npm - @conterra/vuln-scan - Versions diffs - 0.0.14 → 0.0.16 - Mend

@conterra/vuln-scan 0.0.14 → 0.0.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/README.md +3 -0
package/dist/add-project.js +2 -2
package/dist/add-statement.js +10 -10
package/dist/remove-project.js +2 -2
package/dist/schema/conf-schema.json +4 -0
package/dist/vuln-scan.js +10 -10
package/package.json +1 -1

package/README.md CHANGED Viewed

@@ -211,6 +211,9 @@ TRIVY_GITHUB_TOKEN=[token]
 # (optional) to enable verbose logging, otherwise only scan results are printed
 VERBOSE=true
+# (optional) flag to enable automatic removal of unused statements in the vex files, during a scan.
+AUTO_REMOVE_UNUSED_STATEMENTS=true
 ```
 For each project following files are created in the `output` folder:

package/dist/add-project.js CHANGED Viewed

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-"use strict";var j=Object.create;var P=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var D=Object.getOwnPropertyNames;var T=Object.getPrototypeOf,V=Object.prototype.hasOwnProperty;var N=(t,e,r,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of D(e))!V.call(t,i)&&i!==r&&P(t,i,{get:()=>e[i],enumerable:!(o=E(e,i))||o.enumerable});return t};var O=(t,e,r)=>(r=t!=null?j(T(t)):{},N(e||!t||!t.__esModule?P(r,"default",{value:t,enumerable:!0}):r,t));var p=O(require("path"));var f=require("fs/promises");async function u(t){if(await C(t))return JSON.parse(await(0,f.readFile)(t,{encoding:"utf-8"}))}async function l(t,e){await(0,f.writeFile)(t,JSON.stringify(e,null,4)+`
-`,{encoding:"utf-8"})}async function C(t){try{return await(0,f.access)(t,f.constants.F_OK),!0}catch{return!1}}async function y(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=d(t.workingDir,"input/vex"),o=d(t.workingDir,"output"),i=d(t.workingDir,"cache"),a=["grype","trivy","ossindex"],c=d(t.workingDir,"vuln-scan-conf.json"),n=await u(c);if(!n)throw new Error(`Missing project configuration file '${c}'`);return{projectConfigFileLocation:c,failOnNewVulnerabilities:!1,createSubDirsForProject:n.createSubDirsForProject??!0,mavenRepo:n.mavenRepo??e,vexUrls:n.vexUrls??[],vexDir:d(t.workingDir,n.vexDir)??r,outDir:d(t.workingDir,n.outDir)??o,cacheDir:d(t.workingDir,n.cacheDir)??i,scanners:n.scanners??a,projects:(n.projects??[]).map(m=>{let s=m;if(!s.name)throw new Error("Project name is missing on entry:"+JSON.stringify(s));if(!s.version)throw new Error("Project version is missing on entry:"+JSON.stringify(s));if(!s.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(s));return s.enabled==null&&(s.enabled=!0),s.silent==null&&(s.silent=!1),s.minimumSeverity||(s.minimumSeverity="UNKNOWN"),s.sbomFile?{...s,sbomFile:d(t.workingDir,s.sbomFile)}:m})}}function d(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await u(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await l(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await h((0,g.resolve)(r.parentPath,r.name),e)}async function S({workingDir:t,projectName:e,referenceProjectVersion:r,targetProjectVersion:o}){let i=await y({workingDir:t});if(!i.projectConfigFileLocation)throw new Error("Missing project configuration file.");let a=i.projects.find(n=>n.name===e&&n.version===r);if(!a)throw new Error(`Project ${e} with version ${r} not found.`);let c=i.projects.find(n=>n.name===e&&n.version===o);c||(c=await k(e,i.projectConfigFileLocation,a,o)),await A(i.vexDir,a.purl,c.purl)}async function k(t,e,r,o){let i=await u(e),a=i.projects.find(m=>m.name===r.name&&m.version===r.version),c=i.projects.indexOf(a),n={...a};return n.version=o,n.purl=a.purl.replace(a.version,o),n.sbomMavenCoordinates&&(n.sbomMavenCoordinates=a.sbomMavenCoordinates.replace(a.version,o)),i.projects.splice(c+1,0,n),console.info(`Add project ${t} with version ${o} to ${e}`),await l(e,i),n}async function A(t,e,r){await h(t,async o=>{await $(o,e,r)})}async function $(t,e,r){let o=await t.read(),i=!1,a=o.statements;for(let c of a){if(!c.products||c.products.some(m=>m["@id"]===r))continue;let n=c.products.findIndex(m=>m["@id"]===e);n!==-1&&(c.products?.splice(n+1,0,{"@id":r}),i=!0)}i&&(console.info(`Add ${r} to ${t.location}`),t.write(o))}var x=process.argv[2];if(!x)throw new Error("Missing project name.");var b=process.argv[3];if(!b)throw new Error("Missing reference project version.");var F=process.argv[4];if(!F)throw new Error("Missing target project version.");(async()=>await S({workingDir:process.cwd(),projectName:x,referenceProjectVersion:b,targetProjectVersion:F}))();
+"use strict";var j=Object.create;var P=Object.defineProperty;var D=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var N=(t,e,i,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of E(e))!T.call(t,n)&&n!==i&&P(t,n,{get:()=>e[n],enumerable:!(o=D(e,n))||o.enumerable});return t};var O=(t,e,i)=>(i=t!=null?j(V(t)):{},N(e||!t||!t.__esModule?P(i,"default",{value:t,enumerable:!0}):i,t));var p=O(require("path"));var f=require("fs/promises");async function l(t){if(await C(t))return JSON.parse(await(0,f.readFile)(t,{encoding:"utf-8"}))}async function u(t,e){await(0,f.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}async function C(t){try{return await(0,f.access)(t,f.constants.F_OK),!0}catch{return!1}}async function S(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",i=d(t.workingDir,"input/vex"),o=d(t.workingDir,"output"),n=d(t.workingDir,"cache"),a=["grype","trivy","ossindex"],c=d(t.workingDir,"vuln-scan-conf.json"),r=await l(c);if(!r)throw new Error(`Missing project configuration file '${c}'`);return{projectConfigFileLocation:c,failOnNewVulnerabilities:r.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:r.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:r.createSubDirsForProject??!0,mavenRepo:r.mavenRepo??e,vexUrls:r.vexUrls??[],vexDir:d(t.workingDir,r.vexDir)??i,outDir:d(t.workingDir,r.outDir)??o,cacheDir:d(t.workingDir,r.cacheDir)??n,scanners:r.scanners??a,projects:(r.projects??[]).map(m=>{let s=m;if(!s.name)throw new Error("Project name is missing on entry:"+JSON.stringify(s));if(!s.version)throw new Error("Project version is missing on entry:"+JSON.stringify(s));if(!s.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(s));return s.enabled==null&&(s.enabled=!0),s.silent==null&&(s.silent=!1),s.minimumSeverity||(s.minimumSeverity="UNKNOWN"),s.sbomFile?{...s,sbomFile:d(t.workingDir,s.sbomFile)}:m})}}function d(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await l(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await u(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let i of await(0,w.readdir)(t,{withFileTypes:!0}))i.name.endsWith(".json")?await e(new v((0,g.resolve)(i.parentPath,i.name))):i.isDirectory()&&await h((0,g.resolve)(i.parentPath,i.name),e)}async function y({workingDir:t,projectName:e,referenceProjectVersion:i,targetProjectVersion:o}){let n=await S({workingDir:t});if(!n.projectConfigFileLocation)throw new Error("Missing project configuration file.");let a=n.projects.find(r=>r.name===e&&r.version===i);if(!a)throw new Error(`Project ${e} with version ${i} not found.`);let c=n.projects.find(r=>r.name===e&&r.version===o);c||(c=await k(e,n.projectConfigFileLocation,a,o)),await A(n.vexDir,a.purl,c.purl)}async function k(t,e,i,o){let n=await l(e),a=n.projects.find(m=>m.name===i.name&&m.version===i.version),c=n.projects.indexOf(a),r={...a};return r.version=o,r.purl=a.purl.replace(a.version,o),r.sbomMavenCoordinates&&(r.sbomMavenCoordinates=a.sbomMavenCoordinates.replace(a.version,o)),n.projects.splice(c+1,0,r),console.info(`Add project ${t} with version ${o} to ${e}`),await u(e,n),r}async function A(t,e,i){await h(t,async o=>{await $(o,e,i)})}async function $(t,e,i){let o=await t.read(),n=!1,a=o.statements;for(let c of a){if(!c.products||c.products.some(m=>m["@id"]===i))continue;let r=c.products.findIndex(m=>m["@id"]===e);r!==-1&&(c.products?.splice(r+1,0,{"@id":i}),n=!0)}n&&(console.info(`Add ${i} to ${t.location}`),t.write(o))}var b=process.argv[2];if(!b)throw new Error("Missing project name.");var x=process.argv[3];if(!x)throw new Error("Missing reference project version.");var F=process.argv[4];if(!F)throw new Error("Missing target project version.");(async()=>await y({workingDir:process.cwd(),projectName:b,referenceProjectVersion:x,targetProjectVersion:F}))();

package/dist/add-statement.js CHANGED Viewed

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
-"use strict";var E=Object.create;var x=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var A=Object.getPrototypeOf,C=Object.prototype.hasOwnProperty;var I=(t,e,r,m)=>{if(e&&typeof e=="object"||typeof e=="function")for(let a of $(e))!C.call(t,a)&&a!==r&&x(t,a,{get:()=>e[a],enumerable:!(m=k(e,a))||m.enumerable});return t};var D=(t,e,r)=>(r=t!=null?E(A(t)):{},I(e||!t||!t.__esModule?x(r,"default",{value:t,enumerable:!0}):r,t));var F=D(require("node:readline/promises")),j=require("node:process");var _=D(require("path"));var c=require("fs/promises");async function v(t){if(await O(t))return JSON.parse(await(0,c.readFile)(t,{encoding:"utf-8"}))}async function O(t){try{return await(0,c.access)(t,c.constants.F_OK),!0}catch{return!1}}async function b(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=f(t.workingDir,"input/vex"),m=f(t.workingDir,"output"),a=f(t.workingDir,"cache"),y=["grype","trivy","ossindex"],p=f(t.workingDir,"vuln-scan-conf.json"),o=await v(p);if(!o)throw new Error(`Missing project configuration file '${p}'`);return{projectConfigFileLocation:p,failOnNewVulnerabilities:!1,createSubDirsForProject:o.createSubDirsForProject??!0,mavenRepo:o.mavenRepo??e,vexUrls:o.vexUrls??[],vexDir:f(t.workingDir,o.vexDir)??r,outDir:f(t.workingDir,o.outDir)??m,cacheDir:f(t.workingDir,o.cacheDir)??a,scanners:o.scanners??y,projects:(o.projects??[]).map(l=>{let i=l;if(!i.name)throw new Error("Project name is missing on entry:"+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry:"+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(i));return i.enabled==null&&(i.enabled=!0),i.silent==null&&(i.silent=!1),i.minimumSeverity||(i.minimumSeverity="UNKNOWN"),i.sbomFile?{...i,sbomFile:f(t.workingDir,i.sbomFile)}:l})}}function f(t,e){if(e)return _.default.isAbsolute(e)?e:(0,_.resolve)(t,e)}var h=require("path");var P=require("fs/promises"),N=require("crypto");(async()=>{let t=await b({workingDir:process.cwd()});console.info("## Add New VEX Statement ##");let e=F.default.createInterface({input:j.stdin,output:j.stdout}),r=await e.question(`CVE name (e.g. CVE-2023-52070):
-> `);r||(console.log("Please provide a CVE name."),process.exit(1));let m=t.projects.map(n=>`${n.name}@${n.version}`),a=await e.question(`Projects to add? Available are:
+"use strict";var E=Object.create;var b=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var A=Object.getPrototypeOf,O=Object.prototype.hasOwnProperty;var C=(e,t,r,m)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of $(t))!O.call(e,a)&&a!==r&&b(e,a,{get:()=>t[a],enumerable:!(m=k(t,a))||m.enumerable});return e};var x=(e,t,r)=>(r=e!=null?E(A(e)):{},C(t||!e||!e.__esModule?b(r,"default",{value:e,enumerable:!0}):r,e));var F=x(require("node:readline/promises")),j=require("node:process");var _=x(require("path"));var c=require("fs/promises");async function v(e){if(await I(e))return JSON.parse(await(0,c.readFile)(e,{encoding:"utf-8"}))}async function I(e){try{return await(0,c.access)(e,c.constants.F_OK),!0}catch{return!1}}async function D(e){let t="https://repository.conterra.de/repository/maven-mirror-ct",r=f(e.workingDir,"input/vex"),m=f(e.workingDir,"output"),a=f(e.workingDir,"cache"),y=["grype","trivy","ossindex"],p=f(e.workingDir,"vuln-scan-conf.json"),o=await v(p);if(!o)throw new Error(`Missing project configuration file '${p}'`);return{projectConfigFileLocation:p,failOnNewVulnerabilities:o.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:o.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:o.createSubDirsForProject??!0,mavenRepo:o.mavenRepo??t,vexUrls:o.vexUrls??[],vexDir:f(e.workingDir,o.vexDir)??r,outDir:f(e.workingDir,o.outDir)??m,cacheDir:f(e.workingDir,o.cacheDir)??a,scanners:o.scanners??y,projects:(o.projects??[]).map(l=>{let i=l;if(!i.name)throw new Error("Project name is missing on entry:"+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry:"+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(i));return i.enabled==null&&(i.enabled=!0),i.silent==null&&(i.silent=!1),i.minimumSeverity||(i.minimumSeverity="UNKNOWN"),i.sbomFile?{...i,sbomFile:f(e.workingDir,i.sbomFile)}:l})}}function f(e,t){if(t)return _.default.isAbsolute(t)?t:(0,_.resolve)(e,t)}var h=require("path");var P=require("fs/promises"),N=require("crypto");(async()=>{let e=await D({workingDir:process.cwd()});console.info("## Add New VEX Statement ##");let t=F.default.createInterface({input:j.stdin,output:j.stdout}),r=await t.question(`CVE name (e.g. CVE-2023-52070):
+> `);r||(console.log("Please provide a CVE name."),process.exit(1));let m=e.projects.map(n=>`${n.name}@${n.version}`),a=await t.question(`Projects to add? Available are:
 - ${m.join(`
 - `)}
  You can list multiple projects separated by comma:
-> `);a||(console.log("Please provide projects to add."),process.exit(1));let y=a.split(/\s*,\s*/).map(n=>{let s=n.split("@");return{name:s[0],version:s[1]}}),p=new Set(function*(){for(let n of y)for(let s of t.projects)s.name===n.name&&s.version===n.version&&(yield s.purl)}()),o=(0,h.resolve)(t.vexDir,`${r}.json`),l=await v(o),i=["under_investigation","affected","fixed","not_affected"],d=await e.question(`Status? Available are:
+> `);a||(console.log("Please provide projects to add."),process.exit(1));let y=a.split(/\s*,\s*/).map(n=>{let s=n.split("@");return{name:s[0],version:s[1]}}),p=new Set(function*(){for(let n of y)for(let s of e.projects)s.name===n.name&&s.version===n.version&&(yield s.purl)}()),o=(0,h.resolve)(e.vexDir,`${r}.json`),l=await v(o),i=["under_investigation","affected","fixed","not_affected"],d=await t.question(`Status? Available are:
 - ${i.join(`,
 - `)}
-> `);i.includes(d)||(d?(console.log("Invalid status."),process.exit(1)):d="under_investigation");let u={};switch(d){case"affected":{let n=await e.question(`Action statement? (required):
-> `);n||(console.log("Please provide an action statement."),process.exit(1)),u.action_statement=n;break}case"not_affected":{let n=["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist"],s=await e.question(`Justification? Available are:
+> `);i.includes(d)||(d?(console.log("Invalid status."),process.exit(1)):d="under_investigation");let u={};switch(d){case"affected":{let n=await t.question(`Action statement? (required):
+> `);n||(console.log("Please provide an action statement."),process.exit(1)),u.action_statement=n;break}case"not_affected":{let n=["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist"],s=await t.question(`Justification? Available are:
 - ${n.join(`,
 - `)}
-> (optional) `);if(s)if(!n.includes(s))console.log("Invalid justification."),process.exit(1);else{u.justification=s;let g=await e.question(`Impact statement? (optional):
-> `);g&&(u.impact_statement=g)}else{let g=await e.question(`Impact statement? (required):
-> `);g||(console.log("Please provide an impact statement."),process.exit(1)),u.impact_statement=g}break}case"fixed":{let n=await e.question(`Status note? (optional):
-> `);n&&(u.status_notes=n);break}}let w=new Date().toISOString(),S={vulnerability:{name:r},timestamp:w,products:Array.from(p).map(n=>({"@id":n})),status:d,...u};(await e.question(`Following statement will be added to ${o}:
+> (optional) `);if(s)if(!n.includes(s))console.log("Invalid justification."),process.exit(1);else{u.justification=s;let g=await t.question(`Impact statement? (optional):
+> `);g&&(u.impact_statement=g)}else{let g=await t.question(`Impact statement? (required):
+> `);g||(console.log("Please provide an impact statement."),process.exit(1)),u.impact_statement=g}break}case"fixed":{let n=await t.question(`Status note? (optional):
+> `);n&&(u.status_notes=n);break}}let w=new Date().toISOString(),S={vulnerability:{name:r},timestamp:w,products:Array.from(p).map(n=>({"@id":n})),status:d,...u};(await t.question(`Following statement will be added to ${o}:
 ${JSON.stringify(S,null,2)}
 Do you want to proceed? (y/n)?
-> `)).toLowerCase()!=="y"&&(console.log("Aborted."),process.exit(0)),l?(l.last_updated=w,l.version+=1,l.statements.push(S)):l={"@context":"https://openvex.dev/ns/v0.2.0","@id":`https://openvex.dev/docs/public/vex-${(0,N.randomUUID)()}`,author:"conterra",timestamp:w,last_updated:w,version:1,statements:[S]},await(0,P.writeFile)(o,JSON.stringify(l,null,2)),e.close()})();
+> `)).toLowerCase()!=="y"&&(console.log("Aborted."),process.exit(0)),l?(l.last_updated=w,l.version+=1,l.statements.push(S)):l={"@context":"https://openvex.dev/ns/v0.2.0","@id":`https://openvex.dev/docs/public/vex-${(0,N.randomUUID)()}`,author:"conterra",timestamp:w,last_updated:w,version:1,statements:[S]},await(0,P.writeFile)(o,JSON.stringify(l,null,2)),t.close()})();

package/dist/remove-project.js CHANGED Viewed

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-"use strict";var j=Object.create;var P=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var T=Object.getOwnPropertyNames;var N=Object.getPrototypeOf,V=Object.prototype.hasOwnProperty;var O=(t,e,r,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of T(e))!V.call(t,i)&&i!==r&&P(t,i,{get:()=>e[i],enumerable:!(o=E(e,i))||o.enumerable});return t};var $=(t,e,r)=>(r=t!=null?j(N(t)):{},O(e||!t||!t.__esModule?P(r,"default",{value:t,enumerable:!0}):r,t));var p=$(require("path"));var f=require("fs/promises");async function l(t){if(await C(t))return JSON.parse(await(0,f.readFile)(t,{encoding:"utf-8"}))}async function d(t,e){await(0,f.writeFile)(t,JSON.stringify(e,null,4)+`
-`,{encoding:"utf-8"})}async function C(t){try{return await(0,f.access)(t,f.constants.F_OK),!0}catch{return!1}}async function S(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=u(t.workingDir,"input/vex"),o=u(t.workingDir,"output"),i=u(t.workingDir,"cache"),m=["grype","trivy","ossindex"],a=u(t.workingDir,"vuln-scan-conf.json"),s=await l(a);if(!s)throw new Error(`Missing project configuration file '${a}'`);return{projectConfigFileLocation:a,failOnNewVulnerabilities:!1,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??e,vexUrls:s.vexUrls??[],vexDir:u(t.workingDir,s.vexDir)??r,outDir:u(t.workingDir,s.outDir)??o,cacheDir:u(t.workingDir,s.cacheDir)??i,scanners:s.scanners??m,projects:(s.projects??[]).map(c=>{let n=c;if(!n.name)throw new Error("Project name is missing on entry:"+JSON.stringify(n));if(!n.version)throw new Error("Project version is missing on entry:"+JSON.stringify(n));if(!n.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(n));return n.enabled==null&&(n.enabled=!0),n.silent==null&&(n.silent=!1),n.minimumSeverity||(n.minimumSeverity="UNKNOWN"),n.sbomFile?{...n,sbomFile:u(t.workingDir,n.sbomFile)}:c})}}function u(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await l(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await d(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await h((0,g.resolve)(r.parentPath,r.name),e)}function y(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}async function F({workingDir:t,projectName:e,projectVersion:r,vulnId:o}){let i=await S({workingDir:t});if(!i.projectConfigFileLocation)throw new Error("Missing project configuration file.");let m=i.projects.find(a=>a.name===e&&a.version===r);if(!m){console.info(`Project ${e} with version ${r} not found.`);return}o||await k(i.projectConfigFileLocation,m),await U(i.vexDir,m.purl,o)}async function k(t,e){let r=await l(t),o=r.projects.findIndex(i=>i.name===e.name&&i.version===e.version);r.projects.splice(o,1),console.info(`Remove project ${e.name} with version ${e.version} from ${t}`),await d(t,r)}async function U(t,e,r){await h(t,async o=>{let i=await o.read(),m=!1,a=i.statements,s=[];for(let c of a){if(r&&!y(c).has(r)||!c.products)continue;let n=c.products.findIndex(D=>D["@id"]===e);n!==-1&&(c.products.splice(n,1),m=!0,c.products.length===0&&s.push(c))}if(m){for(let c of s){let n=a.indexOf(c);a.splice(n,1)}if(a.length===0){console.info(`Remove ${e} from ${o.location} and delete file.`),await o.delete();return}console.info(`Remove ${e} from ${o.location}`),await o.write(i)}})}var x=process.argv[2];if(!x)throw new Error("Missing project name.");var b=process.argv[3];if(!b)throw new Error("Missing project version.");var I=process.argv[4];(async()=>await F({workingDir:process.cwd(),projectName:x,projectVersion:b,vulnId:I}))();
+"use strict";var j=Object.create;var S=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var N=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var O=(t,e,r,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of N(e))!T.call(t,n)&&n!==r&&S(t,n,{get:()=>e[n],enumerable:!(o=E(e,n))||o.enumerable});return t};var $=(t,e,r)=>(r=t!=null?j(V(t)):{},O(e||!t||!t.__esModule?S(r,"default",{value:t,enumerable:!0}):r,t));var p=$(require("path"));var m=require("fs/promises");async function u(t){if(await C(t))return JSON.parse(await(0,m.readFile)(t,{encoding:"utf-8"}))}async function d(t,e){await(0,m.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}async function C(t){try{return await(0,m.access)(t,m.constants.F_OK),!0}catch{return!1}}async function y(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=l(t.workingDir,"input/vex"),o=l(t.workingDir,"output"),n=l(t.workingDir,"cache"),f=["grype","trivy","ossindex"],a=l(t.workingDir,"vuln-scan-conf.json"),s=await u(a);if(!s)throw new Error(`Missing project configuration file '${a}'`);return{projectConfigFileLocation:a,failOnNewVulnerabilities:s.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:s.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??e,vexUrls:s.vexUrls??[],vexDir:l(t.workingDir,s.vexDir)??r,outDir:l(t.workingDir,s.outDir)??o,cacheDir:l(t.workingDir,s.cacheDir)??n,scanners:s.scanners??f,projects:(s.projects??[]).map(c=>{let i=c;if(!i.name)throw new Error("Project name is missing on entry:"+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry:"+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(i));return i.enabled==null&&(i.enabled=!0),i.silent==null&&(i.silent=!1),i.minimumSeverity||(i.minimumSeverity="UNKNOWN"),i.sbomFile?{...i,sbomFile:l(t.workingDir,i.sbomFile)}:c})}}function l(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await u(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await d(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await h((0,g.resolve)(r.parentPath,r.name),e)}function P(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}async function F({workingDir:t,projectName:e,projectVersion:r,vulnId:o}){let n=await y({workingDir:t});if(!n.projectConfigFileLocation)throw new Error("Missing project configuration file.");let f=n.projects.find(a=>a.name===e&&a.version===r);if(!f){console.info(`Project ${e} with version ${r} not found.`);return}o||await k(n.projectConfigFileLocation,f),await U(n.vexDir,f.purl,o)}async function k(t,e){let r=await u(t),o=r.projects.findIndex(n=>n.name===e.name&&n.version===e.version);r.projects.splice(o,1),console.info(`Remove project ${e.name} with version ${e.version} from ${t}`),await d(t,r)}async function U(t,e,r){await h(t,async o=>{let n=await o.read(),f=!1,a=n.statements,s=[];for(let c of a){if(r&&!P(c).has(r)||!c.products)continue;let i=c.products.findIndex(D=>D["@id"]===e);i!==-1&&(c.products.splice(i,1),f=!0,c.products.length===0&&s.push(c))}if(f){for(let c of s){let i=a.indexOf(c);a.splice(i,1)}if(a.length===0){console.info(`Remove ${e} from ${o.location} and delete file.`),await o.delete();return}console.info(`Remove ${e} from ${o.location}`),await o.write(n)}})}var x=process.argv[2];if(!x)throw new Error("Missing project name.");var b=process.argv[3];if(!b)throw new Error("Missing project version.");var A=process.argv[4];(async()=>await F({workingDir:process.cwd(),projectName:x,projectVersion:b,vulnId:A}))();

package/dist/schema/conf-schema.json CHANGED Viewed

@@ -6,6 +6,10 @@
             "type": "boolean",
             "default": false
         },
+        "reportNoLongerDetectedVulnerabilities": {
+            "type": "boolean",
+            "default": true
+        },
         "mavenRepo": {
             "type": "string",
             "format": "uri",

package/dist/vuln-scan.js CHANGED Viewed

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-"use strict";var Hi=Object.create;var Et=Object.defineProperty;var Qi=Object.getOwnPropertyDescriptor;var Ki=Object.getOwnPropertyNames;var Yi=Object.getPrototypeOf,zi=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Zi=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Ki(e))!zi.call(t,n)&&n!==r&&Et(t,n,{get:()=>e[n],enumerable:!(i=Qi(e,n))||i.enumerable});return t};var Ye=(t,e,r)=>(r=t!=null?Hi(Yi(t)):{},Zi(e||!t||!t.__esModule?Et(r,"default",{value:t,enumerable:!0}):r,t));var F=S(tt=>{"use strict";tt.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};tt.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var Tt=S((ea,jt)=>{var Y=require("constants"),tn=process.cwd,Ee=null,rn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Ee||(Ee=tn.call(process)),Ee};try{process.cwd()}catch{}typeof process.chdir=="function"&&(rt=process.chdir,process.chdir=function(t){Ee=null,rt.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,rt));var rt;jt.exports=nn;function nn(t){Y.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=i(t.chmod),t.fchmod=i(t.fchmod),t.lchmod=i(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=n(t.chmodSync),t.fchmodSync=n(t.fchmodSync),t.lchmodSync=n(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=u(t.statSync),t.fstatSync=u(t.fstatSync),t.lstatSync=u(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,m,d){d&&process.nextTick(d)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,m,d,f){f&&process.nextTick(f)},t.lchownSync=function(){}),rn==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:function(a){function m(d,f,p){var h=Date.now(),v=0;a(d,f,function b(N){if(N&&(N.code==="EACCES"||N.code==="EPERM"||N.code==="EBUSY")&&Date.now()-h<6e4){setTimeout(function(){t.stat(f,function(O,ie){O&&O.code==="ENOENT"?a(d,f,b):p(N)})},v),v<100&&(v+=10);return}p&&p(N)})}return Object.setPrototypeOf&&Object.setPrototypeOf(m,a),m}(t.rename)),t.read=typeof t.read!="function"?t.read:function(a){function m(d,f,p,h,v,b){var N;if(b&&typeof b=="function"){var O=0;N=function(ie,Le,kt){if(ie&&ie.code==="EAGAIN"&&O<10)return O++,a.call(t,d,f,p,h,v,N);b.apply(this,arguments)}}return a.call(t,d,f,p,h,v,N)}return Object.setPrototypeOf&&Object.setPrototypeOf(m,a),m}(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:function(a){return function(m,d,f,p,h){for(var v=0;;)try{return a.call(t,m,d,f,p,h)}catch(b){if(b.code==="EAGAIN"&&v<10){v++;continue}throw b}}}(t.readSync);function e(a){a.lchmod=function(m,d,f){a.open(m,Y.O_WRONLY|Y.O_SYMLINK,d,function(p,h){if(p){f&&f(p);return}a.fchmod(h,d,function(v){a.close(h,function(b){f&&f(v||b)})})})},a.lchmodSync=function(m,d){var f=a.openSync(m,Y.O_WRONLY|Y.O_SYMLINK,d),p=!0,h;try{h=a.fchmodSync(f,d),p=!1}finally{if(p)try{a.closeSync(f)}catch{}else a.closeSync(f)}return h}}function r(a){Y.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(m,d,f,p){a.open(m,Y.O_SYMLINK,function(h,v){if(h){p&&p(h);return}a.futimes(v,d,f,function(b){a.close(v,function(N){p&&p(b||N)})})})},a.lutimesSync=function(m,d,f){var p=a.openSync(m,Y.O_SYMLINK),h,v=!0;try{h=a.futimesSync(p,d,f),v=!1}finally{if(v)try{a.closeSync(p)}catch{}else a.closeSync(p)}return h}):a.futimes&&(a.lutimes=function(m,d,f,p){p&&process.nextTick(p)},a.lutimesSync=function(){})}function i(a){return a&&function(m,d,f){return a.call(t,m,d,function(p){l(p)&&(p=null),f&&f.apply(this,arguments)})}}function n(a){return a&&function(m,d){try{return a.call(t,m,d)}catch(f){if(!l(f))throw f}}}function o(a){return a&&function(m,d,f,p){return a.call(t,m,d,f,function(h){l(h)&&(h=null),p&&p.apply(this,arguments)})}}function s(a){return a&&function(m,d,f){try{return a.call(t,m,d,f)}catch(p){if(!l(p))throw p}}}function c(a){return a&&function(m,d,f){typeof d=="function"&&(f=d,d=null);function p(h,v){v&&(v.uid<0&&(v.uid+=4294967296),v.gid<0&&(v.gid+=4294967296)),f&&f.apply(this,arguments)}return d?a.call(t,m,d,p):a.call(t,m,p)}}function u(a){return a&&function(m,d){var f=d?a.call(t,m,d):a.call(t,m);return f&&(f.uid<0&&(f.uid+=4294967296),f.gid<0&&(f.gid+=4294967296)),f}}function l(a){if(!a||a.code==="ENOSYS")return!0;var m=!process.getuid||process.getuid()!==0;return!!(m&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Ct=S((ta,Mt)=>{var It=require("stream").Stream;Mt.exports=on;function on(t){return{ReadStream:e,WriteStream:r};function e(i,n){if(!(this instanceof e))return new e(i,n);It.call(this);var o=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,n=n||{};for(var s=Object.keys(n),c=0,u=s.length;c<u;c++){var l=s[c];this[l]=n[l]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,m){if(a){o.emit("error",a),o.readable=!1;return}o.fd=m,o.emit("open",m),o._read()})}function r(i,n){if(!(this instanceof r))return new r(i,n);It.call(this),this.path=i,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,n=n||{};for(var o=Object.keys(n),s=0,c=o.length;s<c;s++){var u=o[s];this[u]=n[u]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var At=S((ra,Nt)=>{"use strict";Nt.exports=an;var sn=Object.getPrototypeOf||function(t){return t.__proto__};function an(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:sn(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var le=S((ia,ot)=>{var k=require("fs"),cn=Tt(),ln=Ct(),un=At(),Oe=require("util"),C,Fe;typeof Symbol=="function"&&typeof Symbol.for=="function"?(C=Symbol.for("graceful-fs.queue"),Fe=Symbol.for("graceful-fs.previous")):(C="___graceful-fs.queue",Fe="___graceful-fs.previous");function fn(){}function _t(t,e){Object.defineProperty(t,C,{get:function(){return e}})}var oe=fn;Oe.debuglog?oe=Oe.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(oe=function(){var t=Oe.format.apply(Oe,arguments);t="GFS4: "+t.split(/\n/).join(`
-GFS4: `),console.error(t)});k[C]||(Rt=global[C]||[],_t(k,Rt),k.close=function(t){function e(r,i){return t.call(k,r,function(n){n||Vt(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,Fe,{value:t}),e}(k.close),k.closeSync=function(t){function e(r){t.apply(k,arguments),Vt()}return Object.defineProperty(e,Fe,{value:t}),e}(k.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){oe(k[C]),require("assert").equal(k[C].length,0)}));var Rt;global[C]||_t(global,k[C]);ot.exports=it(un(k));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!k.__patched&&(ot.exports=it(k),k.__patched=!0);function it(t){cn(t),t.gracefulify=it,t.createReadStream=Le,t.createWriteStream=kt;var e=t.readFile;t.readFile=r;function r(y,w,g){return typeof w=="function"&&(g=w,w=null),T(y,w,g);function T(I,D,P,E){return e(I,D,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?ce([T,[I,D,P],x,E||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,x,M){return i(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,x,M){return o(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(y,w,g,T){return typeof g=="function"&&(T=g,g=0),I(y,w,g,T);function I(D,P,E,x,M){return c(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var l=t.readdir;t.readdir=m;var a=/^v[0-5]\./;function m(y,w,g){typeof w=="function"&&(g=w,w=null);var T=a.test(process.version)?function(P,E,x,M){return l(P,I(P,E,x,M))}:function(P,E,x,M){return l(P,E,I(P,E,x,M))};return T(y,w,g);function I(D,P,E,x){return function(M,L){M&&(M.code==="EMFILE"||M.code==="ENFILE")?ce([T,[D,P,E],M,x||Date.now(),Date.now()]):(L&&L.sort&&L.sort(),typeof E=="function"&&E.call(this,M,L))}}}if(process.version.substr(0,4)==="v0.8"){var d=ln(t);b=d.ReadStream,O=d.WriteStream}var f=t.ReadStream;f&&(b.prototype=Object.create(f.prototype),b.prototype.open=N);var p=t.WriteStream;p&&(O.prototype=Object.create(p.prototype),O.prototype.open=ie),Object.defineProperty(t,"ReadStream",{get:function(){return b},set:function(y){b=y},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return O},set:function(y){O=y},enumerable:!0,configurable:!0});var h=b;Object.defineProperty(t,"FileReadStream",{get:function(){return h},set:function(y){h=y},enumerable:!0,configurable:!0});var v=O;Object.defineProperty(t,"FileWriteStream",{get:function(){return v},set:function(y){v=y},enumerable:!0,configurable:!0});function b(y,w){return this instanceof b?(f.apply(this,arguments),this):b.apply(Object.create(b.prototype),arguments)}function N(){var y=this;Ke(y.path,y.flags,y.mode,function(w,g){w?(y.autoClose&&y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g),y.read())})}function O(y,w){return this instanceof O?(p.apply(this,arguments),this):O.apply(Object.create(O.prototype),arguments)}function ie(){var y=this;Ke(y.path,y.flags,y.mode,function(w,g){w?(y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g))})}function Le(y,w){return new t.ReadStream(y,w)}function kt(y,w){return new t.WriteStream(y,w)}var Ji=t.open;t.open=Ke;function Ke(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,x,M){return Ji(D,P,E,function(L,Bs){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}return t}function ce(t){oe("ENQUEUE",t[0].name,t[1]),k[C].push(t),nt()}var De;function Vt(){for(var t=Date.now(),e=0;e<k[C].length;++e)k[C][e].length>2&&(k[C][e][3]=t,k[C][e][4]=t);nt()}function nt(){if(clearTimeout(De),De=void 0,k[C].length!==0){var t=k[C].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)oe("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){oe("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,u=Math.max(o-n,1),l=Math.min(u*1.2,100);c>=l?(oe("RETRY",e.name,r),e.apply(null,r.concat([n]))):k[C].push(t)}De===void 0&&(De=setTimeout(nt,0))}}});var V=S(H=>{"use strict";var qt=F().fromCallback,R=le(),mn=["access","appendFile","chmod","chown","close","copyFile","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","lchmod","lchown","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof R[t]=="function");Object.assign(H,R);mn.forEach(t=>{H[t]=qt(R[t])});H.exists=function(t,e){return typeof e=="function"?R.exists(t,e):new Promise(r=>R.exists(t,r))};H.read=function(t,e,r,i,n,o){return typeof o=="function"?R.read(t,e,r,i,n,o):new Promise((s,c)=>{R.read(t,e,r,i,n,(u,l,a)=>{if(u)return c(u);s({bytesRead:l,buffer:a})})})};H.write=function(t,e,...r){return typeof r[r.length-1]=="function"?R.write(t,e,...r):new Promise((i,n)=>{R.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};H.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?R.readv(t,e,...r):new Promise((i,n)=>{R.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};H.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?R.writev(t,e,...r):new Promise((i,n)=>{R.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof R.realpath.native=="function"?H.realpath.native=qt(R.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Xt=S((oa,$t)=>{"use strict";var dn=require("path");$t.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(dn.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var Wt=S((sa,st)=>{"use strict";var Bt=V(),{checkPath:Ut}=Xt(),Gt=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};st.exports.makeDir=async(t,e)=>(Ut(t),Bt.mkdir(t,{mode:Gt(e),recursive:!0}));st.exports.makeDirSync=(t,e)=>(Ut(t),Bt.mkdirSync(t,{mode:Gt(e),recursive:!0}))});var X=S((aa,Jt)=>{"use strict";var pn=F().fromPromise,{makeDir:yn,makeDirSync:at}=Wt(),ct=pn(yn);Jt.exports={mkdirs:ct,mkdirsSync:at,mkdirp:ct,mkdirpSync:at,ensureDir:ct,ensureDirSync:at}});var z=S((ca,Qt)=>{"use strict";var hn=F().fromPromise,Ht=V();function Sn(t){return Ht.access(t).then(()=>!0).catch(()=>!1)}Qt.exports={pathExists:hn(Sn),pathExistsSync:Ht.existsSync}});var lt=S((la,Kt)=>{"use strict";var ue=V(),gn=F().fromPromise;async function vn(t,e,r){let i=await ue.open(t,"r+"),n=null;try{await ue.futimes(i,e,r)}finally{try{await ue.close(i)}catch(o){n=o}}if(n)throw n}function wn(t,e,r){let i=ue.openSync(t,"r+");return ue.futimesSync(i,e,r),ue.closeSync(i)}Kt.exports={utimesMillis:gn(vn),utimesMillisSync:wn}});var se=S((ua,er)=>{"use strict";var fe=V(),j=require("path"),Yt=F().fromPromise;function bn(t,e,r){let i=r.dereference?n=>fe.stat(n,{bigint:!0}):n=>fe.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function xn(t,e,r){let i,n=r.dereference?s=>fe.statSync(s,{bigint:!0}):s=>fe.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function Ln(t,e,r,i){let{srcStat:n,destStat:o}=await bn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&ut(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}function Pn(t,e,r,i){let{srcStat:n,destStat:o}=xn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&ut(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}async function zt(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=await fe.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return zt(t,e,o,i)}function Zt(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=fe.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return Zt(t,e,o,i)}function ye(t,e){return e.ino&&e.dev&&e.ino===t.ino&&e.dev===t.dev}function ut(t,e){let r=j.resolve(t).split(j.sep).filter(n=>n),i=j.resolve(e).split(j.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function je(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}er.exports={checkPaths:Yt(Ln),checkPathsSync:Pn,checkParentPaths:Yt(zt),checkParentPathsSync:Zt,isSrcSubdir:ut,areIdentical:ye}});var or=S((fa,nr)=>{"use strict";var A=V(),he=require("path"),{mkdirs:kn}=X(),{pathExists:En}=z(),{utimesMillis:On}=lt(),Se=se();async function Dn(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
+"use strict";var Ki=Object.create;var jt=Object.defineProperty;var Yi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Zi=Object.getPrototypeOf,en=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var tn=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of zi(e))!en.call(t,n)&&n!==r&&jt(t,n,{get:()=>e[n],enumerable:!(i=Yi(e,n))||i.enumerable});return t};var ze=(t,e,r)=>(r=t!=null?Ki(Zi(t)):{},tn(e||!t||!t.__esModule?jt(r,"default",{value:t,enumerable:!0}):r,t));var F=S(nt=>{"use strict";nt.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};nt.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var Mt=S((ia,It)=>{var z=require("constants"),nn=process.cwd,Ee=null,on=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Ee||(Ee=nn.call(process)),Ee};try{process.cwd()}catch{}typeof process.chdir=="function"&&(ot=process.chdir,process.chdir=function(t){Ee=null,ot.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,ot));var ot;It.exports=sn;function sn(t){z.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=i(t.chmod),t.fchmod=i(t.fchmod),t.lchmod=i(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=n(t.chmodSync),t.fchmodSync=n(t.fchmodSync),t.lchmodSync=n(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=u(t.statSync),t.fstatSync=u(t.fstatSync),t.lstatSync=u(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,f,p){p&&process.nextTick(p)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,f,p,m){m&&process.nextTick(m)},t.lchownSync=function(){}),on==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:function(a){function f(p,m,d){var h=Date.now(),v=0;a(p,m,function x(C){if(C&&(C.code==="EACCES"||C.code==="EPERM"||C.code==="EBUSY")&&Date.now()-h<6e4){setTimeout(function(){t.stat(m,function(O,ie){O&&O.code==="ENOENT"?a(p,m,x):d(C)})},v),v<100&&(v+=10);return}d&&d(C)})}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f}(t.rename)),t.read=typeof t.read!="function"?t.read:function(a){function f(p,m,d,h,v,x){var C;if(x&&typeof x=="function"){var O=0;C=function(ie,Le,Ft){if(ie&&ie.code==="EAGAIN"&&O<10)return O++,a.call(t,p,m,d,h,v,C);x.apply(this,arguments)}}return a.call(t,p,m,d,h,v,C)}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f}(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:function(a){return function(f,p,m,d,h){for(var v=0;;)try{return a.call(t,f,p,m,d,h)}catch(x){if(x.code==="EAGAIN"&&v<10){v++;continue}throw x}}}(t.readSync);function e(a){a.lchmod=function(f,p,m){a.open(f,z.O_WRONLY|z.O_SYMLINK,p,function(d,h){if(d){m&&m(d);return}a.fchmod(h,p,function(v){a.close(h,function(x){m&&m(v||x)})})})},a.lchmodSync=function(f,p){var m=a.openSync(f,z.O_WRONLY|z.O_SYMLINK,p),d=!0,h;try{h=a.fchmodSync(m,p),d=!1}finally{if(d)try{a.closeSync(m)}catch{}else a.closeSync(m)}return h}}function r(a){z.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(f,p,m,d){a.open(f,z.O_SYMLINK,function(h,v){if(h){d&&d(h);return}a.futimes(v,p,m,function(x){a.close(v,function(C){d&&d(x||C)})})})},a.lutimesSync=function(f,p,m){var d=a.openSync(f,z.O_SYMLINK),h,v=!0;try{h=a.futimesSync(d,p,m),v=!1}finally{if(v)try{a.closeSync(d)}catch{}else a.closeSync(d)}return h}):a.futimes&&(a.lutimes=function(f,p,m,d){d&&process.nextTick(d)},a.lutimesSync=function(){})}function i(a){return a&&function(f,p,m){return a.call(t,f,p,function(d){l(d)&&(d=null),m&&m.apply(this,arguments)})}}function n(a){return a&&function(f,p){try{return a.call(t,f,p)}catch(m){if(!l(m))throw m}}}function o(a){return a&&function(f,p,m,d){return a.call(t,f,p,m,function(h){l(h)&&(h=null),d&&d.apply(this,arguments)})}}function s(a){return a&&function(f,p,m){try{return a.call(t,f,p,m)}catch(d){if(!l(d))throw d}}}function c(a){return a&&function(f,p,m){typeof p=="function"&&(m=p,p=null);function d(h,v){v&&(v.uid<0&&(v.uid+=4294967296),v.gid<0&&(v.gid+=4294967296)),m&&m.apply(this,arguments)}return p?a.call(t,f,p,d):a.call(t,f,d)}}function u(a){return a&&function(f,p){var m=p?a.call(t,f,p):a.call(t,f);return m&&(m.uid<0&&(m.uid+=4294967296),m.gid<0&&(m.gid+=4294967296)),m}}function l(a){if(!a||a.code==="ENOSYS")return!0;var f=!process.getuid||process.getuid()!==0;return!!(f&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Rt=S((na,Ct)=>{var Nt=require("stream").Stream;Ct.exports=an;function an(t){return{ReadStream:e,WriteStream:r};function e(i,n){if(!(this instanceof e))return new e(i,n);Nt.call(this);var o=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,n=n||{};for(var s=Object.keys(n),c=0,u=s.length;c<u;c++){var l=s[c];this[l]=n[l]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,f){if(a){o.emit("error",a),o.readable=!1;return}o.fd=f,o.emit("open",f),o._read()})}function r(i,n){if(!(this instanceof r))return new r(i,n);Nt.call(this),this.path=i,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,n=n||{};for(var o=Object.keys(n),s=0,c=o.length;s<c;s++){var u=o[s];this[u]=n[u]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var Vt=S((oa,At)=>{"use strict";At.exports=ln;var cn=Object.getPrototypeOf||function(t){return t.__proto__};function ln(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:cn(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var le=S((sa,ct)=>{var k=require("fs"),un=Mt(),fn=Rt(),mn=Vt(),Oe=require("util"),N,Fe;typeof Symbol=="function"&&typeof Symbol.for=="function"?(N=Symbol.for("graceful-fs.queue"),Fe=Symbol.for("graceful-fs.previous")):(N="___graceful-fs.queue",Fe="___graceful-fs.previous");function pn(){}function qt(t,e){Object.defineProperty(t,N,{get:function(){return e}})}var oe=pn;Oe.debuglog?oe=Oe.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(oe=function(){var t=Oe.format.apply(Oe,arguments);t="GFS4: "+t.split(/\n/).join(`
+GFS4: `),console.error(t)});k[N]||(_t=global[N]||[],qt(k,_t),k.close=function(t){function e(r,i){return t.call(k,r,function(n){n||$t(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,Fe,{value:t}),e}(k.close),k.closeSync=function(t){function e(r){t.apply(k,arguments),$t()}return Object.defineProperty(e,Fe,{value:t}),e}(k.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){oe(k[N]),require("assert").equal(k[N].length,0)}));var _t;global[N]||qt(global,k[N]);ct.exports=st(mn(k));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!k.__patched&&(ct.exports=st(k),k.__patched=!0);function st(t){un(t),t.gracefulify=st,t.createReadStream=Le,t.createWriteStream=Ft;var e=t.readFile;t.readFile=r;function r(y,w,g){return typeof w=="function"&&(g=w,w=null),T(y,w,g);function T(I,D,P,E){return e(I,D,function(b){b&&(b.code==="EMFILE"||b.code==="ENFILE")?ce([T,[I,D,P],b,E||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,b,M){return i(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,b],L,M||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,b,M){return o(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,b],L,M||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(y,w,g,T){return typeof g=="function"&&(T=g,g=0),I(y,w,g,T);function I(D,P,E,b,M){return c(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,b],L,M||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var l=t.readdir;t.readdir=f;var a=/^v[0-5]\./;function f(y,w,g){typeof w=="function"&&(g=w,w=null);var T=a.test(process.version)?function(P,E,b,M){return l(P,I(P,E,b,M))}:function(P,E,b,M){return l(P,E,I(P,E,b,M))};return T(y,w,g);function I(D,P,E,b){return function(M,L){M&&(M.code==="EMFILE"||M.code==="ENFILE")?ce([T,[D,P,E],M,b||Date.now(),Date.now()]):(L&&L.sort&&L.sort(),typeof E=="function"&&E.call(this,M,L))}}}if(process.version.substr(0,4)==="v0.8"){var p=fn(t);x=p.ReadStream,O=p.WriteStream}var m=t.ReadStream;m&&(x.prototype=Object.create(m.prototype),x.prototype.open=C);var d=t.WriteStream;d&&(O.prototype=Object.create(d.prototype),O.prototype.open=ie),Object.defineProperty(t,"ReadStream",{get:function(){return x},set:function(y){x=y},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return O},set:function(y){O=y},enumerable:!0,configurable:!0});var h=x;Object.defineProperty(t,"FileReadStream",{get:function(){return h},set:function(y){h=y},enumerable:!0,configurable:!0});var v=O;Object.defineProperty(t,"FileWriteStream",{get:function(){return v},set:function(y){v=y},enumerable:!0,configurable:!0});function x(y,w){return this instanceof x?(m.apply(this,arguments),this):x.apply(Object.create(x.prototype),arguments)}function C(){var y=this;Ye(y.path,y.flags,y.mode,function(w,g){w?(y.autoClose&&y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g),y.read())})}function O(y,w){return this instanceof O?(d.apply(this,arguments),this):O.apply(Object.create(O.prototype),arguments)}function ie(){var y=this;Ye(y.path,y.flags,y.mode,function(w,g){w?(y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g))})}function Le(y,w){return new t.ReadStream(y,w)}function Ft(y,w){return new t.WriteStream(y,w)}var Qi=t.open;t.open=Ye;function Ye(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(D,P,E,b,M){return Qi(D,P,E,function(L,Js){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[D,P,E,b],L,M||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}return t}function ce(t){oe("ENQUEUE",t[0].name,t[1]),k[N].push(t),at()}var De;function $t(){for(var t=Date.now(),e=0;e<k[N].length;++e)k[N][e].length>2&&(k[N][e][3]=t,k[N][e][4]=t);at()}function at(){if(clearTimeout(De),De=void 0,k[N].length!==0){var t=k[N].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)oe("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){oe("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,u=Math.max(o-n,1),l=Math.min(u*1.2,100);c>=l?(oe("RETRY",e.name,r),e.apply(null,r.concat([n]))):k[N].push(t)}De===void 0&&(De=setTimeout(at,0))}}});var V=S(H=>{"use strict";var Xt=F().fromCallback,A=le(),dn=["access","appendFile","chmod","chown","close","copyFile","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","lchmod","lchown","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof A[t]=="function");Object.assign(H,A);dn.forEach(t=>{H[t]=Xt(A[t])});H.exists=function(t,e){return typeof e=="function"?A.exists(t,e):new Promise(r=>A.exists(t,r))};H.read=function(t,e,r,i,n,o){return typeof o=="function"?A.read(t,e,r,i,n,o):new Promise((s,c)=>{A.read(t,e,r,i,n,(u,l,a)=>{if(u)return c(u);s({bytesRead:l,buffer:a})})})};H.write=function(t,e,...r){return typeof r[r.length-1]=="function"?A.write(t,e,...r):new Promise((i,n)=>{A.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};H.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?A.readv(t,e,...r):new Promise((i,n)=>{A.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};H.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?A.writev(t,e,...r):new Promise((i,n)=>{A.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof A.realpath.native=="function"?H.realpath.native=Xt(A.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Bt=S((ca,Ut)=>{"use strict";var yn=require("path");Ut.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(yn.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var Ht=S((la,lt)=>{"use strict";var Gt=V(),{checkPath:Jt}=Bt(),Wt=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};lt.exports.makeDir=async(t,e)=>(Jt(t),Gt.mkdir(t,{mode:Wt(e),recursive:!0}));lt.exports.makeDirSync=(t,e)=>(Jt(t),Gt.mkdirSync(t,{mode:Wt(e),recursive:!0}))});var U=S((ua,Qt)=>{"use strict";var hn=F().fromPromise,{makeDir:Sn,makeDirSync:ut}=Ht(),ft=hn(Sn);Qt.exports={mkdirs:ft,mkdirsSync:ut,mkdirp:ft,mkdirpSync:ut,ensureDir:ft,ensureDirSync:ut}});var Z=S((fa,Yt)=>{"use strict";var gn=F().fromPromise,Kt=V();function vn(t){return Kt.access(t).then(()=>!0).catch(()=>!1)}Yt.exports={pathExists:gn(vn),pathExistsSync:Kt.existsSync}});var mt=S((ma,zt)=>{"use strict";var ue=V(),wn=F().fromPromise;async function xn(t,e,r){let i=await ue.open(t,"r+"),n=null;try{await ue.futimes(i,e,r)}finally{try{await ue.close(i)}catch(o){n=o}}if(n)throw n}function bn(t,e,r){let i=ue.openSync(t,"r+");return ue.futimesSync(i,e,r),ue.closeSync(i)}zt.exports={utimesMillis:wn(xn),utimesMillisSync:bn}});var se=S((pa,rr)=>{"use strict";var fe=V(),j=require("path"),Zt=F().fromPromise;function Ln(t,e,r){let i=r.dereference?n=>fe.stat(n,{bigint:!0}):n=>fe.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function Pn(t,e,r){let i,n=r.dereference?s=>fe.statSync(s,{bigint:!0}):s=>fe.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function kn(t,e,r,i){let{srcStat:n,destStat:o}=await Ln(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&pt(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}function En(t,e,r,i){let{srcStat:n,destStat:o}=Pn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&pt(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}async function er(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=await fe.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return er(t,e,o,i)}function tr(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=fe.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return tr(t,e,o,i)}function ye(t,e){return e.ino&&e.dev&&e.ino===t.ino&&e.dev===t.dev}function pt(t,e){let r=j.resolve(t).split(j.sep).filter(n=>n),i=j.resolve(e).split(j.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function je(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}rr.exports={checkPaths:Zt(kn),checkPathsSync:En,checkParentPaths:Zt(er),checkParentPathsSync:tr,isSrcSubdir:pt,areIdentical:ye}});var ar=S((da,sr)=>{"use strict";var R=V(),he=require("path"),{mkdirs:On}=U(),{pathExists:Dn}=Z(),{utimesMillis:Fn}=mt(),Se=se();async function jn(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
-	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await Se.checkPaths(t,e,"copy",r);if(await Se.checkParentPaths(t,i,e,"copy"),!await rr(t,e,r))return;let s=he.dirname(e);await En(s)||await kn(s),await ir(n,t,e,r)}async function rr(t,e,r){return r.filter?r.filter(t,e):!0}async function ir(t,e,r,i){let o=await(i.dereference?A.stat:A.lstat)(e);if(o.isDirectory())return In(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Fn(o,t,e,r,i);if(o.isSymbolicLink())return Mn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Fn(t,e,r,i,n){if(!e)return tr(t,r,i,n);if(n.overwrite)return await A.unlink(i),tr(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function tr(t,e,r,i){if(await A.copyFile(e,r),i.preserveTimestamps){jn(t.mode)&&await Tn(r,t.mode);let n=await A.stat(e);await On(r,n.atime,n.mtime)}return A.chmod(r,t.mode)}function jn(t){return(t&128)===0}function Tn(t,e){return A.chmod(t,e|128)}async function In(t,e,r,i,n){e||await A.mkdir(i);let o=await A.readdir(r);await Promise.all(o.map(async s=>{let c=he.join(r,s),u=he.join(i,s);if(!await rr(c,u,n))return;let{destStat:a}=await Se.checkPaths(c,u,"copy",n);return ir(a,c,u,n)})),e||await A.chmod(i,t.mode)}async function Mn(t,e,r,i){let n=await A.readlink(e);if(i.dereference&&(n=he.resolve(process.cwd(),n)),!t)return A.symlink(n,r);let o=null;try{o=await A.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return A.symlink(n,r);throw s}if(i.dereference&&(o=he.resolve(process.cwd(),o)),Se.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(Se.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await A.unlink(r),A.symlink(n,r)}nr.exports=Dn});var ur=S((ma,lr)=>{"use strict";var _=le(),ge=require("path"),Cn=X().mkdirsSync,Nn=lt().utimesMillisSync,ve=se();function An(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
+	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await Se.checkPaths(t,e,"copy",r);if(await Se.checkParentPaths(t,i,e,"copy"),!await nr(t,e,r))return;let s=he.dirname(e);await Dn(s)||await On(s),await or(n,t,e,r)}async function nr(t,e,r){return r.filter?r.filter(t,e):!0}async function or(t,e,r,i){let o=await(i.dereference?R.stat:R.lstat)(e);if(o.isDirectory())return Nn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Tn(o,t,e,r,i);if(o.isSymbolicLink())return Cn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Tn(t,e,r,i,n){if(!e)return ir(t,r,i,n);if(n.overwrite)return await R.unlink(i),ir(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function ir(t,e,r,i){if(await R.copyFile(e,r),i.preserveTimestamps){In(t.mode)&&await Mn(r,t.mode);let n=await R.stat(e);await Fn(r,n.atime,n.mtime)}return R.chmod(r,t.mode)}function In(t){return(t&128)===0}function Mn(t,e){return R.chmod(t,e|128)}async function Nn(t,e,r,i,n){e||await R.mkdir(i);let o=await R.readdir(r);await Promise.all(o.map(async s=>{let c=he.join(r,s),u=he.join(i,s);if(!await nr(c,u,n))return;let{destStat:a}=await Se.checkPaths(c,u,"copy",n);return or(a,c,u,n)})),e||await R.chmod(i,t.mode)}async function Cn(t,e,r,i){let n=await R.readlink(e);if(i.dereference&&(n=he.resolve(process.cwd(),n)),!t)return R.symlink(n,r);let o=null;try{o=await R.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return R.symlink(n,r);throw s}if(i.dereference&&(o=he.resolve(process.cwd(),o)),Se.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(Se.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await R.unlink(r),R.symlink(n,r)}sr.exports=jn});var mr=S((ya,fr)=>{"use strict";var _=le(),ge=require("path"),Rn=U().mkdirsSync,An=mt().utimesMillisSync,ve=se();function Vn(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
-	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ve.checkPathsSync(t,e,"copy",r);if(ve.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ge.dirname(e);return _.existsSync(o)||Cn(o),sr(n,t,e,r)}function sr(t,e,r,i){let o=(i.dereference?_.statSync:_.lstatSync)(e);if(o.isDirectory())return Bn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Rn(o,t,e,r,i);if(o.isSymbolicLink())return Wn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function Rn(t,e,r,i,n){return e?Vn(t,r,i,n):ar(t,r,i,n)}function Vn(t,e,r,i){if(i.overwrite)return _.unlinkSync(r),ar(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function ar(t,e,r,i){return _.copyFileSync(e,r),i.preserveTimestamps&&_n(t.mode,e,r),ft(r,t.mode)}function _n(t,e,r){return qn(t)&&$n(r,t),Xn(e,r)}function qn(t){return(t&128)===0}function $n(t,e){return ft(t,e|128)}function ft(t,e){return _.chmodSync(t,e)}function Xn(t,e){let r=_.statSync(t);return Nn(e,r.atime,r.mtime)}function Bn(t,e,r,i,n){return e?cr(r,i,n):Un(t.mode,r,i,n)}function Un(t,e,r,i){return _.mkdirSync(r),cr(e,r,i),ft(r,t)}function cr(t,e,r){_.readdirSync(t).forEach(i=>Gn(i,t,e,r))}function Gn(t,e,r,i){let n=ge.join(e,t),o=ge.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=ve.checkPathsSync(n,o,"copy",i);return sr(s,n,o,i)}function Wn(t,e,r,i){let n=_.readlinkSync(e);if(i.dereference&&(n=ge.resolve(process.cwd(),n)),t){let o;try{o=_.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return _.symlinkSync(n,r);throw s}if(i.dereference&&(o=ge.resolve(process.cwd(),o)),ve.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(ve.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return Jn(n,r)}else return _.symlinkSync(n,r)}function Jn(t,e){return _.unlinkSync(e),_.symlinkSync(t,e)}lr.exports=An});var Te=S((da,fr)=>{"use strict";var Hn=F().fromPromise;fr.exports={copy:Hn(or()),copySync:ur()}});var we=S((pa,dr)=>{"use strict";var mr=le(),Qn=F().fromCallback;function Kn(t,e){mr.rm(t,{recursive:!0,force:!0},e)}function Yn(t){mr.rmSync(t,{recursive:!0,force:!0})}dr.exports={remove:Qn(Kn),removeSync:Yn}});var br=S((ya,wr)=>{"use strict";var zn=F().fromPromise,hr=V(),Sr=require("path"),gr=X(),vr=we(),pr=zn(async function(e){let r;try{r=await hr.readdir(e)}catch{return gr.mkdirs(e)}return Promise.all(r.map(i=>vr.remove(Sr.join(e,i))))});function yr(t){let e;try{e=hr.readdirSync(t)}catch{return gr.mkdirsSync(t)}e.forEach(r=>{r=Sr.join(t,r),vr.removeSync(r)})}wr.exports={emptyDirSync:yr,emptydirSync:yr,emptyDir:pr,emptydir:pr}});var kr=S((ha,Pr)=>{"use strict";var Zn=F().fromPromise,xr=require("path"),Q=V(),Lr=X();async function eo(t){let e;try{e=await Q.stat(t)}catch{}if(e&&e.isFile())return;let r=xr.dirname(t),i=null;try{i=await Q.stat(r)}catch(n){if(n.code==="ENOENT"){await Lr.mkdirs(r),await Q.writeFile(t,"");return}else throw n}i.isDirectory()?await Q.writeFile(t,""):await Q.readdir(r)}function to(t){let e;try{e=Q.statSync(t)}catch{}if(e&&e.isFile())return;let r=xr.dirname(t);try{Q.statSync(r).isDirectory()||Q.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")Lr.mkdirsSync(r);else throw i}Q.writeFileSync(t,"")}Pr.exports={createFile:Zn(eo),createFileSync:to}});var jr=S((Sa,Fr)=>{"use strict";var ro=F().fromPromise,Er=require("path"),Z=V(),Or=X(),{pathExists:io}=z(),{areIdentical:Dr}=se();async function no(t,e){let r;try{r=await Z.lstat(e)}catch{}let i;try{i=await Z.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&Dr(i,r))return;let n=Er.dirname(e);await io(n)||await Or.mkdirs(n),await Z.link(t,e)}function oo(t,e){let r;try{r=Z.lstatSync(e)}catch{}try{let o=Z.lstatSync(t);if(r&&Dr(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Er.dirname(e);return Z.existsSync(i)||Or.mkdirsSync(i),Z.linkSync(t,e)}Fr.exports={createLink:ro(no),createLinkSync:oo}});var Ir=S((ga,Tr)=>{"use strict";var ee=require("path"),be=V(),{pathExists:so}=z(),ao=F().fromPromise;async function co(t,e){if(ee.isAbsolute(t)){try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(await so(i))return{toCwd:i,toDst:t};try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ee.relative(r,t)}}function lo(t,e){if(ee.isAbsolute(t)){if(!be.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(be.existsSync(i))return{toCwd:i,toDst:t};if(!be.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ee.relative(r,t)}}Tr.exports={symlinkPaths:ao(co),symlinkPathsSync:lo}});var Nr=S((va,Cr)=>{"use strict";var Mr=V(),uo=F().fromPromise;async function fo(t,e){if(e)return e;let r;try{r=await Mr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function mo(t,e){if(e)return e;let r;try{r=Mr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Cr.exports={symlinkType:uo(fo),symlinkTypeSync:mo}});var _r=S((wa,Vr)=>{"use strict";var po=F().fromPromise,Ar=require("path"),U=V(),{mkdirs:yo,mkdirsSync:ho}=X(),{symlinkPaths:So,symlinkPathsSync:go}=Ir(),{symlinkType:vo,symlinkTypeSync:wo}=Nr(),{pathExists:bo}=z(),{areIdentical:Rr}=se();async function xo(t,e,r){let i;try{i=await U.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,u]=await Promise.all([U.stat(t),U.stat(e)]);if(Rr(c,u))return}let n=await So(t,e);t=n.toDst;let o=await vo(n.toCwd,r),s=Ar.dirname(e);return await bo(s)||await yo(s),U.symlink(t,e,o)}function Lo(t,e,r){let i;try{i=U.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=U.statSync(t),u=U.statSync(e);if(Rr(c,u))return}let n=go(t,e);t=n.toDst,r=wo(n.toCwd,r);let o=Ar.dirname(e);return U.existsSync(o)||ho(o),U.symlinkSync(t,e,r)}Vr.exports={createSymlink:po(xo),createSymlinkSync:Lo}});var Jr=S((ba,Wr)=>{"use strict";var{createFile:qr,createFileSync:$r}=kr(),{createLink:Xr,createLinkSync:Br}=jr(),{createSymlink:Ur,createSymlinkSync:Gr}=_r();Wr.exports={createFile:qr,createFileSync:$r,ensureFile:qr,ensureFileSync:$r,createLink:Xr,createLinkSync:Br,ensureLink:Xr,ensureLinkSync:Br,createSymlink:Ur,createSymlinkSync:Gr,ensureSymlink:Ur,ensureSymlinkSync:Gr}});var Ie=S((xa,Hr)=>{function Po(t,{EOL:e=`
-`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function ko(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Hr.exports={stringify:Po,stripBom:ko}});var zr=S((La,Yr)=>{var me;try{me=le()}catch{me=require("fs")}var Me=F(),{stringify:Qr,stripBom:Kr}=Ie();async function Eo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0,n=await Me.fromCallback(r.readFile)(t,e);n=Kr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Oo=Me.fromPromise(Eo);function Do(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Kr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function Fo(t,e,r={}){let i=r.fs||me,n=Qr(e,r);await Me.fromCallback(i.writeFile)(t,n,r)}var jo=Me.fromPromise(Fo);function To(t,e,r={}){let i=r.fs||me,n=Qr(e,r);return i.writeFileSync(t,n,r)}var Io={readFile:Oo,readFileSync:Do,writeFile:jo,writeFileSync:To};Yr.exports=Io});var ei=S((Pa,Zr)=>{"use strict";var Ce=zr();Zr.exports={readJson:Ce.readFile,readJsonSync:Ce.readFileSync,writeJson:Ce.writeFile,writeJsonSync:Ce.writeFileSync}});var Ne=S((ka,ii)=>{"use strict";var Mo=F().fromPromise,mt=V(),ti=require("path"),ri=X(),Co=z().pathExists;async function No(t,e,r="utf-8"){let i=ti.dirname(t);return await Co(i)||await ri.mkdirs(i),mt.writeFile(t,e,r)}function Ao(t,...e){let r=ti.dirname(t);mt.existsSync(r)||ri.mkdirsSync(r),mt.writeFileSync(t,...e)}ii.exports={outputFile:Mo(No),outputFileSync:Ao}});var oi=S((Ea,ni)=>{"use strict";var{stringify:Ro}=Ie(),{outputFile:Vo}=Ne();async function _o(t,e,r={}){let i=Ro(e,r);await Vo(t,i,r)}ni.exports=_o});var ai=S((Oa,si)=>{"use strict";var{stringify:qo}=Ie(),{outputFileSync:$o}=Ne();function Xo(t,e,r){let i=qo(e,r);$o(t,i,r)}si.exports=Xo});var li=S((Da,ci)=>{"use strict";var Bo=F().fromPromise,q=ei();q.outputJson=Bo(oi());q.outputJsonSync=ai();q.outputJSON=q.outputJson;q.outputJSONSync=q.outputJsonSync;q.writeJSON=q.writeJson;q.writeJSONSync=q.writeJsonSync;q.readJSON=q.readJson;q.readJSONSync=q.readJsonSync;ci.exports=q});var pi=S((Fa,di)=>{"use strict";var Uo=V(),ui=require("path"),{copy:Go}=Te(),{remove:mi}=we(),{mkdirp:Wo}=X(),{pathExists:Jo}=z(),fi=se();async function Ho(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await fi.checkPaths(t,e,"move",r);await fi.checkParentPaths(t,n,e,"move");let s=ui.dirname(e);return ui.parse(s).root!==s&&await Wo(s),Qo(t,e,i,o)}async function Qo(t,e,r,i){if(!i){if(r)await mi(e);else if(await Jo(e))throw new Error("dest already exists.")}try{await Uo.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Ko(t,e,r)}}async function Ko(t,e,r){return await Go(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),mi(t)}di.exports=Ho});var vi=S((ja,gi)=>{"use strict";var hi=le(),pt=require("path"),Yo=Te().copySync,Si=we().removeSync,zo=X().mkdirpSync,yi=se();function Zo(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=yi.checkPathsSync(t,e,"move",r);return yi.checkParentPathsSync(t,n,e,"move"),es(e)||zo(pt.dirname(e)),ts(t,e,i,o)}function es(t){let e=pt.dirname(t);return pt.parse(e).root===e}function ts(t,e,r,i){if(i)return dt(t,e,r);if(r)return Si(e),dt(t,e,r);if(hi.existsSync(e))throw new Error("dest already exists.");return dt(t,e,r)}function dt(t,e,r){try{hi.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return rs(t,e,r)}}function rs(t,e,r){return Yo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Si(t)}gi.exports=Zo});var bi=S((Ta,wi)=>{"use strict";var is=F().fromPromise;wi.exports={move:is(pi()),moveSync:vi()}});var Li=S((Ia,xi)=>{"use strict";xi.exports={...V(),...Te(),...br(),...Jr(),...li(),...X(),...bi(),...Ne(),...z(),...we()}});var Pi=S(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.EXTENSIONS_LANGUAGES=void 0;Ae.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var xe=S(yt=>{"use strict";Object.defineProperty(yt,"__esModule",{value:!0});yt.setOptionValues=ns;function ns(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Ei=S(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.SarifBuilder=void 0;var os=require("path"),ki=Li(),ss=Pi(),as=xe(),ht=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,as.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();ki.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await ki.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((i=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var m;return((m=a?.location)===null||m===void 0?void 0:m.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=os.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),m=ss.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:m,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,m;let d=(m=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||m===void 0?void 0:m.uri;return d&&s.indexOf(d)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(d)),l})),u)),e}};Re.SarifBuilder=ht});var Oi=S(Ve=>{"use strict";Object.defineProperty(Ve,"__esModule",{value:!0});Ve.SarifResultBuilder=void 0;var cs=xe(),St=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,cs.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Ve.SarifResultBuilder=St});var Di=S(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});_e.SarifRuleBuilder=void 0;var ls=xe(),gt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,ls.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};_e.SarifRuleBuilder=gt});var Fi=S(qe=>{"use strict";Object.defineProperty(qe,"__esModule",{value:!0});qe.SarifRunBuilder=void 0;var us=xe(),vt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,us.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};qe.SarifRunBuilder=vt});var ji=S(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.SarifResultBuilder=G.SarifRuleBuilder=G.SarifRunBuilder=G.SarifBuilder=void 0;var fs=Ei();Object.defineProperty(G,"SarifBuilder",{enumerable:!0,get:function(){return fs.SarifBuilder}});var ms=Oi();Object.defineProperty(G,"SarifResultBuilder",{enumerable:!0,get:function(){return ms.SarifResultBuilder}});var ds=Di();Object.defineProperty(G,"SarifRuleBuilder",{enumerable:!0,get:function(){return ds.SarifRuleBuilder}});var ps=Fi();Object.defineProperty(G,"SarifRunBuilder",{enumerable:!0,get:function(){return ps.SarifRunBuilder}})});var Ii=S((qa,Ti)=>{"use strict";var ys=/["'&<>]/;Ti.exports=hs;function hs(t){var e=""+t,r=ys.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Qe=require("zx"),ae=require("fs/promises");var W={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var Pe=class{allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=Ot(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=en(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=ze(o.detectedBy,r),o.components=ze(o.components,e.components[0]),o.refs=ze(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push({id:i.id,severity:i.severity});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function en(t,e){return Ot(t,e)>0?t:e}function Ot(t,e){return W[t]-W[e]}function ze(t,e){return e?Array.from(new Set([...t,e]).values()):t}var ke=Ye(require("path"));var $=require("fs/promises"),Ze=require("path");async function B(t){if(await ne(t))return JSON.parse(await(0,$.readFile)(t,{encoding:"utf-8"}))}async function Dt(t,e){await(0,$.writeFile)(t,JSON.stringify(e,null,4)+`
-`,{encoding:"utf-8"})}function J(t){return t&&t.replace(/\?.*$/,"")}async function ne(t){try{return await(0,$.access)(t,$.constants.F_OK),!0}catch{return!1}}async function et(t){let e=(0,Ze.resolve)(t),r=await(0,$.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,Ze.resolve)(i.parentPath,i.name);i.isDirectory()?await et(n):await(0,$.rm)(n)}await(0,$.rmdir)(e)}async function pe(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function Ft(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=K(t.workingDir,"input/vex"),i=K(t.workingDir,"output"),n=K(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=K(t.workingDir,"vuln-scan-conf.json"),c=await B(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);return{projectConfigFileLocation:s,failOnNewVulnerabilities:!1,createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:K(t.workingDir,c.vexDir)??r,outDir:K(t.workingDir,c.outDir)??i,cacheDir:K(t.workingDir,c.cacheDir)??n,scanners:c.scanners??o,projects:(c.projects??[]).map(u=>{let l=u;if(!l.name)throw new Error("Project name is missing on entry:"+JSON.stringify(l));if(!l.version)throw new Error("Project version is missing on entry:"+JSON.stringify(l));if(!l.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(l));return l.enabled==null&&(l.enabled=!0),l.silent==null&&(l.silent=!1),l.minimumSeverity||(l.minimumSeverity="UNKNOWN"),l.sbomFile?{...l,sbomFile:K(t.workingDir,l.sbomFile)}:u})}}function K(t,e){if(e)return ke.default.isAbsolute(e)?e:(0,ke.resolve)(t,e)}var te=Ye(ji());var Mi=Ye(Ii());function Ci(t,e){let r=new te.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=gs(o.severity),c=o.id,u=Ss(o.refs),l=new te.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,m,d="new",f="";a?(m=[{kind:"external",status:"accepted"}],d="updated",f=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(m[0].status="underReview",f="--- UNDER INVESTIGATION --- ")):W[e.minimumSeverity]>W[o.severity]?(m=[{kind:"external",status:"accepted"}],d="updated",f=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(m=[{kind:"external",status:"accepted"}],d="updated",f="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${f}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:vs(o,u,f)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let p of o.components){let h=new te.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${p}`});h.result.message.id="default",h.result.locations=[{logicalLocations:[{fullyQualifiedName:p}]}],h.result.baselineState=d,h.result.suppressions=m,r.addResult(h)}}let n=new te.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function Ss(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function gs(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function vs(t,e,r){let i=t.vexStatement,n=i?`
+	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ve.checkPathsSync(t,e,"copy",r);if(ve.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ge.dirname(e);return _.existsSync(o)||Rn(o),cr(n,t,e,r)}function cr(t,e,r,i){let o=(i.dereference?_.statSync:_.lstatSync)(e);if(o.isDirectory())return Gn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return _n(o,t,e,r,i);if(o.isSymbolicLink())return Hn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function _n(t,e,r,i,n){return e?$n(t,r,i,n):lr(t,r,i,n)}function $n(t,e,r,i){if(i.overwrite)return _.unlinkSync(r),lr(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function lr(t,e,r,i){return _.copyFileSync(e,r),i.preserveTimestamps&&qn(t.mode,e,r),dt(r,t.mode)}function qn(t,e,r){return Xn(t)&&Un(r,t),Bn(e,r)}function Xn(t){return(t&128)===0}function Un(t,e){return dt(t,e|128)}function dt(t,e){return _.chmodSync(t,e)}function Bn(t,e){let r=_.statSync(t);return An(e,r.atime,r.mtime)}function Gn(t,e,r,i,n){return e?ur(r,i,n):Jn(t.mode,r,i,n)}function Jn(t,e,r,i){return _.mkdirSync(r),ur(e,r,i),dt(r,t)}function ur(t,e,r){_.readdirSync(t).forEach(i=>Wn(i,t,e,r))}function Wn(t,e,r,i){let n=ge.join(e,t),o=ge.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=ve.checkPathsSync(n,o,"copy",i);return cr(s,n,o,i)}function Hn(t,e,r,i){let n=_.readlinkSync(e);if(i.dereference&&(n=ge.resolve(process.cwd(),n)),t){let o;try{o=_.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return _.symlinkSync(n,r);throw s}if(i.dereference&&(o=ge.resolve(process.cwd(),o)),ve.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(ve.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return Qn(n,r)}else return _.symlinkSync(n,r)}function Qn(t,e){return _.unlinkSync(e),_.symlinkSync(t,e)}fr.exports=Vn});var Te=S((ha,pr)=>{"use strict";var Kn=F().fromPromise;pr.exports={copy:Kn(ar()),copySync:mr()}});var we=S((Sa,yr)=>{"use strict";var dr=le(),Yn=F().fromCallback;function zn(t,e){dr.rm(t,{recursive:!0,force:!0},e)}function Zn(t){dr.rmSync(t,{recursive:!0,force:!0})}yr.exports={remove:Yn(zn),removeSync:Zn}});var Lr=S((ga,br)=>{"use strict";var eo=F().fromPromise,gr=V(),vr=require("path"),wr=U(),xr=we(),hr=eo(async function(e){let r;try{r=await gr.readdir(e)}catch{return wr.mkdirs(e)}return Promise.all(r.map(i=>xr.remove(vr.join(e,i))))});function Sr(t){let e;try{e=gr.readdirSync(t)}catch{return wr.mkdirsSync(t)}e.forEach(r=>{r=vr.join(t,r),xr.removeSync(r)})}br.exports={emptyDirSync:Sr,emptydirSync:Sr,emptyDir:hr,emptydir:hr}});var Or=S((va,Er)=>{"use strict";var to=F().fromPromise,Pr=require("path"),Q=V(),kr=U();async function ro(t){let e;try{e=await Q.stat(t)}catch{}if(e&&e.isFile())return;let r=Pr.dirname(t),i=null;try{i=await Q.stat(r)}catch(n){if(n.code==="ENOENT"){await kr.mkdirs(r),await Q.writeFile(t,"");return}else throw n}i.isDirectory()?await Q.writeFile(t,""):await Q.readdir(r)}function io(t){let e;try{e=Q.statSync(t)}catch{}if(e&&e.isFile())return;let r=Pr.dirname(t);try{Q.statSync(r).isDirectory()||Q.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")kr.mkdirsSync(r);else throw i}Q.writeFileSync(t,"")}Er.exports={createFile:to(ro),createFileSync:io}});var Ir=S((wa,Tr)=>{"use strict";var no=F().fromPromise,Dr=require("path"),ee=V(),Fr=U(),{pathExists:oo}=Z(),{areIdentical:jr}=se();async function so(t,e){let r;try{r=await ee.lstat(e)}catch{}let i;try{i=await ee.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&jr(i,r))return;let n=Dr.dirname(e);await oo(n)||await Fr.mkdirs(n),await ee.link(t,e)}function ao(t,e){let r;try{r=ee.lstatSync(e)}catch{}try{let o=ee.lstatSync(t);if(r&&jr(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Dr.dirname(e);return ee.existsSync(i)||Fr.mkdirsSync(i),ee.linkSync(t,e)}Tr.exports={createLink:no(so),createLinkSync:ao}});var Nr=S((xa,Mr)=>{"use strict";var te=require("path"),xe=V(),{pathExists:co}=Z(),lo=F().fromPromise;async function uo(t,e){if(te.isAbsolute(t)){try{await xe.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=te.dirname(e),i=te.join(r,t);if(await co(i))return{toCwd:i,toDst:t};try{await xe.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:te.relative(r,t)}}function fo(t,e){if(te.isAbsolute(t)){if(!xe.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=te.dirname(e),i=te.join(r,t);if(xe.existsSync(i))return{toCwd:i,toDst:t};if(!xe.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:te.relative(r,t)}}Mr.exports={symlinkPaths:lo(uo),symlinkPathsSync:fo}});var Ar=S((ba,Rr)=>{"use strict";var Cr=V(),mo=F().fromPromise;async function po(t,e){if(e)return e;let r;try{r=await Cr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function yo(t,e){if(e)return e;let r;try{r=Cr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Rr.exports={symlinkType:mo(po),symlinkTypeSync:yo}});var qr=S((La,$r)=>{"use strict";var ho=F().fromPromise,Vr=require("path"),B=V(),{mkdirs:So,mkdirsSync:go}=U(),{symlinkPaths:vo,symlinkPathsSync:wo}=Nr(),{symlinkType:xo,symlinkTypeSync:bo}=Ar(),{pathExists:Lo}=Z(),{areIdentical:_r}=se();async function Po(t,e,r){let i;try{i=await B.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,u]=await Promise.all([B.stat(t),B.stat(e)]);if(_r(c,u))return}let n=await vo(t,e);t=n.toDst;let o=await xo(n.toCwd,r),s=Vr.dirname(e);return await Lo(s)||await So(s),B.symlink(t,e,o)}function ko(t,e,r){let i;try{i=B.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=B.statSync(t),u=B.statSync(e);if(_r(c,u))return}let n=wo(t,e);t=n.toDst,r=bo(n.toCwd,r);let o=Vr.dirname(e);return B.existsSync(o)||go(o),B.symlinkSync(t,e,r)}$r.exports={createSymlink:ho(Po),createSymlinkSync:ko}});var Qr=S((Pa,Hr)=>{"use strict";var{createFile:Xr,createFileSync:Ur}=Or(),{createLink:Br,createLinkSync:Gr}=Ir(),{createSymlink:Jr,createSymlinkSync:Wr}=qr();Hr.exports={createFile:Xr,createFileSync:Ur,ensureFile:Xr,ensureFileSync:Ur,createLink:Br,createLinkSync:Gr,ensureLink:Br,ensureLinkSync:Gr,createSymlink:Jr,createSymlinkSync:Wr,ensureSymlink:Jr,ensureSymlinkSync:Wr}});var Ie=S((ka,Kr)=>{function Eo(t,{EOL:e=`
+`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function Oo(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Kr.exports={stringify:Eo,stripBom:Oo}});var ei=S((Ea,Zr)=>{var me;try{me=le()}catch{me=require("fs")}var Me=F(),{stringify:Yr,stripBom:zr}=Ie();async function Do(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0,n=await Me.fromCallback(r.readFile)(t,e);n=zr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Fo=Me.fromPromise(Do);function jo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=zr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function To(t,e,r={}){let i=r.fs||me,n=Yr(e,r);await Me.fromCallback(i.writeFile)(t,n,r)}var Io=Me.fromPromise(To);function Mo(t,e,r={}){let i=r.fs||me,n=Yr(e,r);return i.writeFileSync(t,n,r)}var No={readFile:Fo,readFileSync:jo,writeFile:Io,writeFileSync:Mo};Zr.exports=No});var ri=S((Oa,ti)=>{"use strict";var Ne=ei();ti.exports={readJson:Ne.readFile,readJsonSync:Ne.readFileSync,writeJson:Ne.writeFile,writeJsonSync:Ne.writeFileSync}});var Ce=S((Da,oi)=>{"use strict";var Co=F().fromPromise,yt=V(),ii=require("path"),ni=U(),Ro=Z().pathExists;async function Ao(t,e,r="utf-8"){let i=ii.dirname(t);return await Ro(i)||await ni.mkdirs(i),yt.writeFile(t,e,r)}function Vo(t,...e){let r=ii.dirname(t);yt.existsSync(r)||ni.mkdirsSync(r),yt.writeFileSync(t,...e)}oi.exports={outputFile:Co(Ao),outputFileSync:Vo}});var ai=S((Fa,si)=>{"use strict";var{stringify:_o}=Ie(),{outputFile:$o}=Ce();async function qo(t,e,r={}){let i=_o(e,r);await $o(t,i,r)}si.exports=qo});var li=S((ja,ci)=>{"use strict";var{stringify:Xo}=Ie(),{outputFileSync:Uo}=Ce();function Bo(t,e,r){let i=Xo(e,r);Uo(t,i,r)}ci.exports=Bo});var fi=S((Ta,ui)=>{"use strict";var Go=F().fromPromise,$=ri();$.outputJson=Go(ai());$.outputJsonSync=li();$.outputJSON=$.outputJson;$.outputJSONSync=$.outputJsonSync;$.writeJSON=$.writeJson;$.writeJSONSync=$.writeJsonSync;$.readJSON=$.readJson;$.readJSONSync=$.readJsonSync;ui.exports=$});var hi=S((Ia,yi)=>{"use strict";var Jo=V(),mi=require("path"),{copy:Wo}=Te(),{remove:di}=we(),{mkdirp:Ho}=U(),{pathExists:Qo}=Z(),pi=se();async function Ko(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await pi.checkPaths(t,e,"move",r);await pi.checkParentPaths(t,n,e,"move");let s=mi.dirname(e);return mi.parse(s).root!==s&&await Ho(s),Yo(t,e,i,o)}async function Yo(t,e,r,i){if(!i){if(r)await di(e);else if(await Qo(e))throw new Error("dest already exists.")}try{await Jo.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await zo(t,e,r)}}async function zo(t,e,r){return await Wo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),di(t)}yi.exports=Ko});var xi=S((Ma,wi)=>{"use strict";var gi=le(),St=require("path"),Zo=Te().copySync,vi=we().removeSync,es=U().mkdirpSync,Si=se();function ts(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=Si.checkPathsSync(t,e,"move",r);return Si.checkParentPathsSync(t,n,e,"move"),rs(e)||es(St.dirname(e)),is(t,e,i,o)}function rs(t){let e=St.dirname(t);return St.parse(e).root===e}function is(t,e,r,i){if(i)return ht(t,e,r);if(r)return vi(e),ht(t,e,r);if(gi.existsSync(e))throw new Error("dest already exists.");return ht(t,e,r)}function ht(t,e,r){try{gi.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return ns(t,e,r)}}function ns(t,e,r){return Zo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),vi(t)}wi.exports=ts});var Li=S((Na,bi)=>{"use strict";var os=F().fromPromise;bi.exports={move:os(hi()),moveSync:xi()}});var ki=S((Ca,Pi)=>{"use strict";Pi.exports={...V(),...Te(),...Lr(),...Qr(),...fi(),...U(),...Li(),...Ce(),...Z(),...we()}});var Ei=S(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.EXTENSIONS_LANGUAGES=void 0;Re.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var be=S(gt=>{"use strict";Object.defineProperty(gt,"__esModule",{value:!0});gt.setOptionValues=ss;function ss(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Di=S(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.SarifBuilder=void 0;var as=require("path"),Oi=ki(),cs=Ei(),ls=be(),vt=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,ls.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Oi.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Oi.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((i=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var f;return((f=a?.location)===null||f===void 0?void 0:f.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=as.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),f=cs.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:f,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,f;let p=(f=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||f===void 0?void 0:f.uri;return p&&s.indexOf(p)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(p)),l})),u)),e}};Ae.SarifBuilder=vt});var Fi=S(Ve=>{"use strict";Object.defineProperty(Ve,"__esModule",{value:!0});Ve.SarifResultBuilder=void 0;var us=be(),wt=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,us.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Ve.SarifResultBuilder=wt});var ji=S(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});_e.SarifRuleBuilder=void 0;var fs=be(),xt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,fs.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};_e.SarifRuleBuilder=xt});var Ti=S($e=>{"use strict";Object.defineProperty($e,"__esModule",{value:!0});$e.SarifRunBuilder=void 0;var ms=be(),bt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,ms.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};$e.SarifRunBuilder=bt});var Ii=S(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.SarifResultBuilder=G.SarifRuleBuilder=G.SarifRunBuilder=G.SarifBuilder=void 0;var ps=Di();Object.defineProperty(G,"SarifBuilder",{enumerable:!0,get:function(){return ps.SarifBuilder}});var ds=Fi();Object.defineProperty(G,"SarifResultBuilder",{enumerable:!0,get:function(){return ds.SarifResultBuilder}});var ys=ji();Object.defineProperty(G,"SarifRuleBuilder",{enumerable:!0,get:function(){return ys.SarifRuleBuilder}});var hs=Ti();Object.defineProperty(G,"SarifRunBuilder",{enumerable:!0,get:function(){return hs.SarifRunBuilder}})});var Ni=S((Ua,Mi)=>{"use strict";var Ss=/["'&<>]/;Mi.exports=gs;function gs(t){var e=""+t,r=Ss.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Ke=require("zx"),ae=require("fs/promises");var J={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var Pe=class{allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=Tt(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=rn(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=Ze(o.detectedBy,r),o.components=Ze(o.components,e.components[0]),o.refs=Ze(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push({id:i.id,severity:i.severity});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function rn(t,e){return Tt(t,e)>0?t:e}function Tt(t,e){return J[t]-J[e]}function Ze(t,e){return e?Array.from(new Set([...t,e]).values()):t}var ke=ze(require("path"));var q=require("fs/promises"),et=require("path");async function X(t){if(await ne(t))return JSON.parse(await(0,q.readFile)(t,{encoding:"utf-8"}))}async function tt(t,e){await(0,q.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}function W(t){return t&&t.replace(/\?.*$/,"")}async function ne(t){try{return await(0,q.access)(t,q.constants.F_OK),!0}catch{return!1}}async function rt(t){let e=(0,et.resolve)(t),r=await(0,q.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,et.resolve)(i.parentPath,i.name);i.isDirectory()?await rt(n):await(0,q.rm)(n)}await(0,q.rmdir)(e)}async function de(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function it(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=Y(t.workingDir,"input/vex"),i=Y(t.workingDir,"output"),n=Y(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=Y(t.workingDir,"vuln-scan-conf.json"),c=await X(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);return{projectConfigFileLocation:s,failOnNewVulnerabilities:c.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:c.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:Y(t.workingDir,c.vexDir)??r,outDir:Y(t.workingDir,c.outDir)??i,cacheDir:Y(t.workingDir,c.cacheDir)??n,scanners:c.scanners??o,projects:(c.projects??[]).map(u=>{let l=u;if(!l.name)throw new Error("Project name is missing on entry:"+JSON.stringify(l));if(!l.version)throw new Error("Project version is missing on entry:"+JSON.stringify(l));if(!l.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(l));return l.enabled==null&&(l.enabled=!0),l.silent==null&&(l.silent=!1),l.minimumSeverity||(l.minimumSeverity="UNKNOWN"),l.sbomFile?{...l,sbomFile:Y(t.workingDir,l.sbomFile)}:u})}}function Y(t,e){if(e)return ke.default.isAbsolute(e)?e:(0,ke.resolve)(t,e)}var re=ze(Ii());var Ci=ze(Ni());function Ri(t,e){let r=new re.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=ws(o.severity),c=o.id,u=vs(o.refs),l=new re.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,f,p="new",m="";a?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(f[0].status="underReview",m="--- UNDER INVESTIGATION --- ")):J[e.minimumSeverity]>J[o.severity]?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(f=[{kind:"external",status:"accepted"}],p="updated",m="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${m}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:xs(o,u,m)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let d of o.components){let h=new re.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});h.result.message.id="default",h.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],h.result.baselineState=p,h.result.suppressions=f,r.addResult(h)}}let n=new re.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function vs(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function ws(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function xs(t,e,r){let i=t.vexStatement,n=i?`
 ${r}
 ${i.justification??""}
 ${i.impact_statement??""}
@@ -18,13 +18,13 @@ ${n}
 --- DETAILS ---
-${(0,Mi.default)(t.description)}
+${(0,Ci.default)(t.description)}
 ${t.refs.map(o=>`* <${o}>`).join(`
 `)}
-`}var Xe=require("fs/promises");async function Ni(t,e,r){if("sbomFile"in t)return await(0,Xe.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Xe.writeFile)(e,i),{...t,sbomFile:e}}var $e=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await pe(i,this.authn);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await pe(r,this.authn)).text();return ws(n,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function ws(t,e){if(e.classifier&&e.extension){let n=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(n?.[1])return n[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),i=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!i)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${i[1]}`}var Be=require("fs/promises"),wt=require("path");var bt=class{constructor(e){this.location=e}async read(){let e=await B(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await Dt(this.location,e)}async delete(){await(0,Be.unlink)(this.location)}};async function Ai(t,e){for(let r of await(0,Be.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new bt((0,wt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await Ai((0,wt.resolve)(r.parentPath,r.name),e)}function bs(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var de=class t{statements=[];filteredToProduct;static async fromUrl(e,r,i=new t){let o=await(await pe(e,r)).json();return i.add(o),i}static async fromFiles(e,r=new t){return await Ai(e,async i=>{let n=await i.read();r.add(n)}),r}add(e){xs(e);let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=bs(i),c=new Set(i.products?.map(l=>l["@id"]).filter(l=>!!l)??[]),u=new xt(n,o,s,c,i);this.statements.push(u)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProduct)return this;let r=new t;return r.filteredToProduct=e,r.statements=this.statements.filter(i=>i.matchesProduct(e)),r}findNotMatchingVulnerabilities(e,r){let i=this.filterByProduct(r??this.filteredToProduct),n=new Set;for(let o of i.statements)n.add(o.vulnName);for(let o of e)n.delete(o);return Array.from(n)}newestVulnerabilityStatement(e,r){let i=this.filterByProduct(r??this.filteredToProduct);for(let n of i.statements)if(n.matchesVulnerability(e))return this.reduceToProductInformation(n.statement,i.filteredToProduct)}toVexFileForProduct(e){let r=this.filterByProduct(e??this.filteredToProduct),i=r.statements[0]?.statement.timestamp??new Date().toISOString(),n=r.statements.map(o=>r.reduceToProductInformation(o.statement)).filter(o=>o.status!=="under_investigation");if(n.length!==0)return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:i,last_updated:i,version:1,statements:n}}assertCorrectProductId(e){if(!e)throw new Error("Product ID must be provided");if(this.filteredToProduct&&this.filteredToProduct!==e)throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){return r=r??this.filteredToProduct,{...e,products:e.products?.filter(i=>i["@id"]===r)}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}},xt=class{constructor(e,r,i,n,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=i;this.products=n;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesVulnerability(e){return this.vulnAliases.has(e)}};function xs(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}var Ge=require("path"),Ri=require("fs/promises");var Ue=class{constructor(e,r,i){this.project=e;this.outputDir=r;this.useSubDirForProject=i}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",i=`${this.project.name}-${this.project.version}-`,n=this.getFileSuffix(e),o=(0,Ge.resolve)(this.outputDir,r,`${i}${n}`),s=(0,Ge.dirname)(o);return await ne(s)||await(0,Ri.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};var Lt=require("zx");var We=require("path"),Vi="anchore/grype:latest";async function _i(t){let e=await Lt.$`docker run --rm -v '${t}:/.cache' ${Vi} db update`;e.stdout&&console.log(` Grype DB Update: ${e.stdout}`),e.stderr&&console.log(` Grype DB Update error: ${e.stderr}`)}async function qi(t,e,r,i,n){let o=(0,We.dirname)(e),s=(0,We.basename)(e),c=await Lt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' -e GRYPE_DB_AUTO_UPDATE=false ${Vi} sbom:/tmp/input.json -o json --file '/tmp/output/${s}' --by-cve --quiet`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(`  Grype output file: ${e}`);let u=await B(e);Ls(i,u)}function Ls(t,e){if(e)for(let r of e.matches){let i=Ps(r);t.addVulnerability(i,"grype")}}function Ps(t){let e=t.vulnerability,r=e.id,i=J(t.artifact.purl),n=J(e.dataSource),o=ks(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[i],detectedBy:["grype"],refs:[n]}}function ks(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var $i=require("fs/promises");async function Xi(t,e,r,i,n){let o={},s="";r.user&&r.token&&(o.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,s="/authorized");let c=`https://ossindex.sonatype.org/api/v3${s}/component-report`,u=await Es(e.sbomFile),l=new Set(u.map(d=>d.purl.replace(/\?.*$/,"")));Is(l);let a=Array.from(l),m=[];for(let d=0;d<a.length;d+=128){let f=JSON.stringify({coordinates:a.slice(d,d+128)}),h=await(await fetch(c,{method:"POST",headers:{...o,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:f})).json();Array.isArray(h)?m.push(...h.filter(v=>v.vulnerabilities.length>0)):n(`  Sonatype OssIndex Error: ${h.code} - ${h.message}`)}await(0,$i.writeFile)(t,JSON.stringify(m,null,2)),n(`  Sonatype OssIndex output file: ${t}`),Fs(i,m)}async function Es(t){return(await B(t)).components.filter(r=>Os(r)&&!Ds(r))}function Os(t){return!!t.purl}function Ds(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function Fs(t,e){if(e)for(let r of e)for(let i of r.vulnerabilities){let n=js(i,r.coordinates);t.addVulnerability(n,"ossindex")}}function js(t,e){let r=t.cve||t.id,i=J(e),n=J(t.reference),o=Ts(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[i],detectedBy:["ossindex"],refs:n?[n]:[]}}function Ts(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function Is(t){let e=Array.from(t);for(let r of e){let i=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(i)}}var Pt=require("zx");var Je=require("path"),Bi="aquasec/trivy:latest";async function Ui(t,e){let r=[];e&&(r.push("-e"),r.push(`GITHUB_TOKEN=${e}`));let i=[];i.push("--db-repository"),i.push("public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db");let n=await Pt.$`docker run --rm -v '${t}:/.cache' ${r} ${Bi} ${i} --cache-dir '/.cache' sbom --download-db-only --quiet`;!n.stdout&&!n.stderr&&console.log(" Trivy DB Update: finished"),n.stdout&&console.log(` Trivy DB Update: ${n.stdout}`),n.stderr&&console.log(` Trivy DB Update error: ${n.stderr}`)}async function Gi(t,e,r,i,n){let o=(0,Je.dirname)(e),s=(0,Je.basename)(e),c=await Pt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' ${Bi} sbom --cache-dir '/.cache' --format json --output '/tmp/output/${s}' --quiet --skip-db-update /tmp/input.json`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(`  Trivy output file: ${e}`);let u=await B(e);Ms(i,u)}function Ms(t,e){if(e){for(let r of e.Results)if(r.Vulnerabilities)for(let i of r.Vulnerabilities){let n=Cs(i);t.addVulnerability(n,"trivy")}}}function Cs(t){let e=t.VulnerabilityID,r=J(t.PkgIdentifier.PURL),i=J(t.PrimaryURL),n=Ns(t.Severity);return{id:e,severity:n,scannerSeverity:{trivy:n},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[i]}}function Ns(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var He=class{constructor(e,r,i){this.scannerNames=e;this.cacheDir=r;this.options=i}async init(){let e=[];for(let r of this.scannerNames)switch(r){case"grype":e.push(_i(this.cacheDir));break;case"trivy":e.push(Ui(this.cacheDir,this.options.trivyGithubToken));break;case"ossindex":continue}await Promise.all(e)}async scanProject(e,r,i,n){let o=[];for(let s of this.scannerNames)o.push(this.scanProjectBy(s,e,r,this.cacheDir,i,this.options.ossIndexApiUser,this.options.ossIndexApiToken,n));await Promise.all(o)}async scanProjectBy(e,r,i,n,o,s,c,u){switch(e){case"grype":return qi(n,await i.lookupOutputFileForWriting("grype-results"),r,o,u);case"trivy":return Gi(n,await i.lookupOutputFileForWriting("trivy-results"),r,o,u);case"ossindex":return Xi(await i.lookupOutputFileForWriting("ossindex-results"),r,{user:s,token:c},o,u)}}};Qe.os.type().startsWith("Windows")&&(0,Qe.usePowerShell)();async function Wi(t){let e=await Ft(t),r=e.cacheDir;await ne(r)||await(0,ae.mkdir)(r);let i=e.outDir;await ne(i)&&await et(i),await(0,ae.mkdir)(i);let n=await qs(e,{user:t.vexUrlsUser,pw:t.vexUrlsPw}),o=new $e(e.mavenRepo,{user:t.mavenRepoUser,pw:t.mavenRepoPw}),s=$s(e,t,r),c=Date.now();console.log("Initializing scanner engines ..."),await s.init(),console.log(`Scanner engines initialization took ${Date.now()-c}ms
-`);let u=Xs(t),l=e.projects,a=new Map,m=Date.now();console.log("Scanning projects ...");let d=1,f=0,p=[];for(let b of l){if(!u(b))continue;f>=d&&(await Promise.race(p),--f);let N=new Ue(b,i,e.createSubDirsForProject),O=[],ie=Le=>{O.push(Le)};p.push(As(b,N,o,s,n,ie,a,t,O)),++f}await Promise.all(p),console.log(`Scanning took ${Date.now()-m}ms`);let h=Rs(a);return t.mode!=="test"&&(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&!e.failOnNewVulnerabilities&&console.log("##vso[task.complete result=SucceededWithIssues;]NEW_VULNERABILITIES_DETECTED"),h.hasError||(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&e.failOnNewVulnerabilities?1:0}async function As(t,e,r,i,n,o,s,c,u){try{let{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}=await Vs(t,e,r,i,n,o);s.set(t.purl,{project:t,newVulns:l,noLongerDetectedVulns:a})}catch(l){let a=l;s.set(t.purl,{project:t,error:a.message,newVulns:[],noLongerDetectedVulns:[]})}if(c.verbose)for(let l of u)console.log(l)}function Rs(t){let e=!1,r=!1,i=!1;console.log(`
-Scan results:`);for(let[n,o]of t){let s=o.project,c=s.silent,u=W[s.minimumSeverity];if(console.log(`  ${s.name} - ${s.version} (${n}):`),o.error&&(console.error(`    Error: ${o.error}`),e=!0),!c&&o.newVulns.length){console.log("    New vulnerabilities:");for(let l of o.newVulns)u>W[l.severity]||(r=!0,console.log(`      [${l.severity}] ${l.id}`))}if(!c&&o.noLongerDetectedVulns.length){i=!0,console.log("    No longer detected vulnerabilities");for(let l of o.noLongerDetectedVulns)console.log(`      ${l}`)}}return!e&&!r&&!i&&console.log("  No issues found"),{hasError:e,hasNewVuln:r,hasNoLongerDetectedVuln:i}}async function Vs(t,e,r,i,n,o){let s=await Ni(t,await e.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),r);o(`Analyzing project: ${s.name} - ${s.version} - ${s.sbomFile}`);let c=new Pe;await i.scanProject(s,e,c,o);let u=n.filterByProduct(s.purl),{unmatchedVulnerabilities:l}=c.enhanceWithVexData(u),a=u.findNotMatchingVulnerabilities(c.getAllVulnIds());return await _s(e,s,c,u,o),{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}}async function _s(t,e,r,i,n){let o=r.getAllVulnerabilitiesSortedBySeverity(),s=await t.lookupOutputFileForWriting("aggregate-results");await(0,ae.writeFile)(s,JSON.stringify(o,null,2)),n(`  Vulnerabilities output file: ${s}`);let c=await t.lookupOutputFileForWriting("aggregated-sarif-results"),u=Ci(o,e);await(0,ae.writeFile)(c,JSON.stringify(u,null,2)),n(`  Vuln Sarif output file: ${c}`);let l=i.toVexFileForProduct();if(!l)return;let a=await t.lookupOutputFileForWriting("project-openvex-file");await(0,ae.writeFile)(a,JSON.stringify(l,null,2)),n(`  OpenVex file: ${a}`)}async function qs(t,e){let r=t.vexDir,i;await ne(r)?i=await de.fromFiles(r):i=new de;for(let n of t.vexUrls)await de.fromUrl(n,e,i);return i}function $s(t,e,r){if(e.scannerEngine)return e.scannerEngine;if(t.scanners.length===0)throw new Error("No scanners configured");return new He(t.scanners,r,e)}function Xs(t){let{reduceToProjectName:e,reduceToProjectVersion:r}=t;return i=>!(!i.enabled||e&&(i.name!==e||r&&i.version!==r))}var re=process.env;(async()=>{let t=await Wi({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:re.OSS_INDEX_API_USER,ossIndexApiToken:re.OSS_INDEX_API_TOKEN,mavenRepoUser:re.MAVEN_REPO_USER,mavenRepoPw:re.MAVEN_REPO_PW,trivyGithubToken:re.TRIVY_GITHUB_TOKEN,vexUrlsUser:re.VEX_URLS_USER,vexUrlsPw:re.VEX_URLS_PW,verbose:re.VERBOSE==="true"});process.exit(t)})();
+`}var Xe=require("fs/promises");async function Ai(t,e,r){if("sbomFile"in t)return await(0,Xe.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Xe.writeFile)(e,i),{...t,sbomFile:e}}var qe=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await de(i,this.authn);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await de(r,this.authn)).text();return bs(n,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function bs(t,e){if(e.classifier&&e.extension){let n=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(n?.[1])return n[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),i=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!i)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${i[1]}`}var Ue=require("fs/promises"),Lt=require("path");var Pt=class{constructor(e){this.location=e}async read(){let e=await X(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await tt(this.location,e)}async delete(){await(0,Ue.unlink)(this.location)}};async function Be(t,e){for(let r of await(0,Ue.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new Pt((0,Lt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await Be((0,Lt.resolve)(r.parentPath,r.name),e)}function Et(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var pe=class t{statements=[];filteredToProduct;static async fromUrl(e,r,i=new t){let o=await(await de(e,r)).json();return i.add(o),i}static async fromFiles(e,r=new t){return await Be(e,async i=>{let n=await i.read();r.add(n)}),r}add(e){Ls(e);let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=Et(i),c=new Set(i.products?.map(l=>l["@id"]).filter(l=>!!l)??[]),u=new kt(n,o,s,c,i);this.statements.push(u)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProduct)return this;let r=new t;return r.filteredToProduct=e,r.statements=this.statements.filter(i=>i.matchesProduct(e)),r}findNotMatchingVulnerabilities(e,r){let i=this.filterByProduct(r??this.filteredToProduct),n=new Set;for(let o of i.statements)n.add(o.vulnName);for(let o of e)n.delete(o);return Array.from(n)}newestVulnerabilityStatement(e,r){let i=this.filterByProduct(r??this.filteredToProduct);for(let n of i.statements)if(n.matchesVulnerability(e))return this.reduceToProductInformation({timestamp:new Date(n.timestamp).toISOString(),...n.statement},i.filteredToProduct)}toVexFile(e){let r=e.filter(n=>n.status!=="under_investigation");if(r.length===0)return;this.sortVexStatementsByTimestampNewestFirst(r);let i=r[0].timestamp;return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:i,last_updated:i,version:1,statements:r}}assertCorrectProductId(e){if(!e)throw new Error("Product ID must be provided");if(this.filteredToProduct&&this.filteredToProduct!==e)throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){return r=r??this.filteredToProduct,{...e,products:e.products?.filter(i=>i["@id"]===r)}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}sortVexStatementsByTimestampNewestFirst(e){e.sort((r,i)=>Date.parse(i.timestamp)-Date.parse(r.timestamp))}},kt=class{constructor(e,r,i,n,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=i;this.products=n;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesVulnerability(e){return this.vulnAliases.has(e)}};function Ls(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}var Je=require("path"),Vi=require("fs/promises");var Ge=class{constructor(e,r,i){this.project=e;this.outputDir=r;this.useSubDirForProject=i}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",i=`${this.project.name}-${this.project.version}-`,n=this.getFileSuffix(e),o=(0,Je.resolve)(this.outputDir,r,`${i}${n}`),s=(0,Je.dirname)(o);return await ne(s)||await(0,Vi.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};var Ot=require("zx");var We=require("path"),_i="anchore/grype:latest";async function $i(t){let e=await Ot.$`docker run --rm -v '${t}:/.cache' ${_i} db update`;e.stdout&&console.log(` Grype DB Update: ${e.stdout}`),e.stderr&&console.log(` Grype DB Update error: ${e.stderr}`)}async function qi(t,e,r,i,n){let o=(0,We.dirname)(e),s=(0,We.basename)(e),c=await Ot.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' -e GRYPE_DB_AUTO_UPDATE=false ${_i} sbom:/tmp/input.json -o json --file '/tmp/output/${s}' --by-cve --quiet`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(`  Grype output file: ${e}`);let u=await X(e);Ps(i,u)}function Ps(t,e){if(e)for(let r of e.matches){let i=ks(r);t.addVulnerability(i,"grype")}}function ks(t){let e=t.vulnerability,r=e.id,i=W(t.artifact.purl),n=W(e.dataSource),o=Es(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[i],detectedBy:["grype"],refs:[n]}}function Es(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var Xi=require("fs/promises");async function Ui(t,e,r,i,n){let o={},s="";r.user&&r.token&&(o.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,s="/authorized");let c=`https://ossindex.sonatype.org/api/v3${s}/component-report`,u=await Os(e.sbomFile),l=new Set(u.map(p=>p.purl.replace(/\?.*$/,"")));Ms(l);let a=Array.from(l),f=[];for(let p=0;p<a.length;p+=128){let m=JSON.stringify({coordinates:a.slice(p,p+128)}),h=await(await fetch(c,{method:"POST",headers:{...o,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:m})).json();Array.isArray(h)?f.push(...h.filter(v=>v.vulnerabilities.length>0)):n(`  Sonatype OssIndex Error: ${h.code} - ${h.message}`)}await(0,Xi.writeFile)(t,JSON.stringify(f,null,2)),n(`  Sonatype OssIndex output file: ${t}`),js(i,f)}async function Os(t){return(await X(t)).components.filter(r=>Ds(r)&&!Fs(r))}function Ds(t){return!!t.purl}function Fs(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function js(t,e){if(e)for(let r of e)for(let i of r.vulnerabilities){let n=Ts(i,r.coordinates);t.addVulnerability(n,"ossindex")}}function Ts(t,e){let r=t.cve||t.id,i=W(e),n=W(t.reference),o=Is(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[i],detectedBy:["ossindex"],refs:n?[n]:[]}}function Is(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function Ms(t){let e=Array.from(t);for(let r of e){let i=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(i)}}var Dt=require("zx");var He=require("path"),Bi="aquasec/trivy:latest";async function Gi(t,e){let r=[];e&&(r.push("-e"),r.push(`GITHUB_TOKEN=${e}`));let i=[];i.push("--db-repository"),i.push("public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db");let n=await Dt.$`docker run --rm -v '${t}:/.cache' ${r} ${Bi} ${i} --cache-dir '/.cache' sbom --download-db-only --quiet`;!n.stdout&&!n.stderr&&console.log(" Trivy DB Update: finished"),n.stdout&&console.log(` Trivy DB Update: ${n.stdout}`),n.stderr&&console.log(` Trivy DB Update error: ${n.stderr}`)}async function Ji(t,e,r,i,n){let o=(0,He.dirname)(e),s=(0,He.basename)(e),c=await Dt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' ${Bi} sbom --cache-dir '/.cache' --format json --output '/tmp/output/${s}' --quiet --skip-db-update /tmp/input.json`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(`  Trivy output file: ${e}`);let u=await X(e);Ns(i,u)}function Ns(t,e){if(e){for(let r of e.Results)if(r.Vulnerabilities)for(let i of r.Vulnerabilities){let n=Cs(i);t.addVulnerability(n,"trivy")}}}function Cs(t){let e=t.VulnerabilityID,r=W(t.PkgIdentifier.PURL),i=W(t.PrimaryURL),n=Rs(t.Severity);return{id:e,severity:n,scannerSeverity:{trivy:n},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[i]}}function Rs(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var Qe=class{constructor(e,r,i){this.scannerNames=e;this.cacheDir=r;this.options=i}async init(){let e=[];for(let r of this.scannerNames)switch(r){case"grype":e.push($i(this.cacheDir));break;case"trivy":e.push(Gi(this.cacheDir,this.options.trivyGithubToken));break;case"ossindex":continue}await Promise.all(e)}async scanProject(e,r,i,n){let o=[];for(let s of this.scannerNames)o.push(this.scanProjectBy(s,e,r,this.cacheDir,i,this.options.ossIndexApiUser,this.options.ossIndexApiToken,n));await Promise.all(o)}async scanProjectBy(e,r,i,n,o,s,c,u){switch(e){case"grype":return qi(n,await i.lookupOutputFileForWriting("grype-results"),r,o,u);case"trivy":return Ji(n,await i.lookupOutputFileForWriting("trivy-results"),r,o,u);case"ossindex":return Ui(await i.lookupOutputFileForWriting("ossindex-results"),r,{user:s,token:c},o,u)}}};async function Wi(t,e,r){await Be(t,async i=>{let n=await i.read(),o=!1,s=n.statements,c=[];for(let u of s){if(r&&!Et(u).has(r)||!u.products)continue;let l=u.products.findIndex(a=>a["@id"]===e);l!==-1&&(u.products.splice(l,1),o=!0,u.products.length===0&&c.push(u))}if(o){for(let u of c){let l=s.indexOf(u);s.splice(l,1)}if(s.length===0){console.info(`Remove ${e} from ${i.location} and delete file.`),await i.delete();return}console.info(`Remove ${e} from ${i.location}`),await i.write(n)}})}Ke.os.type().startsWith("Windows")&&(0,Ke.usePowerShell)();async function Hi(t){let e=await it(t),r=e.cacheDir;await ne(r)||await(0,ae.mkdir)(r);let i=e.outDir;await ne(i)&&await rt(i),await(0,ae.mkdir)(i);let n=await Xs(e,{user:t.vexUrlsUser,pw:t.vexUrlsPw}),o=new qe(e.mavenRepo,{user:t.mavenRepoUser,pw:t.mavenRepoPw}),s=Us(e,t,r),c=Date.now();console.log("Initializing scanner engines ..."),await s.init(),console.log(`Scanner engines initialization took ${Date.now()-c}ms
+`);let u=Bs(t),l=e.projects,a=new Map,f=Date.now();console.log("Scanning projects ...");let p=1,m=0,d=[];for(let x of l){if(!u(x))continue;m>=p&&(await Promise.race(d),--m);let C=new Ge(x,i,e.createSubDirsForProject),O=[],ie=Le=>{O.push(Le)};d.push(As(x,C,o,s,n,ie,a,t,O)),++m}await Promise.all(d),console.log(`Scanning took ${Date.now()-f}ms`),t.autoRemoveUnusedStatements&&await Gs(a,e.vexDir);let h=Vs(a,e.reportNoLongerDetectedVulnerabilities);return t.mode!=="test"&&(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&!e.failOnNewVulnerabilities&&console.log("##vso[task.complete result=SucceededWithIssues;]NEW_VULNERABILITIES_DETECTED"),h.hasError||(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&e.failOnNewVulnerabilities?1:0}async function As(t,e,r,i,n,o,s,c,u){try{let{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}=await $s(t,e,r,i,n,o);s.set(t.purl,{project:t,newVulns:l,noLongerDetectedVulns:a})}catch(l){let a=l;s.set(t.purl,{project:t,error:a.message,newVulns:[],noLongerDetectedVulns:[]})}if(c.verbose)for(let l of u)console.log(l)}function Vs(t,e){let r=!1,i=!1,n=!1;console.log(`
+Scan results:`);for(let o of t.values()){let s=_s(o,e);r=r||s.hasError,i=i||s.hasNewVuln,n=n||s.hasNoLongerDetectedVuln}return!r&&!i&&!n&&console.log("  No issues found"),{hasError:r,hasNewVuln:i,hasNoLongerDetectedVuln:n}}function _s(t,e){let r=t.project,i=r.purl,n=r.silent,o=J[r.minimumSeverity],s=!!t.error,c=n?[]:t.newVulns.filter(l=>o<=J[l.severity]),u=n||!e?[]:t.noLongerDetectedVulns;if(!s&&!c.length&&!u.length)return{hasError:s,hasNewVuln:!1,hasNoLongerDetectedVuln:!1};if(console.log(`  ${r.name} - ${r.version} (${i}):`),t.error&&console.error(`    Error: ${t.error}`),c.length){console.log("    New vulnerabilities:");for(let l of c)console.log(`      [${l.severity}] ${l.id}`)}if(u.length){console.log("    No longer detected vulnerabilities");for(let l of u)console.log(`      ${l}`)}return{hasError:s,hasNewVuln:c.length>0,hasNoLongerDetectedVuln:u.length>0}}async function $s(t,e,r,i,n,o){let s=await Ai(t,await e.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),r);o(`Analyzing project: ${s.name} - ${s.version} - ${s.sbomFile}`);let c=new Pe;await i.scanProject(s,e,c,o);let u=n.filterByProduct(s.purl),{unmatchedVulnerabilities:l}=c.enhanceWithVexData(u),a=u.findNotMatchingVulnerabilities(c.getAllVulnIds());return await qs(e,s,c,u,o),{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}}async function qs(t,e,r,i,n){let o=r.getAllVulnerabilitiesSortedBySeverity(),s=await t.lookupOutputFileForWriting("aggregate-results");await(0,ae.writeFile)(s,JSON.stringify(o,null,2)),n(`  Vulnerabilities output file: ${s}`);let c=await t.lookupOutputFileForWriting("aggregated-sarif-results"),u=Ri(o,e);await(0,ae.writeFile)(c,JSON.stringify(u,null,2)),n(`  Vuln Sarif output file: ${c}`);let l=i.toVexFile(o.map(f=>f.vexStatement).filter(f=>!!f));if(!l)return;let a=await t.lookupOutputFileForWriting("project-openvex-file");await(0,ae.writeFile)(a,JSON.stringify(l,null,2)),n(`  OpenVex file: ${a}`)}async function Xs(t,e){let r=t.vexDir,i;await ne(r)?i=await pe.fromFiles(r):i=new pe;for(let n of t.vexUrls)await pe.fromUrl(n,e,i);return i}function Us(t,e,r){if(e.scannerEngine)return e.scannerEngine;if(t.scanners.length===0)throw new Error("No scanners configured");return new Qe(t.scanners,r,e)}function Bs(t){let{reduceToProjectName:e,reduceToProjectVersion:r}=t;return i=>!(!i.enabled||e&&(i.name!==e||r&&i.version!==r))}async function Gs(t,e){for(let r of t.values())if(!r.project.silent)for(let i of r.noLongerDetectedVulns)await Wi(e,r.project.purl,i)}var K=process.env;(async()=>{let t=await Hi({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:K.OSS_INDEX_API_USER,ossIndexApiToken:K.OSS_INDEX_API_TOKEN,mavenRepoUser:K.MAVEN_REPO_USER,mavenRepoPw:K.MAVEN_REPO_PW,trivyGithubToken:K.TRIVY_GITHUB_TOKEN,vexUrlsUser:K.VEX_URLS_USER,vexUrlsPw:K.VEX_URLS_PW,verbose:K.VERBOSE==="true",autoRemoveUnusedStatements:K.AUTO_REMOVE_UNUSED_STATEMENTS==="true"});process.exit(t)})();
 /*! Bundled license information:
 escape-html/index.js:

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
     "name": "@conterra/vuln-scan",
-    "version": "0.0.14",
+    "version": "0.0.16",
     "description": "con terra vulnerability scan process",
     "author": "con terra GmbH",
     "license": "Apache-2.0",