@ploaness/cli 1.6.0 → 1.7.0

package/dist/sbom.js

@@ -0,0 +1,183 @@
+import { createHash } from 'node:crypto';
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { CONTAINER_IMAGES, canonicalInventory, readKey, SBOM_SCOPE, sbomInputProblems, sbomProblems, sbomWithWorkspaceRoles, } from '@ploaness/governance';
+import { parseAllDocuments } from 'yaml';
+import { acquireImage } from './checks/container-run.js';
+import { git } from './context.js';
+import { run } from './exec.js';
+import { workingTreeFingerprint } from './working-tree.js';
+const JSON_INDENT = 2;
+const SBOM_TIMEOUT_MS = 300_000;
+const IMAGE = CONTAINER_IMAGES.cdxgen;
+const hashFile = (file) => createHash('sha256').update(readFileSync(file)).digest('hex');
+const readJson = (file) => JSON.parse(readFileSync(file, 'utf8'));
+const lockDocument = (file) => {
+    const documents = parseAllDocuments(readFileSync(file, 'utf8'));
+    if (documents.length === 0 || documents.some((document) => document.errors.length > 0)) {
+        throw new Error(`${file} is not a readable pnpm lockfile`);
+    }
+    return documents.at(-1)?.toJS();
+};
+const assertInputs = (repository) => {
+    const problems = sbomInputProblems(repository.projects, lockDocument(path.join(repository.root, 'pnpm-lock.yaml')), lockDocument(path.join(repository.root, 'node_modules/.pnpm/lock.yaml')), existsSync(path.join(repository.root, 'pnpm-workspace.yaml'))
+        ? lockDocument(path.join(repository.root, 'pnpm-workspace.yaml'))
+        : {});
+    if (problems.length > 0) {
+        throw new Error(problems.join('\n'));
+    }
+};
+// Resolve existing ancestors so an ignored symlink cannot direct output into authored content.
+const resolvedDestination = (directory) => existsSync(directory)
+    ? realpathSync(directory)
+    : path.join(resolvedDestination(path.dirname(directory)), path.basename(directory));
+const outputDirectory = (repository, requested) => {
+    const directory = resolvedDestination(path.resolve(requested));
+    const relative = path.relative(realpathSync(repository.root), directory);
+    const isInside = relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+    if (isInside) {
+        const ignored = ['bom.cdx.json', 'release.json', 'bom.cdx.json.tmp', 'release.json.tmp'].map((file) => run('git', ['check-ignore', '--quiet', '--', path.join(directory, file)], {
+            cwd: repository.root,
+        }));
+        const tracked = git(repository, ['ls-files', '--', relative]);
+        if (ignored.some((result) => result.code !== 0) || tracked.length > 0) {
+            throw new Error('SBOM output must be in an ignored artifact directory or outside the repository');
+        }
+    }
+    return directory;
+};
+const mirrorInputs = (repository, directory) => {
+    const files = [
+        ...new Set([
+            'package.json',
+            'pnpm-lock.yaml',
+            ...(existsSync(path.join(repository.root, 'pnpm-workspace.yaml')) ? ['pnpm-workspace.yaml'] : []),
+            ...repository.projects.map((project) => path.join(project.path, 'package.json')),
+        ]),
+    ];
+    for (const file of files) {
+        const destination = path.join(directory, file);
+        mkdirSync(path.dirname(destination), { recursive: true });
+        copyFileSync(path.join(repository.root, file), destination);
+    }
+};
+// Linux bind mounts retain host ownership, including private lockfiles and output directories.
+// Docker Desktop handles the ownership mapping on hosts without POSIX user identities.
+const containerUserArguments = () => {
+    const uid = process.geteuid?.();
+    const gid = process.getegid?.();
+    return uid === undefined || gid === undefined ? [] : ['--user', `${String(uid)}:${String(gid)}`];
+};
+const generate = (repository, directory) => {
+    const input = path.join(directory, 'input');
+    const output = path.join(directory, 'output');
+    mkdirSync(input);
+    mkdirSync(output);
+    mirrorInputs(repository, input);
+    const result = run('docker', [
+        'run',
+        '--rm',
+        '--network=none',
+        ...containerUserArguments(),
+        '-v',
+        `${input}:/workspace:ro`,
+        '-v',
+        `${output}:/output`,
+        '-w',
+        '/workspace',
+        '-e',
+        'FETCH_LICENSE=false',
+        '-e',
+        'CDXGEN_FETCH_PKG_METADATA=false',
+        IMAGE,
+        '-t',
+        'js',
+        '--recurse',
+        '--no-install-deps',
+        '--no-babel',
+        '--fail-on-error',
+        '--validate',
+        '--spec-version',
+        '1.6',
+        '-o',
+        '/output/bom.cdx.json',
+        '/workspace',
+    ], { cwd: repository.root, timeoutMs: SBOM_TIMEOUT_MS });
+    if (result.code !== 0) {
+        throw new Error(`SBOM generation failed: ${result.output}`);
+    }
+    const bom = readJson(path.join(output, 'bom.cdx.json'));
+    const problems = sbomProblems(bom);
+    if (problems.length > 0) {
+        throw new Error(problems.join('\n'));
+    }
+    return sbomWithWorkspaceRoles(bom, repository.projects);
+};
+const artifactsOf = (arguments_) => arguments_.artifacts.map((file) => {
+    const absolute = realpathSync(path.resolve(file));
+    if (!statSync(absolute).isFile()) {
+        throw new Error(`release artifact is not a file: ${file}`);
+    }
+    return { path: path.basename(absolute), sha256: hashFile(absolute) };
+});
+const rejectArtifactOutputs = (arguments_, directory) => {
+    const outputs = new Set(['bom.cdx.json', 'release.json', 'bom.cdx.json.tmp', 'release.json.tmp'].map((file) => path.join(directory, file)));
+    if (arguments_.artifacts.some((file) => outputs.has(realpathSync(path.resolve(file))))) {
+        throw new Error('release artifacts must not be overwritten by the SBOM output files');
+    }
+};
+const publishReports = (directory, reports) => {
+    mkdirSync(directory, { recursive: true });
+    for (const [name, report] of Object.entries(reports)) {
+        const temporary = path.join(directory, `${name}.tmp`);
+        writeFileSync(temporary, `${JSON.stringify(report, null, JSON_INDENT)}\n`, { flag: 'wx' });
+        renameSync(temporary, path.join(directory, name));
+    }
+};
+/** Generate inventory and source metadata; supplied artifacts add release associations. */
+export const writeSbom = (repository, arguments_) => {
+    const before = workingTreeFingerprint(repository.root);
+    const destination = outputDirectory(repository, arguments_.output);
+    rejectArtifactOutputs(arguments_, destination);
+    const artifacts = artifactsOf(arguments_);
+    if (new Set(artifacts.map((artifact) => artifact.path)).size !== artifacts.length) {
+        throw new Error('release artifact filenames must be distinct');
+    }
+    assertInputs(repository);
+    const unavailable = acquireImage(repository, IMAGE, 'SBOM generation');
+    if (unavailable !== undefined) {
+        throw new Error([unavailable.summary, ...unavailable.findings].join('\n'));
+    }
+    const temporary = mkdtempSync(path.join(homedir(), '.ploaness-sbom-'));
+    try {
+        const bom = generate(repository, temporary);
+        if (before !== workingTreeFingerprint(repository.root)) {
+            throw new Error('the authored tree changed during SBOM generation; regenerate from stable inputs');
+        }
+        if (canonicalInventory(artifacts) !== canonicalInventory(artifactsOf(arguments_))) {
+            throw new Error('release artifact bytes changed during SBOM generation');
+        }
+        const text = `${JSON.stringify(bom, null, JSON_INDENT)}\n`;
+        publishReports(destination, {
+            'bom.cdx.json': bom,
+            'release.json': {
+                schemaVersion: 1,
+                sourceCommit: git(repository, ['rev-parse', 'HEAD']).trim(),
+                sourceDirty: git(repository, ['status', '--porcelain']).length > 0,
+                sourceFingerprint: before,
+                lockfileSha256: hashFile(path.join(repository.root, 'pnpm-lock.yaml')),
+                generator: { image: IMAGE, tool: readKey(readKey(bom, 'metadata'), 'tools') },
+                scope: SBOM_SCOPE,
+                sbomSha256: createHash('sha256').update(text).digest('hex'),
+                artifacts,
+            },
+        });
+        return destination;
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+};
+//# sourceMappingURL=sbom.js.map

package/dist/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../src/sbom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAElB,OAAO,EACP,UAAU,EAEV,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAA;AACnD,OAAO,EAAmC,GAAG,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,GAAW,CAAC,CAAA;AAC7B,MAAM,eAAe,GAAW,OAAO,CAAA;AACvC,MAAM,KAAK,GAAW,gBAAgB,CAAC,MAAM,CAAA;AAE7C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxG,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAElF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC7C,MAAM,SAAS,GAAyC,iBAAiB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IACrG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;AACjC,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,UAAsB,EAAQ,EAAE;IACpD,MAAM,QAAQ,GAAsB,iBAAiB,CACnD,UAAU,CAAC,QAAQ,EACnB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAC1D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC,EACxE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC3D,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACjE,CAAC,CAAC,EAAE,CACP,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACtC,CAAC;AACH,CAAC,CAAA;AAED,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAU,EAAE,CACxD,UAAU,CAAC,SAAS,CAAC;IACnB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC;IACzB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;AAEvF,MAAM,eAAe,GAAG,CAAC,UAAsB,EAAE,SAAiB,EAAU,EAAE;IAC5E,MAAM,SAAS,GAAW,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;IACtE,MAAM,QAAQ,GAAW,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAA;IAChF,MAAM,QAAQ,GACZ,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/G,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAyB,CAAC,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAChH,CAAC,IAAY,EAAa,EAAE,CAC1B,GAAG,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE;YACxE,GAAG,EAAE,UAAU,CAAC,IAAI;SACrB,CAAC,CACL,CAAA;QACD,MAAM,OAAO,GAAW,GAAG,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAiB,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,UAAsB,EAAE,SAAiB,EAAQ,EAAE;IACvE,MAAM,KAAK,GAAsB;QAC/B,GAAG,IAAI,GAAG,CAAC;YACT,cAAc;YACd,gBAAgB;YAChB,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;SACzF,CAAC;KACH,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,WAAW,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACtD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,CAAA;IAC7D,CAAC;AACH,CAAC,CAAA;AAED,+FAA+F;AAC/F,uFAAuF;AACvF,MAAM,sBAAsB,GAAG,GAAsB,EAAE;IACrD,MAAM,GAAG,GAAuB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAA;IACnD,MAAM,GAAG,GAAuB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAA;IACnD,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAClG,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,UAAsB,EAAE,SAAiB,EAAW,EAAE;IACtE,MAAM,KAAK,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,MAAM,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACrD,SAAS,CAAC,KAAK,CAAC,CAAA;IAChB,SAAS,CAAC,MAAM,CAAC,CAAA;IACjB,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAc,GAAG,CAC3B,QAAQ,EACR;QACE,KAAK;QACL,MAAM;QACN,gBAAgB;QAChB,GAAG,sBAAsB,EAAE;QAC3B,IAAI;QACJ,GAAG,KAAK,gBAAgB;QACxB,IAAI;QACJ,GAAG,MAAM,UAAU;QACnB,IAAI;QACJ,YAAY;QACZ,IAAI;QACJ,qBAAqB;QACrB,IAAI;QACJ,iCAAiC;QACjC,KAAK;QACL,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,mBAAmB;QACnB,YAAY;QACZ,iBAAiB;QACjB,YAAY;QACZ,gBAAgB;QAChB,KAAK;QACL,IAAI;QACJ,sBAAsB;QACtB,YAAY;KACb,EACD,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,CACrD,CAAA;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,GAAG,GAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;IAChE,MAAM,QAAQ,GAAsB,YAAY,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,UAAyB,EAA8B,EAAE,CAC5E,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;IACxC,MAAM,QAAQ,GAAW,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;AACtE,CAAC,CAAC,CAAA;AAEJ,MAAM,qBAAqB,GAAG,CAAC,UAAyB,EAAE,SAAiB,EAAQ,EAAE;IACnF,MAAM,OAAO,GAAwB,IAAI,GAAG,CAC1C,CAAC,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CACpG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAC3B,CACF,CAAA;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IACvF,CAAC;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,OAA0C,EAAQ,EAAE;IAC7F,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;QAC7D,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1F,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;IACnD,CAAC;AACH,CAAC,CAAA;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAAsB,EAAE,UAAyB,EAAU,EAAE;IACrF,MAAM,MAAM,GAAW,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,WAAW,GAAW,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAC1E,qBAAqB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC9C,MAAM,SAAS,GAA+B,WAAW,CAAC,UAAU,CAAC,CAAA;IACrE,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAyB,EAAU,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,YAAY,CAAC,UAAU,CAAC,CAAA;IACxB,MAAM,WAAW,GAA2B,YAAY,CAAC,UAAU,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAA;IAC9F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,SAAS,GAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC9E,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAA;QACpG,CAAC;QACD,IAAI,kBAAkB,CAAC,SAAS,CAAC,KAAK,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QACD,MAAM,IAAI,GAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAA;QAClE,cAAc,CAAC,WAAW,EAAE;YAC1B,cAAc,EAAE,GAAG;YACnB,cAAc,EAAE;gBACd,aAAa,EAAE,CAAC;gBAChB,YAAY,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;gBAC3D,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;gBAClE,iBAAiB,EAAE,MAAM;gBACzB,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBACtE,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE;gBAC7E,KAAK,EAAE,UAAU;gBACjB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC3D,SAAS;aACV;SACF,CAAC,CAAA;QACF,OAAO,WAAW,CAAA;IACpB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ploaness/cli",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "The executable half of ploaness: the verification gates and the commands that run them.",
   "license": "MIT",
   "author": "Herman Ciechanowiec <herman@ciechanowiec.eu>",
@@ -32,19 +32,20 @@
   ],
   "dependencies": {
     "@biomejs/biome": "2.5.15",
-    "@ploaness/assets": "1.6.0",
-    "@ploaness/config": "1.6.0",
-    "@ploaness/governance": "1.6.0",
+    "@ploaness/assets": "1.7.0",
+    "@ploaness/config": "1.7.0",
+    "@ploaness/governance": "1.7.0",
     "@vitest/coverage-v8": "5.0.3",
     "dependency-cruiser": "18.5.0",
     "eslint": "10.12.0",
-    "knip": "6.39.0",
-    "oxlint": "1.86.0",
+    "knip": "6.40.0",
+    "oxlint": "1.87.0",
     "stylelint": "17.16.0",
     "tsx": "4.23.15",
     "type-coverage": "2.30.3",
     "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "vitest": "5.0.3",
+    "yaml": "2.9.1"
   },
   "engines": {
     "node": ">=26"