@qa-ai-stlc/runner-security 0.0.0-stage → 1.7.0

package/dist/identity-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-sessions.js","sourceRoot":"","sources":["../src/identity-sessions.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,UAAU,GAGX,MAAM,kBAAkB,CAAC;AAiB1B,mGAAmG;AACnG,MAAM,OAAO,gBAAgB;IAER;IACA;IAFnB,YACmB,QAA8C,EAC9C,QAAqC;QADrC,aAAQ,GAAR,QAAQ,CAAsC;QAC9C,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEJ,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,IAAU;QACf,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAC5E,gBAAgB;QACd,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,gBAAgB,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAE/E,SAAS,SAAS,CAAC,MAAoB,EAAE,QAAgB;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,MAAM,CAAC,MAAoB,EAAE,KAAa;IACjD,0DAA0D;IAC1D,OAAO,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC;AAChE,CAAC;AAED,SAAS,OAAO,CAAC,MAAoB;IACnC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,QAAQ;QAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,IAAU,EACV,YAA0B,EAC1B,OAAe,EACf,KAAa;IAEb,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAC5C,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CACjE,CAAC;IACF,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QAChC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACtF,CAAC;AACJ,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAsB,EACtB,aAAoC,EACpC,UAAuC,EAAE;IAEzC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,OAAO,CAAC,2BAA2B,EAAE,IAAI,IAAI,gCAAgC,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,YAAY,GAChB,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/F,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC;YACrG,QAAQ,CAAC,GAAG,CACV,IAAI,EACJ,iBAAiB,CACf,IAAI,EACJ,IAAI,EACJ,YAAY,EACZ,aAAa,CAAC,WAAW,CAAC,OAAO,EACjC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAC9B,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;gBAClE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,OAAsB,EACtB,aAAoC,EACpC,IAAY,EACZ,QAAwB,EACxB,OAAoC,EACpC,WAAoB;IAEpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC;IACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,OAAO,CACf,2CAA2C,EAC3C,wBAAwB,IAAI,oCAAoC,EAChE,EAAE,WAAW,EAAE,oFAAoF,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE;QAClE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from './cookie-flags.js';
+export * from './default-checks.js';
+export * from './identity-sessions.js';
+export * from './security-audit.js';
+export * from './security-check.js';
+export * from './security-probe.js';
+export * from './source-checkout.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+export * from './cookie-flags.js';
+export * from './default-checks.js';
+export * from './identity-sessions.js';
+export * from './security-audit.js';
+export * from './security-check.js';
+export * from './security-probe.js';
+export * from './source-checkout.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC"}

package/dist/security-audit.d.ts

@@ -0,0 +1,30 @@
+import { type EngineContext, type IdGenerator } from '@qa-ai-stlc/core';
+import { type DefectDraft, type RelativePath, type SecurityAuditResult } from '@qa-ai-stlc/schemas';
+import { type OpenIdentitySessionsOptions } from './identity-sessions.js';
+import type { SecurityCheck } from './security-check.js';
+export interface RunSecurityAuditOptions {
+    /** The check implementations to run; only classes the authorization names are used. */
+    readonly checks: readonly SecurityCheck[];
+    readonly idGenerator?: IdGenerator;
+    /** See `SecurityProbeOptions.pause`. */
+    readonly pause?: (milliseconds: number) => Promise<void>;
+    readonly requestTimeoutMs?: number;
+    /** See `OpenIdentitySessionsOptions`. */
+    readonly identities?: OpenIdentitySessionsOptions;
+}
+export interface SecurityAuditOutcome {
+    readonly result: SecurityAuditResult;
+    /** Where the engine registered the audit result; defect drafts cite it as evidence. */
+    readonly evidencePath: RelativePath;
+    /** One tracker-neutral draft per finding, none accepted: acceptance is a separate gate. */
+    readonly drafts: readonly DefectDraft[];
+}
+/**
+ * Runs the authorized black-box security checks and registers what they found. It refuses to start
+ * without an approved, current authorization (`assertSecurityAuthorized`), then gives every check
+ * the same probe, which holds the authorized limits. A check the authorization lists but this
+ * version cannot run is `skipped`, never silently omitted or reported `passed`; a check that
+ * could not complete is `blocked`, and the audit is then `partial` rather than a clean bill.
+ */
+export declare function runSecurityAudit(context: EngineContext, options: RunSecurityAuditOptions): Promise<SecurityAuditOutcome>;
+//# sourceMappingURL=security-audit.d.ts.map

package/dist/security-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.d.ts","sourceRoot":"","sources":["../src/security-audit.ts"],"names":[],"mappings":"AAGA,OAAO,EAUL,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAIzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAI7E,MAAM,WAAW,uBAAuB;IACtC,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,wCAAwC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,yCAAyC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,2BAA2B,CAAC;CACnD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;CACzC;AAYD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAmD/B"}

package/dist/security-audit.js

@@ -0,0 +1,173 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { EvidenceStore, ManifestStore, QaError, QaStore, assertSecurityAuthorized, loadConfig, randomIdGenerator, securityFindingToDefectDraft, toCanonicalJson, } from '@qa-ai-stlc/core';
+import { CODE_ASSISTED_CHECK_CLASSES, SECURITY_CHECK_CLASSES, } from '@qa-ai-stlc/schemas';
+import { NO_IDENTITY_SESSIONS, openIdentitySessions, } from './identity-sessions.js';
+import { SecurityProbe } from './security-probe.js';
+import { SourceCheckout } from './source-checkout.js';
+function isCodeAssisted(checkClass) {
+    return CODE_ASSISTED_CHECK_CLASSES.includes(checkClass);
+}
+function skipped(checkClass, note) {
+    return { checkClass, status: 'skipped', note, findingIds: [] };
+}
+/**
+ * Runs the authorized black-box security checks and registers what they found. It refuses to start
+ * without an approved, current authorization (`assertSecurityAuthorized`), then gives every check
+ * the same probe, which holds the authorized limits. A check the authorization lists but this
+ * version cannot run is `skipped`, never silently omitted or reported `passed`; a check that
+ * could not complete is `blocked`, and the audit is then `partial` rather than a clean bill.
+ */
+export async function runSecurityAudit(context, options) {
+    const authorization = await assertSecurityAuthorized(context);
+    const config = await loadConfig(context);
+    const idGenerator = options.idGenerator ?? randomIdGenerator;
+    const auditId = `audit-${idGenerator.next()}`;
+    const startedAt = context.clock.now().toISOString();
+    const probe = new SecurityProbe({
+        httpClient: context.httpClient,
+        authorization,
+        tlsInsecure: config.environments[authorization.environment.name]?.tlsInsecure === true,
+        ...(options.pause !== undefined ? { pause: options.pause } : {}),
+        ...(options.requestTimeoutMs !== undefined ? { requestTimeoutMs: options.requestTimeoutMs } : {}),
+    });
+    const identities = authorization.identities.length > 0
+        ? await openIdentitySessions(context, authorization, options.identities)
+        : NO_IDENTITY_SESSIONS;
+    const source = await openSourceCheckout(context, config.source?.path, authorization);
+    const { checks, findings, stoppedReason } = await runChecks(context, authorization, { probe, identities, ...(source.checkout !== undefined ? { source: source.checkout } : {}) }, options.checks, source.unavailableReason);
+    const isClean = stoppedReason === undefined && checks.every((entry) => entry.status !== 'blocked');
+    const result = {
+        schemaVersion: 1,
+        auditId,
+        environment: authorization.environment.name,
+        startedAt,
+        finishedAt: context.clock.now().toISOString(),
+        status: isClean ? 'completed' : 'partial',
+        ...(stoppedReason !== undefined ? { stoppedReason } : {}),
+        checks,
+        findings,
+        requests: probe.log,
+    };
+    assertFindingsCiteRequests(result);
+    const evidencePath = await registerAuditResult(context, result, idGenerator);
+    const drafts = findings.map((finding) => securityFindingToDefectDraft(finding, {
+        environment: result.environment,
+        evidencePaths: [evidencePath],
+        createdAt: result.finishedAt,
+    }));
+    return { result, evidencePath, drafts };
+}
+// The code-assisted level needs `source.path`; without it the audit still runs its black-box checks
+// and says so, rather than failing a request the operator may have made for the whole set.
+async function openSourceCheckout(context, sourcePath, authorization) {
+    const requested = CODE_ASSISTED_CHECK_CLASSES.filter((checkClass) => authorization.checks.includes(checkClass));
+    if (requested.length === 0) {
+        return {};
+    }
+    const checkout = sourcePath === undefined
+        ? undefined
+        : new SourceCheckout({
+            projectRoot: context.projectRoot,
+            relativeRoot: sourcePath,
+            fs: context.fs,
+            processRunner: context.processRunner,
+        });
+    const unavailableReason = checkout === undefined
+        ? 'source.path is not configured'
+        : (await context.fs.pathExists(checkout.absoluteDirectory(checkout.relativeRoot)))
+            ? undefined
+            : `source.path "${sourcePath ?? ''}" does not exist`;
+    if (unavailableReason !== undefined) {
+        context.logger.info('Code-assisted security checks are skipped; the audit runs black-box only', {
+            reason: unavailableReason,
+            checks: requested,
+        });
+        return { unavailableReason };
+    }
+    return { ...(checkout !== undefined ? { checkout } : {}) };
+}
+async function runChecks(context, authorization, checkInput, implementations, codeAssistedUnavailableReason) {
+    const entries = [];
+    const findings = [];
+    let stoppedReason;
+    for (const checkClass of SECURITY_CHECK_CLASSES) {
+        if (!authorization.checks.includes(checkClass)) {
+            continue;
+        }
+        if (stoppedReason !== undefined) {
+            entries.push(skipped(checkClass, `Not run: ${stoppedReason}.`));
+            continue;
+        }
+        if (codeAssistedUnavailableReason !== undefined && isCodeAssisted(checkClass)) {
+            entries.push(skipped(checkClass, `Not run: ${codeAssistedUnavailableReason}, so only the black-box checks ran.`));
+            continue;
+        }
+        const implementation = implementations.find((candidate) => candidate.checkClass === checkClass);
+        if (implementation === undefined) {
+            entries.push(skipped(checkClass, 'This version has no implementation of the check.'));
+            continue;
+        }
+        try {
+            // Only the code-assisted checks are given the checkout: a black-box check has no business reading code.
+            const { source, ...blackBoxInput } = checkInput;
+            const outcome = await implementation.run({
+                ...blackBoxInput,
+                authorization,
+                ...(source !== undefined && isCodeAssisted(checkClass) ? { source } : {}),
+            });
+            for (const finding of outcome.findings) {
+                if (finding.checkClass !== checkClass || findings.some((known) => known.id === finding.id)) {
+                    throw new QaError('SECURITY_FINDING_INVALID', `The "${checkClass}" check returned finding "${finding.id}" of class "${finding.checkClass}", or reused an id`, { remediation: 'A check reports only its own class, with ids unique across the audit.' });
+                }
+                findings.push(finding);
+            }
+            const status = outcome.findings.length > 0 ? 'failed' : outcome.status;
+            entries.push({
+                checkClass,
+                status,
+                ...(outcome.note !== undefined ? { note: outcome.note } : {}),
+                findingIds: outcome.findings.map((finding) => finding.id),
+            });
+        }
+        catch (error) {
+            if (!(error instanceof QaError)) {
+                throw error;
+            }
+            context.logger.error('A security check could not complete', { code: error.code, checkClass });
+            entries.push({ checkClass, status: 'blocked', note: error.message, findingIds: [] });
+            if (error.code === 'SECURITY_BUDGET_EXHAUSTED') {
+                stoppedReason = 'the authorized request budget was used up';
+            }
+        }
+    }
+    return { checks: entries, findings, ...(stoppedReason !== undefined ? { stoppedReason } : {}) };
+}
+// A finding that cites a request the audit never made would point a reviewer at nothing.
+function assertFindingsCiteRequests(result) {
+    for (const finding of result.findings) {
+        const invalid = finding.requestIndexes.filter((index) => index >= result.requests.length);
+        if (invalid.length > 0) {
+            throw new QaError('SECURITY_FINDING_INVALID', `Finding "${finding.id}" cites request(s) ${invalid.join(', ')} that the audit did not make`, { remediation: 'A finding cites positions in the audit request log.' });
+        }
+    }
+}
+async function registerAuditResult(context, result, idGenerator) {
+    const store = new QaStore({ projectRoot: context.projectRoot, fs: context.fs });
+    const manifest = new ManifestStore({ store, clock: context.clock });
+    const evidenceStore = new EvidenceStore({ store, manifest, clock: context.clock });
+    const registration = await evidenceStore.register({
+        id: `evidence-${idGenerator.next()}`,
+        runId: `security-${result.auditId}`,
+        kind: 'other',
+        fileExtension: 'json',
+        content: toCanonicalJson(result),
+    });
+    if (registration.status === 'quarantined') {
+        throw new QaError('SECURITY_EVIDENCE_QUARANTINED', `The audit result matched ${registration.patterns.join(', ')} and was quarantined instead of registered`, {
+            remediation: `A sanitized receipt is at ${registration.receiptPath}. Remove the secret from the application's responses.`,
+        });
+    }
+    return registration.evidence.path;
+}
+//# sourceMappingURL=security-audit.js.map

package/dist/security-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.js","sourceRoot":"","sources":["../src/security-audit.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EACL,aAAa,EACb,aAAa,EACb,OAAO,EACP,OAAO,EACP,wBAAwB,EACxB,UAAU,EACV,iBAAiB,EACjB,4BAA4B,EAC5B,eAAe,GAGhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,GAOvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuBtD,SAAS,cAAc,CAAC,UAAoC;IAC1D,OAAQ,2BAAiD,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,UAAoC,EAAE,IAAY;IACjE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAsB,EACtB,OAAgC;IAEhC,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC7D,MAAM,OAAO,GAAG,SAAS,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa;QACb,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,IAAI;QACtF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClG,CAAC,CAAC;IAEH,MAAM,UAAU,GACd,aAAa,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;QACxE,CAAC,CAAC,oBAAoB,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,SAAS,CACzD,OAAO,EACP,aAAa,EACb,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC5F,OAAO,CAAC,MAAM,EACd,MAAM,CAAC,iBAAiB,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACnG,MAAM,MAAM,GAAwB;QAClC,aAAa,EAAE,CAAC;QAChB,OAAO;QACP,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI;QAC3C,SAAS;QACT,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC7C,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACzC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM;QACN,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,GAAG;KACpB,CAAC;IACF,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACtC,4BAA4B,CAAC,OAAO,EAAE;QACpC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,CAAC,YAAY,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC,CACH,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAQD,oGAAoG;AACpG,2FAA2F;AAC3F,KAAK,UAAU,kBAAkB,CAC/B,OAAsB,EACtB,UAA8B,EAC9B,aAAoC;IAEpC,MAAM,SAAS,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAClE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1C,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GACZ,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,cAAc,CAAC;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,UAAU;YACxB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACT,MAAM,iBAAiB,GACrB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YAChF,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gBAAgB,UAAU,IAAI,EAAE,kBAAkB,CAAC;IAC3D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE;YAC9F,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAsB,EACtB,aAAoC,EACpC,UAAqD,EACrD,eAAyC,EACzC,6BAAiD;IAEjD,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,aAAiC,CAAC;IAEtC,KAAK,MAAM,UAAU,IAAI,sBAAsB,EAAE,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,aAAa,GAAG,CAAC,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,IAAI,6BAA6B,KAAK,SAAS,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CACV,OAAO,CAAC,UAAU,EAAE,YAAY,6BAA6B,qCAAqC,CAAC,CACpG,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QAChG,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,kDAAkD,CAAC,CAAC,CAAC;YACtF,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,wGAAwG;YACxG,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC;gBACvC,GAAG,aAAa;gBAChB,aAAa;gBACb,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACvC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC3F,MAAM,IAAI,OAAO,CACf,0BAA0B,EAC1B,QAAQ,UAAU,6BAA6B,OAAO,CAAC,EAAE,eAAe,OAAO,CAAC,UAAU,oBAAoB,EAC9G,EAAE,WAAW,EAAE,uEAAuE,EAAE,CACzF,CAAC;gBACJ,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YACD,MAAM,MAAM,GAAwB,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5F,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU;gBACV,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBAC/C,aAAa,GAAG,2CAA2C,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,yFAAyF;AACzF,SAAS,0BAA0B,CAAC,MAA2B;IAC7D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,OAAO,CACf,0BAA0B,EAC1B,YAAY,OAAO,CAAC,EAAE,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAC5F,EAAE,WAAW,EAAE,qDAAqD,EAAE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAsB,EACtB,MAA2B,EAC3B,WAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC;QAChD,EAAE,EAAE,YAAY,WAAW,CAAC,IAAI,EAAE,EAAE;QACpC,KAAK,EAAE,YAAY,MAAM,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,OAAO;QACb,aAAa,EAAE,MAAM;QACrB,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAC1C,MAAM,IAAI,OAAO,CACf,+BAA+B,EAC/B,4BAA4B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,EACxG;YACE,WAAW,EAAE,6BAA6B,YAAY,CAAC,WAAW,uDAAuD;SAC1H,CACF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;AACpC,CAAC"}

package/dist/security-check.d.ts

@@ -0,0 +1,30 @@
+import type { SecurityAuthorization, SecurityCheckClass, SecurityCheckStatus, SecurityFinding } from '@qa-ai-stlc/schemas';
+import type { IdentitySessions } from './identity-sessions.js';
+import type { SecurityProbe } from './security-probe.js';
+import type { SourceCheckout } from './source-checkout.js';
+export interface SecurityCheckInput {
+    /** The only way a check reaches the application; every authorized limit is enforced inside it. */
+    readonly probe: SecurityProbe;
+    readonly authorization: SecurityAuthorization;
+    /** The identities the authorization names, signed in; empty when it names none. */
+    readonly identities: IdentitySessions;
+    /** The source checkout (`source.path`), read-only; absent when none is configured. */
+    readonly source?: SourceCheckout;
+}
+export interface SecurityCheckOutcome {
+    /**
+     * `passed` only when the check looked and found nothing. A check that could not look says
+     * `skipped` (not applicable or not enough authorization) or `blocked` (something stopped it),
+     * and one unsure of what it saw says `uncertain`: none of these is ever reported as `passed`.
+     */
+    readonly status: Exclude<SecurityCheckStatus, 'failed'>;
+    readonly note?: string;
+    /** Any finding makes the check `failed`, whatever `status` says. */
+    readonly findings: readonly SecurityFinding[];
+}
+/** One class of black-box checks (development plan 2.7), run through the probe. */
+export interface SecurityCheck {
+    readonly checkClass: SecurityCheckClass;
+    run(input: SecurityCheckInput): Promise<SecurityCheckOutcome>;
+}
+//# sourceMappingURL=security-check.d.ts.map

package/dist/security-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-check.d.ts","sourceRoot":"","sources":["../src/security-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,GAAG,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC/D"}

package/dist/security-check.js

@@ -0,0 +1,4 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+export {};
+//# sourceMappingURL=security-check.js.map

package/dist/security-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-check.js","sourceRoot":"","sources":["../src/security-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC"}

package/dist/security-probe.d.ts

@@ -0,0 +1,56 @@
+import { type HttpClient } from '@qa-ai-stlc/core';
+import type { SecurityAuthorization, SecurityRequestLogEntry } from '@qa-ai-stlc/schemas';
+export interface ProbeRequest {
+    readonly method: string;
+    /** An absolute path on the audited host, such as `/admin/users`; never a full URL. */
+    readonly path: string;
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly body?: string;
+}
+export interface ProbeResponse {
+    readonly status: number;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly setCookies: readonly string[];
+    /** Capped; page-controlled, so untrusted. */
+    readonly bodyText: string;
+    /** Position of this request in the probe's log, for a finding to cite. */
+    readonly requestIndex: number;
+}
+export interface SecurityProbeOptions {
+    readonly httpClient: HttpClient;
+    readonly authorization: SecurityAuthorization;
+    /** Whether the environment's configuration turns off certificate validation (ADR-011). */
+    readonly tlsInsecure?: boolean;
+    readonly requestTimeoutMs?: number;
+    /** Waits between requests to honour the rate limit; injected so tests run without real delay. */
+    readonly pause?: (milliseconds: number) => Promise<void>;
+    readonly nowMs?: () => number;
+}
+/**
+ * The one way an audit reaches the network. Every limit the operator authorized is enforced here
+ * and nowhere else, so no check can bypass it (AGENTS.md 12.7): a request is sent only to the
+ * authorized origin and allowlist, a method that is not a read only when the authorization names
+ * that exact method and path, never faster than the rate limit, and never beyond the request
+ * budget. Redirects are not followed: each hop would have to pass the same checks. Every request,
+ * sent or refused, is logged for the audit result.
+ */
+export declare class SecurityProbe {
+    readonly log: SecurityRequestLogEntry[];
+    private sentCount;
+    private lastSentAtMs;
+    private readonly httpClient;
+    private readonly authorization;
+    private readonly tlsInsecure;
+    private readonly requestTimeoutMs;
+    private readonly pause;
+    private readonly nowMs;
+    constructor(options: SecurityProbeOptions);
+    request(request: ProbeRequest): Promise<ProbeResponse>;
+    /** Whether the audit has used up its authorized request budget. */
+    get isBudgetExhausted(): boolean;
+    private resolve;
+    private refuseUnlessPermitted;
+    private refuse;
+    private waitForRateLimit;
+}
+//# sourceMappingURL=security-probe.d.ts.map

package/dist/security-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-probe.d.ts","sourceRoot":"","sources":["../src/security-probe.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAM1F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,iGAAiG;IACjG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAYD;;;;;;;GAOG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAM;IAC7C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAEzB,OAAO,EAAE,oBAAoB;IASnC,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IA+C5D,mEAAmE;IACnE,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,MAAM;YAaA,gBAAgB;CAU/B"}

package/dist/security-probe.js

@@ -0,0 +1,128 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { QaError, isUrlAllowed } from '@qa-ai-stlc/core';
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+const MAX_BODY_CHARACTERS = 64 * 1024;
+const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
+function realPause(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+/** Where a request went, without query values (they can carry tokens) or credentials in the URL. */
+function describeUrl(url) {
+    const names = [...url.searchParams.keys()];
+    return `${url.origin}${url.pathname}${names.length > 0 ? `?${names.join('&')}` : ''}`;
+}
+/**
+ * The one way an audit reaches the network. Every limit the operator authorized is enforced here
+ * and nowhere else, so no check can bypass it (AGENTS.md 12.7): a request is sent only to the
+ * authorized origin and allowlist, a method that is not a read only when the authorization names
+ * that exact method and path, never faster than the rate limit, and never beyond the request
+ * budget. Redirects are not followed: each hop would have to pass the same checks. Every request,
+ * sent or refused, is logged for the audit result.
+ */
+export class SecurityProbe {
+    log = [];
+    sentCount = 0;
+    lastSentAtMs;
+    httpClient;
+    authorization;
+    tlsInsecure;
+    requestTimeoutMs;
+    pause;
+    nowMs;
+    constructor(options) {
+        this.httpClient = options.httpClient;
+        this.authorization = options.authorization;
+        this.tlsInsecure = options.tlsInsecure === true;
+        this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+        this.pause = options.pause ?? realPause;
+        this.nowMs = options.nowMs ?? Date.now;
+    }
+    async request(request) {
+        const method = request.method.toUpperCase();
+        const url = this.resolve(method, request.path);
+        this.refuseUnlessPermitted(method, request.path, url);
+        if (this.sentCount >= this.authorization.rateLimit.maxRequests) {
+            throw new QaError('SECURITY_BUDGET_EXHAUSTED', `The audit sent its authorized ${String(this.authorization.rateLimit.maxRequests)} requests and stopped`, { remediation: 'Authorize a larger request budget if the operator wants a longer audit.' });
+        }
+        await this.waitForRateLimit();
+        const requestIndex = this.log.length;
+        this.sentCount += 1;
+        try {
+            const response = await this.httpClient.request(url.href, {
+                method,
+                ...(request.headers !== undefined ? { headers: request.headers } : {}),
+                ...(request.body !== undefined ? { body: request.body } : {}),
+                redirect: 'manual',
+                signal: AbortSignal.timeout(this.requestTimeoutMs),
+                ...(this.tlsInsecure ? { tlsInsecure: true } : {}),
+            });
+            this.log.push({ method, url: describeUrl(url), outcome: 'sent', status: response.status });
+            return {
+                status: response.status,
+                headers: response.headers,
+                setCookies: response.setCookies,
+                bodyText: response.bodyText.slice(0, MAX_BODY_CHARACTERS),
+                requestIndex,
+            };
+        }
+        catch (error) {
+            this.log.push({
+                method,
+                url: describeUrl(url),
+                outcome: 'sent',
+                reason: 'the request failed before a response arrived',
+            });
+            throw new QaError('SECURITY_REQUEST_FAILED', `${method} ${describeUrl(url)} failed`, {
+                cause: error,
+                remediation: 'Check that the environment is reachable, then run the audit again.',
+            });
+        }
+    }
+    /** Whether the audit has used up its authorized request budget. */
+    get isBudgetExhausted() {
+        return this.sentCount >= this.authorization.rateLimit.maxRequests;
+    }
+    resolve(method, path) {
+        // A path that is really a URL would let the host part escape the authorized origin.
+        if (!path.startsWith('/') || path.startsWith('//')) {
+            this.refuse(method, path, 'not an absolute path on the audited host');
+        }
+        return new URL(path, this.authorization.environment.baseUrl);
+    }
+    refuseUnlessPermitted(method, path, url) {
+        const { baseUrl, allowlist } = this.authorization.environment;
+        if (!isUrlAllowed(url.href, allowlist, baseUrl)) {
+            this.refuse(method, path, 'outside the authorized origin and allowlist', url);
+        }
+        if (SAFE_METHODS.has(method)) {
+            return;
+        }
+        const isAuthorizedMutation = this.authorization.allowedMutations.some((mutation) => mutation.method === method && mutation.path === url.pathname);
+        if (!isAuthorizedMutation) {
+            this.refuse(method, path, 'not a read and not an authorized mutation', url);
+        }
+    }
+    refuse(method, path, reason, url) {
+        this.log.push({
+            method,
+            url: url === undefined ? path : describeUrl(url),
+            outcome: 'refused',
+            reason,
+        });
+        throw new QaError('SECURITY_REQUEST_REFUSED', `${method} ${path} was refused: ${reason}`, {
+            remediation: 'An audit only sends reads and the mutations its authorization names, to the authorized origin.',
+        });
+    }
+    async waitForRateLimit() {
+        const intervalMs = 1000 / this.authorization.rateLimit.requestsPerSecond;
+        if (this.lastSentAtMs !== undefined) {
+            const waitMs = this.lastSentAtMs + intervalMs - this.nowMs();
+            if (waitMs > 0) {
+                await this.pause(waitMs);
+            }
+        }
+        this.lastSentAtMs = this.nowMs();
+    }
+}
+//# sourceMappingURL=security-probe.js.map

package/dist/security-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-probe.js","sourceRoot":"","sources":["../src/security-probe.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAG1E,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AA+B1C,SAAS,SAAS,CAAC,YAAoB;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,GAAQ;IAC3B,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IACf,GAAG,GAA8B,EAAE,CAAC;IACrC,SAAS,GAAG,CAAC,CAAC;IACd,YAAY,CAAqB;IACxB,UAAU,CAAa;IACvB,aAAa,CAAwB;IACrC,WAAW,CAAU;IACrB,gBAAgB,CAAS;IACzB,KAAK,CAA0C;IAC/C,KAAK,CAAe;IAErC,YAAY,OAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEtD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC/D,MAAM,IAAI,OAAO,CACf,2BAA2B,EAC3B,iCAAiC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,uBAAuB,EACxG,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QACrC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;gBACvD,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3F,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;gBACzD,YAAY;aACb,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;gBACrB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,8CAA8C;aACvD,CAAC,CAAC;YACH,MAAM,IAAI,OAAO,CAAC,yBAAyB,EAAE,GAAG,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE;gBACnF,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,oEAAoE;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC;IACpE,CAAC;IAEO,OAAO,CAAC,MAAc,EAAE,IAAY;QAC1C,oFAAoF;QACpF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,0CAA0C,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAEO,qBAAqB,CAAC,MAAc,EAAE,IAAY,EAAE,GAAQ;QAClE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;QAC9D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,CACnE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAC3E,CAAC;QACF,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc,EAAE,GAAS;QACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;YAChD,OAAO,EAAE,SAAS;YAClB,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAC,0BAA0B,EAAE,GAAG,MAAM,IAAI,IAAI,iBAAiB,MAAM,EAAE,EAAE;YACxF,WAAW,EACT,gGAAgG;SACnG,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC;QACzE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,GAAG,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7D,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/source-checkout.d.ts

@@ -0,0 +1,56 @@
+import { type FileSystem, type ProcessRunner } from '@qa-ai-stlc/core';
+import type { RelativePath } from '@qa-ai-stlc/schemas';
+export interface SourceFile {
+    /** Project-relative, with `/` separators, so a finding can cite it as it stands. */
+    readonly path: RelativePath;
+    readonly text: string;
+}
+export interface SourceScan {
+    readonly files: readonly SourceFile[];
+    /** True when the file limit stopped the scan, so a clean result does not cover the whole checkout. */
+    readonly isTruncated: boolean;
+    /** Files left out because they are binary or larger than the size limit. */
+    readonly skippedCount: number;
+}
+export interface SourceCheckoutOptions {
+    readonly projectRoot: string;
+    /** The configured `source.path`; `.` and `./app` forms are accepted. */
+    readonly relativeRoot: string;
+    readonly fs: FileSystem;
+    readonly processRunner: ProcessRunner;
+    readonly maxFiles?: number;
+    readonly maxFileSizeBytes?: number;
+}
+export declare const DEFAULT_MAX_SOURCE_FILES = 3000;
+export declare const DEFAULT_MAX_SOURCE_FILE_SIZE_BYTES: number;
+/**
+ * A read-only view of the application's source checkout (`source.path`). It exposes no write, so a
+ * code-assisted check cannot change the code it audits (AGENTS.md 12.4). The scan is bounded by a
+ * file count and a file size and says when it was cut short, so a clean result is never mistaken
+ * for a complete one.
+ */
+export declare class SourceCheckout {
+    /** Project-relative with `/` separators; `''` when the checkout is the project root itself. */
+    readonly relativeRoot: string;
+    readonly processRunner: ProcessRunner;
+    private readonly projectRoot;
+    private readonly fs;
+    private readonly maxFiles;
+    private readonly maxFileSizeBytes;
+    constructor(options: SourceCheckoutOptions);
+    /** The text files of the checkout in a stable order, without installed or generated directories. */
+    scan(): Promise<SourceScan>;
+    /** One file's text, or `undefined` when it is missing, binary or over the size limit. */
+    readText(path: RelativePath): Promise<string | undefined>;
+    /**
+     * The nearest directory, from the checkout's root up to the project root, that holds `fileName`:
+     * project-relative, `''` for the project root itself. A monorepo keeps one lockfile above the
+     * packages it covers.
+     */
+    findDirectoryWith(fileName: string): Promise<string | undefined>;
+    /** The absolute, OS-native path of a project-relative directory (`''` is the project root). */
+    absoluteDirectory(relativeDirectory: string): string;
+    private isInsideRoot;
+    private isInIgnoredDirectory;
+}
+//# sourceMappingURL=source-checkout.d.ts.map

package/dist/source-checkout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-checkout.d.ts","sourceRoot":"","sources":["../src/source-checkout.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,UAAU;IACzB,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,sGAAsG;IACtG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,kCAAkC,QAAa,CAAC;AAiD7D;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAE9B,OAAO,EAAE,qBAAqB;IAU1C,oGAAoG;IAC9F,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IAoBjC,yFAAyF;IACnF,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAe/D;;;;OAIG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAetE,+FAA+F;IAC/F,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM;IAMpD,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,oBAAoB;CAM7B"}