@xenos1996/usa 2.0.0 → 2.3.1

package/dist/report/sarif.d.ts

@@ -0,0 +1,84 @@
+import type { AuditReport } from '../types.js';
+/**
+ * SARIF 2.1.0 renderer — lets USA compose with GitHub code scanning, IDE
+ * SARIF viewers, and any dashboard that ingests SARIF.
+ *
+ * Only findings that represent an actionable defect become `results`; PASS and
+ * NOT_APPLICABLE are successes, not results. Judgement findings (status
+ * UNKNOWN) are emitted at `note` level with the evidence hint, because "a
+ * human must look at this" is the finding.
+ *
+ * Path handling: SARIF wants URI-style, repo-relative paths. Locations from
+ * the engine are already relative to the audit target, but we normalize
+ * separators and strip a leading `./` so GitHub links line up.
+ */
+export declare const SARIF_VERSION = "2.1.0";
+export declare const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
+/** SARIF levels, weakest to strongest. */
+export type SarifLevel = 'none' | 'note' | 'warning' | 'error';
+/** Normalize an engine path to a SARIF-friendly, repo-relative URI. */
+export declare function sarifUri(file: string): string;
+interface SarifPhysicalLocation {
+    physicalLocation: {
+        artifactLocation: {
+            uri: string;
+        };
+        region?: Record<string, number>;
+    };
+}
+interface SarifRule {
+    id: string;
+    name: string;
+    shortDescription: {
+        text: string;
+    };
+    fullDescription?: {
+        text: string;
+    };
+    help?: {
+        text: string;
+    };
+    helpUri?: string;
+    defaultConfiguration: {
+        level: SarifLevel;
+    };
+    properties: Record<string, unknown>;
+}
+interface SarifResult {
+    ruleId: string;
+    ruleIndex: number;
+    level: SarifLevel;
+    kind: 'fail' | 'informational';
+    message: {
+        text: string;
+    };
+    locations: SarifPhysicalLocation[];
+    suppressions?: {
+        kind: 'external';
+        justification: string;
+    }[];
+}
+export interface SarifLog {
+    version: typeof SARIF_VERSION;
+    $schema: typeof SARIF_SCHEMA;
+    runs: {
+        tool: {
+            driver: {
+                name: string;
+                version: string;
+                informationUri: string;
+                rules: SarifRule[];
+            };
+        };
+        results: SarifResult[];
+        invocations: {
+            executionSuccessful: boolean;
+        }[];
+    }[];
+}
+/** Builds a SARIF 2.1.0 log from an audit report. */
+export declare function toSarif(report: AuditReport): SarifLog;
+/** Renders an AuditReport as pretty-printed SARIF 2.1.0 (trailing newline). */
+export declare function renderSarif(report: AuditReport): string;
+export {};
+//# sourceMappingURL=sarif.d.ts.map

package/dist/report/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAuC,MAAM,aAAa,CAAC;AAEpF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,UAAU,CAAC;AACrC,eAAO,MAAM,YAAY,mGACyE,CAAC;AAEnG,0CAA0C;AAC1C,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAoB/D,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7C;AAMD,UAAU,qBAAqB;IAC7B,gBAAgB,EAAE;QAChB,gBAAgB,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAClC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;CACH;AAaD,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE;QAAE,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AA4BD,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC/B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9D;AAkBD,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,OAAO,aAAa,CAAC;IAC9B,OAAO,EAAE,OAAO,YAAY,CAAC;IAC7B,IAAI,EAAE;QACJ,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC;gBACb,OAAO,EAAE,MAAM,CAAC;gBAChB,cAAc,EAAE,MAAM,CAAC;gBACvB,KAAK,EAAE,SAAS,EAAE,CAAC;aACpB,CAAC;SACH,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,CAAC;QACvB,WAAW,EAAE;YAAE,mBAAmB,EAAE,OAAO,CAAA;SAAE,EAAE,CAAC;KACjD,EAAE,CAAC;CACL;AAED,qDAAqD;AACrD,wBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAkCrD;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEvD"}

package/dist/report/sarif.js

@@ -0,0 +1,129 @@
+import path from 'node:path';
+/**
+ * SARIF 2.1.0 renderer — lets USA compose with GitHub code scanning, IDE
+ * SARIF viewers, and any dashboard that ingests SARIF.
+ *
+ * Only findings that represent an actionable defect become `results`; PASS and
+ * NOT_APPLICABLE are successes, not results. Judgement findings (status
+ * UNKNOWN) are emitted at `note` level with the evidence hint, because "a
+ * human must look at this" is the finding.
+ *
+ * Path handling: SARIF wants URI-style, repo-relative paths. Locations from
+ * the engine are already relative to the audit target, but we normalize
+ * separators and strip a leading `./` so GitHub links line up.
+ */
+export const SARIF_VERSION = '2.1.0';
+export const SARIF_SCHEMA = 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json';
+const SEVERITY_LEVEL = {
+    CRITICAL: 'error',
+    HIGH: 'error',
+    MEDIUM: 'warning',
+    LOW: 'note',
+    FUTURE: 'note',
+};
+/** A finding is reported only when it is not a success or a skip. */
+const REPORTED_STATUSES = new Set([
+    'FAIL',
+    'WRONG',
+    'MISSING',
+    'DEPRECATED',
+    'EXPERIMENTAL',
+    'UNKNOWN',
+]);
+/** Normalize an engine path to a SARIF-friendly, repo-relative URI. */
+export function sarifUri(file) {
+    const posix = file.split(path.sep).join('/');
+    return posix.startsWith('./') ? posix.slice(2) : posix;
+}
+function region(l) {
+    return typeof l.line === 'number' ? { startLine: l.line } : undefined;
+}
+function locationsOf(f) {
+    return f.locations.map((l) => {
+        const physicalLocation = {
+            artifactLocation: { uri: sarifUri(l.file) },
+        };
+        const r = region(l);
+        if (r)
+            physicalLocation.region = r;
+        return { physicalLocation };
+    });
+}
+function toRule(f) {
+    const help = f.remediation
+        ? { text: `${f.why ? `${f.why}\n\n` : ''}${f.remediation}` }
+        : f.why
+            ? { text: f.why }
+            : undefined;
+    const firstRef = f.references?.[0];
+    return {
+        id: f.ruleId,
+        name: f.ruleId,
+        shortDescription: { text: f.title },
+        ...(f.why ? { fullDescription: { text: f.why } } : {}),
+        ...(help ? { help } : {}),
+        ...(firstRef ? { helpUri: firstRef } : {}),
+        defaultConfiguration: { level: SEVERITY_LEVEL[f.severity] },
+        properties: {
+            section: f.section,
+            sectionTitle: f.sectionTitle,
+            severity: f.severity,
+            baseSeverity: f.baseSeverity,
+            ruleClass: f.ruleClass,
+            ...(f.automatability ? { automatability: f.automatability } : {}),
+        },
+    };
+}
+function toResult(f, ruleIndex) {
+    const isJudgement = f.status === 'UNKNOWN';
+    const result = {
+        ruleId: f.ruleId,
+        ruleIndex,
+        level: isJudgement ? 'note' : SEVERITY_LEVEL[f.severity],
+        kind: isJudgement ? 'informational' : 'fail',
+        message: { text: f.message },
+        locations: locationsOf(f),
+    };
+    if (f.suppressedReason) {
+        result.suppressions = [{ kind: 'external', justification: f.suppressedReason }];
+    }
+    return result;
+}
+/** Builds a SARIF 2.1.0 log from an audit report. */
+export function toSarif(report) {
+    const reported = report.findings.filter((f) => REPORTED_STATUSES.has(f.status));
+    // One SARIF rule entry per distinct rule id, in first-seen order so ruleIndex
+    // stays stable for a given report.
+    const ruleIndex = new Map();
+    const rules = [];
+    for (const f of reported) {
+        if (!ruleIndex.has(f.ruleId)) {
+            ruleIndex.set(f.ruleId, rules.length);
+            rules.push(toRule(f));
+        }
+    }
+    const results = reported.map((f) => toResult(f, ruleIndex.get(f.ruleId)));
+    return {
+        version: SARIF_VERSION,
+        $schema: SARIF_SCHEMA,
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'USA — Universal Software Auditor',
+                        version: report.usaVersion,
+                        informationUri: 'https://github.com/Er-Sajan-PLG/universal-software-auditor',
+                        rules,
+                    },
+                },
+                results,
+                invocations: [{ executionSuccessful: true }],
+            },
+        ],
+    };
+}
+/** Renders an AuditReport as pretty-printed SARIF 2.1.0 (trailing newline). */
+export function renderSarif(report) {
+    return `${JSON.stringify(toSarif(report), null, 2)}\n`;
+}
+//# sourceMappingURL=sarif.js.map

package/dist/report/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,YAAY,GACvB,gGAAgG,CAAC;AAKnG,MAAM,cAAc,GAAiC;IACnD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,MAAM;IACX,MAAM,EAAE,MAAM;CACf,CAAC;AAEF,qEAAqE;AACrE,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAS;IAC7D,MAAM;IACN,OAAO;IACP,SAAS;IACT,YAAY;IACZ,cAAc;IACd,SAAS;CACV,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,SAAS,MAAM,CAAC,CAAW;IACzB,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AASD,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,gBAAgB,GAA8C;YAClE,gBAAgB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;SAC5C,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC;YAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;QACnC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAaD,SAAS,MAAM,CAAC,CAAU;IACxB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW;QACxB,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QAC5D,CAAC,CAAC,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE;YACjB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,MAAM;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM;QACd,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE;QACnC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,oBAAoB,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QAC3D,UAAU,EAAE;YACV,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;KACF,CAAC;AACJ,CAAC;AAYD,SAAS,QAAQ,CAAC,CAAU,EAAE,SAAiB;IAC7C,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAgB;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS;QACT,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM;QAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;KAC1B,CAAC;IACF,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvB,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAmBD,qDAAqD;AACrD,MAAM,UAAU,OAAO,CAAC,MAAmB;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,8EAA8E;IAC9E,mCAAmC;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC;IAE3E,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,MAAM,CAAC,UAAU;wBAC1B,cAAc,EAAE,4DAA4D;wBAC5E,KAAK;qBACN;iBACF;gBACD,OAAO;gBACP,WAAW,EAAE,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;aAC7C;SACF;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC"}

package/dist/report/signature.d.ts

@@ -0,0 +1,76 @@
+import type { AuditReport } from '../types.js';
+/**
+ * Verify-side support for detached report signatures (Sigstore/cosign).
+ *
+ * ADR-0011 boundary: USA ships NO signer. There is deliberately no
+ * `signReport()` here — minting a signature would cross the charter
+ * constraint ("no signer") and must re-open ADR-0011 first. This module only
+ * consumes evidence produced elsewhere: it builds the deterministic payload
+ * bytes a report signs over, parses a `.sig.json` sidecar, and shells out to
+ * an external `cosign` binary to verify it — the same opt-in posture as
+ * `command` checks (absent binary = explicit error, NEVER a fake pass).
+ *
+ * Deterministic/offline core: everything here is pure bytes except the
+ * explicitly-invoked local `cosign verify-blob` subprocess. No network calls.
+ */
+export declare const SIGNATURE_SCHEMA = "usa-report-sig-v1";
+export declare const SIDECAR_SUFFIX = ".sig.json";
+/**
+ * Deterministic payload bytes of a report: the single canonical trailer
+ * projection from `markdown.ts`, UTF-8 encoded with a trailing newline.
+ * No second canonicalization is invented here — whatever `usa diff` parses
+ * is exactly what a signature binds to.
+ */
+export declare function canonicalReportBytes(report: AuditReport): Buffer;
+/** Lowercase hex SHA-256 of bytes (or a UTF-8 string). */
+export declare function sha256Hex(data: Uint8Array | string): string;
+/**
+ * Detached-signature sidecar (the `.sig.json` file beside a report).
+ * `bundle` is the base64-encoded Sigstore bundle as written by
+ * `cosign sign-blob --bundle` — kept base64 so the sidecar stays plain JSON.
+ */
+export interface DetachedSignature {
+    schema: typeof SIGNATURE_SCHEMA;
+    /** Hex SHA-256 of `canonicalReportBytes(report)` at signing time. */
+    payloadSha256: string;
+    /** Base64-encoded Sigstore bundle binding the payload to a key. */
+    bundle: string;
+    keyHint?: string;
+    createdAt?: string;
+}
+/**
+ * Parses a `.sig.json` sidecar. Fail-closed: anything malformed throws —
+ * a corrupt sidecar is an operator error, never something to verify past.
+ */
+export declare function parseDetachedSignature(raw: string): DetachedSignature;
+/** Serializes a sidecar to prettier-stable JSON (trailing newline). */
+export declare function formatDetachedSignature(sig: DetachedSignature): string;
+/** True when the external `cosign` binary runs. Never throws. */
+export declare function isCosignAvailable(cosignBinary?: string): boolean;
+export interface VerifyOptions {
+    /** Path to the PEM-encoded public key the bundle is verified against. */
+    publicKeyPath: string;
+    /** Override the `cosign` binary (tests, custom installs). */
+    cosignBinary?: string;
+    /** Subprocess timeout in ms (default 60 s, mirroring `command` checks). */
+    timeoutMs?: number;
+}
+export interface VerifyResult {
+    ok: boolean;
+    detail: string;
+}
+/**
+ * Verifies a report's detached signature against a public key.
+ *
+ * Fail-closed contract:
+ * - payload hash mismatch → `{ ok: false }` (report changed after signing);
+ * - missing public key, cosign rejection, timeout → `{ ok: false }`;
+ * - malformed sidecar → throws (cannot even attempt verification);
+ * - absent `cosign` binary → throws an explicit error (same posture as
+ *   `command` checks: an unverifiable report is NEVER reported as passing).
+ *
+ * The only external touch is the local `cosign verify-blob` subprocess;
+ * no network calls are made from this module.
+ */
+export declare function verifyDetachedSignature(payload: AuditReport | Uint8Array, signature: DetachedSignature | string, options: VerifyOptions): VerifyResult;
+//# sourceMappingURL=signature.d.ts.map

package/dist/report/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/report/signature.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AACpD,eAAO,MAAM,cAAc,cAAc,CAAC;AAG1C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEhE;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAI3D;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,gBAAgB,CAAC;IAChC,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAsDD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CASrE;AAED,uEAAuE;AACvE,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAGtE;AAED,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,YAAY,SAAW,GAAG,OAAO,CAWlE;AAED,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAiED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,WAAW,GAAG,UAAU,EACjC,SAAS,EAAE,iBAAiB,GAAG,MAAM,EACrC,OAAO,EAAE,aAAa,GACrB,YAAY,CAmCd"}

package/dist/report/signature.js

@@ -0,0 +1,206 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { trailer } from './markdown.js';
+/**
+ * Verify-side support for detached report signatures (Sigstore/cosign).
+ *
+ * ADR-0011 boundary: USA ships NO signer. There is deliberately no
+ * `signReport()` here — minting a signature would cross the charter
+ * constraint ("no signer") and must re-open ADR-0011 first. This module only
+ * consumes evidence produced elsewhere: it builds the deterministic payload
+ * bytes a report signs over, parses a `.sig.json` sidecar, and shells out to
+ * an external `cosign` binary to verify it — the same opt-in posture as
+ * `command` checks (absent binary = explicit error, NEVER a fake pass).
+ *
+ * Deterministic/offline core: everything here is pure bytes except the
+ * explicitly-invoked local `cosign verify-blob` subprocess. No network calls.
+ */
+export const SIGNATURE_SCHEMA = 'usa-report-sig-v1';
+export const SIDECAR_SUFFIX = '.sig.json';
+const DEFAULT_TIMEOUT_MS = 60_000;
+/**
+ * Deterministic payload bytes of a report: the single canonical trailer
+ * projection from `markdown.ts`, UTF-8 encoded with a trailing newline.
+ * No second canonicalization is invented here — whatever `usa diff` parses
+ * is exactly what a signature binds to.
+ */
+export function canonicalReportBytes(report) {
+    return Buffer.from(`${trailer(report)}\n`, 'utf8');
+}
+/** Lowercase hex SHA-256 of bytes (or a UTF-8 string). */
+export function sha256Hex(data) {
+    const h = createHash('sha256');
+    h.update(typeof data === 'string' ? Buffer.from(data, 'utf8') : data);
+    return h.digest('hex');
+}
+const HEX64 = /^[0-9a-f]{64}$/;
+const BASE64 = /^[A-Za-z0-9+/=\s]+$/;
+function assertSidecarSchema(s) {
+    if (s['schema'] !== SIGNATURE_SCHEMA) {
+        throw new Error(`unsupported signature schema ${JSON.stringify(s['schema'])} — expected ${JSON.stringify(SIGNATURE_SCHEMA)}`);
+    }
+}
+function assertSidecarHash(s) {
+    if (typeof s['payloadSha256'] !== 'string' || !HEX64.test(s['payloadSha256'])) {
+        throw new Error('signature sidecar has no valid payloadSha256 (expected 64 lowercase hex chars)');
+    }
+}
+function decodedBundleLength(bundle) {
+    try {
+        return Buffer.from(bundle, 'base64').length;
+    }
+    catch {
+        return 0;
+    }
+}
+function assertSidecarBundle(s) {
+    if (typeof s['bundle'] !== 'string' || s['bundle'].length === 0 || !BASE64.test(s['bundle'])) {
+        throw new Error('signature sidecar has no valid bundle (expected non-empty base64)');
+    }
+    if (decodedBundleLength(s['bundle']) === 0) {
+        throw new Error('signature sidecar bundle decodes to zero bytes');
+    }
+}
+function assertSidecarShape(sig) {
+    if (typeof sig !== 'object' || sig === null || Array.isArray(sig)) {
+        throw new Error('signature sidecar must be a JSON object, got a non-object');
+    }
+    const s = sig;
+    assertSidecarSchema(s);
+    assertSidecarHash(s);
+    assertSidecarBundle(s);
+    if (s['keyHint'] !== undefined && typeof s['keyHint'] !== 'string') {
+        throw new Error('signature sidecar keyHint must be a string when present');
+    }
+    if (s['createdAt'] !== undefined && typeof s['createdAt'] !== 'string') {
+        throw new Error('signature sidecar createdAt must be a string when present');
+    }
+}
+/**
+ * Parses a `.sig.json` sidecar. Fail-closed: anything malformed throws —
+ * a corrupt sidecar is an operator error, never something to verify past.
+ */
+export function parseDetachedSignature(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('signature sidecar is not valid JSON');
+    }
+    assertSidecarShape(parsed);
+    return parsed;
+}
+/** Serializes a sidecar to prettier-stable JSON (trailing newline). */
+export function formatDetachedSignature(sig) {
+    assertSidecarShape(sig);
+    return `${JSON.stringify(sig, null, 2)}\n`;
+}
+/** True when the external `cosign` binary runs. Never throws. */
+export function isCosignAvailable(cosignBinary = 'cosign') {
+    try {
+        execFileSync(cosignBinary, ['version'], {
+            encoding: 'utf8',
+            timeout: 15_000,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function truncate(s, n) {
+    const flat = s.replace(/\s+/g, ' ').trim();
+    return flat.length > n ? `${flat.slice(0, n)}…` : flat;
+}
+/** Returns a fail-closed refusal detail, or null when the key file is usable. */
+function checkPublicKey(publicKeyPath) {
+    if (!publicKeyPath) {
+        return 'no public key supplied — cannot verify a signature without one';
+    }
+    let isFile;
+    try {
+        isFile = fs.statSync(publicKeyPath).isFile();
+    }
+    catch {
+        return `public key not found at ${publicKeyPath} — refusing to pass an unverifiable report`;
+    }
+    return isFile
+        ? null
+        : `public key at ${publicKeyPath} is not a file — refusing to pass an unverifiable report`;
+}
+/**
+ * Runs the single allowed external touch: the local `cosign verify-blob`
+ * subprocess. Cosign rejections come back as `{ ok: false }`; only an
+ * absent binary throws (explicitly — never a fake pass).
+ */
+function runCosignVerify(binary, publicKeyPath, bundlePath, payloadPath, timeoutMs) {
+    try {
+        const out = execFileSync(binary, ['verify-blob', '--key', publicKeyPath, '--bundle', bundlePath, payloadPath], {
+            encoding: 'utf8',
+            timeout: timeoutMs,
+            maxBuffer: 1 * 1024 * 1024,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        return { ok: true, detail: truncate(out, 200) || 'signature verified' };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/ENOENT/i.test(msg)) {
+            // Same posture as `command` checks: the tool is absent, so the check
+            // is explicitly un-runnable — throw rather than return ok:false, so
+            // no caller can mistake this for a completed verification.
+            throw new Error(`cosign binary not found (${binary}) — install cosign to verify report signatures; refusing to pass an unverified report`, { cause: err });
+        }
+        return {
+            ok: false,
+            detail: `cosign verify-blob rejected the signature: ${truncate(msg, 300)}`,
+        };
+    }
+}
+/**
+ * Verifies a report's detached signature against a public key.
+ *
+ * Fail-closed contract:
+ * - payload hash mismatch → `{ ok: false }` (report changed after signing);
+ * - missing public key, cosign rejection, timeout → `{ ok: false }`;
+ * - malformed sidecar → throws (cannot even attempt verification);
+ * - absent `cosign` binary → throws an explicit error (same posture as
+ *   `command` checks: an unverifiable report is NEVER reported as passing).
+ *
+ * The only external touch is the local `cosign verify-blob` subprocess;
+ * no network calls are made from this module.
+ */
+export function verifyDetachedSignature(payload, signature, options) {
+    const sig = typeof signature === 'string' ? parseDetachedSignature(signature) : signature;
+    assertSidecarShape(sig);
+    const bytes = payload instanceof Uint8Array ? payload : canonicalReportBytes(payload);
+    const binary = options.cosignBinary ?? 'cosign';
+    const actual = sha256Hex(bytes);
+    if (actual !== sig.payloadSha256) {
+        return {
+            ok: false,
+            detail: `payload hash mismatch — report changed after signing (sidecar binds ${sig.payloadSha256}, payload hashes to ${actual})`,
+        };
+    }
+    const keyRefusal = checkPublicKey(options.publicKeyPath);
+    if (keyRefusal !== null) {
+        return { ok: false, detail: keyRefusal };
+    }
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'usa-sig-verify-'));
+    try {
+        const payloadPath = path.join(dir, 'payload.bin');
+        const bundlePath = path.join(dir, 'bundle.json');
+        fs.writeFileSync(payloadPath, bytes);
+        fs.writeFileSync(bundlePath, Buffer.from(sig.bundle, 'base64'));
+        return runCosignVerify(binary, options.publicKeyPath, bundlePath, payloadPath, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=signature.js.map

package/dist/report/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/report/signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,IAAyB;IACjD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAiBD,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC;AAErC,SAAS,mBAAmB,CAAC,CAA0B;IACrD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,CAA0B;IACnD,IAAI,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,CAA0B;IACrD,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACvB,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACrB,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,YAAY,GAAG,QAAQ;IACvD,IAAI,CAAC;QACH,YAAY,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAgBD,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,aAAqB;IAC3C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,gEAAgE,CAAC;IAC1E,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,aAAa,4CAA4C,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM;QACX,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,iBAAiB,aAAa,0DAA0D,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,MAAc,EACd,aAAqB,EACrB,UAAkB,EAClB,WAAmB,EACnB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,MAAM,EACN,CAAC,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,EAC5E;YACE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CACF,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,oBAAoB,EAAE,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,2DAA2D;YAC3D,MAAM,IAAI,KAAK,CACb,4BAA4B,MAAM,uFAAuF,EACzH,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8CAA8C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;SAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAiC,EACjC,SAAqC,EACrC,OAAsB;IAEtB,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG,OAAO,YAAY,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC;IAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uEAAuE,GAAG,CAAC,aAAa,uBAAuB,MAAM,GAAG;SACjI,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChE,OAAO,eAAe,CACpB,MAAM,EACN,OAAO,CAAC,aAAa,EACrB,UAAU,EACV,WAAW,EACX,OAAO,CAAC,SAAS,IAAI,kBAAkB,CACxC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}