@conterra/vuln-scan 0.0.14 → 0.0.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/add-project.js +2 -2
  2. package/dist/add-statement.js +10 -10
  3. package/dist/remove-project.js +2 -2
  4. package/dist/schema/conf-schema.json +4 -0
  5. package/dist/vuln-scan.js +9 -9
  6. package/package.json +1 -1
package/dist/add-project.js CHANGED
@@ -1,3 +1,3 @@
1
1
  #!/usr/bin/env node
2
- "use strict";var j=Object.create;var P=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var D=Object.getOwnPropertyNames;var T=Object.getPrototypeOf,V=Object.prototype.hasOwnProperty;var N=(t,e,r,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of D(e))!V.call(t,i)&&i!==r&&P(t,i,{get:()=>e[i],enumerable:!(o=E(e,i))||o.enumerable});return t};var O=(t,e,r)=>(r=t!=null?j(T(t)):{},N(e||!t||!t.__esModule?P(r,"default",{value:t,enumerable:!0}):r,t));var p=O(require("path"));var f=require("fs/promises");async function u(t){if(await C(t))return JSON.parse(await(0,f.readFile)(t,{encoding:"utf-8"}))}async function l(t,e){await(0,f.writeFile)(t,JSON.stringify(e,null,4)+`
3
- `,{encoding:"utf-8"})}async function C(t){try{return await(0,f.access)(t,f.constants.F_OK),!0}catch{return!1}}async function y(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=d(t.workingDir,"input/vex"),o=d(t.workingDir,"output"),i=d(t.workingDir,"cache"),a=["grype","trivy","ossindex"],c=d(t.workingDir,"vuln-scan-conf.json"),n=await u(c);if(!n)throw new Error(`Missing project configuration file '${c}'`);return{projectConfigFileLocation:c,failOnNewVulnerabilities:!1,createSubDirsForProject:n.createSubDirsForProject??!0,mavenRepo:n.mavenRepo??e,vexUrls:n.vexUrls??[],vexDir:d(t.workingDir,n.vexDir)??r,outDir:d(t.workingDir,n.outDir)??o,cacheDir:d(t.workingDir,n.cacheDir)??i,scanners:n.scanners??a,projects:(n.projects??[]).map(m=>{let s=m;if(!s.name)throw new Error("Project name is missing on entry:"+JSON.stringify(s));if(!s.version)throw new Error("Project version is missing on entry:"+JSON.stringify(s));if(!s.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(s));return s.enabled==null&&(s.enabled=!0),s.silent==null&&(s.silent=!1),s.minimumSeverity||(s.minimumSeverity="UNKNOWN"),s.sbomFile?{...s,sbomFile:d(t.workingDir,s.sbomFile)}:m})}}function d(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await u(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await l(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await h((0,g.resolve)(r.parentPath,r.name),e)}async function S({workingDir:t,projectName:e,referenceProjectVersion:r,targetProjectVersion:o}){let i=await y({workingDir:t});if(!i.projectConfigFileLocation)throw new Error("Missing project configuration file.");let a=i.projects.find(n=>n.name===e&&n.version===r);if(!a)throw new Error(`Project ${e} with version ${r} not found.`);let c=i.projects.find(n=>n.name===e&&n.version===o);c||(c=await k(e,i.projectConfigFileLocation,a,o)),await A(i.vexDir,a.purl,c.purl)}async function k(t,e,r,o){let i=await u(e),a=i.projects.find(m=>m.name===r.name&&m.version===r.version),c=i.projects.indexOf(a),n={...a};return n.version=o,n.purl=a.purl.replace(a.version,o),n.sbomMavenCoordinates&&(n.sbomMavenCoordinates=a.sbomMavenCoordinates.replace(a.version,o)),i.projects.splice(c+1,0,n),console.info(`Add project ${t} with version ${o} to ${e}`),await l(e,i),n}async function A(t,e,r){await h(t,async o=>{await $(o,e,r)})}async function $(t,e,r){let o=await t.read(),i=!1,a=o.statements;for(let c of a){if(!c.products||c.products.some(m=>m["@id"]===r))continue;let n=c.products.findIndex(m=>m["@id"]===e);n!==-1&&(c.products?.splice(n+1,0,{"@id":r}),i=!0)}i&&(console.info(`Add ${r} to ${t.location}`),t.write(o))}var x=process.argv[2];if(!x)throw new Error("Missing project name.");var b=process.argv[3];if(!b)throw new Error("Missing reference project version.");var F=process.argv[4];if(!F)throw new Error("Missing target project version.");(async()=>await S({workingDir:process.cwd(),projectName:x,referenceProjectVersion:b,targetProjectVersion:F}))();
2
+ "use strict";var j=Object.create;var P=Object.defineProperty;var D=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var N=(t,e,i,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of E(e))!T.call(t,n)&&n!==i&&P(t,n,{get:()=>e[n],enumerable:!(o=D(e,n))||o.enumerable});return t};var O=(t,e,i)=>(i=t!=null?j(V(t)):{},N(e||!t||!t.__esModule?P(i,"default",{value:t,enumerable:!0}):i,t));var p=O(require("path"));var f=require("fs/promises");async function l(t){if(await C(t))return JSON.parse(await(0,f.readFile)(t,{encoding:"utf-8"}))}async function u(t,e){await(0,f.writeFile)(t,JSON.stringify(e,null,4)+`
3
+ `,{encoding:"utf-8"})}async function C(t){try{return await(0,f.access)(t,f.constants.F_OK),!0}catch{return!1}}async function S(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",i=d(t.workingDir,"input/vex"),o=d(t.workingDir,"output"),n=d(t.workingDir,"cache"),a=["grype","trivy","ossindex"],c=d(t.workingDir,"vuln-scan-conf.json"),r=await l(c);if(!r)throw new Error(`Missing project configuration file '${c}'`);return{projectConfigFileLocation:c,failOnNewVulnerabilities:r.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:r.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:r.createSubDirsForProject??!0,mavenRepo:r.mavenRepo??e,vexUrls:r.vexUrls??[],vexDir:d(t.workingDir,r.vexDir)??i,outDir:d(t.workingDir,r.outDir)??o,cacheDir:d(t.workingDir,r.cacheDir)??n,scanners:r.scanners??a,projects:(r.projects??[]).map(m=>{let s=m;if(!s.name)throw new Error("Project name is missing on entry:"+JSON.stringify(s));if(!s.version)throw new Error("Project version is missing on entry:"+JSON.stringify(s));if(!s.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(s));return s.enabled==null&&(s.enabled=!0),s.silent==null&&(s.silent=!1),s.minimumSeverity||(s.minimumSeverity="UNKNOWN"),s.sbomFile?{...s,sbomFile:d(t.workingDir,s.sbomFile)}:m})}}function d(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await l(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await u(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let i of await(0,w.readdir)(t,{withFileTypes:!0}))i.name.endsWith(".json")?await e(new v((0,g.resolve)(i.parentPath,i.name))):i.isDirectory()&&await h((0,g.resolve)(i.parentPath,i.name),e)}async function y({workingDir:t,projectName:e,referenceProjectVersion:i,targetProjectVersion:o}){let n=await S({workingDir:t});if(!n.projectConfigFileLocation)throw new Error("Missing project configuration file.");let a=n.projects.find(r=>r.name===e&&r.version===i);if(!a)throw new Error(`Project ${e} with version ${i} not found.`);let c=n.projects.find(r=>r.name===e&&r.version===o);c||(c=await k(e,n.projectConfigFileLocation,a,o)),await A(n.vexDir,a.purl,c.purl)}async function k(t,e,i,o){let n=await l(e),a=n.projects.find(m=>m.name===i.name&&m.version===i.version),c=n.projects.indexOf(a),r={...a};return r.version=o,r.purl=a.purl.replace(a.version,o),r.sbomMavenCoordinates&&(r.sbomMavenCoordinates=a.sbomMavenCoordinates.replace(a.version,o)),n.projects.splice(c+1,0,r),console.info(`Add project ${t} with version ${o} to ${e}`),await u(e,n),r}async function A(t,e,i){await h(t,async o=>{await $(o,e,i)})}async function $(t,e,i){let o=await t.read(),n=!1,a=o.statements;for(let c of a){if(!c.products||c.products.some(m=>m["@id"]===i))continue;let r=c.products.findIndex(m=>m["@id"]===e);r!==-1&&(c.products?.splice(r+1,0,{"@id":i}),n=!0)}n&&(console.info(`Add ${i} to ${t.location}`),t.write(o))}var b=process.argv[2];if(!b)throw new Error("Missing project name.");var x=process.argv[3];if(!x)throw new Error("Missing reference project version.");var F=process.argv[4];if(!F)throw new Error("Missing target project version.");(async()=>await y({workingDir:process.cwd(),projectName:b,referenceProjectVersion:x,targetProjectVersion:F}))();
package/dist/add-statement.js CHANGED
@@ -1,21 +1,21 @@
1
1
  #!/usr/bin/env node
2
- "use strict";var E=Object.create;var x=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var A=Object.getPrototypeOf,C=Object.prototype.hasOwnProperty;var I=(t,e,r,m)=>{if(e&&typeof e=="object"||typeof e=="function")for(let a of $(e))!C.call(t,a)&&a!==r&&x(t,a,{get:()=>e[a],enumerable:!(m=k(e,a))||m.enumerable});return t};var D=(t,e,r)=>(r=t!=null?E(A(t)):{},I(e||!t||!t.__esModule?x(r,"default",{value:t,enumerable:!0}):r,t));var F=D(require("node:readline/promises")),j=require("node:process");var _=D(require("path"));var c=require("fs/promises");async function v(t){if(await O(t))return JSON.parse(await(0,c.readFile)(t,{encoding:"utf-8"}))}async function O(t){try{return await(0,c.access)(t,c.constants.F_OK),!0}catch{return!1}}async function b(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=f(t.workingDir,"input/vex"),m=f(t.workingDir,"output"),a=f(t.workingDir,"cache"),y=["grype","trivy","ossindex"],p=f(t.workingDir,"vuln-scan-conf.json"),o=await v(p);if(!o)throw new Error(`Missing project configuration file '${p}'`);return{projectConfigFileLocation:p,failOnNewVulnerabilities:!1,createSubDirsForProject:o.createSubDirsForProject??!0,mavenRepo:o.mavenRepo??e,vexUrls:o.vexUrls??[],vexDir:f(t.workingDir,o.vexDir)??r,outDir:f(t.workingDir,o.outDir)??m,cacheDir:f(t.workingDir,o.cacheDir)??a,scanners:o.scanners??y,projects:(o.projects??[]).map(l=>{let i=l;if(!i.name)throw new Error("Project name is missing on entry:"+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry:"+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(i));return i.enabled==null&&(i.enabled=!0),i.silent==null&&(i.silent=!1),i.minimumSeverity||(i.minimumSeverity="UNKNOWN"),i.sbomFile?{...i,sbomFile:f(t.workingDir,i.sbomFile)}:l})}}function f(t,e){if(e)return _.default.isAbsolute(e)?e:(0,_.resolve)(t,e)}var h=require("path");var P=require("fs/promises"),N=require("crypto");(async()=>{let t=await b({workingDir:process.cwd()});console.info("## Add New VEX Statement ##");let e=F.default.createInterface({input:j.stdin,output:j.stdout}),r=await e.question(`CVE name (e.g. CVE-2023-52070):
3
- > `);r||(console.log("Please provide a CVE name."),process.exit(1));let m=t.projects.map(n=>`${n.name}@${n.version}`),a=await e.question(`Projects to add? Available are:
2
+ "use strict";var E=Object.create;var b=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var A=Object.getPrototypeOf,O=Object.prototype.hasOwnProperty;var C=(e,t,r,m)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of $(t))!O.call(e,a)&&a!==r&&b(e,a,{get:()=>t[a],enumerable:!(m=k(t,a))||m.enumerable});return e};var x=(e,t,r)=>(r=e!=null?E(A(e)):{},C(t||!e||!e.__esModule?b(r,"default",{value:e,enumerable:!0}):r,e));var F=x(require("node:readline/promises")),j=require("node:process");var _=x(require("path"));var c=require("fs/promises");async function v(e){if(await I(e))return JSON.parse(await(0,c.readFile)(e,{encoding:"utf-8"}))}async function I(e){try{return await(0,c.access)(e,c.constants.F_OK),!0}catch{return!1}}async function D(e){let t="https://repository.conterra.de/repository/maven-mirror-ct",r=f(e.workingDir,"input/vex"),m=f(e.workingDir,"output"),a=f(e.workingDir,"cache"),y=["grype","trivy","ossindex"],p=f(e.workingDir,"vuln-scan-conf.json"),o=await v(p);if(!o)throw new Error(`Missing project configuration file '${p}'`);return{projectConfigFileLocation:p,failOnNewVulnerabilities:o.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:o.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:o.createSubDirsForProject??!0,mavenRepo:o.mavenRepo??t,vexUrls:o.vexUrls??[],vexDir:f(e.workingDir,o.vexDir)??r,outDir:f(e.workingDir,o.outDir)??m,cacheDir:f(e.workingDir,o.cacheDir)??a,scanners:o.scanners??y,projects:(o.projects??[]).map(l=>{let i=l;if(!i.name)throw new Error("Project name is missing on entry:"+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry:"+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(i));return i.enabled==null&&(i.enabled=!0),i.silent==null&&(i.silent=!1),i.minimumSeverity||(i.minimumSeverity="UNKNOWN"),i.sbomFile?{...i,sbomFile:f(e.workingDir,i.sbomFile)}:l})}}function f(e,t){if(t)return _.default.isAbsolute(t)?t:(0,_.resolve)(e,t)}var h=require("path");var P=require("fs/promises"),N=require("crypto");(async()=>{let e=await D({workingDir:process.cwd()});console.info("## Add New VEX Statement ##");let t=F.default.createInterface({input:j.stdin,output:j.stdout}),r=await t.question(`CVE name (e.g. CVE-2023-52070):
3
+ > `);r||(console.log("Please provide a CVE name."),process.exit(1));let m=e.projects.map(n=>`${n.name}@${n.version}`),a=await t.question(`Projects to add? Available are:
4
4
  - ${m.join(`
5
5
  - `)}
6
6
  You can list multiple projects separated by comma:
7
- > `);a||(console.log("Please provide projects to add."),process.exit(1));let y=a.split(/\s*,\s*/).map(n=>{let s=n.split("@");return{name:s[0],version:s[1]}}),p=new Set(function*(){for(let n of y)for(let s of t.projects)s.name===n.name&&s.version===n.version&&(yield s.purl)}()),o=(0,h.resolve)(t.vexDir,`${r}.json`),l=await v(o),i=["under_investigation","affected","fixed","not_affected"],d=await e.question(`Status? Available are:
7
+ > `);a||(console.log("Please provide projects to add."),process.exit(1));let y=a.split(/\s*,\s*/).map(n=>{let s=n.split("@");return{name:s[0],version:s[1]}}),p=new Set(function*(){for(let n of y)for(let s of e.projects)s.name===n.name&&s.version===n.version&&(yield s.purl)}()),o=(0,h.resolve)(e.vexDir,`${r}.json`),l=await v(o),i=["under_investigation","affected","fixed","not_affected"],d=await t.question(`Status? Available are:
8
8
  - ${i.join(`,
9
9
  - `)}
10
- > `);i.includes(d)||(d?(console.log("Invalid status."),process.exit(1)):d="under_investigation");let u={};switch(d){case"affected":{let n=await e.question(`Action statement? (required):
11
- > `);n||(console.log("Please provide an action statement."),process.exit(1)),u.action_statement=n;break}case"not_affected":{let n=["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist"],s=await e.question(`Justification? Available are:
10
+ > `);i.includes(d)||(d?(console.log("Invalid status."),process.exit(1)):d="under_investigation");let u={};switch(d){case"affected":{let n=await t.question(`Action statement? (required):
11
+ > `);n||(console.log("Please provide an action statement."),process.exit(1)),u.action_statement=n;break}case"not_affected":{let n=["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist"],s=await t.question(`Justification? Available are:
12
12
  - ${n.join(`,
13
13
  - `)}
14
- > (optional) `);if(s)if(!n.includes(s))console.log("Invalid justification."),process.exit(1);else{u.justification=s;let g=await e.question(`Impact statement? (optional):
15
- > `);g&&(u.impact_statement=g)}else{let g=await e.question(`Impact statement? (required):
16
- > `);g||(console.log("Please provide an impact statement."),process.exit(1)),u.impact_statement=g}break}case"fixed":{let n=await e.question(`Status note? (optional):
17
- > `);n&&(u.status_notes=n);break}}let w=new Date().toISOString(),S={vulnerability:{name:r},timestamp:w,products:Array.from(p).map(n=>({"@id":n})),status:d,...u};(await e.question(`Following statement will be added to ${o}:
14
+ > (optional) `);if(s)if(!n.includes(s))console.log("Invalid justification."),process.exit(1);else{u.justification=s;let g=await t.question(`Impact statement? (optional):
15
+ > `);g&&(u.impact_statement=g)}else{let g=await t.question(`Impact statement? (required):
16
+ > `);g||(console.log("Please provide an impact statement."),process.exit(1)),u.impact_statement=g}break}case"fixed":{let n=await t.question(`Status note? (optional):
17
+ > `);n&&(u.status_notes=n);break}}let w=new Date().toISOString(),S={vulnerability:{name:r},timestamp:w,products:Array.from(p).map(n=>({"@id":n})),status:d,...u};(await t.question(`Following statement will be added to ${o}:
18
18
  ${JSON.stringify(S,null,2)}
19
19
 
20
20
  Do you want to proceed? (y/n)?
21
- > `)).toLowerCase()!=="y"&&(console.log("Aborted."),process.exit(0)),l?(l.last_updated=w,l.version+=1,l.statements.push(S)):l={"@context":"https://openvex.dev/ns/v0.2.0","@id":`https://openvex.dev/docs/public/vex-${(0,N.randomUUID)()}`,author:"conterra",timestamp:w,last_updated:w,version:1,statements:[S]},await(0,P.writeFile)(o,JSON.stringify(l,null,2)),e.close()})();
21
+ > `)).toLowerCase()!=="y"&&(console.log("Aborted."),process.exit(0)),l?(l.last_updated=w,l.version+=1,l.statements.push(S)):l={"@context":"https://openvex.dev/ns/v0.2.0","@id":`https://openvex.dev/docs/public/vex-${(0,N.randomUUID)()}`,author:"conterra",timestamp:w,last_updated:w,version:1,statements:[S]},await(0,P.writeFile)(o,JSON.stringify(l,null,2)),t.close()})();
package/dist/remove-project.js CHANGED
@@ -1,3 +1,3 @@
1
1
  #!/usr/bin/env node
2
- "use strict";var j=Object.create;var P=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var T=Object.getOwnPropertyNames;var N=Object.getPrototypeOf,V=Object.prototype.hasOwnProperty;var O=(t,e,r,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of T(e))!V.call(t,i)&&i!==r&&P(t,i,{get:()=>e[i],enumerable:!(o=E(e,i))||o.enumerable});return t};var $=(t,e,r)=>(r=t!=null?j(N(t)):{},O(e||!t||!t.__esModule?P(r,"default",{value:t,enumerable:!0}):r,t));var p=$(require("path"));var f=require("fs/promises");async function l(t){if(await C(t))return JSON.parse(await(0,f.readFile)(t,{encoding:"utf-8"}))}async function d(t,e){await(0,f.writeFile)(t,JSON.stringify(e,null,4)+`
3
- `,{encoding:"utf-8"})}async function C(t){try{return await(0,f.access)(t,f.constants.F_OK),!0}catch{return!1}}async function S(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=u(t.workingDir,"input/vex"),o=u(t.workingDir,"output"),i=u(t.workingDir,"cache"),m=["grype","trivy","ossindex"],a=u(t.workingDir,"vuln-scan-conf.json"),s=await l(a);if(!s)throw new Error(`Missing project configuration file '${a}'`);return{projectConfigFileLocation:a,failOnNewVulnerabilities:!1,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??e,vexUrls:s.vexUrls??[],vexDir:u(t.workingDir,s.vexDir)??r,outDir:u(t.workingDir,s.outDir)??o,cacheDir:u(t.workingDir,s.cacheDir)??i,scanners:s.scanners??m,projects:(s.projects??[]).map(c=>{let n=c;if(!n.name)throw new Error("Project name is missing on entry:"+JSON.stringify(n));if(!n.version)throw new Error("Project version is missing on entry:"+JSON.stringify(n));if(!n.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(n));return n.enabled==null&&(n.enabled=!0),n.silent==null&&(n.silent=!1),n.minimumSeverity||(n.minimumSeverity="UNKNOWN"),n.sbomFile?{...n,sbomFile:u(t.workingDir,n.sbomFile)}:c})}}function u(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await l(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await d(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await h((0,g.resolve)(r.parentPath,r.name),e)}function y(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}async function F({workingDir:t,projectName:e,projectVersion:r,vulnId:o}){let i=await S({workingDir:t});if(!i.projectConfigFileLocation)throw new Error("Missing project configuration file.");let m=i.projects.find(a=>a.name===e&&a.version===r);if(!m){console.info(`Project ${e} with version ${r} not found.`);return}o||await k(i.projectConfigFileLocation,m),await U(i.vexDir,m.purl,o)}async function k(t,e){let r=await l(t),o=r.projects.findIndex(i=>i.name===e.name&&i.version===e.version);r.projects.splice(o,1),console.info(`Remove project ${e.name} with version ${e.version} from ${t}`),await d(t,r)}async function U(t,e,r){await h(t,async o=>{let i=await o.read(),m=!1,a=i.statements,s=[];for(let c of a){if(r&&!y(c).has(r)||!c.products)continue;let n=c.products.findIndex(D=>D["@id"]===e);n!==-1&&(c.products.splice(n,1),m=!0,c.products.length===0&&s.push(c))}if(m){for(let c of s){let n=a.indexOf(c);a.splice(n,1)}if(a.length===0){console.info(`Remove ${e} from ${o.location} and delete file.`),await o.delete();return}console.info(`Remove ${e} from ${o.location}`),await o.write(i)}})}var x=process.argv[2];if(!x)throw new Error("Missing project name.");var b=process.argv[3];if(!b)throw new Error("Missing project version.");var I=process.argv[4];(async()=>await F({workingDir:process.cwd(),projectName:x,projectVersion:b,vulnId:I}))();
2
+ "use strict";var j=Object.create;var S=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var N=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var O=(t,e,r,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of N(e))!T.call(t,n)&&n!==r&&S(t,n,{get:()=>e[n],enumerable:!(o=E(e,n))||o.enumerable});return t};var $=(t,e,r)=>(r=t!=null?j(V(t)):{},O(e||!t||!t.__esModule?S(r,"default",{value:t,enumerable:!0}):r,t));var p=$(require("path"));var m=require("fs/promises");async function u(t){if(await C(t))return JSON.parse(await(0,m.readFile)(t,{encoding:"utf-8"}))}async function d(t,e){await(0,m.writeFile)(t,JSON.stringify(e,null,4)+`
3
+ `,{encoding:"utf-8"})}async function C(t){try{return await(0,m.access)(t,m.constants.F_OK),!0}catch{return!1}}async function y(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=l(t.workingDir,"input/vex"),o=l(t.workingDir,"output"),n=l(t.workingDir,"cache"),f=["grype","trivy","ossindex"],a=l(t.workingDir,"vuln-scan-conf.json"),s=await u(a);if(!s)throw new Error(`Missing project configuration file '${a}'`);return{projectConfigFileLocation:a,failOnNewVulnerabilities:s.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:s.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??e,vexUrls:s.vexUrls??[],vexDir:l(t.workingDir,s.vexDir)??r,outDir:l(t.workingDir,s.outDir)??o,cacheDir:l(t.workingDir,s.cacheDir)??n,scanners:s.scanners??f,projects:(s.projects??[]).map(c=>{let i=c;if(!i.name)throw new Error("Project name is missing on entry:"+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry:"+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(i));return i.enabled==null&&(i.enabled=!0),i.silent==null&&(i.silent=!1),i.minimumSeverity||(i.minimumSeverity="UNKNOWN"),i.sbomFile?{...i,sbomFile:l(t.workingDir,i.sbomFile)}:c})}}function l(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await u(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await d(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await h((0,g.resolve)(r.parentPath,r.name),e)}function P(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}async function F({workingDir:t,projectName:e,projectVersion:r,vulnId:o}){let n=await y({workingDir:t});if(!n.projectConfigFileLocation)throw new Error("Missing project configuration file.");let f=n.projects.find(a=>a.name===e&&a.version===r);if(!f){console.info(`Project ${e} with version ${r} not found.`);return}o||await k(n.projectConfigFileLocation,f),await U(n.vexDir,f.purl,o)}async function k(t,e){let r=await u(t),o=r.projects.findIndex(n=>n.name===e.name&&n.version===e.version);r.projects.splice(o,1),console.info(`Remove project ${e.name} with version ${e.version} from ${t}`),await d(t,r)}async function U(t,e,r){await h(t,async o=>{let n=await o.read(),f=!1,a=n.statements,s=[];for(let c of a){if(r&&!P(c).has(r)||!c.products)continue;let i=c.products.findIndex(D=>D["@id"]===e);i!==-1&&(c.products.splice(i,1),f=!0,c.products.length===0&&s.push(c))}if(f){for(let c of s){let i=a.indexOf(c);a.splice(i,1)}if(a.length===0){console.info(`Remove ${e} from ${o.location} and delete file.`),await o.delete();return}console.info(`Remove ${e} from ${o.location}`),await o.write(n)}})}var x=process.argv[2];if(!x)throw new Error("Missing project name.");var b=process.argv[3];if(!b)throw new Error("Missing project version.");var A=process.argv[4];(async()=>await F({workingDir:process.cwd(),projectName:x,projectVersion:b,vulnId:A}))();
package/dist/schema/conf-schema.json CHANGED
@@ -6,6 +6,10 @@
6
6
  "type": "boolean",
7
7
  "default": false
8
8
  },
9
+ "reportNoLongerDetectedVulnerabilities": {
10
+ "type": "boolean",
11
+ "default": true
12
+ },
9
13
  "mavenRepo": {
10
14
  "type": "string",
11
15
  "format": "uri",
package/dist/vuln-scan.js CHANGED
@@ -1,12 +1,12 @@
1
1
  #!/usr/bin/env node
2
- "use strict";var Hi=Object.create;var Et=Object.defineProperty;var Qi=Object.getOwnPropertyDescriptor;var Ki=Object.getOwnPropertyNames;var Yi=Object.getPrototypeOf,zi=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Zi=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Ki(e))!zi.call(t,n)&&n!==r&&Et(t,n,{get:()=>e[n],enumerable:!(i=Qi(e,n))||i.enumerable});return t};var Ye=(t,e,r)=>(r=t!=null?Hi(Yi(t)):{},Zi(e||!t||!t.__esModule?Et(r,"default",{value:t,enumerable:!0}):r,t));var F=S(tt=>{"use strict";tt.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};tt.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var Tt=S((ea,jt)=>{var Y=require("constants"),tn=process.cwd,Ee=null,rn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Ee||(Ee=tn.call(process)),Ee};try{process.cwd()}catch{}typeof process.chdir=="function"&&(rt=process.chdir,process.chdir=function(t){Ee=null,rt.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,rt));var rt;jt.exports=nn;function nn(t){Y.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=i(t.chmod),t.fchmod=i(t.fchmod),t.lchmod=i(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=n(t.chmodSync),t.fchmodSync=n(t.fchmodSync),t.lchmodSync=n(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=u(t.statSync),t.fstatSync=u(t.fstatSync),t.lstatSync=u(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,m,d){d&&process.nextTick(d)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,m,d,f){f&&process.nextTick(f)},t.lchownSync=function(){}),rn==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:function(a){function m(d,f,p){var h=Date.now(),v=0;a(d,f,function b(N){if(N&&(N.code==="EACCES"||N.code==="EPERM"||N.code==="EBUSY")&&Date.now()-h<6e4){setTimeout(function(){t.stat(f,function(O,ie){O&&O.code==="ENOENT"?a(d,f,b):p(N)})},v),v<100&&(v+=10);return}p&&p(N)})}return Object.setPrototypeOf&&Object.setPrototypeOf(m,a),m}(t.rename)),t.read=typeof t.read!="function"?t.read:function(a){function m(d,f,p,h,v,b){var N;if(b&&typeof b=="function"){var O=0;N=function(ie,Le,kt){if(ie&&ie.code==="EAGAIN"&&O<10)return O++,a.call(t,d,f,p,h,v,N);b.apply(this,arguments)}}return a.call(t,d,f,p,h,v,N)}return Object.setPrototypeOf&&Object.setPrototypeOf(m,a),m}(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:function(a){return function(m,d,f,p,h){for(var v=0;;)try{return a.call(t,m,d,f,p,h)}catch(b){if(b.code==="EAGAIN"&&v<10){v++;continue}throw b}}}(t.readSync);function e(a){a.lchmod=function(m,d,f){a.open(m,Y.O_WRONLY|Y.O_SYMLINK,d,function(p,h){if(p){f&&f(p);return}a.fchmod(h,d,function(v){a.close(h,function(b){f&&f(v||b)})})})},a.lchmodSync=function(m,d){var f=a.openSync(m,Y.O_WRONLY|Y.O_SYMLINK,d),p=!0,h;try{h=a.fchmodSync(f,d),p=!1}finally{if(p)try{a.closeSync(f)}catch{}else a.closeSync(f)}return h}}function r(a){Y.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(m,d,f,p){a.open(m,Y.O_SYMLINK,function(h,v){if(h){p&&p(h);return}a.futimes(v,d,f,function(b){a.close(v,function(N){p&&p(b||N)})})})},a.lutimesSync=function(m,d,f){var p=a.openSync(m,Y.O_SYMLINK),h,v=!0;try{h=a.futimesSync(p,d,f),v=!1}finally{if(v)try{a.closeSync(p)}catch{}else a.closeSync(p)}return h}):a.futimes&&(a.lutimes=function(m,d,f,p){p&&process.nextTick(p)},a.lutimesSync=function(){})}function i(a){return a&&function(m,d,f){return a.call(t,m,d,function(p){l(p)&&(p=null),f&&f.apply(this,arguments)})}}function n(a){return a&&function(m,d){try{return a.call(t,m,d)}catch(f){if(!l(f))throw f}}}function o(a){return a&&function(m,d,f,p){return a.call(t,m,d,f,function(h){l(h)&&(h=null),p&&p.apply(this,arguments)})}}function s(a){return a&&function(m,d,f){try{return a.call(t,m,d,f)}catch(p){if(!l(p))throw p}}}function c(a){return a&&function(m,d,f){typeof d=="function"&&(f=d,d=null);function p(h,v){v&&(v.uid<0&&(v.uid+=4294967296),v.gid<0&&(v.gid+=4294967296)),f&&f.apply(this,arguments)}return d?a.call(t,m,d,p):a.call(t,m,p)}}function u(a){return a&&function(m,d){var f=d?a.call(t,m,d):a.call(t,m);return f&&(f.uid<0&&(f.uid+=4294967296),f.gid<0&&(f.gid+=4294967296)),f}}function l(a){if(!a||a.code==="ENOSYS")return!0;var m=!process.getuid||process.getuid()!==0;return!!(m&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Ct=S((ta,Mt)=>{var It=require("stream").Stream;Mt.exports=on;function on(t){return{ReadStream:e,WriteStream:r};function e(i,n){if(!(this instanceof e))return new e(i,n);It.call(this);var o=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,n=n||{};for(var s=Object.keys(n),c=0,u=s.length;c<u;c++){var l=s[c];this[l]=n[l]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,m){if(a){o.emit("error",a),o.readable=!1;return}o.fd=m,o.emit("open",m),o._read()})}function r(i,n){if(!(this instanceof r))return new r(i,n);It.call(this),this.path=i,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,n=n||{};for(var o=Object.keys(n),s=0,c=o.length;s<c;s++){var u=o[s];this[u]=n[u]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var At=S((ra,Nt)=>{"use strict";Nt.exports=an;var sn=Object.getPrototypeOf||function(t){return t.__proto__};function an(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:sn(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var le=S((ia,ot)=>{var k=require("fs"),cn=Tt(),ln=Ct(),un=At(),Oe=require("util"),C,Fe;typeof Symbol=="function"&&typeof Symbol.for=="function"?(C=Symbol.for("graceful-fs.queue"),Fe=Symbol.for("graceful-fs.previous")):(C="___graceful-fs.queue",Fe="___graceful-fs.previous");function fn(){}function _t(t,e){Object.defineProperty(t,C,{get:function(){return e}})}var oe=fn;Oe.debuglog?oe=Oe.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(oe=function(){var t=Oe.format.apply(Oe,arguments);t="GFS4: "+t.split(/\n/).join(`
3
- GFS4: `),console.error(t)});k[C]||(Rt=global[C]||[],_t(k,Rt),k.close=function(t){function e(r,i){return t.call(k,r,function(n){n||Vt(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,Fe,{value:t}),e}(k.close),k.closeSync=function(t){function e(r){t.apply(k,arguments),Vt()}return Object.defineProperty(e,Fe,{value:t}),e}(k.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){oe(k[C]),require("assert").equal(k[C].length,0)}));var Rt;global[C]||_t(global,k[C]);ot.exports=it(un(k));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!k.__patched&&(ot.exports=it(k),k.__patched=!0);function it(t){cn(t),t.gracefulify=it,t.createReadStream=Le,t.createWriteStream=kt;var e=t.readFile;t.readFile=r;function r(y,w,g){return typeof w=="function"&&(g=w,w=null),T(y,w,g);function T(I,D,P,E){return e(I,D,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?ce([T,[I,D,P],x,E||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,x,M){return i(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,x,M){return o(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(y,w,g,T){return typeof g=="function"&&(T=g,g=0),I(y,w,g,T);function I(D,P,E,x,M){return c(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var l=t.readdir;t.readdir=m;var a=/^v[0-5]\./;function m(y,w,g){typeof w=="function"&&(g=w,w=null);var T=a.test(process.version)?function(P,E,x,M){return l(P,I(P,E,x,M))}:function(P,E,x,M){return l(P,E,I(P,E,x,M))};return T(y,w,g);function I(D,P,E,x){return function(M,L){M&&(M.code==="EMFILE"||M.code==="ENFILE")?ce([T,[D,P,E],M,x||Date.now(),Date.now()]):(L&&L.sort&&L.sort(),typeof E=="function"&&E.call(this,M,L))}}}if(process.version.substr(0,4)==="v0.8"){var d=ln(t);b=d.ReadStream,O=d.WriteStream}var f=t.ReadStream;f&&(b.prototype=Object.create(f.prototype),b.prototype.open=N);var p=t.WriteStream;p&&(O.prototype=Object.create(p.prototype),O.prototype.open=ie),Object.defineProperty(t,"ReadStream",{get:function(){return b},set:function(y){b=y},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return O},set:function(y){O=y},enumerable:!0,configurable:!0});var h=b;Object.defineProperty(t,"FileReadStream",{get:function(){return h},set:function(y){h=y},enumerable:!0,configurable:!0});var v=O;Object.defineProperty(t,"FileWriteStream",{get:function(){return v},set:function(y){v=y},enumerable:!0,configurable:!0});function b(y,w){return this instanceof b?(f.apply(this,arguments),this):b.apply(Object.create(b.prototype),arguments)}function N(){var y=this;Ke(y.path,y.flags,y.mode,function(w,g){w?(y.autoClose&&y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g),y.read())})}function O(y,w){return this instanceof O?(p.apply(this,arguments),this):O.apply(Object.create(O.prototype),arguments)}function ie(){var y=this;Ke(y.path,y.flags,y.mode,function(w,g){w?(y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g))})}function Le(y,w){return new t.ReadStream(y,w)}function kt(y,w){return new t.WriteStream(y,w)}var Ji=t.open;t.open=Ke;function Ke(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,x,M){return Ji(D,P,E,function(L,Bs){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}return t}function ce(t){oe("ENQUEUE",t[0].name,t[1]),k[C].push(t),nt()}var De;function Vt(){for(var t=Date.now(),e=0;e<k[C].length;++e)k[C][e].length>2&&(k[C][e][3]=t,k[C][e][4]=t);nt()}function nt(){if(clearTimeout(De),De=void 0,k[C].length!==0){var t=k[C].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)oe("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){oe("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,u=Math.max(o-n,1),l=Math.min(u*1.2,100);c>=l?(oe("RETRY",e.name,r),e.apply(null,r.concat([n]))):k[C].push(t)}De===void 0&&(De=setTimeout(nt,0))}}});var V=S(H=>{"use strict";var qt=F().fromCallback,R=le(),mn=["access","appendFile","chmod","chown","close","copyFile","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","lchmod","lchown","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof R[t]=="function");Object.assign(H,R);mn.forEach(t=>{H[t]=qt(R[t])});H.exists=function(t,e){return typeof e=="function"?R.exists(t,e):new Promise(r=>R.exists(t,r))};H.read=function(t,e,r,i,n,o){return typeof o=="function"?R.read(t,e,r,i,n,o):new Promise((s,c)=>{R.read(t,e,r,i,n,(u,l,a)=>{if(u)return c(u);s({bytesRead:l,buffer:a})})})};H.write=function(t,e,...r){return typeof r[r.length-1]=="function"?R.write(t,e,...r):new Promise((i,n)=>{R.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};H.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?R.readv(t,e,...r):new Promise((i,n)=>{R.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};H.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?R.writev(t,e,...r):new Promise((i,n)=>{R.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof R.realpath.native=="function"?H.realpath.native=qt(R.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Xt=S((oa,$t)=>{"use strict";var dn=require("path");$t.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(dn.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var Wt=S((sa,st)=>{"use strict";var Bt=V(),{checkPath:Ut}=Xt(),Gt=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};st.exports.makeDir=async(t,e)=>(Ut(t),Bt.mkdir(t,{mode:Gt(e),recursive:!0}));st.exports.makeDirSync=(t,e)=>(Ut(t),Bt.mkdirSync(t,{mode:Gt(e),recursive:!0}))});var X=S((aa,Jt)=>{"use strict";var pn=F().fromPromise,{makeDir:yn,makeDirSync:at}=Wt(),ct=pn(yn);Jt.exports={mkdirs:ct,mkdirsSync:at,mkdirp:ct,mkdirpSync:at,ensureDir:ct,ensureDirSync:at}});var z=S((ca,Qt)=>{"use strict";var hn=F().fromPromise,Ht=V();function Sn(t){return Ht.access(t).then(()=>!0).catch(()=>!1)}Qt.exports={pathExists:hn(Sn),pathExistsSync:Ht.existsSync}});var lt=S((la,Kt)=>{"use strict";var ue=V(),gn=F().fromPromise;async function vn(t,e,r){let i=await ue.open(t,"r+"),n=null;try{await ue.futimes(i,e,r)}finally{try{await ue.close(i)}catch(o){n=o}}if(n)throw n}function wn(t,e,r){let i=ue.openSync(t,"r+");return ue.futimesSync(i,e,r),ue.closeSync(i)}Kt.exports={utimesMillis:gn(vn),utimesMillisSync:wn}});var se=S((ua,er)=>{"use strict";var fe=V(),j=require("path"),Yt=F().fromPromise;function bn(t,e,r){let i=r.dereference?n=>fe.stat(n,{bigint:!0}):n=>fe.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function xn(t,e,r){let i,n=r.dereference?s=>fe.statSync(s,{bigint:!0}):s=>fe.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function Ln(t,e,r,i){let{srcStat:n,destStat:o}=await bn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&ut(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}function Pn(t,e,r,i){let{srcStat:n,destStat:o}=xn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&ut(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}async function zt(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=await fe.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return zt(t,e,o,i)}function Zt(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=fe.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return Zt(t,e,o,i)}function ye(t,e){return e.ino&&e.dev&&e.ino===t.ino&&e.dev===t.dev}function ut(t,e){let r=j.resolve(t).split(j.sep).filter(n=>n),i=j.resolve(e).split(j.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function je(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}er.exports={checkPaths:Yt(Ln),checkPathsSync:Pn,checkParentPaths:Yt(zt),checkParentPathsSync:Zt,isSrcSubdir:ut,areIdentical:ye}});var or=S((fa,nr)=>{"use strict";var A=V(),he=require("path"),{mkdirs:kn}=X(),{pathExists:En}=z(),{utimesMillis:On}=lt(),Se=se();async function Dn(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
2
+ "use strict";var Hi=Object.create;var Et=Object.defineProperty;var Qi=Object.getOwnPropertyDescriptor;var Ki=Object.getOwnPropertyNames;var Yi=Object.getPrototypeOf,zi=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Zi=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Ki(e))!zi.call(t,n)&&n!==r&&Et(t,n,{get:()=>e[n],enumerable:!(i=Qi(e,n))||i.enumerable});return t};var Ye=(t,e,r)=>(r=t!=null?Hi(Yi(t)):{},Zi(e||!t||!t.__esModule?Et(r,"default",{value:t,enumerable:!0}):r,t));var F=S(tt=>{"use strict";tt.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};tt.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var Tt=S((ta,jt)=>{var Y=require("constants"),tn=process.cwd,Ee=null,rn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Ee||(Ee=tn.call(process)),Ee};try{process.cwd()}catch{}typeof process.chdir=="function"&&(rt=process.chdir,process.chdir=function(t){Ee=null,rt.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,rt));var rt;jt.exports=nn;function nn(t){Y.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=i(t.chmod),t.fchmod=i(t.fchmod),t.lchmod=i(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=n(t.chmodSync),t.fchmodSync=n(t.fchmodSync),t.lchmodSync=n(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=u(t.statSync),t.fstatSync=u(t.fstatSync),t.lstatSync=u(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,f,p){p&&process.nextTick(p)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,f,p,m){m&&process.nextTick(m)},t.lchownSync=function(){}),rn==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:function(a){function f(p,m,d){var h=Date.now(),v=0;a(p,m,function b(C){if(C&&(C.code==="EACCES"||C.code==="EPERM"||C.code==="EBUSY")&&Date.now()-h<6e4){setTimeout(function(){t.stat(m,function(D,ie){D&&D.code==="ENOENT"?a(p,m,b):d(C)})},v),v<100&&(v+=10);return}d&&d(C)})}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f}(t.rename)),t.read=typeof t.read!="function"?t.read:function(a){function f(p,m,d,h,v,b){var C;if(b&&typeof b=="function"){var D=0;C=function(ie,Le,kt){if(ie&&ie.code==="EAGAIN"&&D<10)return D++,a.call(t,p,m,d,h,v,C);b.apply(this,arguments)}}return a.call(t,p,m,d,h,v,C)}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f}(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:function(a){return function(f,p,m,d,h){for(var v=0;;)try{return a.call(t,f,p,m,d,h)}catch(b){if(b.code==="EAGAIN"&&v<10){v++;continue}throw b}}}(t.readSync);function e(a){a.lchmod=function(f,p,m){a.open(f,Y.O_WRONLY|Y.O_SYMLINK,p,function(d,h){if(d){m&&m(d);return}a.fchmod(h,p,function(v){a.close(h,function(b){m&&m(v||b)})})})},a.lchmodSync=function(f,p){var m=a.openSync(f,Y.O_WRONLY|Y.O_SYMLINK,p),d=!0,h;try{h=a.fchmodSync(m,p),d=!1}finally{if(d)try{a.closeSync(m)}catch{}else a.closeSync(m)}return h}}function r(a){Y.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(f,p,m,d){a.open(f,Y.O_SYMLINK,function(h,v){if(h){d&&d(h);return}a.futimes(v,p,m,function(b){a.close(v,function(C){d&&d(b||C)})})})},a.lutimesSync=function(f,p,m){var d=a.openSync(f,Y.O_SYMLINK),h,v=!0;try{h=a.futimesSync(d,p,m),v=!1}finally{if(v)try{a.closeSync(d)}catch{}else a.closeSync(d)}return h}):a.futimes&&(a.lutimes=function(f,p,m,d){d&&process.nextTick(d)},a.lutimesSync=function(){})}function i(a){return a&&function(f,p,m){return a.call(t,f,p,function(d){l(d)&&(d=null),m&&m.apply(this,arguments)})}}function n(a){return a&&function(f,p){try{return a.call(t,f,p)}catch(m){if(!l(m))throw m}}}function o(a){return a&&function(f,p,m,d){return a.call(t,f,p,m,function(h){l(h)&&(h=null),d&&d.apply(this,arguments)})}}function s(a){return a&&function(f,p,m){try{return a.call(t,f,p,m)}catch(d){if(!l(d))throw d}}}function c(a){return a&&function(f,p,m){typeof p=="function"&&(m=p,p=null);function d(h,v){v&&(v.uid<0&&(v.uid+=4294967296),v.gid<0&&(v.gid+=4294967296)),m&&m.apply(this,arguments)}return p?a.call(t,f,p,d):a.call(t,f,d)}}function u(a){return a&&function(f,p){var m=p?a.call(t,f,p):a.call(t,f);return m&&(m.uid<0&&(m.uid+=4294967296),m.gid<0&&(m.gid+=4294967296)),m}}function l(a){if(!a||a.code==="ENOSYS")return!0;var f=!process.getuid||process.getuid()!==0;return!!(f&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Nt=S((ra,Mt)=>{var It=require("stream").Stream;Mt.exports=on;function on(t){return{ReadStream:e,WriteStream:r};function e(i,n){if(!(this instanceof e))return new e(i,n);It.call(this);var o=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,n=n||{};for(var s=Object.keys(n),c=0,u=s.length;c<u;c++){var l=s[c];this[l]=n[l]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,f){if(a){o.emit("error",a),o.readable=!1;return}o.fd=f,o.emit("open",f),o._read()})}function r(i,n){if(!(this instanceof r))return new r(i,n);It.call(this),this.path=i,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,n=n||{};for(var o=Object.keys(n),s=0,c=o.length;s<c;s++){var u=o[s];this[u]=n[u]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var At=S((ia,Ct)=>{"use strict";Ct.exports=an;var sn=Object.getPrototypeOf||function(t){return t.__proto__};function an(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:sn(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var le=S((na,ot)=>{var k=require("fs"),cn=Tt(),ln=Nt(),un=At(),De=require("util"),N,Fe;typeof Symbol=="function"&&typeof Symbol.for=="function"?(N=Symbol.for("graceful-fs.queue"),Fe=Symbol.for("graceful-fs.previous")):(N="___graceful-fs.queue",Fe="___graceful-fs.previous");function fn(){}function _t(t,e){Object.defineProperty(t,N,{get:function(){return e}})}var oe=fn;De.debuglog?oe=De.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(oe=function(){var t=De.format.apply(De,arguments);t="GFS4: "+t.split(/\n/).join(`
3
+ GFS4: `),console.error(t)});k[N]||(Rt=global[N]||[],_t(k,Rt),k.close=function(t){function e(r,i){return t.call(k,r,function(n){n||Vt(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,Fe,{value:t}),e}(k.close),k.closeSync=function(t){function e(r){t.apply(k,arguments),Vt()}return Object.defineProperty(e,Fe,{value:t}),e}(k.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){oe(k[N]),require("assert").equal(k[N].length,0)}));var Rt;global[N]||_t(global,k[N]);ot.exports=it(un(k));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!k.__patched&&(ot.exports=it(k),k.__patched=!0);function it(t){cn(t),t.gracefulify=it,t.createReadStream=Le,t.createWriteStream=kt;var e=t.readFile;t.readFile=r;function r(y,w,g){return typeof w=="function"&&(g=w,w=null),T(y,w,g);function T(I,O,P,E){return e(I,O,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?ce([T,[I,O,P],x,E||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(O,P,E,x,M){return i(O,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[O,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(O,P,E,x,M){return o(O,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[O,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(y,w,g,T){return typeof g=="function"&&(T=g,g=0),I(y,w,g,T);function I(O,P,E,x,M){return c(O,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[O,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var l=t.readdir;t.readdir=f;var a=/^v[0-5]\./;function f(y,w,g){typeof w=="function"&&(g=w,w=null);var T=a.test(process.version)?function(P,E,x,M){return l(P,I(P,E,x,M))}:function(P,E,x,M){return l(P,E,I(P,E,x,M))};return T(y,w,g);function I(O,P,E,x){return function(M,L){M&&(M.code==="EMFILE"||M.code==="ENFILE")?ce([T,[O,P,E],M,x||Date.now(),Date.now()]):(L&&L.sort&&L.sort(),typeof E=="function"&&E.call(this,M,L))}}}if(process.version.substr(0,4)==="v0.8"){var p=ln(t);b=p.ReadStream,D=p.WriteStream}var m=t.ReadStream;m&&(b.prototype=Object.create(m.prototype),b.prototype.open=C);var d=t.WriteStream;d&&(D.prototype=Object.create(d.prototype),D.prototype.open=ie),Object.defineProperty(t,"ReadStream",{get:function(){return b},set:function(y){b=y},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return D},set:function(y){D=y},enumerable:!0,configurable:!0});var h=b;Object.defineProperty(t,"FileReadStream",{get:function(){return h},set:function(y){h=y},enumerable:!0,configurable:!0});var v=D;Object.defineProperty(t,"FileWriteStream",{get:function(){return v},set:function(y){v=y},enumerable:!0,configurable:!0});function b(y,w){return this instanceof b?(m.apply(this,arguments),this):b.apply(Object.create(b.prototype),arguments)}function C(){var y=this;Ke(y.path,y.flags,y.mode,function(w,g){w?(y.autoClose&&y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g),y.read())})}function D(y,w){return this instanceof D?(d.apply(this,arguments),this):D.apply(Object.create(D.prototype),arguments)}function ie(){var y=this;Ke(y.path,y.flags,y.mode,function(w,g){w?(y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g))})}function Le(y,w){return new t.ReadStream(y,w)}function kt(y,w){return new t.WriteStream(y,w)}var Ji=t.open;t.open=Ke;function Ke(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(O,P,E,x,M){return Ji(O,P,E,function(L,Us){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[O,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}return t}function ce(t){oe("ENQUEUE",t[0].name,t[1]),k[N].push(t),nt()}var Oe;function Vt(){for(var t=Date.now(),e=0;e<k[N].length;++e)k[N][e].length>2&&(k[N][e][3]=t,k[N][e][4]=t);nt()}function nt(){if(clearTimeout(Oe),Oe=void 0,k[N].length!==0){var t=k[N].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)oe("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){oe("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,u=Math.max(o-n,1),l=Math.min(u*1.2,100);c>=l?(oe("RETRY",e.name,r),e.apply(null,r.concat([n]))):k[N].push(t)}Oe===void 0&&(Oe=setTimeout(nt,0))}}});var V=S(H=>{"use strict";var qt=F().fromCallback,R=le(),mn=["access","appendFile","chmod","chown","close","copyFile","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","lchmod","lchown","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof R[t]=="function");Object.assign(H,R);mn.forEach(t=>{H[t]=qt(R[t])});H.exists=function(t,e){return typeof e=="function"?R.exists(t,e):new Promise(r=>R.exists(t,r))};H.read=function(t,e,r,i,n,o){return typeof o=="function"?R.read(t,e,r,i,n,o):new Promise((s,c)=>{R.read(t,e,r,i,n,(u,l,a)=>{if(u)return c(u);s({bytesRead:l,buffer:a})})})};H.write=function(t,e,...r){return typeof r[r.length-1]=="function"?R.write(t,e,...r):new Promise((i,n)=>{R.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};H.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?R.readv(t,e,...r):new Promise((i,n)=>{R.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};H.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?R.writev(t,e,...r):new Promise((i,n)=>{R.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof R.realpath.native=="function"?H.realpath.native=qt(R.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Xt=S((sa,$t)=>{"use strict";var pn=require("path");$t.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(pn.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var Wt=S((aa,st)=>{"use strict";var Bt=V(),{checkPath:Ut}=Xt(),Gt=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};st.exports.makeDir=async(t,e)=>(Ut(t),Bt.mkdir(t,{mode:Gt(e),recursive:!0}));st.exports.makeDirSync=(t,e)=>(Ut(t),Bt.mkdirSync(t,{mode:Gt(e),recursive:!0}))});var X=S((ca,Jt)=>{"use strict";var dn=F().fromPromise,{makeDir:yn,makeDirSync:at}=Wt(),ct=dn(yn);Jt.exports={mkdirs:ct,mkdirsSync:at,mkdirp:ct,mkdirpSync:at,ensureDir:ct,ensureDirSync:at}});var z=S((la,Qt)=>{"use strict";var hn=F().fromPromise,Ht=V();function Sn(t){return Ht.access(t).then(()=>!0).catch(()=>!1)}Qt.exports={pathExists:hn(Sn),pathExistsSync:Ht.existsSync}});var lt=S((ua,Kt)=>{"use strict";var ue=V(),gn=F().fromPromise;async function vn(t,e,r){let i=await ue.open(t,"r+"),n=null;try{await ue.futimes(i,e,r)}finally{try{await ue.close(i)}catch(o){n=o}}if(n)throw n}function wn(t,e,r){let i=ue.openSync(t,"r+");return ue.futimesSync(i,e,r),ue.closeSync(i)}Kt.exports={utimesMillis:gn(vn),utimesMillisSync:wn}});var se=S((fa,er)=>{"use strict";var fe=V(),j=require("path"),Yt=F().fromPromise;function bn(t,e,r){let i=r.dereference?n=>fe.stat(n,{bigint:!0}):n=>fe.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function xn(t,e,r){let i,n=r.dereference?s=>fe.statSync(s,{bigint:!0}):s=>fe.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function Ln(t,e,r,i){let{srcStat:n,destStat:o}=await bn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&ut(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}function Pn(t,e,r,i){let{srcStat:n,destStat:o}=xn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&ut(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}async function zt(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=await fe.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return zt(t,e,o,i)}function Zt(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=fe.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return Zt(t,e,o,i)}function ye(t,e){return e.ino&&e.dev&&e.ino===t.ino&&e.dev===t.dev}function ut(t,e){let r=j.resolve(t).split(j.sep).filter(n=>n),i=j.resolve(e).split(j.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function je(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}er.exports={checkPaths:Yt(Ln),checkPathsSync:Pn,checkParentPaths:Yt(zt),checkParentPathsSync:Zt,isSrcSubdir:ut,areIdentical:ye}});var or=S((ma,nr)=>{"use strict";var A=V(),he=require("path"),{mkdirs:kn}=X(),{pathExists:En}=z(),{utimesMillis:Dn}=lt(),Se=se();async function On(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
4
4
 
5
- see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await Se.checkPaths(t,e,"copy",r);if(await Se.checkParentPaths(t,i,e,"copy"),!await rr(t,e,r))return;let s=he.dirname(e);await En(s)||await kn(s),await ir(n,t,e,r)}async function rr(t,e,r){return r.filter?r.filter(t,e):!0}async function ir(t,e,r,i){let o=await(i.dereference?A.stat:A.lstat)(e);if(o.isDirectory())return In(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Fn(o,t,e,r,i);if(o.isSymbolicLink())return Mn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Fn(t,e,r,i,n){if(!e)return tr(t,r,i,n);if(n.overwrite)return await A.unlink(i),tr(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function tr(t,e,r,i){if(await A.copyFile(e,r),i.preserveTimestamps){jn(t.mode)&&await Tn(r,t.mode);let n=await A.stat(e);await On(r,n.atime,n.mtime)}return A.chmod(r,t.mode)}function jn(t){return(t&128)===0}function Tn(t,e){return A.chmod(t,e|128)}async function In(t,e,r,i,n){e||await A.mkdir(i);let o=await A.readdir(r);await Promise.all(o.map(async s=>{let c=he.join(r,s),u=he.join(i,s);if(!await rr(c,u,n))return;let{destStat:a}=await Se.checkPaths(c,u,"copy",n);return ir(a,c,u,n)})),e||await A.chmod(i,t.mode)}async function Mn(t,e,r,i){let n=await A.readlink(e);if(i.dereference&&(n=he.resolve(process.cwd(),n)),!t)return A.symlink(n,r);let o=null;try{o=await A.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return A.symlink(n,r);throw s}if(i.dereference&&(o=he.resolve(process.cwd(),o)),Se.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(Se.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await A.unlink(r),A.symlink(n,r)}nr.exports=Dn});var ur=S((ma,lr)=>{"use strict";var _=le(),ge=require("path"),Cn=X().mkdirsSync,Nn=lt().utimesMillisSync,ve=se();function An(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
5
+ see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await Se.checkPaths(t,e,"copy",r);if(await Se.checkParentPaths(t,i,e,"copy"),!await rr(t,e,r))return;let s=he.dirname(e);await En(s)||await kn(s),await ir(n,t,e,r)}async function rr(t,e,r){return r.filter?r.filter(t,e):!0}async function ir(t,e,r,i){let o=await(i.dereference?A.stat:A.lstat)(e);if(o.isDirectory())return In(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Fn(o,t,e,r,i);if(o.isSymbolicLink())return Mn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Fn(t,e,r,i,n){if(!e)return tr(t,r,i,n);if(n.overwrite)return await A.unlink(i),tr(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function tr(t,e,r,i){if(await A.copyFile(e,r),i.preserveTimestamps){jn(t.mode)&&await Tn(r,t.mode);let n=await A.stat(e);await Dn(r,n.atime,n.mtime)}return A.chmod(r,t.mode)}function jn(t){return(t&128)===0}function Tn(t,e){return A.chmod(t,e|128)}async function In(t,e,r,i,n){e||await A.mkdir(i);let o=await A.readdir(r);await Promise.all(o.map(async s=>{let c=he.join(r,s),u=he.join(i,s);if(!await rr(c,u,n))return;let{destStat:a}=await Se.checkPaths(c,u,"copy",n);return ir(a,c,u,n)})),e||await A.chmod(i,t.mode)}async function Mn(t,e,r,i){let n=await A.readlink(e);if(i.dereference&&(n=he.resolve(process.cwd(),n)),!t)return A.symlink(n,r);let o=null;try{o=await A.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return A.symlink(n,r);throw s}if(i.dereference&&(o=he.resolve(process.cwd(),o)),Se.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(Se.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await A.unlink(r),A.symlink(n,r)}nr.exports=On});var ur=S((pa,lr)=>{"use strict";var _=le(),ge=require("path"),Nn=X().mkdirsSync,Cn=lt().utimesMillisSync,ve=se();function An(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
6
6
 
7
- see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ve.checkPathsSync(t,e,"copy",r);if(ve.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ge.dirname(e);return _.existsSync(o)||Cn(o),sr(n,t,e,r)}function sr(t,e,r,i){let o=(i.dereference?_.statSync:_.lstatSync)(e);if(o.isDirectory())return Bn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Rn(o,t,e,r,i);if(o.isSymbolicLink())return Wn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function Rn(t,e,r,i,n){return e?Vn(t,r,i,n):ar(t,r,i,n)}function Vn(t,e,r,i){if(i.overwrite)return _.unlinkSync(r),ar(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function ar(t,e,r,i){return _.copyFileSync(e,r),i.preserveTimestamps&&_n(t.mode,e,r),ft(r,t.mode)}function _n(t,e,r){return qn(t)&&$n(r,t),Xn(e,r)}function qn(t){return(t&128)===0}function $n(t,e){return ft(t,e|128)}function ft(t,e){return _.chmodSync(t,e)}function Xn(t,e){let r=_.statSync(t);return Nn(e,r.atime,r.mtime)}function Bn(t,e,r,i,n){return e?cr(r,i,n):Un(t.mode,r,i,n)}function Un(t,e,r,i){return _.mkdirSync(r),cr(e,r,i),ft(r,t)}function cr(t,e,r){_.readdirSync(t).forEach(i=>Gn(i,t,e,r))}function Gn(t,e,r,i){let n=ge.join(e,t),o=ge.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=ve.checkPathsSync(n,o,"copy",i);return sr(s,n,o,i)}function Wn(t,e,r,i){let n=_.readlinkSync(e);if(i.dereference&&(n=ge.resolve(process.cwd(),n)),t){let o;try{o=_.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return _.symlinkSync(n,r);throw s}if(i.dereference&&(o=ge.resolve(process.cwd(),o)),ve.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(ve.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return Jn(n,r)}else return _.symlinkSync(n,r)}function Jn(t,e){return _.unlinkSync(e),_.symlinkSync(t,e)}lr.exports=An});var Te=S((da,fr)=>{"use strict";var Hn=F().fromPromise;fr.exports={copy:Hn(or()),copySync:ur()}});var we=S((pa,dr)=>{"use strict";var mr=le(),Qn=F().fromCallback;function Kn(t,e){mr.rm(t,{recursive:!0,force:!0},e)}function Yn(t){mr.rmSync(t,{recursive:!0,force:!0})}dr.exports={remove:Qn(Kn),removeSync:Yn}});var br=S((ya,wr)=>{"use strict";var zn=F().fromPromise,hr=V(),Sr=require("path"),gr=X(),vr=we(),pr=zn(async function(e){let r;try{r=await hr.readdir(e)}catch{return gr.mkdirs(e)}return Promise.all(r.map(i=>vr.remove(Sr.join(e,i))))});function yr(t){let e;try{e=hr.readdirSync(t)}catch{return gr.mkdirsSync(t)}e.forEach(r=>{r=Sr.join(t,r),vr.removeSync(r)})}wr.exports={emptyDirSync:yr,emptydirSync:yr,emptyDir:pr,emptydir:pr}});var kr=S((ha,Pr)=>{"use strict";var Zn=F().fromPromise,xr=require("path"),Q=V(),Lr=X();async function eo(t){let e;try{e=await Q.stat(t)}catch{}if(e&&e.isFile())return;let r=xr.dirname(t),i=null;try{i=await Q.stat(r)}catch(n){if(n.code==="ENOENT"){await Lr.mkdirs(r),await Q.writeFile(t,"");return}else throw n}i.isDirectory()?await Q.writeFile(t,""):await Q.readdir(r)}function to(t){let e;try{e=Q.statSync(t)}catch{}if(e&&e.isFile())return;let r=xr.dirname(t);try{Q.statSync(r).isDirectory()||Q.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")Lr.mkdirsSync(r);else throw i}Q.writeFileSync(t,"")}Pr.exports={createFile:Zn(eo),createFileSync:to}});var jr=S((Sa,Fr)=>{"use strict";var ro=F().fromPromise,Er=require("path"),Z=V(),Or=X(),{pathExists:io}=z(),{areIdentical:Dr}=se();async function no(t,e){let r;try{r=await Z.lstat(e)}catch{}let i;try{i=await Z.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&Dr(i,r))return;let n=Er.dirname(e);await io(n)||await Or.mkdirs(n),await Z.link(t,e)}function oo(t,e){let r;try{r=Z.lstatSync(e)}catch{}try{let o=Z.lstatSync(t);if(r&&Dr(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Er.dirname(e);return Z.existsSync(i)||Or.mkdirsSync(i),Z.linkSync(t,e)}Fr.exports={createLink:ro(no),createLinkSync:oo}});var Ir=S((ga,Tr)=>{"use strict";var ee=require("path"),be=V(),{pathExists:so}=z(),ao=F().fromPromise;async function co(t,e){if(ee.isAbsolute(t)){try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(await so(i))return{toCwd:i,toDst:t};try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ee.relative(r,t)}}function lo(t,e){if(ee.isAbsolute(t)){if(!be.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(be.existsSync(i))return{toCwd:i,toDst:t};if(!be.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ee.relative(r,t)}}Tr.exports={symlinkPaths:ao(co),symlinkPathsSync:lo}});var Nr=S((va,Cr)=>{"use strict";var Mr=V(),uo=F().fromPromise;async function fo(t,e){if(e)return e;let r;try{r=await Mr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function mo(t,e){if(e)return e;let r;try{r=Mr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Cr.exports={symlinkType:uo(fo),symlinkTypeSync:mo}});var _r=S((wa,Vr)=>{"use strict";var po=F().fromPromise,Ar=require("path"),U=V(),{mkdirs:yo,mkdirsSync:ho}=X(),{symlinkPaths:So,symlinkPathsSync:go}=Ir(),{symlinkType:vo,symlinkTypeSync:wo}=Nr(),{pathExists:bo}=z(),{areIdentical:Rr}=se();async function xo(t,e,r){let i;try{i=await U.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,u]=await Promise.all([U.stat(t),U.stat(e)]);if(Rr(c,u))return}let n=await So(t,e);t=n.toDst;let o=await vo(n.toCwd,r),s=Ar.dirname(e);return await bo(s)||await yo(s),U.symlink(t,e,o)}function Lo(t,e,r){let i;try{i=U.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=U.statSync(t),u=U.statSync(e);if(Rr(c,u))return}let n=go(t,e);t=n.toDst,r=wo(n.toCwd,r);let o=Ar.dirname(e);return U.existsSync(o)||ho(o),U.symlinkSync(t,e,r)}Vr.exports={createSymlink:po(xo),createSymlinkSync:Lo}});var Jr=S((ba,Wr)=>{"use strict";var{createFile:qr,createFileSync:$r}=kr(),{createLink:Xr,createLinkSync:Br}=jr(),{createSymlink:Ur,createSymlinkSync:Gr}=_r();Wr.exports={createFile:qr,createFileSync:$r,ensureFile:qr,ensureFileSync:$r,createLink:Xr,createLinkSync:Br,ensureLink:Xr,ensureLinkSync:Br,createSymlink:Ur,createSymlinkSync:Gr,ensureSymlink:Ur,ensureSymlinkSync:Gr}});var Ie=S((xa,Hr)=>{function Po(t,{EOL:e=`
8
- `,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function ko(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Hr.exports={stringify:Po,stripBom:ko}});var zr=S((La,Yr)=>{var me;try{me=le()}catch{me=require("fs")}var Me=F(),{stringify:Qr,stripBom:Kr}=Ie();async function Eo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0,n=await Me.fromCallback(r.readFile)(t,e);n=Kr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Oo=Me.fromPromise(Eo);function Do(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Kr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function Fo(t,e,r={}){let i=r.fs||me,n=Qr(e,r);await Me.fromCallback(i.writeFile)(t,n,r)}var jo=Me.fromPromise(Fo);function To(t,e,r={}){let i=r.fs||me,n=Qr(e,r);return i.writeFileSync(t,n,r)}var Io={readFile:Oo,readFileSync:Do,writeFile:jo,writeFileSync:To};Yr.exports=Io});var ei=S((Pa,Zr)=>{"use strict";var Ce=zr();Zr.exports={readJson:Ce.readFile,readJsonSync:Ce.readFileSync,writeJson:Ce.writeFile,writeJsonSync:Ce.writeFileSync}});var Ne=S((ka,ii)=>{"use strict";var Mo=F().fromPromise,mt=V(),ti=require("path"),ri=X(),Co=z().pathExists;async function No(t,e,r="utf-8"){let i=ti.dirname(t);return await Co(i)||await ri.mkdirs(i),mt.writeFile(t,e,r)}function Ao(t,...e){let r=ti.dirname(t);mt.existsSync(r)||ri.mkdirsSync(r),mt.writeFileSync(t,...e)}ii.exports={outputFile:Mo(No),outputFileSync:Ao}});var oi=S((Ea,ni)=>{"use strict";var{stringify:Ro}=Ie(),{outputFile:Vo}=Ne();async function _o(t,e,r={}){let i=Ro(e,r);await Vo(t,i,r)}ni.exports=_o});var ai=S((Oa,si)=>{"use strict";var{stringify:qo}=Ie(),{outputFileSync:$o}=Ne();function Xo(t,e,r){let i=qo(e,r);$o(t,i,r)}si.exports=Xo});var li=S((Da,ci)=>{"use strict";var Bo=F().fromPromise,q=ei();q.outputJson=Bo(oi());q.outputJsonSync=ai();q.outputJSON=q.outputJson;q.outputJSONSync=q.outputJsonSync;q.writeJSON=q.writeJson;q.writeJSONSync=q.writeJsonSync;q.readJSON=q.readJson;q.readJSONSync=q.readJsonSync;ci.exports=q});var pi=S((Fa,di)=>{"use strict";var Uo=V(),ui=require("path"),{copy:Go}=Te(),{remove:mi}=we(),{mkdirp:Wo}=X(),{pathExists:Jo}=z(),fi=se();async function Ho(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await fi.checkPaths(t,e,"move",r);await fi.checkParentPaths(t,n,e,"move");let s=ui.dirname(e);return ui.parse(s).root!==s&&await Wo(s),Qo(t,e,i,o)}async function Qo(t,e,r,i){if(!i){if(r)await mi(e);else if(await Jo(e))throw new Error("dest already exists.")}try{await Uo.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Ko(t,e,r)}}async function Ko(t,e,r){return await Go(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),mi(t)}di.exports=Ho});var vi=S((ja,gi)=>{"use strict";var hi=le(),pt=require("path"),Yo=Te().copySync,Si=we().removeSync,zo=X().mkdirpSync,yi=se();function Zo(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=yi.checkPathsSync(t,e,"move",r);return yi.checkParentPathsSync(t,n,e,"move"),es(e)||zo(pt.dirname(e)),ts(t,e,i,o)}function es(t){let e=pt.dirname(t);return pt.parse(e).root===e}function ts(t,e,r,i){if(i)return dt(t,e,r);if(r)return Si(e),dt(t,e,r);if(hi.existsSync(e))throw new Error("dest already exists.");return dt(t,e,r)}function dt(t,e,r){try{hi.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return rs(t,e,r)}}function rs(t,e,r){return Yo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Si(t)}gi.exports=Zo});var bi=S((Ta,wi)=>{"use strict";var is=F().fromPromise;wi.exports={move:is(pi()),moveSync:vi()}});var Li=S((Ia,xi)=>{"use strict";xi.exports={...V(),...Te(),...br(),...Jr(),...li(),...X(),...bi(),...Ne(),...z(),...we()}});var Pi=S(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.EXTENSIONS_LANGUAGES=void 0;Ae.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var xe=S(yt=>{"use strict";Object.defineProperty(yt,"__esModule",{value:!0});yt.setOptionValues=ns;function ns(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Ei=S(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.SarifBuilder=void 0;var os=require("path"),ki=Li(),ss=Pi(),as=xe(),ht=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,as.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();ki.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await ki.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((i=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var m;return((m=a?.location)===null||m===void 0?void 0:m.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=os.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),m=ss.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:m,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,m;let d=(m=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||m===void 0?void 0:m.uri;return d&&s.indexOf(d)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(d)),l})),u)),e}};Re.SarifBuilder=ht});var Oi=S(Ve=>{"use strict";Object.defineProperty(Ve,"__esModule",{value:!0});Ve.SarifResultBuilder=void 0;var cs=xe(),St=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,cs.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Ve.SarifResultBuilder=St});var Di=S(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});_e.SarifRuleBuilder=void 0;var ls=xe(),gt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,ls.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};_e.SarifRuleBuilder=gt});var Fi=S(qe=>{"use strict";Object.defineProperty(qe,"__esModule",{value:!0});qe.SarifRunBuilder=void 0;var us=xe(),vt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,us.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};qe.SarifRunBuilder=vt});var ji=S(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.SarifResultBuilder=G.SarifRuleBuilder=G.SarifRunBuilder=G.SarifBuilder=void 0;var fs=Ei();Object.defineProperty(G,"SarifBuilder",{enumerable:!0,get:function(){return fs.SarifBuilder}});var ms=Oi();Object.defineProperty(G,"SarifResultBuilder",{enumerable:!0,get:function(){return ms.SarifResultBuilder}});var ds=Di();Object.defineProperty(G,"SarifRuleBuilder",{enumerable:!0,get:function(){return ds.SarifRuleBuilder}});var ps=Fi();Object.defineProperty(G,"SarifRunBuilder",{enumerable:!0,get:function(){return ps.SarifRunBuilder}})});var Ii=S((qa,Ti)=>{"use strict";var ys=/["'&<>]/;Ti.exports=hs;function hs(t){var e=""+t,r=ys.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Qe=require("zx"),ae=require("fs/promises");var W={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var Pe=class{allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=Ot(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=en(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=ze(o.detectedBy,r),o.components=ze(o.components,e.components[0]),o.refs=ze(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push({id:i.id,severity:i.severity});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function en(t,e){return Ot(t,e)>0?t:e}function Ot(t,e){return W[t]-W[e]}function ze(t,e){return e?Array.from(new Set([...t,e]).values()):t}var ke=Ye(require("path"));var $=require("fs/promises"),Ze=require("path");async function B(t){if(await ne(t))return JSON.parse(await(0,$.readFile)(t,{encoding:"utf-8"}))}async function Dt(t,e){await(0,$.writeFile)(t,JSON.stringify(e,null,4)+`
9
- `,{encoding:"utf-8"})}function J(t){return t&&t.replace(/\?.*$/,"")}async function ne(t){try{return await(0,$.access)(t,$.constants.F_OK),!0}catch{return!1}}async function et(t){let e=(0,Ze.resolve)(t),r=await(0,$.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,Ze.resolve)(i.parentPath,i.name);i.isDirectory()?await et(n):await(0,$.rm)(n)}await(0,$.rmdir)(e)}async function pe(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function Ft(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=K(t.workingDir,"input/vex"),i=K(t.workingDir,"output"),n=K(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=K(t.workingDir,"vuln-scan-conf.json"),c=await B(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);return{projectConfigFileLocation:s,failOnNewVulnerabilities:!1,createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:K(t.workingDir,c.vexDir)??r,outDir:K(t.workingDir,c.outDir)??i,cacheDir:K(t.workingDir,c.cacheDir)??n,scanners:c.scanners??o,projects:(c.projects??[]).map(u=>{let l=u;if(!l.name)throw new Error("Project name is missing on entry:"+JSON.stringify(l));if(!l.version)throw new Error("Project version is missing on entry:"+JSON.stringify(l));if(!l.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(l));return l.enabled==null&&(l.enabled=!0),l.silent==null&&(l.silent=!1),l.minimumSeverity||(l.minimumSeverity="UNKNOWN"),l.sbomFile?{...l,sbomFile:K(t.workingDir,l.sbomFile)}:u})}}function K(t,e){if(e)return ke.default.isAbsolute(e)?e:(0,ke.resolve)(t,e)}var te=Ye(ji());var Mi=Ye(Ii());function Ci(t,e){let r=new te.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=gs(o.severity),c=o.id,u=Ss(o.refs),l=new te.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,m,d="new",f="";a?(m=[{kind:"external",status:"accepted"}],d="updated",f=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(m[0].status="underReview",f="--- UNDER INVESTIGATION --- ")):W[e.minimumSeverity]>W[o.severity]?(m=[{kind:"external",status:"accepted"}],d="updated",f=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(m=[{kind:"external",status:"accepted"}],d="updated",f="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${f}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:vs(o,u,f)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let p of o.components){let h=new te.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${p}`});h.result.message.id="default",h.result.locations=[{logicalLocations:[{fullyQualifiedName:p}]}],h.result.baselineState=d,h.result.suppressions=m,r.addResult(h)}}let n=new te.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function Ss(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function gs(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function vs(t,e,r){let i=t.vexStatement,n=i?`
7
+ see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ve.checkPathsSync(t,e,"copy",r);if(ve.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ge.dirname(e);return _.existsSync(o)||Nn(o),sr(n,t,e,r)}function sr(t,e,r,i){let o=(i.dereference?_.statSync:_.lstatSync)(e);if(o.isDirectory())return Bn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Rn(o,t,e,r,i);if(o.isSymbolicLink())return Wn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function Rn(t,e,r,i,n){return e?Vn(t,r,i,n):ar(t,r,i,n)}function Vn(t,e,r,i){if(i.overwrite)return _.unlinkSync(r),ar(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function ar(t,e,r,i){return _.copyFileSync(e,r),i.preserveTimestamps&&_n(t.mode,e,r),ft(r,t.mode)}function _n(t,e,r){return qn(t)&&$n(r,t),Xn(e,r)}function qn(t){return(t&128)===0}function $n(t,e){return ft(t,e|128)}function ft(t,e){return _.chmodSync(t,e)}function Xn(t,e){let r=_.statSync(t);return Cn(e,r.atime,r.mtime)}function Bn(t,e,r,i,n){return e?cr(r,i,n):Un(t.mode,r,i,n)}function Un(t,e,r,i){return _.mkdirSync(r),cr(e,r,i),ft(r,t)}function cr(t,e,r){_.readdirSync(t).forEach(i=>Gn(i,t,e,r))}function Gn(t,e,r,i){let n=ge.join(e,t),o=ge.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=ve.checkPathsSync(n,o,"copy",i);return sr(s,n,o,i)}function Wn(t,e,r,i){let n=_.readlinkSync(e);if(i.dereference&&(n=ge.resolve(process.cwd(),n)),t){let o;try{o=_.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return _.symlinkSync(n,r);throw s}if(i.dereference&&(o=ge.resolve(process.cwd(),o)),ve.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(ve.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return Jn(n,r)}else return _.symlinkSync(n,r)}function Jn(t,e){return _.unlinkSync(e),_.symlinkSync(t,e)}lr.exports=An});var Te=S((da,fr)=>{"use strict";var Hn=F().fromPromise;fr.exports={copy:Hn(or()),copySync:ur()}});var we=S((ya,pr)=>{"use strict";var mr=le(),Qn=F().fromCallback;function Kn(t,e){mr.rm(t,{recursive:!0,force:!0},e)}function Yn(t){mr.rmSync(t,{recursive:!0,force:!0})}pr.exports={remove:Qn(Kn),removeSync:Yn}});var br=S((ha,wr)=>{"use strict";var zn=F().fromPromise,hr=V(),Sr=require("path"),gr=X(),vr=we(),dr=zn(async function(e){let r;try{r=await hr.readdir(e)}catch{return gr.mkdirs(e)}return Promise.all(r.map(i=>vr.remove(Sr.join(e,i))))});function yr(t){let e;try{e=hr.readdirSync(t)}catch{return gr.mkdirsSync(t)}e.forEach(r=>{r=Sr.join(t,r),vr.removeSync(r)})}wr.exports={emptyDirSync:yr,emptydirSync:yr,emptyDir:dr,emptydir:dr}});var kr=S((Sa,Pr)=>{"use strict";var Zn=F().fromPromise,xr=require("path"),Q=V(),Lr=X();async function eo(t){let e;try{e=await Q.stat(t)}catch{}if(e&&e.isFile())return;let r=xr.dirname(t),i=null;try{i=await Q.stat(r)}catch(n){if(n.code==="ENOENT"){await Lr.mkdirs(r),await Q.writeFile(t,"");return}else throw n}i.isDirectory()?await Q.writeFile(t,""):await Q.readdir(r)}function to(t){let e;try{e=Q.statSync(t)}catch{}if(e&&e.isFile())return;let r=xr.dirname(t);try{Q.statSync(r).isDirectory()||Q.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")Lr.mkdirsSync(r);else throw i}Q.writeFileSync(t,"")}Pr.exports={createFile:Zn(eo),createFileSync:to}});var jr=S((ga,Fr)=>{"use strict";var ro=F().fromPromise,Er=require("path"),Z=V(),Dr=X(),{pathExists:io}=z(),{areIdentical:Or}=se();async function no(t,e){let r;try{r=await Z.lstat(e)}catch{}let i;try{i=await Z.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&Or(i,r))return;let n=Er.dirname(e);await io(n)||await Dr.mkdirs(n),await Z.link(t,e)}function oo(t,e){let r;try{r=Z.lstatSync(e)}catch{}try{let o=Z.lstatSync(t);if(r&&Or(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Er.dirname(e);return Z.existsSync(i)||Dr.mkdirsSync(i),Z.linkSync(t,e)}Fr.exports={createLink:ro(no),createLinkSync:oo}});var Ir=S((va,Tr)=>{"use strict";var ee=require("path"),be=V(),{pathExists:so}=z(),ao=F().fromPromise;async function co(t,e){if(ee.isAbsolute(t)){try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(await so(i))return{toCwd:i,toDst:t};try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ee.relative(r,t)}}function lo(t,e){if(ee.isAbsolute(t)){if(!be.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(be.existsSync(i))return{toCwd:i,toDst:t};if(!be.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ee.relative(r,t)}}Tr.exports={symlinkPaths:ao(co),symlinkPathsSync:lo}});var Cr=S((wa,Nr)=>{"use strict";var Mr=V(),uo=F().fromPromise;async function fo(t,e){if(e)return e;let r;try{r=await Mr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function mo(t,e){if(e)return e;let r;try{r=Mr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Nr.exports={symlinkType:uo(fo),symlinkTypeSync:mo}});var _r=S((ba,Vr)=>{"use strict";var po=F().fromPromise,Ar=require("path"),U=V(),{mkdirs:yo,mkdirsSync:ho}=X(),{symlinkPaths:So,symlinkPathsSync:go}=Ir(),{symlinkType:vo,symlinkTypeSync:wo}=Cr(),{pathExists:bo}=z(),{areIdentical:Rr}=se();async function xo(t,e,r){let i;try{i=await U.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,u]=await Promise.all([U.stat(t),U.stat(e)]);if(Rr(c,u))return}let n=await So(t,e);t=n.toDst;let o=await vo(n.toCwd,r),s=Ar.dirname(e);return await bo(s)||await yo(s),U.symlink(t,e,o)}function Lo(t,e,r){let i;try{i=U.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=U.statSync(t),u=U.statSync(e);if(Rr(c,u))return}let n=go(t,e);t=n.toDst,r=wo(n.toCwd,r);let o=Ar.dirname(e);return U.existsSync(o)||ho(o),U.symlinkSync(t,e,r)}Vr.exports={createSymlink:po(xo),createSymlinkSync:Lo}});var Jr=S((xa,Wr)=>{"use strict";var{createFile:qr,createFileSync:$r}=kr(),{createLink:Xr,createLinkSync:Br}=jr(),{createSymlink:Ur,createSymlinkSync:Gr}=_r();Wr.exports={createFile:qr,createFileSync:$r,ensureFile:qr,ensureFileSync:$r,createLink:Xr,createLinkSync:Br,ensureLink:Xr,ensureLinkSync:Br,createSymlink:Ur,createSymlinkSync:Gr,ensureSymlink:Ur,ensureSymlinkSync:Gr}});var Ie=S((La,Hr)=>{function Po(t,{EOL:e=`
8
+ `,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function ko(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Hr.exports={stringify:Po,stripBom:ko}});var zr=S((Pa,Yr)=>{var me;try{me=le()}catch{me=require("fs")}var Me=F(),{stringify:Qr,stripBom:Kr}=Ie();async function Eo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0,n=await Me.fromCallback(r.readFile)(t,e);n=Kr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Do=Me.fromPromise(Eo);function Oo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Kr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function Fo(t,e,r={}){let i=r.fs||me,n=Qr(e,r);await Me.fromCallback(i.writeFile)(t,n,r)}var jo=Me.fromPromise(Fo);function To(t,e,r={}){let i=r.fs||me,n=Qr(e,r);return i.writeFileSync(t,n,r)}var Io={readFile:Do,readFileSync:Oo,writeFile:jo,writeFileSync:To};Yr.exports=Io});var ei=S((ka,Zr)=>{"use strict";var Ne=zr();Zr.exports={readJson:Ne.readFile,readJsonSync:Ne.readFileSync,writeJson:Ne.writeFile,writeJsonSync:Ne.writeFileSync}});var Ce=S((Ea,ii)=>{"use strict";var Mo=F().fromPromise,mt=V(),ti=require("path"),ri=X(),No=z().pathExists;async function Co(t,e,r="utf-8"){let i=ti.dirname(t);return await No(i)||await ri.mkdirs(i),mt.writeFile(t,e,r)}function Ao(t,...e){let r=ti.dirname(t);mt.existsSync(r)||ri.mkdirsSync(r),mt.writeFileSync(t,...e)}ii.exports={outputFile:Mo(Co),outputFileSync:Ao}});var oi=S((Da,ni)=>{"use strict";var{stringify:Ro}=Ie(),{outputFile:Vo}=Ce();async function _o(t,e,r={}){let i=Ro(e,r);await Vo(t,i,r)}ni.exports=_o});var ai=S((Oa,si)=>{"use strict";var{stringify:qo}=Ie(),{outputFileSync:$o}=Ce();function Xo(t,e,r){let i=qo(e,r);$o(t,i,r)}si.exports=Xo});var li=S((Fa,ci)=>{"use strict";var Bo=F().fromPromise,q=ei();q.outputJson=Bo(oi());q.outputJsonSync=ai();q.outputJSON=q.outputJson;q.outputJSONSync=q.outputJsonSync;q.writeJSON=q.writeJson;q.writeJSONSync=q.writeJsonSync;q.readJSON=q.readJson;q.readJSONSync=q.readJsonSync;ci.exports=q});var di=S((ja,pi)=>{"use strict";var Uo=V(),ui=require("path"),{copy:Go}=Te(),{remove:mi}=we(),{mkdirp:Wo}=X(),{pathExists:Jo}=z(),fi=se();async function Ho(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await fi.checkPaths(t,e,"move",r);await fi.checkParentPaths(t,n,e,"move");let s=ui.dirname(e);return ui.parse(s).root!==s&&await Wo(s),Qo(t,e,i,o)}async function Qo(t,e,r,i){if(!i){if(r)await mi(e);else if(await Jo(e))throw new Error("dest already exists.")}try{await Uo.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Ko(t,e,r)}}async function Ko(t,e,r){return await Go(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),mi(t)}pi.exports=Ho});var vi=S((Ta,gi)=>{"use strict";var hi=le(),dt=require("path"),Yo=Te().copySync,Si=we().removeSync,zo=X().mkdirpSync,yi=se();function Zo(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=yi.checkPathsSync(t,e,"move",r);return yi.checkParentPathsSync(t,n,e,"move"),es(e)||zo(dt.dirname(e)),ts(t,e,i,o)}function es(t){let e=dt.dirname(t);return dt.parse(e).root===e}function ts(t,e,r,i){if(i)return pt(t,e,r);if(r)return Si(e),pt(t,e,r);if(hi.existsSync(e))throw new Error("dest already exists.");return pt(t,e,r)}function pt(t,e,r){try{hi.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return rs(t,e,r)}}function rs(t,e,r){return Yo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Si(t)}gi.exports=Zo});var bi=S((Ia,wi)=>{"use strict";var is=F().fromPromise;wi.exports={move:is(di()),moveSync:vi()}});var Li=S((Ma,xi)=>{"use strict";xi.exports={...V(),...Te(),...br(),...Jr(),...li(),...X(),...bi(),...Ce(),...z(),...we()}});var Pi=S(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.EXTENSIONS_LANGUAGES=void 0;Ae.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var xe=S(yt=>{"use strict";Object.defineProperty(yt,"__esModule",{value:!0});yt.setOptionValues=ns;function ns(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Ei=S(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.SarifBuilder=void 0;var os=require("path"),ki=Li(),ss=Pi(),as=xe(),ht=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,as.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();ki.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await ki.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((i=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var f;return((f=a?.location)===null||f===void 0?void 0:f.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=os.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),f=ss.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:f,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,f;let p=(f=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||f===void 0?void 0:f.uri;return p&&s.indexOf(p)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(p)),l})),u)),e}};Re.SarifBuilder=ht});var Di=S(Ve=>{"use strict";Object.defineProperty(Ve,"__esModule",{value:!0});Ve.SarifResultBuilder=void 0;var cs=xe(),St=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,cs.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Ve.SarifResultBuilder=St});var Oi=S(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});_e.SarifRuleBuilder=void 0;var ls=xe(),gt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,ls.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};_e.SarifRuleBuilder=gt});var Fi=S(qe=>{"use strict";Object.defineProperty(qe,"__esModule",{value:!0});qe.SarifRunBuilder=void 0;var us=xe(),vt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,us.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};qe.SarifRunBuilder=vt});var ji=S(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.SarifResultBuilder=G.SarifRuleBuilder=G.SarifRunBuilder=G.SarifBuilder=void 0;var fs=Ei();Object.defineProperty(G,"SarifBuilder",{enumerable:!0,get:function(){return fs.SarifBuilder}});var ms=Di();Object.defineProperty(G,"SarifResultBuilder",{enumerable:!0,get:function(){return ms.SarifResultBuilder}});var ps=Oi();Object.defineProperty(G,"SarifRuleBuilder",{enumerable:!0,get:function(){return ps.SarifRuleBuilder}});var ds=Fi();Object.defineProperty(G,"SarifRunBuilder",{enumerable:!0,get:function(){return ds.SarifRunBuilder}})});var Ii=S(($a,Ti)=>{"use strict";var ys=/["'&<>]/;Ti.exports=hs;function hs(t){var e=""+t,r=ys.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Qe=require("zx"),ae=require("fs/promises");var W={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var Pe=class{allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=Dt(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=en(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=ze(o.detectedBy,r),o.components=ze(o.components,e.components[0]),o.refs=ze(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push({id:i.id,severity:i.severity});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function en(t,e){return Dt(t,e)>0?t:e}function Dt(t,e){return W[t]-W[e]}function ze(t,e){return e?Array.from(new Set([...t,e]).values()):t}var ke=Ye(require("path"));var $=require("fs/promises"),Ze=require("path");async function B(t){if(await ne(t))return JSON.parse(await(0,$.readFile)(t,{encoding:"utf-8"}))}async function Ot(t,e){await(0,$.writeFile)(t,JSON.stringify(e,null,4)+`
9
+ `,{encoding:"utf-8"})}function J(t){return t&&t.replace(/\?.*$/,"")}async function ne(t){try{return await(0,$.access)(t,$.constants.F_OK),!0}catch{return!1}}async function et(t){let e=(0,Ze.resolve)(t),r=await(0,$.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,Ze.resolve)(i.parentPath,i.name);i.isDirectory()?await et(n):await(0,$.rm)(n)}await(0,$.rmdir)(e)}async function de(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function Ft(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=K(t.workingDir,"input/vex"),i=K(t.workingDir,"output"),n=K(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=K(t.workingDir,"vuln-scan-conf.json"),c=await B(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);return{projectConfigFileLocation:s,failOnNewVulnerabilities:c.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:c.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:K(t.workingDir,c.vexDir)??r,outDir:K(t.workingDir,c.outDir)??i,cacheDir:K(t.workingDir,c.cacheDir)??n,scanners:c.scanners??o,projects:(c.projects??[]).map(u=>{let l=u;if(!l.name)throw new Error("Project name is missing on entry:"+JSON.stringify(l));if(!l.version)throw new Error("Project version is missing on entry:"+JSON.stringify(l));if(!l.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(l));return l.enabled==null&&(l.enabled=!0),l.silent==null&&(l.silent=!1),l.minimumSeverity||(l.minimumSeverity="UNKNOWN"),l.sbomFile?{...l,sbomFile:K(t.workingDir,l.sbomFile)}:u})}}function K(t,e){if(e)return ke.default.isAbsolute(e)?e:(0,ke.resolve)(t,e)}var te=Ye(ji());var Mi=Ye(Ii());function Ni(t,e){let r=new te.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=gs(o.severity),c=o.id,u=Ss(o.refs),l=new te.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,f,p="new",m="";a?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(f[0].status="underReview",m="--- UNDER INVESTIGATION --- ")):W[e.minimumSeverity]>W[o.severity]?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(f=[{kind:"external",status:"accepted"}],p="updated",m="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${m}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:vs(o,u,m)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let d of o.components){let h=new te.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});h.result.message.id="default",h.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],h.result.baselineState=p,h.result.suppressions=f,r.addResult(h)}}let n=new te.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function Ss(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function gs(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function vs(t,e,r){let i=t.vexStatement,n=i?`
10
10
  ${r}
11
11
  ${i.justification??""}
12
12
  ${i.impact_statement??""}
@@ -22,9 +22,9 @@ ${(0,Mi.default)(t.description)}
22
22
 
23
23
  ${t.refs.map(o=>`* <${o}>`).join(`
24
24
  `)}
25
- `}var Xe=require("fs/promises");async function Ni(t,e,r){if("sbomFile"in t)return await(0,Xe.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Xe.writeFile)(e,i),{...t,sbomFile:e}}var $e=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await pe(i,this.authn);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await pe(r,this.authn)).text();return ws(n,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function ws(t,e){if(e.classifier&&e.extension){let n=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(n?.[1])return n[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),i=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!i)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${i[1]}`}var Be=require("fs/promises"),wt=require("path");var bt=class{constructor(e){this.location=e}async read(){let e=await B(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await Dt(this.location,e)}async delete(){await(0,Be.unlink)(this.location)}};async function Ai(t,e){for(let r of await(0,Be.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new bt((0,wt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await Ai((0,wt.resolve)(r.parentPath,r.name),e)}function bs(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var de=class t{statements=[];filteredToProduct;static async fromUrl(e,r,i=new t){let o=await(await pe(e,r)).json();return i.add(o),i}static async fromFiles(e,r=new t){return await Ai(e,async i=>{let n=await i.read();r.add(n)}),r}add(e){xs(e);let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=bs(i),c=new Set(i.products?.map(l=>l["@id"]).filter(l=>!!l)??[]),u=new xt(n,o,s,c,i);this.statements.push(u)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProduct)return this;let r=new t;return r.filteredToProduct=e,r.statements=this.statements.filter(i=>i.matchesProduct(e)),r}findNotMatchingVulnerabilities(e,r){let i=this.filterByProduct(r??this.filteredToProduct),n=new Set;for(let o of i.statements)n.add(o.vulnName);for(let o of e)n.delete(o);return Array.from(n)}newestVulnerabilityStatement(e,r){let i=this.filterByProduct(r??this.filteredToProduct);for(let n of i.statements)if(n.matchesVulnerability(e))return this.reduceToProductInformation(n.statement,i.filteredToProduct)}toVexFileForProduct(e){let r=this.filterByProduct(e??this.filteredToProduct),i=r.statements[0]?.statement.timestamp??new Date().toISOString(),n=r.statements.map(o=>r.reduceToProductInformation(o.statement)).filter(o=>o.status!=="under_investigation");if(n.length!==0)return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:i,last_updated:i,version:1,statements:n}}assertCorrectProductId(e){if(!e)throw new Error("Product ID must be provided");if(this.filteredToProduct&&this.filteredToProduct!==e)throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){return r=r??this.filteredToProduct,{...e,products:e.products?.filter(i=>i["@id"]===r)}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}},xt=class{constructor(e,r,i,n,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=i;this.products=n;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesVulnerability(e){return this.vulnAliases.has(e)}};function xs(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}var Ge=require("path"),Ri=require("fs/promises");var Ue=class{constructor(e,r,i){this.project=e;this.outputDir=r;this.useSubDirForProject=i}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",i=`${this.project.name}-${this.project.version}-`,n=this.getFileSuffix(e),o=(0,Ge.resolve)(this.outputDir,r,`${i}${n}`),s=(0,Ge.dirname)(o);return await ne(s)||await(0,Ri.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};var Lt=require("zx");var We=require("path"),Vi="anchore/grype:latest";async function _i(t){let e=await Lt.$`docker run --rm -v '${t}:/.cache' ${Vi} db update`;e.stdout&&console.log(` Grype DB Update: ${e.stdout}`),e.stderr&&console.log(` Grype DB Update error: ${e.stderr}`)}async function qi(t,e,r,i,n){let o=(0,We.dirname)(e),s=(0,We.basename)(e),c=await Lt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' -e GRYPE_DB_AUTO_UPDATE=false ${Vi} sbom:/tmp/input.json -o json --file '/tmp/output/${s}' --by-cve --quiet`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(` Grype output file: ${e}`);let u=await B(e);Ls(i,u)}function Ls(t,e){if(e)for(let r of e.matches){let i=Ps(r);t.addVulnerability(i,"grype")}}function Ps(t){let e=t.vulnerability,r=e.id,i=J(t.artifact.purl),n=J(e.dataSource),o=ks(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[i],detectedBy:["grype"],refs:[n]}}function ks(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var $i=require("fs/promises");async function Xi(t,e,r,i,n){let o={},s="";r.user&&r.token&&(o.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,s="/authorized");let c=`https://ossindex.sonatype.org/api/v3${s}/component-report`,u=await Es(e.sbomFile),l=new Set(u.map(d=>d.purl.replace(/\?.*$/,"")));Is(l);let a=Array.from(l),m=[];for(let d=0;d<a.length;d+=128){let f=JSON.stringify({coordinates:a.slice(d,d+128)}),h=await(await fetch(c,{method:"POST",headers:{...o,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:f})).json();Array.isArray(h)?m.push(...h.filter(v=>v.vulnerabilities.length>0)):n(` Sonatype OssIndex Error: ${h.code} - ${h.message}`)}await(0,$i.writeFile)(t,JSON.stringify(m,null,2)),n(` Sonatype OssIndex output file: ${t}`),Fs(i,m)}async function Es(t){return(await B(t)).components.filter(r=>Os(r)&&!Ds(r))}function Os(t){return!!t.purl}function Ds(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function Fs(t,e){if(e)for(let r of e)for(let i of r.vulnerabilities){let n=js(i,r.coordinates);t.addVulnerability(n,"ossindex")}}function js(t,e){let r=t.cve||t.id,i=J(e),n=J(t.reference),o=Ts(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[i],detectedBy:["ossindex"],refs:n?[n]:[]}}function Ts(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function Is(t){let e=Array.from(t);for(let r of e){let i=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(i)}}var Pt=require("zx");var Je=require("path"),Bi="aquasec/trivy:latest";async function Ui(t,e){let r=[];e&&(r.push("-e"),r.push(`GITHUB_TOKEN=${e}`));let i=[];i.push("--db-repository"),i.push("public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db");let n=await Pt.$`docker run --rm -v '${t}:/.cache' ${r} ${Bi} ${i} --cache-dir '/.cache' sbom --download-db-only --quiet`;!n.stdout&&!n.stderr&&console.log(" Trivy DB Update: finished"),n.stdout&&console.log(` Trivy DB Update: ${n.stdout}`),n.stderr&&console.log(` Trivy DB Update error: ${n.stderr}`)}async function Gi(t,e,r,i,n){let o=(0,Je.dirname)(e),s=(0,Je.basename)(e),c=await Pt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' ${Bi} sbom --cache-dir '/.cache' --format json --output '/tmp/output/${s}' --quiet --skip-db-update /tmp/input.json`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(` Trivy output file: ${e}`);let u=await B(e);Ms(i,u)}function Ms(t,e){if(e){for(let r of e.Results)if(r.Vulnerabilities)for(let i of r.Vulnerabilities){let n=Cs(i);t.addVulnerability(n,"trivy")}}}function Cs(t){let e=t.VulnerabilityID,r=J(t.PkgIdentifier.PURL),i=J(t.PrimaryURL),n=Ns(t.Severity);return{id:e,severity:n,scannerSeverity:{trivy:n},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[i]}}function Ns(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var He=class{constructor(e,r,i){this.scannerNames=e;this.cacheDir=r;this.options=i}async init(){let e=[];for(let r of this.scannerNames)switch(r){case"grype":e.push(_i(this.cacheDir));break;case"trivy":e.push(Ui(this.cacheDir,this.options.trivyGithubToken));break;case"ossindex":continue}await Promise.all(e)}async scanProject(e,r,i,n){let o=[];for(let s of this.scannerNames)o.push(this.scanProjectBy(s,e,r,this.cacheDir,i,this.options.ossIndexApiUser,this.options.ossIndexApiToken,n));await Promise.all(o)}async scanProjectBy(e,r,i,n,o,s,c,u){switch(e){case"grype":return qi(n,await i.lookupOutputFileForWriting("grype-results"),r,o,u);case"trivy":return Gi(n,await i.lookupOutputFileForWriting("trivy-results"),r,o,u);case"ossindex":return Xi(await i.lookupOutputFileForWriting("ossindex-results"),r,{user:s,token:c},o,u)}}};Qe.os.type().startsWith("Windows")&&(0,Qe.usePowerShell)();async function Wi(t){let e=await Ft(t),r=e.cacheDir;await ne(r)||await(0,ae.mkdir)(r);let i=e.outDir;await ne(i)&&await et(i),await(0,ae.mkdir)(i);let n=await qs(e,{user:t.vexUrlsUser,pw:t.vexUrlsPw}),o=new $e(e.mavenRepo,{user:t.mavenRepoUser,pw:t.mavenRepoPw}),s=$s(e,t,r),c=Date.now();console.log("Initializing scanner engines ..."),await s.init(),console.log(`Scanner engines initialization took ${Date.now()-c}ms
26
- `);let u=Xs(t),l=e.projects,a=new Map,m=Date.now();console.log("Scanning projects ...");let d=1,f=0,p=[];for(let b of l){if(!u(b))continue;f>=d&&(await Promise.race(p),--f);let N=new Ue(b,i,e.createSubDirsForProject),O=[],ie=Le=>{O.push(Le)};p.push(As(b,N,o,s,n,ie,a,t,O)),++f}await Promise.all(p),console.log(`Scanning took ${Date.now()-m}ms`);let h=Rs(a);return t.mode!=="test"&&(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&!e.failOnNewVulnerabilities&&console.log("##vso[task.complete result=SucceededWithIssues;]NEW_VULNERABILITIES_DETECTED"),h.hasError||(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&e.failOnNewVulnerabilities?1:0}async function As(t,e,r,i,n,o,s,c,u){try{let{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}=await Vs(t,e,r,i,n,o);s.set(t.purl,{project:t,newVulns:l,noLongerDetectedVulns:a})}catch(l){let a=l;s.set(t.purl,{project:t,error:a.message,newVulns:[],noLongerDetectedVulns:[]})}if(c.verbose)for(let l of u)console.log(l)}function Rs(t){let e=!1,r=!1,i=!1;console.log(`
27
- Scan results:`);for(let[n,o]of t){let s=o.project,c=s.silent,u=W[s.minimumSeverity];if(console.log(` ${s.name} - ${s.version} (${n}):`),o.error&&(console.error(` Error: ${o.error}`),e=!0),!c&&o.newVulns.length){console.log(" New vulnerabilities:");for(let l of o.newVulns)u>W[l.severity]||(r=!0,console.log(` [${l.severity}] ${l.id}`))}if(!c&&o.noLongerDetectedVulns.length){i=!0,console.log(" No longer detected vulnerabilities");for(let l of o.noLongerDetectedVulns)console.log(` ${l}`)}}return!e&&!r&&!i&&console.log(" No issues found"),{hasError:e,hasNewVuln:r,hasNoLongerDetectedVuln:i}}async function Vs(t,e,r,i,n,o){let s=await Ni(t,await e.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),r);o(`Analyzing project: ${s.name} - ${s.version} - ${s.sbomFile}`);let c=new Pe;await i.scanProject(s,e,c,o);let u=n.filterByProduct(s.purl),{unmatchedVulnerabilities:l}=c.enhanceWithVexData(u),a=u.findNotMatchingVulnerabilities(c.getAllVulnIds());return await _s(e,s,c,u,o),{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}}async function _s(t,e,r,i,n){let o=r.getAllVulnerabilitiesSortedBySeverity(),s=await t.lookupOutputFileForWriting("aggregate-results");await(0,ae.writeFile)(s,JSON.stringify(o,null,2)),n(` Vulnerabilities output file: ${s}`);let c=await t.lookupOutputFileForWriting("aggregated-sarif-results"),u=Ci(o,e);await(0,ae.writeFile)(c,JSON.stringify(u,null,2)),n(` Vuln Sarif output file: ${c}`);let l=i.toVexFileForProduct();if(!l)return;let a=await t.lookupOutputFileForWriting("project-openvex-file");await(0,ae.writeFile)(a,JSON.stringify(l,null,2)),n(` OpenVex file: ${a}`)}async function qs(t,e){let r=t.vexDir,i;await ne(r)?i=await de.fromFiles(r):i=new de;for(let n of t.vexUrls)await de.fromUrl(n,e,i);return i}function $s(t,e,r){if(e.scannerEngine)return e.scannerEngine;if(t.scanners.length===0)throw new Error("No scanners configured");return new He(t.scanners,r,e)}function Xs(t){let{reduceToProjectName:e,reduceToProjectVersion:r}=t;return i=>!(!i.enabled||e&&(i.name!==e||r&&i.version!==r))}var re=process.env;(async()=>{let t=await Wi({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:re.OSS_INDEX_API_USER,ossIndexApiToken:re.OSS_INDEX_API_TOKEN,mavenRepoUser:re.MAVEN_REPO_USER,mavenRepoPw:re.MAVEN_REPO_PW,trivyGithubToken:re.TRIVY_GITHUB_TOKEN,vexUrlsUser:re.VEX_URLS_USER,vexUrlsPw:re.VEX_URLS_PW,verbose:re.VERBOSE==="true"});process.exit(t)})();
25
+ `}var Xe=require("fs/promises");async function Ci(t,e,r){if("sbomFile"in t)return await(0,Xe.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Xe.writeFile)(e,i),{...t,sbomFile:e}}var $e=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await de(i,this.authn);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await de(r,this.authn)).text();return ws(n,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function ws(t,e){if(e.classifier&&e.extension){let n=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(n?.[1])return n[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),i=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!i)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${i[1]}`}var Be=require("fs/promises"),wt=require("path");var bt=class{constructor(e){this.location=e}async read(){let e=await B(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await Ot(this.location,e)}async delete(){await(0,Be.unlink)(this.location)}};async function Ai(t,e){for(let r of await(0,Be.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new bt((0,wt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await Ai((0,wt.resolve)(r.parentPath,r.name),e)}function bs(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var pe=class t{statements=[];filteredToProduct;static async fromUrl(e,r,i=new t){let o=await(await de(e,r)).json();return i.add(o),i}static async fromFiles(e,r=new t){return await Ai(e,async i=>{let n=await i.read();r.add(n)}),r}add(e){xs(e);let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=bs(i),c=new Set(i.products?.map(l=>l["@id"]).filter(l=>!!l)??[]),u=new xt(n,o,s,c,i);this.statements.push(u)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProduct)return this;let r=new t;return r.filteredToProduct=e,r.statements=this.statements.filter(i=>i.matchesProduct(e)),r}findNotMatchingVulnerabilities(e,r){let i=this.filterByProduct(r??this.filteredToProduct),n=new Set;for(let o of i.statements)n.add(o.vulnName);for(let o of e)n.delete(o);return Array.from(n)}newestVulnerabilityStatement(e,r){let i=this.filterByProduct(r??this.filteredToProduct);for(let n of i.statements)if(n.matchesVulnerability(e))return this.reduceToProductInformation({timestamp:new Date(n.timestamp).toISOString(),...n.statement},i.filteredToProduct)}toVexFile(e){let r=e.filter(n=>n.status!=="under_investigation");if(r.length===0)return;this.sortVexStatementsByTimestampNewestFirst(r);let i=r[0].timestamp;return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:i,last_updated:i,version:1,statements:r}}assertCorrectProductId(e){if(!e)throw new Error("Product ID must be provided");if(this.filteredToProduct&&this.filteredToProduct!==e)throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){return r=r??this.filteredToProduct,{...e,products:e.products?.filter(i=>i["@id"]===r)}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}sortVexStatementsByTimestampNewestFirst(e){e.sort((r,i)=>Date.parse(i.timestamp)-Date.parse(r.timestamp))}},xt=class{constructor(e,r,i,n,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=i;this.products=n;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesVulnerability(e){return this.vulnAliases.has(e)}};function xs(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}var Ge=require("path"),Ri=require("fs/promises");var Ue=class{constructor(e,r,i){this.project=e;this.outputDir=r;this.useSubDirForProject=i}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",i=`${this.project.name}-${this.project.version}-`,n=this.getFileSuffix(e),o=(0,Ge.resolve)(this.outputDir,r,`${i}${n}`),s=(0,Ge.dirname)(o);return await ne(s)||await(0,Ri.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};var Lt=require("zx");var We=require("path"),Vi="anchore/grype:latest";async function _i(t){let e=await Lt.$`docker run --rm -v '${t}:/.cache' ${Vi} db update`;e.stdout&&console.log(` Grype DB Update: ${e.stdout}`),e.stderr&&console.log(` Grype DB Update error: ${e.stderr}`)}async function qi(t,e,r,i,n){let o=(0,We.dirname)(e),s=(0,We.basename)(e),c=await Lt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' -e GRYPE_DB_AUTO_UPDATE=false ${Vi} sbom:/tmp/input.json -o json --file '/tmp/output/${s}' --by-cve --quiet`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(` Grype output file: ${e}`);let u=await B(e);Ls(i,u)}function Ls(t,e){if(e)for(let r of e.matches){let i=Ps(r);t.addVulnerability(i,"grype")}}function Ps(t){let e=t.vulnerability,r=e.id,i=J(t.artifact.purl),n=J(e.dataSource),o=ks(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[i],detectedBy:["grype"],refs:[n]}}function ks(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var $i=require("fs/promises");async function Xi(t,e,r,i,n){let o={},s="";r.user&&r.token&&(o.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,s="/authorized");let c=`https://ossindex.sonatype.org/api/v3${s}/component-report`,u=await Es(e.sbomFile),l=new Set(u.map(p=>p.purl.replace(/\?.*$/,"")));Is(l);let a=Array.from(l),f=[];for(let p=0;p<a.length;p+=128){let m=JSON.stringify({coordinates:a.slice(p,p+128)}),h=await(await fetch(c,{method:"POST",headers:{...o,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:m})).json();Array.isArray(h)?f.push(...h.filter(v=>v.vulnerabilities.length>0)):n(` Sonatype OssIndex Error: ${h.code} - ${h.message}`)}await(0,$i.writeFile)(t,JSON.stringify(f,null,2)),n(` Sonatype OssIndex output file: ${t}`),Fs(i,f)}async function Es(t){return(await B(t)).components.filter(r=>Ds(r)&&!Os(r))}function Ds(t){return!!t.purl}function Os(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function Fs(t,e){if(e)for(let r of e)for(let i of r.vulnerabilities){let n=js(i,r.coordinates);t.addVulnerability(n,"ossindex")}}function js(t,e){let r=t.cve||t.id,i=J(e),n=J(t.reference),o=Ts(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[i],detectedBy:["ossindex"],refs:n?[n]:[]}}function Ts(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function Is(t){let e=Array.from(t);for(let r of e){let i=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(i)}}var Pt=require("zx");var Je=require("path"),Bi="aquasec/trivy:latest";async function Ui(t,e){let r=[];e&&(r.push("-e"),r.push(`GITHUB_TOKEN=${e}`));let i=[];i.push("--db-repository"),i.push("public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db");let n=await Pt.$`docker run --rm -v '${t}:/.cache' ${r} ${Bi} ${i} --cache-dir '/.cache' sbom --download-db-only --quiet`;!n.stdout&&!n.stderr&&console.log(" Trivy DB Update: finished"),n.stdout&&console.log(` Trivy DB Update: ${n.stdout}`),n.stderr&&console.log(` Trivy DB Update error: ${n.stderr}`)}async function Gi(t,e,r,i,n){let o=(0,Je.dirname)(e),s=(0,Je.basename)(e),c=await Pt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' ${Bi} sbom --cache-dir '/.cache' --format json --output '/tmp/output/${s}' --quiet --skip-db-update /tmp/input.json`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(` Trivy output file: ${e}`);let u=await B(e);Ms(i,u)}function Ms(t,e){if(e){for(let r of e.Results)if(r.Vulnerabilities)for(let i of r.Vulnerabilities){let n=Ns(i);t.addVulnerability(n,"trivy")}}}function Ns(t){let e=t.VulnerabilityID,r=J(t.PkgIdentifier.PURL),i=J(t.PrimaryURL),n=Cs(t.Severity);return{id:e,severity:n,scannerSeverity:{trivy:n},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[i]}}function Cs(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var He=class{constructor(e,r,i){this.scannerNames=e;this.cacheDir=r;this.options=i}async init(){let e=[];for(let r of this.scannerNames)switch(r){case"grype":e.push(_i(this.cacheDir));break;case"trivy":e.push(Ui(this.cacheDir,this.options.trivyGithubToken));break;case"ossindex":continue}await Promise.all(e)}async scanProject(e,r,i,n){let o=[];for(let s of this.scannerNames)o.push(this.scanProjectBy(s,e,r,this.cacheDir,i,this.options.ossIndexApiUser,this.options.ossIndexApiToken,n));await Promise.all(o)}async scanProjectBy(e,r,i,n,o,s,c,u){switch(e){case"grype":return qi(n,await i.lookupOutputFileForWriting("grype-results"),r,o,u);case"trivy":return Gi(n,await i.lookupOutputFileForWriting("trivy-results"),r,o,u);case"ossindex":return Xi(await i.lookupOutputFileForWriting("ossindex-results"),r,{user:s,token:c},o,u)}}};Qe.os.type().startsWith("Windows")&&(0,Qe.usePowerShell)();async function Wi(t){let e=await Ft(t),r=e.cacheDir;await ne(r)||await(0,ae.mkdir)(r);let i=e.outDir;await ne(i)&&await et(i),await(0,ae.mkdir)(i);let n=await $s(e,{user:t.vexUrlsUser,pw:t.vexUrlsPw}),o=new $e(e.mavenRepo,{user:t.mavenRepoUser,pw:t.mavenRepoPw}),s=Xs(e,t,r),c=Date.now();console.log("Initializing scanner engines ..."),await s.init(),console.log(`Scanner engines initialization took ${Date.now()-c}ms
26
+ `);let u=Bs(t),l=e.projects,a=new Map,f=Date.now();console.log("Scanning projects ...");let p=1,m=0,d=[];for(let b of l){if(!u(b))continue;m>=p&&(await Promise.race(d),--m);let C=new Ue(b,i,e.createSubDirsForProject),D=[],ie=Le=>{D.push(Le)};d.push(As(b,C,o,s,n,ie,a,t,D)),++m}await Promise.all(d),console.log(`Scanning took ${Date.now()-f}ms`);let h=Rs(a,e.reportNoLongerDetectedVulnerabilities);return t.mode!=="test"&&(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&!e.failOnNewVulnerabilities&&console.log("##vso[task.complete result=SucceededWithIssues;]NEW_VULNERABILITIES_DETECTED"),h.hasError||(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&e.failOnNewVulnerabilities?1:0}async function As(t,e,r,i,n,o,s,c,u){try{let{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}=await _s(t,e,r,i,n,o);s.set(t.purl,{project:t,newVulns:l,noLongerDetectedVulns:a})}catch(l){let a=l;s.set(t.purl,{project:t,error:a.message,newVulns:[],noLongerDetectedVulns:[]})}if(c.verbose)for(let l of u)console.log(l)}function Rs(t,e){let r=!1,i=!1,n=!1;console.log(`
27
+ Scan results:`);for(let o of t.values()){let s=Vs(o,e);r=r||s.hasError,i=i||s.hasNewVuln,n=n||s.hasNoLongerDetectedVuln}return!r&&!i&&!n&&console.log(" No issues found"),{hasError:r,hasNewVuln:i,hasNoLongerDetectedVuln:n}}function Vs(t,e){let r=t.project,i=r.purl,n=r.silent,o=W[r.minimumSeverity],s=!!t.error,c=n?[]:t.newVulns.filter(l=>o<=W[l.severity]),u=n||!e?[]:t.noLongerDetectedVulns;if(!s&&!c.length&&!u.length)return{hasError:s,hasNewVuln:!1,hasNoLongerDetectedVuln:!1};if(console.log(` ${r.name} - ${r.version} (${i}):`),t.error&&console.error(` Error: ${t.error}`),c.length){console.log(" New vulnerabilities:");for(let l of c)console.log(` [${l.severity}] ${l.id}`)}if(u.length){console.log(" No longer detected vulnerabilities");for(let l of u)console.log(` ${l}`)}return{hasError:s,hasNewVuln:c.length>0,hasNoLongerDetectedVuln:u.length>0}}async function _s(t,e,r,i,n,o){let s=await Ci(t,await e.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),r);o(`Analyzing project: ${s.name} - ${s.version} - ${s.sbomFile}`);let c=new Pe;await i.scanProject(s,e,c,o);let u=n.filterByProduct(s.purl),{unmatchedVulnerabilities:l}=c.enhanceWithVexData(u),a=u.findNotMatchingVulnerabilities(c.getAllVulnIds());return await qs(e,s,c,u,o),{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}}async function qs(t,e,r,i,n){let o=r.getAllVulnerabilitiesSortedBySeverity(),s=await t.lookupOutputFileForWriting("aggregate-results");await(0,ae.writeFile)(s,JSON.stringify(o,null,2)),n(` Vulnerabilities output file: ${s}`);let c=await t.lookupOutputFileForWriting("aggregated-sarif-results"),u=Ni(o,e);await(0,ae.writeFile)(c,JSON.stringify(u,null,2)),n(` Vuln Sarif output file: ${c}`);let l=i.toVexFile(o.map(f=>f.vexStatement).filter(f=>!!f));if(!l)return;let a=await t.lookupOutputFileForWriting("project-openvex-file");await(0,ae.writeFile)(a,JSON.stringify(l,null,2)),n(` OpenVex file: ${a}`)}async function $s(t,e){let r=t.vexDir,i;await ne(r)?i=await pe.fromFiles(r):i=new pe;for(let n of t.vexUrls)await pe.fromUrl(n,e,i);return i}function Xs(t,e,r){if(e.scannerEngine)return e.scannerEngine;if(t.scanners.length===0)throw new Error("No scanners configured");return new He(t.scanners,r,e)}function Bs(t){let{reduceToProjectName:e,reduceToProjectVersion:r}=t;return i=>!(!i.enabled||e&&(i.name!==e||r&&i.version!==r))}var re=process.env;(async()=>{let t=await Wi({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:re.OSS_INDEX_API_USER,ossIndexApiToken:re.OSS_INDEX_API_TOKEN,mavenRepoUser:re.MAVEN_REPO_USER,mavenRepoPw:re.MAVEN_REPO_PW,trivyGithubToken:re.TRIVY_GITHUB_TOKEN,vexUrlsUser:re.VEX_URLS_USER,vexUrlsPw:re.VEX_URLS_PW,verbose:re.VERBOSE==="true"});process.exit(t)})();
28
28
  /*! Bundled license information:
29
29
 
30
30
  escape-html/index.js:
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@conterra/vuln-scan",
3
- "version": "0.0.14",
3
+ "version": "0.0.15",
4
4
  "description": "con terra vulnerability scan process",
5
5
  "author": "con terra GmbH",
6
6
  "license": "Apache-2.0",