guardrail-security 1.0.1 → 2.0.0

package/dist/attack-surface/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../src/attack-surface/analyzer.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,qBAAa,qBAAqB;IAC1B,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,2BAA2B,CAAC;YA0CzB,iBAAiB;YAKjB,gBAAgB;YA8BhB,gBAAgB;IAOxB,qBAAqB,CACzB,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,MAAM,CAAC;CAWnB;AAED,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../../src/attack-surface/analyzer.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,qBAAa,qBAAqB;IAC1B,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,2BAA2B,CAAC;YA0CzB,iBAAiB;YAKjB,gBAAgB;YA8BhB,gBAAgB;IAOxB,qBAAqB,CACzB,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,MAAM,CAAC;CAWnB;AAED,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}

package/dist/attack-surface/analyzer.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.attackSurfaceAnalyzer = exports.AttackSurfaceAnalyzer = void 0;
-const database_1 = require("@guardrail/database");
+// Stub prisma for standalone use
+const prisma = null;
 class AttackSurfaceAnalyzer {
     async analyzeProject(projectPath, projectId) {
         const entryPoints = await this.scanHTTPEndpoints(projectPath);
@@ -27,7 +28,7 @@ class AttackSurfaceAnalyzer {
             attackPaths,
             apiFindings,
         };
-        await database_1.prisma.attackSurfaceAnalysis.create({
+        await prisma.attackSurfaceAnalysis.create({
             data: {
                 projectId,
                 summary: JSON.parse(JSON.stringify(result.summary)),

package/dist/license/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/license/engine.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,aAAa,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;CACtD;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,uBAAuB;IAC5B,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAoCtG,mBAAmB;IAsCjC;;OAEG;YACW,wBAAwB;IAuCtC;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAyBrC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IASzB;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,aAAa,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE;IAa3D,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB;IAkBnF,OAAO,CAAC,sBAAsB;YAoBhB,wBAAwB;IAKhC,wBAAwB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC;CAiBjF;AAED,eAAO,MAAM,uBAAuB,yBAAgC,CAAC"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/license/engine.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,aAAa,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;CACtD;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,uBAAuB;IAC5B,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAoCtG,mBAAmB;IAsCjC;;OAEG;YACW,wBAAwB;IAuCtC;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAyBrC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IASzB;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,aAAa,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE;IAa3D,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB;IAkBnF,OAAO,CAAC,sBAAsB;YAoBhB,wBAAwB;IAKhC,wBAAwB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC;CAiBjF;AAED,eAAO,MAAM,uBAAuB,yBAAgC,CAAC"}

package/dist/license/engine.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.licenseComplianceEngine = exports.LicenseComplianceEngine = void 0;
-const database_1 = require("@guardrail/database");
+// Stub prisma for standalone use
+const prisma = null;
 const compatibility_matrix_1 = require("./compatibility-matrix");
 const fs_1 = require("fs");
 const path_1 = require("path");
@@ -35,7 +36,7 @@ class LicenseComplianceEngine {
             overallStatus,
         };
         // @ts-ignore - licenseAnalysis may not exist in schema yet
-        const analysis = await database_1.prisma.licenseAnalysis.findUnique({
+        const analysis = await prisma.licenseAnalysis.findUnique({
             where: { id: projectId }
         });
         return result;

package/dist/sbom/generator.d.ts

@@ -57,6 +57,24 @@ export interface SBOMGeneratorOptions {
     includeLicenses?: boolean;
     includeHashes?: boolean;
     outputPath?: string;
+    vex?: boolean;
+    sign?: boolean;
+}
+export interface VEXDocument {
+    '@context': string;
+    '@id': string;
+    author: string;
+    timestamp: string;
+    version: string;
+    statements: VEXStatement[];
+}
+export interface VEXStatement {
+    vulnerability: string;
+    products: string[];
+    status: 'not_affected' | 'affected' | 'fixed' | 'under_investigation';
+    justification?: string;
+    actionStatement?: string;
+    actionStatementTimestamp?: string;
 }
 export declare class SBOMGenerator {
     private readonly toolInfo;
@@ -64,6 +82,10 @@ export declare class SBOMGenerator {
      * Generate SBOM for a project
      */
     generate(projectPath: string, options: SBOMGeneratorOptions): Promise<SBOM>;
+    /**
+     * Generate SBOM for a container image using syft
+     */
+    generateContainerSBOM(imageName: string, options: SBOMGeneratorOptions): Promise<SBOM>;
     /**
      * Extract components from package.json
      */
@@ -103,6 +125,26 @@ export declare class SBOMGenerator {
         valid: boolean;
         errors: string[];
     };
+    /**
+     * Compute hashes for a package
+     */
+    private computePackageHashes;
+    /**
+     * Generate VEX document
+     */
+    private generateVEX;
+    /**
+     * Sign SBOM using cosign
+     */
+    private signSBOM;
+    /**
+     * Check if a tool is available
+     */
+    private checkToolAvailable;
+    /**
+     * Normalize container SBOM from syft output
+     */
+    private normalizeContainerSBOM;
 }
 export declare const sbomGenerator: SBOMGenerator;
 //# sourceMappingURL=generator.d.ts.map

package/dist/sbom/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/sbom/generator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,WAAW,CAAC;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC3D,SAAS,EAAE;YACT,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,OAAO,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC9C,CAAC;IACF,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,YAAY,EAAE,cAAc,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,UAAU,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAIvB;IAEF;;OAEG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCjF;;OAEG;YACW,iBAAiB;IAiD/B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAqB5B;;OAEG;YACW,oBAAoB;IAelC;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;YACW,SAAS;IAiBvB;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM;IAsCnC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM;IA2C9B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;CAyB/D;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/sbom/generator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,WAAW,CAAC;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC3D,SAAS,EAAE;YACT,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,OAAO,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC9C,CAAC;IACF,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,YAAY,EAAE,cAAc,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,UAAU,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,YAAY,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,qBAAqB,CAAC;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAIvB;IAEF;;OAEG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8CjF;;OAEG;IACG,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IA4C5F;;OAEG;YACW,iBAAiB;IA6C/B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAqB5B;;OAEG;YACW,oBAAoB;IAelC;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;YACW,SAAS;IAiBvB;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM;IAsCnC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM;IA2C9B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IA0B9D;;OAEG;YACW,oBAAoB;IAelC;;OAEG;YACW,WAAW;IAkBzB;;OAEG;YACW,QAAQ;IAmBtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,sBAAsB;CAoD/B;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/sbom/generator.js

@@ -9,6 +9,7 @@ exports.sbomGenerator = exports.SBOMGenerator = void 0;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
 class SBOMGenerator {
     toolInfo = {
         vendor: 'Guardrail AI',
@@ -46,9 +47,55 @@ class SBOMGenerator {
         };
         if (options.outputPath) {
             await this.writeSBOM(sbom, options.outputPath, options.format);
+            if (options.vex) {
+                const vexPath = options.outputPath.replace(/\.(json|xml)$/, '.vex.json');
+                await this.generateVEX(sbom, vexPath);
+            }
+            if (options.sign) {
+                await this.signSBOM(options.outputPath);
+            }
         }
         return sbom;
     }
+    /**
+     * Generate SBOM for a container image using syft
+     */
+    async generateContainerSBOM(imageName, options) {
+        if (!this.checkToolAvailable('syft')) {
+            throw new Error('syft is not installed. Install it with:\n' +
+                '  curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin\n' +
+                '  Or visit: https://github.com/anchore/syft#installation');
+        }
+        const format = options.format === 'spdx' ? 'spdx-json' : 'cyclonedx-json';
+        const tempFile = (0, path_1.join)(process.cwd(), `.sbom-${Date.now()}.json`);
+        try {
+            (0, child_process_1.execSync)(`syft ${imageName} -o ${format} --file ${tempFile}`, {
+                stdio: 'pipe',
+                encoding: 'utf-8',
+            });
+            const rawSBOM = JSON.parse((0, fs_1.readFileSync)(tempFile, 'utf-8'));
+            const sbom = this.normalizeContainerSBOM(rawSBOM, options.format, imageName);
+            if (options.outputPath) {
+                await this.writeSBOM(sbom, options.outputPath, options.format);
+                if (options.vex) {
+                    const vexPath = options.outputPath.replace(/\.(json|xml)$/, '.vex.json');
+                    await this.generateVEX(sbom, vexPath);
+                }
+                if (options.sign) {
+                    await this.signSBOM(options.outputPath);
+                }
+            }
+            return sbom;
+        }
+        finally {
+            if ((0, fs_1.existsSync)(tempFile)) {
+                try {
+                    require('fs').unlinkSync(tempFile);
+                }
+                catch { }
+            }
+        }
+    }
     /**
      * Extract components from package.json
      */
@@ -76,13 +123,9 @@ class SBOMGenerator {
             }
             // Generate hashes if requested
             if (options.includeHashes) {
-                const packagePath = (0, path_1.join)(projectPath, 'node_modules', name, 'package.json');
-                if ((0, fs_1.existsSync)(packagePath)) {
-                    const content = (0, fs_1.readFileSync)(packagePath, 'utf-8');
-                    component.hashes = [
-                        { algorithm: 'SHA-256', content: this.hashContent(content, 'sha256') },
-                        { algorithm: 'SHA-512', content: this.hashContent(content, 'sha512') },
-                    ];
+                const hashes = await this.computePackageHashes(projectPath, name);
+                if (hashes.length > 0) {
+                    component.hashes = hashes;
                 }
             }
             components.push(component);
@@ -265,6 +308,124 @@ class SBOMGenerator {
             errors,
         };
     }
+    /**
+     * Compute hashes for a package
+     */
+    async computePackageHashes(projectPath, packageName) {
+        const hashes = [];
+        const packagePath = (0, path_1.join)(projectPath, 'node_modules', packageName, 'package.json');
+        if ((0, fs_1.existsSync)(packagePath)) {
+            const content = (0, fs_1.readFileSync)(packagePath, 'utf-8');
+            hashes.push({ algorithm: 'SHA-256', content: this.hashContent(content, 'sha256') });
+        }
+        return hashes;
+    }
+    /**
+     * Generate VEX document
+     */
+    async generateVEX(sbom, outputPath) {
+        const vex = {
+            '@context': 'https://openvex.dev/ns',
+            '@id': `${sbom.serialNumber}/vex`,
+            author: this.toolInfo.vendor,
+            timestamp: new Date().toISOString(),
+            version: '1',
+            statements: sbom.components.map(component => ({
+                vulnerability: 'PLACEHOLDER',
+                products: [component.purl || `${component.name}@${component.version}`],
+                status: 'not_affected',
+                justification: 'No known vulnerabilities at time of SBOM generation',
+            })),
+        };
+        (0, fs_1.writeFileSync)(outputPath, JSON.stringify(vex, null, 2), 'utf-8');
+    }
+    /**
+     * Sign SBOM using cosign
+     */
+    async signSBOM(sbomPath) {
+        if (!this.checkToolAvailable('cosign')) {
+            throw new Error('cosign is not installed. Install it with:\n' +
+                '  brew install cosign (macOS)\n' +
+                '  Or visit: https://docs.sigstore.dev/cosign/installation/');
+        }
+        try {
+            (0, child_process_1.execSync)(`cosign sign-blob --yes ${sbomPath} --output-signature ${sbomPath}.sig`, {
+                stdio: 'pipe',
+                encoding: 'utf-8',
+            });
+        }
+        catch (error) {
+            throw new Error(`Failed to sign SBOM: ${error.message}`);
+        }
+    }
+    /**
+     * Check if a tool is available
+     */
+    checkToolAvailable(tool) {
+        try {
+            (0, child_process_1.execSync)(`${tool} --version`, { stdio: 'pipe' });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Normalize container SBOM from syft output
+     */
+    normalizeContainerSBOM(rawSBOM, format, imageName) {
+        if (format === 'cyclonedx') {
+            return {
+                format: 'cyclonedx',
+                specVersion: rawSBOM.specVersion || '1.5',
+                serialNumber: rawSBOM.serialNumber || `urn:uuid:${this.generateUUID()}`,
+                version: rawSBOM.version || 1,
+                metadata: {
+                    timestamp: rawSBOM.metadata?.timestamp || new Date().toISOString(),
+                    tools: [this.toolInfo],
+                    component: {
+                        type: 'container',
+                        name: imageName,
+                        version: 'latest',
+                    },
+                },
+                components: (rawSBOM.components || []).map((c) => ({
+                    type: c.type || 'library',
+                    name: c.name,
+                    version: c.version,
+                    purl: c.purl,
+                    licenses: (c.licenses || []).map((l) => l.license?.id || l.expression || 'unknown'),
+                    hashes: c.hashes?.map((h) => ({ algorithm: h.alg, content: h.content })),
+                })),
+                dependencies: rawSBOM.dependencies || [],
+            };
+        }
+        else {
+            return {
+                format: 'spdx',
+                specVersion: '2.3',
+                serialNumber: `urn:uuid:${this.generateUUID()}`,
+                version: 1,
+                metadata: {
+                    timestamp: new Date().toISOString(),
+                    tools: [this.toolInfo],
+                    component: {
+                        type: 'container',
+                        name: imageName,
+                        version: 'latest',
+                    },
+                },
+                components: (rawSBOM.packages || []).map((p) => ({
+                    type: 'library',
+                    name: p.name,
+                    version: p.versionInfo,
+                    purl: p.externalRefs?.find((r) => r.referenceType === 'purl')?.referenceLocator,
+                    licenses: p.licenseConcluded ? [p.licenseConcluded] : [],
+                })),
+                dependencies: [],
+            };
+        }
+    }
 }
 exports.SBOMGenerator = SBOMGenerator;
 // Export singleton

package/dist/secrets/allowlist.d.ts

@@ -0,0 +1,38 @@
+/**
+ * allowlist.ts
+ * Manage allowlisted secret detections via SHA256 fingerprints
+ */
+export declare class Allowlist {
+    private readonly projectPath;
+    private fingerprints;
+    constructor(projectPath: string);
+    /**
+     * Load allowlist from .guardrail/secrets.allowlist
+     */
+    private load;
+    /**
+     * Check if a fingerprint is allowlisted
+     */
+    isAllowlisted(fingerprint: string): boolean;
+    /**
+     * Add a fingerprint to the allowlist
+     */
+    add(fingerprint: string): void;
+    /**
+     * Add multiple fingerprints from a baseline file
+     */
+    addFromBaseline(baselinePath: string): number;
+    /**
+     * Save allowlist to disk
+     */
+    save(): void;
+    /**
+     * Get the allowlist file path
+     */
+    private getAllowlistPath;
+    /**
+     * Get count of allowlisted items
+     */
+    size(): number;
+}
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/secrets/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../src/secrets/allowlist.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,qBAAa,SAAS;IAGR,OAAO,CAAC,QAAQ,CAAC,WAAW;IAFxC,OAAO,CAAC,YAAY,CAAqB;gBAEZ,WAAW,EAAE,MAAM;IAIhD;;OAEG;IACH,OAAO,CAAC,IAAI;IA4BZ;;OAEG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAI3C;;OAEG;IACH,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAO9B;;OAEG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAyC7C;;OAEG;IACH,IAAI,IAAI,IAAI;IAmBZ;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;OAEG;IACH,IAAI,IAAI,MAAM;CAGf"}

package/dist/secrets/allowlist.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * allowlist.ts
+ * Manage allowlisted secret detections via SHA256 fingerprints
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Allowlist = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+class Allowlist {
+    projectPath;
+    fingerprints = new Set();
+    constructor(projectPath) {
+        this.projectPath = projectPath;
+        this.load();
+    }
+    /**
+     * Load allowlist from .guardrail/secrets.allowlist
+     */
+    load() {
+        const allowlistPath = this.getAllowlistPath();
+        if (!(0, fs_1.existsSync)(allowlistPath)) {
+            return;
+        }
+        try {
+            const content = (0, fs_1.readFileSync)(allowlistPath, 'utf-8');
+            const lines = content.split('\n');
+            for (const line of lines) {
+                const trimmed = line.trim();
+                // Skip empty lines and comments
+                if (!trimmed || trimmed.startsWith('#')) {
+                    continue;
+                }
+                // Validate SHA256 format (64 hex chars)
+                if (/^[a-f0-9]{64}$/i.test(trimmed)) {
+                    this.fingerprints.add(trimmed.toLowerCase());
+                }
+            }
+        }
+        catch (err) {
+            // Silently ignore read errors
+        }
+    }
+    /**
+     * Check if a fingerprint is allowlisted
+     */
+    isAllowlisted(fingerprint) {
+        return this.fingerprints.has(fingerprint.toLowerCase());
+    }
+    /**
+     * Add a fingerprint to the allowlist
+     */
+    add(fingerprint) {
+        if (!/^[a-f0-9]{64}$/i.test(fingerprint)) {
+            throw new Error(`Invalid fingerprint format: ${fingerprint}`);
+        }
+        this.fingerprints.add(fingerprint.toLowerCase());
+    }
+    /**
+     * Add multiple fingerprints from a baseline file
+     */
+    addFromBaseline(baselinePath) {
+        if (!(0, fs_1.existsSync)(baselinePath)) {
+            throw new Error(`Baseline file not found: ${baselinePath}`);
+        }
+        let added = 0;
+        try {
+            const content = (0, fs_1.readFileSync)(baselinePath, 'utf-8');
+            // Try to parse as JSON first (scan results format)
+            try {
+                const json = JSON.parse(content);
+                if (json.findings && Array.isArray(json.findings)) {
+                    for (const finding of json.findings) {
+                        if (finding.fingerprint) {
+                            this.add(finding.fingerprint);
+                            added++;
+                        }
+                    }
+                    return added;
+                }
+            }
+            catch {
+                // Not JSON, try line-by-line
+            }
+            // Parse as line-delimited fingerprints
+            const lines = content.split('\n');
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (trimmed && !trimmed.startsWith('#') && /^[a-f0-9]{64}$/i.test(trimmed)) {
+                    this.add(trimmed);
+                    added++;
+                }
+            }
+        }
+        catch (err) {
+            throw new Error(`Failed to read baseline file: ${err.message}`);
+        }
+        return added;
+    }
+    /**
+     * Save allowlist to disk
+     */
+    save() {
+        const allowlistPath = this.getAllowlistPath();
+        const dir = (0, path_1.dirname)(allowlistPath);
+        if (!(0, fs_1.existsSync)(dir)) {
+            (0, fs_1.mkdirSync)(dir, { recursive: true });
+        }
+        const lines = [
+            '# Guardrail Secrets Allowlist',
+            '# SHA256 fingerprints of approved/suppressed detections',
+            '# One fingerprint per line',
+            '',
+            ...Array.from(this.fingerprints).sort(),
+        ];
+        (0, fs_1.writeFileSync)(allowlistPath, lines.join('\n'), 'utf-8');
+    }
+    /**
+     * Get the allowlist file path
+     */
+    getAllowlistPath() {
+        return (0, path_1.join)(this.projectPath, '.guardrail', 'secrets.allowlist');
+    }
+    /**
+     * Get count of allowlisted items
+     */
+    size() {
+        return this.fingerprints.size;
+    }
+}
+exports.Allowlist = Allowlist;

package/dist/secrets/config-loader.d.ts

@@ -0,0 +1,25 @@
+/**
+ * config-loader.ts
+ * Load and validate custom secret patterns from .guardrail/secrets.yaml
+ */
+import { SecretPattern, RiskLevel } from './patterns';
+export interface CustomPatternConfig {
+    name: string;
+    type: string;
+    regex: string;
+    minEntropy?: number;
+    description?: string;
+    risk?: RiskLevel;
+}
+export interface SecretsConfigFile {
+    patterns?: CustomPatternConfig[];
+}
+export declare class ConfigValidationError extends Error {
+    readonly details?: string[] | undefined;
+    constructor(message: string, details?: string[] | undefined);
+}
+/**
+ * Load and validate custom patterns from .guardrail/secrets.yaml
+ */
+export declare function loadCustomPatterns(projectPath: string): SecretPattern[];
+//# sourceMappingURL=config-loader.d.ts.map

package/dist/secrets/config-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/secrets/config-loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,aAAa,EAAc,SAAS,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,qBAAa,qBAAsB,SAAQ,KAAK;aACD,OAAO,CAAC,EAAE,MAAM,EAAE;gBAAnD,OAAO,EAAE,MAAM,EAAkB,OAAO,CAAC,EAAE,MAAM,EAAE,YAAA;CAIhE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,EAAE,CAqGvE"}

package/dist/secrets/config-loader.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * config-loader.ts
+ * Load and validate custom secret patterns from .guardrail/secrets.yaml
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigValidationError = void 0;
+exports.loadCustomPatterns = loadCustomPatterns;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const yaml_1 = require("yaml");
+class ConfigValidationError extends Error {
+    details;
+    constructor(message, details) {
+        super(message);
+        this.details = details;
+        this.name = 'ConfigValidationError';
+    }
+}
+exports.ConfigValidationError = ConfigValidationError;
+/**
+ * Load and validate custom patterns from .guardrail/secrets.yaml
+ */
+function loadCustomPatterns(projectPath) {
+    const configPath = (0, path_1.join)(projectPath, '.guardrail', 'secrets.yaml');
+    if (!(0, fs_1.existsSync)(configPath)) {
+        return [];
+    }
+    let rawContent;
+    try {
+        rawContent = (0, fs_1.readFileSync)(configPath, 'utf-8');
+    }
+    catch (err) {
+        throw new ConfigValidationError(`Failed to read secrets config: ${configPath}`, [err.message]);
+    }
+    let parsed;
+    try {
+        parsed = (0, yaml_1.parse)(rawContent);
+    }
+    catch (err) {
+        throw new ConfigValidationError('Invalid YAML syntax in secrets.yaml', [err.message]);
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        throw new ConfigValidationError('secrets.yaml must contain an object at root');
+    }
+    const config = parsed;
+    if (!config.patterns) {
+        return [];
+    }
+    if (!Array.isArray(config.patterns)) {
+        throw new ConfigValidationError('patterns must be an array');
+    }
+    const errors = [];
+    const customPatterns = [];
+    config.patterns.forEach((pattern, idx) => {
+        const prefix = `patterns[${idx}]`;
+        // Validate required fields
+        if (!pattern.name || typeof pattern.name !== 'string') {
+            errors.push(`${prefix}.name is required and must be a string`);
+        }
+        if (!pattern.type || typeof pattern.type !== 'string') {
+            errors.push(`${prefix}.type is required and must be a string`);
+        }
+        if (!pattern.regex || typeof pattern.regex !== 'string') {
+            errors.push(`${prefix}.regex is required and must be a string`);
+        }
+        // Validate optional fields
+        if (pattern.minEntropy !== undefined) {
+            if (typeof pattern.minEntropy !== 'number' || pattern.minEntropy < 0 || pattern.minEntropy > 8) {
+                errors.push(`${prefix}.minEntropy must be a number between 0 and 8`);
+            }
+        }
+        if (pattern.risk !== undefined) {
+            if (!['high', 'medium', 'low'].includes(pattern.risk)) {
+                errors.push(`${prefix}.risk must be one of: high, medium, low`);
+            }
+        }
+        // Try to compile regex
+        let regex;
+        try {
+            regex = new RegExp(pattern.regex);
+        }
+        catch (err) {
+            errors.push(`${prefix}.regex is invalid: ${err.message}`);
+            return;
+        }
+        if (errors.length === 0) {
+            customPatterns.push({
+                type: pattern.type,
+                name: pattern.name,
+                pattern: regex,
+                minEntropy: pattern.minEntropy,
+                risk: pattern.risk || 'medium',
+                description: pattern.description || pattern.name,
+                examples: [],
+            });
+        }
+    });
+    if (errors.length > 0) {
+        throw new ConfigValidationError('Invalid custom patterns in secrets.yaml', errors);
+    }
+    return customPatterns;
+}

package/dist/secrets/contextual-risk.d.ts

@@ -0,0 +1,19 @@
+/**
+ * contextual-risk.ts
+ * Adjust risk levels based on file context (examples, templates, production code)
+ */
+import { RiskLevel } from './patterns';
+export interface RiskContext {
+    filePath: string;
+    entropy: number;
+    originalRisk: RiskLevel;
+}
+/**
+ * Adjust risk based on file context
+ */
+export declare function adjustRiskByContext(context: RiskContext): RiskLevel;
+/**
+ * Get context description for reporting
+ */
+export declare function getContextDescription(filePath: string): string;
+//# sourceMappingURL=contextual-risk.d.ts.map

package/dist/secrets/contextual-risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextual-risk.d.ts","sourceRoot":"","sources":["../../src/secrets/contextual-risk.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,SAAS,CAAC;CACzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,CAyBnE;AA8CD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAY9D"}