@conterra/vuln-scan 0.0.15 → 0.0.17

package/README.md

@@ -211,6 +211,9 @@ TRIVY_GITHUB_TOKEN=[token]
 # (optional) to enable verbose logging, otherwise only scan results are printed
 VERBOSE=true
 
+# (optional) flag to enable automatic removal of unused statements in the vex files, during a scan.
+AUTO_REMOVE_UNUSED_STATEMENTS=true
+
 ```
 
 For each project following files are created in the `output` folder:

package/dist/add-project.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-"use strict";var j=Object.create;var P=Object.defineProperty;var D=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var N=(t,e,i,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of E(e))!T.call(t,n)&&n!==i&&P(t,n,{get:()=>e[n],enumerable:!(o=D(e,n))||o.enumerable});return t};var O=(t,e,i)=>(i=t!=null?j(V(t)):{},N(e||!t||!t.__esModule?P(i,"default",{value:t,enumerable:!0}):i,t));var p=O(require("path"));var f=require("fs/promises");async function l(t){if(await C(t))return JSON.parse(await(0,f.readFile)(t,{encoding:"utf-8"}))}async function u(t,e){await(0,f.writeFile)(t,JSON.stringify(e,null,4)+`
-`,{encoding:"utf-8"})}async function C(t){try{return await(0,f.access)(t,f.constants.F_OK),!0}catch{return!1}}async function S(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",i=d(t.workingDir,"input/vex"),o=d(t.workingDir,"output"),n=d(t.workingDir,"cache"),a=["grype","trivy","ossindex"],c=d(t.workingDir,"vuln-scan-conf.json"),r=await l(c);if(!r)throw new Error(`Missing project configuration file '${c}'`);return{projectConfigFileLocation:c,failOnNewVulnerabilities:r.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:r.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:r.createSubDirsForProject??!0,mavenRepo:r.mavenRepo??e,vexUrls:r.vexUrls??[],vexDir:d(t.workingDir,r.vexDir)??i,outDir:d(t.workingDir,r.outDir)??o,cacheDir:d(t.workingDir,r.cacheDir)??n,scanners:r.scanners??a,projects:(r.projects??[]).map(m=>{let s=m;if(!s.name)throw new Error("Project name is missing on entry:"+JSON.stringify(s));if(!s.version)throw new Error("Project version is missing on entry:"+JSON.stringify(s));if(!s.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(s));return s.enabled==null&&(s.enabled=!0),s.silent==null&&(s.silent=!1),s.minimumSeverity||(s.minimumSeverity="UNKNOWN"),s.sbomFile?{...s,sbomFile:d(t.workingDir,s.sbomFile)}:m})}}function d(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await l(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await u(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let i of await(0,w.readdir)(t,{withFileTypes:!0}))i.name.endsWith(".json")?await e(new v((0,g.resolve)(i.parentPath,i.name))):i.isDirectory()&&await h((0,g.resolve)(i.parentPath,i.name),e)}async function y({workingDir:t,projectName:e,referenceProjectVersion:i,targetProjectVersion:o}){let n=await S({workingDir:t});if(!n.projectConfigFileLocation)throw new Error("Missing project configuration file.");let a=n.projects.find(r=>r.name===e&&r.version===i);if(!a)throw new Error(`Project ${e} with version ${i} not found.`);let c=n.projects.find(r=>r.name===e&&r.version===o);c||(c=await k(e,n.projectConfigFileLocation,a,o)),await A(n.vexDir,a.purl,c.purl)}async function k(t,e,i,o){let n=await l(e),a=n.projects.find(m=>m.name===i.name&&m.version===i.version),c=n.projects.indexOf(a),r={...a};return r.version=o,r.purl=a.purl.replace(a.version,o),r.sbomMavenCoordinates&&(r.sbomMavenCoordinates=a.sbomMavenCoordinates.replace(a.version,o)),n.projects.splice(c+1,0,r),console.info(`Add project ${t} with version ${o} to ${e}`),await u(e,n),r}async function A(t,e,i){await h(t,async o=>{await $(o,e,i)})}async function $(t,e,i){let o=await t.read(),n=!1,a=o.statements;for(let c of a){if(!c.products||c.products.some(m=>m["@id"]===i))continue;let r=c.products.findIndex(m=>m["@id"]===e);r!==-1&&(c.products?.splice(r+1,0,{"@id":i}),n=!0)}n&&(console.info(`Add ${i} to ${t.location}`),t.write(o))}var b=process.argv[2];if(!b)throw new Error("Missing project name.");var x=process.argv[3];if(!x)throw new Error("Missing reference project version.");var F=process.argv[4];if(!F)throw new Error("Missing target project version.");(async()=>await y({workingDir:process.cwd(),projectName:b,referenceProjectVersion:x,targetProjectVersion:F}))();
+"use strict";var j=Object.create;var S=Object.defineProperty;var D=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var N=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var O=(t,e,n,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of E(e))!T.call(t,i)&&i!==n&&S(t,i,{get:()=>e[i],enumerable:!(o=D(e,i))||o.enumerable});return t};var A=(t,e,n)=>(n=t!=null?j(N(t)):{},O(e||!t||!t.__esModule?S(n,"default",{value:t,enumerable:!0}):n,t));var p=A(require("path"));var l=require("fs/promises");async function u(t){if(await C(t))return JSON.parse(await(0,l.readFile)(t,{encoding:"utf-8"}))}async function d(t,e){await(0,l.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}async function C(t){try{return await(0,l.access)(t,l.constants.F_OK),!0}catch{return!1}}async function y(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",n=m(t.workingDir,"input/vex"),o=m(t.workingDir,"output"),i=m(t.workingDir,"cache"),a=["grype","trivy","ossindex"],c=m(t.workingDir,"vuln-scan-conf.json"),r=await u(c);if(!r)throw new Error(`Missing project configuration file '${c}'`);let f=r.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:c,failOnNewVulnerabilities:r.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:r.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:r.createSubDirsForProject??!0,mavenRepo:r.mavenRepo??e,vexUrls:r.vexUrls??[],vexDir:m(t.workingDir,r.vexDir)??n,outDir:m(t.workingDir,r.outDir)??o,cacheDir:m(t.workingDir,r.cacheDir)??i,scanners:r.scanners??a,projects:(r.projects??[]).map(P=>{let s=P;if(!s.name)throw new Error("Project name is missing on entry:"+JSON.stringify(s));if(!s.version)throw new Error("Project version is missing on entry:"+JSON.stringify(s));if(!s.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(s));return s.purlAliases||(s.purlAliases=[]),s.enabled==null&&(s.enabled=!0),s.silent==null&&(s.silent=!1),s.minimumSeverity||(s.minimumSeverity="UNKNOWN"),s.sbomFile?{...s,sbomFile:m(t.workingDir,s.sbomFile)}:(s.detectNoLongerUsedVulnerabilities=f?s.purl.endsWith("-SNAPSHOT"):!0,P)})}}function m(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var g=require("fs/promises"),w=require("path");var h=class{constructor(e){this.location=e}async read(){let e=await u(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await d(this.location,e)}async delete(){await(0,g.unlink)(this.location)}};async function v(t,e){for(let n of await(0,g.readdir)(t,{withFileTypes:!0}))n.name.endsWith(".json")?await e(new h((0,w.resolve)(n.parentPath,n.name))):n.isDirectory()&&await v((0,w.resolve)(n.parentPath,n.name),e)}async function b({workingDir:t,projectName:e,referenceProjectVersion:n,targetProjectVersion:o}){let i=await y({workingDir:t});if(!i.projectConfigFileLocation)throw new Error("Missing project configuration file.");let a=i.projects.find(r=>r.name===e&&r.version===n);if(!a)throw new Error(`Project ${e} with version ${n} not found.`);let c=i.projects.find(r=>r.name===e&&r.version===o);c||(c=await k(e,i.projectConfigFileLocation,a,o)),await $(i.vexDir,a.purl,c.purl)}async function k(t,e,n,o){let i=await u(e),a=i.projects.find(f=>f.name===n.name&&f.version===n.version),c=i.projects.indexOf(a),r={...a};return r.version=o,r.purl=a.purl.replace(a.version,o),r.sbomMavenCoordinates&&(r.sbomMavenCoordinates=a.sbomMavenCoordinates.replace(a.version,o)),i.projects.splice(c+1,0,r),console.info(`Add project ${t} with version ${o} to ${e}`),await d(e,i),r}async function $(t,e,n){await v(t,async o=>{await M(o,e,n)})}async function M(t,e,n){let o=await t.read(),i=!1,a=o.statements;for(let c of a){if(!c.products||c.products.some(f=>f["@id"]===n))continue;let r=c.products.findIndex(f=>f["@id"]===e);r!==-1&&(c.products?.splice(r+1,0,{"@id":n}),i=!0)}i&&(console.info(`Add ${n} to ${t.location}`),t.write(o))}var F=process.argv[2];if(!F)throw new Error("Missing project name.");var x=process.argv[3];if(!x)throw new Error("Missing reference project version.");var V=process.argv[4];if(!V)throw new Error("Missing target project version.");(async()=>await b({workingDir:process.cwd(),projectName:F,referenceProjectVersion:x,targetProjectVersion:V}))();

package/dist/add-statement.js

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
-"use strict";var E=Object.create;var b=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var A=Object.getPrototypeOf,O=Object.prototype.hasOwnProperty;var C=(e,t,r,m)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of $(t))!O.call(e,a)&&a!==r&&b(e,a,{get:()=>t[a],enumerable:!(m=k(t,a))||m.enumerable});return e};var x=(e,t,r)=>(r=e!=null?E(A(e)):{},C(t||!e||!e.__esModule?b(r,"default",{value:e,enumerable:!0}):r,e));var F=x(require("node:readline/promises")),j=require("node:process");var _=x(require("path"));var c=require("fs/promises");async function v(e){if(await I(e))return JSON.parse(await(0,c.readFile)(e,{encoding:"utf-8"}))}async function I(e){try{return await(0,c.access)(e,c.constants.F_OK),!0}catch{return!1}}async function D(e){let t="https://repository.conterra.de/repository/maven-mirror-ct",r=f(e.workingDir,"input/vex"),m=f(e.workingDir,"output"),a=f(e.workingDir,"cache"),y=["grype","trivy","ossindex"],p=f(e.workingDir,"vuln-scan-conf.json"),o=await v(p);if(!o)throw new Error(`Missing project configuration file '${p}'`);return{projectConfigFileLocation:p,failOnNewVulnerabilities:o.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:o.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:o.createSubDirsForProject??!0,mavenRepo:o.mavenRepo??t,vexUrls:o.vexUrls??[],vexDir:f(e.workingDir,o.vexDir)??r,outDir:f(e.workingDir,o.outDir)??m,cacheDir:f(e.workingDir,o.cacheDir)??a,scanners:o.scanners??y,projects:(o.projects??[]).map(l=>{let i=l;if(!i.name)throw new Error("Project name is missing on entry:"+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry:"+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(i));return i.enabled==null&&(i.enabled=!0),i.silent==null&&(i.silent=!1),i.minimumSeverity||(i.minimumSeverity="UNKNOWN"),i.sbomFile?{...i,sbomFile:f(e.workingDir,i.sbomFile)}:l})}}function f(e,t){if(t)return _.default.isAbsolute(t)?t:(0,_.resolve)(e,t)}var h=require("path");var P=require("fs/promises"),N=require("crypto");(async()=>{let e=await D({workingDir:process.cwd()});console.info("## Add New VEX Statement ##");let t=F.default.createInterface({input:j.stdin,output:j.stdout}),r=await t.question(`CVE name (e.g. CVE-2023-52070):
-> `);r||(console.log("Please provide a CVE name."),process.exit(1));let m=e.projects.map(n=>`${n.name}@${n.version}`),a=await t.question(`Projects to add? Available are: 
-- ${m.join(`
+"use strict";var A=Object.create;var j=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var O=Object.getOwnPropertyNames;var k=Object.getPrototypeOf,$=Object.prototype.hasOwnProperty;var V=(e,t,r,f)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of O(t))!$.call(e,a)&&a!==r&&j(e,a,{get:()=>t[a],enumerable:!(f=E(t,a))||f.enumerable});return e};var D=(e,t,r)=>(r=e!=null?A(k(e)):{},V(t||!e||!e.__esModule?j(r,"default",{value:e,enumerable:!0}):r,e));var F=D(require("node:readline/promises")),S=require("node:process");var _=D(require("path"));var c=require("fs/promises");async function v(e){if(await C(e))return JSON.parse(await(0,c.readFile)(e,{encoding:"utf-8"}))}async function C(e){try{return await(0,c.access)(e,c.constants.F_OK),!0}catch{return!1}}async function x(e){let t="https://repository.conterra.de/repository/maven-mirror-ct",r=u(e.workingDir,"input/vex"),f=u(e.workingDir,"output"),a=u(e.workingDir,"cache"),y=["grype","trivy","ossindex"],p=u(e.workingDir,"vuln-scan-conf.json"),o=await v(p);if(!o)throw new Error(`Missing project configuration file '${p}'`);let l=o.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:p,failOnNewVulnerabilities:o.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:o.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:o.createSubDirsForProject??!0,mavenRepo:o.mavenRepo??t,vexUrls:o.vexUrls??[],vexDir:u(e.workingDir,o.vexDir)??r,outDir:u(e.workingDir,o.outDir)??f,cacheDir:u(e.workingDir,o.cacheDir)??a,scanners:o.scanners??y,projects:(o.projects??[]).map(d=>{let n=d;if(!n.name)throw new Error("Project name is missing on entry:"+JSON.stringify(n));if(!n.version)throw new Error("Project version is missing on entry:"+JSON.stringify(n));if(!n.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(n));return n.purlAliases||(n.purlAliases=[]),n.enabled==null&&(n.enabled=!0),n.silent==null&&(n.silent=!1),n.minimumSeverity||(n.minimumSeverity="UNKNOWN"),n.sbomFile?{...n,sbomFile:u(e.workingDir,n.sbomFile)}:(n.detectNoLongerUsedVulnerabilities=l?n.purl.endsWith("-SNAPSHOT"):!0,d)})}}function u(e,t){if(t)return _.default.isAbsolute(t)?t:(0,_.resolve)(e,t)}var h=require("path");var N=require("fs/promises"),P=require("crypto");(async()=>{let e=await x({workingDir:process.cwd()});console.info("## Add New VEX Statement ##");let t=F.default.createInterface({input:S.stdin,output:S.stdout}),r=await t.question(`CVE name (e.g. CVE-2023-52070):
+> `);r||(console.log("Please provide a CVE name."),process.exit(1));let f=e.projects.map(i=>`${i.name}@${i.version}`),a=await t.question(`Projects to add? Available are: 
+- ${f.join(`
 - `)}
  You can list multiple projects separated by comma:
-> `);a||(console.log("Please provide projects to add."),process.exit(1));let y=a.split(/\s*,\s*/).map(n=>{let s=n.split("@");return{name:s[0],version:s[1]}}),p=new Set(function*(){for(let n of y)for(let s of e.projects)s.name===n.name&&s.version===n.version&&(yield s.purl)}()),o=(0,h.resolve)(e.vexDir,`${r}.json`),l=await v(o),i=["under_investigation","affected","fixed","not_affected"],d=await t.question(`Status? Available are: 
-- ${i.join(`,
+> `);a||(console.log("Please provide projects to add."),process.exit(1));let y=a.split(/\s*,\s*/).map(i=>{let s=i.split("@");return{name:s[0],version:s[1]}}),p=new Set(function*(){for(let i of y)for(let s of e.projects)s.name===i.name&&s.version===i.version&&(yield s.purl)}()),o=(0,h.resolve)(e.vexDir,`${r}.json`),l=await v(o),d=["under_investigation","affected","fixed","not_affected"],n=await t.question(`Status? Available are: 
+- ${d.join(`,
 - `)}
-> `);i.includes(d)||(d?(console.log("Invalid status."),process.exit(1)):d="under_investigation");let u={};switch(d){case"affected":{let n=await t.question(`Action statement? (required):
-> `);n||(console.log("Please provide an action statement."),process.exit(1)),u.action_statement=n;break}case"not_affected":{let n=["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist"],s=await t.question(`Justification? Available are: 
-- ${n.join(`,
+> `);d.includes(n)||(n?(console.log("Invalid status."),process.exit(1)):n="under_investigation");let m={};switch(n){case"affected":{let i=await t.question(`Action statement? (required):
+> `);i||(console.log("Please provide an action statement."),process.exit(1)),m.action_statement=i;break}case"not_affected":{let i=["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist"],s=await t.question(`Justification? Available are: 
+- ${i.join(`,
 - `)}
-> (optional) `);if(s)if(!n.includes(s))console.log("Invalid justification."),process.exit(1);else{u.justification=s;let g=await t.question(`Impact statement? (optional):
-> `);g&&(u.impact_statement=g)}else{let g=await t.question(`Impact statement? (required):
-> `);g||(console.log("Please provide an impact statement."),process.exit(1)),u.impact_statement=g}break}case"fixed":{let n=await t.question(`Status note? (optional):
-> `);n&&(u.status_notes=n);break}}let w=new Date().toISOString(),S={vulnerability:{name:r},timestamp:w,products:Array.from(p).map(n=>({"@id":n})),status:d,...u};(await t.question(`Following statement will be added to ${o}:
-${JSON.stringify(S,null,2)}
+> (optional) `);if(s)if(!i.includes(s))console.log("Invalid justification."),process.exit(1);else{m.justification=s;let g=await t.question(`Impact statement? (optional):
+> `);g&&(m.impact_statement=g)}else{let g=await t.question(`Impact statement? (required):
+> `);g||(console.log("Please provide an impact statement."),process.exit(1)),m.impact_statement=g}break}case"fixed":{let i=await t.question(`Status note? (optional):
+> `);i&&(m.status_notes=i);break}}let w=new Date().toISOString(),b={vulnerability:{name:r},timestamp:w,products:Array.from(p).map(i=>({"@id":i})),status:n,...m};(await t.question(`Following statement will be added to ${o}:
+${JSON.stringify(b,null,2)}
 
 Do you want to proceed? (y/n)?
-> `)).toLowerCase()!=="y"&&(console.log("Aborted."),process.exit(0)),l?(l.last_updated=w,l.version+=1,l.statements.push(S)):l={"@context":"https://openvex.dev/ns/v0.2.0","@id":`https://openvex.dev/docs/public/vex-${(0,N.randomUUID)()}`,author:"conterra",timestamp:w,last_updated:w,version:1,statements:[S]},await(0,P.writeFile)(o,JSON.stringify(l,null,2)),t.close()})();
+> `)).toLowerCase()!=="y"&&(console.log("Aborted."),process.exit(0)),l?(l.last_updated=w,l.version+=1,l.statements.push(b)):l={"@context":"https://openvex.dev/ns/v0.2.0","@id":`https://openvex.dev/docs/public/vex-${(0,P.randomUUID)()}`,author:"conterra",timestamp:w,last_updated:w,version:1,statements:[b]},await(0,N.writeFile)(o,JSON.stringify(l,null,2)),t.close()})();

package/dist/remove-project.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-"use strict";var j=Object.create;var S=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var N=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var O=(t,e,r,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of N(e))!T.call(t,n)&&n!==r&&S(t,n,{get:()=>e[n],enumerable:!(o=E(e,n))||o.enumerable});return t};var $=(t,e,r)=>(r=t!=null?j(V(t)):{},O(e||!t||!t.__esModule?S(r,"default",{value:t,enumerable:!0}):r,t));var p=$(require("path"));var m=require("fs/promises");async function u(t){if(await C(t))return JSON.parse(await(0,m.readFile)(t,{encoding:"utf-8"}))}async function d(t,e){await(0,m.writeFile)(t,JSON.stringify(e,null,4)+`
-`,{encoding:"utf-8"})}async function C(t){try{return await(0,m.access)(t,m.constants.F_OK),!0}catch{return!1}}async function y(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=l(t.workingDir,"input/vex"),o=l(t.workingDir,"output"),n=l(t.workingDir,"cache"),f=["grype","trivy","ossindex"],a=l(t.workingDir,"vuln-scan-conf.json"),s=await u(a);if(!s)throw new Error(`Missing project configuration file '${a}'`);return{projectConfigFileLocation:a,failOnNewVulnerabilities:s.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:s.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??e,vexUrls:s.vexUrls??[],vexDir:l(t.workingDir,s.vexDir)??r,outDir:l(t.workingDir,s.outDir)??o,cacheDir:l(t.workingDir,s.cacheDir)??n,scanners:s.scanners??f,projects:(s.projects??[]).map(c=>{let i=c;if(!i.name)throw new Error("Project name is missing on entry:"+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry:"+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(i));return i.enabled==null&&(i.enabled=!0),i.silent==null&&(i.silent=!1),i.minimumSeverity||(i.minimumSeverity="UNKNOWN"),i.sbomFile?{...i,sbomFile:l(t.workingDir,i.sbomFile)}:c})}}function l(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await u(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await d(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function h(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await h((0,g.resolve)(r.parentPath,r.name),e)}function P(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}async function F({workingDir:t,projectName:e,projectVersion:r,vulnId:o}){let n=await y({workingDir:t});if(!n.projectConfigFileLocation)throw new Error("Missing project configuration file.");let f=n.projects.find(a=>a.name===e&&a.version===r);if(!f){console.info(`Project ${e} with version ${r} not found.`);return}o||await k(n.projectConfigFileLocation,f),await U(n.vexDir,f.purl,o)}async function k(t,e){let r=await u(t),o=r.projects.findIndex(n=>n.name===e.name&&n.version===e.version);r.projects.splice(o,1),console.info(`Remove project ${e.name} with version ${e.version} from ${t}`),await d(t,r)}async function U(t,e,r){await h(t,async o=>{let n=await o.read(),f=!1,a=n.statements,s=[];for(let c of a){if(r&&!P(c).has(r)||!c.products)continue;let i=c.products.findIndex(D=>D["@id"]===e);i!==-1&&(c.products.splice(i,1),f=!0,c.products.length===0&&s.push(c))}if(f){for(let c of s){let i=a.indexOf(c);a.splice(i,1)}if(a.length===0){console.info(`Remove ${e} from ${o.location} and delete file.`),await o.delete();return}console.info(`Remove ${e} from ${o.location}`),await o.write(n)}})}var x=process.argv[2];if(!x)throw new Error("Missing project name.");var b=process.argv[3];if(!b)throw new Error("Missing project version.");var A=process.argv[4];(async()=>await F({workingDir:process.cwd(),projectName:x,projectVersion:b,vulnId:A}))();
+"use strict";var D=Object.create;var y=Object.defineProperty;var N=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var T=Object.getPrototypeOf,j=Object.prototype.hasOwnProperty;var O=(t,e,r,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of E(e))!j.call(t,i)&&i!==r&&y(t,i,{get:()=>e[i],enumerable:!(o=N(e,i))||o.enumerable});return t};var $=(t,e,r)=>(r=t!=null?D(T(t)):{},O(e||!t||!t.__esModule?y(r,"default",{value:t,enumerable:!0}):r,t));var g=$(require("path"));var c=require("fs/promises");async function d(t){if(await A(t))return JSON.parse(await(0,c.readFile)(t,{encoding:"utf-8"}))}async function p(t,e){await(0,c.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}async function A(t){try{return await(0,c.access)(t,c.constants.F_OK),!0}catch{return!1}}async function P(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=f(t.workingDir,"input/vex"),o=f(t.workingDir,"output"),i=f(t.workingDir,"cache"),l=["grype","trivy","ossindex"],a=f(t.workingDir,"vuln-scan-conf.json"),s=await d(a);if(!s)throw new Error(`Missing project configuration file '${a}'`);let m=s.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:a,failOnNewVulnerabilities:s.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:s.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??e,vexUrls:s.vexUrls??[],vexDir:f(t.workingDir,s.vexDir)??r,outDir:f(t.workingDir,s.outDir)??o,cacheDir:f(t.workingDir,s.cacheDir)??i,scanners:s.scanners??l,projects:(s.projects??[]).map(u=>{let n=u;if(!n.name)throw new Error("Project name is missing on entry:"+JSON.stringify(n));if(!n.version)throw new Error("Project version is missing on entry:"+JSON.stringify(n));if(!n.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(n));return n.purlAliases||(n.purlAliases=[]),n.enabled==null&&(n.enabled=!0),n.silent==null&&(n.silent=!1),n.minimumSeverity||(n.minimumSeverity="UNKNOWN"),n.sbomFile?{...n,sbomFile:f(t.workingDir,n.sbomFile)}:(n.detectNoLongerUsedVulnerabilities=m?n.purl.endsWith("-SNAPSHOT"):!0,u)})}}function f(t,e){if(e)return g.default.isAbsolute(e)?e:(0,g.resolve)(t,e)}var w=require("fs/promises"),h=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await d(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await p(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function S(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,h.resolve)(r.parentPath,r.name))):r.isDirectory()&&await S((0,h.resolve)(r.parentPath,r.name),e)}function F(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}async function b({workingDir:t,projectName:e,projectVersion:r,vulnId:o}){let i=await P({workingDir:t});if(!i.projectConfigFileLocation)throw new Error("Missing project configuration file.");let l=i.projects.find(a=>a.name===e&&a.version===r);if(!l){console.info(`Project ${e} with version ${r} not found.`);return}o||await C(i.projectConfigFileLocation,l),await k(i.vexDir,l.purl,o)}async function C(t,e){let r=await d(t),o=r.projects.findIndex(i=>i.name===e.name&&i.version===e.version);r.projects.splice(o,1),console.info(`Remove project ${e.name} with version ${e.version} from ${t}`),await p(t,r)}async function k(t,e,r){await S(t,async o=>{let i=await o.read(),l=!1,a=i.statements,s=[];for(let m of a){if(r&&!F(m).has(r)||!m.products)continue;let u=m.products.findIndex(n=>n["@id"]===e);u!==-1&&(m.products.splice(u,1),l=!0,m.products.length===0&&s.push(m))}if(l){for(let m of s){let u=a.indexOf(m);a.splice(u,1)}if(a.length===0){console.info(`Remove ${e} from ${o.location} and delete file.`),await o.delete();return}console.info(`Remove ${e} from ${o.location}`),await o.write(i)}})}var x=process.argv[2];if(!x)throw new Error("Missing project name.");var V=process.argv[3];if(!V)throw new Error("Missing project version.");var U=process.argv[4];(async()=>await b({workingDir:process.cwd(),projectName:x,projectVersion:V,vulnId:U}))();

package/dist/schema/conf-schema.json

@@ -6,6 +6,10 @@
             "type": "boolean",
             "default": false
         },
+        "findNoLongerDetectedVulnerabilitiesOnlyForSnapshots": {
+            "type": "boolean",
+            "default": false
+        },
         "reportNoLongerDetectedVulnerabilities": {
             "type": "boolean",
             "default": true
@@ -59,6 +63,13 @@
                     "purl": {
                         "type": "string"
                     },
+                    "purlAliases": {
+                        "type": "array",
+                        "items": {
+                            "type": "string"
+                        },
+                        "default": []
+                    },
                     "sbomMavenCoordinates": {
                         "type": "string"
                     },

package/dist/vuln-scan.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-"use strict";var Hi=Object.create;var Et=Object.defineProperty;var Qi=Object.getOwnPropertyDescriptor;var Ki=Object.getOwnPropertyNames;var Yi=Object.getPrototypeOf,zi=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Zi=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Ki(e))!zi.call(t,n)&&n!==r&&Et(t,n,{get:()=>e[n],enumerable:!(i=Qi(e,n))||i.enumerable});return t};var Ye=(t,e,r)=>(r=t!=null?Hi(Yi(t)):{},Zi(e||!t||!t.__esModule?Et(r,"default",{value:t,enumerable:!0}):r,t));var F=S(tt=>{"use strict";tt.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};tt.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var Tt=S((ta,jt)=>{var Y=require("constants"),tn=process.cwd,Ee=null,rn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Ee||(Ee=tn.call(process)),Ee};try{process.cwd()}catch{}typeof process.chdir=="function"&&(rt=process.chdir,process.chdir=function(t){Ee=null,rt.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,rt));var rt;jt.exports=nn;function nn(t){Y.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=i(t.chmod),t.fchmod=i(t.fchmod),t.lchmod=i(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=n(t.chmodSync),t.fchmodSync=n(t.fchmodSync),t.lchmodSync=n(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=u(t.statSync),t.fstatSync=u(t.fstatSync),t.lstatSync=u(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,f,p){p&&process.nextTick(p)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,f,p,m){m&&process.nextTick(m)},t.lchownSync=function(){}),rn==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:function(a){function f(p,m,d){var h=Date.now(),v=0;a(p,m,function b(C){if(C&&(C.code==="EACCES"||C.code==="EPERM"||C.code==="EBUSY")&&Date.now()-h<6e4){setTimeout(function(){t.stat(m,function(D,ie){D&&D.code==="ENOENT"?a(p,m,b):d(C)})},v),v<100&&(v+=10);return}d&&d(C)})}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f}(t.rename)),t.read=typeof t.read!="function"?t.read:function(a){function f(p,m,d,h,v,b){var C;if(b&&typeof b=="function"){var D=0;C=function(ie,Le,kt){if(ie&&ie.code==="EAGAIN"&&D<10)return D++,a.call(t,p,m,d,h,v,C);b.apply(this,arguments)}}return a.call(t,p,m,d,h,v,C)}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f}(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:function(a){return function(f,p,m,d,h){for(var v=0;;)try{return a.call(t,f,p,m,d,h)}catch(b){if(b.code==="EAGAIN"&&v<10){v++;continue}throw b}}}(t.readSync);function e(a){a.lchmod=function(f,p,m){a.open(f,Y.O_WRONLY|Y.O_SYMLINK,p,function(d,h){if(d){m&&m(d);return}a.fchmod(h,p,function(v){a.close(h,function(b){m&&m(v||b)})})})},a.lchmodSync=function(f,p){var m=a.openSync(f,Y.O_WRONLY|Y.O_SYMLINK,p),d=!0,h;try{h=a.fchmodSync(m,p),d=!1}finally{if(d)try{a.closeSync(m)}catch{}else a.closeSync(m)}return h}}function r(a){Y.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(f,p,m,d){a.open(f,Y.O_SYMLINK,function(h,v){if(h){d&&d(h);return}a.futimes(v,p,m,function(b){a.close(v,function(C){d&&d(b||C)})})})},a.lutimesSync=function(f,p,m){var d=a.openSync(f,Y.O_SYMLINK),h,v=!0;try{h=a.futimesSync(d,p,m),v=!1}finally{if(v)try{a.closeSync(d)}catch{}else a.closeSync(d)}return h}):a.futimes&&(a.lutimes=function(f,p,m,d){d&&process.nextTick(d)},a.lutimesSync=function(){})}function i(a){return a&&function(f,p,m){return a.call(t,f,p,function(d){l(d)&&(d=null),m&&m.apply(this,arguments)})}}function n(a){return a&&function(f,p){try{return a.call(t,f,p)}catch(m){if(!l(m))throw m}}}function o(a){return a&&function(f,p,m,d){return a.call(t,f,p,m,function(h){l(h)&&(h=null),d&&d.apply(this,arguments)})}}function s(a){return a&&function(f,p,m){try{return a.call(t,f,p,m)}catch(d){if(!l(d))throw d}}}function c(a){return a&&function(f,p,m){typeof p=="function"&&(m=p,p=null);function d(h,v){v&&(v.uid<0&&(v.uid+=4294967296),v.gid<0&&(v.gid+=4294967296)),m&&m.apply(this,arguments)}return p?a.call(t,f,p,d):a.call(t,f,d)}}function u(a){return a&&function(f,p){var m=p?a.call(t,f,p):a.call(t,f);return m&&(m.uid<0&&(m.uid+=4294967296),m.gid<0&&(m.gid+=4294967296)),m}}function l(a){if(!a||a.code==="ENOSYS")return!0;var f=!process.getuid||process.getuid()!==0;return!!(f&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Nt=S((ra,Mt)=>{var It=require("stream").Stream;Mt.exports=on;function on(t){return{ReadStream:e,WriteStream:r};function e(i,n){if(!(this instanceof e))return new e(i,n);It.call(this);var o=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,n=n||{};for(var s=Object.keys(n),c=0,u=s.length;c<u;c++){var l=s[c];this[l]=n[l]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,f){if(a){o.emit("error",a),o.readable=!1;return}o.fd=f,o.emit("open",f),o._read()})}function r(i,n){if(!(this instanceof r))return new r(i,n);It.call(this),this.path=i,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,n=n||{};for(var o=Object.keys(n),s=0,c=o.length;s<c;s++){var u=o[s];this[u]=n[u]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var At=S((ia,Ct)=>{"use strict";Ct.exports=an;var sn=Object.getPrototypeOf||function(t){return t.__proto__};function an(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:sn(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var le=S((na,ot)=>{var k=require("fs"),cn=Tt(),ln=Nt(),un=At(),De=require("util"),N,Fe;typeof Symbol=="function"&&typeof Symbol.for=="function"?(N=Symbol.for("graceful-fs.queue"),Fe=Symbol.for("graceful-fs.previous")):(N="___graceful-fs.queue",Fe="___graceful-fs.previous");function fn(){}function _t(t,e){Object.defineProperty(t,N,{get:function(){return e}})}var oe=fn;De.debuglog?oe=De.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(oe=function(){var t=De.format.apply(De,arguments);t="GFS4: "+t.split(/\n/).join(`
-GFS4: `),console.error(t)});k[N]||(Rt=global[N]||[],_t(k,Rt),k.close=function(t){function e(r,i){return t.call(k,r,function(n){n||Vt(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,Fe,{value:t}),e}(k.close),k.closeSync=function(t){function e(r){t.apply(k,arguments),Vt()}return Object.defineProperty(e,Fe,{value:t}),e}(k.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){oe(k[N]),require("assert").equal(k[N].length,0)}));var Rt;global[N]||_t(global,k[N]);ot.exports=it(un(k));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!k.__patched&&(ot.exports=it(k),k.__patched=!0);function it(t){cn(t),t.gracefulify=it,t.createReadStream=Le,t.createWriteStream=kt;var e=t.readFile;t.readFile=r;function r(y,w,g){return typeof w=="function"&&(g=w,w=null),T(y,w,g);function T(I,O,P,E){return e(I,O,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?ce([T,[I,O,P],x,E||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(O,P,E,x,M){return i(O,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[O,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(O,P,E,x,M){return o(O,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[O,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(y,w,g,T){return typeof g=="function"&&(T=g,g=0),I(y,w,g,T);function I(O,P,E,x,M){return c(O,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[O,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var l=t.readdir;t.readdir=f;var a=/^v[0-5]\./;function f(y,w,g){typeof w=="function"&&(g=w,w=null);var T=a.test(process.version)?function(P,E,x,M){return l(P,I(P,E,x,M))}:function(P,E,x,M){return l(P,E,I(P,E,x,M))};return T(y,w,g);function I(O,P,E,x){return function(M,L){M&&(M.code==="EMFILE"||M.code==="ENFILE")?ce([T,[O,P,E],M,x||Date.now(),Date.now()]):(L&&L.sort&&L.sort(),typeof E=="function"&&E.call(this,M,L))}}}if(process.version.substr(0,4)==="v0.8"){var p=ln(t);b=p.ReadStream,D=p.WriteStream}var m=t.ReadStream;m&&(b.prototype=Object.create(m.prototype),b.prototype.open=C);var d=t.WriteStream;d&&(D.prototype=Object.create(d.prototype),D.prototype.open=ie),Object.defineProperty(t,"ReadStream",{get:function(){return b},set:function(y){b=y},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return D},set:function(y){D=y},enumerable:!0,configurable:!0});var h=b;Object.defineProperty(t,"FileReadStream",{get:function(){return h},set:function(y){h=y},enumerable:!0,configurable:!0});var v=D;Object.defineProperty(t,"FileWriteStream",{get:function(){return v},set:function(y){v=y},enumerable:!0,configurable:!0});function b(y,w){return this instanceof b?(m.apply(this,arguments),this):b.apply(Object.create(b.prototype),arguments)}function C(){var y=this;Ke(y.path,y.flags,y.mode,function(w,g){w?(y.autoClose&&y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g),y.read())})}function D(y,w){return this instanceof D?(d.apply(this,arguments),this):D.apply(Object.create(D.prototype),arguments)}function ie(){var y=this;Ke(y.path,y.flags,y.mode,function(w,g){w?(y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g))})}function Le(y,w){return new t.ReadStream(y,w)}function kt(y,w){return new t.WriteStream(y,w)}var Ji=t.open;t.open=Ke;function Ke(y,w,g,T){return typeof g=="function"&&(T=g,g=null),I(y,w,g,T);function I(O,P,E,x,M){return Ji(O,P,E,function(L,Us){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([I,[O,P,E,x],L,M||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}return t}function ce(t){oe("ENQUEUE",t[0].name,t[1]),k[N].push(t),nt()}var Oe;function Vt(){for(var t=Date.now(),e=0;e<k[N].length;++e)k[N][e].length>2&&(k[N][e][3]=t,k[N][e][4]=t);nt()}function nt(){if(clearTimeout(Oe),Oe=void 0,k[N].length!==0){var t=k[N].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)oe("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){oe("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,u=Math.max(o-n,1),l=Math.min(u*1.2,100);c>=l?(oe("RETRY",e.name,r),e.apply(null,r.concat([n]))):k[N].push(t)}Oe===void 0&&(Oe=setTimeout(nt,0))}}});var V=S(H=>{"use strict";var qt=F().fromCallback,R=le(),mn=["access","appendFile","chmod","chown","close","copyFile","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","lchmod","lchown","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof R[t]=="function");Object.assign(H,R);mn.forEach(t=>{H[t]=qt(R[t])});H.exists=function(t,e){return typeof e=="function"?R.exists(t,e):new Promise(r=>R.exists(t,r))};H.read=function(t,e,r,i,n,o){return typeof o=="function"?R.read(t,e,r,i,n,o):new Promise((s,c)=>{R.read(t,e,r,i,n,(u,l,a)=>{if(u)return c(u);s({bytesRead:l,buffer:a})})})};H.write=function(t,e,...r){return typeof r[r.length-1]=="function"?R.write(t,e,...r):new Promise((i,n)=>{R.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};H.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?R.readv(t,e,...r):new Promise((i,n)=>{R.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};H.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?R.writev(t,e,...r):new Promise((i,n)=>{R.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof R.realpath.native=="function"?H.realpath.native=qt(R.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Xt=S((sa,$t)=>{"use strict";var pn=require("path");$t.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(pn.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var Wt=S((aa,st)=>{"use strict";var Bt=V(),{checkPath:Ut}=Xt(),Gt=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};st.exports.makeDir=async(t,e)=>(Ut(t),Bt.mkdir(t,{mode:Gt(e),recursive:!0}));st.exports.makeDirSync=(t,e)=>(Ut(t),Bt.mkdirSync(t,{mode:Gt(e),recursive:!0}))});var X=S((ca,Jt)=>{"use strict";var dn=F().fromPromise,{makeDir:yn,makeDirSync:at}=Wt(),ct=dn(yn);Jt.exports={mkdirs:ct,mkdirsSync:at,mkdirp:ct,mkdirpSync:at,ensureDir:ct,ensureDirSync:at}});var z=S((la,Qt)=>{"use strict";var hn=F().fromPromise,Ht=V();function Sn(t){return Ht.access(t).then(()=>!0).catch(()=>!1)}Qt.exports={pathExists:hn(Sn),pathExistsSync:Ht.existsSync}});var lt=S((ua,Kt)=>{"use strict";var ue=V(),gn=F().fromPromise;async function vn(t,e,r){let i=await ue.open(t,"r+"),n=null;try{await ue.futimes(i,e,r)}finally{try{await ue.close(i)}catch(o){n=o}}if(n)throw n}function wn(t,e,r){let i=ue.openSync(t,"r+");return ue.futimesSync(i,e,r),ue.closeSync(i)}Kt.exports={utimesMillis:gn(vn),utimesMillisSync:wn}});var se=S((fa,er)=>{"use strict";var fe=V(),j=require("path"),Yt=F().fromPromise;function bn(t,e,r){let i=r.dereference?n=>fe.stat(n,{bigint:!0}):n=>fe.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function xn(t,e,r){let i,n=r.dereference?s=>fe.statSync(s,{bigint:!0}):s=>fe.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function Ln(t,e,r,i){let{srcStat:n,destStat:o}=await bn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&ut(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}function Pn(t,e,r,i){let{srcStat:n,destStat:o}=xn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&ut(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}async function zt(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=await fe.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return zt(t,e,o,i)}function Zt(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=fe.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return Zt(t,e,o,i)}function ye(t,e){return e.ino&&e.dev&&e.ino===t.ino&&e.dev===t.dev}function ut(t,e){let r=j.resolve(t).split(j.sep).filter(n=>n),i=j.resolve(e).split(j.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function je(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}er.exports={checkPaths:Yt(Ln),checkPathsSync:Pn,checkParentPaths:Yt(zt),checkParentPathsSync:Zt,isSrcSubdir:ut,areIdentical:ye}});var or=S((ma,nr)=>{"use strict";var A=V(),he=require("path"),{mkdirs:kn}=X(),{pathExists:En}=z(),{utimesMillis:Dn}=lt(),Se=se();async function On(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
+"use strict";var Ki=Object.create;var jt=Object.defineProperty;var Yi=Object.getOwnPropertyDescriptor;var zi=Object.getOwnPropertyNames;var Zi=Object.getPrototypeOf,en=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var tn=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of zi(e))!en.call(t,n)&&n!==r&&jt(t,n,{get:()=>e[n],enumerable:!(i=Yi(e,n))||i.enumerable});return t};var ze=(t,e,r)=>(r=t!=null?Ki(Zi(t)):{},tn(e||!t||!t.__esModule?jt(r,"default",{value:t,enumerable:!0}):r,t));var F=S(nt=>{"use strict";nt.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};nt.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var It=S((na,Nt)=>{var z=require("constants"),nn=process.cwd,Ee=null,on=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Ee||(Ee=nn.call(process)),Ee};try{process.cwd()}catch{}typeof process.chdir=="function"&&(ot=process.chdir,process.chdir=function(t){Ee=null,ot.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,ot));var ot;Nt.exports=sn;function sn(t){z.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=i(t.chmod),t.fchmod=i(t.fchmod),t.lchmod=i(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=n(t.chmodSync),t.fchmodSync=n(t.fchmodSync),t.lchmodSync=n(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=l(t.statSync),t.fstatSync=l(t.fstatSync),t.lstatSync=l(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,m,d){d&&process.nextTick(d)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,m,d,f){f&&process.nextTick(f)},t.lchownSync=function(){}),on==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:function(a){function m(d,f,p){var h=Date.now(),v=0;a(d,f,function b(C){if(C&&(C.code==="EACCES"||C.code==="EPERM"||C.code==="EBUSY")&&Date.now()-h<6e4){setTimeout(function(){t.stat(f,function(O,ie){O&&O.code==="ENOENT"?a(d,f,b):p(C)})},v),v<100&&(v+=10);return}p&&p(C)})}return Object.setPrototypeOf&&Object.setPrototypeOf(m,a),m}(t.rename)),t.read=typeof t.read!="function"?t.read:function(a){function m(d,f,p,h,v,b){var C;if(b&&typeof b=="function"){var O=0;C=function(ie,Le,Ft){if(ie&&ie.code==="EAGAIN"&&O<10)return O++,a.call(t,d,f,p,h,v,C);b.apply(this,arguments)}}return a.call(t,d,f,p,h,v,C)}return Object.setPrototypeOf&&Object.setPrototypeOf(m,a),m}(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:function(a){return function(m,d,f,p,h){for(var v=0;;)try{return a.call(t,m,d,f,p,h)}catch(b){if(b.code==="EAGAIN"&&v<10){v++;continue}throw b}}}(t.readSync);function e(a){a.lchmod=function(m,d,f){a.open(m,z.O_WRONLY|z.O_SYMLINK,d,function(p,h){if(p){f&&f(p);return}a.fchmod(h,d,function(v){a.close(h,function(b){f&&f(v||b)})})})},a.lchmodSync=function(m,d){var f=a.openSync(m,z.O_WRONLY|z.O_SYMLINK,d),p=!0,h;try{h=a.fchmodSync(f,d),p=!1}finally{if(p)try{a.closeSync(f)}catch{}else a.closeSync(f)}return h}}function r(a){z.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(m,d,f,p){a.open(m,z.O_SYMLINK,function(h,v){if(h){p&&p(h);return}a.futimes(v,d,f,function(b){a.close(v,function(C){p&&p(b||C)})})})},a.lutimesSync=function(m,d,f){var p=a.openSync(m,z.O_SYMLINK),h,v=!0;try{h=a.futimesSync(p,d,f),v=!1}finally{if(v)try{a.closeSync(p)}catch{}else a.closeSync(p)}return h}):a.futimes&&(a.lutimes=function(m,d,f,p){p&&process.nextTick(p)},a.lutimesSync=function(){})}function i(a){return a&&function(m,d,f){return a.call(t,m,d,function(p){u(p)&&(p=null),f&&f.apply(this,arguments)})}}function n(a){return a&&function(m,d){try{return a.call(t,m,d)}catch(f){if(!u(f))throw f}}}function o(a){return a&&function(m,d,f,p){return a.call(t,m,d,f,function(h){u(h)&&(h=null),p&&p.apply(this,arguments)})}}function s(a){return a&&function(m,d,f){try{return a.call(t,m,d,f)}catch(p){if(!u(p))throw p}}}function c(a){return a&&function(m,d,f){typeof d=="function"&&(f=d,d=null);function p(h,v){v&&(v.uid<0&&(v.uid+=4294967296),v.gid<0&&(v.gid+=4294967296)),f&&f.apply(this,arguments)}return d?a.call(t,m,d,p):a.call(t,m,p)}}function l(a){return a&&function(m,d){var f=d?a.call(t,m,d):a.call(t,m);return f&&(f.uid<0&&(f.uid+=4294967296),f.gid<0&&(f.gid+=4294967296)),f}}function u(a){if(!a||a.code==="ENOSYS")return!0;var m=!process.getuid||process.getuid()!==0;return!!(m&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Rt=S((oa,Ct)=>{var Mt=require("stream").Stream;Ct.exports=an;function an(t){return{ReadStream:e,WriteStream:r};function e(i,n){if(!(this instanceof e))return new e(i,n);Mt.call(this);var o=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,n=n||{};for(var s=Object.keys(n),c=0,l=s.length;c<l;c++){var u=s[c];this[u]=n[u]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,m){if(a){o.emit("error",a),o.readable=!1;return}o.fd=m,o.emit("open",m),o._read()})}function r(i,n){if(!(this instanceof r))return new r(i,n);Mt.call(this),this.path=i,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,n=n||{};for(var o=Object.keys(n),s=0,c=o.length;s<c;s++){var l=o[s];this[l]=n[l]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var Vt=S((sa,At)=>{"use strict";At.exports=ln;var cn=Object.getPrototypeOf||function(t){return t.__proto__};function ln(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:cn(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var le=S((aa,ct)=>{var k=require("fs"),un=It(),fn=Rt(),mn=Vt(),Oe=require("util"),M,Fe;typeof Symbol=="function"&&typeof Symbol.for=="function"?(M=Symbol.for("graceful-fs.queue"),Fe=Symbol.for("graceful-fs.previous")):(M="___graceful-fs.queue",Fe="___graceful-fs.previous");function dn(){}function qt(t,e){Object.defineProperty(t,M,{get:function(){return e}})}var oe=dn;Oe.debuglog?oe=Oe.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(oe=function(){var t=Oe.format.apply(Oe,arguments);t="GFS4: "+t.split(/\n/).join(`
+GFS4: `),console.error(t)});k[M]||(_t=global[M]||[],qt(k,_t),k.close=function(t){function e(r,i){return t.call(k,r,function(n){n||$t(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,Fe,{value:t}),e}(k.close),k.closeSync=function(t){function e(r){t.apply(k,arguments),$t()}return Object.defineProperty(e,Fe,{value:t}),e}(k.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){oe(k[M]),require("assert").equal(k[M].length,0)}));var _t;global[M]||qt(global,k[M]);ct.exports=st(mn(k));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!k.__patched&&(ct.exports=st(k),k.__patched=!0);function st(t){un(t),t.gracefulify=st,t.createReadStream=Le,t.createWriteStream=Ft;var e=t.readFile;t.readFile=r;function r(y,w,g){return typeof w=="function"&&(g=w,w=null),T(y,w,g);function T(N,D,P,E){return e(N,D,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?ce([T,[N,D,P],x,E||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(y,w,g,T){return typeof g=="function"&&(T=g,g=null),N(y,w,g,T);function N(D,P,E,x,I){return i(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([N,[D,P,E,x],L,I||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(y,w,g,T){return typeof g=="function"&&(T=g,g=null),N(y,w,g,T);function N(D,P,E,x,I){return o(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([N,[D,P,E,x],L,I||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=l);function l(y,w,g,T){return typeof g=="function"&&(T=g,g=0),N(y,w,g,T);function N(D,P,E,x,I){return c(D,P,E,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([N,[D,P,E,x],L,I||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}var u=t.readdir;t.readdir=m;var a=/^v[0-5]\./;function m(y,w,g){typeof w=="function"&&(g=w,w=null);var T=a.test(process.version)?function(P,E,x,I){return u(P,N(P,E,x,I))}:function(P,E,x,I){return u(P,E,N(P,E,x,I))};return T(y,w,g);function N(D,P,E,x){return function(I,L){I&&(I.code==="EMFILE"||I.code==="ENFILE")?ce([T,[D,P,E],I,x||Date.now(),Date.now()]):(L&&L.sort&&L.sort(),typeof E=="function"&&E.call(this,I,L))}}}if(process.version.substr(0,4)==="v0.8"){var d=fn(t);b=d.ReadStream,O=d.WriteStream}var f=t.ReadStream;f&&(b.prototype=Object.create(f.prototype),b.prototype.open=C);var p=t.WriteStream;p&&(O.prototype=Object.create(p.prototype),O.prototype.open=ie),Object.defineProperty(t,"ReadStream",{get:function(){return b},set:function(y){b=y},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return O},set:function(y){O=y},enumerable:!0,configurable:!0});var h=b;Object.defineProperty(t,"FileReadStream",{get:function(){return h},set:function(y){h=y},enumerable:!0,configurable:!0});var v=O;Object.defineProperty(t,"FileWriteStream",{get:function(){return v},set:function(y){v=y},enumerable:!0,configurable:!0});function b(y,w){return this instanceof b?(f.apply(this,arguments),this):b.apply(Object.create(b.prototype),arguments)}function C(){var y=this;Ye(y.path,y.flags,y.mode,function(w,g){w?(y.autoClose&&y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g),y.read())})}function O(y,w){return this instanceof O?(p.apply(this,arguments),this):O.apply(Object.create(O.prototype),arguments)}function ie(){var y=this;Ye(y.path,y.flags,y.mode,function(w,g){w?(y.destroy(),y.emit("error",w)):(y.fd=g,y.emit("open",g))})}function Le(y,w){return new t.ReadStream(y,w)}function Ft(y,w){return new t.WriteStream(y,w)}var Qi=t.open;t.open=Ye;function Ye(y,w,g,T){return typeof g=="function"&&(T=g,g=null),N(y,w,g,T);function N(D,P,E,x,I){return Qi(D,P,E,function(L,Js){L&&(L.code==="EMFILE"||L.code==="ENFILE")?ce([N,[D,P,E,x],L,I||Date.now(),Date.now()]):typeof x=="function"&&x.apply(this,arguments)})}}return t}function ce(t){oe("ENQUEUE",t[0].name,t[1]),k[M].push(t),at()}var De;function $t(){for(var t=Date.now(),e=0;e<k[M].length;++e)k[M][e].length>2&&(k[M][e][3]=t,k[M][e][4]=t);at()}function at(){if(clearTimeout(De),De=void 0,k[M].length!==0){var t=k[M].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)oe("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){oe("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,l=Math.max(o-n,1),u=Math.min(l*1.2,100);c>=u?(oe("RETRY",e.name,r),e.apply(null,r.concat([n]))):k[M].push(t)}De===void 0&&(De=setTimeout(at,0))}}});var V=S(H=>{"use strict";var Ut=F().fromCallback,A=le(),pn=["access","appendFile","chmod","chown","close","copyFile","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","lchmod","lchown","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof A[t]=="function");Object.assign(H,A);pn.forEach(t=>{H[t]=Ut(A[t])});H.exists=function(t,e){return typeof e=="function"?A.exists(t,e):new Promise(r=>A.exists(t,r))};H.read=function(t,e,r,i,n,o){return typeof o=="function"?A.read(t,e,r,i,n,o):new Promise((s,c)=>{A.read(t,e,r,i,n,(l,u,a)=>{if(l)return c(l);s({bytesRead:u,buffer:a})})})};H.write=function(t,e,...r){return typeof r[r.length-1]=="function"?A.write(t,e,...r):new Promise((i,n)=>{A.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};H.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?A.readv(t,e,...r):new Promise((i,n)=>{A.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};H.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?A.writev(t,e,...r):new Promise((i,n)=>{A.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof A.realpath.native=="function"?H.realpath.native=Ut(A.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Bt=S((la,Xt)=>{"use strict";var yn=require("path");Xt.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(yn.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var Ht=S((ua,lt)=>{"use strict";var Gt=V(),{checkPath:Wt}=Bt(),Jt=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};lt.exports.makeDir=async(t,e)=>(Wt(t),Gt.mkdir(t,{mode:Jt(e),recursive:!0}));lt.exports.makeDirSync=(t,e)=>(Wt(t),Gt.mkdirSync(t,{mode:Jt(e),recursive:!0}))});var X=S((fa,Qt)=>{"use strict";var hn=F().fromPromise,{makeDir:Sn,makeDirSync:ut}=Ht(),ft=hn(Sn);Qt.exports={mkdirs:ft,mkdirsSync:ut,mkdirp:ft,mkdirpSync:ut,ensureDir:ft,ensureDirSync:ut}});var Z=S((ma,Yt)=>{"use strict";var gn=F().fromPromise,Kt=V();function vn(t){return Kt.access(t).then(()=>!0).catch(()=>!1)}Yt.exports={pathExists:gn(vn),pathExistsSync:Kt.existsSync}});var mt=S((da,zt)=>{"use strict";var ue=V(),wn=F().fromPromise;async function bn(t,e,r){let i=await ue.open(t,"r+"),n=null;try{await ue.futimes(i,e,r)}finally{try{await ue.close(i)}catch(o){n=o}}if(n)throw n}function xn(t,e,r){let i=ue.openSync(t,"r+");return ue.futimesSync(i,e,r),ue.closeSync(i)}zt.exports={utimesMillis:wn(bn),utimesMillisSync:xn}});var se=S((pa,rr)=>{"use strict";var fe=V(),j=require("path"),Zt=F().fromPromise;function Ln(t,e,r){let i=r.dereference?n=>fe.stat(n,{bigint:!0}):n=>fe.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function Pn(t,e,r){let i,n=r.dereference?s=>fe.statSync(s,{bigint:!0}):s=>fe.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function kn(t,e,r,i){let{srcStat:n,destStat:o}=await Ln(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&dt(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}function En(t,e,r,i){let{srcStat:n,destStat:o}=Pn(t,e,i);if(o){if(ye(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&dt(t,e))throw new Error(je(t,e,r));return{srcStat:n,destStat:o}}async function er(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=await fe.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return er(t,e,o,i)}function tr(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=fe.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(ye(e,s))throw new Error(je(t,r,i));return tr(t,e,o,i)}function ye(t,e){return e.ino&&e.dev&&e.ino===t.ino&&e.dev===t.dev}function dt(t,e){let r=j.resolve(t).split(j.sep).filter(n=>n),i=j.resolve(e).split(j.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function je(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}rr.exports={checkPaths:Zt(kn),checkPathsSync:En,checkParentPaths:Zt(er),checkParentPathsSync:tr,isSrcSubdir:dt,areIdentical:ye}});var ar=S((ya,sr)=>{"use strict";var R=V(),he=require("path"),{mkdirs:On}=X(),{pathExists:Dn}=Z(),{utimesMillis:Fn}=mt(),Se=se();async function jn(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
 
-	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await Se.checkPaths(t,e,"copy",r);if(await Se.checkParentPaths(t,i,e,"copy"),!await rr(t,e,r))return;let s=he.dirname(e);await En(s)||await kn(s),await ir(n,t,e,r)}async function rr(t,e,r){return r.filter?r.filter(t,e):!0}async function ir(t,e,r,i){let o=await(i.dereference?A.stat:A.lstat)(e);if(o.isDirectory())return In(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Fn(o,t,e,r,i);if(o.isSymbolicLink())return Mn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Fn(t,e,r,i,n){if(!e)return tr(t,r,i,n);if(n.overwrite)return await A.unlink(i),tr(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function tr(t,e,r,i){if(await A.copyFile(e,r),i.preserveTimestamps){jn(t.mode)&&await Tn(r,t.mode);let n=await A.stat(e);await Dn(r,n.atime,n.mtime)}return A.chmod(r,t.mode)}function jn(t){return(t&128)===0}function Tn(t,e){return A.chmod(t,e|128)}async function In(t,e,r,i,n){e||await A.mkdir(i);let o=await A.readdir(r);await Promise.all(o.map(async s=>{let c=he.join(r,s),u=he.join(i,s);if(!await rr(c,u,n))return;let{destStat:a}=await Se.checkPaths(c,u,"copy",n);return ir(a,c,u,n)})),e||await A.chmod(i,t.mode)}async function Mn(t,e,r,i){let n=await A.readlink(e);if(i.dereference&&(n=he.resolve(process.cwd(),n)),!t)return A.symlink(n,r);let o=null;try{o=await A.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return A.symlink(n,r);throw s}if(i.dereference&&(o=he.resolve(process.cwd(),o)),Se.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(Se.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await A.unlink(r),A.symlink(n,r)}nr.exports=On});var ur=S((pa,lr)=>{"use strict";var _=le(),ge=require("path"),Nn=X().mkdirsSync,Cn=lt().utimesMillisSync,ve=se();function An(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
+	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await Se.checkPaths(t,e,"copy",r);if(await Se.checkParentPaths(t,i,e,"copy"),!await nr(t,e,r))return;let s=he.dirname(e);await Dn(s)||await On(s),await or(n,t,e,r)}async function nr(t,e,r){return r.filter?r.filter(t,e):!0}async function or(t,e,r,i){let o=await(i.dereference?R.stat:R.lstat)(e);if(o.isDirectory())return Mn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Tn(o,t,e,r,i);if(o.isSymbolicLink())return Cn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Tn(t,e,r,i,n){if(!e)return ir(t,r,i,n);if(n.overwrite)return await R.unlink(i),ir(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function ir(t,e,r,i){if(await R.copyFile(e,r),i.preserveTimestamps){Nn(t.mode)&&await In(r,t.mode);let n=await R.stat(e);await Fn(r,n.atime,n.mtime)}return R.chmod(r,t.mode)}function Nn(t){return(t&128)===0}function In(t,e){return R.chmod(t,e|128)}async function Mn(t,e,r,i,n){e||await R.mkdir(i);let o=await R.readdir(r);await Promise.all(o.map(async s=>{let c=he.join(r,s),l=he.join(i,s);if(!await nr(c,l,n))return;let{destStat:a}=await Se.checkPaths(c,l,"copy",n);return or(a,c,l,n)})),e||await R.chmod(i,t.mode)}async function Cn(t,e,r,i){let n=await R.readlink(e);if(i.dereference&&(n=he.resolve(process.cwd(),n)),!t)return R.symlink(n,r);let o=null;try{o=await R.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return R.symlink(n,r);throw s}if(i.dereference&&(o=he.resolve(process.cwd(),o)),Se.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(Se.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await R.unlink(r),R.symlink(n,r)}sr.exports=jn});var mr=S((ha,fr)=>{"use strict";var _=le(),ge=require("path"),Rn=X().mkdirsSync,An=mt().utimesMillisSync,ve=se();function Vn(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
 
-	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ve.checkPathsSync(t,e,"copy",r);if(ve.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ge.dirname(e);return _.existsSync(o)||Nn(o),sr(n,t,e,r)}function sr(t,e,r,i){let o=(i.dereference?_.statSync:_.lstatSync)(e);if(o.isDirectory())return Bn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Rn(o,t,e,r,i);if(o.isSymbolicLink())return Wn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function Rn(t,e,r,i,n){return e?Vn(t,r,i,n):ar(t,r,i,n)}function Vn(t,e,r,i){if(i.overwrite)return _.unlinkSync(r),ar(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function ar(t,e,r,i){return _.copyFileSync(e,r),i.preserveTimestamps&&_n(t.mode,e,r),ft(r,t.mode)}function _n(t,e,r){return qn(t)&&$n(r,t),Xn(e,r)}function qn(t){return(t&128)===0}function $n(t,e){return ft(t,e|128)}function ft(t,e){return _.chmodSync(t,e)}function Xn(t,e){let r=_.statSync(t);return Cn(e,r.atime,r.mtime)}function Bn(t,e,r,i,n){return e?cr(r,i,n):Un(t.mode,r,i,n)}function Un(t,e,r,i){return _.mkdirSync(r),cr(e,r,i),ft(r,t)}function cr(t,e,r){_.readdirSync(t).forEach(i=>Gn(i,t,e,r))}function Gn(t,e,r,i){let n=ge.join(e,t),o=ge.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=ve.checkPathsSync(n,o,"copy",i);return sr(s,n,o,i)}function Wn(t,e,r,i){let n=_.readlinkSync(e);if(i.dereference&&(n=ge.resolve(process.cwd(),n)),t){let o;try{o=_.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return _.symlinkSync(n,r);throw s}if(i.dereference&&(o=ge.resolve(process.cwd(),o)),ve.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(ve.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return Jn(n,r)}else return _.symlinkSync(n,r)}function Jn(t,e){return _.unlinkSync(e),_.symlinkSync(t,e)}lr.exports=An});var Te=S((da,fr)=>{"use strict";var Hn=F().fromPromise;fr.exports={copy:Hn(or()),copySync:ur()}});var we=S((ya,pr)=>{"use strict";var mr=le(),Qn=F().fromCallback;function Kn(t,e){mr.rm(t,{recursive:!0,force:!0},e)}function Yn(t){mr.rmSync(t,{recursive:!0,force:!0})}pr.exports={remove:Qn(Kn),removeSync:Yn}});var br=S((ha,wr)=>{"use strict";var zn=F().fromPromise,hr=V(),Sr=require("path"),gr=X(),vr=we(),dr=zn(async function(e){let r;try{r=await hr.readdir(e)}catch{return gr.mkdirs(e)}return Promise.all(r.map(i=>vr.remove(Sr.join(e,i))))});function yr(t){let e;try{e=hr.readdirSync(t)}catch{return gr.mkdirsSync(t)}e.forEach(r=>{r=Sr.join(t,r),vr.removeSync(r)})}wr.exports={emptyDirSync:yr,emptydirSync:yr,emptyDir:dr,emptydir:dr}});var kr=S((Sa,Pr)=>{"use strict";var Zn=F().fromPromise,xr=require("path"),Q=V(),Lr=X();async function eo(t){let e;try{e=await Q.stat(t)}catch{}if(e&&e.isFile())return;let r=xr.dirname(t),i=null;try{i=await Q.stat(r)}catch(n){if(n.code==="ENOENT"){await Lr.mkdirs(r),await Q.writeFile(t,"");return}else throw n}i.isDirectory()?await Q.writeFile(t,""):await Q.readdir(r)}function to(t){let e;try{e=Q.statSync(t)}catch{}if(e&&e.isFile())return;let r=xr.dirname(t);try{Q.statSync(r).isDirectory()||Q.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")Lr.mkdirsSync(r);else throw i}Q.writeFileSync(t,"")}Pr.exports={createFile:Zn(eo),createFileSync:to}});var jr=S((ga,Fr)=>{"use strict";var ro=F().fromPromise,Er=require("path"),Z=V(),Dr=X(),{pathExists:io}=z(),{areIdentical:Or}=se();async function no(t,e){let r;try{r=await Z.lstat(e)}catch{}let i;try{i=await Z.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&Or(i,r))return;let n=Er.dirname(e);await io(n)||await Dr.mkdirs(n),await Z.link(t,e)}function oo(t,e){let r;try{r=Z.lstatSync(e)}catch{}try{let o=Z.lstatSync(t);if(r&&Or(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Er.dirname(e);return Z.existsSync(i)||Dr.mkdirsSync(i),Z.linkSync(t,e)}Fr.exports={createLink:ro(no),createLinkSync:oo}});var Ir=S((va,Tr)=>{"use strict";var ee=require("path"),be=V(),{pathExists:so}=z(),ao=F().fromPromise;async function co(t,e){if(ee.isAbsolute(t)){try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(await so(i))return{toCwd:i,toDst:t};try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ee.relative(r,t)}}function lo(t,e){if(ee.isAbsolute(t)){if(!be.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(be.existsSync(i))return{toCwd:i,toDst:t};if(!be.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ee.relative(r,t)}}Tr.exports={symlinkPaths:ao(co),symlinkPathsSync:lo}});var Cr=S((wa,Nr)=>{"use strict";var Mr=V(),uo=F().fromPromise;async function fo(t,e){if(e)return e;let r;try{r=await Mr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function mo(t,e){if(e)return e;let r;try{r=Mr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Nr.exports={symlinkType:uo(fo),symlinkTypeSync:mo}});var _r=S((ba,Vr)=>{"use strict";var po=F().fromPromise,Ar=require("path"),U=V(),{mkdirs:yo,mkdirsSync:ho}=X(),{symlinkPaths:So,symlinkPathsSync:go}=Ir(),{symlinkType:vo,symlinkTypeSync:wo}=Cr(),{pathExists:bo}=z(),{areIdentical:Rr}=se();async function xo(t,e,r){let i;try{i=await U.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,u]=await Promise.all([U.stat(t),U.stat(e)]);if(Rr(c,u))return}let n=await So(t,e);t=n.toDst;let o=await vo(n.toCwd,r),s=Ar.dirname(e);return await bo(s)||await yo(s),U.symlink(t,e,o)}function Lo(t,e,r){let i;try{i=U.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=U.statSync(t),u=U.statSync(e);if(Rr(c,u))return}let n=go(t,e);t=n.toDst,r=wo(n.toCwd,r);let o=Ar.dirname(e);return U.existsSync(o)||ho(o),U.symlinkSync(t,e,r)}Vr.exports={createSymlink:po(xo),createSymlinkSync:Lo}});var Jr=S((xa,Wr)=>{"use strict";var{createFile:qr,createFileSync:$r}=kr(),{createLink:Xr,createLinkSync:Br}=jr(),{createSymlink:Ur,createSymlinkSync:Gr}=_r();Wr.exports={createFile:qr,createFileSync:$r,ensureFile:qr,ensureFileSync:$r,createLink:Xr,createLinkSync:Br,ensureLink:Xr,ensureLinkSync:Br,createSymlink:Ur,createSymlinkSync:Gr,ensureSymlink:Ur,ensureSymlinkSync:Gr}});var Ie=S((La,Hr)=>{function Po(t,{EOL:e=`
-`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function ko(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Hr.exports={stringify:Po,stripBom:ko}});var zr=S((Pa,Yr)=>{var me;try{me=le()}catch{me=require("fs")}var Me=F(),{stringify:Qr,stripBom:Kr}=Ie();async function Eo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0,n=await Me.fromCallback(r.readFile)(t,e);n=Kr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Do=Me.fromPromise(Eo);function Oo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Kr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function Fo(t,e,r={}){let i=r.fs||me,n=Qr(e,r);await Me.fromCallback(i.writeFile)(t,n,r)}var jo=Me.fromPromise(Fo);function To(t,e,r={}){let i=r.fs||me,n=Qr(e,r);return i.writeFileSync(t,n,r)}var Io={readFile:Do,readFileSync:Oo,writeFile:jo,writeFileSync:To};Yr.exports=Io});var ei=S((ka,Zr)=>{"use strict";var Ne=zr();Zr.exports={readJson:Ne.readFile,readJsonSync:Ne.readFileSync,writeJson:Ne.writeFile,writeJsonSync:Ne.writeFileSync}});var Ce=S((Ea,ii)=>{"use strict";var Mo=F().fromPromise,mt=V(),ti=require("path"),ri=X(),No=z().pathExists;async function Co(t,e,r="utf-8"){let i=ti.dirname(t);return await No(i)||await ri.mkdirs(i),mt.writeFile(t,e,r)}function Ao(t,...e){let r=ti.dirname(t);mt.existsSync(r)||ri.mkdirsSync(r),mt.writeFileSync(t,...e)}ii.exports={outputFile:Mo(Co),outputFileSync:Ao}});var oi=S((Da,ni)=>{"use strict";var{stringify:Ro}=Ie(),{outputFile:Vo}=Ce();async function _o(t,e,r={}){let i=Ro(e,r);await Vo(t,i,r)}ni.exports=_o});var ai=S((Oa,si)=>{"use strict";var{stringify:qo}=Ie(),{outputFileSync:$o}=Ce();function Xo(t,e,r){let i=qo(e,r);$o(t,i,r)}si.exports=Xo});var li=S((Fa,ci)=>{"use strict";var Bo=F().fromPromise,q=ei();q.outputJson=Bo(oi());q.outputJsonSync=ai();q.outputJSON=q.outputJson;q.outputJSONSync=q.outputJsonSync;q.writeJSON=q.writeJson;q.writeJSONSync=q.writeJsonSync;q.readJSON=q.readJson;q.readJSONSync=q.readJsonSync;ci.exports=q});var di=S((ja,pi)=>{"use strict";var Uo=V(),ui=require("path"),{copy:Go}=Te(),{remove:mi}=we(),{mkdirp:Wo}=X(),{pathExists:Jo}=z(),fi=se();async function Ho(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await fi.checkPaths(t,e,"move",r);await fi.checkParentPaths(t,n,e,"move");let s=ui.dirname(e);return ui.parse(s).root!==s&&await Wo(s),Qo(t,e,i,o)}async function Qo(t,e,r,i){if(!i){if(r)await mi(e);else if(await Jo(e))throw new Error("dest already exists.")}try{await Uo.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Ko(t,e,r)}}async function Ko(t,e,r){return await Go(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),mi(t)}pi.exports=Ho});var vi=S((Ta,gi)=>{"use strict";var hi=le(),dt=require("path"),Yo=Te().copySync,Si=we().removeSync,zo=X().mkdirpSync,yi=se();function Zo(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=yi.checkPathsSync(t,e,"move",r);return yi.checkParentPathsSync(t,n,e,"move"),es(e)||zo(dt.dirname(e)),ts(t,e,i,o)}function es(t){let e=dt.dirname(t);return dt.parse(e).root===e}function ts(t,e,r,i){if(i)return pt(t,e,r);if(r)return Si(e),pt(t,e,r);if(hi.existsSync(e))throw new Error("dest already exists.");return pt(t,e,r)}function pt(t,e,r){try{hi.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return rs(t,e,r)}}function rs(t,e,r){return Yo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Si(t)}gi.exports=Zo});var bi=S((Ia,wi)=>{"use strict";var is=F().fromPromise;wi.exports={move:is(di()),moveSync:vi()}});var Li=S((Ma,xi)=>{"use strict";xi.exports={...V(),...Te(),...br(),...Jr(),...li(),...X(),...bi(),...Ce(),...z(),...we()}});var Pi=S(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.EXTENSIONS_LANGUAGES=void 0;Ae.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var xe=S(yt=>{"use strict";Object.defineProperty(yt,"__esModule",{value:!0});yt.setOptionValues=ns;function ns(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Ei=S(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.SarifBuilder=void 0;var os=require("path"),ki=Li(),ss=Pi(),as=xe(),ht=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,as.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();ki.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await ki.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((i=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var f;return((f=a?.location)===null||f===void 0?void 0:f.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=os.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),f=ss.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:f,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,f;let p=(f=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||f===void 0?void 0:f.uri;return p&&s.indexOf(p)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(p)),l})),u)),e}};Re.SarifBuilder=ht});var Di=S(Ve=>{"use strict";Object.defineProperty(Ve,"__esModule",{value:!0});Ve.SarifResultBuilder=void 0;var cs=xe(),St=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,cs.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Ve.SarifResultBuilder=St});var Oi=S(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});_e.SarifRuleBuilder=void 0;var ls=xe(),gt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,ls.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};_e.SarifRuleBuilder=gt});var Fi=S(qe=>{"use strict";Object.defineProperty(qe,"__esModule",{value:!0});qe.SarifRunBuilder=void 0;var us=xe(),vt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,us.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};qe.SarifRunBuilder=vt});var ji=S(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.SarifResultBuilder=G.SarifRuleBuilder=G.SarifRunBuilder=G.SarifBuilder=void 0;var fs=Ei();Object.defineProperty(G,"SarifBuilder",{enumerable:!0,get:function(){return fs.SarifBuilder}});var ms=Di();Object.defineProperty(G,"SarifResultBuilder",{enumerable:!0,get:function(){return ms.SarifResultBuilder}});var ps=Oi();Object.defineProperty(G,"SarifRuleBuilder",{enumerable:!0,get:function(){return ps.SarifRuleBuilder}});var ds=Fi();Object.defineProperty(G,"SarifRunBuilder",{enumerable:!0,get:function(){return ds.SarifRunBuilder}})});var Ii=S(($a,Ti)=>{"use strict";var ys=/["'&<>]/;Ti.exports=hs;function hs(t){var e=""+t,r=ys.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Qe=require("zx"),ae=require("fs/promises");var W={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var Pe=class{allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=Dt(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=en(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=ze(o.detectedBy,r),o.components=ze(o.components,e.components[0]),o.refs=ze(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push({id:i.id,severity:i.severity});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function en(t,e){return Dt(t,e)>0?t:e}function Dt(t,e){return W[t]-W[e]}function ze(t,e){return e?Array.from(new Set([...t,e]).values()):t}var ke=Ye(require("path"));var $=require("fs/promises"),Ze=require("path");async function B(t){if(await ne(t))return JSON.parse(await(0,$.readFile)(t,{encoding:"utf-8"}))}async function Ot(t,e){await(0,$.writeFile)(t,JSON.stringify(e,null,4)+`
-`,{encoding:"utf-8"})}function J(t){return t&&t.replace(/\?.*$/,"")}async function ne(t){try{return await(0,$.access)(t,$.constants.F_OK),!0}catch{return!1}}async function et(t){let e=(0,Ze.resolve)(t),r=await(0,$.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,Ze.resolve)(i.parentPath,i.name);i.isDirectory()?await et(n):await(0,$.rm)(n)}await(0,$.rmdir)(e)}async function de(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function Ft(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=K(t.workingDir,"input/vex"),i=K(t.workingDir,"output"),n=K(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=K(t.workingDir,"vuln-scan-conf.json"),c=await B(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);return{projectConfigFileLocation:s,failOnNewVulnerabilities:c.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:c.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:K(t.workingDir,c.vexDir)??r,outDir:K(t.workingDir,c.outDir)??i,cacheDir:K(t.workingDir,c.cacheDir)??n,scanners:c.scanners??o,projects:(c.projects??[]).map(u=>{let l=u;if(!l.name)throw new Error("Project name is missing on entry:"+JSON.stringify(l));if(!l.version)throw new Error("Project version is missing on entry:"+JSON.stringify(l));if(!l.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(l));return l.enabled==null&&(l.enabled=!0),l.silent==null&&(l.silent=!1),l.minimumSeverity||(l.minimumSeverity="UNKNOWN"),l.sbomFile?{...l,sbomFile:K(t.workingDir,l.sbomFile)}:u})}}function K(t,e){if(e)return ke.default.isAbsolute(e)?e:(0,ke.resolve)(t,e)}var te=Ye(ji());var Mi=Ye(Ii());function Ni(t,e){let r=new te.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=gs(o.severity),c=o.id,u=Ss(o.refs),l=new te.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,f,p="new",m="";a?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(f[0].status="underReview",m="--- UNDER INVESTIGATION --- ")):W[e.minimumSeverity]>W[o.severity]?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(f=[{kind:"external",status:"accepted"}],p="updated",m="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${m}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:vs(o,u,m)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let d of o.components){let h=new te.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});h.result.message.id="default",h.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],h.result.baselineState=p,h.result.suppressions=f,r.addResult(h)}}let n=new te.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function Ss(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function gs(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function vs(t,e,r){let i=t.vexStatement,n=i?`
+	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ve.checkPathsSync(t,e,"copy",r);if(ve.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ge.dirname(e);return _.existsSync(o)||Rn(o),cr(n,t,e,r)}function cr(t,e,r,i){let o=(i.dereference?_.statSync:_.lstatSync)(e);if(o.isDirectory())return Gn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return _n(o,t,e,r,i);if(o.isSymbolicLink())return Hn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function _n(t,e,r,i,n){return e?$n(t,r,i,n):lr(t,r,i,n)}function $n(t,e,r,i){if(i.overwrite)return _.unlinkSync(r),lr(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function lr(t,e,r,i){return _.copyFileSync(e,r),i.preserveTimestamps&&qn(t.mode,e,r),pt(r,t.mode)}function qn(t,e,r){return Un(t)&&Xn(r,t),Bn(e,r)}function Un(t){return(t&128)===0}function Xn(t,e){return pt(t,e|128)}function pt(t,e){return _.chmodSync(t,e)}function Bn(t,e){let r=_.statSync(t);return An(e,r.atime,r.mtime)}function Gn(t,e,r,i,n){return e?ur(r,i,n):Wn(t.mode,r,i,n)}function Wn(t,e,r,i){return _.mkdirSync(r),ur(e,r,i),pt(r,t)}function ur(t,e,r){_.readdirSync(t).forEach(i=>Jn(i,t,e,r))}function Jn(t,e,r,i){let n=ge.join(e,t),o=ge.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=ve.checkPathsSync(n,o,"copy",i);return cr(s,n,o,i)}function Hn(t,e,r,i){let n=_.readlinkSync(e);if(i.dereference&&(n=ge.resolve(process.cwd(),n)),t){let o;try{o=_.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return _.symlinkSync(n,r);throw s}if(i.dereference&&(o=ge.resolve(process.cwd(),o)),ve.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(ve.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return Qn(n,r)}else return _.symlinkSync(n,r)}function Qn(t,e){return _.unlinkSync(e),_.symlinkSync(t,e)}fr.exports=Vn});var Te=S((Sa,dr)=>{"use strict";var Kn=F().fromPromise;dr.exports={copy:Kn(ar()),copySync:mr()}});var we=S((ga,yr)=>{"use strict";var pr=le(),Yn=F().fromCallback;function zn(t,e){pr.rm(t,{recursive:!0,force:!0},e)}function Zn(t){pr.rmSync(t,{recursive:!0,force:!0})}yr.exports={remove:Yn(zn),removeSync:Zn}});var Lr=S((va,xr)=>{"use strict";var eo=F().fromPromise,gr=V(),vr=require("path"),wr=X(),br=we(),hr=eo(async function(e){let r;try{r=await gr.readdir(e)}catch{return wr.mkdirs(e)}return Promise.all(r.map(i=>br.remove(vr.join(e,i))))});function Sr(t){let e;try{e=gr.readdirSync(t)}catch{return wr.mkdirsSync(t)}e.forEach(r=>{r=vr.join(t,r),br.removeSync(r)})}xr.exports={emptyDirSync:Sr,emptydirSync:Sr,emptyDir:hr,emptydir:hr}});var Or=S((wa,Er)=>{"use strict";var to=F().fromPromise,Pr=require("path"),Q=V(),kr=X();async function ro(t){let e;try{e=await Q.stat(t)}catch{}if(e&&e.isFile())return;let r=Pr.dirname(t),i=null;try{i=await Q.stat(r)}catch(n){if(n.code==="ENOENT"){await kr.mkdirs(r),await Q.writeFile(t,"");return}else throw n}i.isDirectory()?await Q.writeFile(t,""):await Q.readdir(r)}function io(t){let e;try{e=Q.statSync(t)}catch{}if(e&&e.isFile())return;let r=Pr.dirname(t);try{Q.statSync(r).isDirectory()||Q.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")kr.mkdirsSync(r);else throw i}Q.writeFileSync(t,"")}Er.exports={createFile:to(ro),createFileSync:io}});var Nr=S((ba,Tr)=>{"use strict";var no=F().fromPromise,Dr=require("path"),ee=V(),Fr=X(),{pathExists:oo}=Z(),{areIdentical:jr}=se();async function so(t,e){let r;try{r=await ee.lstat(e)}catch{}let i;try{i=await ee.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&jr(i,r))return;let n=Dr.dirname(e);await oo(n)||await Fr.mkdirs(n),await ee.link(t,e)}function ao(t,e){let r;try{r=ee.lstatSync(e)}catch{}try{let o=ee.lstatSync(t);if(r&&jr(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Dr.dirname(e);return ee.existsSync(i)||Fr.mkdirsSync(i),ee.linkSync(t,e)}Tr.exports={createLink:no(so),createLinkSync:ao}});var Mr=S((xa,Ir)=>{"use strict";var te=require("path"),be=V(),{pathExists:co}=Z(),lo=F().fromPromise;async function uo(t,e){if(te.isAbsolute(t)){try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=te.dirname(e),i=te.join(r,t);if(await co(i))return{toCwd:i,toDst:t};try{await be.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:te.relative(r,t)}}function fo(t,e){if(te.isAbsolute(t)){if(!be.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=te.dirname(e),i=te.join(r,t);if(be.existsSync(i))return{toCwd:i,toDst:t};if(!be.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:te.relative(r,t)}}Ir.exports={symlinkPaths:lo(uo),symlinkPathsSync:fo}});var Ar=S((La,Rr)=>{"use strict";var Cr=V(),mo=F().fromPromise;async function po(t,e){if(e)return e;let r;try{r=await Cr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function yo(t,e){if(e)return e;let r;try{r=Cr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Rr.exports={symlinkType:mo(po),symlinkTypeSync:yo}});var qr=S((Pa,$r)=>{"use strict";var ho=F().fromPromise,Vr=require("path"),B=V(),{mkdirs:So,mkdirsSync:go}=X(),{symlinkPaths:vo,symlinkPathsSync:wo}=Mr(),{symlinkType:bo,symlinkTypeSync:xo}=Ar(),{pathExists:Lo}=Z(),{areIdentical:_r}=se();async function Po(t,e,r){let i;try{i=await B.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,l]=await Promise.all([B.stat(t),B.stat(e)]);if(_r(c,l))return}let n=await vo(t,e);t=n.toDst;let o=await bo(n.toCwd,r),s=Vr.dirname(e);return await Lo(s)||await So(s),B.symlink(t,e,o)}function ko(t,e,r){let i;try{i=B.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=B.statSync(t),l=B.statSync(e);if(_r(c,l))return}let n=wo(t,e);t=n.toDst,r=xo(n.toCwd,r);let o=Vr.dirname(e);return B.existsSync(o)||go(o),B.symlinkSync(t,e,r)}$r.exports={createSymlink:ho(Po),createSymlinkSync:ko}});var Qr=S((ka,Hr)=>{"use strict";var{createFile:Ur,createFileSync:Xr}=Or(),{createLink:Br,createLinkSync:Gr}=Nr(),{createSymlink:Wr,createSymlinkSync:Jr}=qr();Hr.exports={createFile:Ur,createFileSync:Xr,ensureFile:Ur,ensureFileSync:Xr,createLink:Br,createLinkSync:Gr,ensureLink:Br,ensureLinkSync:Gr,createSymlink:Wr,createSymlinkSync:Jr,ensureSymlink:Wr,ensureSymlinkSync:Jr}});var Ne=S((Ea,Kr)=>{function Eo(t,{EOL:e=`
+`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function Oo(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Kr.exports={stringify:Eo,stripBom:Oo}});var ei=S((Oa,Zr)=>{var me;try{me=le()}catch{me=require("fs")}var Ie=F(),{stringify:Yr,stripBom:zr}=Ne();async function Do(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0,n=await Ie.fromCallback(r.readFile)(t,e);n=zr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Fo=Ie.fromPromise(Do);function jo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||me,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=zr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function To(t,e,r={}){let i=r.fs||me,n=Yr(e,r);await Ie.fromCallback(i.writeFile)(t,n,r)}var No=Ie.fromPromise(To);function Io(t,e,r={}){let i=r.fs||me,n=Yr(e,r);return i.writeFileSync(t,n,r)}var Mo={readFile:Fo,readFileSync:jo,writeFile:No,writeFileSync:Io};Zr.exports=Mo});var ri=S((Da,ti)=>{"use strict";var Me=ei();ti.exports={readJson:Me.readFile,readJsonSync:Me.readFileSync,writeJson:Me.writeFile,writeJsonSync:Me.writeFileSync}});var Ce=S((Fa,oi)=>{"use strict";var Co=F().fromPromise,yt=V(),ii=require("path"),ni=X(),Ro=Z().pathExists;async function Ao(t,e,r="utf-8"){let i=ii.dirname(t);return await Ro(i)||await ni.mkdirs(i),yt.writeFile(t,e,r)}function Vo(t,...e){let r=ii.dirname(t);yt.existsSync(r)||ni.mkdirsSync(r),yt.writeFileSync(t,...e)}oi.exports={outputFile:Co(Ao),outputFileSync:Vo}});var ai=S((ja,si)=>{"use strict";var{stringify:_o}=Ne(),{outputFile:$o}=Ce();async function qo(t,e,r={}){let i=_o(e,r);await $o(t,i,r)}si.exports=qo});var li=S((Ta,ci)=>{"use strict";var{stringify:Uo}=Ne(),{outputFileSync:Xo}=Ce();function Bo(t,e,r){let i=Uo(e,r);Xo(t,i,r)}ci.exports=Bo});var fi=S((Na,ui)=>{"use strict";var Go=F().fromPromise,$=ri();$.outputJson=Go(ai());$.outputJsonSync=li();$.outputJSON=$.outputJson;$.outputJSONSync=$.outputJsonSync;$.writeJSON=$.writeJson;$.writeJSONSync=$.writeJsonSync;$.readJSON=$.readJson;$.readJSONSync=$.readJsonSync;ui.exports=$});var hi=S((Ia,yi)=>{"use strict";var Wo=V(),mi=require("path"),{copy:Jo}=Te(),{remove:pi}=we(),{mkdirp:Ho}=X(),{pathExists:Qo}=Z(),di=se();async function Ko(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await di.checkPaths(t,e,"move",r);await di.checkParentPaths(t,n,e,"move");let s=mi.dirname(e);return mi.parse(s).root!==s&&await Ho(s),Yo(t,e,i,o)}async function Yo(t,e,r,i){if(!i){if(r)await pi(e);else if(await Qo(e))throw new Error("dest already exists.")}try{await Wo.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await zo(t,e,r)}}async function zo(t,e,r){return await Jo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),pi(t)}yi.exports=Ko});var bi=S((Ma,wi)=>{"use strict";var gi=le(),St=require("path"),Zo=Te().copySync,vi=we().removeSync,es=X().mkdirpSync,Si=se();function ts(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=Si.checkPathsSync(t,e,"move",r);return Si.checkParentPathsSync(t,n,e,"move"),rs(e)||es(St.dirname(e)),is(t,e,i,o)}function rs(t){let e=St.dirname(t);return St.parse(e).root===e}function is(t,e,r,i){if(i)return ht(t,e,r);if(r)return vi(e),ht(t,e,r);if(gi.existsSync(e))throw new Error("dest already exists.");return ht(t,e,r)}function ht(t,e,r){try{gi.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return ns(t,e,r)}}function ns(t,e,r){return Zo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),vi(t)}wi.exports=ts});var Li=S((Ca,xi)=>{"use strict";var os=F().fromPromise;xi.exports={move:os(hi()),moveSync:bi()}});var ki=S((Ra,Pi)=>{"use strict";Pi.exports={...V(),...Te(),...Lr(),...Qr(),...fi(),...X(),...Li(),...Ce(),...Z(),...we()}});var Ei=S(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.EXTENSIONS_LANGUAGES=void 0;Re.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var xe=S(gt=>{"use strict";Object.defineProperty(gt,"__esModule",{value:!0});gt.setOptionValues=ss;function ss(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Di=S(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.SarifBuilder=void 0;var as=require("path"),Oi=ki(),cs=Ei(),ls=xe(),vt=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,ls.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Oi.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Oi.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let l of e.results)for(let u of l.locations||[])if(!((i=(r=u?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var m;return((m=a?.location)===null||m===void 0?void 0:m.uri)===u.physicalLocation.artifactLocation.uri}).length===0){let a=as.extname(u.physicalLocation.artifactLocation.uri).replace(".",""),m=cs.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:m,location:{uri:u.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(l=>{var u;return(u=l?.location)===null||u===void 0?void 0:u.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(l=>l.id);return e.results=e.results.map(l=>(c.indexOf(l.ruleId)>-1&&(l.ruleIndex=c.indexOf(l.ruleId)),l.locations&&(l.locations=l.locations.map(u=>{var a,m;let d=(m=(a=u?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||m===void 0?void 0:m.uri;return d&&s.indexOf(d)>-1&&(u.physicalLocation.artifactLocation.index=s.indexOf(d)),u})),l)),e}};Ae.SarifBuilder=vt});var Fi=S(Ve=>{"use strict";Object.defineProperty(Ve,"__esModule",{value:!0});Ve.SarifResultBuilder=void 0;var us=xe(),wt=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,us.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Ve.SarifResultBuilder=wt});var ji=S(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});_e.SarifRuleBuilder=void 0;var fs=xe(),bt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,fs.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};_e.SarifRuleBuilder=bt});var Ti=S($e=>{"use strict";Object.defineProperty($e,"__esModule",{value:!0});$e.SarifRunBuilder=void 0;var ms=xe(),xt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,ms.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};$e.SarifRunBuilder=xt});var Ni=S(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.SarifResultBuilder=G.SarifRuleBuilder=G.SarifRunBuilder=G.SarifBuilder=void 0;var ds=Di();Object.defineProperty(G,"SarifBuilder",{enumerable:!0,get:function(){return ds.SarifBuilder}});var ps=Fi();Object.defineProperty(G,"SarifResultBuilder",{enumerable:!0,get:function(){return ps.SarifResultBuilder}});var ys=ji();Object.defineProperty(G,"SarifRuleBuilder",{enumerable:!0,get:function(){return ys.SarifRuleBuilder}});var hs=Ti();Object.defineProperty(G,"SarifRunBuilder",{enumerable:!0,get:function(){return hs.SarifRunBuilder}})});var Mi=S((Ba,Ii)=>{"use strict";var Ss=/["'&<>]/;Ii.exports=gs;function gs(t){var e=""+t,r=Ss.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Ke=require("zx"),ae=require("fs/promises");var W={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var Pe=class{allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=Tt(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=rn(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=Ze(o.detectedBy,r),o.components=Ze(o.components,e.components[0]),o.refs=Ze(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push({id:i.id,severity:i.severity});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function rn(t,e){return Tt(t,e)>0?t:e}function Tt(t,e){return W[t]-W[e]}function Ze(t,e){return e?Array.from(new Set([...t,e]).values()):t}var ke=ze(require("path"));var q=require("fs/promises"),et=require("path");async function U(t){if(await ne(t))return JSON.parse(await(0,q.readFile)(t,{encoding:"utf-8"}))}async function tt(t,e){await(0,q.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}function J(t){return t&&t.replace(/\?.*$/,"")}async function ne(t){try{return await(0,q.access)(t,q.constants.F_OK),!0}catch{return!1}}async function rt(t){let e=(0,et.resolve)(t),r=await(0,q.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,et.resolve)(i.parentPath,i.name);i.isDirectory()?await rt(n):await(0,q.rm)(n)}await(0,q.rmdir)(e)}async function pe(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function it(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=Y(t.workingDir,"input/vex"),i=Y(t.workingDir,"output"),n=Y(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=Y(t.workingDir,"vuln-scan-conf.json"),c=await U(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);let l=c.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:s,failOnNewVulnerabilities:c.failOnNewVulnerabilities??!1,reportNoLongerDetectedVulnerabilities:c.reportNoLongerDetectedVulnerabilities??!0,createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:Y(t.workingDir,c.vexDir)??r,outDir:Y(t.workingDir,c.outDir)??i,cacheDir:Y(t.workingDir,c.cacheDir)??n,scanners:c.scanners??o,projects:(c.projects??[]).map(u=>{let a=u;if(!a.name)throw new Error("Project name is missing on entry:"+JSON.stringify(a));if(!a.version)throw new Error("Project version is missing on entry:"+JSON.stringify(a));if(!a.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(a));return a.purlAliases||(a.purlAliases=[]),a.enabled==null&&(a.enabled=!0),a.silent==null&&(a.silent=!1),a.minimumSeverity||(a.minimumSeverity="UNKNOWN"),a.sbomFile?{...a,sbomFile:Y(t.workingDir,a.sbomFile)}:(a.detectNoLongerUsedVulnerabilities=l?a.purl.endsWith("-SNAPSHOT"):!0,u)})}}function Y(t,e){if(e)return ke.default.isAbsolute(e)?e:(0,ke.resolve)(t,e)}var re=ze(Ni());var Ci=ze(Mi());function Ri(t,e){let r=new re.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=ws(o.severity),c=o.id,l=vs(o.refs),u=new re.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:l}),a=o.vexStatement,m,d="new",f="";a?(m=[{kind:"external",status:"accepted"}],d="updated",f=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(m[0].status="underReview",f="--- UNDER INVESTIGATION --- ")):W[e.minimumSeverity]>W[o.severity]?(m=[{kind:"external",status:"accepted"}],d="updated",f=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(m=[{kind:"external",status:"accepted"}],d="updated",f="--- PROJECT SILENT ---"),Object.assign(u.rule,{name:`${f}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:bs(o,l,f)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(u);for(let p of o.components){let h=new re.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${p}`});h.result.message.id="default",h.result.locations=[{logicalLocations:[{fullyQualifiedName:p}]}],h.result.baselineState=d,h.result.suppressions=m,r.addResult(h)}}let n=new re.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function vs(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function ws(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function bs(t,e,r){let i=t.vexStatement,n=i?`
 ${r}
 ${i.justification??""}
 ${i.impact_statement??""}
@@ -18,13 +18,13 @@ ${n}
 
 --- DETAILS ---
 
-${(0,Mi.default)(t.description)}
+${(0,Ci.default)(t.description)}
 
 ${t.refs.map(o=>`* <${o}>`).join(`
 `)}
-`}var Xe=require("fs/promises");async function Ci(t,e,r){if("sbomFile"in t)return await(0,Xe.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Xe.writeFile)(e,i),{...t,sbomFile:e}}var $e=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await de(i,this.authn);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await de(r,this.authn)).text();return ws(n,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function ws(t,e){if(e.classifier&&e.extension){let n=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(n?.[1])return n[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),i=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!i)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${i[1]}`}var Be=require("fs/promises"),wt=require("path");var bt=class{constructor(e){this.location=e}async read(){let e=await B(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await Ot(this.location,e)}async delete(){await(0,Be.unlink)(this.location)}};async function Ai(t,e){for(let r of await(0,Be.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new bt((0,wt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await Ai((0,wt.resolve)(r.parentPath,r.name),e)}function bs(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var pe=class t{statements=[];filteredToProduct;static async fromUrl(e,r,i=new t){let o=await(await de(e,r)).json();return i.add(o),i}static async fromFiles(e,r=new t){return await Ai(e,async i=>{let n=await i.read();r.add(n)}),r}add(e){xs(e);let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=bs(i),c=new Set(i.products?.map(l=>l["@id"]).filter(l=>!!l)??[]),u=new xt(n,o,s,c,i);this.statements.push(u)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProduct)return this;let r=new t;return r.filteredToProduct=e,r.statements=this.statements.filter(i=>i.matchesProduct(e)),r}findNotMatchingVulnerabilities(e,r){let i=this.filterByProduct(r??this.filteredToProduct),n=new Set;for(let o of i.statements)n.add(o.vulnName);for(let o of e)n.delete(o);return Array.from(n)}newestVulnerabilityStatement(e,r){let i=this.filterByProduct(r??this.filteredToProduct);for(let n of i.statements)if(n.matchesVulnerability(e))return this.reduceToProductInformation({timestamp:new Date(n.timestamp).toISOString(),...n.statement},i.filteredToProduct)}toVexFile(e){let r=e.filter(n=>n.status!=="under_investigation");if(r.length===0)return;this.sortVexStatementsByTimestampNewestFirst(r);let i=r[0].timestamp;return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:i,last_updated:i,version:1,statements:r}}assertCorrectProductId(e){if(!e)throw new Error("Product ID must be provided");if(this.filteredToProduct&&this.filteredToProduct!==e)throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){return r=r??this.filteredToProduct,{...e,products:e.products?.filter(i=>i["@id"]===r)}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}sortVexStatementsByTimestampNewestFirst(e){e.sort((r,i)=>Date.parse(i.timestamp)-Date.parse(r.timestamp))}},xt=class{constructor(e,r,i,n,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=i;this.products=n;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesVulnerability(e){return this.vulnAliases.has(e)}};function xs(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}var Ge=require("path"),Ri=require("fs/promises");var Ue=class{constructor(e,r,i){this.project=e;this.outputDir=r;this.useSubDirForProject=i}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",i=`${this.project.name}-${this.project.version}-`,n=this.getFileSuffix(e),o=(0,Ge.resolve)(this.outputDir,r,`${i}${n}`),s=(0,Ge.dirname)(o);return await ne(s)||await(0,Ri.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};var Lt=require("zx");var We=require("path"),Vi="anchore/grype:latest";async function _i(t){let e=await Lt.$`docker run --rm -v '${t}:/.cache' ${Vi} db update`;e.stdout&&console.log(` Grype DB Update: ${e.stdout}`),e.stderr&&console.log(` Grype DB Update error: ${e.stderr}`)}async function qi(t,e,r,i,n){let o=(0,We.dirname)(e),s=(0,We.basename)(e),c=await Lt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' -e GRYPE_DB_AUTO_UPDATE=false ${Vi} sbom:/tmp/input.json -o json --file '/tmp/output/${s}' --by-cve --quiet`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(`  Grype output file: ${e}`);let u=await B(e);Ls(i,u)}function Ls(t,e){if(e)for(let r of e.matches){let i=Ps(r);t.addVulnerability(i,"grype")}}function Ps(t){let e=t.vulnerability,r=e.id,i=J(t.artifact.purl),n=J(e.dataSource),o=ks(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[i],detectedBy:["grype"],refs:[n]}}function ks(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var $i=require("fs/promises");async function Xi(t,e,r,i,n){let o={},s="";r.user&&r.token&&(o.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,s="/authorized");let c=`https://ossindex.sonatype.org/api/v3${s}/component-report`,u=await Es(e.sbomFile),l=new Set(u.map(p=>p.purl.replace(/\?.*$/,"")));Is(l);let a=Array.from(l),f=[];for(let p=0;p<a.length;p+=128){let m=JSON.stringify({coordinates:a.slice(p,p+128)}),h=await(await fetch(c,{method:"POST",headers:{...o,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:m})).json();Array.isArray(h)?f.push(...h.filter(v=>v.vulnerabilities.length>0)):n(`  Sonatype OssIndex Error: ${h.code} - ${h.message}`)}await(0,$i.writeFile)(t,JSON.stringify(f,null,2)),n(`  Sonatype OssIndex output file: ${t}`),Fs(i,f)}async function Es(t){return(await B(t)).components.filter(r=>Ds(r)&&!Os(r))}function Ds(t){return!!t.purl}function Os(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function Fs(t,e){if(e)for(let r of e)for(let i of r.vulnerabilities){let n=js(i,r.coordinates);t.addVulnerability(n,"ossindex")}}function js(t,e){let r=t.cve||t.id,i=J(e),n=J(t.reference),o=Ts(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[i],detectedBy:["ossindex"],refs:n?[n]:[]}}function Ts(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function Is(t){let e=Array.from(t);for(let r of e){let i=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(i)}}var Pt=require("zx");var Je=require("path"),Bi="aquasec/trivy:latest";async function Ui(t,e){let r=[];e&&(r.push("-e"),r.push(`GITHUB_TOKEN=${e}`));let i=[];i.push("--db-repository"),i.push("public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db");let n=await Pt.$`docker run --rm -v '${t}:/.cache' ${r} ${Bi} ${i} --cache-dir '/.cache' sbom --download-db-only --quiet`;!n.stdout&&!n.stderr&&console.log(" Trivy DB Update: finished"),n.stdout&&console.log(` Trivy DB Update: ${n.stdout}`),n.stderr&&console.log(` Trivy DB Update error: ${n.stderr}`)}async function Gi(t,e,r,i,n){let o=(0,Je.dirname)(e),s=(0,Je.basename)(e),c=await Pt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' ${Bi} sbom --cache-dir '/.cache' --format json --output '/tmp/output/${s}' --quiet --skip-db-update /tmp/input.json`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(`  Trivy output file: ${e}`);let u=await B(e);Ms(i,u)}function Ms(t,e){if(e){for(let r of e.Results)if(r.Vulnerabilities)for(let i of r.Vulnerabilities){let n=Ns(i);t.addVulnerability(n,"trivy")}}}function Ns(t){let e=t.VulnerabilityID,r=J(t.PkgIdentifier.PURL),i=J(t.PrimaryURL),n=Cs(t.Severity);return{id:e,severity:n,scannerSeverity:{trivy:n},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[i]}}function Cs(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var He=class{constructor(e,r,i){this.scannerNames=e;this.cacheDir=r;this.options=i}async init(){let e=[];for(let r of this.scannerNames)switch(r){case"grype":e.push(_i(this.cacheDir));break;case"trivy":e.push(Ui(this.cacheDir,this.options.trivyGithubToken));break;case"ossindex":continue}await Promise.all(e)}async scanProject(e,r,i,n){let o=[];for(let s of this.scannerNames)o.push(this.scanProjectBy(s,e,r,this.cacheDir,i,this.options.ossIndexApiUser,this.options.ossIndexApiToken,n));await Promise.all(o)}async scanProjectBy(e,r,i,n,o,s,c,u){switch(e){case"grype":return qi(n,await i.lookupOutputFileForWriting("grype-results"),r,o,u);case"trivy":return Gi(n,await i.lookupOutputFileForWriting("trivy-results"),r,o,u);case"ossindex":return Xi(await i.lookupOutputFileForWriting("ossindex-results"),r,{user:s,token:c},o,u)}}};Qe.os.type().startsWith("Windows")&&(0,Qe.usePowerShell)();async function Wi(t){let e=await Ft(t),r=e.cacheDir;await ne(r)||await(0,ae.mkdir)(r);let i=e.outDir;await ne(i)&&await et(i),await(0,ae.mkdir)(i);let n=await $s(e,{user:t.vexUrlsUser,pw:t.vexUrlsPw}),o=new $e(e.mavenRepo,{user:t.mavenRepoUser,pw:t.mavenRepoPw}),s=Xs(e,t,r),c=Date.now();console.log("Initializing scanner engines ..."),await s.init(),console.log(`Scanner engines initialization took ${Date.now()-c}ms
-`);let u=Bs(t),l=e.projects,a=new Map,f=Date.now();console.log("Scanning projects ...");let p=1,m=0,d=[];for(let b of l){if(!u(b))continue;m>=p&&(await Promise.race(d),--m);let C=new Ue(b,i,e.createSubDirsForProject),D=[],ie=Le=>{D.push(Le)};d.push(As(b,C,o,s,n,ie,a,t,D)),++m}await Promise.all(d),console.log(`Scanning took ${Date.now()-f}ms`);let h=Rs(a,e.reportNoLongerDetectedVulnerabilities);return t.mode!=="test"&&(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&!e.failOnNewVulnerabilities&&console.log("##vso[task.complete result=SucceededWithIssues;]NEW_VULNERABILITIES_DETECTED"),h.hasError||(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&e.failOnNewVulnerabilities?1:0}async function As(t,e,r,i,n,o,s,c,u){try{let{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}=await _s(t,e,r,i,n,o);s.set(t.purl,{project:t,newVulns:l,noLongerDetectedVulns:a})}catch(l){let a=l;s.set(t.purl,{project:t,error:a.message,newVulns:[],noLongerDetectedVulns:[]})}if(c.verbose)for(let l of u)console.log(l)}function Rs(t,e){let r=!1,i=!1,n=!1;console.log(`
-Scan results:`);for(let o of t.values()){let s=Vs(o,e);r=r||s.hasError,i=i||s.hasNewVuln,n=n||s.hasNoLongerDetectedVuln}return!r&&!i&&!n&&console.log("  No issues found"),{hasError:r,hasNewVuln:i,hasNoLongerDetectedVuln:n}}function Vs(t,e){let r=t.project,i=r.purl,n=r.silent,o=W[r.minimumSeverity],s=!!t.error,c=n?[]:t.newVulns.filter(l=>o<=W[l.severity]),u=n||!e?[]:t.noLongerDetectedVulns;if(!s&&!c.length&&!u.length)return{hasError:s,hasNewVuln:!1,hasNoLongerDetectedVuln:!1};if(console.log(`  ${r.name} - ${r.version} (${i}):`),t.error&&console.error(`    Error: ${t.error}`),c.length){console.log("    New vulnerabilities:");for(let l of c)console.log(`      [${l.severity}] ${l.id}`)}if(u.length){console.log("    No longer detected vulnerabilities");for(let l of u)console.log(`      ${l}`)}return{hasError:s,hasNewVuln:c.length>0,hasNoLongerDetectedVuln:u.length>0}}async function _s(t,e,r,i,n,o){let s=await Ci(t,await e.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),r);o(`Analyzing project: ${s.name} - ${s.version} - ${s.sbomFile}`);let c=new Pe;await i.scanProject(s,e,c,o);let u=n.filterByProduct(s.purl),{unmatchedVulnerabilities:l}=c.enhanceWithVexData(u),a=u.findNotMatchingVulnerabilities(c.getAllVulnIds());return await qs(e,s,c,u,o),{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}}async function qs(t,e,r,i,n){let o=r.getAllVulnerabilitiesSortedBySeverity(),s=await t.lookupOutputFileForWriting("aggregate-results");await(0,ae.writeFile)(s,JSON.stringify(o,null,2)),n(`  Vulnerabilities output file: ${s}`);let c=await t.lookupOutputFileForWriting("aggregated-sarif-results"),u=Ni(o,e);await(0,ae.writeFile)(c,JSON.stringify(u,null,2)),n(`  Vuln Sarif output file: ${c}`);let l=i.toVexFile(o.map(f=>f.vexStatement).filter(f=>!!f));if(!l)return;let a=await t.lookupOutputFileForWriting("project-openvex-file");await(0,ae.writeFile)(a,JSON.stringify(l,null,2)),n(`  OpenVex file: ${a}`)}async function $s(t,e){let r=t.vexDir,i;await ne(r)?i=await pe.fromFiles(r):i=new pe;for(let n of t.vexUrls)await pe.fromUrl(n,e,i);return i}function Xs(t,e,r){if(e.scannerEngine)return e.scannerEngine;if(t.scanners.length===0)throw new Error("No scanners configured");return new He(t.scanners,r,e)}function Bs(t){let{reduceToProjectName:e,reduceToProjectVersion:r}=t;return i=>!(!i.enabled||e&&(i.name!==e||r&&i.version!==r))}var re=process.env;(async()=>{let t=await Wi({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:re.OSS_INDEX_API_USER,ossIndexApiToken:re.OSS_INDEX_API_TOKEN,mavenRepoUser:re.MAVEN_REPO_USER,mavenRepoPw:re.MAVEN_REPO_PW,trivyGithubToken:re.TRIVY_GITHUB_TOKEN,vexUrlsUser:re.VEX_URLS_USER,vexUrlsPw:re.VEX_URLS_PW,verbose:re.VERBOSE==="true"});process.exit(t)})();
+`}var Ue=require("fs/promises");async function Ai(t,e,r){if("sbomFile"in t)return await(0,Ue.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Ue.writeFile)(e,i),{...t,sbomFile:e}}var qe=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await pe(i,this.authn);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await pe(r,this.authn)).text();return xs(n,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function xs(t,e){if(e.classifier&&e.extension){let n=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(n?.[1])return n[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),i=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!i)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${i[1]}`}var Xe=require("fs/promises"),Lt=require("path");var Pt=class{constructor(e){this.location=e}async read(){let e=await U(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await tt(this.location,e)}async delete(){await(0,Xe.unlink)(this.location)}};async function Be(t,e){for(let r of await(0,Xe.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new Pt((0,Lt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await Be((0,Lt.resolve)(r.parentPath,r.name),e)}function Et(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var de=class t{statements=[];filteredToProducts=[];static async fromUrl(e,r,i=new t){let o=await(await pe(e,r)).json();return i.add(o),i}static async fromFiles(e,r=new t){return await Be(e,async i=>{let n=await i.read();r.add(n)}),r}add(e){Ps(e);let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=Et(i),c=new Set(i.products?.map(u=>u["@id"]).filter(u=>!!u)??[]),l=new kt(n,o,s,c,i);this.statements.push(l)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProducts.length)return this;let r=new t;return r.filteredToProducts=e.slice(0),r.statements=this.statements.filter(i=>i.matchesAtLeastOneProduct(e)),r}findNotMatchingVulnerabilities(e,r){let i=this.filterByProduct(r??this.filteredToProducts),n=new Set;for(let o of i.statements)n.add(o.vulnName);for(let o of e)n.delete(o);return Array.from(n)}newestVulnerabilityStatement(e,r){let i=this.filterByProduct(r??this.filteredToProducts);for(let n of i.statements)if(n.matchesVulnerability(e))return this.reduceToProductInformation(n,i.filteredToProducts[0])}toVexFileForProduct(e){let r=this.filterByProduct(e??this.filteredToProducts),i=r.statements.map(n=>this.reduceToProductInformation(n,r.filteredToProducts[0]));return this.toVexFile(i)}toVexFile(e){let r=e.filter(n=>n.status!=="under_investigation");if(r.length===0)return;this.sortVexStatementsByTimestampNewestFirst(r);let i=r[0].timestamp;return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:i,last_updated:i,version:1,statements:r}}assertCorrectProductId(e){if(!e||e.length===0)throw new Error("Product ID must be provided");if(this.filteredToProducts.length&&!Ls(this.filteredToProducts,e))throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){let i={timestamp:new Date(e.timestamp).toISOString(),...e.statement};if(!r)return i;let n=i.products?.filter(o=>o["@id"]===r);return n?.length||(n=[{"@id":r}]),{...i,products:n}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}sortVexStatementsByTimestampNewestFirst(e){e.sort((r,i)=>Date.parse(i.timestamp)-Date.parse(r.timestamp))}};function Ls(t,e){return t.length===e.length&&t.every((r,i)=>r===e[i])}var kt=class{constructor(e,r,i,n,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=i;this.products=n;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesAtLeastOneProduct(e){return e.some(this.matchesProduct.bind(this))}matchesVulnerability(e){return this.vulnAliases.has(e)}};function Ps(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}var We=require("path"),Vi=require("fs/promises");var Ge=class{constructor(e,r,i){this.project=e;this.outputDir=r;this.useSubDirForProject=i}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",i=`${this.project.name}-${this.project.version}-`,n=this.getFileSuffix(e),o=(0,We.resolve)(this.outputDir,r,`${i}${n}`),s=(0,We.dirname)(o);return await ne(s)||await(0,Vi.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};var Ot=require("zx");var Je=require("path"),_i="anchore/grype:latest";async function $i(t){let e=await Ot.$`docker run --rm -v '${t}:/.cache' ${_i} db update`;e.stdout&&console.log(` Grype DB Update: ${e.stdout}`),e.stderr&&console.log(` Grype DB Update error: ${e.stderr}`)}async function qi(t,e,r,i,n){let o=(0,Je.dirname)(e),s=(0,Je.basename)(e),c=await Ot.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' -e GRYPE_DB_AUTO_UPDATE=false ${_i} sbom:/tmp/input.json -o json --file '/tmp/output/${s}' --by-cve --quiet`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(`  Grype output file: ${e}`);let l=await U(e);ks(i,l)}function ks(t,e){if(e)for(let r of e.matches){let i=Es(r);t.addVulnerability(i,"grype")}}function Es(t){let e=t.vulnerability,r=e.id,i=J(t.artifact.purl),n=J(e.dataSource),o=Os(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[i],detectedBy:["grype"],refs:[n]}}function Os(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var Ui=require("fs/promises");async function Xi(t,e,r,i,n){let o={},s="";r.user&&r.token&&(o.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,s="/authorized");let c=`https://ossindex.sonatype.org/api/v3${s}/component-report`,l=await Ds(e.sbomFile),u=new Set(l.map(d=>d.purl.replace(/\?.*$/,"")));Ms(u);let a=Array.from(u),m=[];for(let d=0;d<a.length;d+=128){let f=JSON.stringify({coordinates:a.slice(d,d+128)}),h=await(await fetch(c,{method:"POST",headers:{...o,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:f})).json();Array.isArray(h)?m.push(...h.filter(v=>v.vulnerabilities.length>0)):n(`  Sonatype OssIndex Error: ${h.code} - ${h.message}`)}await(0,Ui.writeFile)(t,JSON.stringify(m,null,2)),n(`  Sonatype OssIndex output file: ${t}`),Ts(i,m)}async function Ds(t){return(await U(t)).components.filter(r=>Fs(r)&&!js(r))}function Fs(t){return!!t.purl}function js(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function Ts(t,e){if(e)for(let r of e)for(let i of r.vulnerabilities){let n=Ns(i,r.coordinates);t.addVulnerability(n,"ossindex")}}function Ns(t,e){let r=t.cve||t.id,i=J(e),n=J(t.reference),o=Is(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[i],detectedBy:["ossindex"],refs:n?[n]:[]}}function Is(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function Ms(t){let e=Array.from(t);for(let r of e){let i=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(i)}}var Dt=require("zx");var He=require("path"),Bi="aquasec/trivy:latest";async function Gi(t,e){let r=[];e&&(r.push("-e"),r.push(`GITHUB_TOKEN=${e}`));let i=[];i.push("--db-repository"),i.push("public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db");let n=await Dt.$`docker run --rm -v '${t}:/.cache' ${r} ${Bi} ${i} --cache-dir '/.cache' sbom --download-db-only --quiet`;!n.stdout&&!n.stderr&&console.log(" Trivy DB Update: finished"),n.stdout&&console.log(` Trivy DB Update: ${n.stdout}`),n.stderr&&console.log(` Trivy DB Update error: ${n.stderr}`)}async function Wi(t,e,r,i,n){let o=(0,He.dirname)(e),s=(0,He.basename)(e),c=await Dt.$`docker run --rm -v '${t}:/.cache' -v '${o}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' ${Bi} sbom --cache-dir '/.cache' --format json --output '/tmp/output/${s}' --quiet --skip-db-update /tmp/input.json`;c.stdout&&n(` Scan log: ${c.stdout}`),c.stderr&&n(` Scan error: ${c.stderr}`),n(`  Trivy output file: ${e}`);let l=await U(e);Cs(i,l)}function Cs(t,e){if(e){for(let r of e.Results)if(r.Vulnerabilities)for(let i of r.Vulnerabilities){let n=Rs(i);t.addVulnerability(n,"trivy")}}}function Rs(t){let e=t.VulnerabilityID,r=J(t.PkgIdentifier.PURL),i=J(t.PrimaryURL),n=As(t.Severity);return{id:e,severity:n,scannerSeverity:{trivy:n},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[i]}}function As(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var Qe=class{constructor(e,r,i){this.scannerNames=e;this.cacheDir=r;this.options=i}async init(){let e=[];for(let r of this.scannerNames)switch(r){case"grype":e.push($i(this.cacheDir));break;case"trivy":e.push(Gi(this.cacheDir,this.options.trivyGithubToken));break;case"ossindex":continue}await Promise.all(e)}async scanProject(e,r,i,n){let o=[];for(let s of this.scannerNames)o.push(this.scanProjectBy(s,e,r,this.cacheDir,i,this.options.ossIndexApiUser,this.options.ossIndexApiToken,n));await Promise.all(o)}async scanProjectBy(e,r,i,n,o,s,c,l){switch(e){case"grype":return qi(n,await i.lookupOutputFileForWriting("grype-results"),r,o,l);case"trivy":return Wi(n,await i.lookupOutputFileForWriting("trivy-results"),r,o,l);case"ossindex":return Xi(await i.lookupOutputFileForWriting("ossindex-results"),r,{user:s,token:c},o,l)}}};async function Ji(t,e,r){await Be(t,async i=>{let n=await i.read(),o=!1,s=n.statements,c=[];for(let l of s){if(r&&!Et(l).has(r)||!l.products)continue;let u=l.products.findIndex(a=>a["@id"]===e);u!==-1&&(l.products.splice(u,1),o=!0,l.products.length===0&&c.push(l))}if(o){for(let l of c){let u=s.indexOf(l);s.splice(u,1)}if(s.length===0){console.info(`Remove ${e} from ${i.location} and delete file.`),await i.delete();return}console.info(`Remove ${e} from ${i.location}`),await i.write(n)}})}Ke.os.type().startsWith("Windows")&&(0,Ke.usePowerShell)();async function Hi(t){let e=await it(t),r=e.cacheDir;await ne(r)||await(0,ae.mkdir)(r);let i=e.outDir;await ne(i)&&await rt(i),await(0,ae.mkdir)(i);let n=await Xs(e,{user:t.vexUrlsUser,pw:t.vexUrlsPw}),o=new qe(e.mavenRepo,{user:t.mavenRepoUser,pw:t.mavenRepoPw}),s=Bs(e,t,r),c=Date.now();console.log("Initializing scanner engines ..."),await s.init(),console.log(`Scanner engines initialization took ${Date.now()-c}ms
+`);let l=Gs(t),u=e.projects,a=new Map,m=Date.now();console.log("Scanning projects ...");let d=1,f=0,p=[];for(let b of u){if(!l(b))continue;f>=d&&(await Promise.race(p),--f);let C=new Ge(b,i,e.createSubDirsForProject),O=[],ie=Le=>{O.push(Le)};p.push(Vs(b,C,o,s,n,ie,a,t,O)),++f}await Promise.all(p),console.log(`Scanning took ${Date.now()-m}ms`),t.autoRemoveUnusedStatements&&await Ws(a,e.vexDir);let h=_s(a,e.reportNoLongerDetectedVulnerabilities);return t.mode!=="test"&&(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&!e.failOnNewVulnerabilities&&console.log("##vso[task.complete result=SucceededWithIssues;]NEW_VULNERABILITIES_DETECTED"),h.hasError||(h.hasNewVuln||h.hasNoLongerDetectedVuln)&&e.failOnNewVulnerabilities?1:0}async function Vs(t,e,r,i,n,o,s,c,l){try{let{unmatchedVulnerabilities:u,noLongerDetectedVulnerabilities:a}=await qs(t,e,r,i,n,o);s.set(t.purl,{project:t,newVulns:u,noLongerDetectedVulns:a})}catch(u){let a=u;s.set(t.purl,{project:t,error:a.message,newVulns:[],noLongerDetectedVulns:[]})}if(c.verbose)for(let u of l)console.log(u)}function _s(t,e){let r=!1,i=!1,n=!1;console.log(`
+Scan results:`);for(let o of t.values()){let s=$s(o,e);r=r||s.hasError,i=i||s.hasNewVuln,n=n||s.hasNoLongerDetectedVuln}return!r&&!i&&!n&&console.log("  No issues found"),{hasError:r,hasNewVuln:i,hasNoLongerDetectedVuln:n}}function $s(t,e){let r=t.project,i=r.purl,n=r.silent,o=W[r.minimumSeverity],s=!!t.error,c=n?[]:t.newVulns.filter(u=>o<=W[u.severity]),l=n||!e?[]:t.noLongerDetectedVulns;if(!s&&!c.length&&!l.length)return{hasError:s,hasNewVuln:!1,hasNoLongerDetectedVuln:!1};if(console.log(`  ${r.name} - ${r.version} (${i}):`),t.error&&console.error(`    Error: ${t.error}`),c.length){console.log("    New vulnerabilities:");for(let u of c)console.log(`      [${u.severity}] ${u.id}`)}if(l.length){console.log("    No longer detected vulnerabilities");for(let u of l)console.log(`      ${u}`)}return{hasError:s,hasNewVuln:c.length>0,hasNoLongerDetectedVuln:l.length>0}}async function qs(t,e,r,i,n,o){let s=await Ai(t,await e.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),r);o(`Analyzing project: ${s.name} - ${s.version} - ${s.sbomFile}`);let c=new Pe;await i.scanProject(s,e,c,o);let l=n.filterByProduct([s.purl,...s.purlAliases]),{unmatchedVulnerabilities:u}=c.enhanceWithVexData(l),a=s.detectNoLongerUsedVulnerabilities?l.findNotMatchingVulnerabilities(c.getAllVulnIds()):[];return await Us(e,s,c,l,o),{unmatchedVulnerabilities:u,noLongerDetectedVulnerabilities:a}}async function Us(t,e,r,i,n){let o=r.getAllVulnerabilitiesSortedBySeverity(),s=await t.lookupOutputFileForWriting("aggregate-results");await(0,ae.writeFile)(s,JSON.stringify(o,null,2)),n(`  Vulnerabilities output file: ${s}`);let c=await t.lookupOutputFileForWriting("aggregated-sarif-results"),l=Ri(o,e);await(0,ae.writeFile)(c,JSON.stringify(l,null,2)),n(`  Vuln Sarif output file: ${c}`);let u=i.toVexFileForProduct();if(!u)return;let a=await t.lookupOutputFileForWriting("project-openvex-file");await(0,ae.writeFile)(a,JSON.stringify(u,null,2)),n(`  OpenVex file: ${a}`)}async function Xs(t,e){let r=t.vexDir,i;await ne(r)?i=await de.fromFiles(r):i=new de;for(let n of t.vexUrls)await de.fromUrl(n,e,i);return i}function Bs(t,e,r){if(e.scannerEngine)return e.scannerEngine;if(t.scanners.length===0)throw new Error("No scanners configured");return new Qe(t.scanners,r,e)}function Gs(t){let{reduceToProjectName:e,reduceToProjectVersion:r}=t;return i=>!(!i.enabled||e&&(i.name!==e||r&&i.version!==r))}async function Ws(t,e){for(let r of t.values())if(!r.project.silent)for(let i of r.noLongerDetectedVulns)await Ji(e,r.project.purl,i)}var K=process.env;(async()=>{let t=await Hi({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:K.OSS_INDEX_API_USER,ossIndexApiToken:K.OSS_INDEX_API_TOKEN,mavenRepoUser:K.MAVEN_REPO_USER,mavenRepoPw:K.MAVEN_REPO_PW,trivyGithubToken:K.TRIVY_GITHUB_TOKEN,vexUrlsUser:K.VEX_URLS_USER,vexUrlsPw:K.VEX_URLS_PW,verbose:K.VERBOSE==="true",autoRemoveUnusedStatements:K.AUTO_REMOVE_UNUSED_STATEMENTS==="true"});process.exit(t)})();
 /*! Bundled license information:
 
 escape-html/index.js:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@conterra/vuln-scan",
-    "version": "0.0.15",
+    "version": "0.0.17",
     "description": "con terra vulnerability scan process",
     "author": "con terra GmbH",
     "license": "Apache-2.0",