autoremediator 0.21.2 → 0.22.0

package/dist/api/hooks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/api/hooks/types.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,eAAO,MAAM,UAAU,YAAI,UAAU,EAAE,YAAY,CAAU,CAAC;AAC9D,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,yFAAyF;AACzF,eAAO,MAAM,aAAa,YAAI,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,CAAU,CAAC;AACjF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;AAEzF,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,oEAAoE;IACpE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;IACrB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,yDAAyD;IACzD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB"}

package/dist/api/hooks/types.js

@@ -0,0 +1,5 @@
+/** Git hooks Autoremediator can install. */
+export const HOOK_NAMES = ["pre-push", "post-merge"];
+/** Tools that manage git hooks; `git` means plain `.git/hooks` (or `core.hooksPath`). */
+export const HOOK_MANAGERS = ["husky", "lefthook", "pre-commit", "git"];
+//# sourceMappingURL=types.js.map

package/dist/api/hooks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/hooks/types.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,YAAY,CAAU,CAAC;AAG9D,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,CAAU,CAAC"}

package/dist/api/incident/ci-secrets.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Which secrets could have been in reach of an `npm install` that ran while a bad package version
+ * was locked? This reads CI workflows, Dockerfiles, env templates, `.npmrc` and `package.json`
+ * and collects the NAMES of secrets and credential variables they reference.
+ *
+ * It never reads a value: env templates and `.npmrc` are read line by line and only the name part
+ * is kept; real `.env` files are not opened at all; a literal value written into a workflow or a
+ * Dockerfile is dropped on the spot. What it returns is a checklist to review, not a finding that
+ * anything was exposed.
+ */
+export type CiProvider = "github-actions" | "gitlab-ci" | "circleci" | "azure-pipelines" | "bitbucket-pipelines" | "travis" | "jenkins";
+export interface CiFile {
+    /** Relative to the project directory. */
+    file: string;
+    provider: CiProvider;
+    /** Something in the file runs a package install, or runs registry packages (npx, dlx). */
+    installs: boolean;
+    /** Jobs that install (GitHub Actions only; other providers are read as one unit). */
+    installJobs: string[];
+    /** Secret names in reach of an install step, its job or the whole workflow. */
+    secretNames: string[];
+    /** Sensitive-looking environment variable names set or used there. */
+    envNames: string[];
+    /** Short observations a reviewer should see (OIDC, `secrets: inherit`, contexts). */
+    notes: string[];
+}
+export interface ContainerFile {
+    file: string;
+    installs: boolean;
+    /** `ARG`/`ENV` names that look sensitive, and ids of `--mount=type=secret`. */
+    names: string[];
+    secretMounts: string[];
+}
+export interface EnvTemplate {
+    file: string;
+    names: string[];
+    /** The subset that looks like a credential. */
+    sensitiveNames: string[];
+}
+export interface NpmrcFile {
+    file: string;
+    /** Names inside `${...}` references (typically the token variable). */
+    envNames: string[];
+    /** A token or password is written into the file itself (its value is never read out). */
+    literalCredential: boolean;
+}
+export interface LifecycleScripts {
+    file: string;
+    /** Names of install-time scripts the project itself defines. */
+    scripts: string[];
+}
+export interface ChecklistItem {
+    id: string;
+    text: string;
+}
+export interface SecretsChecklist {
+    /** What this section is, in a sentence: it is read first. */
+    disclaimer: string;
+    ci: CiFile[];
+    containers: ContainerFile[];
+    envTemplates: EnvTemplate[];
+    npmrc: NpmrcFile[];
+    lifecycle: LifecycleScripts[];
+    /** Every secret or credential name found, sorted, with where it was found. */
+    secretNames: Array<{
+        name: string;
+        files: string[];
+        inInstallScope: boolean;
+    }>;
+    guidance: ChecklistItem[];
+    notes: string[];
+}
+export declare const CHECKLIST_DISCLAIMER = "A checklist to review, not a finding that anything was compromised. It lists the names of secrets that the project's own CI, container and environment files put in reach of a package install, so you can decide what to rotate. Secret values were never read.";
+/** Collect the names of secrets reachable from package installs in the project at `cwd`. */
+export declare function scanSecrets(cwd: string): SecretsChecklist;
+//# sourceMappingURL=ci-secrets.d.ts.map

package/dist/api/incident/ci-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-secrets.d.ts","sourceRoot":"","sources":["../../../src/api/incident/ci-secrets.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AAEH,MAAM,MAAM,UAAU,GAClB,gBAAgB,GAChB,WAAW,GACX,UAAU,GACV,iBAAiB,GACjB,qBAAqB,GACrB,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,MAAM;IACrB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,CAAC;IACrB,0FAA0F;IAC1F,QAAQ,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,qFAAqF;IACrF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,+CAA+C;IAC/C,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,yFAAyF;IACzF,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,8EAA8E;IAC9E,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,eAAO,MAAM,oBAAoB,qQACmO,CAAC;AA2WrQ,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CA4FzD"}

package/dist/api/incident/ci-secrets.js

@@ -0,0 +1,420 @@
+import { lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import YAML from "yaml";
+export const CHECKLIST_DISCLAIMER = "A checklist to review, not a finding that anything was compromised. It lists the names of secrets that the project's own CI, container and environment files put in reach of a package install, so you can decide what to rotate. Secret values were never read.";
+const SENSITIVE = /(TOKEN|SECRET|KEY|PASSWORD|PASSWD|PASS\b|CREDENTIAL|AUTH|CERT|PRIVATE|SIGNING|API)/i;
+const INSTALL = /\b(?:npm|pnpm|yarn|bun)\s+(?:ci|install|i|add|up|update|upgrade|dlx|x|create)\b|\byarn\s*(?:&&|;|$)|\b(?:npx|bunx)\b|\bcorepack\b|\bdocker\s+(?:build|buildx)\b|\bdocker\/build-push-action\b/im;
+const LIFECYCLE = [
+    "preinstall",
+    "install",
+    "postinstall",
+    "prepare",
+    "prepublish",
+    "prepublishOnly",
+    "prepack",
+];
+const MAX_FILE_BYTES = 1024 * 1024;
+const SKIP_DIRS = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    "coverage",
+    ".next",
+    ".turbo",
+    "vendor",
+]);
+/** Variables every CI sets itself; they are not credentials. */
+const BUILTIN = /^(?:PATH|HOME|USER|PWD|SHELL|CI|NODE_ENV|TERM|LANG|LC_ALL|TZ|HOSTNAME|TMPDIR|DEBIAN_FRONTEND|CI_[A-Z0-9_]*|GITHUB_[A-Z0-9_]*|RUNNER_[A-Z0-9_]*|GITLAB_[A-Z0-9_]*|CIRCLE_[A-Z0-9_]*|BITBUCKET_[A-Z0-9_]*|BUILD_[A-Z0-9_]*|SYSTEM_[A-Z0-9_]*|AGENT_[A-Z0-9_]*|TRAVIS_[A-Z0-9_]*|NODE_VERSION|NPM_CONFIG_[A-Z0-9_]*)$/;
+const sorted = (values) => [...new Set(values)].toSorted();
+function readSmallText(path) {
+    try {
+        const stat = lstatSync(path);
+        // Never follow a symlink out of the project, and never slurp something huge.
+        if (!stat.isFile() || stat.size > MAX_FILE_BYTES)
+            return undefined;
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Files under `cwd` whose relative path passes `accept`, at most `depth` directories deep. Symlinks are not followed. */
+function walk(cwd, accept, depth = 4) {
+    const found = [];
+    const visit = (dir, level) => {
+        let names;
+        try {
+            names = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of names.toSorted()) {
+            const full = join(dir, name);
+            let stat;
+            try {
+                stat = lstatSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isSymbolicLink())
+                continue;
+            if (stat.isDirectory()) {
+                // Hidden CI directories matter; other hidden ones and build output do not.
+                if (level < depth &&
+                    !SKIP_DIRS.has(name) &&
+                    (!name.startsWith(".") || name === ".github" || name === ".circleci")) {
+                    visit(full, level + 1);
+                }
+            }
+            else if (stat.isFile() && accept(relative(cwd, full), name)) {
+                found.push(relative(cwd, full));
+            }
+            if (found.length >= 400)
+                return;
+        }
+    };
+    visit(cwd, 0);
+    return found;
+}
+function stringsIn(node, out = [], depth = 0) {
+    if (depth > 30)
+        return out;
+    if (typeof node === "string")
+        out.push(node);
+    else if (Array.isArray(node))
+        for (const child of node)
+            stringsIn(child, out, depth + 1);
+    else if (typeof node === "object" && node !== null) {
+        for (const child of Object.values(node))
+            stringsIn(child, out, depth + 1);
+    }
+    return out;
+}
+function keysIn(node, key, out = [], depth = 0) {
+    if (depth > 30 || typeof node !== "object" || node === null)
+        return out;
+    if (Array.isArray(node)) {
+        for (const child of node)
+            keysIn(child, key, out, depth + 1);
+        return out;
+    }
+    for (const [name, child] of Object.entries(node)) {
+        if (name === key && typeof child === "object" && child !== null && !Array.isArray(child))
+            out.push(...Object.keys(child));
+        keysIn(child, key, out, depth + 1);
+    }
+    return out;
+}
+const SECRET_REF = /secrets\.([A-Za-z_][A-Za-z0-9_-]*)|secrets\[\s*['"]([^'"]+)['"]\s*\]/g;
+function secretsIn(node) {
+    const names = [];
+    for (const text of stringsIn(node)) {
+        for (const match of text.matchAll(SECRET_REF)) {
+            const name = match[1] ?? match[2];
+            if (name)
+                names.push(name);
+        }
+    }
+    return names;
+}
+const sensitiveEnvKeys = (node) => keysIn(node, "env").filter((name) => SENSITIVE.test(name));
+function stepInstalls(step) {
+    if (typeof step !== "object" || step === null)
+        return false;
+    const record = step;
+    const run = typeof record["run"] === "string" ? record["run"] : "";
+    const uses = typeof record["uses"] === "string" ? record["uses"] : "";
+    return INSTALL.test(run) || INSTALL.test(uses);
+}
+function scanGithubWorkflow(file, text) {
+    const result = {
+        file,
+        provider: "github-actions",
+        installs: false,
+        installJobs: [],
+        secretNames: [],
+        envNames: [],
+        notes: [],
+    };
+    let doc;
+    try {
+        doc = YAML.parse(text);
+    }
+    catch {
+        // Not valid YAML: fall back to reading the text for names, and say so.
+        result.installs = INSTALL.test(text);
+        result.secretNames = sorted(secretsIn(text));
+        result.notes.push("The workflow is not valid YAML, so it was only scanned as text; jobs could not be told apart.");
+        return result;
+    }
+    const workflow = typeof doc === "object" && doc !== null ? doc : {};
+    const jobs = typeof workflow["jobs"] === "object" && workflow["jobs"] !== null
+        ? workflow["jobs"]
+        : {};
+    const workflowSecrets = secretsIn(workflow["env"]);
+    const secrets = new Set();
+    const envNames = new Set(sensitiveEnvKeys({ env: workflow["env"] }));
+    for (const [jobId, raw] of Object.entries(jobs)) {
+        const job = typeof raw === "object" && raw !== null ? raw : {};
+        const steps = Array.isArray(job["steps"]) ? job["steps"] : [];
+        const installSteps = steps.filter((step) => stepInstalls(step));
+        const reusable = typeof job["uses"] === "string";
+        if (installSteps.length === 0 && !reusable)
+            continue;
+        result.installJobs.push(jobId);
+        result.installs = installSteps.length > 0 || result.installs;
+        // Anything the job runs after the install can execute the installed code, so the whole job counts.
+        for (const name of [
+            ...workflowSecrets,
+            ...secretsIn(job["env"]),
+            ...secretsIn(steps),
+            ...secretsIn(job["with"]),
+            ...secretsIn(job["secrets"]),
+        ]) {
+            secrets.add(name);
+        }
+        for (const name of [...sensitiveEnvKeys({ env: job["env"] }), ...sensitiveEnvKeys(steps)])
+            envNames.add(name);
+        if (job["secrets"] === "inherit") {
+            result.notes.push(`Job "${jobId}" calls a reusable workflow with \`secrets: inherit\`: every secret the caller can see is passed on.`);
+        }
+        const permissions = typeof job["permissions"] === "object" && job["permissions"] !== null
+            ? job["permissions"]
+            : {};
+        const topPermissions = typeof workflow["permissions"] === "object" && workflow["permissions"] !== null
+            ? workflow["permissions"]
+            : {};
+        if (permissions["id-token"] === "write" || topPermissions["id-token"] === "write") {
+            result.notes.push(`Job "${jobId}" can request an OIDC token: short-lived cloud credentials may have been minted in it.`);
+        }
+        const credentialActions = stringsIn(steps).filter((value) => /^(?:aws-actions\/configure-aws-credentials|google-github-actions\/auth|azure\/login|docker\/login-action|hashicorp\/vault-action)@/.test(value));
+        for (const action of sorted(credentialActions)) {
+            result.notes.push(`Job "${jobId}" uses ${action.split("@")[0]}, which puts cloud or registry credentials in the job's environment.`);
+        }
+    }
+    // Names GitHub provides itself are worth one line, not a row each.
+    if (secrets.delete("GITHUB_TOKEN")) {
+        result.notes.push("`secrets.GITHUB_TOKEN` (the automatic repository token) is in reach of an install job; its permissions are set by the workflow's `permissions:`.");
+    }
+    result.secretNames = sorted(secrets);
+    result.envNames = sorted(envNames);
+    result.notes = sorted(result.notes);
+    return result;
+}
+/** Providers read as one unit: variable names that look like credentials, plus contexts and credential ids. */
+function scanGenericCi(file, provider, text) {
+    const names = new Set();
+    for (const match of text.matchAll(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g)) {
+        const name = match[1];
+        if (!BUILTIN.test(name) && SENSITIVE.test(name))
+            names.add(name);
+    }
+    for (const match of text.matchAll(/\$\(([A-Za-z_][A-Za-z0-9_.]*)\)/g)) {
+        const name = match[1];
+        if (!BUILTIN.test(name) && SENSITIVE.test(name))
+            names.add(name);
+    }
+    const notes = [];
+    for (const match of text.matchAll(/credentials\(\s*['"]([^'"]+)['"]\s*\)|credentialsId\s*:\s*['"]([^'"]+)['"]/g)) {
+        const id = match[1] ?? match[2];
+        if (id)
+            names.add(id);
+    }
+    const contexts = [
+        ...text.matchAll(/^\s*-?\s*context\s*:\s*\[?\s*([A-Za-z0-9_.\- ,]+?)\s*\]?\s*$/gm),
+    ].flatMap((match) => (match[1] ?? "").split(",").map((entry) => entry.trim()));
+    for (const context of sorted(contexts.filter((entry) => entry !== ""))) {
+        notes.push(`Uses the CircleCI context "${context}": every variable stored in that context is in reach of the job.`);
+    }
+    if (provider === "gitlab-ci" ||
+        provider === "azure-pipelines" ||
+        provider === "bitbucket-pipelines" ||
+        provider === "travis") {
+        notes.push("Variables are read from the file by name only; whether each one holds a secret depends on the CI project's settings, which are not in the repository.");
+    }
+    return {
+        file,
+        provider,
+        installs: INSTALL.test(text),
+        installJobs: [],
+        secretNames: sorted(names),
+        envNames: [],
+        notes,
+    };
+}
+const CI_FILES = [
+    { test: (path) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(path), provider: "github-actions" },
+    { test: (path) => path === ".gitlab-ci.yml", provider: "gitlab-ci" },
+    { test: (path) => path === ".circleci/config.yml", provider: "circleci" },
+    {
+        test: (path) => path === "azure-pipelines.yml" || path === ".azure-pipelines.yml",
+        provider: "azure-pipelines",
+    },
+    { test: (path) => path === "bitbucket-pipelines.yml", provider: "bitbucket-pipelines" },
+    { test: (path) => path === ".travis.yml", provider: "travis" },
+    { test: (path) => path === "Jenkinsfile", provider: "jenkins" },
+];
+function scanDockerfile(file, text) {
+    const names = new Set();
+    const mounts = new Set();
+    for (const line of text.split(/\r?\n/)) {
+        const directive = /^\s*(ARG|ENV)\s+([A-Za-z_][A-Za-z0-9_]*)/i.exec(line);
+        // Only the name after the keyword is kept; whatever follows the `=` is a value and is dropped here.
+        if (directive?.[2] && SENSITIVE.test(directive[2]))
+            names.add(directive[2]);
+        for (const match of line.matchAll(/(?:--mount=type=secret,[^\s]*?id=|--secret(?:\s+|=)(?:[^\s,]*,)*?id=)([A-Za-z0-9_.-]+)/g)) {
+            mounts.add(match[1]);
+        }
+    }
+    return { file, installs: INSTALL.test(text), names: sorted(names), secretMounts: sorted(mounts) };
+}
+function scanEnvTemplate(file, text) {
+    const names = new Set();
+    for (const line of text.split(/\r?\n/)) {
+        const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+        if (match?.[1])
+            names.add(match[1]);
+    }
+    const all = sorted(names);
+    return { file, names: all, sensitiveNames: all.filter((name) => SENSITIVE.test(name)) };
+}
+function scanNpmrc(file, text) {
+    const envNames = new Set();
+    let literalCredential = false;
+    for (const line of text.split(/\r?\n/)) {
+        if (/^\s*[#;]/.test(line))
+            continue;
+        const credential = /(_authToken|_auth|_password|:_authToken)\s*=\s*(.*)$/i.exec(line);
+        if (!credential)
+            continue;
+        const refs = [...(credential[2] ?? "").matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map((match) => match[1]);
+        for (const name of refs)
+            envNames.add(name);
+        // A value that is not a `${VAR}` reference is a credential written into the file; note that, not what it is.
+        if (refs.length === 0 && (credential[2] ?? "").trim() !== "")
+            literalCredential = true;
+    }
+    return { file, envNames: sorted(envNames), literalCredential };
+}
+const GENERIC_GUIDANCE = [
+    {
+        id: "npm-tokens",
+        text: "Rotate npm tokens that could publish or read private packages: automation and publish tokens in npmjs.com account settings, the NPM_TOKEN-style secrets named above, and any token in a developer's ~/.npmrc.",
+    },
+    {
+        id: "ci-secrets",
+        text: "Rotate the CI secrets listed above for every workflow that installs dependencies, starting with deploy keys, cloud credentials and registry tokens. Check the CI provider's audit log for use of them outside normal runs.",
+    },
+    {
+        id: "cloud-keys",
+        text: "Rotate cloud access keys and revoke long-lived sessions (AWS access keys and STS sessions, GCP service account keys, Azure service principal secrets) that a build or a developer machine could reach. Prefer short-lived OIDC credentials afterwards.",
+    },
+    {
+        id: "git-and-ssh",
+        text: "Rotate GitHub or GitLab personal access tokens, deploy keys and SSH keys that lived on affected CI runners or developer machines, and review recent pushes, releases and workflow changes for anything you did not make.",
+    },
+    {
+        id: "developer-machines",
+        text: "Anyone who ran an install on an affected commit locally had their environment in reach too: .env files, shell history and exported variables, ~/.aws, ~/.ssh, browser-stored tokens. Ask them to check and rotate.",
+    },
+    {
+        id: "rebuild",
+        text: "Delete caches and rebuild from a clean checkout once the lockfile is back on a safe version (restore the CI cache, rebuild images, republish anything built while the bad version was present).",
+    },
+    {
+        id: "verify",
+        text: "After rotating, confirm the old credentials no longer work, and keep the incident report with the dates of the exposure window for the post-mortem.",
+    },
+];
+/** Collect the names of secrets reachable from package installs in the project at `cwd`. */
+export function scanSecrets(cwd) {
+    const notes = [];
+    const ci = [];
+    const containers = [];
+    const envTemplates = [];
+    const npmrc = [];
+    const files = walk(cwd, (path, name) => CI_FILES.some((candidate) => candidate.test(path.split("\\").join("/"))) ||
+        /^(?:Dockerfile(?:\..+)?|.+\.Dockerfile)$/.test(name) ||
+        /^(?:\.env(?:\..+)?\.(?:example|sample|template|dist)|(?:example|sample)\.env|env\.example)$/.test(name) ||
+        path === ".npmrc");
+    for (const file of files) {
+        const posix = file.split("\\").join("/");
+        const name = posix.slice(posix.lastIndexOf("/") + 1);
+        const text = readSmallText(join(cwd, file));
+        if (text === undefined) {
+            notes.push(`${posix} was not read (a symlink, unreadable, or larger than 1 MB).`);
+            continue;
+        }
+        const provider = CI_FILES.find((candidate) => candidate.test(posix))?.provider;
+        if (provider === "github-actions")
+            ci.push(scanGithubWorkflow(posix, text));
+        else if (provider)
+            ci.push(scanGenericCi(posix, provider, text));
+        else if (/Dockerfile/.test(name))
+            containers.push(scanDockerfile(posix, text));
+        else if (posix === ".npmrc")
+            npmrc.push(scanNpmrc(posix, text));
+        else
+            envTemplates.push(scanEnvTemplate(posix, text));
+    }
+    const lifecycle = [];
+    const manifest = readSmallText(join(cwd, "package.json"));
+    if (manifest !== undefined) {
+        try {
+            const scripts = JSON.parse(manifest).scripts ?? {};
+            const own = LIFECYCLE.filter((name) => typeof scripts[name] === "string");
+            if (own.length > 0)
+                lifecycle.push({ file: "package.json", scripts: own });
+        }
+        catch {
+            notes.push("package.json is not valid JSON, so its install-time scripts were not listed.");
+        }
+    }
+    if (files.length === 0 && lifecycle.length === 0) {
+        notes.push("No CI workflow, Dockerfile, env template or .npmrc was found, so no secret names are listed. The generic guidance still applies to developer machines.");
+    }
+    notes.push("Real .env files are never opened; only templates (.env.example and similar) are read, and only for variable names.");
+    const byName = new Map();
+    const note = (name, file, install) => {
+        const entry = byName.get(name) ?? { files: new Set(), inInstallScope: false };
+        entry.files.add(file);
+        entry.inInstallScope ||= install;
+        byName.set(name, entry);
+    };
+    for (const entry of ci) {
+        for (const name of [...entry.secretNames, ...entry.envNames])
+            note(name, entry.file, entry.installs || entry.installJobs.length > 0);
+    }
+    for (const entry of containers) {
+        for (const name of [...entry.names, ...entry.secretMounts])
+            note(name, entry.file, entry.installs);
+    }
+    for (const entry of npmrc)
+        for (const name of entry.envNames)
+            note(name, entry.file, true);
+    // Templates describe what a developer's environment holds, which a local install can reach.
+    for (const entry of envTemplates)
+        for (const name of entry.sensitiveNames)
+            note(name, entry.file, true);
+    return {
+        disclaimer: CHECKLIST_DISCLAIMER,
+        ci: ci.toSorted((a, b) => a.file.localeCompare(b.file)),
+        containers,
+        envTemplates,
+        npmrc,
+        lifecycle,
+        secretNames: [...byName.entries()]
+            .map(([name, entry]) => ({
+            name,
+            files: sorted(entry.files),
+            inInstallScope: entry.inInstallScope,
+        }))
+            .toSorted((a, b) => a.name.localeCompare(b.name)),
+        guidance: GENERIC_GUIDANCE,
+        notes,
+    };
+}
+//# sourceMappingURL=ci-secrets.js.map

package/dist/api/incident/ci-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-secrets.js","sourceRoot":"","sources":["../../../src/api/incident/ci-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,IAAI,MAAM,MAAM,CAAC;AAsFxB,MAAM,CAAC,MAAM,oBAAoB,GAC/B,kQAAkQ,CAAC;AAErQ,MAAM,SAAS,GACb,qFAAqF,CAAC;AACxF,MAAM,OAAO,GACX,iMAAiM,CAAC;AACpM,MAAM,SAAS,GAAG;IAChB,YAAY;IACZ,SAAS;IACT,aAAa;IACb,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,SAAS;CACV,CAAC;AACF,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,OAAO,GACX,oTAAoT,CAAC;AAEvT,MAAM,MAAM,GAAG,CAAC,MAAwB,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEvF,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,6EAA6E;QAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO,SAAS,CAAC;QACnE,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0HAA0H;AAC1H,SAAS,IAAI,CACX,GAAW,EACX,MAAuD,EACvD,KAAK,GAAG,CAAC;IAET,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QACjD,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,SAAS;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,2EAA2E;gBAC3E,IACE,KAAK,GAAG,KAAK;oBACb,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;oBACpB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,CAAC,EACrE,CAAC;oBACD,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC9D,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO;QAClC,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,GAAG,GAAa,EAAE,EAAE,KAAK,GAAG,CAAC;IAC7D,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC;IAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;SACpF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,IAAa,EAAE,GAAW,EAAE,GAAG,GAAa,EAAE,EAAE,KAAK,GAAG,CAAC;IACvE,IAAI,KAAK,GAAG,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,uEAAuE,CAAC;AAE3F,SAAS,SAAS,CAAC,IAAa;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,IAAa,EAAY,EAAE,CACnD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,MAAM,GAAW;QACrB,IAAI;QACJ,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,EAAE;KACV,CAAC;IACF,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,+FAA+F,CAChG,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,IAAI,GACR,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI;QAC/D,CAAC,CAAE,QAAQ,CAAC,MAAM,CAA6B;QAC/C,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7E,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAErD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC;QAC7D,mGAAmG;QACnG,KAAK,MAAM,IAAI,IAAI;YACjB,GAAG,eAAe;YAClB,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG,SAAS,CAAC,KAAK,CAAC;YACnB,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzB,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;SAC7B,EAAE,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACvF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErB,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,QAAQ,KAAK,sGAAsG,CACpH,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI;YACnE,CAAC,CAAE,GAAG,CAAC,aAAa,CAA6B;YACjD,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,cAAc,GAClB,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,IAAI;YAC7E,CAAC,CAAE,QAAQ,CAAC,aAAa,CAA6B;YACtD,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,OAAO,IAAI,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YAClF,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,QAAQ,KAAK,wFAAwF,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1D,oIAAoI,CAAC,IAAI,CACvI,KAAK,CACN,CACF,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,QAAQ,KAAK,UAAU,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sEAAsE,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,kJAAkJ,CACnJ,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+GAA+G;AAC/G,SAAS,aAAa,CAAC,IAAY,EAAE,QAAoB,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAC/B,6EAA6E,CAC9E,EAAE,CAAC;QACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,CAAC,QAAQ,CAAC,gEAAgE,CAAC;KACnF,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,CAAC,IAAI,CACR,8BAA8B,OAAO,kEAAkE,CACxG,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,qBAAqB;QAClC,QAAQ,KAAK,QAAQ,EACrB,CAAC;QACD,KAAK,CAAC,IAAI,CACR,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,EAAE;QACZ,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAqE;IACjF,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IAChG,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE;IACpE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE;IACzE;QACE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,sBAAsB;QACjF,QAAQ,EAAE,iBAAiB;KAC5B;IACD,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,yBAAyB,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IACvF,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC9D,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE;CAChE,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,oGAAoG;QACpG,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAC/B,yFAAyF,CAC1F,EAAE,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,UAAU,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC,CAAC,GAAG,CACrF,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CACrB,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,6GAA6G;QAC7G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,iBAAiB,GAAG,IAAI,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,gBAAgB,GAAoB;IACxC;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,+MAA+M;KACtN;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,4NAA4N;KACnO;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,wPAAwP;KAC/P;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,0NAA0N;KACjO;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,oNAAoN;KAC3N;IACD;QACE,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,iMAAiM;KACxM;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,qJAAqJ;KAC5J;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,EAAE,GAAa,EAAE,CAAC;IACxB,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,MAAM,KAAK,GAAG,IAAI,CAChB,GAAG,EACH,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACb,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;QACrD,6FAA6F,CAAC,IAAI,CAChG,IAAI,CACL;QACD,IAAI,KAAK,QAAQ,CACpB,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,6DAA6D,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;QAC/E,IAAI,QAAQ,KAAK,gBAAgB;YAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;aACvE,IAAI,QAAQ;YAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAC5D,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;aAC1E,IAAI,KAAK,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;;YAC3D,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA2C,CAAC,OAAO,IAAI,EAAE,CAAC;YAC9F,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;YAC1E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CACR,wJAAwJ,CACzJ,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,oHAAoH,CACrH,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2D,CAAC;IAClF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,OAAgB,EAAQ,EAAE;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAU,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QACtF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,EAAE,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC1D,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK;QAAE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3F,4FAA4F;IAC5F,KAAK,MAAM,KAAK,IAAI,YAAY;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,cAAc;YAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAExE,OAAO;QACL,UAAU,EAAE,oBAAoB;QAChC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,UAAU;QACV,YAAY;QACZ,KAAK;QACL,SAAS;QACT,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;aACF,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,QAAQ,EAAE,gBAAgB;QAC1B,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/api/incident/history.d.ts

@@ -0,0 +1,81 @@
+export interface CommitRef {
+    sha: string;
+    /** Commit date, ISO 8601. */
+    date: string;
+}
+export interface RefSet {
+    branches: string[];
+    tags: string[];
+}
+/** One version of the package in one lockfile, and when it came and went. */
+export interface VersionWindow {
+    version: string;
+    /** The lockfile, relative to the repository root. */
+    lockfile: string;
+    /** Commits whose lockfile has the version where the commit before it did not. Newest first. */
+    entered: CommitRef[];
+    /** Commits whose lockfile lost it. Newest first. */
+    left: CommitRef[];
+    /** Versions of the package the lockfile had just before the version first entered, newest first. */
+    previousVersions: string[];
+    /** The lockfile at HEAD still has it. */
+    presentAtHead: boolean;
+    /** Branches and tags whose tip has it in the lockfile: a build of one of those installs it. */
+    atTip: RefSet;
+    /** Branches and tags whose history passes through an entering commit but whose tip no longer has it. */
+    passedThrough: RefSet;
+}
+export interface ManifestChange {
+    commit: CommitRef;
+    /** What package.json declared before (absent: the package was not listed). */
+    from?: string;
+    /** What it declares after (absent: removed). */
+    to?: string;
+}
+export interface PackageHistory {
+    packageName: string;
+    /** Every version of the package the lockfiles ever had in the scanned commits, with when. */
+    versionsSeen: Array<{
+        version: string;
+        affected: boolean;
+        firstSeen: CommitRef;
+        lastSeen: CommitRef;
+    }>;
+    windows: VersionWindow[];
+    manifestChanges: ManifestChange[];
+}
+export interface HistoryReport {
+    /** False when there is no history to read (not a git checkout, or no commit touched a lockfile). */
+    available: boolean;
+    reason?: string;
+    /** Lockfile commits examined. */
+    scannedCommits: number;
+    /** More lockfile commits exist than `maxCommits`; older ones were not examined. */
+    truncated: boolean;
+    shallow: boolean;
+    lockfiles: string[];
+    /** Lockfile versions that could not be read (corrupt, or a format that is not supported). */
+    unreadable: number;
+    packages: PackageHistory[];
+    notes: string[];
+}
+export interface HistoryOptions {
+    cwd: string;
+    /** The packages and the version range of each that counts as affected. */
+    targets: Array<{
+        name: string;
+        range: string;
+    }>;
+    /** Most lockfile commits to examine, newest first (default 500). */
+    maxCommits?: number;
+    /** Most branches and most tags to evaluate (default 200 each). */
+    maxRefs?: number;
+}
+/**
+ * When did the affected versions of each package enter and leave the repository's lockfiles, and
+ * which branches and tags could therefore have installed them? Reads lockfile text out of git
+ * (nothing is checked out, nothing is installed) and parses it with the lockfile parsers, so it
+ * works for npm, pnpm, yarn and bun lockfiles alike.
+ */
+export declare function scanHistory(options: HistoryOptions): Promise<HistoryReport>;
+//# sourceMappingURL=history.d.ts.map

package/dist/api/incident/history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.d.ts","sourceRoot":"","sources":["../../../src/api/incident/history.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,oDAAoD;IACpD,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,oGAAoG;IACpG,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,yCAAyC;IACzC,aAAa,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,KAAK,EAAE,MAAM,CAAC;IACd,wGAAwG;IACxG,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,YAAY,EAAE,KAAK,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,SAAS,CAAC;QACrB,QAAQ,EAAE,SAAS,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,eAAe,EAAE,cAAc,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,oGAAoG;IACpG,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAkID;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAqTjF"}