@clawvard/sdk 0.14.0 → 0.15.1

package/dist/pentest.js

@@ -0,0 +1,585 @@
+/**
+ * `cv.security.pentestRun` — hand-written orchestration for the
+ * `agent-pentest` course.
+ *
+ * The pentest agent (open-source `strix-agent`, Apache-2.0) runs
+ * locally against a target the user owns — usually a self-hosted
+ * OWASP Juice Shop or a staging build of their own web app. The SDK
+ * mints a one-time LLM credential scoped to this run via
+ * `service.clawvard`, spawns the `strix` CLI as a subprocess with the
+ * credential exposed as `LLM_API_KEY`, and normalises the
+ * `strix_runs/<name>/` directory into the typed
+ * `SecurityPentestRunOutput` shape when the process exits.
+ *
+ * Node-only. Attempting to call `pentestRun` in a browser (or any
+ * environment without `child_process`) throws
+ * `SandboxMissingError` early — Strix launches its agent sandbox in a
+ * local Docker container.
+ *
+ * The credential handed to Strix expires when the run resolves or
+ * hits the wall-clock timeout. The SDK does NOT hard-code an
+ * OpenAI-compatible relay base URL in the run — the endpoint is
+ * chosen by `service.clawvard` at mint time.
+ *
+ * Callers can pattern-match on the SDK-side error subclasses:
+ *
+ *     try {
+ *       await cv.security.pentestRun({...});
+ *     } catch (err) {
+ *       if (err instanceof TargetUnreachableError) { ... }
+ *       if (err instanceof InvalidTargetHostError) { ... }
+ *       if (err instanceof SandboxMissingError) { ... }
+ *       if (err instanceof OwnershipUnconfirmedError) { ... }
+ *       if (err instanceof LlmQuotaError) { ... }
+ *       if (err instanceof PentestTimeoutError) { ... }
+ *       if (err instanceof StrixCrashedError) { ... }
+ *     }
+ */
+import { ClawvardError } from "./errors.js";
+import { SecurityNamespace } from "./generated.js";
+/** Public error codes surfaced on `PentestError.code`. Uppercase `E_`-
+ *  prefixed shape per the course PRD so consumers can pattern-match
+ *  without normalising case. See `mapPentestError` for the two-way
+ *  mapping against server-side envelopes (which may still use the
+ *  lowercase `snake_case` form to be robust to older backends). */
+export const PENTEST_ERROR_CODES = [
+    "E_TARGET_UNREACHABLE",
+    "E_INVALID_TARGET_HOST",
+    "E_SANDBOX_MISSING",
+    "E_OWNERSHIP_UNCONFIRMED",
+    "E_LLM_QUOTA",
+    "E_TIMEOUT",
+    "E_STRIX_CRASHED",
+    "E_SERVICE_NOT_LIVE",
+];
+/** Base class for any error surfaced by `cv.security.pentestRun`. */
+export class PentestError extends ClawvardError {
+    constructor(code, message) {
+        super(message, code);
+        this.name = "PentestError";
+    }
+}
+/** `HEAD <targetUrl>` failed before Strix could be spawned. Usually
+ *  means the user forgot to `docker run` the target, or bound it to a
+ *  port other than the one they wrote in the prompt. */
+export class TargetUnreachableError extends PentestError {
+    constructor(message = "Target URL could not be reached — start the target (e.g. `docker run --rm -p 3000:3000 bkimminich/juice-shop`) and retry.") {
+        super("E_TARGET_UNREACHABLE", message);
+        this.name = "TargetUnreachableError";
+    }
+}
+/** Either the input `targetUrl` isn't in `allowedHosts`, or Strix
+ *  tried to reach a host outside the whitelist mid-run. The SDK kills
+ *  the run instead of letting a coerced prompt escape the sandbox. */
+export class InvalidTargetHostError extends PentestError {
+    constructor(message = "Target host is not in `allowedHosts`. Add the exact host:port shown in `targetUrl` and retry.") {
+        super("E_INVALID_TARGET_HOST", message);
+        this.name = "InvalidTargetHostError";
+    }
+}
+/** Local Docker daemon is missing or unreachable, `strix` is not on
+ *  PATH, or the environment cannot spawn subprocesses (browser). */
+export class SandboxMissingError extends PentestError {
+    constructor(message = "Local sandbox is not ready — install strix-agent (`pipx install strix-agent`), start Docker, and retry.") {
+        super("E_SANDBOX_MISSING", message);
+        this.name = "SandboxMissingError";
+    }
+}
+/** `ownership.confirmed` was missing or `false`. The service will not
+ *  attack a target the caller has not declared they own or are
+ *  authorised to test. */
+export class OwnershipUnconfirmedError extends PentestError {
+    constructor(message = "Set `ownership.confirmed = true` and a truthful `ownership.statement` to run against your own target.") {
+        super("E_OWNERSHIP_UNCONFIRMED", message);
+        this.name = "OwnershipUnconfirmedError";
+    }
+}
+/** The caller's Clawvard credits balance is below the per-run budget
+ *  the SDK reserved. Top up at https://clawvard.school and retry. */
+export class LlmQuotaError extends PentestError {
+    constructor(message = "Not enough Clawvard credits reserved for this run — top up at https://clawvard.school and retry.") {
+        super("E_LLM_QUOTA", message);
+        this.name = "LlmQuotaError";
+    }
+}
+/** Wall-clock timeout hit before Strix marked the run complete. The
+ *  scoped LLM credential is revoked at this point so the run cannot
+ *  keep grinding credits in the background. */
+export class PentestTimeoutError extends PentestError {
+    constructor(message = "Pentest run exceeded its wall-clock budget. Split by iteration cap or retry with a smaller target.") {
+        super("E_TIMEOUT", message);
+        this.name = "PentestTimeoutError";
+    }
+}
+/** Strix subprocess exited non-zero. Message carries the tail of
+ *  Strix's stderr so the caller can see what actually broke — usually
+ *  a docker-in-docker permissions issue or an interrupted run. */
+export class StrixCrashedError extends PentestError {
+    constructor(message) {
+        super("E_STRIX_CRASHED", message);
+        this.name = "StrixCrashedError";
+    }
+}
+/** The Clawvard tenant the caller's key resolves to does not yet have
+ *  the pentest service live — usually means the closed beta hasn't
+ *  been rolled out to their account. Contact support at
+ *  https://clawvard.school to request access. Callers can pattern-
+ *  match this to fall back to a manual Strix invocation if they need
+ *  a result today. */
+export class PentestServiceNotLiveError extends PentestError {
+    constructor(message = "cv.security.pentestRun is currently in closed beta — request access at https://clawvard.school and we'll enable it for your account.") {
+        super("E_SERVICE_NOT_LIVE", message);
+        this.name = "PentestServiceNotLiveError";
+    }
+}
+/** Map a backend error envelope (`{ error: code, message }`) to the
+ *  matching SDK class. Accepts both the canonical `E_UPPERCASE_SNAKE`
+ *  form and the older `lowercase_snake` shape some backends still
+ *  emit, so a mid-flight backend rollout doesn't spike into generic
+ *  `PentestError`. `service_not_found` (dispatcher-level 404 for a
+ *  route the tenant hasn't been enrolled in yet) is folded into
+ *  `PentestServiceNotLiveError` so callers get an actionable message
+ *  instead of a raw dispatcher code. */
+export function mapPentestError(code, message) {
+    const normalised = normalisePentestCode(code);
+    switch (normalised) {
+        case "E_TARGET_UNREACHABLE":
+            return new TargetUnreachableError(message);
+        case "E_INVALID_TARGET_HOST":
+            return new InvalidTargetHostError(message);
+        case "E_SANDBOX_MISSING":
+            return new SandboxMissingError(message);
+        case "E_OWNERSHIP_UNCONFIRMED":
+            return new OwnershipUnconfirmedError(message);
+        case "E_LLM_QUOTA":
+            return new LlmQuotaError(message);
+        case "E_TIMEOUT":
+            return new PentestTimeoutError(message);
+        case "E_STRIX_CRASHED":
+            return new StrixCrashedError(message);
+        case "E_SERVICE_NOT_LIVE":
+            return new PentestServiceNotLiveError(message);
+        default:
+            return new PentestError(code, message);
+    }
+}
+/** Fold both legacy `lowercase_snake` and canonical `E_UPPERCASE_SNAKE`
+ *  server codes to the same canonical value used on `PentestError.code`.
+ *  Exposed so the pentest-run wrapper can also recognise dispatcher-
+ *  level codes (`service_not_found` → `E_SERVICE_NOT_LIVE`). */
+function normalisePentestCode(code) {
+    if (PENTEST_ERROR_CODES.includes(code)) {
+        return code;
+    }
+    const upperE = code.startsWith("E_")
+        ? code
+        : `E_${code.toUpperCase()}`;
+    if (PENTEST_ERROR_CODES.includes(upperE)) {
+        return upperE;
+    }
+    // Dispatcher-level 404 when the caller's tenant isn't enrolled in the
+    // pentest beta yet. Emit the friendlier typed error so users know
+    // where to request access rather than a raw dispatcher code.
+    if (code === "service_not_found" || code === "not_found") {
+        return "E_SERVICE_NOT_LIVE";
+    }
+    return code;
+}
+/** Attach the hand-written `pentestRun` to the SecurityNamespace
+ *  prototype. Called from the Clawvard constructor so browsers still
+ *  see the method (even if calling it throws SandboxMissingError). */
+export function installPentestRun(_client) {
+    if (Object.prototype.hasOwnProperty.call(SecurityNamespace.prototype, "pentestRun")) {
+        return;
+    }
+    async function pentestRunImpl(input) {
+        validateOwnership(input.ownership);
+        validateAllowedHosts(input.targetUrl, input.allowedHosts);
+        const nodeApis = await loadNodeApis();
+        if (!nodeApis) {
+            throw new SandboxMissingError("cv.security.pentestRun requires Node.js — it spawns the local `strix` CLI. Browser environments are not supported.");
+        }
+        await preflightTarget(input.targetUrl);
+        const outputDir = await resolveOutputDir(input, nodeApis);
+        const credential = await rethrowAsPentest(this.mintPentestCredential(input));
+        return runStrix(input, credential, outputDir, nodeApis);
+    }
+    Object.defineProperty(SecurityNamespace.prototype, "pentestRun", {
+        value: pentestRunImpl,
+        writable: true,
+        configurable: true,
+    });
+}
+async function loadNodeApis() {
+    try {
+        const [cp, fs, path, os] = await Promise.all([
+            import("node:child_process"),
+            import("node:fs/promises"),
+            import("node:path"),
+            import("node:os"),
+        ]);
+        return { spawn: cp.spawn, fs, path, os };
+    }
+    catch {
+        return null;
+    }
+}
+/** Throw `OwnershipUnconfirmedError` before hitting the server if the
+ *  caller has not confirmed they own the target. */
+function validateOwnership(ownership) {
+    if (!ownership || ownership.confirmed !== true) {
+        throw new OwnershipUnconfirmedError();
+    }
+    const statement = ownership.statement?.trim();
+    if (!statement || statement.length < 4) {
+        throw new OwnershipUnconfirmedError("Set a truthful `ownership.statement` describing why you are authorised to test this target.");
+    }
+}
+/** Throw `InvalidTargetHostError` when `targetUrl` isn't covered by
+ *  `allowedHosts`. Matches on host+port literals — this is not a
+ *  wildcard matcher; the whitelist has to name the exact origin the
+ *  caller wrote into `targetUrl`. */
+function validateAllowedHosts(targetUrl, allowedHosts) {
+    if (!Array.isArray(allowedHosts) || allowedHosts.length === 0) {
+        throw new InvalidTargetHostError("Provide at least one entry in `allowedHosts` — the SDK will not run against a target without a scoped whitelist.");
+    }
+    let parsed;
+    try {
+        parsed = new URL(targetUrl);
+    }
+    catch {
+        throw new InvalidTargetHostError("targetUrl is not a parseable URL. Use `http://<host>:<port>` or `https://<host>`.");
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new InvalidTargetHostError("Only http and https schemes are accepted for `targetUrl`.");
+    }
+    const originShape = parsed.port
+        ? `${parsed.hostname}:${parsed.port}`
+        : parsed.hostname;
+    if (!allowedHosts.includes(originShape) && !allowedHosts.includes(parsed.hostname)) {
+        throw new InvalidTargetHostError(`targetUrl origin \`${originShape}\` is not in allowedHosts. Include it verbatim and retry.`);
+    }
+}
+/** `HEAD` the target so we fail fast before spending credits on a
+ *  Strix startup that will just crash. 3s hard budget. */
+async function preflightTarget(targetUrl) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 3000);
+    try {
+        const res = await fetch(targetUrl, { method: "HEAD", signal: ctrl.signal, redirect: "follow" });
+        if (!res.ok && res.status >= 500) {
+            throw new TargetUnreachableError(`Target responded with ${res.status}. Check the app is up and try again.`);
+        }
+    }
+    catch (err) {
+        if (err instanceof TargetUnreachableError)
+            throw err;
+        throw new TargetUnreachableError(`Could not reach ${targetUrl}. Start the target and retry (docker run bkimminich/juice-shop for the demo).`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Resolve the working directory for `strix_runs/<name>/` output.
+ *  Defaults to `./strix_runs/` under the caller's CWD when
+ *  `outputDir` is unset. */
+async function resolveOutputDir(input, nodeApis) {
+    const dir = input.outputDir ?? nodeApis.path.join(process.cwd(), "strix_runs");
+    await nodeApis.fs.mkdir(dir, { recursive: true });
+    return dir;
+}
+/** Spawn the `strix` CLI, pipe stdio into log files under
+ *  `outputDir/<runId>/`, and resolve to the typed run envelope on
+ *  clean exit. Enforces `maxIterations`-derived wall-clock timeout
+ *  (2 min per iteration). */
+async function runStrix(input, cred, outputDir, nodeApis) {
+    const runDir = nodeApis.path.join(outputDir, cred.runId);
+    await nodeApis.fs.mkdir(runDir, { recursive: true });
+    const stdoutPath = nodeApis.path.join(runDir, "strix.stdout.log");
+    const stderrPath = nodeApis.path.join(runDir, "strix.stderr.log");
+    const env = {
+        ...process.env,
+        LLM_API_KEY: cred.scopedApiKey,
+        STRIX_LLM: `${cred.provider}/${cred.model}`,
+        ...(cred.scopedApiBase ? { LLM_API_BASE: cred.scopedApiBase } : {}),
+        STRIX_RUN_NAME: cred.runId,
+        STRIX_OUTPUT_DIR: runDir,
+    };
+    const args = [
+        "--target",
+        input.targetUrl,
+        "--scan-mode",
+        "standard",
+        "--non-interactive",
+    ];
+    const maxIterations = input.maxIterations ?? 40;
+    const timeoutMs = Math.min(maxIterations * 120_000, 4 * 60 * 60 * 1000);
+    return new Promise((resolve, reject) => {
+        let killed = false;
+        const child = nodeApis.spawn("strix", args, {
+            env,
+            cwd: outputDir,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        // Pipe strix stdio into on-disk logs so the user can inspect them
+        // after the fact; we tail stderr into the crash message.
+        let stderrTail = "";
+        child.stdout?.on("data", async (chunk) => {
+            try {
+                await nodeApis.fs.appendFile(stdoutPath, chunk);
+            }
+            catch { /* best effort */ }
+        });
+        child.stderr?.on("data", async (chunk) => {
+            try {
+                await nodeApis.fs.appendFile(stderrPath, chunk);
+            }
+            catch { /* best effort */ }
+            stderrTail = (stderrTail + chunk.toString()).slice(-2048);
+        });
+        const timer = setTimeout(() => {
+            killed = true;
+            child.kill("SIGKILL");
+        }, timeoutMs);
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            if (err.code === "ENOENT") {
+                reject(new SandboxMissingError("The `strix` CLI is not on PATH. Install with `pipx install strix-agent` and retry."));
+                return;
+            }
+            reject(new StrixCrashedError(err.message));
+        });
+        child.on("exit", async (code) => {
+            clearTimeout(timer);
+            if (killed) {
+                reject(new PentestTimeoutError());
+                return;
+            }
+            if (code !== 0) {
+                reject(new StrixCrashedError(`strix exited with code ${code}. Stderr tail:\n${stderrTail || "(empty)"}`));
+                return;
+            }
+            try {
+                const out = await hydrateOutput(cred, input, runDir, nodeApis);
+                resolve(out);
+            }
+            catch (err) {
+                reject(new StrixCrashedError(`strix finished but its output could not be parsed: ${err.message}`));
+            }
+        });
+    });
+}
+/** Read `<runDir>/report.json` (findings/pocs/patch) plus the
+ *  self-contained `report.html` and pack them into the typed run
+ *  envelope. Falls back to reading `findings.json` for older Strix
+ *  versions that write per-artefact files. */
+async function hydrateOutput(cred, input, runDir, nodeApis) {
+    const reportJson = await readJsonSafely(nodeApis.path.join(runDir, "report.json"), nodeApis);
+    const findings = reportJson?.findings ?? [];
+    const pocs = reportJson?.pocs ?? [];
+    const patch = reportJson?.patch ?? {
+        diff: "",
+        branchSuggestion: `pentest/${cred.runId}`,
+    };
+    const reportHtmlPath = nodeApis.path.join(runDir, "report.html");
+    if (!(await pathExists(reportHtmlPath, nodeApis))) {
+        // Compose a minimal HTML report from the JSON when Strix didn't
+        // emit one — deterministic, no-network fallback.
+        await nodeApis.fs.writeFile(reportHtmlPath, renderPentestReportHtml({
+            runId: cred.runId,
+            target: input.targetUrl,
+            findings,
+            pocs,
+            patch,
+            reportHtmlPath: "",
+            costCredits: cred.budgetCredits,
+        }));
+    }
+    return {
+        runId: cred.runId,
+        target: input.targetUrl,
+        findings,
+        pocs,
+        patch,
+        reportHtmlPath,
+        costCredits: cred.budgetCredits,
+    };
+}
+async function readJsonSafely(filePath, nodeApis) {
+    try {
+        const text = await nodeApis.fs.readFile(filePath, "utf-8");
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+async function pathExists(filePath, nodeApis) {
+    try {
+        await nodeApis.fs.stat(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Backend errors land as either `ClawvardError` (dispatcher envelope
+ *  with `.code`) or a plain `Error` from `toApiError` (which folds the
+ *  server's `error: "..."` string into `err.message`). We accept both:
+ *  a code that matches a `PentestErrorCode` (in either case shape) is
+ *  rewrapped in the typed subclass; a dispatcher-level 404
+ *  (`service_not_found`) becomes `PentestServiceNotLiveError` so
+ *  callers get an actionable message instead of a raw route code. */
+async function rethrowAsPentest(p) {
+    try {
+        return await p;
+    }
+    catch (err) {
+        if (err instanceof PentestError)
+            throw err;
+        const remapped = tryRemapPentestError(err);
+        if (remapped)
+            throw remapped;
+        throw err;
+    }
+}
+/** Best-effort mapping of any thrown value to a `PentestError`
+ *  subclass. Returns `null` when the caller should rethrow as-is. */
+function tryRemapPentestError(err) {
+    if (err instanceof ClawvardError) {
+        return mapPentestError(err.code, err.message);
+    }
+    if (err instanceof Error) {
+        const parsed = parsePentestCodeFromMessage(err.message);
+        if (parsed)
+            return mapPentestError(parsed.code, parsed.message);
+        // Dispatcher / http-client fallback: the API-error string is
+        // stashed in `err.message` verbatim. Catch the two flavours we
+        // know Clawvard emits for a route the tenant isn't enrolled in.
+        const raw = err.message.toLowerCase();
+        if (raw.includes("service_not_found") || raw.includes("not_found")) {
+            return new PentestServiceNotLiveError();
+        }
+    }
+    return null;
+}
+/** Pull `{ code, message }` out of a `"<code>|<message>"` job-failure
+ *  message. Mirrors the id-photo convention so a future job-runtime
+ *  handler can surface typed failures via the same channel. Accepts
+ *  both canonical `E_UPPERCASE_SNAKE` and legacy `lowercase_snake`
+ *  prefixes and returns the canonical form. */
+export function parsePentestCodeFromMessage(msg) {
+    const pipeIdx = msg.indexOf("|");
+    if (pipeIdx <= 0)
+        return null;
+    const candidate = msg.slice(0, pipeIdx);
+    const canonical = normalisePentestCode(candidate);
+    if (!PENTEST_ERROR_CODES.includes(canonical))
+        return null;
+    return {
+        code: canonical,
+        message: msg.slice(pipeIdx + 1),
+    };
+}
+/** Deterministic renderer — turns a `SecurityPentestRunOutput` into
+ *  the three-panel HTML report the course showcase renders (findings
+ *  card / PoC replay accordion / patch diff viewer). Exposed on the
+ *  SDK so course pipelines don't have to re-derive the layout in user
+ *  code. Emits a self-contained HTML document: inlined CSS, no
+ *  external dependencies, deterministic node order, safe to
+ *  `iframe`-embed. */
+export function renderPentestReportHtml(out, options) {
+    const title = escapeHtml(options?.title ?? `Pen-Test Report · ${out.target}`);
+    const findings = out.findings.map(renderFindingCard).join("\n");
+    const pocs = out.pocs.map(renderPocCard).join("\n");
+    const patch = renderPatchCard(out.patch);
+    return [
+        `<!DOCTYPE html>`,
+        `<html lang="en">`,
+        `<head>`,
+        `<meta charset="utf-8"/>`,
+        `<meta name="viewport" content="width=device-width, initial-scale=1"/>`,
+        `<title>${title}</title>`,
+        `<style>${PENTEST_REPORT_CSS}</style>`,
+        `</head>`,
+        `<body>`,
+        `<main class="pt-report">`,
+        `<header><h1>${title}</h1><p class="meta">${out.findings.length} findings · ${out.pocs.length} PoCs · ${out.costCredits} credits</p></header>`,
+        `<section class="findings"><h2>Findings</h2>${findings}</section>`,
+        `<section class="pocs"><h2>Proof-of-concept replay</h2>${pocs}</section>`,
+        `<section class="patch"><h2>Remediation patch</h2>${patch}</section>`,
+        `</main>`,
+        `</body>`,
+        `</html>`,
+    ].join("\n");
+}
+function renderFindingCard(f) {
+    const badge = escapeHtml(f.cvss.severity);
+    const score = f.cvss.score.toFixed(1);
+    return [
+        `<article class="finding sev-${badge}">`,
+        `<header>`,
+        `<span class="badge">${badge.toUpperCase()} · CVSS ${escapeHtml(score)}</span>`,
+        `<h3>${escapeHtml(f.title)}</h3>`,
+        `<p class="cat">${escapeHtml(f.owaspCategory)} · <code>${escapeHtml(f.affectedEndpoint)}</code></p>`,
+        `</header>`,
+        `<p class="impact">${escapeHtml(f.impact)}</p>`,
+        `<p class="fix"><strong>Fix:</strong> ${escapeHtml(f.remediation)}</p>`,
+        `</article>`,
+    ].join("");
+}
+function renderPocCard(p) {
+    return [
+        `<details class="poc">`,
+        `<summary><code>${escapeHtml(p.findingId)}</code> · ${escapeHtml(p.kind)}</summary>`,
+        `<pre>${escapeHtml(p.body)}</pre>`,
+        `<p class="indicator"><strong>Look for:</strong> ${escapeHtml(p.expectedIndicator)}</p>`,
+        `</details>`,
+    ].join("");
+}
+function renderPatchCard(patch) {
+    const branch = escapeHtml(patch.branchSuggestion);
+    return [
+        `<p class="branch">Suggested branch: <code>${branch}</code></p>`,
+        `<pre class="diff">${escapeHtml(patch.diff)}</pre>`,
+    ].join("");
+}
+/** Minimal HTML escape — enough for user-supplied strings coming out
+ *  of the pentest run. We escape `&`, `<`, `>`, `"`, `'`. */
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+const PENTEST_REPORT_CSS = `
+:root { --fg: #0f172a; --muted: #64748b; --card: #ffffff; --edge: #e2e8f0; --crit: #b91c1c; --high: #c2410c; --med: #a16207; --low: #0369a1; }
+body { margin: 0; font: 15px/1.55 system-ui, -apple-system, "Segoe UI", sans-serif; color: var(--fg); background: #f8fafc; }
+.pt-report { max-width: 960px; margin: 0 auto; padding: 32px 24px 64px; }
+.pt-report > header h1 { font-size: 22px; margin: 0 0 4px; }
+.pt-report .meta { color: var(--muted); margin: 0 0 24px; }
+.pt-report section { margin-top: 28px; }
+.pt-report section > h2 { font-size: 14px; text-transform: uppercase; letter-spacing: .08em; color: var(--muted); margin: 0 0 12px; }
+.finding { background: var(--card); border: 1px solid var(--edge); border-radius: 12px; padding: 16px 18px; margin-bottom: 12px; }
+.finding header { display: flex; flex-direction: column; gap: 4px; margin-bottom: 8px; }
+.finding .badge { font-size: 11px; padding: 3px 8px; border-radius: 999px; background: #f1f5f9; color: var(--fg); align-self: flex-start; font-weight: 600; }
+.finding.sev-critical .badge { background: #fee2e2; color: var(--crit); }
+.finding.sev-high .badge { background: #ffedd5; color: var(--high); }
+.finding.sev-medium .badge { background: #fef3c7; color: var(--med); }
+.finding.sev-low .badge { background: #e0f2fe; color: var(--low); }
+.finding h3 { margin: 0; font-size: 16px; }
+.finding .cat { margin: 0; color: var(--muted); font-size: 13px; }
+.finding .cat code { background: #f1f5f9; padding: 2px 6px; border-radius: 6px; }
+.finding .impact { margin: 6px 0 8px; }
+.finding .fix { margin: 0; color: var(--muted); }
+.poc { background: var(--card); border: 1px solid var(--edge); border-radius: 10px; padding: 10px 14px; margin-bottom: 10px; }
+.poc summary { cursor: pointer; font-weight: 500; }
+.poc pre { background: #0f172a; color: #e2e8f0; padding: 12px 14px; border-radius: 8px; overflow-x: auto; font: 13px/1.5 ui-monospace, SFMono-Regular, monospace; }
+.poc .indicator { margin: 8px 0 0; color: var(--muted); font-size: 13px; }
+.patch .branch { margin: 0 0 8px; color: var(--muted); }
+.patch .branch code { background: #f1f5f9; padding: 2px 6px; border-radius: 6px; }
+.patch pre.diff { background: #0f172a; color: #e2e8f0; padding: 14px 16px; border-radius: 10px; overflow-x: auto; font: 13px/1.55 ui-monospace, SFMono-Regular, monospace; }
+`;
+//# sourceMappingURL=pentest.js.map

package/dist/pentest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pentest.js","sourceRoot":"","sources":["../src/pentest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAUnD;;;;mEAImE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,sBAAsB;IACtB,uBAAuB;IACvB,mBAAmB;IACnB,yBAAyB;IACzB,aAAa;IACb,WAAW;IACX,iBAAiB;IACjB,oBAAoB;CACZ,CAAC;AAGX,qEAAqE;AACrE,MAAM,OAAO,YAAa,SAAQ,aAAa;IAC7C,YAAY,IAAsB,EAAE,OAAe;QACjD,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED;;wDAEwD;AACxD,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IACtD,YACE,OAAO,GAAG,2HAA2H;QAErI,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;sEAEsE;AACtE,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IACtD,YACE,OAAO,GAAG,+FAA+F;QAEzG,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;oEACoE;AACpE,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACnD,YACE,OAAO,GAAG,yGAAyG;QAEnH,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;0BAE0B;AAC1B,MAAM,OAAO,yBAA0B,SAAQ,YAAY;IACzD,YACE,OAAO,GAAG,uGAAuG;QAEjH,KAAK,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;qEACqE;AACrE,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC7C,YACE,OAAO,GAAG,kGAAkG;QAE5G,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;+CAE+C;AAC/C,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACnD,YACE,OAAO,GAAG,oGAAoG;QAE9G,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;kEAEkE;AAClE,MAAM,OAAO,iBAAkB,SAAQ,YAAY;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;sBAKsB;AACtB,MAAM,OAAO,0BAA2B,SAAQ,YAAY;IAC1D,YACE,OAAO,GAAG,sIAAsI;QAEhJ,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;;;;wCAOwC;AACxC,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,sBAAsB;YACzB,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,uBAAuB;YAC1B,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,mBAAmB;YACtB,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,KAAK,yBAAyB;YAC5B,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAChD,KAAK,aAAa;YAChB,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,KAAK,WAAW;YACd,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,KAAK,iBAAiB;YACpB,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxC,KAAK,oBAAoB;YACvB,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACjD;YACE,OAAO,IAAI,YAAY,CAAC,IAAwB,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;gEAGgE;AAChE,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAK,mBAAyC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAwB,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9B,IAAK,mBAAyC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,OAAO,MAA0B,CAAC;IACpC,CAAC;IACD,sEAAsE;IACtE,kEAAkE;IAClE,6DAA6D;IAC7D,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAsBD;;sEAEsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,OAAmB;IACnD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;QACpF,OAAO;IACT,CAAC;IACD,KAAK,UAAU,cAAc,CAE3B,KAA8B;QAE9B,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,mBAAmB,CAC3B,oHAAoH,CACrH,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,EAAE;QAC/D,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAWD,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,MAAM,CAAC,oBAAoB,CAAC;YAC5B,MAAM,CAAC,kBAAkB,CAAC;YAC1B,MAAM,CAAC,WAAW,CAAC;YACnB,MAAM,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;oDACoD;AACpD,SAAS,iBAAiB,CAAC,SAA+C;IACxE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,yBAAyB,CACjC,6FAA6F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;qCAGqC;AACrC,SAAS,oBAAoB,CAAC,SAAiB,EAAE,YAAsB;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,sBAAsB,CAC9B,kHAAkH,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAC9B,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,sBAAsB,CAC9B,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI;QAC7B,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QACrC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACpB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,sBAAsB,CAC9B,sBAAsB,WAAW,2DAA2D,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;0DAC0D;AAC1D,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,sBAAsB,CAC9B,yBAAyB,GAAG,CAAC,MAAM,sCAAsC,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB;YAAE,MAAM,GAAG,CAAC;QACrD,MAAM,IAAI,sBAAsB,CAC9B,mBAAmB,SAAS,+EAA+E,CAC5G,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;4BAE4B;AAC5B,KAAK,UAAU,gBAAgB,CAC7B,KAA8B,EAC9B,QAAkB;IAElB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;IAC/E,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;6BAG6B;AAC7B,KAAK,UAAU,QAAQ,CACrB,KAA8B,EAC9B,IAAyC,EACzC,SAAiB,EACjB,QAAkB;IAElB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAElE,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,cAAc,EAAE,IAAI,CAAC,KAAK;QAC1B,gBAAgB,EAAE,MAAM;KACzB,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,UAAU;QACV,KAAK,CAAC,SAAS;QACf,aAAa;QACb,UAAU;QACV,mBAAmB;KACpB,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAExE,OAAO,IAAI,OAAO,CAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/D,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YAC1C,GAAG;YACH,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QAEH,kEAAkE;QAClE,yDAAyD;QACzD,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;YAC/C,IAAI,CAAC;gBAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;YAC/C,IAAI,CAAC;gBAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACpF,UAAU,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,mBAAmB,CAC5B,oFAAoF,CACrF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC9B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,iBAAiB,CAC1B,0BAA0B,IAAI,mBAAmB,UAAU,IAAI,SAAS,EAAE,CAC3E,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,iBAAiB,CAC1B,sDAAuD,GAAa,CAAC,OAAO,EAAE,CAC/E,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;8CAG8C;AAC9C,KAAK,UAAU,aAAa,CAC1B,IAAyC,EACzC,KAA8B,EAC9B,MAAc,EACd,QAAkB;IAElB,MAAM,UAAU,GAAG,MAAM,cAAc,CAIpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,KAAK,GAAyB,UAAU,EAAE,KAAK,IAAI;QACvD,IAAI,EAAE,EAAE;QACR,gBAAgB,EAAE,WAAW,IAAI,CAAC,KAAK,EAAE;KAC1C,CAAC;IAEF,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAClD,gEAAgE;QAChE,iDAAiD;QACjD,MAAM,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;YAClE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,IAAI,CAAC,aAAa;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,KAAK,CAAC,SAAS;QACvB,QAAQ;QACR,IAAI;QACJ,KAAK;QACL,cAAc;QACd,WAAW,EAAE,IAAI,CAAC,aAAa;KAChC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,QAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;qEAMqE;AACrE,KAAK,UAAU,gBAAgB,CAAI,CAAa;IAC9C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY;YAAE,MAAM,GAAG,CAAC;QAC3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ;YAAE,MAAM,QAAQ,CAAC;QAC7B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;qEACqE;AACrE,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAChE,6DAA6D;QAC7D,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,0BAA0B,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;+CAI+C;AAC/C,MAAM,UAAU,2BAA2B,CACzC,GAAW;IAEX,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO;QACL,IAAI,EAAE,SAA6B;QACnC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;sBAMsB;AACtB,MAAM,UAAU,uBAAuB,CACrC,GAA6B,EAC7B,OAA4B;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,IAAI,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,yBAAyB;QACzB,uEAAuE;QACvE,UAAU,KAAK,UAAU;QACzB,UAAU,kBAAkB,UAAU;QACtC,SAAS;QACT,QAAQ;QACR,0BAA0B;QAC1B,eAAe,KAAK,wBAAwB,GAAG,CAAC,QAAQ,CAAC,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,MAAM,WAAW,GAAG,CAAC,WAAW,uBAAuB;QAC9I,8CAA8C,QAAQ,YAAY;QAClE,yDAAyD,IAAI,YAAY;QACzE,oDAAoD,KAAK,YAAY;QACrE,SAAS;QACT,SAAS;QACT,SAAS;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAyB;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO;QACL,+BAA+B,KAAK,IAAI;QACxC,UAAU;QACV,uBAAuB,KAAK,CAAC,WAAW,EAAE,WAAW,UAAU,CAAC,KAAK,CAAC,SAAS;QAC/E,OAAO,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;QACjC,kBAAkB,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,aAAa;QACpG,WAAW;QACX,qBAAqB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QAC/C,wCAAwC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM;QACvE,YAAY;KACb,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,CAAqB;IAC1C,OAAO;QACL,uBAAuB;QACvB,kBAAkB,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY;QACpF,QAAQ,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;QAClC,mDAAmD,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM;QACxF,YAAY;KACb,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAA2B;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO;QACL,6CAA6C,MAAM,aAAa;QAChE,qBAAqB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;KACpD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;6DAC6D;AAC7D,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B1B,CAAC"}