@promptci/core 0.0.1 → 0.2.0

package/dist/security-pack.js

@@ -1,6 +1,10 @@
 import * as crypto from 'node:crypto';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
+import { matchEvidence } from './evidence.js';
+import { PROMPTCI_GITIGNORE_BLOCK, PROMPTCI_GITIGNORE_LINES } from './promptci-gitignore.js';
+import { fileIdPath } from './finding-id.js';
+import { realPathWithinRoot } from './path-containment.js';
 const SECURITY_CHECKS = [
     {
         id: 'no-secret-safeguard',
@@ -119,7 +123,7 @@ function matchesAny(text, patterns) {
  * block the match, but a differently-named file/dir never accidentally
  * satisfies it).
  */
-function gitignoreLineMatchesTarget(line, target) {
+export function gitignoreLineMatchesTarget(line, target) {
     if (line.startsWith('!'))
         return false;
     const clean = line.replace(/^\/+|\/+$/g, '');
@@ -243,7 +247,7 @@ export function detectSecurityPack(context) {
                 ];
                 if (!matchesAny(file.content, safetyPatterns)) {
                     issues.push({
-                        id: destructiveCommandIssueId(file.path, cmd.name),
+                        id: destructiveCommandIssueId(fileIdPath(file), cmd.name),
                         severity: 'warning',
                         category: 'security',
                         title: `Destructive command "${cmd.name}" without safety language`,
@@ -264,7 +268,7 @@ export function detectSecurityPack(context) {
     const gitignorePath = path.join(/*turbopackIgnore: true*/ repoRoot, '.gitignore');
     let gitignoreContent = '';
     try {
-        if (fs.existsSync(gitignorePath)) {
+        if (fs.existsSync(gitignorePath) && realPathWithinRoot(repoRoot, gitignorePath)) {
             gitignoreContent = fs.readFileSync(gitignorePath, 'utf8');
         }
     }
@@ -287,8 +291,18 @@ export function detectSecurityPack(context) {
             filePaths: ['.gitignore'],
             locations: [],
             evidence: ['.promptci/ entry not found in .gitignore'],
-            recommendation: 'Add `.promptci/` to your `.gitignore` file to prevent committing generated reports.',
-            fixRecipe: 'echo ".promptci/" >> .gitignore',
+            // BUG-7: recommend the carve-out, not a bare `.promptci/`. Ignoring the
+            // whole directory also ignores baseline.json, and `--baseline` /
+            // `--fail-on-new` need that file committed and readable in CI.
+            recommendation: 'Add the following to `.gitignore` so generated reports stay out of git while the shared ' +
+                'baseline and config remain committed:\n' +
+                PROMPTCI_GITIGNORE_LINES.map((l) => `    ${l}`).join('\n') +
+                '\n\nUse `.promptci/*` rather than `.promptci/` — git does not descend into an ignored ' +
+                'directory, so the `!` negations only work against the directory\'s contents.',
+            fixRecipe: PROMPTCI_GITIGNORE_BLOCK,
+            // `applyFixRecipe` appends the baseline-preserving stanza deterministically
+            // — a mechanical, reversible edit, so `promptci fix` may auto-apply it.
+            autoApplySafe: true,
             confidence: 0.9,
         });
     }
@@ -324,6 +338,9 @@ export function detectSecurityPack(context) {
             evidence: unignoredDirs.map((d) => `Directory "${d}" exists but is not ignored in .gitignore.`),
             recommendation: `Add generated directories to .gitignore. For example: "${unignoredDirs.map((d) => `${d}/`).join(', ')}"`,
             fixRecipe: unignoredDirs.map((d) => `echo "${d}/" >> .gitignore`).join('\n'),
+            // `applyFixRecipe` appends each missing directory to .gitignore — a
+            // mechanical, reversible edit, so `promptci fix` may auto-apply it.
+            autoApplySafe: true,
             confidence: 0.8,
         });
     }
@@ -331,7 +348,7 @@ export function detectSecurityPack(context) {
     let hasBroadInclude = false;
     try {
         const configPath = path.join(/*turbopackIgnore: true*/ repoRoot, '.promptci', 'config.json');
-        if (fs.existsSync(configPath)) {
+        if (fs.existsSync(configPath) && realPathWithinRoot(repoRoot, configPath)) {
             const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
             if (Array.isArray(config.include)) {
                 const broadPatterns = ['**/*', '**/*.md', '*', '*.*', '**'];
@@ -368,20 +385,22 @@ export function detectSecurityPack(context) {
     }
     // 9. Inspect generated reports before source docs (Cost 9)
     for (const file of files) {
+        // BUG-20: each pattern carries a human label so evidence can quote the
+        // matched instruction text instead of the regex source.
         const inspectBeforePatterns = [
-            /read\s+.*\.promptci\s+before/i,
-            /inspect\s+.*\.promptci\s+before/i,
-            /check\s+.*\.promptci\s+before/i,
-            /read\s+.*report.*\s+before\s+.*(source|docs|code)/i,
-            /inspect\s+.*report.*\s+before\s+.*(source|docs|code)/i,
+            { re: /read\s+.*\.promptci\s+before/i, label: 'Instruction to read .promptci reports first' },
+            { re: /inspect\s+.*\.promptci\s+before/i, label: 'Instruction to inspect .promptci reports first' },
+            { re: /check\s+.*\.promptci\s+before/i, label: 'Instruction to check .promptci reports first' },
+            { re: /read\s+.*report.*\s+before\s+.*(source|docs|code)/i, label: 'Instruction to read generated reports before source' },
+            { re: /inspect\s+.*report.*\s+before\s+.*(source|docs|code)/i, label: 'Instruction to inspect generated reports before source' },
         ];
         for (const pat of inspectBeforePatterns) {
-            if (pat.test(file.content)) {
+            if (pat.re.test(file.content)) {
                 issues.push({
                     // SP1 / B3: was a constant id inside this per-file loop — the
                     // `break` below only exits the pattern loop, not the file loop, so
                     // two matching files produced two issues sharing ONE id.
-                    id: inspectReportsFirstIssueId(file.path),
+                    id: inspectReportsFirstIssueId(fileIdPath(file)),
                     severity: 'info',
                     category: 'context_bloat',
                     title: 'Instruction prioritizing generated reports over source docs',
@@ -389,7 +408,7 @@ export function detectSecurityPack(context) {
                         `generated reports before source files, which can cause circular or outdated guidance ingestion.`,
                     filePaths: [file.path],
                     locations: [],
-                    evidence: [`Matched pattern: ${pat.toString()}`],
+                    evidence: [matchEvidence(file.content, pat.re, pat.label)],
                     recommendation: 'Recommend linking to latest reports or directing the agent to read source documents first instead of generated reports.',
                     fixRecipe: 'Update the instruction to prioritize reading source files and configuration rather than relying on generated reports.',
                     confidence: 0.7,

package/dist/security-pack.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-pack.js","sourceRoot":"","sources":["../src/security-pack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAgB9B,MAAM,eAAe,GAAoB;IACvC;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,sCAAsC;QAC7C,OAAO,EACL,8EAA8E;YAC9E,qDAAqD;QACvD,QAAQ,EAAE;YACR,iFAAiF;YACjF,oFAAoF;YACpF,+BAA+B;YAC/B,2BAA2B;SAC5B;QACD,cAAc,EACZ,gFAAgF;YAChF,yFAAyF;QAC3F,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,iJAAiJ;KAC7J;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,yCAAyC;QAChD,OAAO,EACL,6EAA6E;YAC7E,qDAAqD;QACvD,QAAQ,EAAE;YACR,sEAAsE;YACtE,6CAA6C;YAC7C,+CAA+C;SAChD;QACD,cAAc,EACZ,+GAA+G;QACjH,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,6GAA6G;KACzH;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,iDAAiD;QACxD,OAAO,EACL,8EAA8E;YAC9E,qDAAqD;QACvD,QAAQ,EAAE;YACR,gDAAgD;YAChD,kCAAkC;YAClC,sBAAsB;YACtB,wBAAwB;SACzB;QACD,cAAc,EACZ,2FAA2F;QAC7F,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,6HAA6H;KACzI;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,KAAK,EAAE,0CAA0C;QACjD,OAAO,EACL,uEAAuE;YACvE,oDAAoD;QACtD,QAAQ,EAAE;YACR,iCAAiC;YACjC,8BAA8B;YAC9B,yDAAyD;SAC1D;QACD,cAAc,EACZ,2EAA2E;QAC7E,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,qDAAqD;KACjE;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B;QACE,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,QAAQ;KACf;IACD;QACE,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,YAAY;KACnB;IACD;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,kBAAkB;KACzB;CACF,CAAC;AAEF,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,uBAAuB,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvH,OAAO,uBAAuB,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,iFAAiF;AACjF,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9G,OAAO,uCAAuC,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,0BAA0B,CAAC,IAAY,EAAE,MAAc;IAC9D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAoB;IACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9C,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,qBAAqB,CAAE,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG;QACnB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY;QACnC,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe;QACtC,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB;KACxC,CAAC;IACF,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACrG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,uBAAuB,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3G,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,+BAA+B,CAAE,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,kFAAkF;IAClF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC/C,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,CACL,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC;YACtC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,yBAAyB,CAAE,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,iBAAiB,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACpG,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,8BAA8B,CAAE,CAAC;QAClF,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,uEAAuE,CAAC;gBACnF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,+DAA+D;gBAC/D,MAAM,cAAc,GAAG;oBACrB,gCAAgC;oBAChC,mBAAmB;oBACnB,sBAAsB;oBACtB,0BAA0B;oBAC1B,qBAAqB;iBACtB,CAAC;gBAEF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC9C,MAAM,CAAC,IAAI,CAAC;wBACV,EAAE,EAAE,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;wBAClD,QAAQ,EAAE,SAAS;wBACnB,QAAQ,EAAE,UAAU;wBACpB,KAAK,EAAE,wBAAwB,GAAG,CAAC,IAAI,2BAA2B;wBAClE,OAAO,EACL,oDAAoD,GAAG,CAAC,IAAI,cAAc;4BAC1E,+CAA+C;wBACjD,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;wBACtB,SAAS,EAAE,EAAE,EAAE,sCAAsC;wBACrD,QAAQ,EAAE,CAAC,wBAAwB,GAAG,CAAC,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC7G,cAAc,EACZ,oEAAoE,GAAG,CAAC,IAAI,IAAI;4BAChF,kEAAkE;wBACpE,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,gBAAgB,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB;SACpC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAE1G,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,qCAAqC;YACzC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,yCAAyC;YAChD,OAAO,EACL,2EAA2E;gBAC3E,4DAA4D;YAC9D,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,CAAC,0CAA0C,CAAC;YACtD,cAAc,EAAE,qFAAqF;YACrG,SAAS,EAAE,iCAAiC;YAC5C,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACvB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBACrF,OAAO,CAAC,SAAS,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,8BAA8B;YAClC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,kDAAkD;YACzD,OAAO,EACL,kDAAkD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;gBACvF,+EAA+E;gBAC/E,wBAAwB;YAC1B,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,4CAA4C,CAAC;YAC/F,cAAc,EAAE,0DAA0D,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACzH,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC7F,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC5D,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1F,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACzB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACvB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,6BAA6B;gBACjC,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,eAAe;gBACzB,KAAK,EAAE,sDAAsD;gBAC7D,OAAO,EACL,wFAAwF;oBACxF,4EAA4E;gBAC9E,SAAS,EAAE,CAAC,uBAAuB,CAAC;gBACpC,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACjJ,cAAc,EAAE,yHAAyH;gBACzI,SAAS,EAAE,mHAAmH;gBAC9H,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,qBAAqB,GAAG;YAC5B,+BAA+B;YAC/B,kCAAkC;YAClC,gCAAgC;YAChC,oDAAoD;YACpD,uDAAuD;SACxD,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,8DAA8D;oBAC9D,mEAAmE;oBACnE,yDAAyD;oBACzD,EAAE,EAAE,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;oBACzC,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,eAAe;oBACzB,KAAK,EAAE,6DAA6D;oBACpE,OAAO,EACL,qBAAqB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;wBAC5E,iGAAiG;oBACnG,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtB,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,CAAC,oBAAoB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAChD,cAAc,EAAE,yHAAyH;oBACzI,SAAS,EAAE,uHAAuH;oBAClI,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;gBACH,MAAM,CAAC,qBAAqB;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"security-pack.js","sourceRoot":"","sources":["../src/security-pack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAc3D,MAAM,eAAe,GAAoB;IACvC;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,sCAAsC;QAC7C,OAAO,EACL,8EAA8E;YAC9E,qDAAqD;QACvD,QAAQ,EAAE;YACR,iFAAiF;YACjF,oFAAoF;YACpF,+BAA+B;YAC/B,2BAA2B;SAC5B;QACD,cAAc,EACZ,gFAAgF;YAChF,yFAAyF;QAC3F,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,iJAAiJ;KAC7J;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,yCAAyC;QAChD,OAAO,EACL,6EAA6E;YAC7E,qDAAqD;QACvD,QAAQ,EAAE;YACR,sEAAsE;YACtE,6CAA6C;YAC7C,+CAA+C;SAChD;QACD,cAAc,EACZ,+GAA+G;QACjH,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,6GAA6G;KACzH;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,iDAAiD;QACxD,OAAO,EACL,8EAA8E;YAC9E,qDAAqD;QACvD,QAAQ,EAAE;YACR,gDAAgD;YAChD,kCAAkC;YAClC,sBAAsB;YACtB,wBAAwB;SACzB;QACD,cAAc,EACZ,2FAA2F;QAC7F,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,6HAA6H;KACzI;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,KAAK,EAAE,0CAA0C;QACjD,OAAO,EACL,uEAAuE;YACvE,oDAAoD;QACtD,QAAQ,EAAE;YACR,iCAAiC;YACjC,8BAA8B;YAC9B,yDAAyD;SAC1D;QACD,cAAc,EACZ,2EAA2E;QAC7E,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,qDAAqD;KACjE;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B;QACE,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,QAAQ;KACf;IACD;QACE,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,YAAY;KACnB;IACD;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,kBAAkB;KACzB;CACF,CAAC;AAEF,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,uBAAuB,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvH,OAAO,uBAAuB,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,iFAAiF;AACjF,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9G,OAAO,uCAAuC,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,MAAc;IACrE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAoB;IACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9C,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,qBAAqB,CAAE,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG;QACnB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY;QACnC,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe;QACtC,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB;KACxC,CAAC;IACF,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACrG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,uBAAuB,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3G,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,+BAA+B,CAAE,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,kFAAkF;IAClF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC/C,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,CACL,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC;YACtC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,yBAAyB,CAAE,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,iBAAiB,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACpG,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,8BAA8B,CAAE,CAAC;QAClF,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,uEAAuE,CAAC;gBACnF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,+DAA+D;gBAC/D,MAAM,cAAc,GAAG;oBACrB,gCAAgC;oBAChC,mBAAmB;oBACnB,sBAAsB;oBACtB,0BAA0B;oBAC1B,qBAAqB;iBACtB,CAAC;gBAEF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC9C,MAAM,CAAC,IAAI,CAAC;wBACV,EAAE,EAAE,yBAAyB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;wBACzD,QAAQ,EAAE,SAAS;wBACnB,QAAQ,EAAE,UAAU;wBACpB,KAAK,EAAE,wBAAwB,GAAG,CAAC,IAAI,2BAA2B;wBAClE,OAAO,EACL,oDAAoD,GAAG,CAAC,IAAI,cAAc;4BAC1E,+CAA+C;wBACjD,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;wBACtB,SAAS,EAAE,EAAE,EAAE,sCAAsC;wBACrD,QAAQ,EAAE,CAAC,wBAAwB,GAAG,CAAC,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC7G,cAAc,EACZ,oEAAoE,GAAG,CAAC,IAAI,IAAI;4BAChF,kEAAkE;wBACpE,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAChF,gBAAgB,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB;SACpC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAE1G,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,qCAAqC;YACzC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,yCAAyC;YAChD,OAAO,EACL,2EAA2E;gBAC3E,4DAA4D;YAC9D,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,CAAC,0CAA0C,CAAC;YACtD,wEAAwE;YACxE,iEAAiE;YACjE,+DAA+D;YAC/D,cAAc,EACZ,0FAA0F;gBAC1F,yCAAyC;gBACzC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1D,wFAAwF;gBACxF,8EAA8E;YAChF,SAAS,EAAE,wBAAwB;YACnC,4EAA4E;YAC5E,wEAAwE;YACxE,aAAa,EAAE,IAAI;YACnB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACvB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBACrF,OAAO,CAAC,SAAS,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,8BAA8B;YAClC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,kDAAkD;YACzD,OAAO,EACL,kDAAkD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;gBACvF,+EAA+E;gBAC/E,wBAAwB;YAC1B,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,4CAA4C,CAAC;YAC/F,cAAc,EAAE,0DAA0D,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACzH,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5E,oEAAoE;YACpE,oEAAoE;YACpE,aAAa,EAAE,IAAI;YACnB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC7F,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC5D,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1F,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACzB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACvB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,6BAA6B;gBACjC,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,eAAe;gBACzB,KAAK,EAAE,sDAAsD;gBAC7D,OAAO,EACL,wFAAwF;oBACxF,4EAA4E;gBAC9E,SAAS,EAAE,CAAC,uBAAuB,CAAC;gBACpC,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACjJ,cAAc,EAAE,yHAAyH;gBACzI,SAAS,EAAE,mHAAmH;gBAC9H,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,qBAAqB,GAAyC;YAClE,EAAE,EAAE,EAAE,+BAA+B,EAAE,KAAK,EAAE,6CAA6C,EAAE;YAC7F,EAAE,EAAE,EAAE,kCAAkC,EAAE,KAAK,EAAE,gDAAgD,EAAE;YACnG,EAAE,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,8CAA8C,EAAE;YAC/F,EAAE,EAAE,EAAE,oDAAoD,EAAE,KAAK,EAAE,qDAAqD,EAAE;YAC1H,EAAE,EAAE,EAAE,uDAAuD,EAAE,KAAK,EAAE,wDAAwD,EAAE;SACjI,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACV,8DAA8D;oBAC9D,mEAAmE;oBACnE,yDAAyD;oBACzD,EAAE,EAAE,0BAA0B,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBAChD,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,eAAe;oBACzB,KAAK,EAAE,6DAA6D;oBACpE,OAAO,EACL,qBAAqB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;wBAC5E,iGAAiG;oBACnG,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtB,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;oBAC1D,cAAc,EAAE,yHAAyH;oBACzI,SAAS,EAAE,uHAAuH;oBAClI,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;gBACH,MAAM,CAAC,qBAAqB;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/skill-supply-chain.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Skill supply-chain scan
+ *
+ * An Agent Skill is instructions (SKILL.md plus reference docs) and bundled
+ * scripts that an agent loads on demand and runs with the user's permissions.
+ * Installing a third-party skill is installing code. The structural skills
+ * detector (skills-detector.ts) checks that a skill *loads*; this detector
+ * reads the same skill — and every file bundled in its directory — as plain
+ * text and flags content characteristic of supply-chain abuse.
+ *
+ * Static only. Nothing here executes, imports, fetches or resolves anything:
+ * skill content is matched against fixed patterns, so the same files always
+ * produce the same findings (no network, no clock, no LLM).
+ *
+ * Rules (tag `skill-supply-chain` + the rule id below):
+ *
+ *   remote-exec            fetched content piped into a shell (`curl … |
+ *                          bash`, by path, via env/sudo/busybox/xargs — an
+ *                          `env A=…` assignment of any length — in a
+ *                          subshell, through any number of pipe stages),
+ *                          into `tee >(bash)`, into an interpreter that runs
+ *                          its own stdin (`node -e "eval(readFileSync(0))"`,
+ *                          `python -c 'exec(sys.stdin.read())'`, `ruby -e`,
+ *                          `perl -e`, `node /dev/stdin`), or into a `while
+ *                          read l; do eval "$l"; done` loop; process/here-
+ *                          string substitution, `iex (iwr …)`, or a
+ *                          downloaded file executed later in the same
+ *                          command without first being verified           high
+ *   encoded-exec           decoded or transformed content executed (`base64
+ *                          -d | sh`, `xxd -r -p | sh`, `rev | sh`, a rot13
+ *                          `tr`, `base32 -d`, a run of `\x63\x75…` escapes,
+ *                          decode-to-file then run, `eval "$(… | base64
+ *                          -d)"`, `exec(b64decode(…))`, `powershell -enc`) high
+ *   remote-eval            eval of fetched code (also in SKILL.md code,
+ *                          including a fetch function imported under another
+ *                          name: `urlopen as u`, `import requests as r`), or
+ *                          a script that both evaluates dynamic code AND
+ *                          makes network calls                            high
+ *   dynamic-eval           eval/exec/new Function/iex, no network call   warning
+ *   credential-exfil       credential-store read or environment dump AND
+ *                          network calls in the same file                 high
+ *   exfil-instruction      prose sending secrets to a destination  high/warning
+ *   instruction-override   prompt-injection text                          high
+ *   conceal-from-user      prose hiding actions from the user      high/warning
+ *   permission-bypass      flags/prose disabling permission prompts    warning
+ *   hidden-unicode         tag characters, bidi controls (high); other
+ *                          invisible/format/control characters       (warning)
+ *   hidden-html-comment    agent-directed text inside an HTML comment  warning
+ *   hidden-html-element    text hidden by `display:none`/`hidden`      warning
+ *   encoded-blob           a large base64 blob in instruction text     warning
+ *   unpinned-remote-dep    a remote dependency with no pinned version  warning
+ *   missing-script         the SKILL.md runs a script that exists nowhere
+ *                                                          warning, ai_config
+ *   unscanned-files        content this scan could not fully read, named:
+ *                          binaries/archives/executables, compiled-language
+ *                          sources, files over the cap or budget, oversized
+ *                          files (head and tail read), overlong continuation
+ *                          chains (warning); dependency directories and
+ *                          include-filtered files (info)
+ *
+ * Hostile input: every regex uses bounded quantifiers and runs over lines in
+ * overlapping 2000-character windows behind cheap prefilters, and every rule
+ * whose span can exceed the window overlap (pipes, command chains) is matched
+ * procedurally over the whole logical command, so results do not depend on
+ * window alignment. HTML comments and tags are found with indexOf walks. A
+ * rule keeps scanning past its evidence cap (a flood of low-severity matches
+ * cannot hide a later high-severity one). Documents are loaded, scanned and
+ * dropped one at a time under a per-scan byte, file and line budget, SKILL.md
+ * files and scripts/executables first; a priority file the budget cannot
+ * reach is reported at HIGH (fail closed). There is deliberately no
+ * wall-clock budget: output must not depend on the clock.
+ *
+ * Documentation vs directive (the false-positive controls). Outside fenced
+ * code — prose, inline code, table rows — a negation or discussion word only
+ * counts when it directly GOVERNS the match: an imperative negation with
+ * nothing or one executing verb between ("never run `curl … | bash`"), a
+ * discussion word right before it ("this skill detects `curl | bash`" — a
+ * `Label:` is not governance), or a predicate right after it ("… is
+ * dangerous"). Governance ends at but / and / then / instead / so and at
+ * clause punctuation; "never forget/hesitate/stop/skip/fail/neglect/mind" is
+ * not a negation. Even then, context NEVER drops a match, or lowers its
+ * severity, when the match names a concrete target — a URL, a host (dotted,
+ * IPv4/IPv6, host:port, defanged or quote-split), a host/path, a `$VARIABLE`
+ * or `$(…)`, or any address-like argument or config/list flag given to
+ * curl/wget/iwr, or a dot-less host (`wget intranet`) that is the fetcher's
+ * first non-flag argument while the same text pipes into a shell or runs the
+ * download (a bare word elsewhere is prose: "pipe curl into bash") — it only
+ * lowers confidence (0.4) and notes "looks like documentation". Target-less
+ * exec documentation ("never run `curl | bash`")
+ * is dropped; target-less override/concealment/bypass text is dropped only
+ * when the governed phrase is itself set off in a code span, quotes or a
+ * table cell (otherwise it is kept at low confidence), and quoted text after
+ * an adoption phrase ("your new rule is \"…\"") is never data. The trade-off: a
+ * security skill quoting a real installer URL is reported (high, low
+ * confidence); the escape hatch is the baseline or a config `exclude`. A
+ * documented example whose governing word the rules do not recognise ("Instead
+ * of `curl URL | bash`", a table of risky patterns, a "bad example" fence)
+ * stays at full confidence; the benign-documentation corpus in
+ * skill-supply-chain.test.ts pins both behaviours.
+ * Other controls: one named API key sent to an API is not exfiltration;
+ * dynamic require/import only counts next to network access; emoji ZWJ, a
+ * single variation selector after a non-ASCII character, flag tag sequences,
+ * RTL marks in RTL text, a leading BOM and `data:` URIs are ignored; `npx
+ * tool` without a version is not flagged; a table row whose first cell is just
+ * a flag, and whose other cells direct nothing, documents that flag.
+ *
+ * Findings list the file they were found in plus the owning SKILL.md in
+ * `filePaths`, with `locations` at the exact line. Inline `promptci-ignore`
+ * annotations inside a skill directory never suppress these findings
+ * (scan.ts). Evidence quotes the matched text with every invisible or control
+ * character shown as `<U+XXXX>` and tag-character payloads decoded. No finding
+ * is auto-fixable: repairing a skill needs a human-reviewed diff.
+ */
+import type { RepoContext } from './repo-context.js';
+import type { PromptCiIssue } from './types.js';
+/** First entry of every finding's `tags`. */
+export declare const SKILL_SUPPLY_CHAIN_TAG = "skill-supply-chain";
+/** Total bytes of skill content read per scan; the rest is reported, not read. */
+export declare const MAX_SCAN_BYTES: number;
+/** Total skill files read per scan. */
+export declare const MAX_SCAN_FILES = 2000;
+export type SkillSupplyChainRule = 'remote-exec' | 'encoded-exec' | 'remote-eval' | 'dynamic-eval' | 'credential-exfil' | 'exfil-instruction' | 'instruction-override' | 'conceal-from-user' | 'permission-bypass' | 'hidden-unicode' | 'hidden-html-comment' | 'hidden-html-element' | 'encoded-blob' | 'unpinned-remote-dep' | 'missing-script' | 'unscanned-files';
+/** Total lines examined per scan: bounds per-line work however the bytes are shaped (e.g. megabytes of newlines). */
+export declare const MAX_SCAN_LINES = 3000000;
+/** Per-scan budget overrides (tests exercise budget exhaustion without generating gigabytes). */
+export type SkillScanLimits = Partial<{
+    bytes: number;
+    files: number;
+    lines: number;
+}>;
+export declare function detectSkillSupplyChain(context: RepoContext, limits?: SkillScanLimits): PromptCiIssue[];
+//# sourceMappingURL=skill-supply-chain.d.ts.map

package/dist/skill-supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-supply-chain.d.ts","sourceRoot":"","sources":["../src/skill-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAgC,aAAa,EAAE,MAAM,YAAY,CAAC;AAgB9E,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,kFAAkF;AAClF,eAAO,MAAM,cAAc,QAAmB,CAAC;AAC/C,uCAAuC;AACvC,eAAO,MAAM,cAAc,OAAO,CAAC;AAiCnC,MAAM,MAAM,oBAAoB,GAC5B,aAAa,GACb,cAAc,GACd,aAAa,GACb,cAAc,GACd,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,qBAAqB,GACrB,qBAAqB,GACrB,cAAc,GACd,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,CAAC;AAq9EtB,qHAAqH;AACrH,eAAO,MAAM,cAAc,UAAY,CAAC;AA+OxC,iGAAiG;AACjG,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEvF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,GAAE,eAAoB,GAAG,aAAa,EAAE,CAqG1G"}