autoremediator 0.21.2 → 0.22.0

package/dist/api/evidence-pack/sbom.d.ts

@@ -0,0 +1,87 @@
+import type { SbomEntry } from "../../platform/types.js";
+import type { ProjectLocks } from "../incident/project.js";
+import { type CycloneDxHash, type CycloneDxLicenseChoice } from "./components.js";
+export interface ProductIdentity {
+    name: string;
+    version?: string;
+    description?: string;
+    purl?: string;
+    manufacturer?: string;
+}
+export interface CycloneDxComponent {
+    type: "library" | "application";
+    "bom-ref": string;
+    group?: string;
+    name: string;
+    version?: string;
+    description?: string;
+    scope?: "required" | "optional" | "excluded";
+    purl?: string;
+    hashes?: CycloneDxHash[];
+    licenses?: CycloneDxLicenseChoice[];
+    properties?: Array<{
+        name: string;
+        value: string;
+    }>;
+}
+export interface CycloneDxBom {
+    bomFormat: "CycloneDX";
+    specVersion: "1.6";
+    serialNumber: string;
+    version: number;
+    metadata: {
+        timestamp: string;
+        lifecycles: Array<{
+            phase: "pre-build";
+        }>;
+        tools: {
+            components: CycloneDxComponent[];
+        };
+        component: CycloneDxComponent;
+        manufacturer?: {
+            name: string;
+        };
+        properties: Array<{
+            name: string;
+            value: string;
+        }>;
+    };
+    components: CycloneDxComponent[];
+    dependencies: Array<{
+        ref: string;
+        dependsOn: string[];
+    }>;
+}
+export interface SbomBuild {
+    bom: CycloneDxBom;
+    /** Which lockfile the components came from, or `report` when only a run report's SBOM was available. */
+    source: string;
+    componentCount: number;
+    withHash: number;
+    withLicense: number;
+    /** `name@version` of every component, for later lookups. */
+    locked: Set<string>;
+    notes: string[];
+}
+/** The identity of the product from `package.json`, overridden by what the caller states. */
+export declare function productIdentity(cwd: string, overrides: {
+    name?: string;
+    version?: string;
+    manufacturer?: string;
+}): ProductIdentity;
+/**
+ * A CycloneDX 1.6 SBOM of what the project's lockfile locks: every package as a component with a
+ * purl, a hash where the lockfile records an integrity digest, a license where the lockfile or the
+ * installed copy declares one, and the dependency graph. When no lockfile can be read, the packages
+ * of a recorded run's report SBOM are listed instead, without a graph.
+ */
+export declare function buildSbom(input: {
+    cwd: string;
+    product: ProductIdentity;
+    locks: ProjectLocks;
+    /** Status the pipeline recorded per `name@version` in run reports. */
+    reportEntries: Map<string, SbomEntry>;
+    toolVersion: string;
+    now: Date;
+}): SbomBuild;
+//# sourceMappingURL=sbom.d.ts.map

package/dist/api/evidence-pack/sbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../../src/api/evidence-pack/sbom.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAQL,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAE5B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,GAAG,aAAa,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACpC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1C,KAAK,EAAE;YAAE,UAAU,EAAE,kBAAkB,EAAE,CAAA;SAAE,CAAC;QAC5C,SAAS,EAAE,kBAAkB,CAAC;QAC9B,YAAY,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAChC,UAAU,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACpD,CAAC;IACF,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,YAAY,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,YAAY,CAAC;IAClB,wGAAwG;IACxG,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6FAA6F;AAC7F,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE,eAAe,CAyBjB;AA4BD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,sEAAsE;IACtE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,SAAS,CAsKZ"}

package/dist/api/evidence-pack/sbom.js

@@ -0,0 +1,221 @@
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { factKey, hashFromIntegrity, installedLicense, licenseChoice, npmPurl, readLockFacts, splitName, } from "./components.js";
+/** The identity of the product from `package.json`, overridden by what the caller states. */
+export function productIdentity(cwd, overrides) {
+    let manifest = {};
+    try {
+        const parsed = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+        if (typeof parsed === "object" && parsed !== null)
+            manifest = parsed;
+    }
+    catch {
+        // No readable package.json: the caller must name the product.
+    }
+    const name = overrides.name ?? (typeof manifest["name"] === "string" ? manifest["name"] : "unnamed-product");
+    const version = overrides.version ??
+        (typeof manifest["version"] === "string" ? manifest["version"] : undefined);
+    return {
+        name,
+        ...(version ? { version } : {}),
+        ...(typeof manifest["description"] === "string"
+            ? { description: manifest["description"] }
+            : {}),
+        // Only a package.json-style identity has a purl; a free-text product name does not.
+        ...(version && /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/.test(name)
+            ? { purl: npmPurl(name, version) }
+            : {}),
+        ...(overrides.manufacturer ? { manufacturer: overrides.manufacturer } : {}),
+    };
+}
+/** Production reachability per node id: reachable from a production root, a dev root, or neither. */
+function reachability(graph) {
+    const result = new Map();
+    const walk = (starts, kind) => {
+        const stack = [...starts];
+        while (stack.length > 0) {
+            const id = stack.pop();
+            const seen = result.get(id);
+            if (seen === "prod" || seen === kind)
+                continue;
+            result.set(id, kind);
+            for (const dep of graph.nodes.get(id)?.deps ?? [])
+                stack.push(dep);
+        }
+    };
+    // Production first, so a package both kinds reach stays `prod`.
+    for (const root of graph.roots)
+        walk(root.prod, "prod");
+    for (const root of graph.roots)
+        walk(root.dev, "dev");
+    return result;
+}
+const toolComponent = (toolVersion) => ({
+    type: "application",
+    "bom-ref": "autoremediator",
+    name: "autoremediator",
+    version: toolVersion,
+});
+/**
+ * A CycloneDX 1.6 SBOM of what the project's lockfile locks: every package as a component with a
+ * purl, a hash where the lockfile records an integrity digest, a license where the lockfile or the
+ * installed copy declares one, and the dependency graph. When no lockfile can be read, the packages
+ * of a recorded run's report SBOM are listed instead, without a graph.
+ */
+export function buildSbom(input) {
+    const { cwd, product, locks, reportEntries } = input;
+    const notes = [...locks.notes];
+    const chosen = locks.locks[0];
+    if (locks.locks.length > 1) {
+        notes.push(`More than one lockfile was found (${locks.locks.map((lock) => lock.path).join(", ")}); the SBOM follows ${chosen.path}.`);
+    }
+    const productRef = product.purl ?? `product:${product.name}${product.version ? `@${product.version}` : ""}`;
+    const productComponent = {
+        type: "application",
+        "bom-ref": productRef,
+        ...splitName(product.name),
+        ...(product.version ? { version: product.version } : {}),
+        ...(product.description ? { description: product.description } : {}),
+        ...(product.purl ? { purl: product.purl } : {}),
+    };
+    const components = new Map();
+    const dependsOn = new Map();
+    const locked = new Set();
+    let source;
+    const facts = new Map();
+    if (chosen) {
+        source = chosen.path;
+        try {
+            for (const [key, value] of readLockFacts(chosen.path, readFileSync(join(cwd, chosen.path), "utf8"))) {
+                facts.set(key, value);
+            }
+        }
+        catch {
+            notes.push(`${chosen.path} could not be read again for hashes; components have none.`);
+        }
+        const reach = reachability(chosen.graph);
+        for (const node of chosen.graph.nodes.values()) {
+            const purl = npmPurl(node.name, node.version);
+            const found = facts.get(factKey(node.name, node.version));
+            const hash = found?.integrity ? hashFromIntegrity(found.integrity) : undefined;
+            const licenseText = found?.license ?? installedLicense(cwd, node.name, node.version);
+            const license = licenseText ? licenseChoice(licenseText) : undefined;
+            const kind = reach.get(node.id);
+            const existing = components.get(purl);
+            if (!existing) {
+                const report = reportEntries.get(factKey(node.name, node.version));
+                const properties = [
+                    ...(report?.scope
+                        ? [{ name: "autoremediator:dependency-scope", value: report.scope }]
+                        : []),
+                    ...(report?.status
+                        ? [{ name: "autoremediator:remediation-status", value: report.status }]
+                        : []),
+                    ...(report?.cveIds?.length
+                        ? [{ name: "autoremediator:cve-ids", value: report.cveIds.toSorted().join(",") }]
+                        : []),
+                ];
+                components.set(purl, {
+                    type: "library",
+                    "bom-ref": purl,
+                    ...splitName(node.name),
+                    version: node.version,
+                    ...(kind
+                        ? { scope: kind === "prod" ? "required" : "excluded" }
+                        : {}),
+                    purl,
+                    ...(hash ? { hashes: [hash] } : {}),
+                    ...(license ? { licenses: [license] } : {}),
+                    ...(properties.length > 0 ? { properties } : {}),
+                });
+                dependsOn.set(purl, new Set());
+            }
+            else if (kind === "prod" && existing.scope === "excluded") {
+                existing.scope = "required";
+            }
+            locked.add(factKey(node.name, node.version));
+        }
+        for (const node of chosen.graph.nodes.values()) {
+            const from = npmPurl(node.name, node.version);
+            for (const depId of node.deps) {
+                const dep = chosen.graph.nodes.get(depId);
+                if (!dep)
+                    continue;
+                const to = npmPurl(dep.name, dep.version);
+                if (to !== from)
+                    dependsOn.get(from)?.add(to);
+            }
+        }
+        const rootDeps = new Set();
+        for (const root of chosen.graph.roots) {
+            for (const id of [...root.prod, ...root.dev]) {
+                const node = chosen.graph.nodes.get(id);
+                if (node)
+                    rootDeps.add(npmPurl(node.name, node.version));
+            }
+        }
+        dependsOn.set(productRef, rootDeps);
+        if (chosen.graph.roots.length === 0) {
+            notes.push("The lockfile did not say which packages the project depends on directly, so the product has no direct dependencies in the graph.");
+        }
+    }
+    else {
+        source = "report";
+        for (const entry of reportEntries.values()) {
+            const purl = npmPurl(entry.name, entry.version);
+            components.set(purl, {
+                type: "library",
+                "bom-ref": purl,
+                ...splitName(entry.name),
+                version: entry.version,
+                purl,
+                properties: [
+                    { name: "autoremediator:dependency-scope", value: entry.scope },
+                    ...(entry.status
+                        ? [{ name: "autoremediator:remediation-status", value: entry.status }]
+                        : []),
+                ],
+            });
+            locked.add(factKey(entry.name, entry.version));
+        }
+        notes.push(components.size > 0
+            ? "No lockfile could be read; the components come from the SBOM recorded in run reports, with no dependency graph, hashes or licenses."
+            : "No lockfile could be read and no run report carries an SBOM, so the SBOM has no components.");
+        dependsOn.set(productRef, new Set());
+    }
+    const sorted = [...components.values()].toSorted((a, b) => a["bom-ref"].localeCompare(b["bom-ref"]));
+    const dependencies = [
+        { ref: productRef, dependsOn: [...(dependsOn.get(productRef) ?? [])].toSorted() },
+        ...sorted.map((component) => ({
+            ref: component["bom-ref"],
+            dependsOn: [...(dependsOn.get(component["bom-ref"]) ?? [])].toSorted(),
+        })),
+    ];
+    const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.6",
+        serialNumber: `urn:uuid:${randomUUID()}`,
+        version: 1,
+        metadata: {
+            timestamp: input.now.toISOString(),
+            lifecycles: [{ phase: "pre-build" }],
+            tools: { components: [toolComponent(input.toolVersion)] },
+            component: productComponent,
+            ...(product.manufacturer ? { manufacturer: { name: product.manufacturer } } : {}),
+            properties: [{ name: "autoremediator:component-source", value: source }],
+        },
+        components: sorted,
+        dependencies,
+    };
+    return {
+        bom,
+        source,
+        componentCount: sorted.length,
+        withHash: sorted.filter((component) => component.hashes).length,
+        withLicense: sorted.filter((component) => component.licenses).length,
+        locked,
+        notes,
+    };
+}
+//# sourceMappingURL=sbom.js.map

package/dist/api/evidence-pack/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../../src/api/evidence-pack/sbom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAKjC,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,OAAO,EACP,aAAa,EACb,SAAS,GAIV,MAAM,iBAAiB,CAAC;AAqDzB,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,SAAqE;IAErE,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,QAAQ,GAAG,MAAiC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IACD,MAAM,IAAI,GACR,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAClG,MAAM,OAAO,GACX,SAAS,CAAC,OAAO;QACjB,CAAC,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9E,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ;YAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,oFAAoF;QACpF,GAAG,CAAC,OAAO,IAAI,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC;YAClF,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,YAAY,CAAC,KAAgB;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,MAAgB,EAAE,IAAoB,EAAQ,EAAE;QAC5D,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC/C,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC;IACF,gEAAgE;IAChE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,WAAmB,EAAsB,EAAE,CAAC,CAAC;IAClE,IAAI,EAAE,aAAa;IACnB,SAAS,EAAE,gBAAgB;IAC3B,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,WAAW;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAQzB;IACC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IACrD,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,qCAAqC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,MAAO,CAAC,IAAI,GAAG,CAC3H,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,IAAI,WAAW,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3F,MAAM,gBAAgB,GAAuB;QAC3C,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,UAAU;QACrB,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,MAAc,CAAC;IAEnB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,aAAa,CACtC,MAAM,CAAC,IAAI,EACX,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAC7C,EAAE,CAAC;gBACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,4DAA4D,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,MAAM,WAAW,GAAG,KAAK,EAAE,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnE,MAAM,UAAU,GAAG;oBACjB,GAAG,CAAC,MAAM,EAAE,KAAK;wBACf,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;wBACpE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,EAAE,MAAM;wBAChB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;wBACvE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;wBACxB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBACjF,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;gBACF,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE;oBACnB,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,IAAI;oBACf,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,GAAG,CAAC,IAAI;wBACN,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,UAAoB,EAAE;wBAC5E,CAAC,CAAC,EAAE,CAAC;oBACP,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjD,CAAC,CAAC;gBACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC5D,QAAQ,CAAC,KAAK,GAAG,UAAU,CAAC;YAC9B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC1C,IAAI,EAAE,KAAK,IAAI;oBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtC,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,IAAI;oBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CACR,kIAAkI,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,QAAQ,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE;gBACnB,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,IAAI;gBACf,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI;gBACJ,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;oBAC/D,GAAG,CAAC,KAAK,CAAC,MAAM;wBACd,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;wBACtE,CAAC,CAAC,EAAE,CAAC;iBACR;aACF,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,IAAI,GAAG,CAAC;YACjB,CAAC,CAAC,qIAAqI;YACvI,CAAC,CAAC,6FAA6F,CAClG,CAAC;QACF,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxD,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjF,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC5B,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;SACvE,CAAC,CAAC;KACJ,CAAC;IAEF,MAAM,GAAG,GAAiB;QACxB,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,YAAY,UAAU,EAAE,EAAE;QACxC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YACpC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE;YACzD,SAAS,EAAE,gBAAgB;YAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SACzE;QACD,UAAU,EAAE,MAAM;QAClB,YAAY;KACb,CAAC;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM;QAC/D,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM;QACpE,MAAM;QACN,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/api/evidence-pack/types.d.ts

@@ -0,0 +1,62 @@
+import type { CraDeadlines } from "./cra.js";
+import type { VexStatus } from "./findings.js";
+export interface EvidencePackFile {
+    /** Relative to the pack directory, with `/`. */
+    path: string;
+    sha256: string;
+    bytes: number;
+    kind: "readme" | "sbom" | "vex" | "cra-draft" | "attestation" | "statement" | "public-key" | "manifest";
+}
+export interface EvidencePackResult {
+    schemaVersion: "1";
+    outDir: string;
+    generatedAt: string;
+    disclaimer: string;
+    /** Whether the attestations carry a signature. `false` means the envelopes have an empty `signatures` list. */
+    signed: boolean;
+    signingKeyId?: string;
+    signingAlgorithm?: string;
+    /** Every file written, except the manifest and the pack attestation, which `manifest` and `packAttestation` name. */
+    files: EvidencePackFile[];
+    manifest: EvidencePackFile;
+    packAttestation: {
+        envelope: string;
+        statement: string;
+        signed: boolean;
+        manifestSha256: string;
+    };
+    sbom: {
+        file: string;
+        specVersion: "1.6";
+        source: string;
+        components: number;
+        withHash: number;
+        withLicense: number;
+    };
+    vex: {
+        cycloneDxFile: string;
+        openVexFile: string;
+        statements: number;
+        byStatus: Record<VexStatus, number>;
+    };
+    craReports: Array<{
+        cveId: string;
+        file: string;
+        status: VexStatus;
+        deadlines?: CraDeadlines;
+    }>;
+    attestations: Array<{
+        runId: string;
+        runStatus: string;
+        envelope: string;
+        statement: string;
+        signed: boolean;
+        ledgerHead: string;
+    }>;
+    skippedRuns: Array<{
+        runId: string;
+        reason: string;
+    }>;
+    notes: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/api/evidence-pack/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/api/evidence-pack/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EACA,QAAQ,GACR,MAAM,GACN,KAAK,GACL,WAAW,GACX,aAAa,GACb,WAAW,GACX,YAAY,GACZ,UAAU,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,GAAG,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,+GAA+G;IAC/G,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qHAAqH;IACrH,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAClG,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,KAAK,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,GAAG,EAAE;QACH,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;KACrC,CAAC;IACF,UAAU,EAAE,KAAK,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,SAAS,CAAC;QAClB,SAAS,CAAC,EAAE,YAAY,CAAC;KAC1B,CAAC,CAAC;IACH,YAAY,EAAE,KAAK,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB"}

package/dist/api/evidence-pack/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/evidence-pack/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/evidence-pack/types.ts"],"names":[],"mappings":""}

package/dist/api/evidence-pack/vex.d.ts

@@ -0,0 +1,114 @@
+import type { CveDetails } from "../../platform/types.js";
+import type { VexFinding, VexStatus } from "./findings.js";
+import type { CycloneDxComponent, ProductIdentity } from "./sbom.js";
+type CdxState = "resolved" | "exploitable" | "in_triage" | "not_affected" | "false_positive";
+export interface CycloneDxVexVulnerability {
+    id: string;
+    source?: {
+        name: string;
+        url: string;
+    };
+    ratings?: Array<{
+        score?: number;
+        severity: string;
+        method: "other";
+    }>;
+    description?: string;
+    published?: string;
+    advisories?: Array<{
+        url: string;
+    }>;
+    recommendation?: string;
+    properties?: Array<{
+        name: string;
+        value: string;
+    }>;
+    analysis: {
+        state: CdxState;
+        justification?: string;
+        response?: string[];
+        detail: string;
+    };
+    affects?: Array<{
+        ref: string;
+        versions: Array<{
+            version: string;
+            status: "affected" | "unaffected";
+        }>;
+    }>;
+}
+export interface CycloneDxVex16 {
+    bomFormat: "CycloneDX";
+    specVersion: "1.6";
+    serialNumber: string;
+    version: number;
+    metadata: {
+        timestamp: string;
+        tools: {
+            components: CycloneDxComponent[];
+        };
+        component: CycloneDxComponent;
+        manufacturer?: {
+            name: string;
+        };
+    };
+    components: CycloneDxComponent[];
+    vulnerabilities: CycloneDxVexVulnerability[];
+}
+/**
+ * A CycloneDX 1.6 VEX document: one vulnerability per advisory and component, each with the
+ * `affects` reference to the component's purl, the analysis state, and where the claim came from.
+ * The components it references are listed in the document so it stands alone.
+ */
+export declare function buildCycloneDxVex(input: {
+    findings: VexFinding[];
+    cves: Map<string, CveDetails | null>;
+    product: ProductIdentity;
+    toolVersion: string;
+    now: Date;
+}): CycloneDxVex16;
+export declare const OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
+export interface OpenVexStatement {
+    vulnerability: {
+        name: string;
+        aliases?: string[];
+    };
+    timestamp: string;
+    products: Array<{
+        "@id": string;
+        identifiers?: {
+            purl: string;
+        };
+        subcomponents?: Array<{
+            "@id": string;
+            identifiers: {
+                purl: string;
+            };
+        }>;
+    }>;
+    status: VexStatus;
+    justification?: string;
+    impact_statement?: string;
+    action_statement?: string;
+    action_statement_timestamp?: string;
+    status_notes?: string;
+}
+export interface OpenVexDocument {
+    "@context": typeof OPENVEX_CONTEXT;
+    "@id": string;
+    author: string;
+    role?: string;
+    timestamp: string;
+    version: number;
+    tooling: string;
+    statements: OpenVexStatement[];
+}
+export declare function buildOpenVex(input: {
+    findings: VexFinding[];
+    product: ProductIdentity;
+    author?: string;
+    toolVersion: string;
+    now: Date;
+}): OpenVexDocument;
+export {};
+//# sourceMappingURL=vex.d.ts.map

package/dist/api/evidence-pack/vex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex.d.ts","sourceRoot":"","sources":["../../../src/api/evidence-pack/vex.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,KAAK,EAAoB,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMrE,KAAK,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,gBAAgB,CAAC;AAS7F,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,QAAQ,EAAE;QACR,KAAK,EAAE,QAAQ,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAAA;SAAE,CAAC,CAAC;KACzE,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE;YAAE,UAAU,EAAE,kBAAkB,EAAE,CAAA;SAAE,CAAC;QAC5C,SAAS,EAAE,kBAAkB,CAAC;QAC9B,YAAY,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;KACjC,CAAC;IACF,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,eAAe,EAAE,yBAAyB,EAAE,CAAC;CAC9C;AAoGD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;IACrC,OAAO,EAAE,eAAe,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,cAAc,CA+CjB;AAMD,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/B,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KACzE,CAAC,CAAC;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,OAAO,eAAe,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAgDD,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,eAAe,CAelB"}