persona-harness 0.8.11 → 0.8.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/authority-artifact-binding.d.ts +8 -0
- package/dist/cli/authority-artifact-binding.js +15 -0
- package/dist/cli/authority-artifact-binding.js.map +1 -1
- package/dist/cli/authority-command-surface.d.ts +2 -0
- package/dist/cli/authority-command-surface.js +73 -11
- package/dist/cli/authority-command-surface.js.map +1 -1
- package/dist/cli/authority-command.d.ts +2 -1
- package/dist/cli/authority-command.js +8 -3
- package/dist/cli/authority-command.js.map +1 -1
- package/dist/cli/authority-fetch-worker.d.ts +3 -1
- package/dist/cli/authority-fetch-worker.js +20 -9
- package/dist/cli/authority-fetch-worker.js.map +1 -1
- package/docs/current/release/consumer-authority-v0812-acceptance.json +1101 -0
- package/docs/current/release/v0.8.12-release-notes.md +31 -0
- package/package.json +3 -1
- package/packages/shared-skills/package.json +1 -1
- package/scripts/consumer-authority-v0812-acceptance-schema.d.mts +40 -0
- package/scripts/consumer-authority-v0812-acceptance-schema.mjs +119 -0
- package/scripts/fetch-consumer-authority-artifact.mjs +26 -2
- package/scripts/preflight-consumer-authority-external-artifact-transport.mjs +2 -2
- package/scripts/preflight-consumer-authority-external-attestation.mjs +2 -2
|
@@ -1,6 +1,14 @@
|
|
|
1
1
|
import type { AuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
2
|
import type { AuthorityEnrollment } from "./authority-enrollment.js";
|
|
3
3
|
import type { ProjectFinishAttestationVerifierAssessment } from "./project-finish-attestation-verifier.js";
|
|
4
|
+
export type AuthorityArtifactTuple = {
|
|
5
|
+
readonly artifactId: number;
|
|
6
|
+
readonly artifactDigest: string;
|
|
7
|
+
readonly runId: string;
|
|
8
|
+
readonly sourceHead: string;
|
|
9
|
+
};
|
|
10
|
+
export declare function matchesAuthorityArtifactTuple(artifact: AuthorityArtifact, expected: AuthorityArtifactTuple): boolean;
|
|
11
|
+
export declare function classifyAuthorityArtifactTupleReason(artifact: AuthorityArtifact, expected: AuthorityArtifactTuple): AuthorityBindingReason;
|
|
4
12
|
export declare function matchesAuthorityArtifactBinding(artifact: AuthorityArtifact, enrollment: AuthorityEnrollment, assessment: ProjectFinishAttestationVerifierAssessment): boolean;
|
|
5
13
|
export declare const AUTHORITY_BINDING_REASONS: readonly ["artifact", "package-version", "source", "enrollment", "run", "signer", "freshness", "consumption", "verification", "unknown"];
|
|
6
14
|
export type AuthorityBindingReason = typeof AUTHORITY_BINDING_REASONS[number];
|
|
@@ -1,5 +1,20 @@
|
|
|
1
1
|
import { matchProjectFinishAttestationEnrollment } from "./project-finish-attestation-policy.js";
|
|
2
2
|
import { projectFinishAttestationReusableCertificateSan } from "./project-finish-attestation-workflow-identity.js";
|
|
3
|
+
export function matchesAuthorityArtifactTuple(artifact, expected) {
|
|
4
|
+
return artifact.artifactId === expected.artifactId
|
|
5
|
+
&& artifact.artifactDigest === expected.artifactDigest
|
|
6
|
+
&& artifact.runId === expected.runId
|
|
7
|
+
&& artifact.sourceHead === expected.sourceHead;
|
|
8
|
+
}
|
|
9
|
+
export function classifyAuthorityArtifactTupleReason(artifact, expected) {
|
|
10
|
+
if (artifact.artifactId !== expected.artifactId || artifact.artifactDigest !== expected.artifactDigest)
|
|
11
|
+
return "artifact";
|
|
12
|
+
if (artifact.runId !== expected.runId)
|
|
13
|
+
return "run";
|
|
14
|
+
if (artifact.sourceHead !== expected.sourceHead)
|
|
15
|
+
return "source";
|
|
16
|
+
return "unknown";
|
|
17
|
+
}
|
|
3
18
|
export function matchesAuthorityArtifactBinding(artifact, enrollment, assessment) {
|
|
4
19
|
const receipt = assessment.receipt;
|
|
5
20
|
return assessment.authorityEligible
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-artifact-binding.js","sourceRoot":"","sources":["../../src/cli/authority-artifact-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAMhG,OAAO,EAAE,8CAA8C,EAAE,MAAM,mDAAmD,CAAA;
|
|
1
|
+
{"version":3,"file":"authority-artifact-binding.js","sourceRoot":"","sources":["../../src/cli/authority-artifact-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAMhG,OAAO,EAAE,8CAA8C,EAAE,MAAM,mDAAmD,CAAA;AASlH,MAAM,UAAU,6BAA6B,CAC3C,QAA2B,EAC3B,QAAgC;IAEhC,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;WAC7C,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;WACnD,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WACjC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,QAA2B,EAC3B,QAAgC;IAEhC,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAAE,OAAO,UAAU,CAAA;IACzH,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACnD,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAA;IAChE,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,QAA2B,EAC3B,UAA+B,EAC/B,UAAsD;IAEtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAA;IAClC,OAAO,UAAU,CAAC,iBAAiB;WAC9B,OAAO,KAAK,SAAS;WACrB,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE;WAC/C,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;WAC3C,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK;WAC1C,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK;WACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,8CAA8C,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;WACjH,uCAAuC,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,SAAS,CAAA;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU;IACV,iBAAiB;IACjB,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,aAAa;IACb,cAAc;IACd,SAAS;CACD,CAAA;AAIV,MAAM,UAAU,8BAA8B,CAC5C,QAA2B,EAC3B,UAA+B,EAC/B,UAAsD;IAEtD,MAAM,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAA;IAEjD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAA;IAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QACjF,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,aAAa,CAAA;IACvD,CAAC;IAED,OAAO,wBAAwB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA0D;IAE1D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,cAAc;YACjB,OAAO,QAAQ,CAAA;QACjB,KAAK,OAAO;YACV,OAAO,WAAW,CAAA;QACpB,KAAK,UAAU;YACb,OAAO,aAAa,CAAA;QACtB,KAAK,qBAAqB;YACxB,OAAO,QAAQ,CAAA;QACjB,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB,CAAC;QACvB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB,CAAC;QACzB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,OAAO,cAAc,CAAA;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAA;QAClB,KAAK,WAAW,CAAC;QACjB,KAAK,kBAAkB,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO,UAAU,CAAA;QACnB;YACE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,QAA2B,EAC3B,UAA+B,EAC/B,OAAwC;IAExC,IAAI,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,YAAY,CAAA;IACxE,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAA;IAChE,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACzG,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,8CAA8C,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtH,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,kBAAkB,GAAG,uCAAuC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACvF,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACtD,OAAO,kBAAkB,CAAC,IAAI,KAAK,8BAA8B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAA;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAC/B,WAAkE;IAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,6BAA6B;QAAE,OAAO,iBAAiB,CAAA;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,aAAa,CAAA;IACzD,IAAI,IAAI,KAAK,8BAA8B,IAAI,IAAI,KAAK,4BAA4B;QAAE,OAAO,QAAQ,CAAA;IACrG,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,YAAY,CAAA;IACvD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAA;IAC9D,IAAI,IAAI,KAAK,6BAA6B;QAAE,OAAO,WAAW,CAAA;IAC9D,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAA;IACtH,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC7D,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { AuthorityArtifactTuple } from "./authority-artifact-binding.js";
|
|
1
2
|
import type { AuthorityBindingReason } from "./authority-artifact-binding.js";
|
|
2
3
|
import type { CliRunResult } from "./bearshell.js";
|
|
3
4
|
import type { GithubAuthorityFetchDiagnostic } from "./authority-fetch-worker.js";
|
|
@@ -10,6 +11,7 @@ export type AuthorityStatus = {
|
|
|
10
11
|
readonly state: "authentication-unavailable" | "enrollment-unavailable" | "missing" | "trusted";
|
|
11
12
|
};
|
|
12
13
|
export type AuthorityFetchArgs = {
|
|
14
|
+
readonly artifactTuple?: AuthorityArtifactTuple;
|
|
13
15
|
readonly json: boolean;
|
|
14
16
|
readonly repositorySlug?: string;
|
|
15
17
|
};
|
|
@@ -8,24 +8,86 @@ export function authorityUsage(invocationName = "ph") {
|
|
|
8
8
|
" explain [--json] Explain the bounded next authority step.",
|
|
9
9
|
" enroll github <owner/repository> --workflow <path>",
|
|
10
10
|
" Interactively enroll a public GitHub workflow pin.",
|
|
11
|
-
" fetch github [owner/repository]
|
|
12
|
-
"
|
|
11
|
+
" fetch github [owner/repository] --artifact-id <id> --run-id <id>",
|
|
12
|
+
" --source-head <sha> --artifact-digest <sha256> [--json]",
|
|
13
|
+
" Fetch one explicit original artifact without consuming it.",
|
|
13
14
|
].join("\n");
|
|
14
15
|
}
|
|
15
16
|
export function parseReadOnlyArgs(args) {
|
|
16
17
|
return args.length === 0 ? { json: false } : args.length === 1 && args[0] === "--json" ? { json: true } : undefined;
|
|
17
18
|
}
|
|
18
19
|
export function parseFetchArgs(args) {
|
|
19
|
-
if (args
|
|
20
|
-
return
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
20
|
+
if (args[0] !== "github")
|
|
21
|
+
return undefined;
|
|
22
|
+
let cursor = 1;
|
|
23
|
+
const repositorySlug = args[cursor]?.startsWith("--") === false ? args[cursor++] : undefined;
|
|
24
|
+
if (repositorySlug !== undefined && !isPublicRepositorySlug(repositorySlug))
|
|
25
|
+
return undefined;
|
|
26
|
+
let json = false;
|
|
27
|
+
let artifactId;
|
|
28
|
+
let artifactDigest;
|
|
29
|
+
let runId;
|
|
30
|
+
let sourceHead;
|
|
31
|
+
while (cursor < args.length) {
|
|
32
|
+
const flag = args[cursor++];
|
|
33
|
+
if (flag === "--json" && !json) {
|
|
34
|
+
json = true;
|
|
35
|
+
continue;
|
|
36
|
+
}
|
|
37
|
+
const value = args[cursor++];
|
|
38
|
+
if (value === undefined || value.startsWith("--"))
|
|
39
|
+
return undefined;
|
|
40
|
+
switch (flag) {
|
|
41
|
+
case "--artifact-id":
|
|
42
|
+
if (artifactId !== undefined)
|
|
43
|
+
return undefined;
|
|
44
|
+
artifactId = value;
|
|
45
|
+
break;
|
|
46
|
+
case "--artifact-digest":
|
|
47
|
+
if (artifactDigest !== undefined)
|
|
48
|
+
return undefined;
|
|
49
|
+
artifactDigest = value;
|
|
50
|
+
break;
|
|
51
|
+
case "--run-id":
|
|
52
|
+
if (runId !== undefined)
|
|
53
|
+
return undefined;
|
|
54
|
+
runId = value;
|
|
55
|
+
break;
|
|
56
|
+
case "--source-head":
|
|
57
|
+
if (sourceHead !== undefined)
|
|
58
|
+
return undefined;
|
|
59
|
+
sourceHead = value;
|
|
60
|
+
break;
|
|
61
|
+
default:
|
|
62
|
+
return undefined;
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
const tuple = parseArtifactTuple(artifactId, artifactDigest, runId, sourceHead);
|
|
66
|
+
return tuple === undefined
|
|
67
|
+
? { json, repositorySlug }
|
|
68
|
+
: { artifactTuple: tuple, json, repositorySlug };
|
|
69
|
+
}
|
|
70
|
+
function parseArtifactTuple(artifactId, artifactDigest, runId, sourceHead) {
|
|
71
|
+
if (artifactId === undefined && artifactDigest === undefined && runId === undefined && sourceHead === undefined)
|
|
72
|
+
return undefined;
|
|
73
|
+
if (artifactId === undefined
|
|
74
|
+
|| artifactDigest === undefined
|
|
75
|
+
|| runId === undefined
|
|
76
|
+
|| sourceHead === undefined
|
|
77
|
+
|| !/^[1-9][0-9]{0,18}$/u.test(artifactId)
|
|
78
|
+
|| !/^[1-9][0-9]{0,18}$/u.test(runId)
|
|
79
|
+
|| !/^[a-f0-9]{40}$/iu.test(sourceHead)
|
|
80
|
+
|| !/^sha256:[a-f0-9]{64}$/iu.test(artifactDigest))
|
|
25
81
|
return undefined;
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
82
|
+
const parsedArtifactId = Number(artifactId);
|
|
83
|
+
return Number.isSafeInteger(parsedArtifactId)
|
|
84
|
+
? {
|
|
85
|
+
artifactId: parsedArtifactId,
|
|
86
|
+
artifactDigest: artifactDigest.toLowerCase(),
|
|
87
|
+
runId,
|
|
88
|
+
sourceHead: sourceHead.toLowerCase(),
|
|
89
|
+
}
|
|
90
|
+
: undefined;
|
|
29
91
|
}
|
|
30
92
|
export function parseEnrollmentArgs(args) {
|
|
31
93
|
if (args.length !== 4 || args[0] !== "github" || args[2] !== "--workflow")
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-command-surface.js","sourceRoot":"","sources":["../../src/cli/authority-command-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;
|
|
1
|
+
{"version":3,"file":"authority-command-surface.js","sourceRoot":"","sources":["../../src/cli/authority-command-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAqB3E,MAAM,UAAU,cAAc,CAAC,cAAc,GAAG,IAAI;IAClD,OAAO;QACL,UAAU,cAAc,oDAAoD;QAC5E,EAAE;QACF,WAAW;QACX,+FAA+F;QAC/F,oFAAoF;QACpF,sDAAsD;QACtD,6FAA6F;QAC7F,oEAAoE;QACpE,6DAA6D;QAC7D,qGAAqG;KACtG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACrH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,IAAI,UAA8B,CAAA;IAClC,IAAI,cAAkC,CAAA;IACtC,IAAI,KAAyB,CAAA;IAC7B,IAAI,UAA8B,CAAA;IAClC,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3B,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAA;YACX,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QACnE,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,eAAe;gBAClB,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAC9C,UAAU,GAAG,KAAK,CAAA;gBAClB,MAAK;YACP,KAAK,mBAAmB;gBACtB,IAAI,cAAc,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAClD,cAAc,GAAG,KAAK,CAAA;gBACtB,MAAK;YACP,KAAK,UAAU;gBACb,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBACzC,KAAK,GAAG,KAAK,CAAA;gBACb,MAAK;YACP,KAAK,eAAe;gBAClB,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAC9C,UAAU,GAAG,KAAK,CAAA;gBAClB,MAAK;YACP;gBACE,OAAO,SAAS,CAAA;QACpB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/E,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;QAC1B,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,kBAAkB,CACzB,UAA8B,EAC9B,cAAkC,EAClC,KAAyB,EACzB,UAA8B;IAE9B,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACjI,IACE,UAAU,KAAK,SAAS;WACrB,cAAc,KAAK,SAAS;WAC5B,KAAK,KAAK,SAAS;WACnB,UAAU,KAAK,SAAS;WACxB,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;WACvC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;WAClC,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;WACpC,CAAC,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC;QAClD,OAAO,SAAS,CAAA;IAClB,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;QAC3C,CAAC,CAAC;YACE,UAAU,EAAE,gBAAgB;YAC5B,cAAc,EAAE,cAAc,CAAC,WAAW,EAAE;YAC5C,KAAK;YACL,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;SACrC;QACH,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IAIzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAA;IAC3F,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,UAAU,GAAG,+BAA+B,CAAC;QACjD,kBAAkB,EAAE,YAAY;QAChC,YAAY,EAAE,CAAC;QACf,cAAc,EAAE,cAAc,IAAI,EAAE;QACpC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,kBAAkB,EAAE,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB,EAAE,OAAgB;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE;YACN,eAAe,OAAO,CAAC,UAAU,EAAE;YACnC,0BAA0B,OAAO,CAAC,oBAAoB,EAAE;YACxD,uBAAuB,KAAK,EAAE;YAC9B,gBAAgB,OAAO,CAAC,gBAAgB,EAAE;YAC1C,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;SAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;QACnB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,6BAA6B,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI;QAC3F,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,cAAsB;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAa,EACb,KAAa,EACb,OAAgC,wBAAwB,EACxD,UAA2C,EAC3C,aAAsC;IAEtC,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,IAAI;YACV,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClB,iBAAiB,EAAE,KAAK;gBACxB,gBAAgB,EAAE,gBAAgB;gBAClC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,IAAI;gBACJ,aAAa,EAAE,4BAA4B;gBAC3C,KAAK;aACN,CAAC,IAAI;YACN,CAAC,CAAC,sCAAsC,KAAK,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,UAAU,EAAE,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,aAAa,EAAE,2CAA2C;QACrO,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,uIAAuI;KAChJ,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAA6B,EAAE,OAAgB;IAC/D,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,OAAO;YAChD,CAAC,CAAC,2GAA2G;YAC7G,CAAC,CAAC,qBAAqB,CAAA;IACzB,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,yBAAyB,CAAA;IAC3J,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,wBAAwB,CAAA;IAClJ,OAAO,OAAO,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,iBAAiB,CAAA;AACzG,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,GAAG,CAAC;WAChB,KAAK,CAAC,MAAM,IAAI,GAAG;WACnB,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;WACjD,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAA;AACtE,CAAC"}
|
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
import { type AuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
|
+
import { type AuthorityArtifactTuple } from "./authority-artifact-binding.js";
|
|
2
3
|
import { type AuthorityEnrollment, type AuthorityEnrollmentReadback, type AuthorityEnrollmentStoreOptions } from "./authority-enrollment.js";
|
|
3
4
|
import { type AuthorityStatus } from "./authority-command-surface.js";
|
|
4
5
|
import { type ProjectFinishAttestationVerifierAssessment } from "./project-finish-attestation-verifier.js";
|
|
5
6
|
import type { CliRunResult } from "./bearshell.js";
|
|
6
7
|
type AuthorityCommandOptions = AuthorityEnrollmentStoreOptions & {
|
|
7
|
-
readonly artifactFetch?: (projectDir: string, enrollment: AuthorityEnrollment) => AuthorityArtifact | undefined;
|
|
8
|
+
readonly artifactFetch?: (projectDir: string, enrollment: AuthorityEnrollment, expected: AuthorityArtifactTuple) => AuthorityArtifact | undefined;
|
|
8
9
|
readonly artifactInspector?: (projectDir: string, enrollment: AuthorityEnrollment, archive: Buffer, now: Date) => ProjectFinishAttestationVerifierAssessment;
|
|
9
10
|
readonly confirmEnrollment?: boolean;
|
|
10
11
|
readonly enrollmentReadback?: (repositorySlug: string, workflowPath: string) => AuthorityEnrollmentReadback | undefined;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { writeAuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
|
-
import { classifyAuthorityBindingReason, matchesAuthorityArtifactBinding, } from "./authority-artifact-binding.js";
|
|
2
|
+
import { classifyAuthorityBindingReason, classifyAuthorityArtifactTupleReason, matchesAuthorityArtifactTuple, matchesAuthorityArtifactBinding, } from "./authority-artifact-binding.js";
|
|
3
3
|
import { authorityEnrollmentFromReadback, readAuthorityEnrollments, writeAuthorityEnrollment, } from "./authority-enrollment.js";
|
|
4
4
|
import { readGithubAuthorityEnrollment } from "./authority-github-readback-worker.js";
|
|
5
5
|
import { fetchGithubAuthorityArtifact } from "./authority-fetch-worker.js";
|
|
@@ -61,6 +61,8 @@ function runFetch(args, options, invocationName) {
|
|
|
61
61
|
const parsed = parseFetchArgs(args);
|
|
62
62
|
if (parsed === undefined)
|
|
63
63
|
return invalidAuthorityCommand(invocationName);
|
|
64
|
+
if (parsed.artifactTuple === undefined)
|
|
65
|
+
return blockedFetch(parsed.json, "selection-required");
|
|
64
66
|
const entries = readAuthorityEnrollments(options);
|
|
65
67
|
if (entries.state !== "ready") {
|
|
66
68
|
const summary = readAuthorityStatus(options);
|
|
@@ -79,8 +81,8 @@ function runFetch(args, options, invocationName) {
|
|
|
79
81
|
return blockedFetch(parsed.json, "authentication-unavailable", "github-authenticate");
|
|
80
82
|
}
|
|
81
83
|
const fetched = options.artifactFetch === undefined
|
|
82
|
-
? fetchGithubAuthorityArtifact(projectDir, enrollment, options.githubToken, options.now ?? new Date())
|
|
83
|
-
: { artifact: options.artifactFetch(projectDir, enrollment), kind: "ready" };
|
|
84
|
+
? fetchGithubAuthorityArtifact(projectDir, enrollment, parsed.artifactTuple, options.githubToken, options.now ?? new Date())
|
|
85
|
+
: { artifact: options.artifactFetch(projectDir, enrollment, parsed.artifactTuple), kind: "ready" };
|
|
84
86
|
if (fetched.kind === "blocked") {
|
|
85
87
|
return blockedFetch(parsed.json, "missing", "authority-fetch-github", fetched.diagnostic);
|
|
86
88
|
}
|
|
@@ -88,6 +90,9 @@ function runFetch(args, options, invocationName) {
|
|
|
88
90
|
if (artifact === undefined || artifact.repositoryId !== enrollment.repositoryId) {
|
|
89
91
|
return blockedFetch(parsed.json, "missing");
|
|
90
92
|
}
|
|
93
|
+
if (!matchesAuthorityArtifactTuple(artifact, parsed.artifactTuple)) {
|
|
94
|
+
return blockedFetch(parsed.json, "binding-mismatch", "authority-fetch-github", undefined, classifyAuthorityArtifactTupleReason(artifact, parsed.artifactTuple));
|
|
95
|
+
}
|
|
91
96
|
const assessment = (options.artifactInspector ?? inspectProjectFinishAttestationArtifact)(projectDir, enrollment, artifact.archive, options.now ?? new Date());
|
|
92
97
|
if (!matchesAuthorityArtifactBinding(artifact, enrollment, assessment)) {
|
|
93
98
|
return blockedFetch(parsed.json, "binding-mismatch", "authority-fetch-github", undefined, classifyAuthorityBindingReason(artifact, enrollment, assessment));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-command.js","sourceRoot":"","sources":["../../src/cli/authority-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA0B,MAAM,+BAA+B,CAAA;AAC9F,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,
|
|
1
|
+
{"version":3,"file":"authority-command.js","sourceRoot":"","sources":["../../src/cli/authority-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA0B,MAAM,+BAA+B,CAAA;AAC9F,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,GAEhC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,+BAA+B,EAE/B,wBAAwB,EACxB,wBAAwB,GAIzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,4BAA4B,EAC5B,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,UAAU,GAEX,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAA;AAC1F,OAAO,EACL,uCAAuC,GAExC,MAAM,0CAA0C,CAAA;AAiBjD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA;AAGlC,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,UAAmC,EAAE,EACrC,cAAc,GAAG,IAAI;IAErB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,aAAa,CACpB,IAAuB,EACvB,OAAgC,EAChC,cAAsB;IAEtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACxE,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7F,OAAO,4BAA4B,EAAE,CAAA;IACvC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,oEAAoE;SAC7E,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,CAChF,6BAA6B,CAC3B,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,EACnC,cAAc,EACd,YAAY,EACZ,OAAO,CAAC,WAAW,CACpB,CAAC,CAAC,CACH,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,YAAY,CACpB,CAAA;IACD,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9G,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,kBAAkB,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7I,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAA;IAC9H,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAA;IACzG,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,iFAAiF;QACzF,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,OAAgC,EAAE,cAAsB;IACjG,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACxE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC9F,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS;QACpD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,CAAC,CAAA;IACjF,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAChG,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACtD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,EAAE,qBAAqB,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,KAAK,SAAS;QACjD,CAAC,CAAC,4BAA4B,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAC5H,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAA;IAC7G,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,wBAAwB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;QAChF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC7C,CAAC;IACD,IAAI,CAAC,6BAA6B,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO,YAAY,CACjB,MAAM,CAAC,IAAI,EACX,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,oCAAoC,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CACrE,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,uCAAuC,CAAC,CACvF,UAAU,EACV,UAAU,EACV,QAAQ,CAAC,OAAO,EAChB,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAC1B,CAAA;IACD,IAAI,CAAC,+BAA+B,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACvE,OAAO,YAAY,CACjB,MAAM,CAAC,IAAI,EACX,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,8BAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CACjE,CAAA;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;IACtD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,MAAM,CAAC,IAAI;YACjB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ,CAAC,cAAc;oBAC/B,EAAE,EAAE,QAAQ,CAAC,UAAU;oBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAChC;gBACD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,4BAA4B;gBAC3C,KAAK,EAAE,SAAS;aACjB,CAAC,IAAI;YACN,CAAC,CAAC,iIAAiI;QACrI,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAmC,EAAE;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACtD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;IACtG,MAAM,mBAAmB,GAAG,qCAAqC,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IACnG,IAAI,mBAAmB,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;QACpD,OAAO;YACL,iBAAiB,EAAE,KAAK;YACxB,gBAAgB,EAAE,gBAAgB;YAClC,UAAU,EAAE,aAAa;YACzB,oBAAoB;YACpB,IAAI,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,qBAAqB;YAC9F,KAAK,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B;SACtG,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,UAAU,CAAA;IAClH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;YACrF,UAAU,EAAE,WAAW;YACvB,oBAAoB;YACpB,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,SAAS;SACjB,CAAA;IACH,CAAC;IACD,OAAO;QACL,iBAAiB,EAAE,KAAK;QACxB,gBAAgB,EAAE,gBAAgB;QAClC,UAAU,EAAE,WAAW;QACvB,oBAAoB;QACpB,IAAI,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB;QAC7F,KAAK,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B;KACvF,CAAA;AACH,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { AuthorityArtifactTuple } from "./authority-artifact-binding.js";
|
|
1
2
|
import type { AuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
3
|
import type { AuthorityEnrollment } from "./authority-enrollment.js";
|
|
3
4
|
export type GithubAuthorityFetchDiagnostic = "authority-fetch-evidence" | "authority-fetch-invalid" | "authority-fetch-network" | "authority-fetch-policy";
|
|
@@ -8,7 +9,8 @@ export type GithubAuthorityFetchResult = {
|
|
|
8
9
|
readonly artifact: AuthorityArtifact;
|
|
9
10
|
readonly kind: "ready";
|
|
10
11
|
};
|
|
11
|
-
export declare function
|
|
12
|
+
export declare function serializeAuthorityFetchChildInput(enrollment: Pick<AuthorityEnrollment, "callerWorkflowPath" | "repositoryId" | "repositorySlug">, sourceHead: string, expected: AuthorityArtifactTuple): string;
|
|
13
|
+
export declare function fetchGithubAuthorityArtifact(projectDir: string, enrollment: AuthorityEnrollment, expected: AuthorityArtifactTuple, githubToken: string | undefined, now?: Date): GithubAuthorityFetchResult;
|
|
12
14
|
export declare function parseFetchedArtifact(value: string): {
|
|
13
15
|
readonly archive: Buffer;
|
|
14
16
|
readonly artifactId: number;
|
|
@@ -1,13 +1,27 @@
|
|
|
1
1
|
import { spawnSync } from "node:child_process";
|
|
2
2
|
import { fileURLToPath } from "node:url";
|
|
3
3
|
import { createAuthorityFetchChildEnvironment as createBoundedAuthorityFetchChildEnvironment } from "../../scripts/authority-fetch-child-environment.mjs";
|
|
4
|
-
import { isAuthorityGithubToken
|
|
4
|
+
import { isAuthorityGithubToken } from "./authority-github-token.js";
|
|
5
5
|
import { captureGitIdentity, captureWorkspaceIdentity } from "./ci-reverification-identity.js";
|
|
6
6
|
const WORKER_PATH = fileURLToPath(new URL("../../scripts/fetch-consumer-authority-artifact.mjs", import.meta.url));
|
|
7
7
|
const MAX_ARCHIVE_BYTES = 8 * 1024 * 1024;
|
|
8
8
|
const MAX_OUTPUT_BYTES = 12 * 1024 * 1024;
|
|
9
9
|
const WORKER_TIMEOUT_MS = 30_000;
|
|
10
|
-
export function
|
|
10
|
+
export function serializeAuthorityFetchChildInput(enrollment, sourceHead, expected) {
|
|
11
|
+
return JSON.stringify({
|
|
12
|
+
callerWorkflowPath: enrollment.callerWorkflowPath,
|
|
13
|
+
expected: {
|
|
14
|
+
artifactDigest: expected.artifactDigest,
|
|
15
|
+
artifactId: expected.artifactId,
|
|
16
|
+
runId: expected.runId,
|
|
17
|
+
sourceHead: expected.sourceHead,
|
|
18
|
+
},
|
|
19
|
+
repositoryId: enrollment.repositoryId,
|
|
20
|
+
repositorySlug: enrollment.repositorySlug,
|
|
21
|
+
sourceHead,
|
|
22
|
+
});
|
|
23
|
+
}
|
|
24
|
+
export function fetchGithubAuthorityArtifact(projectDir, enrollment, expected, githubToken, now = new Date()) {
|
|
11
25
|
if (!isAuthorityGithubToken(githubToken))
|
|
12
26
|
return { kind: "blocked" };
|
|
13
27
|
const workspace = captureWorkspaceIdentity(projectDir);
|
|
@@ -16,6 +30,8 @@ export function fetchGithubAuthorityArtifact(projectDir, enrollment, githubToken
|
|
|
16
30
|
const git = captureGitIdentity(projectDir, workspace.value);
|
|
17
31
|
if (!git.available || git.head === undefined)
|
|
18
32
|
return { kind: "blocked" };
|
|
33
|
+
if (git.head.toLowerCase() !== expected.sourceHead)
|
|
34
|
+
return { kind: "blocked" };
|
|
19
35
|
const childEnvironment = createAuthorityFetchChildEnvironment(githubToken);
|
|
20
36
|
if (childEnvironment === undefined)
|
|
21
37
|
return { kind: "blocked" };
|
|
@@ -23,12 +39,7 @@ export function fetchGithubAuthorityArtifact(projectDir, enrollment, githubToken
|
|
|
23
39
|
cwd: workspace.value.realpath,
|
|
24
40
|
encoding: "utf8",
|
|
25
41
|
env: childEnvironment,
|
|
26
|
-
input:
|
|
27
|
-
callerWorkflowPath: enrollment.callerWorkflowPath,
|
|
28
|
-
repositoryId: enrollment.repositoryId,
|
|
29
|
-
repositorySlug: enrollment.repositorySlug,
|
|
30
|
-
sourceHead: git.head,
|
|
31
|
-
}),
|
|
42
|
+
input: serializeAuthorityFetchChildInput(enrollment, git.head, expected),
|
|
32
43
|
maxBuffer: MAX_OUTPUT_BYTES,
|
|
33
44
|
shell: false,
|
|
34
45
|
stdio: ["pipe", "pipe", "ignore"],
|
|
@@ -52,7 +63,7 @@ export function fetchGithubAuthorityArtifact(projectDir, enrollment, githubToken
|
|
|
52
63
|
fetchedAt: now.toISOString(),
|
|
53
64
|
repositoryId: enrollment.repositoryId,
|
|
54
65
|
runId: fetched.runId,
|
|
55
|
-
sourceHead:
|
|
66
|
+
sourceHead: expected.sourceHead,
|
|
56
67
|
},
|
|
57
68
|
kind: "ready",
|
|
58
69
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-fetch-worker.js","sourceRoot":"","sources":["../../src/cli/authority-fetch-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,oCAAoC,IAAI,2CAA2C,EAAE,MAAM,qDAAqD,CAAA;
|
|
1
|
+
{"version":3,"file":"authority-fetch-worker.js","sourceRoot":"","sources":["../../src/cli/authority-fetch-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,oCAAoC,IAAI,2CAA2C,EAAE,MAAM,qDAAqD,CAAA;AAIzJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAE9F,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,qDAAqD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAClH,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAYhC,MAAM,UAAU,iCAAiC,CAC/C,UAA+F,EAC/F,UAAkB,EAClB,QAAgC;IAEhC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,QAAQ,EAAE;YACR,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC;QACD,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,UAAkB,EAClB,UAA+B,EAC/B,QAAgC,EAChC,WAA+B,EAC/B,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACpE,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAA;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAChE,MAAM,GAAG,GAAG,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;IAC3D,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACxE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC9E,MAAM,gBAAgB,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAC1E,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;QACxD,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ;QAC7B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,iCAAiC,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxE,SAAS,EAAE,gBAAgB;QAC3B,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACjC,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACvG,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC,MAAM,CAAC;QACpD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACpE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACtH,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;QACrB,CAAC,CAAC;YACE,QAAQ,EAAE;gBACR,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC;YACD,IAAI,EAAE,OAAO;SACd,CAAA;AACP,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAMhD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9H,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QAC/J,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACrD,OAAO,OAAO,CAAC,UAAU,GAAG,CAAC;eACxB,OAAO,CAAC,UAAU,IAAI,iBAAiB;eACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,OAAO;YAChD,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;YACxG,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,WAAmB,EACnB,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAC3B,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAE3D,OAAO,2CAA2C,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAa;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,OAAO,QAAQ,CAAC,MAAM,CAAC;eAClB,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;eACjC,MAAM,CAAC,EAAE,KAAK,KAAK;eACnB,gCAAgC,CAAC,MAAM,CAAC,IAAI,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,IAAuB;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,gCAAgC,CAAC,KAAc;IACtD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,0BAA0B,CAAC;QAChC,KAAK,yBAAyB,CAAC;QAC/B,KAAK,yBAAyB,CAAC;QAC/B,KAAK,wBAAwB;YAC3B,OAAO,IAAI,CAAA;QACb;YACE,OAAO,KAAK,CAAA;IAChB,CAAC;AACH,CAAC"}
|