vaspera 2.5.0

package/dist/sbom/cyclonedx.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx.test.js","sourceRoot":"","sources":["../../src/sbom/cyclonedx.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,mBAAmB;AACnB,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;IACjB,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;CAChB,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE/C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,KAAK;QACd,YAAY,EAAE;YACZ,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,UAAU;SACnB;QACD,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;SACjB;KACF,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,OAAO;QAChB,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE;YACR,EAAE,EAAE;gBACF,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE;oBACZ,OAAO,EAAE,SAAS;oBAClB,MAAM,EAAE,UAAU;iBACnB;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,QAAQ;iBACjB;aACF;YACD,sBAAsB,EAAE;gBACtB,OAAO,EAAE,QAAQ;gBACjB,QAAQ,EAAE,yDAAyD;gBACnE,SAAS,EAAE,kBAAkB;aAC9B;YACD,qBAAqB,EAAE;gBACrB,OAAO,EAAE,SAAS;gBAClB,QAAQ,EAAE,wDAAwD;gBAClE,SAAS,EAAE,kBAAkB;aAC9B;YACD,qBAAqB,EAAE;gBACrB,OAAO,EAAE,OAAO;gBAChB,QAAQ,EAAE,sDAAsD;gBAChE,SAAS,EAAE,kBAAkB;gBAC7B,GAAG,EAAE,IAAI;aACV;SACF;KACF,CAAC,CAAC;IAEH,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAE9C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEhF,MAAM,CAAC,IAAI,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACjE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAE9C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YACnE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAE9C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YACnE,MAAM,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC/B,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAE9C,MAAM,CAAC,IAAI,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,2CAA2C;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YACnE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAE5D,MAAM,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YACvC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAE9C,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAE9C,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,YAAa,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACzC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAElD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACzC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBAC/C,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAE1C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,QAAQ,GAAG;gBACf;oBACE,OAAO,EAAE,WAAoB;oBAC7B,MAAM,EAAE,UAAU;oBAClB,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,CAAC;oBACP,OAAO,EAAE,uBAAuB;oBAChC,QAAQ,EAAE,MAAe;oBACzB,UAAU,EAAE,GAAY;oBACxB,MAAM,EAAE,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE,CAAC,eAAe,CAAC;iBAC1B;aACF,CAAC;YAEF,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAElD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,QAAQ,GAAG;gBACf;oBACE,OAAO,EAAE,WAAoB;oBAC7B,MAAM,EAAE,UAAU;oBAClB,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,CAAC;oBACP,OAAO,EAAE,UAAU;oBACnB,QAAQ,EAAE,QAAiB;oBAC3B,UAAU,EAAE,GAAY;iBACzB;aACF,CAAC;YAEF,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAElD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;YAE7C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAE1C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sbom/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * SBOM Module
+ *
+ * Exports SBOM generation, provenance, and signing functionality.
+ *
+ * @module sbom
+ */
+export type { CycloneDXSBOM, CycloneDXComponent, CycloneDXDependency, CycloneDXVulnerability, CycloneDXMetadata, CycloneDXTool, ComponentType, ComponentScope, ExternalReference, ExternalReferenceType, Hash, HashAlgorithm, LicenseInfo, Property, VulnerabilityRating, VulnerabilitySource, InTotoStatement, SLSAProvenancePredicate, SLSABuildDefinition, SLSARunDetails, SLSABuilder, SLSABuildMetadata, SigstoreBundle, SignedArtifact, SBOMOptions, ProvenanceOptions, SigningOptions, } from "./types.js";
+export { CYCLONEDX_SPEC_VERSION, SLSA_PREDICATE_TYPE, } from "./types.js";
+export { generateSBOM, generateSBOMJson, generateSBOMSummary, findingsToVulnerabilities, calculateSha256, } from "./cyclonedx.js";
+export { generateProvenance, generateProvenanceJson, generateProvenanceSummary, verifyProvenance, sha256Digest, sha256File, } from "./provenance.js";
+export { signContent, isSigningAvailable, createUnsignedArtifact, verifySignature, verifySignedArtifact, generateSigningSummary, detectCIEnvironment, sha256, sha256Base64, } from "./signing.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/sbom/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sbom/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,IAAI,EACJ,aAAa,EACb,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,YAAY,EACZ,UAAU,GACX,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,MAAM,EACN,YAAY,GACb,MAAM,cAAc,CAAC"}

package/dist/sbom/index.js

@@ -0,0 +1,15 @@
+/**
+ * SBOM Module
+ *
+ * Exports SBOM generation, provenance, and signing functionality.
+ *
+ * @module sbom
+ */
+export { CYCLONEDX_SPEC_VERSION, SLSA_PREDICATE_TYPE, } from "./types.js";
+// CycloneDX SBOM
+export { generateSBOM, generateSBOMJson, generateSBOMSummary, findingsToVulnerabilities, calculateSha256, } from "./cyclonedx.js";
+// SLSA Provenance
+export { generateProvenance, generateProvenanceJson, generateProvenanceSummary, verifyProvenance, sha256Digest, sha256File, } from "./provenance.js";
+// Sigstore Signing (uses @sigstore/sign for real cryptographic signing)
+export { signContent, isSigningAvailable, createUnsignedArtifact, verifySignature, verifySignedArtifact, generateSigningSummary, detectCIEnvironment, sha256, sha256Base64, } from "./signing.js";
+//# sourceMappingURL=index.js.map

package/dist/sbom/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sbom/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiCH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,kBAAkB;AAClB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,YAAY,EACZ,UAAU,GACX,MAAM,iBAAiB,CAAC;AAEzB,wEAAwE;AACxE,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,MAAM,EACN,YAAY,GACb,MAAM,cAAc,CAAC"}

package/dist/sbom/provenance.d.ts

@@ -0,0 +1,37 @@
+/**
+ * SLSA Provenance Generator
+ *
+ * Generates SLSA v1.0 provenance statements for certifications.
+ *
+ * @module sbom/provenance
+ */
+import type { InTotoStatement, ProvenanceOptions } from "./types.js";
+import type { Certification } from "../certification/types.js";
+/**
+ * Calculate SHA-256 digest of a string
+ */
+export declare function sha256Digest(content: string): string;
+/**
+ * Calculate SHA-256 digest of a file
+ */
+export declare function sha256File(filePath: string): Promise<string>;
+/**
+ * Generate SLSA provenance for a certification
+ */
+export declare function generateProvenance(certification: Certification, artifactContent: string, options?: ProvenanceOptions): Promise<InTotoStatement>;
+/**
+ * Generate provenance as JSON string
+ */
+export declare function generateProvenanceJson(certification: Certification, artifactContent: string, options?: ProvenanceOptions): Promise<string>;
+/**
+ * Generate compact provenance summary
+ */
+export declare function generateProvenanceSummary(provenance: InTotoStatement): string;
+/**
+ * Verify provenance matches a certification
+ */
+export declare function verifyProvenance(provenance: InTotoStatement, certification: Certification, artifactContent: string): {
+    valid: boolean;
+    errors: string[];
+};
+//# sourceMappingURL=provenance.d.ts.map

package/dist/sbom/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/sbom/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EACV,eAAe,EAIf,iBAAiB,EAElB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AA0B/D;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AA+JD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,aAAa,EAC5B,eAAe,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAwC1B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,aAAa,EAC5B,eAAe,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAqB7E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,eAAe,EAC3B,aAAa,EAAE,aAAa,EAC5B,eAAe,EAAE,MAAM,GACtB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAwBtC"}

package/dist/sbom/provenance.js

@@ -0,0 +1,268 @@
+/**
+ * SLSA Provenance Generator
+ *
+ * Generates SLSA v1.0 provenance statements for certifications.
+ *
+ * @module sbom/provenance
+ */
+import { createHash } from "crypto";
+import { readFile, access } from "fs/promises";
+import { join } from "path";
+import { logger } from "../logger.js";
+/**
+ * Default builder ID
+ */
+const DEFAULT_BUILDER_ID = "https://github.com/RCOLKITT/vaspera-hardening-mcp";
+/**
+ * Default build type for Vaspera certifications
+ */
+const VASPERA_BUILD_TYPE = "https://vaspera.dev/certification/v1";
+/**
+ * Check if file exists
+ */
+async function fileExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch (error) {
+        logger.debug("provenance.file_not_found", { path: filePath, error: String(error) });
+        return false;
+    }
+}
+/**
+ * Calculate SHA-256 digest of a string
+ */
+export function sha256Digest(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+/**
+ * Calculate SHA-256 digest of a file
+ */
+export async function sha256File(filePath) {
+    const content = await readFile(filePath);
+    return createHash("sha256").update(content).digest("hex");
+}
+/**
+ * Get Git commit SHA if in a git repo
+ */
+async function getGitCommit(projectPath) {
+    const gitHeadPath = join(projectPath, ".git", "HEAD");
+    if (!(await fileExists(gitHeadPath))) {
+        return undefined;
+    }
+    try {
+        const headContent = await readFile(gitHeadPath, "utf-8");
+        const trimmed = headContent.trim();
+        // Check if HEAD points to a ref
+        if (trimmed.startsWith("ref: ")) {
+            const refPath = join(projectPath, ".git", trimmed.slice(5));
+            if (await fileExists(refPath)) {
+                const sha = await readFile(refPath, "utf-8");
+                return sha.trim();
+            }
+        }
+        else {
+            // Detached HEAD - directly contains SHA
+            return trimmed;
+        }
+    }
+    catch (error) {
+        logger.debug("provenance.git_commit_failed", { projectPath, error: String(error) });
+        return undefined;
+    }
+    return undefined;
+}
+/**
+ * Get Git remote URL
+ */
+async function getGitRemoteUrl(projectPath) {
+    const configPath = join(projectPath, ".git", "config");
+    if (!(await fileExists(configPath))) {
+        return undefined;
+    }
+    try {
+        const configContent = await readFile(configPath, "utf-8");
+        const match = configContent.match(/\[remote "origin"\][^\[]*url\s*=\s*(.+)/);
+        if (match) {
+            return match[1].trim();
+        }
+    }
+    catch (error) {
+        logger.debug("provenance.git_remote_failed", { projectPath, error: String(error) });
+        return undefined;
+    }
+    return undefined;
+}
+/**
+ * Create build definition for a certification
+ */
+async function createBuildDefinition(certification, options) {
+    const projectPath = certification.metadata.project_path;
+    // Resolved dependencies (files that were scanned)
+    const resolvedDependencies = [];
+    // Add package.json as a dependency if it exists
+    const packageJsonPath = join(projectPath, "package.json");
+    if (await fileExists(packageJsonPath)) {
+        resolvedDependencies.push({
+            uri: "file://package.json",
+            digest: {
+                sha256: await sha256File(packageJsonPath),
+            },
+            name: "package.json",
+        });
+    }
+    // Add package-lock.json if it exists
+    const packageLockPath = join(projectPath, "package-lock.json");
+    if (await fileExists(packageLockPath)) {
+        resolvedDependencies.push({
+            uri: "file://package-lock.json",
+            digest: {
+                sha256: await sha256File(packageLockPath),
+            },
+            name: "package-lock.json",
+        });
+    }
+    // External parameters from certification config
+    const externalParameters = {
+        agents: certification.metadata.agents_requested,
+        ...options?.externalParameters,
+    };
+    // Internal parameters (environment info)
+    const internalParameters = {
+        node_version: process.version,
+        platform: process.platform,
+        arch: process.arch,
+        ...options?.internalParameters,
+    };
+    return {
+        buildType: options?.buildType || VASPERA_BUILD_TYPE,
+        externalParameters,
+        internalParameters,
+        resolvedDependencies,
+    };
+}
+/**
+ * Create run details for a certification
+ */
+function createRunDetails(certification, options) {
+    const runDetails = {
+        builder: {
+            id: options?.builderId || DEFAULT_BUILDER_ID,
+            version: {
+                "vaspera-hardening": "1.1.0",
+            },
+        },
+        metadata: {
+            invocationId: certification.metadata.id,
+            startedOn: certification.metadata.started_at,
+            finishedOn: certification.metadata.completed_at,
+        },
+    };
+    // Add byproducts (findings summary)
+    if (certification.consensus) {
+        runDetails.byproducts = [
+            {
+                uri: `vaspera://certification/${certification.metadata.id}/consensus`,
+                mediaType: "application/json",
+                content: Buffer.from(JSON.stringify({
+                    level: certification.consensus.certification_level,
+                    score: certification.consensus.overall_score,
+                    total_findings: certification.consensus.total_findings,
+                    by_severity: certification.consensus.by_severity,
+                })).toString("base64"),
+            },
+        ];
+    }
+    return runDetails;
+}
+/**
+ * Generate SLSA provenance for a certification
+ */
+export async function generateProvenance(certification, artifactContent, options) {
+    const projectPath = certification.metadata.project_path;
+    // Get git info for subject
+    const gitCommit = await getGitCommit(projectPath);
+    const gitRemote = await getGitRemoteUrl(projectPath);
+    // Create subject (what the provenance is about)
+    const subjectName = gitRemote
+        ? gitRemote.replace(/\.git$/, "").replace(/^git@github\.com:/, "https://github.com/")
+        : certification.metadata.project_name;
+    const subjectDigest = {
+        sha256: sha256Digest(artifactContent),
+    };
+    if (gitCommit) {
+        subjectDigest.gitCommit = gitCommit;
+    }
+    // Create provenance predicate
+    const predicate = {
+        buildDefinition: await createBuildDefinition(certification, options),
+        runDetails: createRunDetails(certification, options),
+    };
+    // Create in-toto statement
+    const statement = {
+        _type: "https://in-toto.io/Statement/v1",
+        subject: [
+            {
+                name: subjectName,
+                digest: subjectDigest,
+            },
+        ],
+        predicateType: "https://slsa.dev/provenance/v1",
+        predicate,
+    };
+    return statement;
+}
+/**
+ * Generate provenance as JSON string
+ */
+export async function generateProvenanceJson(certification, artifactContent, options) {
+    const provenance = await generateProvenance(certification, artifactContent, options);
+    return JSON.stringify(provenance, null, 2);
+}
+/**
+ * Generate compact provenance summary
+ */
+export function generateProvenanceSummary(provenance) {
+    const subject = provenance.subject[0];
+    const buildDef = provenance.predicate.buildDefinition;
+    const runDetails = provenance.predicate.runDetails;
+    const lines = [
+        `Subject: ${subject.name}`,
+        `Digest: sha256:${subject.digest.sha256?.slice(0, 12)}...`,
+        `Builder: ${runDetails.builder.id}`,
+        `Build Type: ${buildDef.buildType}`,
+    ];
+    if (runDetails.metadata?.startedOn) {
+        lines.push(`Started: ${runDetails.metadata.startedOn}`);
+    }
+    if (runDetails.metadata?.finishedOn) {
+        lines.push(`Finished: ${runDetails.metadata.finishedOn}`);
+    }
+    return lines.join("\n");
+}
+/**
+ * Verify provenance matches a certification
+ */
+export function verifyProvenance(provenance, certification, artifactContent) {
+    const errors = [];
+    // Check predicate type
+    if (provenance.predicateType !== "https://slsa.dev/provenance/v1") {
+        errors.push(`Invalid predicate type: ${provenance.predicateType}`);
+    }
+    // Check subject digest
+    const expectedDigest = sha256Digest(artifactContent);
+    if (provenance.subject[0]?.digest.sha256 !== expectedDigest) {
+        errors.push("Subject digest does not match artifact content");
+    }
+    // Check invocation ID matches certification ID
+    const invocationId = provenance.predicate.runDetails.metadata?.invocationId;
+    if (invocationId !== certification.metadata.id) {
+        errors.push(`Invocation ID mismatch: ${invocationId} vs ${certification.metadata.id}`);
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+//# sourceMappingURL=provenance.js.map

package/dist/sbom/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/sbom/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAc,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC;;GAEG;AACH,MAAM,kBAAkB,GAAG,mDAAmD,CAAC;AAE/E;;GAEG;AACH,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE;;GAEG;AACH,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,WAAmB;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QAEnC,gCAAgC;QAChC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,WAAmB;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7E,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;IAExD,kDAAkD;IAClD,MAAM,oBAAoB,GAAgD,EAAE,CAAC;IAE7E,gDAAgD;IAChD,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,MAAM,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,oBAAoB,CAAC,IAAI,CAAC;YACxB,GAAG,EAAE,qBAAqB;YAC1B,MAAM,EAAE;gBACN,MAAM,EAAE,MAAM,UAAU,CAAC,eAAe,CAAC;aAC1C;YACD,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC/D,IAAI,MAAM,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,oBAAoB,CAAC,IAAI,CAAC;YACxB,GAAG,EAAE,0BAA0B;YAC/B,MAAM,EAAE;gBACN,MAAM,EAAE,MAAM,UAAU,CAAC,eAAe,CAAC;aAC1C;YACD,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,gDAAgD;IAChD,MAAM,kBAAkB,GAA4B;QAClD,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,gBAAgB;QAC/C,GAAG,OAAO,EAAE,kBAAkB;KAC/B,CAAC;IAEF,yCAAyC;IACzC,MAAM,kBAAkB,GAA4B;QAClD,YAAY,EAAE,OAAO,CAAC,OAAO;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,OAAO,EAAE,kBAAkB;KAC/B,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,kBAAkB;QACnD,kBAAkB;QAClB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,UAAU,GAAmB;QACjC,OAAO,EAAE;YACP,EAAE,EAAE,OAAO,EAAE,SAAS,IAAI,kBAAkB;YAC5C,OAAO,EAAE;gBACP,mBAAmB,EAAE,OAAO;aAC7B;SACF;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE;YACvC,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU;YAC5C,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;SAChD;KACF,CAAC;IAEF,oCAAoC;IACpC,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,UAAU,GAAG;YACtB;gBACE,GAAG,EAAE,2BAA2B,aAAa,CAAC,QAAQ,CAAC,EAAE,YAAY;gBACrE,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,MAAM,CAAC,IAAI,CAClB,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,mBAAmB;oBAClD,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,aAAa;oBAC5C,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,cAAc;oBACtD,WAAW,EAAE,aAAa,CAAC,SAAS,CAAC,WAAW;iBACjD,CAAC,CACH,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACrB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAA4B,EAC5B,eAAuB,EACvB,OAA2B;IAE3B,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;IAExD,2BAA2B;IAC3B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IAErD,gDAAgD;IAChD,MAAM,WAAW,GAAG,SAAS;QAC3B,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACrF,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;IAExC,MAAM,aAAa,GAA2B;QAC5C,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC;KACtC,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,aAAa,CAAC,SAAS,GAAG,SAAS,CAAC;IACtC,CAAC;IAED,8BAA8B;IAC9B,MAAM,SAAS,GAA4B;QACzC,eAAe,EAAE,MAAM,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC;QACpE,UAAU,EAAE,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC;KACrD,CAAC;IAEF,2BAA2B;IAC3B,MAAM,SAAS,GAAoB;QACjC,KAAK,EAAE,iCAAiC;QACxC,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,aAAa;aACtB;SACF;QACD,aAAa,EAAE,gCAAgC;QAC/C,SAAS;KACV,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAA4B,EAC5B,eAAuB,EACvB,OAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAA2B;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC;IACtD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC;IAEnD,MAAM,KAAK,GAAG;QACZ,YAAY,OAAO,CAAC,IAAI,EAAE;QAC1B,kBAAkB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;QAC1D,YAAY,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE;QACnC,eAAe,QAAQ,CAAC,SAAS,EAAE;KACpC,CAAC;IAEF,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA2B,EAC3B,aAA4B,EAC5B,eAAuB;IAEvB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,uBAAuB;IACvB,IAAI,UAAU,CAAC,aAAa,KAAK,gCAAgC,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,2BAA2B,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,uBAAuB;IACvB,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,+CAA+C;IAC/C,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC;IAC5E,IAAI,YAAY,KAAK,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,2BAA2B,YAAY,OAAO,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/sbom/provenance.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Tests for SLSA Provenance generation
+ */
+export {};
+//# sourceMappingURL=provenance.test.d.ts.map

package/dist/sbom/provenance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.test.d.ts","sourceRoot":"","sources":["../../src/sbom/provenance.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/sbom/provenance.test.js

@@ -0,0 +1,189 @@
+/**
+ * Tests for SLSA Provenance generation
+ */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { generateProvenance, generateProvenanceJson, generateProvenanceSummary, verifyProvenance, sha256Digest, } from "./provenance.js";
+// Mock fs/promises
+vi.mock("fs/promises", () => ({
+    readFile: vi.fn(),
+    access: vi.fn(),
+}));
+import { readFile, access } from "fs/promises";
+describe("SLSA Provenance", () => {
+    const mockCertification = {
+        metadata: {
+            id: "cert-test-123",
+            project_name: "test-project",
+            project_path: "/test/path",
+            started_at: "2024-01-01T00:00:00Z",
+            completed_at: "2024-01-01T01:00:00Z",
+            status: "completed",
+            agents_requested: ["security", "reliability"],
+            agents_completed: ["security", "reliability"],
+            certification_level: "CERTIFIED",
+            final_score: 95,
+        },
+        agents: {
+            security: {
+                agent: "security",
+                started_at: "2024-01-01T00:00:00Z",
+                completed_at: "2024-01-01T00:30:00Z",
+                status: "completed",
+                findings: [],
+                summary: {
+                    total_findings: 0,
+                    by_severity: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+                    confidence_score: 95,
+                    coverage_areas: ["authentication", "authorization"],
+                },
+            },
+        },
+        cross_verifications: [],
+        red_team_challenges: [],
+        consensus: {
+            overall_score: 95,
+            certification_level: "CERTIFIED",
+            agent_scores: { security: 95, reliability: 95, typesafety: 0, performance: 0, quality: 0, redteam: 0, "agent-redteam": 0, "agent-privacy": 0, "agent-integrity": 0 },
+            agent_confidences: { security: 95, reliability: 95, typesafety: 0, performance: 0, quality: 0, redteam: 0, "agent-redteam": 0, "agent-privacy": 0, "agent-integrity": 0 },
+            total_findings: 0,
+            by_severity: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+            cross_verification_rate: 100,
+            red_team_challenges_accepted: 0,
+            red_team_challenges_total: 0,
+            calculated_at: "2024-01-01T01:00:00Z",
+        },
+    };
+    const mockArtifactContent = JSON.stringify(mockCertification, null, 2);
+    beforeEach(() => {
+        vi.clearAllMocks();
+        // Default: no git repo
+        vi.mocked(access).mockRejectedValue(new Error("Not found"));
+    });
+    describe("generateProvenance", () => {
+        it("generates valid in-toto statement", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            expect(provenance._type).toBe("https://in-toto.io/Statement/v1");
+            expect(provenance.predicateType).toBe("https://slsa.dev/provenance/v1");
+            expect(provenance.subject).toBeDefined();
+            expect(provenance.subject.length).toBe(1);
+            expect(provenance.predicate).toBeDefined();
+        });
+        it("includes subject with SHA-256 digest", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            expect(provenance.subject[0].digest.sha256).toBeDefined();
+            expect(provenance.subject[0].digest.sha256).toBe(sha256Digest(mockArtifactContent));
+        });
+        it("includes build definition", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            expect(provenance.predicate.buildDefinition).toBeDefined();
+            expect(provenance.predicate.buildDefinition.buildType).toBe("https://vaspera.dev/certification/v1");
+        });
+        it("includes run details with builder", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            expect(provenance.predicate.runDetails).toBeDefined();
+            expect(provenance.predicate.runDetails.builder.id).toBe("https://github.com/RCOLKITT/vaspera-hardening-mcp");
+        });
+        it("includes metadata with certification timestamps", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            expect(provenance.predicate.runDetails.metadata?.invocationId).toBe("cert-test-123");
+            expect(provenance.predicate.runDetails.metadata?.startedOn).toBe("2024-01-01T00:00:00Z");
+            expect(provenance.predicate.runDetails.metadata?.finishedOn).toBe("2024-01-01T01:00:00Z");
+        });
+        it("includes agents in external parameters", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            expect(provenance.predicate.buildDefinition.externalParameters?.agents).toEqual([
+                "security",
+                "reliability",
+            ]);
+        });
+        it("uses custom builder ID", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent, {
+                builderId: "https://custom-builder.com",
+            });
+            expect(provenance.predicate.runDetails.builder.id).toBe("https://custom-builder.com");
+        });
+        it("uses custom build type", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent, {
+                buildType: "https://custom.build/type",
+            });
+            expect(provenance.predicate.buildDefinition.buildType).toBe("https://custom.build/type");
+        });
+        it("includes byproducts with consensus info", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            expect(provenance.predicate.runDetails.byproducts).toBeDefined();
+            expect(provenance.predicate.runDetails.byproducts.length).toBe(1);
+            expect(provenance.predicate.runDetails.byproducts[0].uri).toContain("consensus");
+        });
+        it("includes git commit when available", async () => {
+            vi.mocked(access).mockResolvedValue(undefined);
+            vi.mocked(readFile).mockImplementation(async (path) => {
+                if (String(path).includes("HEAD")) {
+                    return "abc123def456\n";
+                }
+                return "";
+            });
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            expect(provenance.subject[0].digest.gitCommit).toBe("abc123def456");
+        });
+    });
+    describe("generateProvenanceJson", () => {
+        it("returns valid JSON string", async () => {
+            const json = await generateProvenanceJson(mockCertification, mockArtifactContent);
+            expect(() => JSON.parse(json)).not.toThrow();
+            const parsed = JSON.parse(json);
+            expect(parsed._type).toBe("https://in-toto.io/Statement/v1");
+        });
+    });
+    describe("generateProvenanceSummary", () => {
+        it("generates readable summary", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            const summary = generateProvenanceSummary(provenance);
+            expect(summary).toContain("Subject:");
+            expect(summary).toContain("Builder:");
+            expect(summary).toContain("Build Type:");
+        });
+    });
+    describe("verifyProvenance", () => {
+        it("validates matching provenance", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            const result = verifyProvenance(provenance, mockCertification, mockArtifactContent);
+            expect(result.valid).toBe(true);
+            expect(result.errors).toHaveLength(0);
+        });
+        it("fails with wrong predicate type", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            provenance.predicateType = "wrong";
+            const result = verifyProvenance(provenance, mockCertification, mockArtifactContent);
+            expect(result.valid).toBe(false);
+            expect(result.errors).toContain("Invalid predicate type: wrong");
+        });
+        it("fails with mismatched digest", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            const result = verifyProvenance(provenance, mockCertification, "different content");
+            expect(result.valid).toBe(false);
+            expect(result.errors.some((e) => e.includes("digest"))).toBe(true);
+        });
+        it("fails with wrong certification ID", async () => {
+            const provenance = await generateProvenance(mockCertification, mockArtifactContent);
+            const differentCert = {
+                ...mockCertification,
+                metadata: { ...mockCertification.metadata, id: "different-id" },
+            };
+            const result = verifyProvenance(provenance, differentCert, mockArtifactContent);
+            expect(result.valid).toBe(false);
+            expect(result.errors.some((e) => e.includes("Invocation ID"))).toBe(true);
+        });
+    });
+    describe("sha256Digest", () => {
+        it("computes correct SHA-256", () => {
+            const digest = sha256Digest("test");
+            expect(digest).toBe("9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08");
+        });
+        it("produces different digests for different content", () => {
+            const d1 = sha256Digest("content1");
+            const d2 = sha256Digest("content2");
+            expect(d1).not.toBe(d2);
+        });
+    });
+});
+//# sourceMappingURL=provenance.test.js.map

package/dist/sbom/provenance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.test.js","sourceRoot":"","sources":["../../src/sbom/provenance.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,mBAAmB;AACnB,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;IACjB,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;CAChB,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE/C,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,iBAAiB,GAAkB;QACvC,QAAQ,EAAE;YACR,EAAE,EAAE,eAAe;YACnB,YAAY,EAAE,cAAc;YAC5B,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,sBAAsB;YAClC,YAAY,EAAE,sBAAsB;YACpC,MAAM,EAAE,WAAW;YACnB,gBAAgB,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC7C,mBAAmB,EAAE,WAAW;YAChC,WAAW,EAAE,EAAE;SAChB;QACD,MAAM,EAAE;YACN,QAAQ,EAAE;gBACR,KAAK,EAAE,UAAU;gBACjB,UAAU,EAAE,sBAAsB;gBAClC,YAAY,EAAE,sBAAsB;gBACpC,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE;oBACP,cAAc,EAAE,CAAC;oBACjB,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE;oBACjE,gBAAgB,EAAE,EAAE;oBACpB,cAAc,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;iBACpD;aACF;SACF;QACD,mBAAmB,EAAE,EAAE;QACvB,mBAAmB,EAAE,EAAE;QACvB,SAAS,EAAE;YACT,aAAa,EAAE,EAAE;YACjB,mBAAmB,EAAE,WAAW;YAChC,YAAY,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE;YACpK,iBAAiB,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE;YACzK,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE;YACjE,uBAAuB,EAAE,GAAG;YAC5B,4BAA4B,EAAE,CAAC;YAC/B,yBAAyB,EAAE,CAAC;YAC5B,aAAa,EAAE,sBAAsB;SACtC;KACF,CAAC;IAEF,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvE,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,uBAAuB;QACvB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YACjE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YACxE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1D,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3D,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CACzD,sCAAsC,CACvC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CACrD,mDAAmD,CACpD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACrF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACzF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;gBAC9E,UAAU;gBACV,aAAa;aACd,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,EAAE;gBAClF,SAAS,EAAE,4BAA4B;aACxC,CAAC,CAAC;YAEH,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,EAAE;gBAClF,SAAS,EAAE,2BAA2B;aACvC,CAAC,CAAC;YAEH,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YACjE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClC,OAAO,gBAAgB,CAAC;gBAC1B,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAElF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YACpF,MAAM,OAAO,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;YAEtD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YACpF,UAAU,CAAC,aAAa,GAAG,OAAO,CAAC;YAEnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAEpF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YACpF,MAAM,aAAa,GAAG;gBACpB,GAAG,iBAAiB;gBACpB,QAAQ,EAAE,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE;aAChE,CAAC;YAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;YAEhF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}