEY,QAAA,wBAAwB,GAAG,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/security/runtime.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runtime.test.d.ts.map

package/dist/security/runtime.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.test.d.ts","sourceRoot":"","sources":["../../src/security/runtime.test.ts"],"names":[],"mappings":""}