autoremediator 0.21.2 → 0.22.0

package/dist/api/evidence-pack/index.js

@@ -0,0 +1,482 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { loadPolicy } from "../../platform/policy.js";
+import { fingerprintRepo } from "../../runs/fingerprint.js";
+import { sha256 } from "../../runs/hash.js";
+import { isRunId } from "../../runs/ids.js";
+import { RunStore } from "../../runs/run-store.js";
+import { PACKAGE_VERSION } from "../../version.js";
+import { loadProjectLocks } from "../incident/project.js";
+import { PACK_PREDICATE_TYPE, STATEMENT_TYPE, buildRunStatement, projectSubjects, } from "./attest.js";
+import { factKey } from "./components.js";
+import { buildCraDraft, parseAwareness } from "./cra.js";
+import { createEnvelope, decodeBase64, loadPublicKey, loadSigningKey, verifyEnvelope, } from "./dsse.js";
+import { collectFindings } from "./findings.js";
+import { renderReadme } from "./readme.js";
+import { buildSbom, productIdentity } from "./sbom.js";
+import { buildCycloneDxVex, buildOpenVex } from "./vex.js";
+export { craDeadlines, parseAwareness } from "./cra.js";
+export { INTOTO_PAYLOAD_TYPE, pae } from "./dsse.js";
+export { PACK_PREDICATE_TYPE, RUN_PREDICATE_TYPE } from "./attest.js";
+/** Environment variable naming a PEM private key file to sign attestations with (CLI and SDK only). */
+export const SIGNING_KEY_ENV = "AUTOREMEDIATOR_EVIDENCE_SIGNING_KEY";
+export const EVIDENCE_PACK_DISCLAIMER = "Evidence assembled by autoremediator from files on this machine. It is not legal advice, not a conformity assessment and not a claim that any product complies with Regulation (EU) 2024/2847. The statements in it have not been reviewed by a person.";
+const PACK_STATEMENT_FILES = ["attestations/pack.intoto.json", "attestations/pack.statement.json"];
+function jsonText(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Remove what an earlier pack wrote, so a regenerated pack never mixes old and new files. */
+function clearEarlierPack(outDir) {
+    const notAPack = (why) => new Error(`outDir "${outDir}" is not empty and its manifest.json is not an autoremediator evidence pack manifest (${why}). Nothing was removed. Choose an empty or new directory.`);
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(outDir, "manifest.json"), "utf8"));
+    }
+    catch {
+        throw notAPack("it is not JSON");
+    }
+    if (!record(manifest))
+        throw notAPack("it is not an object");
+    const generator = manifest["generator"];
+    if (manifest["schemaVersion"] !== "1" ||
+        !record(generator) ||
+        generator["name"] !== "autoremediator") {
+        throw notAPack("it was not written by autoremediator");
+    }
+    const entries = manifest["files"];
+    if (!Array.isArray(entries))
+        throw notAPack("it lists no files");
+    // Only the files the manifest lists, by relative path inside outDir, with the digest it recorded.
+    const root = resolve(outDir);
+    const listed = [];
+    for (const entry of entries) {
+        const path = record(entry) ? entry["path"] : undefined;
+        const digest = record(entry) ? entry["sha256"] : undefined;
+        if (typeof path !== "string" || typeof digest !== "string")
+            throw notAPack("a file entry is malformed");
+        const target = resolve(root, path);
+        if (path === "" ||
+            isAbsolute(path) ||
+            path === "manifest.json" ||
+            !target.startsWith(`${root}${sep}`)) {
+            throw notAPack(`it lists a path outside the pack: ${JSON.stringify(path)}`);
+        }
+        listed.push({ path, sha256: digest });
+    }
+    const changed = listed.flatMap(({ path, sha256: digest }) => {
+        const full = join(outDir, path);
+        return existsSync(full) && sha256(readFileSync(full, "utf8")) !== digest ? [path] : [];
+    });
+    if (changed.length > 0) {
+        throw new Error(`outDir "${outDir}" holds an evidence pack whose files changed since the pack was written: ${changed.toSorted().join(", ")}. Nothing was removed. Move or restore them, or choose a new directory.`);
+    }
+    const removed = [...listed.map(({ path }) => path), ...PACK_STATEMENT_FILES, "manifest.json"];
+    const directories = new Set();
+    for (const path of removed) {
+        rmSync(join(outDir, path), { force: true });
+        for (let dir = dirname(path); dir !== "." && dir !== "/"; dir = dirname(dir))
+            directories.add(dir);
+    }
+    // Remove only the directories the pack itself made, deepest first, and only when nothing else is in them.
+    for (const dir of [...directories].toSorted((a, b) => b.length - a.length)) {
+        const full = join(outDir, dir);
+        if (existsSync(full) && readdirSync(full).length === 0)
+            rmdirSync(full);
+    }
+}
+function prepareOutDir(outDir) {
+    if (!existsSync(outDir)) {
+        mkdirSync(outDir, { recursive: true });
+        return;
+    }
+    if (!statSync(outDir).isDirectory())
+        throw new Error(`outDir "${outDir}" exists and is not a directory.`);
+    const entries = readdirSync(outDir);
+    if (entries.length === 0)
+        return;
+    if (!entries.includes("manifest.json")) {
+        throw new Error(`outDir "${outDir}" is not empty and does not hold an evidence pack (no manifest.json). Choose an empty or new directory.`);
+    }
+    clearEarlierPack(outDir);
+}
+function resolveSigningKey(options, env) {
+    const fromOption = options.signingKeyPath;
+    // Remote callers (MCP, HTTP) must name the key themselves, inside the allowed roots; the
+    // operator's environment key is not theirs to use.
+    const trustedCaller = options.source === undefined || options.source === "cli" || options.source === "sdk";
+    const fromEnv = trustedCaller ? env[SIGNING_KEY_ENV] : undefined;
+    const path = fromOption ?? (fromEnv && fromEnv.trim() !== "" ? fromEnv : undefined);
+    return path ? loadSigningKey(resolve(options.cwd ?? process.cwd(), path)) : undefined;
+}
+/**
+ * Assemble an evidence pack from what is on this machine: a CycloneDX 1.6 SBOM of the lockfile,
+ * CycloneDX and OpenVEX statements from policy suppressions and recorded runs, Article 14
+ * reporting drafts for CISA-KEV-listed advisories, and in-toto attestations of the recorded runs'
+ * ledgers (signed only when a key is given), with a manifest of sha256 digests. Nothing is
+ * fetched and nothing is submitted. Files are written only under `outDir`.
+ */
+export async function buildEvidencePack(options, deps = {}) {
+    const now = (deps.now ?? (() => new Date()))();
+    const cwd = resolve(options.cwd ?? process.cwd());
+    const outDir = resolve(cwd, options.outDir);
+    const env = deps.env ?? process.env;
+    const notes = [];
+    // Validate everything that can be refused before anything is written.
+    const awareness = options.awarenessAt
+        ? parseAwareness(options.awarenessAt, "awarenessAt")
+        : undefined;
+    const awarenessByCve = new Map();
+    for (const [cveId, value] of Object.entries(options.awarenessByCve ?? {})) {
+        awarenessByCve.set(cveId.toUpperCase(), parseAwareness(value, `awarenessByCve[${cveId}]`));
+    }
+    const correctiveMeasureAt = options.correctiveMeasureAt
+        ? parseAwareness(options.correctiveMeasureAt, "correctiveMeasureAt")
+        : undefined;
+    const key = resolveSigningKey({ ...options, cwd }, env);
+    const policy = loadPolicy(cwd, options.policy);
+    const store = new RunStore(cwd);
+    for (const runId of options.runIds ?? []) {
+        if (!isRunId(runId) || !store.exists(runId))
+            throw new Error(`Run not found: ${runId}`);
+    }
+    const runs = options.runIds ? options.runIds.map((runId) => store.load(runId)) : store.list();
+    if (runs.length === 0) {
+        notes.push("No recorded runs were found under .autoremediator/runs/, so the pack has no run attestations and no run-based VEX statements.");
+    }
+    const product = productIdentity(cwd, {
+        ...(options.productName ? { name: options.productName } : {}),
+        ...(options.productVersion ? { version: options.productVersion } : {}),
+        ...(options.manufacturer ? { manufacturer: options.manufacturer } : {}),
+    });
+    // Report SBOM entries: newest run wins per package version.
+    const reportEntries = new Map();
+    for (const run of runs.toSorted((a, b) => a.createdAt.localeCompare(b.createdAt))) {
+        for (const entry of store.readReport(run.runId)?.sbom ?? []) {
+            reportEntries.set(factKey(entry.name, entry.version), entry);
+        }
+    }
+    const locks = loadProjectLocks(cwd);
+    const sbom = buildSbom({ cwd, product, locks, reportEntries, toolVersion: PACKAGE_VERSION, now });
+    notes.push(...sbom.notes);
+    const found = collectFindings({
+        store,
+        runs,
+        suppressions: policy.suppressions ?? [],
+        locked: sbom.source === "report" ? undefined : sbom.locked,
+    });
+    notes.push(...found.notes);
+    const byStatus = {
+        fixed: 0,
+        affected: 0,
+        not_affected: 0,
+        under_investigation: 0,
+    };
+    for (const finding of found.findings)
+        byStatus[finding.status] += 1;
+    const cdxVex = buildCycloneDxVex({
+        findings: found.findings,
+        cves: found.cves,
+        product,
+        toolVersion: PACKAGE_VERSION,
+        now,
+    });
+    const openVex = buildOpenVex({
+        findings: found.findings,
+        product,
+        ...((options.author ?? options.manufacturer)
+            ? { author: (options.author ?? options.manufacturer) }
+            : {}),
+        toolVersion: PACKAGE_VERSION,
+        now,
+    });
+    // Article 14 drafts: advisories CISA lists as exploited that the product is not recorded as unaffected by.
+    const craReports = [];
+    const drafts = [];
+    const kevCves = [...found.cves.entries()].filter(([, details]) => details?.kev?.knownExploited);
+    for (const [cveId, details] of kevCves) {
+        const relevant = found.findings.filter((finding) => finding.cveId.toUpperCase() === cveId.toUpperCase() && finding.status !== "not_affected");
+        if (relevant.length === 0) {
+            notes.push(`${cveId} is in the CISA KEV catalog but no finding says it affects the product (not affected, or no component recorded); no draft was written.`);
+            continue;
+        }
+        const draft = buildCraDraft({
+            cveId,
+            details,
+            findings: relevant,
+            product,
+            ...((awarenessByCve.get(cveId.toUpperCase()) ?? awareness)
+                ? { awareness: (awarenessByCve.get(cveId.toUpperCase()) ?? awareness) }
+                : {}),
+            ...(correctiveMeasureAt ? { correctiveMeasureAvailableAt: correctiveMeasureAt } : {}),
+            generatedAt: now,
+            toolVersion: PACKAGE_VERSION,
+        });
+        drafts.push({ path: `cra-reports/${draft.fileName}`, content: draft.markdown });
+        craReports.push({
+            cveId,
+            file: `cra-reports/${draft.fileName}`,
+            status: draft.status,
+            ...(draft.deadlines ? { deadlines: draft.deadlines } : {}),
+        });
+    }
+    for (const cveId of awarenessByCve.keys()) {
+        if (!kevCves.some(([id]) => id.toUpperCase() === cveId)) {
+            notes.push(`An awareness time was given for ${cveId}, but no recorded run lists it as known exploited, so it has no draft.`);
+        }
+    }
+    if (kevCves.length === 0) {
+        notes.push("No recorded run lists an advisory in the CISA KEV catalog, so there are no Article 14 drafts. KEV data comes only from earlier runs; nothing was looked up now.");
+    }
+    else if (!awareness && awarenessByCve.size === 0) {
+        notes.push("No awareness time was given (--awareness-at), so the drafts state the 24 hour and 72 hour rules but no dates.");
+    }
+    // Attestations.
+    const subjects = projectSubjects(cwd);
+    const currentFilesSha256 = (await fingerprintRepo(cwd, options.policy)).filesSha256;
+    const contents = new Map();
+    const attestations = [];
+    const skippedRuns = [];
+    for (const run of runs.toSorted((a, b) => a.createdAt.localeCompare(b.createdAt))) {
+        const built = buildRunStatement({
+            store,
+            run,
+            subjects,
+            currentFilesSha256,
+            toolVersion: PACKAGE_VERSION,
+            now,
+        });
+        if (!built.ok) {
+            skippedRuns.push({ runId: run.runId, reason: built.reason });
+            continue;
+        }
+        const body = JSON.stringify(built.statement);
+        const envelope = createEnvelope(body, key);
+        const base = `attestations/run-${run.runId}`;
+        contents.set(`${base}.intoto.json`, { content: jsonText(envelope), kind: "attestation" });
+        contents.set(`${base}.statement.json`, { content: `${body}\n`, kind: "statement" });
+        attestations.push({
+            runId: run.runId,
+            runStatus: run.status,
+            envelope: `${base}.intoto.json`,
+            statement: `${base}.statement.json`,
+            signed: key !== undefined,
+            ledgerHead: built.ledgerHead,
+        });
+    }
+    for (const skipped of skippedRuns)
+        notes.push(`Run ${skipped.runId} has no attestation: ${skipped.reason}.`);
+    if (key) {
+        contents.set("attestations/signing-public-key.pem", {
+            content: key.publicKeyPem,
+            kind: "public-key",
+        });
+    }
+    else {
+        notes.push(`The attestations are unsigned (signatures: []). Pass --signing-key <pem> or set ${SIGNING_KEY_ENV} to sign them.`);
+    }
+    contents.set("sbom/sbom.cdx.json", { content: jsonText(sbom.bom), kind: "sbom" });
+    contents.set("vex/vex.cdx.json", { content: jsonText(cdxVex), kind: "vex" });
+    contents.set("vex/vex.openvex.json", { content: jsonText(openVex), kind: "vex" });
+    for (const draft of drafts)
+        contents.set(draft.path, { content: draft.content, kind: "cra-draft" });
+    const result = {
+        schemaVersion: "1",
+        outDir,
+        generatedAt: now.toISOString(),
+        disclaimer: EVIDENCE_PACK_DISCLAIMER,
+        signed: key !== undefined,
+        ...(key ? { signingKeyId: key.keyid, signingAlgorithm: key.algorithm } : {}),
+        files: [],
+        manifest: { path: "manifest.json", sha256: "", bytes: 0, kind: "manifest" },
+        packAttestation: {
+            envelope: PACK_STATEMENT_FILES[0],
+            statement: PACK_STATEMENT_FILES[1],
+            signed: key !== undefined,
+            manifestSha256: "",
+        },
+        sbom: {
+            file: "sbom/sbom.cdx.json",
+            specVersion: "1.6",
+            source: sbom.source,
+            components: sbom.componentCount,
+            withHash: sbom.withHash,
+            withLicense: sbom.withLicense,
+        },
+        vex: {
+            cycloneDxFile: "vex/vex.cdx.json",
+            openVexFile: "vex/vex.openvex.json",
+            statements: found.findings.length,
+            byStatus,
+        },
+        craReports,
+        attestations,
+        skippedRuns,
+        notes,
+    };
+    contents.set("README.md", { content: renderReadme(result, product), kind: "readme" });
+    // Write, then hash exactly what was written.
+    prepareOutDir(outDir);
+    const write = (path, content) => {
+        const full = join(outDir, path);
+        mkdirSync(dirname(full), { recursive: true });
+        writeFileSync(full, content, "utf8");
+        return Buffer.byteLength(content, "utf8");
+    };
+    const files = [...contents.entries()]
+        .toSorted(([a], [b]) => a.localeCompare(b))
+        .map(([path, { content, kind }]) => ({
+        path,
+        sha256: sha256(content),
+        bytes: write(path, content),
+        kind,
+    }));
+    const manifestText = jsonText({
+        schemaVersion: "1",
+        generator: { name: "autoremediator", version: PACKAGE_VERSION },
+        generatedAt: result.generatedAt,
+        disclaimer: EVIDENCE_PACK_DISCLAIMER,
+        signed: result.signed,
+        ...(key ? { signingKeyId: key.keyid, signingAlgorithm: key.algorithm } : {}),
+        excludedFromManifest: PACK_STATEMENT_FILES,
+        files: files.map(({ path, sha256: digest, bytes, kind }) => ({
+            path,
+            sha256: digest,
+            bytes,
+            kind,
+        })),
+    });
+    const manifestBytes = write("manifest.json", manifestText);
+    const manifestSha256 = sha256(manifestText);
+    const packStatement = {
+        _type: STATEMENT_TYPE,
+        subject: [{ name: "manifest.json", digest: { sha256: manifestSha256 } }],
+        predicateType: PACK_PREDICATE_TYPE,
+        predicate: {
+            generator: { name: "autoremediator", version: PACKAGE_VERSION },
+            attestedAt: result.generatedAt,
+            disclaimer: EVIDENCE_PACK_DISCLAIMER,
+            files: files.length,
+            runAttestations: attestations.map((entry) => ({
+                runId: entry.runId,
+                ledgerHead: entry.ledgerHead,
+            })),
+        },
+    };
+    const packBody = JSON.stringify(packStatement);
+    write(PACK_STATEMENT_FILES[0], jsonText(createEnvelope(packBody, key)));
+    write(PACK_STATEMENT_FILES[1], `${packBody}\n`);
+    return {
+        ...result,
+        files,
+        manifest: {
+            path: "manifest.json",
+            sha256: manifestSha256,
+            bytes: manifestBytes,
+            kind: "manifest",
+        },
+        packAttestation: { ...result.packAttestation, manifestSha256 },
+    };
+}
+function listFiles(dir, prefix = "") {
+    return readdirSync(dir).flatMap((name) => {
+        const rel = prefix === "" ? name : `${prefix}/${name}`;
+        return statSync(join(dir, name)).isDirectory() ? listFiles(join(dir, name), rel) : [rel];
+    });
+}
+/**
+ * Check a pack against its own manifest: every file's sha256, no missing or unlisted files, and the
+ * pack attestation's subject. With `publicKeyPath`, also verify every DSSE signature against that
+ * key. The key included in the pack is not a trust anchor (whoever tampered with the pack could
+ * replace it), so it is never used for verification.
+ */
+export function verifyEvidencePack(packDir, options = {}) {
+    const dir = resolve(packDir);
+    const problems = [];
+    const notes = [];
+    const manifestPath = join(dir, "manifest.json");
+    if (!existsSync(manifestPath)) {
+        return {
+            ok: false,
+            signed: false,
+            signaturesVerified: false,
+            problems: ["manifest.json is missing"],
+            notes,
+        };
+    }
+    const manifestText = readFileSync(manifestPath, "utf8");
+    const manifest = JSON.parse(manifestText);
+    const listed = new Set();
+    for (const entry of manifest.files ?? []) {
+        if (typeof entry.path !== "string" || entry.path.includes("..") || entry.path.startsWith("/")) {
+            problems.push(`manifest lists an unsafe path: ${JSON.stringify(entry.path)}`);
+            continue;
+        }
+        listed.add(entry.path);
+        const full = join(dir, entry.path);
+        if (!existsSync(full))
+            problems.push(`missing: ${entry.path}`);
+        else if (sha256(readFileSync(full)) !== entry.sha256)
+            problems.push(`changed: ${entry.path} no longer matches its sha256 in the manifest`);
+    }
+    for (const path of listFiles(dir)) {
+        if (path === "manifest.json" || PACK_STATEMENT_FILES.includes(path) || listed.has(path))
+            continue;
+        problems.push(`unlisted: ${path} is not in the manifest`);
+    }
+    const manifestSha256 = sha256(manifestText);
+    const publicKey = options.publicKeyPath
+        ? loadPublicKey(resolve(options.publicKeyPath))
+        : undefined;
+    let signed = false;
+    let allVerified = publicKey !== undefined;
+    const envelopes = [...listed, ...PACK_STATEMENT_FILES].filter((path) => path.endsWith(".intoto.json"));
+    for (const path of envelopes) {
+        const full = join(dir, path);
+        if (!existsSync(full)) {
+            if (PACK_STATEMENT_FILES.includes(path))
+                problems.push(`missing: ${path}`);
+            continue;
+        }
+        let envelope;
+        let statement;
+        try {
+            envelope = JSON.parse(readFileSync(full, "utf8"));
+            statement = JSON.parse(decodeBase64(envelope.payload).toString("utf8"));
+        }
+        catch {
+            problems.push(`unreadable attestation: ${path}`);
+            continue;
+        }
+        if (envelope.signatures.length > 0)
+            signed = true;
+        if (path === PACK_STATEMENT_FILES[0] &&
+            statement.subject?.[0]?.digest?.sha256 !== manifestSha256) {
+            problems.push(`${path} attests to a different manifest than the one in the pack`);
+        }
+        if (publicKey) {
+            const check = verifyEnvelope(envelope, publicKey);
+            if (!check.ok) {
+                allVerified = false;
+                problems.push(`signature: ${path}: ${check.reason}`);
+            }
+        }
+    }
+    if (!publicKey) {
+        notes.push(signed
+            ? "The attestations are signed, but no --public-key was given, so no signature was checked. The key inside the pack is not a trust anchor."
+            : "The attestations are unsigned: the digests above show the files are unchanged since the manifest was written, not who wrote it.");
+    }
+    else if (!signed) {
+        problems.push("a public key was given but the attestations are not signed");
+        allVerified = false;
+    }
+    return {
+        ok: problems.length === 0,
+        signed,
+        signaturesVerified: publicKey !== undefined && allVerified && signed,
+        problems,
+        notes,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/api/evidence-pack/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/evidence-pack/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,SAAS,EACT,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAEhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,cAAc,EACd,cAAc,GAGf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtE,uGAAuG;AACvG,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAErE,MAAM,CAAC,MAAM,wBAAwB,GACnC,yPAAyP,CAAC;AAoC5P,MAAM,oBAAoB,GAAG,CAAC,+BAA+B,EAAE,kCAAkC,CAAC,CAAC;AAEnG,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAClE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,8FAA8F;AAC9F,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAS,EAAE,CACtC,IAAI,KAAK,CACP,WAAW,MAAM,yFAAyF,GAAG,2DAA2D,CACzK,CAAC;IACJ,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxC,IACE,QAAQ,CAAC,eAAe,CAAC,KAAK,GAAG;QACjC,CAAC,MAAM,CAAC,SAAS,CAAC;QAClB,SAAS,CAAC,MAAM,CAAC,KAAK,gBAAgB,EACtC,CAAC;QACD,MAAM,QAAQ,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEjE,kGAAkG;IAClG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,MAAM,GAA4C,EAAE,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,OAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;YACxD,MAAM,QAAQ,CAAC,2BAA2B,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,IACE,IAAI,KAAK,EAAE;YACX,UAAU,CAAC,IAAI,CAAC;YAChB,IAAI,KAAK,eAAe;YACxB,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,EACnC,CAAC;YACD,MAAM,QAAQ,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,4EAA4E,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,yEAAyE,CACpM,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,oBAAoB,EAAE,eAAe,CAAC,CAAC;IAC9F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAC1E,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,0GAA0G;IAC1G,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;QACjC,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,kCAAkC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,yGAAyG,CAC3H,CAAC;IACJ,CAAC;IACD,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CACxB,OAA4B,EAC5B,GAAsB;IAEtB,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,yFAAyF;IACzF,mDAAmD;IACnD,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IACvF,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,IAAI,GAAG,UAAU,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,IAAI,GAAqB,EAAE;IAE3B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,sEAAsE;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW;QACnC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgB,CAAC;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,KAAK,EAAE,kBAAkB,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB;QACrD,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACpE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,+HAA+H,CAChI,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE;QACnC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqB,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAClF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5D,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,KAAK;QACL,IAAI;QACJ,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;KAC3D,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAA8B;QAC1C,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,mBAAmB,EAAE,CAAC;KACvB,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ;QAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,WAAW,EAAE,eAAe;QAC5B,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,YAAY,CAAC;QAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;YAC1C,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,CAAE,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,WAAW,EAAE,eAAe;QAC5B,GAAG;KACJ,CAAC,CAAC;IAEH,2GAA2G;IAC3G,MAAM,UAAU,GAAqC,EAAE,CAAC;IACxD,MAAM,MAAM,GAA6C,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IAChG,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,CAC3F,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CACR,GAAG,KAAK,wIAAwI,CACjJ,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC;YAC1B,KAAK;YACL,OAAO;YACP,QAAQ,EAAE,QAAQ;YAClB,OAAO;YACP,GAAG,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC;gBACxD,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,SAAS,CAAE,EAAE;gBACxE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,WAAW,EAAE,GAAG;YAChB,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,KAAK,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChF,UAAU,CAAC,IAAI,CAAC;YACd,KAAK;YACL,IAAI,EAAE,eAAe,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CACR,mCAAmC,KAAK,wEAAwE,CACjH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,iKAAiK,CAClK,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CACR,+GAA+G,CAChH,CAAC;IACJ,CAAC;IAED,gBAAgB;IAChB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,kBAAkB,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IACpF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+D,CAAC;IACxF,MAAM,YAAY,GAAuC,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAsC,EAAE,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,KAAK;YACL,GAAG;YACH,QAAQ;YACR,kBAAkB;YAClB,WAAW,EAAE,eAAe;YAC5B,GAAG;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,oBAAoB,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7C,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,cAAc,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1F,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,iBAAiB,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACpF,YAAY,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,MAAM;YACrB,QAAQ,EAAE,GAAG,IAAI,cAAc;YAC/B,SAAS,EAAE,GAAG,IAAI,iBAAiB;YACnC,MAAM,EAAE,GAAG,KAAK,SAAS;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,WAAW;QAC/B,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,KAAK,wBAAwB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,IAAI,GAAG,EAAE,CAAC;QACR,QAAQ,CAAC,GAAG,CAAC,qCAAqC,EAAE;YAClD,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,mFAAmF,eAAe,gBAAgB,CACnH,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,KAAK,MAAM,KAAK,IAAI,MAAM;QACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAuB;QACjC,aAAa,EAAE,GAAG;QAClB,MAAM;QACN,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QAC9B,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,GAAG,KAAK,SAAS;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;QAC3E,eAAe,EAAE;YACf,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAE;YAClC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAE;YACnC,MAAM,EAAE,GAAG,KAAK,SAAS;YACzB,cAAc,EAAE,EAAE;SACnB;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,cAAc;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B;QACD,GAAG,EAAE;YACH,aAAa,EAAE,kBAAkB;YACjC,WAAW,EAAE,sBAAsB;YACnC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YACjC,QAAQ;SACT;QACD,UAAU;QACV,YAAY;QACZ,WAAW;QACX,KAAK;KACN,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtF,6CAA6C;IAC7C,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,OAAe,EAA6B,EAAE;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,KAAK,GAAuB,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;SACtD,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;QACvB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;QAC3B,IAAI;KACL,CAAC,CAAC,CAAC;IAEN,MAAM,YAAY,GAAG,QAAQ,CAAC;QAC5B,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,EAAE;QAC/D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,oBAAoB,EAAE,oBAAoB;QAC1C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,KAAK;YACL,IAAI;SACL,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,KAAK,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAE5C,MAAM,aAAa,GAAc;QAC/B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC;QACxE,aAAa,EAAE,mBAAmB;QAClC,SAAS,EAAE;YACT,SAAS,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,EAAE;YAC/D,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,UAAU,EAAE,wBAAwB;YACpC,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;SACJ;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC/C,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAE,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC;IAEjD,OAAO;QACL,GAAG,MAAM;QACT,KAAK;QACL,QAAQ,EAAE;YACR,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,aAAa;YACpB,IAAI,EAAE,UAAU;SACjB;QACD,eAAe,EAAE,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE;KAC/D,CAAC;AACJ,CAAC;AAiBD,SAAS,SAAS,CAAC,GAAW,EAAE,MAAM,GAAG,EAAE;IACzC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAO,GAA+B,EAAE;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,kBAAkB,EAAE,KAAK;YACzB,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,KAAK;SACN,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAEvC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,QAAQ,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;aAC1D,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;YAClD,QAAQ,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,IAAI,+CAA+C,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,eAAe,IAAI,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YACrF,SAAS;QACX,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa;QACrC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,WAAW,GAAG,SAAS,KAAK,SAAS,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC9B,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,IAAI,QAAsB,CAAC;QAC3B,IAAI,SAAoB,CAAC;QACzB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAiB,CAAC;YAClE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC;QAClD,IACE,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAChC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,cAAc,EACzD,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,2DAA2D,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,WAAW,GAAG,KAAK,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,cAAc,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CACR,MAAM;YACJ,CAAC,CAAC,yIAAyI;YAC3I,CAAC,CAAC,iIAAiI,CACtI,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,MAAM;QACN,kBAAkB,EAAE,SAAS,KAAK,SAAS,IAAI,WAAW,IAAI,MAAM;QACpE,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/api/evidence-pack/readme.d.ts

@@ -0,0 +1,5 @@
+import type { ProductIdentity } from "./sbom.js";
+import type { EvidencePackResult } from "./types.js";
+/** The `README.md` of a pack: what it is, what it is not, what is in it, and how to check it. */
+export declare function renderReadme(result: EvidencePackResult, product: ProductIdentity): string;
+//# sourceMappingURL=readme.d.ts.map

package/dist/api/evidence-pack/readme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readme.d.ts","sourceRoot":"","sources":["../../../src/api/evidence-pack/readme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,CAsDzF"}

package/dist/api/evidence-pack/readme.js

@@ -0,0 +1,55 @@
+/** The `README.md` of a pack: what it is, what it is not, what is in it, and how to check it. */
+export function renderReadme(result, product) {
+    const status = result.vex.byStatus;
+    const reports = result.craReports;
+    const lines = [
+        `# Evidence pack for ${product.name}${product.version ? ` ${product.version}` : ""}`,
+        "",
+        "> **This is evidence assembled by a tool, not legal advice and not a compliance claim.**",
+        "> autoremediator built it from files on one machine: the lockfile, the project's policy file and",
+        "> the runs it recorded under `.autoremediator/runs/`. No person has reviewed it, nothing in it",
+        "> was fetched from the network now, and nothing was submitted to anyone. Whether it satisfies",
+        "> Regulation (EU) 2024/2847 for your product is for you, your notified body or your counsel to decide.",
+        "",
+        `Generated ${result.generatedAt}.`,
+        "",
+        `Attestations: **${result.signed ? `signed (key id ${result.signingKeyId}, ${result.signingAlgorithm})` : "UNSIGNED (`signed: false`; the envelopes have an empty `signatures` list)"}**.`,
+        "",
+        "## Contents",
+        "",
+        "| File | What it is |",
+        "| ---- | ---------- |",
+        `| \`${result.sbom.file}\` | CycloneDX 1.6 SBOM from ${result.sbom.source}: ${result.sbom.components} components, ${result.sbom.withHash} with a hash, ${result.sbom.withLicense} with a license, and the dependency graph. |`,
+        `| \`${result.vex.cycloneDxFile}\` | CycloneDX 1.6 VEX: ${result.vex.statements} vulnerability statements with \`affects\` (fixed ${status.fixed}, affected ${status.affected}, not affected ${status.not_affected}, under investigation ${status.under_investigation}). |`,
+        `| \`${result.vex.openVexFile}\` | The same statements as an OpenVEX v0.2.0 document. |`,
+        `| \`cra-reports/\` | ${reports.length === 0
+            ? "None: no recorded advisory is both listed in the CISA KEV catalog and recorded as affecting the product."
+            : `${reports.length} DRAFT Article 14 report${reports.length === 1 ? "" : "s"}, one per actively exploited advisory (${reports.map((report) => report.cveId).join(", ")}).`} |`,
+        `| \`attestations/run-*.intoto.json\` | ${result.attestations.length} DSSE envelope${result.attestations.length === 1 ? "" : "s"} holding an in-toto statement about a recorded run's hash-chained ledger. \`*.statement.json\` is the bare statement, the exact bytes that were enveloped. |`,
+        "| `manifest.json` | sha256 and size of every file above. |",
+        "| `attestations/pack.intoto.json` | An attestation whose subject is `manifest.json`, so one signature covers the whole pack. |",
+        ...(result.signed
+            ? [
+                "| `attestations/signing-public-key.pem` | The public key of the signing key. Trust it only if you got it from the signer by another route. |",
+            ]
+            : []),
+        "",
+        "## Check it",
+        "",
+        "```bash",
+        "autoremediator evidence-pack verify . --public-key <the signer's public key>   # digests and signatures",
+        "```",
+        "",
+        "Without autoremediator, the digests can be checked against `manifest.json` with any sha256 tool.",
+        "An unsigned pack shows the files are unchanged since the manifest was written; it cannot show who wrote them.",
+        "",
+        "## Notes from this run",
+        "",
+        ...(result.notes.length > 0 ? result.notes.map((note) => `- ${note}`) : ["- None."]),
+        "",
+        "See `docs/guides/evidence-pack.md` in the autoremediator repository for what each document claims, what it does not, and the sources.",
+        "",
+    ];
+    return lines.join("\n");
+}
+//# sourceMappingURL=readme.js.map

package/dist/api/evidence-pack/readme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readme.js","sourceRoot":"","sources":["../../../src/api/evidence-pack/readme.ts"],"names":[],"mappings":"AAGA,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,MAA0B,EAAE,OAAwB;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,uBAAuB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACpF,EAAE;QACF,0FAA0F;QAC1F,kGAAkG;QAClG,gGAAgG;QAChG,+FAA+F;QAC/F,wGAAwG;QACxG,EAAE;QACF,aAAa,MAAM,CAAC,WAAW,GAAG;QAClC,EAAE;QACF,mBAAmB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,2EAA2E,KAAK;QAC1L,EAAE;QACF,aAAa;QACb,EAAE;QACF,uBAAuB;QACvB,uBAAuB;QACvB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,gCAAgC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,gBAAgB,MAAM,CAAC,IAAI,CAAC,QAAQ,iBAAiB,MAAM,CAAC,IAAI,CAAC,WAAW,8CAA8C;QAC9N,OAAO,MAAM,CAAC,GAAG,CAAC,aAAa,2BAA2B,MAAM,CAAC,GAAG,CAAC,UAAU,qDAAqD,MAAM,CAAC,KAAK,cAAc,MAAM,CAAC,QAAQ,kBAAkB,MAAM,CAAC,YAAY,yBAAyB,MAAM,CAAC,mBAAmB,MAAM;QAC3Q,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,2DAA2D;QACxF,wBACE,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,0GAA0G;YAC5G,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,2BAA2B,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,0CAA0C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAC3K,IAAI;QACJ,0CAA0C,MAAM,CAAC,YAAY,CAAC,MAAM,iBAAiB,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,8JAA8J;QAC9R,4DAA4D;QAC5D,gIAAgI;QAChI,GAAG,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC;gBACE,8IAA8I;aAC/I;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;QACF,aAAa;QACb,EAAE;QACF,SAAS;QACT,yGAAyG;QACzG,KAAK;QACL,EAAE;QACF,kGAAkG;QAClG,+GAA+G;QAC/G,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,EAAE;QACF,uIAAuI;QACvI,EAAE;KACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}