@conterra/vuln-scan 0.0.30 → 0.0.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/vuln-scan.js +20 -12
  2. package/package.json +1 -1
package/dist/vuln-scan.js CHANGED
@@ -1,13 +1,13 @@
1
1
  #!/usr/bin/env node
2
- "use strict";var ci=Object.create;var Vt=Object.defineProperty;var li=Object.getOwnPropertyDescriptor;var ui=Object.getOwnPropertyNames;var fi=Object.getPrototypeOf,mi=Object.prototype.hasOwnProperty;var g=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var pi=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of ui(e))!mi.call(t,i)&&i!==r&&Vt(t,i,{get:()=>e[i],enumerable:!(n=li(e,i))||n.enumerable});return t};var nt=(t,e,r)=>(r=t!=null?ci(fi(t)):{},pi(e||!t||!t.__esModule?Vt(r,"default",{value:t,enumerable:!0}):r,t));var j=g(ut=>{"use strict";ut.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,n)=>{e.push((i,o)=>i!=null?n(i):r(o)),t.apply(this,e)})},"name",{value:t.name})};ut.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(n=>r(null,n),r)},"name",{value:t.name})}});var _t=g((ba,$t)=>{var ee=require("constants"),yi=process.cwd,Te=null,hi=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Te||(Te=yi.call(process)),Te};try{process.cwd()}catch{}typeof process.chdir=="function"&&(ft=process.chdir,process.chdir=function(t){Te=null,ft.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,ft));var ft;$t.exports=Si;function Si(t){ee.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=n(t.chmod),t.fchmod=n(t.fchmod),t.lchmod=n(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=i(t.chmodSync),t.fchmodSync=i(t.fchmodSync),t.lchmodSync=i(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=u(t.statSync),t.fstatSync=u(t.fstatSync),t.lstatSync=u(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,f,p){p&&process.nextTick(p)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,f,p,m){m&&process.nextTick(m)},t.lchownSync=function(){}),hi==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:(function(a){function f(p,m,d){var y=Date.now(),h=0;a(p,m,function w(x){if(x&&(x.code==="EACCES"||x.code==="EPERM"||x.code==="EBUSY")&&Date.now()-y<6e4){setTimeout(function(){t.stat(m,function(D,A){D&&D.code==="ENOENT"?a(p,m,w):d(x)})},h),h<100&&(h+=10);return}d&&d(x)})}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f})(t.rename)),t.read=typeof t.read!="function"?t.read:(function(a){function f(p,m,d,y,h,w){var x;if(w&&typeof w=="function"){var D=0;x=function(A,tt,Ee){if(A&&A.code==="EAGAIN"&&D<10)return D++,a.call(t,p,m,d,y,h,x);w.apply(this,arguments)}}return a.call(t,p,m,d,y,h,x)}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f})(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:(function(a){return function(f,p,m,d,y){for(var h=0;;)try{return a.call(t,f,p,m,d,y)}catch(w){if(w.code==="EAGAIN"&&h<10){h++;continue}throw w}}})(t.readSync);function e(a){a.lchmod=function(f,p,m){a.open(f,ee.O_WRONLY|ee.O_SYMLINK,p,function(d,y){if(d){m&&m(d);return}a.fchmod(y,p,function(h){a.close(y,function(w){m&&m(h||w)})})})},a.lchmodSync=function(f,p){var m=a.openSync(f,ee.O_WRONLY|ee.O_SYMLINK,p),d=!0,y;try{y=a.fchmodSync(m,p),d=!1}finally{if(d)try{a.closeSync(m)}catch{}else a.closeSync(m)}return y}}function r(a){ee.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(f,p,m,d){a.open(f,ee.O_SYMLINK,function(y,h){if(y){d&&d(y);return}a.futimes(h,p,m,function(w){a.close(h,function(x){d&&d(w||x)})})})},a.lutimesSync=function(f,p,m){var d=a.openSync(f,ee.O_SYMLINK),y,h=!0;try{y=a.futimesSync(d,p,m),h=!1}finally{if(h)try{a.closeSync(d)}catch{}else a.closeSync(d)}return y}):a.futimes&&(a.lutimes=function(f,p,m,d){d&&process.nextTick(d)},a.lutimesSync=function(){})}function n(a){return a&&function(f,p,m){return a.call(t,f,p,function(d){l(d)&&(d=null),m&&m.apply(this,arguments)})}}function i(a){return a&&function(f,p){try{return a.call(t,f,p)}catch(m){if(!l(m))throw m}}}function o(a){return a&&function(f,p,m,d){return a.call(t,f,p,m,function(y){l(y)&&(y=null),d&&d.apply(this,arguments)})}}function s(a){return a&&function(f,p,m){try{return a.call(t,f,p,m)}catch(d){if(!l(d))throw d}}}function c(a){return a&&function(f,p,m){typeof p=="function"&&(m=p,p=null);function d(y,h){h&&(h.uid<0&&(h.uid+=4294967296),h.gid<0&&(h.gid+=4294967296)),m&&m.apply(this,arguments)}return p?a.call(t,f,p,d):a.call(t,f,d)}}function u(a){return a&&function(f,p){var m=p?a.call(t,f,p):a.call(t,f);return m&&(m.uid<0&&(m.uid+=4294967296),m.gid<0&&(m.gid+=4294967296)),m}}function l(a){if(!a||a.code==="ENOSYS")return!0;var f=!process.getuid||process.getuid()!==0;return!!(f&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Ut=g((xa,Bt)=>{var qt=require("stream").Stream;Bt.exports=gi;function gi(t){return{ReadStream:e,WriteStream:r};function e(n,i){if(!(this instanceof e))return new e(n,i);qt.call(this);var o=this;this.path=n,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,i=i||{};for(var s=Object.keys(i),c=0,u=s.length;c<u;c++){var l=s[c];this[l]=i[l]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,f){if(a){o.emit("error",a),o.readable=!1;return}o.fd=f,o.emit("open",f),o._read()})}function r(n,i){if(!(this instanceof r))return new r(n,i);qt.call(this),this.path=n,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,i=i||{};for(var o=Object.keys(i),s=0,c=o.length;s<c;s++){var u=o[s];this[u]=i[u]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var Gt=g((Pa,Xt)=>{"use strict";Xt.exports=wi;var vi=Object.getPrototypeOf||function(t){return t.__proto__};function wi(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:vi(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var ue=g((La,dt)=>{var E=require("fs"),bi=_t(),xi=Ut(),Pi=Gt(),Ce=require("util"),N,Ie;typeof Symbol=="function"&&typeof Symbol.for=="function"?(N=Symbol.for("graceful-fs.queue"),Ie=Symbol.for("graceful-fs.previous")):(N="___graceful-fs.queue",Ie="___graceful-fs.previous");function Li(){}function Ht(t,e){Object.defineProperty(t,N,{get:function(){return e}})}var se=Li;Ce.debuglog?se=Ce.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(se=function(){var t=Ce.format.apply(Ce,arguments);t="GFS4: "+t.split(/\n/).join(`
3
- GFS4: `),console.error(t)});E[N]||(Jt=global[N]||[],Ht(E,Jt),E.close=(function(t){function e(r,n){return t.call(E,r,function(i){i||Wt(),typeof n=="function"&&n.apply(this,arguments)})}return Object.defineProperty(e,Ie,{value:t}),e})(E.close),E.closeSync=(function(t){function e(r){t.apply(E,arguments),Wt()}return Object.defineProperty(e,Ie,{value:t}),e})(E.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){se(E[N]),require("assert").equal(E[N].length,0)}));var Jt;global[N]||Ht(global,E[N]);dt.exports=mt(Pi(E));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!E.__patched&&(dt.exports=mt(E),E.__patched=!0);function mt(t){bi(t),t.gracefulify=mt,t.createReadStream=tt,t.createWriteStream=Ee;var e=t.readFile;t.readFile=r;function r(S,b,v){return typeof b=="function"&&(v=b,b=null),F(S,b,v);function F(M,C,k,O){return e(M,C,function(P){P&&(P.code==="EMFILE"||P.code==="ENFILE")?le([F,[M,C,k],P,O||Date.now(),Date.now()]):typeof k=="function"&&k.apply(this,arguments)})}}var n=t.writeFile;t.writeFile=i;function i(S,b,v,F){return typeof v=="function"&&(F=v,v=null),M(S,b,v,F);function M(C,k,O,P,R){return n(C,k,O,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?le([M,[C,k,O,P],L,R||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(S,b,v,F){return typeof v=="function"&&(F=v,v=null),M(S,b,v,F);function M(C,k,O,P,R){return o(C,k,O,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?le([M,[C,k,O,P],L,R||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(S,b,v,F){return typeof v=="function"&&(F=v,v=0),M(S,b,v,F);function M(C,k,O,P,R){return c(C,k,O,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?le([M,[C,k,O,P],L,R||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var l=t.readdir;t.readdir=f;var a=/^v[0-5]\./;function f(S,b,v){typeof b=="function"&&(v=b,b=null);var F=a.test(process.version)?function(k,O,P,R){return l(k,M(k,O,P,R))}:function(k,O,P,R){return l(k,O,M(k,O,P,R))};return F(S,b,v);function M(C,k,O,P){return function(R,L){R&&(R.code==="EMFILE"||R.code==="ENFILE")?le([F,[C,k,O],R,P||Date.now(),Date.now()]):(L&&L.sort&&L.sort(),typeof O=="function"&&O.call(this,R,L))}}}if(process.version.substr(0,4)==="v0.8"){var p=xi(t);w=p.ReadStream,D=p.WriteStream}var m=t.ReadStream;m&&(w.prototype=Object.create(m.prototype),w.prototype.open=x);var d=t.WriteStream;d&&(D.prototype=Object.create(d.prototype),D.prototype.open=A),Object.defineProperty(t,"ReadStream",{get:function(){return w},set:function(S){w=S},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return D},set:function(S){D=S},enumerable:!0,configurable:!0});var y=w;Object.defineProperty(t,"FileReadStream",{get:function(){return y},set:function(S){y=S},enumerable:!0,configurable:!0});var h=D;Object.defineProperty(t,"FileWriteStream",{get:function(){return h},set:function(S){h=S},enumerable:!0,configurable:!0});function w(S,b){return this instanceof w?(m.apply(this,arguments),this):w.apply(Object.create(w.prototype),arguments)}function x(){var S=this;T(S.path,S.flags,S.mode,function(b,v){b?(S.autoClose&&S.destroy(),S.emit("error",b)):(S.fd=v,S.emit("open",v),S.read())})}function D(S,b){return this instanceof D?(d.apply(this,arguments),this):D.apply(Object.create(D.prototype),arguments)}function A(){var S=this;T(S.path,S.flags,S.mode,function(b,v){b?(S.destroy(),S.emit("error",b)):(S.fd=v,S.emit("open",v))})}function tt(S,b){return new t.ReadStream(S,b)}function Ee(S,b){return new t.WriteStream(S,b)}var rt=t.open;t.open=T;function T(S,b,v,F){return typeof v=="function"&&(F=v,v=null),M(S,b,v,F);function M(C,k,O,P,R){return rt(C,k,O,function(L,la){L&&(L.code==="EMFILE"||L.code==="ENFILE")?le([M,[C,k,O,P],L,R||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}return t}function le(t){se("ENQUEUE",t[0].name,t[1]),E[N].push(t),pt()}var je;function Wt(){for(var t=Date.now(),e=0;e<E[N].length;++e)E[N][e].length>2&&(E[N][e][3]=t,E[N][e][4]=t);pt()}function pt(){if(clearTimeout(je),je=void 0,E[N].length!==0){var t=E[N].shift(),e=t[0],r=t[1],n=t[2],i=t[3],o=t[4];if(i===void 0)se("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-i>=6e4){se("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,n)}else{var c=Date.now()-o,u=Math.max(o-i,1),l=Math.min(u*1.2,100);c>=l?(se("RETRY",e.name,r),e.apply(null,r.concat([i]))):E[N].push(t)}je===void 0&&(je=setTimeout(pt,0))}}});var _=g(Q=>{"use strict";var Yt=j().fromCallback,$=ue(),ki=["access","appendFile","chmod","chown","close","copyFile","cp","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","glob","lchmod","lchown","lutimes","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","statfs","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof $[t]=="function");Object.assign(Q,$);ki.forEach(t=>{Q[t]=Yt($[t])});Q.exists=function(t,e){return typeof e=="function"?$.exists(t,e):new Promise(r=>$.exists(t,r))};Q.read=function(t,e,r,n,i,o){return typeof o=="function"?$.read(t,e,r,n,i,o):new Promise((s,c)=>{$.read(t,e,r,n,i,(u,l,a)=>{if(u)return c(u);s({bytesRead:l,buffer:a})})})};Q.write=function(t,e,...r){return typeof r[r.length-1]=="function"?$.write(t,e,...r):new Promise((n,i)=>{$.write(t,e,...r,(o,s,c)=>{if(o)return i(o);n({bytesWritten:s,buffer:c})})})};Q.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?$.readv(t,e,...r):new Promise((n,i)=>{$.readv(t,e,...r,(o,s,c)=>{if(o)return i(o);n({bytesRead:s,buffers:c})})})};Q.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?$.writev(t,e,...r):new Promise((n,i)=>{$.writev(t,e,...r,(o,s,c)=>{if(o)return i(o);n({bytesWritten:s,buffers:c})})})};typeof $.realpath.native=="function"?Q.realpath.native=Yt($.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Kt=g((Ea,Qt)=>{"use strict";var Ei=require("path");Qt.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(Ei.parse(e).root,""))){let n=new Error(`Path contains invalid characters: ${e}`);throw n.code="EINVAL",n}}});var tr=g((Da,yt)=>{"use strict";var zt=_(),{checkPath:Zt}=Kt(),er=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};yt.exports.makeDir=async(t,e)=>(Zt(t),zt.mkdir(t,{mode:er(e),recursive:!0}));yt.exports.makeDirSync=(t,e)=>(Zt(t),zt.mkdirSync(t,{mode:er(e),recursive:!0}))});var W=g((Oa,rr)=>{"use strict";var Di=j().fromPromise,{makeDir:Oi,makeDirSync:ht}=tr(),St=Di(Oi);rr.exports={mkdirs:St,mkdirsSync:ht,mkdirp:St,mkdirpSync:ht,ensureDir:St,ensureDirSync:ht}});var te=g((Ta,ir)=>{"use strict";var Ti=j().fromPromise,nr=_();function Ci(t){return nr.access(t).then(()=>!0).catch(()=>!1)}ir.exports={pathExists:Ti(Ci),pathExistsSync:nr.existsSync}});var gt=g((Ca,or)=>{"use strict";var fe=_(),ji=j().fromPromise;async function Ii(t,e,r){let n=await fe.open(t,"r+"),i=null;try{await fe.futimes(n,e,r)}finally{try{await fe.close(n)}catch(o){i=o}}if(i)throw i}function Fi(t,e,r){let n=fe.openSync(t,"r+");return fe.futimesSync(n,e,r),fe.closeSync(n)}or.exports={utimesMillis:ji(Ii),utimesMillisSync:Fi}});var ae=g((ja,lr)=>{"use strict";var me=_(),I=require("path"),sr=j().fromPromise;function Mi(t,e,r){let n=r.dereference?i=>me.stat(i,{bigint:!0}):i=>me.lstat(i,{bigint:!0});return Promise.all([n(t),n(e).catch(i=>{if(i.code==="ENOENT")return null;throw i})]).then(([i,o])=>({srcStat:i,destStat:o}))}function Ri(t,e,r){let n,i=r.dereference?s=>me.statSync(s,{bigint:!0}):s=>me.lstatSync(s,{bigint:!0}),o=i(t);try{n=i(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:n}}async function Ni(t,e,r,n){let{srcStat:i,destStat:o}=await Mi(t,e,n);if(o){if(he(i,o)){let s=I.basename(t),c=I.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:i,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(i.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!i.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(i.isDirectory()&&vt(t,e))throw new Error(Fe(t,e,r));return{srcStat:i,destStat:o}}function Vi(t,e,r,n){let{srcStat:i,destStat:o}=Ri(t,e,n);if(o){if(he(i,o)){let s=I.basename(t),c=I.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:i,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(i.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!i.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(i.isDirectory()&&vt(t,e))throw new Error(Fe(t,e,r));return{srcStat:i,destStat:o}}async function ar(t,e,r,n){let i=I.resolve(I.dirname(t)),o=I.resolve(I.dirname(r));if(o===i||o===I.parse(o).root)return;let s;try{s=await me.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(he(e,s))throw new Error(Fe(t,r,n));return ar(t,e,o,n)}function cr(t,e,r,n){let i=I.resolve(I.dirname(t)),o=I.resolve(I.dirname(r));if(o===i||o===I.parse(o).root)return;let s;try{s=me.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(he(e,s))throw new Error(Fe(t,r,n));return cr(t,e,o,n)}function he(t,e){return e.ino!==void 0&&e.dev!==void 0&&e.ino===t.ino&&e.dev===t.dev}function vt(t,e){let r=I.resolve(t).split(I.sep).filter(i=>i),n=I.resolve(e).split(I.sep).filter(i=>i);return r.every((i,o)=>n[o]===i)}function Fe(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}lr.exports={checkPaths:sr(Ni),checkPathsSync:Vi,checkParentPaths:sr(ar),checkParentPathsSync:cr,isSrcSubdir:vt,areIdentical:he}});var fr=g((Ia,ur)=>{"use strict";async function Ai(t,e){let r=[];for await(let n of t)r.push(e(n).then(()=>null,i=>i??new Error("unknown error")));await Promise.all(r.map(n=>n.then(i=>{if(i!==null)throw i})))}ur.exports={asyncIteratorConcurrentProcess:Ai}});var hr=g((Fa,yr)=>{"use strict";var V=_(),Se=require("path"),{mkdirs:$i}=W(),{pathExists:_i}=te(),{utimesMillis:qi}=gt(),ge=ae(),{asyncIteratorConcurrentProcess:Bi}=fr();async function Ui(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
2
+ "use strict";var ci=Object.create;var Vt=Object.defineProperty;var li=Object.getOwnPropertyDescriptor;var ui=Object.getOwnPropertyNames;var fi=Object.getPrototypeOf,mi=Object.prototype.hasOwnProperty;var g=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var pi=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of ui(e))!mi.call(t,i)&&i!==r&&Vt(t,i,{get:()=>e[i],enumerable:!(n=li(e,i))||n.enumerable});return t};var nt=(t,e,r)=>(r=t!=null?ci(fi(t)):{},pi(e||!t||!t.__esModule?Vt(r,"default",{value:t,enumerable:!0}):r,t));var j=g(ut=>{"use strict";ut.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,n)=>{e.push((i,o)=>i!=null?n(i):r(o)),t.apply(this,e)})},"name",{value:t.name})};ut.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(n=>r(null,n),r)},"name",{value:t.name})}});var _t=g((ba,$t)=>{var ee=require("constants"),yi=process.cwd,Te=null,hi=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Te||(Te=yi.call(process)),Te};try{process.cwd()}catch{}typeof process.chdir=="function"&&(ft=process.chdir,process.chdir=function(t){Te=null,ft.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,ft));var ft;$t.exports=Si;function Si(t){ee.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=n(t.chmod),t.fchmod=n(t.fchmod),t.lchmod=n(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=i(t.chmodSync),t.fchmodSync=i(t.fchmodSync),t.lchmodSync=i(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=u(t.statSync),t.fstatSync=u(t.fstatSync),t.lstatSync=u(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,f,p){p&&process.nextTick(p)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,f,p,m){m&&process.nextTick(m)},t.lchownSync=function(){}),hi==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:(function(a){function f(p,m,d){var y=Date.now(),h=0;a(p,m,function w(x){if(x&&(x.code==="EACCES"||x.code==="EPERM"||x.code==="EBUSY")&&Date.now()-y<6e4){setTimeout(function(){t.stat(m,function(D,A){D&&D.code==="ENOENT"?a(p,m,w):d(x)})},h),h<100&&(h+=10);return}d&&d(x)})}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f})(t.rename)),t.read=typeof t.read!="function"?t.read:(function(a){function f(p,m,d,y,h,w){var x;if(w&&typeof w=="function"){var D=0;x=function(A,tt,Ee){if(A&&A.code==="EAGAIN"&&D<10)return D++,a.call(t,p,m,d,y,h,x);w.apply(this,arguments)}}return a.call(t,p,m,d,y,h,x)}return Object.setPrototypeOf&&Object.setPrototypeOf(f,a),f})(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:(function(a){return function(f,p,m,d,y){for(var h=0;;)try{return a.call(t,f,p,m,d,y)}catch(w){if(w.code==="EAGAIN"&&h<10){h++;continue}throw w}}})(t.readSync);function e(a){a.lchmod=function(f,p,m){a.open(f,ee.O_WRONLY|ee.O_SYMLINK,p,function(d,y){if(d){m&&m(d);return}a.fchmod(y,p,function(h){a.close(y,function(w){m&&m(h||w)})})})},a.lchmodSync=function(f,p){var m=a.openSync(f,ee.O_WRONLY|ee.O_SYMLINK,p),d=!0,y;try{y=a.fchmodSync(m,p),d=!1}finally{if(d)try{a.closeSync(m)}catch{}else a.closeSync(m)}return y}}function r(a){ee.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(f,p,m,d){a.open(f,ee.O_SYMLINK,function(y,h){if(y){d&&d(y);return}a.futimes(h,p,m,function(w){a.close(h,function(x){d&&d(w||x)})})})},a.lutimesSync=function(f,p,m){var d=a.openSync(f,ee.O_SYMLINK),y,h=!0;try{y=a.futimesSync(d,p,m),h=!1}finally{if(h)try{a.closeSync(d)}catch{}else a.closeSync(d)}return y}):a.futimes&&(a.lutimes=function(f,p,m,d){d&&process.nextTick(d)},a.lutimesSync=function(){})}function n(a){return a&&function(f,p,m){return a.call(t,f,p,function(d){l(d)&&(d=null),m&&m.apply(this,arguments)})}}function i(a){return a&&function(f,p){try{return a.call(t,f,p)}catch(m){if(!l(m))throw m}}}function o(a){return a&&function(f,p,m,d){return a.call(t,f,p,m,function(y){l(y)&&(y=null),d&&d.apply(this,arguments)})}}function s(a){return a&&function(f,p,m){try{return a.call(t,f,p,m)}catch(d){if(!l(d))throw d}}}function c(a){return a&&function(f,p,m){typeof p=="function"&&(m=p,p=null);function d(y,h){h&&(h.uid<0&&(h.uid+=4294967296),h.gid<0&&(h.gid+=4294967296)),m&&m.apply(this,arguments)}return p?a.call(t,f,p,d):a.call(t,f,d)}}function u(a){return a&&function(f,p){var m=p?a.call(t,f,p):a.call(t,f);return m&&(m.uid<0&&(m.uid+=4294967296),m.gid<0&&(m.gid+=4294967296)),m}}function l(a){if(!a||a.code==="ENOSYS")return!0;var f=!process.getuid||process.getuid()!==0;return!!(f&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Ut=g((xa,Bt)=>{var qt=require("stream").Stream;Bt.exports=gi;function gi(t){return{ReadStream:e,WriteStream:r};function e(n,i){if(!(this instanceof e))return new e(n,i);qt.call(this);var o=this;this.path=n,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,i=i||{};for(var s=Object.keys(i),c=0,u=s.length;c<u;c++){var l=s[c];this[l]=i[l]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,f){if(a){o.emit("error",a),o.readable=!1;return}o.fd=f,o.emit("open",f),o._read()})}function r(n,i){if(!(this instanceof r))return new r(n,i);qt.call(this),this.path=n,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,i=i||{};for(var o=Object.keys(i),s=0,c=o.length;s<c;s++){var u=o[s];this[u]=i[u]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var Gt=g((La,Xt)=>{"use strict";Xt.exports=wi;var vi=Object.getPrototypeOf||function(t){return t.__proto__};function wi(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:vi(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var ue=g((Pa,dt)=>{var E=require("fs"),bi=_t(),xi=Ut(),Li=Gt(),Ce=require("util"),R,Ie;typeof Symbol=="function"&&typeof Symbol.for=="function"?(R=Symbol.for("graceful-fs.queue"),Ie=Symbol.for("graceful-fs.previous")):(R="___graceful-fs.queue",Ie="___graceful-fs.previous");function Pi(){}function Ht(t,e){Object.defineProperty(t,R,{get:function(){return e}})}var se=Pi;Ce.debuglog?se=Ce.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(se=function(){var t=Ce.format.apply(Ce,arguments);t="GFS4: "+t.split(/\n/).join(`
3
+ GFS4: `),console.error(t)});E[R]||(Jt=global[R]||[],Ht(E,Jt),E.close=(function(t){function e(r,n){return t.call(E,r,function(i){i||Wt(),typeof n=="function"&&n.apply(this,arguments)})}return Object.defineProperty(e,Ie,{value:t}),e})(E.close),E.closeSync=(function(t){function e(r){t.apply(E,arguments),Wt()}return Object.defineProperty(e,Ie,{value:t}),e})(E.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){se(E[R]),require("assert").equal(E[R].length,0)}));var Jt;global[R]||Ht(global,E[R]);dt.exports=mt(Li(E));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!E.__patched&&(dt.exports=mt(E),E.__patched=!0);function mt(t){bi(t),t.gracefulify=mt,t.createReadStream=tt,t.createWriteStream=Ee;var e=t.readFile;t.readFile=r;function r(S,b,v){return typeof b=="function"&&(v=b,b=null),F(S,b,v);function F(M,C,k,O){return e(M,C,function(L){L&&(L.code==="EMFILE"||L.code==="ENFILE")?le([F,[M,C,k],L,O||Date.now(),Date.now()]):typeof k=="function"&&k.apply(this,arguments)})}}var n=t.writeFile;t.writeFile=i;function i(S,b,v,F){return typeof v=="function"&&(F=v,v=null),M(S,b,v,F);function M(C,k,O,L,N){return n(C,k,O,function(P){P&&(P.code==="EMFILE"||P.code==="ENFILE")?le([M,[C,k,O,L],P,N||Date.now(),Date.now()]):typeof L=="function"&&L.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(S,b,v,F){return typeof v=="function"&&(F=v,v=null),M(S,b,v,F);function M(C,k,O,L,N){return o(C,k,O,function(P){P&&(P.code==="EMFILE"||P.code==="ENFILE")?le([M,[C,k,O,L],P,N||Date.now(),Date.now()]):typeof L=="function"&&L.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(S,b,v,F){return typeof v=="function"&&(F=v,v=0),M(S,b,v,F);function M(C,k,O,L,N){return c(C,k,O,function(P){P&&(P.code==="EMFILE"||P.code==="ENFILE")?le([M,[C,k,O,L],P,N||Date.now(),Date.now()]):typeof L=="function"&&L.apply(this,arguments)})}}var l=t.readdir;t.readdir=f;var a=/^v[0-5]\./;function f(S,b,v){typeof b=="function"&&(v=b,b=null);var F=a.test(process.version)?function(k,O,L,N){return l(k,M(k,O,L,N))}:function(k,O,L,N){return l(k,O,M(k,O,L,N))};return F(S,b,v);function M(C,k,O,L){return function(N,P){N&&(N.code==="EMFILE"||N.code==="ENFILE")?le([F,[C,k,O],N,L||Date.now(),Date.now()]):(P&&P.sort&&P.sort(),typeof O=="function"&&O.call(this,N,P))}}}if(process.version.substr(0,4)==="v0.8"){var p=xi(t);w=p.ReadStream,D=p.WriteStream}var m=t.ReadStream;m&&(w.prototype=Object.create(m.prototype),w.prototype.open=x);var d=t.WriteStream;d&&(D.prototype=Object.create(d.prototype),D.prototype.open=A),Object.defineProperty(t,"ReadStream",{get:function(){return w},set:function(S){w=S},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return D},set:function(S){D=S},enumerable:!0,configurable:!0});var y=w;Object.defineProperty(t,"FileReadStream",{get:function(){return y},set:function(S){y=S},enumerable:!0,configurable:!0});var h=D;Object.defineProperty(t,"FileWriteStream",{get:function(){return h},set:function(S){h=S},enumerable:!0,configurable:!0});function w(S,b){return this instanceof w?(m.apply(this,arguments),this):w.apply(Object.create(w.prototype),arguments)}function x(){var S=this;T(S.path,S.flags,S.mode,function(b,v){b?(S.autoClose&&S.destroy(),S.emit("error",b)):(S.fd=v,S.emit("open",v),S.read())})}function D(S,b){return this instanceof D?(d.apply(this,arguments),this):D.apply(Object.create(D.prototype),arguments)}function A(){var S=this;T(S.path,S.flags,S.mode,function(b,v){b?(S.destroy(),S.emit("error",b)):(S.fd=v,S.emit("open",v))})}function tt(S,b){return new t.ReadStream(S,b)}function Ee(S,b){return new t.WriteStream(S,b)}var rt=t.open;t.open=T;function T(S,b,v,F){return typeof v=="function"&&(F=v,v=null),M(S,b,v,F);function M(C,k,O,L,N){return rt(C,k,O,function(P,la){P&&(P.code==="EMFILE"||P.code==="ENFILE")?le([M,[C,k,O,L],P,N||Date.now(),Date.now()]):typeof L=="function"&&L.apply(this,arguments)})}}return t}function le(t){se("ENQUEUE",t[0].name,t[1]),E[R].push(t),pt()}var je;function Wt(){for(var t=Date.now(),e=0;e<E[R].length;++e)E[R][e].length>2&&(E[R][e][3]=t,E[R][e][4]=t);pt()}function pt(){if(clearTimeout(je),je=void 0,E[R].length!==0){var t=E[R].shift(),e=t[0],r=t[1],n=t[2],i=t[3],o=t[4];if(i===void 0)se("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-i>=6e4){se("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,n)}else{var c=Date.now()-o,u=Math.max(o-i,1),l=Math.min(u*1.2,100);c>=l?(se("RETRY",e.name,r),e.apply(null,r.concat([i]))):E[R].push(t)}je===void 0&&(je=setTimeout(pt,0))}}});var _=g(Q=>{"use strict";var Yt=j().fromCallback,$=ue(),ki=["access","appendFile","chmod","chown","close","copyFile","cp","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","glob","lchmod","lchown","lutimes","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","statfs","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof $[t]=="function");Object.assign(Q,$);ki.forEach(t=>{Q[t]=Yt($[t])});Q.exists=function(t,e){return typeof e=="function"?$.exists(t,e):new Promise(r=>$.exists(t,r))};Q.read=function(t,e,r,n,i,o){return typeof o=="function"?$.read(t,e,r,n,i,o):new Promise((s,c)=>{$.read(t,e,r,n,i,(u,l,a)=>{if(u)return c(u);s({bytesRead:l,buffer:a})})})};Q.write=function(t,e,...r){return typeof r[r.length-1]=="function"?$.write(t,e,...r):new Promise((n,i)=>{$.write(t,e,...r,(o,s,c)=>{if(o)return i(o);n({bytesWritten:s,buffer:c})})})};Q.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?$.readv(t,e,...r):new Promise((n,i)=>{$.readv(t,e,...r,(o,s,c)=>{if(o)return i(o);n({bytesRead:s,buffers:c})})})};Q.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?$.writev(t,e,...r):new Promise((n,i)=>{$.writev(t,e,...r,(o,s,c)=>{if(o)return i(o);n({bytesWritten:s,buffers:c})})})};typeof $.realpath.native=="function"?Q.realpath.native=Yt($.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Kt=g((Ea,Qt)=>{"use strict";var Ei=require("path");Qt.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(Ei.parse(e).root,""))){let n=new Error(`Path contains invalid characters: ${e}`);throw n.code="EINVAL",n}}});var tr=g((Da,yt)=>{"use strict";var zt=_(),{checkPath:Zt}=Kt(),er=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};yt.exports.makeDir=async(t,e)=>(Zt(t),zt.mkdir(t,{mode:er(e),recursive:!0}));yt.exports.makeDirSync=(t,e)=>(Zt(t),zt.mkdirSync(t,{mode:er(e),recursive:!0}))});var W=g((Oa,rr)=>{"use strict";var Di=j().fromPromise,{makeDir:Oi,makeDirSync:ht}=tr(),St=Di(Oi);rr.exports={mkdirs:St,mkdirsSync:ht,mkdirp:St,mkdirpSync:ht,ensureDir:St,ensureDirSync:ht}});var te=g((Ta,ir)=>{"use strict";var Ti=j().fromPromise,nr=_();function Ci(t){return nr.access(t).then(()=>!0).catch(()=>!1)}ir.exports={pathExists:Ti(Ci),pathExistsSync:nr.existsSync}});var gt=g((Ca,or)=>{"use strict";var fe=_(),ji=j().fromPromise;async function Ii(t,e,r){let n=await fe.open(t,"r+"),i=null;try{await fe.futimes(n,e,r)}finally{try{await fe.close(n)}catch(o){i=o}}if(i)throw i}function Fi(t,e,r){let n=fe.openSync(t,"r+");return fe.futimesSync(n,e,r),fe.closeSync(n)}or.exports={utimesMillis:ji(Ii),utimesMillisSync:Fi}});var ae=g((ja,lr)=>{"use strict";var me=_(),I=require("path"),sr=j().fromPromise;function Mi(t,e,r){let n=r.dereference?i=>me.stat(i,{bigint:!0}):i=>me.lstat(i,{bigint:!0});return Promise.all([n(t),n(e).catch(i=>{if(i.code==="ENOENT")return null;throw i})]).then(([i,o])=>({srcStat:i,destStat:o}))}function Ni(t,e,r){let n,i=r.dereference?s=>me.statSync(s,{bigint:!0}):s=>me.lstatSync(s,{bigint:!0}),o=i(t);try{n=i(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:n}}async function Ri(t,e,r,n){let{srcStat:i,destStat:o}=await Mi(t,e,n);if(o){if(he(i,o)){let s=I.basename(t),c=I.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:i,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(i.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!i.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(i.isDirectory()&&vt(t,e))throw new Error(Fe(t,e,r));return{srcStat:i,destStat:o}}function Vi(t,e,r,n){let{srcStat:i,destStat:o}=Ni(t,e,n);if(o){if(he(i,o)){let s=I.basename(t),c=I.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:i,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(i.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!i.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(i.isDirectory()&&vt(t,e))throw new Error(Fe(t,e,r));return{srcStat:i,destStat:o}}async function ar(t,e,r,n){let i=I.resolve(I.dirname(t)),o=I.resolve(I.dirname(r));if(o===i||o===I.parse(o).root)return;let s;try{s=await me.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(he(e,s))throw new Error(Fe(t,r,n));return ar(t,e,o,n)}function cr(t,e,r,n){let i=I.resolve(I.dirname(t)),o=I.resolve(I.dirname(r));if(o===i||o===I.parse(o).root)return;let s;try{s=me.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(he(e,s))throw new Error(Fe(t,r,n));return cr(t,e,o,n)}function he(t,e){return e.ino!==void 0&&e.dev!==void 0&&e.ino===t.ino&&e.dev===t.dev}function vt(t,e){let r=I.resolve(t).split(I.sep).filter(i=>i),n=I.resolve(e).split(I.sep).filter(i=>i);return r.every((i,o)=>n[o]===i)}function Fe(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}lr.exports={checkPaths:sr(Ri),checkPathsSync:Vi,checkParentPaths:sr(ar),checkParentPathsSync:cr,isSrcSubdir:vt,areIdentical:he}});var fr=g((Ia,ur)=>{"use strict";async function Ai(t,e){let r=[];for await(let n of t)r.push(e(n).then(()=>null,i=>i??new Error("unknown error")));await Promise.all(r.map(n=>n.then(i=>{if(i!==null)throw i})))}ur.exports={asyncIteratorConcurrentProcess:Ai}});var hr=g((Fa,yr)=>{"use strict";var V=_(),Se=require("path"),{mkdirs:$i}=W(),{pathExists:_i}=te(),{utimesMillis:qi}=gt(),ge=ae(),{asyncIteratorConcurrentProcess:Bi}=fr();async function Ui(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
4
4
 
5
5
  see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await ge.checkPaths(t,e,"copy",r);if(await ge.checkParentPaths(t,n,e,"copy"),!await pr(t,e,r))return;let s=Se.dirname(e);await _i(s)||await $i(s),await dr(i,t,e,r)}async function pr(t,e,r){return r.filter?r.filter(t,e):!0}async function dr(t,e,r,n){let o=await(n.dereference?V.stat:V.lstat)(e);if(o.isDirectory())return Wi(o,t,e,r,n);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Xi(o,t,e,r,n);if(o.isSymbolicLink())return Hi(t,e,r,n);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Xi(t,e,r,n,i){if(!e)return mr(t,r,n,i);if(i.overwrite)return await V.unlink(n),mr(t,r,n,i);if(i.errorOnExist)throw new Error(`'${n}' already exists`)}async function mr(t,e,r,n){if(await V.copyFile(e,r),n.preserveTimestamps){Gi(t.mode)&&await Ji(r,t.mode);let i=await V.stat(e);await qi(r,i.atime,i.mtime)}return V.chmod(r,t.mode)}function Gi(t){return(t&128)===0}function Ji(t,e){return V.chmod(t,e|128)}async function Wi(t,e,r,n,i){e||await V.mkdir(n),await Bi(await V.opendir(r),async o=>{let s=Se.join(r,o.name),c=Se.join(n,o.name);if(await pr(s,c,i)){let{destStat:l}=await ge.checkPaths(s,c,"copy",i);await dr(l,s,c,i)}}),e||await V.chmod(n,t.mode)}async function Hi(t,e,r,n){let i=await V.readlink(e);if(n.dereference&&(i=Se.resolve(process.cwd(),i)),!t)return V.symlink(i,r);let o=null;try{o=await V.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return V.symlink(i,r);throw s}if(n.dereference&&(o=Se.resolve(process.cwd(),o)),ge.isSrcSubdir(i,o))throw new Error(`Cannot copy '${i}' to a subdirectory of itself, '${o}'.`);if(ge.isSrcSubdir(o,i))throw new Error(`Cannot overwrite '${o}' with '${i}'.`);return await V.unlink(r),V.symlink(i,r)}yr.exports=Ui});var br=g((Ma,wr)=>{"use strict";var q=ue(),ve=require("path"),Yi=W().mkdirsSync,Qi=gt().utimesMillisSync,we=ae();function Ki(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
6
6
 
7
- see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=we.checkPathsSync(t,e,"copy",r);if(we.checkParentPathsSync(t,n,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ve.dirname(e);return q.existsSync(o)||Yi(o),Sr(i,t,e,r)}function Sr(t,e,r,n){let o=(n.dereference?q.statSync:q.lstatSync)(e);if(o.isDirectory())return io(o,t,e,r,n);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return zi(o,t,e,r,n);if(o.isSymbolicLink())return ao(t,e,r,n);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function zi(t,e,r,n,i){return e?Zi(t,r,n,i):gr(t,r,n,i)}function Zi(t,e,r,n){if(n.overwrite)return q.unlinkSync(r),gr(t,e,r,n);if(n.errorOnExist)throw new Error(`'${r}' already exists`)}function gr(t,e,r,n){return q.copyFileSync(e,r),n.preserveTimestamps&&eo(t.mode,e,r),wt(r,t.mode)}function eo(t,e,r){return to(t)&&ro(r,t),no(e,r)}function to(t){return(t&128)===0}function ro(t,e){return wt(t,e|128)}function wt(t,e){return q.chmodSync(t,e)}function no(t,e){let r=q.statSync(t);return Qi(e,r.atime,r.mtime)}function io(t,e,r,n,i){return e?vr(r,n,i):oo(t.mode,r,n,i)}function oo(t,e,r,n){return q.mkdirSync(r),vr(e,r,n),wt(r,t)}function vr(t,e,r){let n=q.opendirSync(t);try{let i;for(;(i=n.readSync())!==null;)so(i.name,t,e,r)}finally{n.closeSync()}}function so(t,e,r,n){let i=ve.join(e,t),o=ve.join(r,t);if(n.filter&&!n.filter(i,o))return;let{destStat:s}=we.checkPathsSync(i,o,"copy",n);return Sr(s,i,o,n)}function ao(t,e,r,n){let i=q.readlinkSync(e);if(n.dereference&&(i=ve.resolve(process.cwd(),i)),t){let o;try{o=q.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return q.symlinkSync(i,r);throw s}if(n.dereference&&(o=ve.resolve(process.cwd(),o)),we.isSrcSubdir(i,o))throw new Error(`Cannot copy '${i}' to a subdirectory of itself, '${o}'.`);if(we.isSrcSubdir(o,i))throw new Error(`Cannot overwrite '${o}' with '${i}'.`);return co(i,r)}else return q.symlinkSync(i,r)}function co(t,e){return q.unlinkSync(e),q.symlinkSync(t,e)}wr.exports=Ki});var Me=g((Ra,xr)=>{"use strict";var lo=j().fromPromise;xr.exports={copy:lo(hr()),copySync:br()}});var be=g((Na,Lr)=>{"use strict";var Pr=ue(),uo=j().fromCallback;function fo(t,e){Pr.rm(t,{recursive:!0,force:!0},e)}function mo(t){Pr.rmSync(t,{recursive:!0,force:!0})}Lr.exports={remove:uo(fo),removeSync:mo}});var Ir=g((Va,jr)=>{"use strict";var po=j().fromPromise,Dr=_(),Or=require("path"),Tr=W(),Cr=be(),kr=po(async function(e){let r;try{r=await Dr.readdir(e)}catch{return Tr.mkdirs(e)}return Promise.all(r.map(n=>Cr.remove(Or.join(e,n))))});function Er(t){let e;try{e=Dr.readdirSync(t)}catch{return Tr.mkdirsSync(t)}e.forEach(r=>{r=Or.join(t,r),Cr.removeSync(r)})}jr.exports={emptyDirSync:Er,emptydirSync:Er,emptyDir:kr,emptydir:kr}});var Nr=g((Aa,Rr)=>{"use strict";var yo=j().fromPromise,Fr=require("path"),K=_(),Mr=W();async function ho(t){let e;try{e=await K.stat(t)}catch{}if(e&&e.isFile())return;let r=Fr.dirname(t),n=null;try{n=await K.stat(r)}catch(i){if(i.code==="ENOENT"){await Mr.mkdirs(r),await K.writeFile(t,"");return}else throw i}n.isDirectory()?await K.writeFile(t,""):await K.readdir(r)}function So(t){let e;try{e=K.statSync(t)}catch{}if(e&&e.isFile())return;let r=Fr.dirname(t);try{K.statSync(r).isDirectory()||K.readdirSync(r)}catch(n){if(n&&n.code==="ENOENT")Mr.mkdirsSync(r);else throw n}K.writeFileSync(t,"")}Rr.exports={createFile:yo(ho),createFileSync:So}});var qr=g(($a,_r)=>{"use strict";var go=j().fromPromise,Vr=require("path"),re=_(),Ar=W(),{pathExists:vo}=te(),{areIdentical:$r}=ae();async function wo(t,e){let r;try{r=await re.lstat(e)}catch{}let n;try{n=await re.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&$r(n,r))return;let i=Vr.dirname(e);await vo(i)||await Ar.mkdirs(i),await re.link(t,e)}function bo(t,e){let r;try{r=re.lstatSync(e)}catch{}try{let o=re.lstatSync(t);if(r&&$r(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let n=Vr.dirname(e);return re.existsSync(n)||Ar.mkdirsSync(n),re.linkSync(t,e)}_r.exports={createLink:go(wo),createLinkSync:bo}});var Ur=g((_a,Br)=>{"use strict";var ne=require("path"),xe=_(),{pathExists:xo}=te(),Po=j().fromPromise;async function Lo(t,e){if(ne.isAbsolute(t)){try{await xe.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ne.dirname(e),n=ne.join(r,t);if(await xo(n))return{toCwd:n,toDst:t};try{await xe.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ne.relative(r,t)}}function ko(t,e){if(ne.isAbsolute(t)){if(!xe.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ne.dirname(e),n=ne.join(r,t);if(xe.existsSync(n))return{toCwd:n,toDst:t};if(!xe.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ne.relative(r,t)}}Br.exports={symlinkPaths:Po(Lo),symlinkPathsSync:ko}});var Jr=g((qa,Gr)=>{"use strict";var Xr=_(),Eo=j().fromPromise;async function Do(t,e){if(e)return e;let r;try{r=await Xr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function Oo(t,e){if(e)return e;let r;try{r=Xr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Gr.exports={symlinkType:Eo(Do),symlinkTypeSync:Oo}});var Qr=g((Ba,Yr)=>{"use strict";var To=j().fromPromise,Wr=require("path"),H=_(),{mkdirs:Co,mkdirsSync:jo}=W(),{symlinkPaths:Io,symlinkPathsSync:Fo}=Ur(),{symlinkType:Mo,symlinkTypeSync:Ro}=Jr(),{pathExists:No}=te(),{areIdentical:Hr}=ae();async function Vo(t,e,r){let n;try{n=await H.lstat(e)}catch{}if(n&&n.isSymbolicLink()){let[c,u]=await Promise.all([H.stat(t),H.stat(e)]);if(Hr(c,u))return}let i=await Io(t,e);t=i.toDst;let o=await Mo(i.toCwd,r),s=Wr.dirname(e);return await No(s)||await Co(s),H.symlink(t,e,o)}function Ao(t,e,r){let n;try{n=H.lstatSync(e)}catch{}if(n&&n.isSymbolicLink()){let c=H.statSync(t),u=H.statSync(e);if(Hr(c,u))return}let i=Fo(t,e);t=i.toDst,r=Ro(i.toCwd,r);let o=Wr.dirname(e);return H.existsSync(o)||jo(o),H.symlinkSync(t,e,r)}Yr.exports={createSymlink:To(Vo),createSymlinkSync:Ao}});var on=g((Ua,nn)=>{"use strict";var{createFile:Kr,createFileSync:zr}=Nr(),{createLink:Zr,createLinkSync:en}=qr(),{createSymlink:tn,createSymlinkSync:rn}=Qr();nn.exports={createFile:Kr,createFileSync:zr,ensureFile:Kr,ensureFileSync:zr,createLink:Zr,createLinkSync:en,ensureLink:Zr,ensureLinkSync:en,createSymlink:tn,createSymlinkSync:rn,ensureSymlink:tn,ensureSymlinkSync:rn}});var Re=g((Xa,sn)=>{function $o(t,{EOL:e=`
8
- `,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let o=r?e:"";return JSON.stringify(t,n,i).replace(/\n/g,e)+o}function _o(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}sn.exports={stringify:$o,stripBom:_o}});var un=g((Ga,ln)=>{var pe;try{pe=ue()}catch{pe=require("fs")}var Ne=j(),{stringify:an,stripBom:cn}=Re();async function qo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||pe,n="throws"in e?e.throws:!0,i=await Ne.fromCallback(r.readFile)(t,e);i=cn(i);let o;try{o=JSON.parse(i,e?e.reviver:null)}catch(s){if(n)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Bo=Ne.fromPromise(qo);function Uo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||pe,n="throws"in e?e.throws:!0;try{let i=r.readFileSync(t,e);return i=cn(i),JSON.parse(i,e.reviver)}catch(i){if(n)throw i.message=`${t}: ${i.message}`,i;return null}}async function Xo(t,e,r={}){let n=r.fs||pe,i=an(e,r);await Ne.fromCallback(n.writeFile)(t,i,r)}var Go=Ne.fromPromise(Xo);function Jo(t,e,r={}){let n=r.fs||pe,i=an(e,r);return n.writeFileSync(t,i,r)}ln.exports={readFile:Bo,readFileSync:Uo,writeFile:Go,writeFileSync:Jo}});var mn=g((Ja,fn)=>{"use strict";var Ve=un();fn.exports={readJson:Ve.readFile,readJsonSync:Ve.readFileSync,writeJson:Ve.writeFile,writeJsonSync:Ve.writeFileSync}});var Ae=g((Wa,yn)=>{"use strict";var Wo=j().fromPromise,bt=_(),pn=require("path"),dn=W(),Ho=te().pathExists;async function Yo(t,e,r="utf-8"){let n=pn.dirname(t);return await Ho(n)||await dn.mkdirs(n),bt.writeFile(t,e,r)}function Qo(t,...e){let r=pn.dirname(t);bt.existsSync(r)||dn.mkdirsSync(r),bt.writeFileSync(t,...e)}yn.exports={outputFile:Wo(Yo),outputFileSync:Qo}});var Sn=g((Ha,hn)=>{"use strict";var{stringify:Ko}=Re(),{outputFile:zo}=Ae();async function Zo(t,e,r={}){let n=Ko(e,r);await zo(t,n,r)}hn.exports=Zo});var vn=g((Ya,gn)=>{"use strict";var{stringify:es}=Re(),{outputFileSync:ts}=Ae();function rs(t,e,r){let n=es(e,r);ts(t,n,r)}gn.exports=rs});var bn=g((Qa,wn)=>{"use strict";var ns=j().fromPromise,B=mn();B.outputJson=ns(Sn());B.outputJsonSync=vn();B.outputJSON=B.outputJson;B.outputJSONSync=B.outputJsonSync;B.writeJSON=B.writeJson;B.writeJSONSync=B.writeJsonSync;B.readJSON=B.readJson;B.readJSONSync=B.readJsonSync;wn.exports=B});var En=g((Ka,kn)=>{"use strict";var is=_(),xn=require("path"),{copy:os}=Me(),{remove:Ln}=be(),{mkdirp:ss}=W(),{pathExists:as}=te(),Pn=ae();async function cs(t,e,r={}){let n=r.overwrite||r.clobber||!1,{srcStat:i,isChangingCase:o=!1}=await Pn.checkPaths(t,e,"move",r);await Pn.checkParentPaths(t,i,e,"move");let s=xn.dirname(e);return xn.parse(s).root!==s&&await ss(s),ls(t,e,n,o)}async function ls(t,e,r,n){if(!n){if(r)await Ln(e);else if(await as(e))throw new Error("dest already exists.")}try{await is.rename(t,e)}catch(i){if(i.code!=="EXDEV")throw i;await us(t,e,r)}}async function us(t,e,r){return await os(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Ln(t)}kn.exports=cs});var jn=g((za,Cn)=>{"use strict";var On=ue(),Pt=require("path"),fs=Me().copySync,Tn=be().removeSync,ms=W().mkdirpSync,Dn=ae();function ps(t,e,r){r=r||{};let n=r.overwrite||r.clobber||!1,{srcStat:i,isChangingCase:o=!1}=Dn.checkPathsSync(t,e,"move",r);return Dn.checkParentPathsSync(t,i,e,"move"),ds(e)||ms(Pt.dirname(e)),ys(t,e,n,o)}function ds(t){let e=Pt.dirname(t);return Pt.parse(e).root===e}function ys(t,e,r,n){if(n)return xt(t,e,r);if(r)return Tn(e),xt(t,e,r);if(On.existsSync(e))throw new Error("dest already exists.");return xt(t,e,r)}function xt(t,e,r){try{On.renameSync(t,e)}catch(n){if(n.code!=="EXDEV")throw n;return hs(t,e,r)}}function hs(t,e,r){return fs(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Tn(t)}Cn.exports=ps});var Fn=g((Za,In)=>{"use strict";var Ss=j().fromPromise;In.exports={move:Ss(En()),moveSync:jn()}});var Rn=g((ec,Mn)=>{"use strict";Mn.exports={..._(),...Me(),...Ir(),...on(),...bn(),...W(),...Fn(),...Ae(),...te(),...be()}});var Nn=g($e=>{"use strict";Object.defineProperty($e,"__esModule",{value:!0});$e.EXTENSIONS_LANGUAGES=void 0;$e.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var Pe=g(Lt=>{"use strict";Object.defineProperty(Lt,"__esModule",{value:!0});Lt.setOptionValues=gs;function gs(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var An=g(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});_e.SarifBuilder=void 0;var vs=require("path"),Vn=Rn(),ws=Nn(),bs=Pe(),kt=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,bs.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Vn.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Vn.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,n,i,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((n=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||n===void 0)&&n.uri&&e.artifacts.filter(a=>{var f;return((f=a?.location)===null||f===void 0?void 0:f.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=vs.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),f=ws.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:f,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(i=e?.tool)===null||i===void 0?void 0:i.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,f;let p=(f=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||f===void 0?void 0:f.uri;return p&&s.indexOf(p)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(p)),l})),u)),e}};_e.SarifBuilder=kt});var $n=g(qe=>{"use strict";Object.defineProperty(qe,"__esModule",{value:!0});qe.SarifResultBuilder=void 0;var xs=Pe(),Et=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,xs.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};qe.SarifResultBuilder=Et});var _n=g(Be=>{"use strict";Object.defineProperty(Be,"__esModule",{value:!0});Be.SarifRuleBuilder=void 0;var Ps=Pe(),Dt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,Ps.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};Be.SarifRuleBuilder=Dt});var qn=g(Ue=>{"use strict";Object.defineProperty(Ue,"__esModule",{value:!0});Ue.SarifRunBuilder=void 0;var Ls=Pe(),Ot=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,Ls.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};Ue.SarifRunBuilder=Ot});var Bn=g(Y=>{"use strict";Object.defineProperty(Y,"__esModule",{value:!0});Y.SarifResultBuilder=Y.SarifRuleBuilder=Y.SarifRunBuilder=Y.SarifBuilder=void 0;var ks=An();Object.defineProperty(Y,"SarifBuilder",{enumerable:!0,get:function(){return ks.SarifBuilder}});var Es=$n();Object.defineProperty(Y,"SarifResultBuilder",{enumerable:!0,get:function(){return Es.SarifResultBuilder}});var Ds=_n();Object.defineProperty(Y,"SarifRuleBuilder",{enumerable:!0,get:function(){return Ds.SarifRuleBuilder}});var Os=qn();Object.defineProperty(Y,"SarifRunBuilder",{enumerable:!0,get:function(){return Os.SarifRunBuilder}})});var Xn=g((cc,Un)=>{"use strict";var Ts=/["'&<>]/;Un.exports=Cs;function Cs(t){var e=""+t,r=Ts.exec(e);if(!r)return e;var n,i="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:n="&quot;";break;case 38:n="&amp;";break;case 39:n="&#39;";break;case 60:n="&lt;";break;case 62:n="&gt;";break;default:continue}s!==o&&(i+=e.substring(s,o)),s=o+1,i+=n}return s!==o?i+e.substring(s,o):i}});var et=require("zx"),ce=require("fs/promises");var X={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var De=class{constructor(e){this.depProvider=e}allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,n)=>{let i=At(r.severity,n.severity);return i===0?r.id.localeCompare(n.id):-i}),e}addVulnerability(e,r){let n=e.id,i=this.allById,o=e;if(!i.has(n))i.set(n,e),o=e;else{let s=i.get(n);s.title=s.title||e.title,s.severity=di(s.severity,e.severity),s.scannerSeverity[r]=e.severity,s.detectedBy=it(s.detectedBy,r),s.componentPurls=it(s.componentPurls,e.componentPurls[0]),s.refs=it(s.refs,e.refs[0]),o=s}o.components=o.componentPurls?.map(s=>this.depProvider.findUsagesOfComponent(s))}enhanceWithVexData(e){let r=[];for(let n of this.allById.values()){let i=e.newestVulnerabilityStatement(n.id);if(!i){r.push({id:n.id,severity:n.severity,title:n.title,description:n.description,components:n.components??[],refs:n.refs});continue}n.vexStatement=i}return{unmatchedVulnerabilities:r}}};function di(t,e){return At(t,e)>0?t:e}function At(t,e){return X[t]-X[e]}function it(t,e){return e?Array.from(new Set([...t,e]).values()):t}var Oe=nt(require("path"));var U=require("fs/promises"),ot=require("path");async function G(t){if(await oe(t))return JSON.parse(await(0,U.readFile)(t,{encoding:"utf-8"}))}async function st(t,e){await(0,U.writeFile)(t,JSON.stringify(e,null,4)+`
9
- `,{encoding:"utf-8"})}function J(t){return t&&t.replace(/\?.*$/,"")}async function oe(t){try{return await(0,U.access)(t,U.constants.F_OK),!0}catch{return!1}}async function at(t){let e=(0,ot.resolve)(t),r=await(0,U.readdir)(e,{withFileTypes:!0});for(let n of r){let i=(0,ot.resolve)(n.parentPath,n.name);n.isDirectory()?await at(i):await(0,U.rm)(i)}await(0,U.rmdir)(e)}async function ye(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},n=await fetch(t,{headers:r});if(!n.ok){let i="";try{i=await n.text()}catch(o){i=`${o}`}throw new Error(`Failed to fetch: ${t}: ${n.status} - ${n.statusText}: ${i}`)}return n}var ct;async function lt(t){if(ct)return ct;let e="https://repository.conterra.de/repository/maven-mirror-ct",r=Z(t.workingDir,"input/vex"),n=Z(t.workingDir,"output"),i=Z(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=Z(t.workingDir,"vuln-scan-conf.json"),c=await G(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);let u=c.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return ct={projectConfigFileLocation:s,onNewVulnerabilities:c.onNewVulnerabilities??(c.failOnNewVulnerabilities?"fail":"warn"),onNoLongerDetectedVulnerabilities:c.onNoLongerDetectedVulnerabilities??"ignore",reportNoLongerDetectedVulnerabilities:c.reportNoLongerDetectedVulnerabilities??!0,consoleReport:c.consoleReport||"BY_PROJECT_DETAILED",createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:Z(t.workingDir,c.vexDir)??r,outDir:Z(t.workingDir,c.outDir)??n,cacheDir:Z(t.workingDir,c.cacheDir)??i,scanners:(c.scanners??o).map(l=>{if(typeof l!="string")throw new Error(`Invalid scanner name '${l}' in configuration file '${s}'`);let a=l.split("@");if(a.length>2)throw new Error(`Invalid scanner name '${l}' in configuration file '${s}'`);let f=a[0],p=a[1]??"";return{name:f,version:p}}),projects:(c.projects??[]).map(l=>{let a=l;if(!a.name)throw new Error("Project name is missing on entry:"+JSON.stringify(a));if(!a.version)throw new Error("Project version is missing on entry:"+JSON.stringify(a));if(!a.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(a));return a.purlAliases||(a.purlAliases=[]),a.enabled==null&&(a.enabled=!0),a.silent==null&&(a.silent=!1),a.minimumSeverity||(a.minimumSeverity="UNKNOWN"),a.sbomFile?{...a,sbomFile:Z(t.workingDir,a.sbomFile)}:(a.detectNoLongerUsedVulnerabilities=u?a.purl.endsWith("-SNAPSHOT"):!0,l)})}}function Z(t,e){if(e)return Oe.default.isAbsolute(e)?e:(0,Oe.resolve)(t,e)}var ie=nt(Bn());var Gn=nt(Xn());function Le(t,e="",r=new Set){if(r.has(t.purl))return"";r.add(t.purl);let n=r.size===1,i=`${e}- ${t.purl}`;for(let o of t.usedBy){let s=Le(o,e+(n?" ":" "),r);s!==""&&(i+=`
10
- `,i+=s)}return i}var Xe=class t{constructor(e){this.sbom=e;for(let r of this.sbom.components||[]){let n={purl:J(r.purl),usedBy:[]};this.purlToComponent.has(n.purl)||(this.purlToComponent.set(n.purl,n),this.sbomRefToComponent.set(r["bom-ref"],n))}for(let r of this.sbom.dependencies||[]){let n=this.sbomRefToComponent.get(r.ref);if(n)for(let i of r.dependsOn||[]){let o=this.sbomRefToComponent.get(i);o&&!o.usedBy.includes(n)&&o.usedBy.push(n)}}}static createForSbom(e){return new t(e)}sbomRefToComponent=new Map;purlToComponent=new Map;findUsagesOfComponent(e){if(!this.sbom)return{purl:e,usedBy:[]};let r=this.purlToComponent.get(e);return r||{purl:e,usedBy:[]}}};function Jn(t,e){let r=new ie.SarifRunBuilder().initSimple({toolDriverName:`${e.name}@${e.version}`,toolDriverVersion:"0.0.1"}),n=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${n}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${n}`};for(let o of t){let s=Is(o.severity),c=o.id,u=js(o.refs),l=new ie.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,f,p="new",m="";a?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(f[0].status="underReview",m="--- UNDER INVESTIGATION --- ")):X[e.minimumSeverity]>X[o.severity]?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(f=[{kind:"external",status:"accepted"}],p="updated",m="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${m}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:Fs(o,u,m)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let d of o.componentPurls){let y=new ie.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});y.result.message.id="default",y.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],y.result.baselineState=p,y.result.suppressions=f,r.addResult(y)}}let i=new ie.SarifBuilder;return i.addRun(r),i.buildSarifOutput()}function js(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function Is(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"warning";default:return"note"}}function Fs(t,e,r){let n=t.vexStatement,i=n?`
7
+ see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=we.checkPathsSync(t,e,"copy",r);if(we.checkParentPathsSync(t,n,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ve.dirname(e);return q.existsSync(o)||Yi(o),Sr(i,t,e,r)}function Sr(t,e,r,n){let o=(n.dereference?q.statSync:q.lstatSync)(e);if(o.isDirectory())return io(o,t,e,r,n);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return zi(o,t,e,r,n);if(o.isSymbolicLink())return ao(t,e,r,n);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function zi(t,e,r,n,i){return e?Zi(t,r,n,i):gr(t,r,n,i)}function Zi(t,e,r,n){if(n.overwrite)return q.unlinkSync(r),gr(t,e,r,n);if(n.errorOnExist)throw new Error(`'${r}' already exists`)}function gr(t,e,r,n){return q.copyFileSync(e,r),n.preserveTimestamps&&eo(t.mode,e,r),wt(r,t.mode)}function eo(t,e,r){return to(t)&&ro(r,t),no(e,r)}function to(t){return(t&128)===0}function ro(t,e){return wt(t,e|128)}function wt(t,e){return q.chmodSync(t,e)}function no(t,e){let r=q.statSync(t);return Qi(e,r.atime,r.mtime)}function io(t,e,r,n,i){return e?vr(r,n,i):oo(t.mode,r,n,i)}function oo(t,e,r,n){return q.mkdirSync(r),vr(e,r,n),wt(r,t)}function vr(t,e,r){let n=q.opendirSync(t);try{let i;for(;(i=n.readSync())!==null;)so(i.name,t,e,r)}finally{n.closeSync()}}function so(t,e,r,n){let i=ve.join(e,t),o=ve.join(r,t);if(n.filter&&!n.filter(i,o))return;let{destStat:s}=we.checkPathsSync(i,o,"copy",n);return Sr(s,i,o,n)}function ao(t,e,r,n){let i=q.readlinkSync(e);if(n.dereference&&(i=ve.resolve(process.cwd(),i)),t){let o;try{o=q.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return q.symlinkSync(i,r);throw s}if(n.dereference&&(o=ve.resolve(process.cwd(),o)),we.isSrcSubdir(i,o))throw new Error(`Cannot copy '${i}' to a subdirectory of itself, '${o}'.`);if(we.isSrcSubdir(o,i))throw new Error(`Cannot overwrite '${o}' with '${i}'.`);return co(i,r)}else return q.symlinkSync(i,r)}function co(t,e){return q.unlinkSync(e),q.symlinkSync(t,e)}wr.exports=Ki});var Me=g((Na,xr)=>{"use strict";var lo=j().fromPromise;xr.exports={copy:lo(hr()),copySync:br()}});var be=g((Ra,Pr)=>{"use strict";var Lr=ue(),uo=j().fromCallback;function fo(t,e){Lr.rm(t,{recursive:!0,force:!0},e)}function mo(t){Lr.rmSync(t,{recursive:!0,force:!0})}Pr.exports={remove:uo(fo),removeSync:mo}});var Ir=g((Va,jr)=>{"use strict";var po=j().fromPromise,Dr=_(),Or=require("path"),Tr=W(),Cr=be(),kr=po(async function(e){let r;try{r=await Dr.readdir(e)}catch{return Tr.mkdirs(e)}return Promise.all(r.map(n=>Cr.remove(Or.join(e,n))))});function Er(t){let e;try{e=Dr.readdirSync(t)}catch{return Tr.mkdirsSync(t)}e.forEach(r=>{r=Or.join(t,r),Cr.removeSync(r)})}jr.exports={emptyDirSync:Er,emptydirSync:Er,emptyDir:kr,emptydir:kr}});var Rr=g((Aa,Nr)=>{"use strict";var yo=j().fromPromise,Fr=require("path"),K=_(),Mr=W();async function ho(t){let e;try{e=await K.stat(t)}catch{}if(e&&e.isFile())return;let r=Fr.dirname(t),n=null;try{n=await K.stat(r)}catch(i){if(i.code==="ENOENT"){await Mr.mkdirs(r),await K.writeFile(t,"");return}else throw i}n.isDirectory()?await K.writeFile(t,""):await K.readdir(r)}function So(t){let e;try{e=K.statSync(t)}catch{}if(e&&e.isFile())return;let r=Fr.dirname(t);try{K.statSync(r).isDirectory()||K.readdirSync(r)}catch(n){if(n&&n.code==="ENOENT")Mr.mkdirsSync(r);else throw n}K.writeFileSync(t,"")}Nr.exports={createFile:yo(ho),createFileSync:So}});var qr=g(($a,_r)=>{"use strict";var go=j().fromPromise,Vr=require("path"),re=_(),Ar=W(),{pathExists:vo}=te(),{areIdentical:$r}=ae();async function wo(t,e){let r;try{r=await re.lstat(e)}catch{}let n;try{n=await re.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&$r(n,r))return;let i=Vr.dirname(e);await vo(i)||await Ar.mkdirs(i),await re.link(t,e)}function bo(t,e){let r;try{r=re.lstatSync(e)}catch{}try{let o=re.lstatSync(t);if(r&&$r(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let n=Vr.dirname(e);return re.existsSync(n)||Ar.mkdirsSync(n),re.linkSync(t,e)}_r.exports={createLink:go(wo),createLinkSync:bo}});var Ur=g((_a,Br)=>{"use strict";var ne=require("path"),xe=_(),{pathExists:xo}=te(),Lo=j().fromPromise;async function Po(t,e){if(ne.isAbsolute(t)){try{await xe.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ne.dirname(e),n=ne.join(r,t);if(await xo(n))return{toCwd:n,toDst:t};try{await xe.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ne.relative(r,t)}}function ko(t,e){if(ne.isAbsolute(t)){if(!xe.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ne.dirname(e),n=ne.join(r,t);if(xe.existsSync(n))return{toCwd:n,toDst:t};if(!xe.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ne.relative(r,t)}}Br.exports={symlinkPaths:Lo(Po),symlinkPathsSync:ko}});var Jr=g((qa,Gr)=>{"use strict";var Xr=_(),Eo=j().fromPromise;async function Do(t,e){if(e)return e;let r;try{r=await Xr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function Oo(t,e){if(e)return e;let r;try{r=Xr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Gr.exports={symlinkType:Eo(Do),symlinkTypeSync:Oo}});var Qr=g((Ba,Yr)=>{"use strict";var To=j().fromPromise,Wr=require("path"),H=_(),{mkdirs:Co,mkdirsSync:jo}=W(),{symlinkPaths:Io,symlinkPathsSync:Fo}=Ur(),{symlinkType:Mo,symlinkTypeSync:No}=Jr(),{pathExists:Ro}=te(),{areIdentical:Hr}=ae();async function Vo(t,e,r){let n;try{n=await H.lstat(e)}catch{}if(n&&n.isSymbolicLink()){let[c,u]=await Promise.all([H.stat(t),H.stat(e)]);if(Hr(c,u))return}let i=await Io(t,e);t=i.toDst;let o=await Mo(i.toCwd,r),s=Wr.dirname(e);return await Ro(s)||await Co(s),H.symlink(t,e,o)}function Ao(t,e,r){let n;try{n=H.lstatSync(e)}catch{}if(n&&n.isSymbolicLink()){let c=H.statSync(t),u=H.statSync(e);if(Hr(c,u))return}let i=Fo(t,e);t=i.toDst,r=No(i.toCwd,r);let o=Wr.dirname(e);return H.existsSync(o)||jo(o),H.symlinkSync(t,e,r)}Yr.exports={createSymlink:To(Vo),createSymlinkSync:Ao}});var on=g((Ua,nn)=>{"use strict";var{createFile:Kr,createFileSync:zr}=Rr(),{createLink:Zr,createLinkSync:en}=qr(),{createSymlink:tn,createSymlinkSync:rn}=Qr();nn.exports={createFile:Kr,createFileSync:zr,ensureFile:Kr,ensureFileSync:zr,createLink:Zr,createLinkSync:en,ensureLink:Zr,ensureLinkSync:en,createSymlink:tn,createSymlinkSync:rn,ensureSymlink:tn,ensureSymlinkSync:rn}});var Ne=g((Xa,sn)=>{function $o(t,{EOL:e=`
8
+ `,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let o=r?e:"";return JSON.stringify(t,n,i).replace(/\n/g,e)+o}function _o(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}sn.exports={stringify:$o,stripBom:_o}});var un=g((Ga,ln)=>{var pe;try{pe=ue()}catch{pe=require("fs")}var Re=j(),{stringify:an,stripBom:cn}=Ne();async function qo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||pe,n="throws"in e?e.throws:!0,i=await Re.fromCallback(r.readFile)(t,e);i=cn(i);let o;try{o=JSON.parse(i,e?e.reviver:null)}catch(s){if(n)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Bo=Re.fromPromise(qo);function Uo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||pe,n="throws"in e?e.throws:!0;try{let i=r.readFileSync(t,e);return i=cn(i),JSON.parse(i,e.reviver)}catch(i){if(n)throw i.message=`${t}: ${i.message}`,i;return null}}async function Xo(t,e,r={}){let n=r.fs||pe,i=an(e,r);await Re.fromCallback(n.writeFile)(t,i,r)}var Go=Re.fromPromise(Xo);function Jo(t,e,r={}){let n=r.fs||pe,i=an(e,r);return n.writeFileSync(t,i,r)}ln.exports={readFile:Bo,readFileSync:Uo,writeFile:Go,writeFileSync:Jo}});var mn=g((Ja,fn)=>{"use strict";var Ve=un();fn.exports={readJson:Ve.readFile,readJsonSync:Ve.readFileSync,writeJson:Ve.writeFile,writeJsonSync:Ve.writeFileSync}});var Ae=g((Wa,yn)=>{"use strict";var Wo=j().fromPromise,bt=_(),pn=require("path"),dn=W(),Ho=te().pathExists;async function Yo(t,e,r="utf-8"){let n=pn.dirname(t);return await Ho(n)||await dn.mkdirs(n),bt.writeFile(t,e,r)}function Qo(t,...e){let r=pn.dirname(t);bt.existsSync(r)||dn.mkdirsSync(r),bt.writeFileSync(t,...e)}yn.exports={outputFile:Wo(Yo),outputFileSync:Qo}});var Sn=g((Ha,hn)=>{"use strict";var{stringify:Ko}=Ne(),{outputFile:zo}=Ae();async function Zo(t,e,r={}){let n=Ko(e,r);await zo(t,n,r)}hn.exports=Zo});var vn=g((Ya,gn)=>{"use strict";var{stringify:es}=Ne(),{outputFileSync:ts}=Ae();function rs(t,e,r){let n=es(e,r);ts(t,n,r)}gn.exports=rs});var bn=g((Qa,wn)=>{"use strict";var ns=j().fromPromise,B=mn();B.outputJson=ns(Sn());B.outputJsonSync=vn();B.outputJSON=B.outputJson;B.outputJSONSync=B.outputJsonSync;B.writeJSON=B.writeJson;B.writeJSONSync=B.writeJsonSync;B.readJSON=B.readJson;B.readJSONSync=B.readJsonSync;wn.exports=B});var En=g((Ka,kn)=>{"use strict";var is=_(),xn=require("path"),{copy:os}=Me(),{remove:Pn}=be(),{mkdirp:ss}=W(),{pathExists:as}=te(),Ln=ae();async function cs(t,e,r={}){let n=r.overwrite||r.clobber||!1,{srcStat:i,isChangingCase:o=!1}=await Ln.checkPaths(t,e,"move",r);await Ln.checkParentPaths(t,i,e,"move");let s=xn.dirname(e);return xn.parse(s).root!==s&&await ss(s),ls(t,e,n,o)}async function ls(t,e,r,n){if(!n){if(r)await Pn(e);else if(await as(e))throw new Error("dest already exists.")}try{await is.rename(t,e)}catch(i){if(i.code!=="EXDEV")throw i;await us(t,e,r)}}async function us(t,e,r){return await os(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Pn(t)}kn.exports=cs});var jn=g((za,Cn)=>{"use strict";var On=ue(),Lt=require("path"),fs=Me().copySync,Tn=be().removeSync,ms=W().mkdirpSync,Dn=ae();function ps(t,e,r){r=r||{};let n=r.overwrite||r.clobber||!1,{srcStat:i,isChangingCase:o=!1}=Dn.checkPathsSync(t,e,"move",r);return Dn.checkParentPathsSync(t,i,e,"move"),ds(e)||ms(Lt.dirname(e)),ys(t,e,n,o)}function ds(t){let e=Lt.dirname(t);return Lt.parse(e).root===e}function ys(t,e,r,n){if(n)return xt(t,e,r);if(r)return Tn(e),xt(t,e,r);if(On.existsSync(e))throw new Error("dest already exists.");return xt(t,e,r)}function xt(t,e,r){try{On.renameSync(t,e)}catch(n){if(n.code!=="EXDEV")throw n;return hs(t,e,r)}}function hs(t,e,r){return fs(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Tn(t)}Cn.exports=ps});var Fn=g((Za,In)=>{"use strict";var Ss=j().fromPromise;In.exports={move:Ss(En()),moveSync:jn()}});var Nn=g((ec,Mn)=>{"use strict";Mn.exports={..._(),...Me(),...Ir(),...on(),...bn(),...W(),...Fn(),...Ae(),...te(),...be()}});var Rn=g($e=>{"use strict";Object.defineProperty($e,"__esModule",{value:!0});$e.EXTENSIONS_LANGUAGES=void 0;$e.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var Le=g(Pt=>{"use strict";Object.defineProperty(Pt,"__esModule",{value:!0});Pt.setOptionValues=gs;function gs(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var An=g(_e=>{"use strict";Object.defineProperty(_e,"__esModule",{value:!0});_e.SarifBuilder=void 0;var vs=require("path"),Vn=Nn(),ws=Rn(),bs=Le(),kt=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,bs.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Vn.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Vn.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,n,i,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((n=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||n===void 0)&&n.uri&&e.artifacts.filter(a=>{var f;return((f=a?.location)===null||f===void 0?void 0:f.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=vs.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),f=ws.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:f,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(i=e?.tool)===null||i===void 0?void 0:i.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,f;let p=(f=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||f===void 0?void 0:f.uri;return p&&s.indexOf(p)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(p)),l})),u)),e}};_e.SarifBuilder=kt});var $n=g(qe=>{"use strict";Object.defineProperty(qe,"__esModule",{value:!0});qe.SarifResultBuilder=void 0;var xs=Le(),Et=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,xs.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};qe.SarifResultBuilder=Et});var _n=g(Be=>{"use strict";Object.defineProperty(Be,"__esModule",{value:!0});Be.SarifRuleBuilder=void 0;var Ls=Le(),Dt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,Ls.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};Be.SarifRuleBuilder=Dt});var qn=g(Ue=>{"use strict";Object.defineProperty(Ue,"__esModule",{value:!0});Ue.SarifRunBuilder=void 0;var Ps=Le(),Ot=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,Ps.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};Ue.SarifRunBuilder=Ot});var Bn=g(Y=>{"use strict";Object.defineProperty(Y,"__esModule",{value:!0});Y.SarifResultBuilder=Y.SarifRuleBuilder=Y.SarifRunBuilder=Y.SarifBuilder=void 0;var ks=An();Object.defineProperty(Y,"SarifBuilder",{enumerable:!0,get:function(){return ks.SarifBuilder}});var Es=$n();Object.defineProperty(Y,"SarifResultBuilder",{enumerable:!0,get:function(){return Es.SarifResultBuilder}});var Ds=_n();Object.defineProperty(Y,"SarifRuleBuilder",{enumerable:!0,get:function(){return Ds.SarifRuleBuilder}});var Os=qn();Object.defineProperty(Y,"SarifRunBuilder",{enumerable:!0,get:function(){return Os.SarifRunBuilder}})});var Xn=g((cc,Un)=>{"use strict";var Ts=/["'&<>]/;Un.exports=Cs;function Cs(t){var e=""+t,r=Ts.exec(e);if(!r)return e;var n,i="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:n="&quot;";break;case 38:n="&amp;";break;case 39:n="&#39;";break;case 60:n="&lt;";break;case 62:n="&gt;";break;default:continue}s!==o&&(i+=e.substring(s,o)),s=o+1,i+=n}return s!==o?i+e.substring(s,o):i}});var et=require("zx"),ce=require("fs/promises");var X={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var De=class{constructor(e){this.depProvider=e}allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,n)=>{let i=At(r.severity,n.severity);return i===0?r.id.localeCompare(n.id):-i}),e}addVulnerability(e,r){let n=e.id,i=this.allById,o=e;if(!i.has(n))i.set(n,e),o=e;else{let s=i.get(n);s.title=s.title||e.title,s.severity=di(s.severity,e.severity),s.scannerSeverity[r]=e.severity,s.detectedBy=it(s.detectedBy,r),s.components=it(s.components,e.components[0]),s.refs=it(s.refs,e.refs[0]),o=s}o.componentTree=o.components?.map(s=>this.depProvider.findUsagesOfComponent(s))}enhanceWithVexData(e){let r=[];for(let n of this.allById.values()){let i=e.newestVulnerabilityStatement(n.id);if(!i){r.push({id:n.id,severity:n.severity,title:n.title,description:n.description,components:n.components??[],componentTree:n.componentTree??[],refs:n.refs});continue}n.vexStatement=i}return{unmatchedVulnerabilities:r}}};function di(t,e){return At(t,e)>0?t:e}function At(t,e){return X[t]-X[e]}function it(t,e){return e?Array.from(new Set([...t,e]).values()):t}var Oe=nt(require("path"));var U=require("fs/promises"),ot=require("path");async function G(t){if(await oe(t))return JSON.parse(await(0,U.readFile)(t,{encoding:"utf-8"}))}async function st(t,e){await(0,U.writeFile)(t,JSON.stringify(e,null,4)+`
9
+ `,{encoding:"utf-8"})}function J(t){return t?t.replace(/\?.*$/,""):""}async function oe(t){try{return await(0,U.access)(t,U.constants.F_OK),!0}catch{return!1}}async function at(t){let e=(0,ot.resolve)(t),r=await(0,U.readdir)(e,{withFileTypes:!0});for(let n of r){let i=(0,ot.resolve)(n.parentPath,n.name);n.isDirectory()?await at(i):await(0,U.rm)(i)}await(0,U.rmdir)(e)}async function ye(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},n=await fetch(t,{headers:r});if(!n.ok){let i="";try{i=await n.text()}catch(o){i=`${o}`}throw new Error(`Failed to fetch: ${t}: ${n.status} - ${n.statusText}: ${i}`)}return n}var ct;async function lt(t){if(ct)return ct;let e="https://repository.conterra.de/repository/maven-mirror-ct",r=Z(t.workingDir,"input/vex"),n=Z(t.workingDir,"output"),i=Z(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=Z(t.workingDir,"vuln-scan-conf.json"),c=await G(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);let u=c.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return ct={projectConfigFileLocation:s,onNewVulnerabilities:c.onNewVulnerabilities??(c.failOnNewVulnerabilities?"fail":"warn"),onNoLongerDetectedVulnerabilities:c.onNoLongerDetectedVulnerabilities??"ignore",reportNoLongerDetectedVulnerabilities:c.reportNoLongerDetectedVulnerabilities??!0,consoleReport:c.consoleReport||"BY_PROJECT_DETAILED",createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:Z(t.workingDir,c.vexDir)??r,outDir:Z(t.workingDir,c.outDir)??n,cacheDir:Z(t.workingDir,c.cacheDir)??i,scanners:(c.scanners??o).map(l=>{if(typeof l!="string")throw new Error(`Invalid scanner name '${l}' in configuration file '${s}'`);let a=l.split("@");if(a.length>2)throw new Error(`Invalid scanner name '${l}' in configuration file '${s}'`);let f=a[0],p=a[1]??"";return{name:f,version:p}}),projects:(c.projects??[]).map(l=>{let a=l;if(!a.name)throw new Error("Project name is missing on entry:"+JSON.stringify(a));if(!a.version)throw new Error("Project version is missing on entry:"+JSON.stringify(a));if(!a.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(a));return a.purlAliases||(a.purlAliases=[]),a.enabled==null&&(a.enabled=!0),a.silent==null&&(a.silent=!1),a.minimumSeverity||(a.minimumSeverity="UNKNOWN"),a.sbomFile?{...a,sbomFile:Z(t.workingDir,a.sbomFile)}:(a.detectNoLongerUsedVulnerabilities=u?a.purl.endsWith("-SNAPSHOT"):!0,l)})}}function Z(t,e){if(e)return Oe.default.isAbsolute(e)?e:(0,Oe.resolve)(t,e)}var ie=nt(Bn());var Gn=nt(Xn());function Pe(t,e="",r=new Set){r.add(t.purl);let n=r.size===1,i=`${e}- ${t.purl}`;for(let o of t.usedBy){let s=Pe(o,e+(n?" ":" "),r);s!==""&&(i+=`
10
+ `,i+=s)}return i}var Xe=class t{constructor(e){this.sbom=e;for(let r of this.sbom.components||[]){let n={purl:J(r.purl),usedBy:[]};n.purl&&(this.purlToComponent.has(n.purl)||(this.purlToComponent.set(n.purl,n),this.sbomRefToComponent.set(r["bom-ref"],n)))}for(let r of this.sbom.dependencies||[]){let n=this.sbomRefToComponent.get(r.ref);if(n)for(let i of r.dependsOn||[]){let o=this.sbomRefToComponent.get(i);o&&!o.usedBy.includes(n)&&o.usedBy.push(n)}}}static createForSbom(e){return new t(e)}sbomRefToComponent=new Map;purlToComponent=new Map;findUsagesOfComponent(e){if(!this.sbom)return{purl:e,usedBy:[]};let r=this.purlToComponent.get(e);return r||{purl:e,usedBy:[]}}};function Jn(t,e){let r=new ie.SarifRunBuilder().initSimple({toolDriverName:`${e.name}@${e.version}`,toolDriverVersion:"0.0.1"}),n=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${n}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${n}`};for(let o of t){let s=Is(o.severity),c=o.id,u=js(o.refs),l=new ie.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,f,p="new",m="";a?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(f[0].status="underReview",m="--- UNDER INVESTIGATION --- ")):X[e.minimumSeverity]>X[o.severity]?(f=[{kind:"external",status:"accepted"}],p="updated",m=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(f=[{kind:"external",status:"accepted"}],p="updated",m="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${m}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:Fs(o,u,m)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let d of o.components){let y=new ie.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});y.result.message.id="default",y.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],y.result.baselineState=p,y.result.suppressions=f,r.addResult(y)}}let i=new ie.SarifBuilder;return i.addRun(r),i.buildSarifOutput()}function js(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function Is(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"warning";default:return"note"}}function Fs(t,e,r){let n=t.vexStatement,i=n?`
11
11
  ${r}
12
12
  ${n.justification??""}
13
13
  ${n.impact_statement??""}
@@ -24,14 +24,22 @@ ${(0,Gn.default)(t.description)}
24
24
  ${t.refs.map(o=>`* <${o}>`).join(`
25
25
  `)}
26
26
 
27
- --- DEPENDENCY TREE ---
27
+ --- COMPONENTS ---
28
28
 
29
- ${t.components?.map(o=>Le(o)).join(`
30
- `)}
29
+ - ${t.components?.join(`
30
+ - `)}
31
31
 
32
- `}var Je=require("fs/promises");async function Wn(t,e,r){if("sbomFile"in t)return await(0,Je.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let n=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Je.writeFile)(e,n),{...t,sbomFile:e}}var Ge=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let n=this.toArtifactUrl(r),i=await ye(n,this.authn);return Buffer.from(await i.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,i=await(await ye(r,this.authn)).text();return Ms(i,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),n=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${n}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function Ms(t,e){if(e.classifier&&e.extension){let i=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(i?.[1])return i[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),n=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!n)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${n[1]}`}var We=require("fs/promises"),Tt=require("path");var Ct=class{constructor(e){this.location=e}async read(){let e=await G(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await st(this.location,e)}async delete(){await(0,We.unlink)(this.location)}};async function He(t,e){for(let r of await(0,We.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new Ct((0,Tt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await He((0,Tt.resolve)(r.parentPath,r.name),e)}function It(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var de=class t{statements=[];filteredToProducts=[];static async fromUrl(e,r,n=new t){let o=await(await ye(e,r)).json();return n.add(o),n}static async fromFiles(e,r=new t){return await He(e,async n=>{let i=await n.read();r.add(i)}),r}add(e){Ns(e);let r=e.timestamp;for(let n of e.statements){n.timestamp=n.timestamp??r;let i=Date.parse(n.timestamp),o=n.vulnerability.name,s=It(n),c=new Set(n.products?.map(l=>l["@id"]).filter(l=>!!l)??[]),u=new jt(i,o,s,c,n);this.statements.push(u)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProducts.length)return this;let r=new t;return r.filteredToProducts=e.slice(0),r.statements=this.statements.filter(n=>n.matchesAtLeastOneProduct(e)),r}findNotMatchingVulnerabilities(e,r){let n=this.filterByProduct(r??this.filteredToProducts),i=new Set;for(let o of n.statements)i.add(o.vulnName);for(let o of e)i.delete(o);return Array.from(i)}newestVulnerabilityStatement(e,r){let n=this.filterByProduct(r??this.filteredToProducts);for(let i of n.statements)if(i.matchesVulnerability(e))return this.reduceToProductInformation(i,n.filteredToProducts[0])}toVexFileForProduct(e){let r=this.filterByProduct(e??this.filteredToProducts),n=r.statements.map(i=>this.reduceToProductInformation(i,r.filteredToProducts[0]));return this.toVexFile(n)}toVexFile(e){let r=e.filter(i=>i.status!=="under_investigation");if(r.length===0)return;this.sortVexStatementsByTimestampNewestFirst(r);let n=r[0].timestamp;return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:n,last_updated:n,version:1,statements:r}}assertCorrectProductId(e){if(!e||e.length===0)throw new Error("Product ID must be provided");if(this.filteredToProducts.length&&!Rs(this.filteredToProducts,e))throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){let n={timestamp:new Date(e.timestamp).toISOString(),...e.statement};if(!r)return n;let i=n.products?.filter(o=>o["@id"]===r);return i?.length||(i=[{"@id":r}]),{...n,products:i}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}sortVexStatementsByTimestampNewestFirst(e){e.sort((r,n)=>Date.parse(n.timestamp)-Date.parse(r.timestamp))}};function Rs(t,e){return t.length===e.length&&t.every((r,n)=>r===e[n])}var jt=class{constructor(e,r,n,i,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=n;this.products=i;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesAtLeastOneProduct(e){return e.some(this.matchesProduct.bind(this))}matchesVulnerability(e){return this.vulnAliases.has(e)}};function Ns(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}var Qe=require("path"),Hn=require("fs/promises");var Ye=class{constructor(e,r,n){this.project=e;this.outputDir=r;this.useSubDirForProject=n}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",n=`${this.project.name}-${this.project.version}-`,i=this.getFileSuffix(e),o=(0,Qe.resolve)(this.outputDir,r,`${n}${i}`),s=(0,Qe.dirname)(o);return await oe(s)||await(0,Hn.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};var Ft=require("zx");var Ke=require("path"),Yn="anchore/grype";async function Qn(t,e,r){r&&console.log(`Initializing Grype DB in cache directory: ${e}`);let n=`${Yn}:${t||"latest"}`,i=await Ft.$`docker run --rm -v '${e}:/tmp/.cache' -e GRYPE_DB_CACHE_DIR=/tmp/.cache -e TMPDIR=/tmp ${n} db update`.nothrow();if(i.stdout&&console.log(` Grype DB Update: ${i.stdout}`),i.stderr&&console.log(` Grype DB Update error: ${i.stderr}`),i.exitCode!==0)throw new Error(`Grype DB update failed with exit code ${i.exitCode}: ${i.stderr}`)}async function Kn(t,e,r,n,i,o,s){let c=(0,Ke.dirname)(r),u=(0,Ke.basename)(r),l=[];o||l.push("--quiet");let a=`${Yn}:${t||"latest"}`,f=`${e}:/tmp/.cache`,p=`${c}:/tmp/output`,m=`${n.sbomFile}:/tmp/input.json`,d=`/tmp/output/${u}`,y=await Ft.$`docker run --rm -v ${f} -v ${p} -v ${m} -e GRYPE_DB_CACHE_DIR=/tmp/.cache -e TMPDIR=/tmp -e GRYPE_DB_AUTO_UPDATE=false ${a} sbom:/tmp/input.json -o json --file ${d} --by-cve ${l}`.nothrow();if(y.stdout&&s(` Scan log: ${y.stdout}`),y.stderr&&s(` Scan error: ${y.stderr}`),y.exitCode!==0)throw new Error(`Grype scan failed with exit code ${y.exitCode}: ${y.stderr}`);s(` Grype output file: ${r}`);try{let h=await G(r);Vs(i,h)}catch(h){throw new Error(`Grype scan results could not be read from '${r}': ${h}`,{cause:h})}}function Vs(t,e){if(e)for(let r of e.matches){let n=As(r);t.addVulnerability(n,"grype")}}function As(t){let e=t.vulnerability,r=e.id,n=J(t.artifact.purl),i=J(e.dataSource),o=$s(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,componentPurls:[n],detectedBy:["grype"],refs:[i]}}function $s(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var zn=require("fs/promises");async function Zn(t,e,r,n,i,o){try{let s={},c="";r.user&&r.token&&(s.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,c="/authorized");let u=`https://ossindex.sonatype.org/api/v3${c}/component-report`,l=await _s(e.sbomFile),a=new Set(l.map(m=>m.purl.replace(/\?.*$/,"")));Js(a);let f=Array.from(a),p=[];for(let m=0;m<f.length;m+=128){let d=JSON.stringify({coordinates:f.slice(m,m+128)});i&&o(` Sonatype OssIndex request ${u} with body: ${d}`);let h=await(await fetch(u,{method:"POST",headers:{...s,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:d})).json();Array.isArray(h)?p.push(...h.filter(w=>w.vulnerabilities.length>0)):o(` Sonatype OssIndex Error: ${h.code} - ${h.message}`)}await(0,zn.writeFile)(t,JSON.stringify(p,null,2)),o(` Sonatype OssIndex output file: ${t}`),Us(n,p)}catch(s){throw new Error(`Sonatype OSS Index scan failed: ${s}`,{cause:s})}}async function _s(t){return(await G(t)).components.filter(r=>qs(r)&&!Bs(r))}function qs(t){return!!t.purl}function Bs(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function Us(t,e){if(e)for(let r of e)for(let n of r.vulnerabilities){let i=Xs(n,r.coordinates);t.addVulnerability(i,"ossindex")}}function Xs(t,e){let r=t.cve||t.id,n=J(e),i=J(t.reference),o=Gs(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,componentPurls:[n],detectedBy:["ossindex"],refs:i?[i]:[]}}function Gs(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function Js(t){let e=Array.from(t);for(let r of e){let n=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(n)}}var Mt=require("zx");var ze=require("path"),ei="aquasec/trivy";async function ti(t,e,r,n){let i=[];r&&(i.push("-e"),i.push(`GITHUB_TOKEN=${r}`));let o=[];o.push("--db-repository"),o.push("public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db"),n||o.push("--quiet");let s=`${ei}:${t||"latest"}`,c=await Mt.$`docker run --rm -v '${e}:/.cache' ${i} ${s} ${o} --cache-dir '/.cache' sbom --download-db-only`.nothrow();if(!c.stdout&&!c.stderr&&console.log(" Trivy DB Update: finished"),c.stdout&&console.log(` Trivy DB Update: ${c.stdout}`),c.stderr&&console.log(` Trivy DB Update error: ${c.stderr}`),c.exitCode!==0)throw new Error(`Trivy DB update failed with exit code ${c.exitCode}: ${c.stderr}`)}async function ri(t,e,r,n,i,o,s){let c=(0,ze.dirname)(r),u=(0,ze.basename)(r),l=[];o||l.push("--quiet");let a=`${ei}:${t||"latest"}`,f=`${e}:/.cache`,p=`${c}:/tmp/output`,m=`${n.sbomFile}:/tmp/input.json`,d=`/tmp/output/${u}`,y=await Mt.$`docker run --rm -v ${f} -v ${p} -v ${m} ${a} sbom --cache-dir '/.cache' --format json --output ${d} ${l} --skip-db-update /tmp/input.json`.nothrow();if(y.stdout&&s(` Scan log: ${y.stdout}`),y.stderr&&s(` Scan error: ${y.stderr}`),y.exitCode!==0)throw new Error(`Trivy scan failed with exit code ${y.exitCode}: ${y.stderr}`);s(` Trivy output file: ${r}`);try{let h=await G(r);Ws(i,h)}catch(h){throw new Error(`Trivy scan results could not be read from '${r}': ${h}`,{cause:h})}}function Ws(t,e){if(e){for(let r of e.Results??[])if(r.Vulnerabilities)for(let n of r.Vulnerabilities){let i=Hs(n);t.addVulnerability(i,"trivy")}}}function Hs(t){let e=t.VulnerabilityID,r=J(t.PkgIdentifier.PURL),n=J(t.PrimaryURL),i=Ys(t.Severity);return{id:e,severity:i,scannerSeverity:{trivy:i},title:t.Title,description:t.Description,componentPurls:[r],detectedBy:["trivy"],refs:[n]}}function Ys(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var Ze=class{constructor(e,r,n){this.scanners=e;this.cacheDir=r;this.options=n}async init(e){let r=[];for(let n of this.scanners)switch(n.name){case"grype":r.push(Qn(n.version,this.cacheDir,e));break;case"trivy":r.push(ti(n.version,this.cacheDir,this.options.trivyGithubToken,e));break;case"ossindex":continue}await Promise.all(r)}async scanProject(e,r,n,i,o){let s=[];for(let c of this.scanners)s.push(this.scanProjectBy(c,e,r,this.cacheDir,n,this.options.ossIndexApiUser,this.options.ossIndexApiToken,i,o));await Promise.all(s)}async scanProjectBy(e,r,n,i,o,s,c,u,l){switch(e.name){case"grype":return Kn(e.version,i,await n.lookupOutputFileForWriting("grype-results"),r,o,u,l);case"trivy":return ri(e.version,i,await n.lookupOutputFileForWriting("trivy-results"),r,o,u,l);case"ossindex":return Zn(await n.lookupOutputFileForWriting("ossindex-results"),r,{user:s,token:c},o,u,l)}}};async function ni(t,e,r){await He(t,async n=>{let i=await n.read(),o=!1,s=i.statements,c=[];for(let u of s){if(r&&!It(u).has(r)||!u.products)continue;let l=u.products.findIndex(a=>a["@id"]===e);l!==-1&&(u.products.splice(l,1),o=!0,u.products.length===0&&c.push(u))}if(o){for(let u of c){let l=s.indexOf(u);s.splice(l,1)}if(s.length===0){console.info(`Remove ${e} from ${n.location} and delete file.`),await n.delete();return}console.info(`Remove ${e} from ${n.location}`),await n.write(i)}})}var ke=require("fs/promises"),Rt=require("path");async function oi(t,e){let{orderBy:r,reportNoLongerDetectedVulnerabilities:n,reportCveDetails:i,outputDirectory:o}={orderBy:"CVE",reportNoLongerDetectedVulnerabilities:!0,reportCveDetails:!1,...e},s=!1,c=!1,u=!1,l=new Map,a=new Map,f=new Map,p=new Map,m=new Map,d=[];for(let x of t.values()){let D=x.project,A=`${D.name}@${D.version}`;if(x.error&&(s=!0,d.push({project:A,error:x.error})),D.silent)continue;let Ee=X[D.minimumSeverity],rt=x.newVulns.filter(T=>Ee<=X[T.severity]);for(let T of rt){if(c=!0,!l.has(T.id))l.set(T.id,T);else{let S=l.get(T.id);ea(S,T)}a.has(T.id)||a.set(T.id,[]),p.has(A)||p.set(A,[]),p.get(A).push(T.id),a.get(T.id).push(A)}for(let T of x.noLongerDetectedVulns)u=!0,f.has(T)||f.set(T,[]),m.has(A)||m.set(A,[]),m.get(A).push(T),f.get(T).push(A)}let y;o&&(y=(0,Rt.join)(o,"scan-summary.txt"),await(0,ke.writeFile)(y,"","utf8"));let h=async x=>{console.log(x),y&&await(0,ke.appendFile)(y,x+`
33
- `,"utf8")};switch(await h("=== Scan summary ==="),d.length&&await Qs(h,d),i&&await Zs(h,l),r){case"CVE":{await zs(h,a,l,n?f:new Map);break}case"PROJECT":{await Ks(h,p,n?m:new Map,l);break}}!s&&!c&&(!u||!n)&&await h(" No issues found");let w={errors:d,vulnerabilities:Object.fromEntries(l),vulnerabilityToProject:Object.fromEntries(a.entries()),projectToVulnerability:Object.fromEntries(p.entries()),noLongerDetectedVulnerabilities:Object.fromEntries(f)};if(o){let x=(0,Rt.join)(o,"scan-summary.json");await(0,ke.writeFile)(x,JSON.stringify(w,null,2),"utf8")}return{hasError:s,hasNewVuln:c,hasNoLongerDetectedVuln:u}}async function Qs(t,e){await t(""),await t("- Errors during scan:");for(let{project:r,error:n}of e)await t(` - ${r}:`),await t(` Error: ${n}`)}async function Ks(t,e,r,n){let i=new Set([...Array.from(e.keys()),...Array.from(r.keys())]),o=Array.from(i.keys()).sort();if(o.length){await t(""),await t("- Vulnerabilities by project:");for(let s of o){await t(` - ${s}:`);let c=e.get(s)??[];for(let l of c.slice().sort(Nt(a=>n.get(a).severity))){let{severity:a}=n.get(l);await t(` - [${a}] ${l}`)}let u=(r.get(s)??[]).slice().sort();for(let l of u)await t(` - ${l} (no longer detected)`)}}}async function zs(t,e,r,n){let i=Array.from(e.keys()).sort(Nt(s=>r.get(s).severity));if(i.length){await t(""),await t("- New vulnerabilities:");for(let s of i){let c=e.get(s),{severity:u}=r.get(s);await t(` - [${u}] ${s}`);for(let l of c.slice().sort())await t(` - ${l}`)}}let o=Array.from(n.keys()).sort();if(o.length){await t(""),await t("- Declared but no longer detected vulnerabilities:");for(let s of o){let c=n.get(s);await t(` - ${s}`);for(let u of c.slice().sort())await t(` - ${u}`)}}}async function Zs(t,e){if(e.size===0)return;await t(""),await t("- Vulnerability details:");let r=Array.from(e.keys()).sort(Nt(n=>e.get(n).severity));for(let n of r){let i=e.get(n);if(await t(` - [${i.severity}] ${i.id} - ${i.title||""}:`),i.description){await t(" Description:");let o=i.description.split(/\r?\n/);for(let s of o)await t(` ${s}`)}if(i.components.length){await t(" Dependencies:");for(let o of i.components)await t(Le(o," "))}if(i.refs.length){await t(" Links:");for(let o of i.refs)await t(` - ${o}`)}}}function ea(t,e){t.title=t.title||e.title,t.severity=X[t.severity]>X[e.severity]?t.severity:e.severity,t.description=t.description||e.description,t.components=ii(t.components,e.components),t.refs=ii(t.refs,e.refs)}function ii(t,e){let r=new Set([...t,...e]);return Array.from(r)}function Nt(t){return(e,r)=>{let n=t(e),i=t(r),o=X[n],s=X[i];return o!==s?o>s?-1:1:e.localeCompare(r)}}et.os.type().startsWith("Windows")&&(0,et.usePowerShell)();async function si(t){let e=await lt(t),r=e.cacheDir;await oe(r)||await(0,ce.mkdir)(r);let n=e.outDir;await oe(n)&&await at(n),await(0,ce.mkdir)(n);let i=await ia(e,{user:t.vexUrlsUser,pw:t.vexUrlsPw}),o=new Ge(e.mavenRepo,{user:t.mavenRepoUser,pw:t.mavenRepoPw}),s=oa(e,t,r),c=Date.now();console.log("Initializing scanner engines ..."),await s.init(t.verbose),console.log(`Scanner engines initialization took ${Date.now()-c}ms
34
- `);let u=sa(t),l=e.projects,a=new Map,f=Date.now();console.log("Scanning projects ...");let p=l.filter(u).map(d=>{let y=new Ye(d,n,e.createSubDirsForProject),h=[],w=D=>{h.push(D)};return{scan(){return ta(d,y,o,s,i,w,a,t,h)}}});await ca(p),console.log(`Scanning took ${Date.now()-f}ms`),t.autoRemoveUnusedStatements&&await aa(a,e.vexDir);let m=await oi(a,{orderBy:e.consoleReport.startsWith("BY_CVE")?"CVE":"PROJECT",reportCveDetails:e.consoleReport.endsWith("_DETAILED"),reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities,outputDirectory:n});if(m.hasError)return 1;if(m.hasNewVuln){if(e.onNewVulnerabilities==="fail")return 1;e.onNewVulnerabilities==="warn"&&(console.log("##vso[task.logissue type=warning;]NEW_VULNERABILITIES_DETECTED"),console.log("##vso[task.complete result=SucceededWithIssues;]"))}if(m.hasNoLongerDetectedVuln){if(e.onNoLongerDetectedVulnerabilities==="fail")return 1;e.onNoLongerDetectedVulnerabilities==="warn"&&(console.log("##vso[task.logissue type=warning;]NO_LONGER_DETECTED_VULNERABILITIES"),console.log("##vso[task.complete result=SucceededWithIssues;]"))}return 0}async function ta(t,e,r,n,i,o,s,c,u){try{let{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}=await ra(t,e,r,n,i,c.verbose,o);s.set(t.purl,{project:t,newVulns:l,noLongerDetectedVulns:a})}catch(l){let a=l;s.set(t.purl,{project:t,error:`${a}`,newVulns:[],noLongerDetectedVulns:[]})}if(c.verbose)for(let l of u)console.log(l)}async function ra(t,e,r,n,i,o,s){let c=await Wn(t,await e.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),r);s(`Analyzing project: ${c.name} - ${c.version} - ${c.sbomFile}`);let u=await G(c.sbomFile),l=new De(Xe.createForSbom(u));await n.scanProject(c,e,l,o,s);let a=i.filterByProduct([c.purl,...c.purlAliases]),{unmatchedVulnerabilities:f}=l.enhanceWithVexData(a),p=c.detectNoLongerUsedVulnerabilities?a.findNotMatchingVulnerabilities(l.getAllVulnIds()):[];return await na(e,c,l,a,s),{unmatchedVulnerabilities:f,noLongerDetectedVulnerabilities:p}}async function na(t,e,r,n,i){let o=r.getAllVulnerabilitiesSortedBySeverity(),s=await t.lookupOutputFileForWriting("aggregate-results");await(0,ce.writeFile)(s,JSON.stringify(o.map(f=>{let p={...f,componentPurls:void 0,components:void 0};return p.components=f.componentPurls,delete p.componentPurls,p}),null,2)),i(` Vulnerabilities output file: ${s}`);let c=await t.lookupOutputFileForWriting("aggregated-sarif-results"),u=Jn(o,e);await(0,ce.writeFile)(c,JSON.stringify(u,null,2)),i(` Vuln Sarif output file: ${c}`);let l=n.toVexFile(o.filter(f=>f.vexStatement).map(f=>{let p=f.vexStatement;for(let m of f.componentPurls??[])p.products.push({"@id":m});return p}));if(!l)return;let a=await t.lookupOutputFileForWriting("project-openvex-file");await(0,ce.writeFile)(a,JSON.stringify(l,null,2)),i(` OpenVex file: ${a}`)}async function ia(t,e){let r=t.vexDir,n;await oe(r)?n=await de.fromFiles(r):n=new de;for(let i of t.vexUrls)await de.fromUrl(i,e,n);return n}function oa(t,e,r){if(e.scannerEngine)return e.scannerEngine;if(t.scanners.length===0)throw new Error("No scanners configured");return new Ze(t.scanners,r,e)}function sa(t){let{reduceToProjectName:e,reduceToProjectVersion:r}=t;return n=>!(!n.enabled||e&&(n.name!==e||r&&n.version!==r))}async function aa(t,e){for(let r of t.values())if(!r.project.silent)for(let n of r.noLongerDetectedVulns)await ni(e,r.project.purl,n)}async function ca(t,e=5){let r=0,n=0,i=0,o=t.length,s,c=new Promise(l=>{s=l});function u(){for(;r<e&&i<o;){let l=t[i++];r++,l.scan().finally(()=>{r--,n++,n>=o?s():u()})}}u(),await c}var ai=require("zx");ai.dotenv.config();var z=process.env;(async()=>{let t=await si({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:z.OSS_INDEX_API_USER,ossIndexApiToken:z.OSS_INDEX_API_TOKEN,mavenRepoUser:z.MAVEN_REPO_USER,mavenRepoPw:z.MAVEN_REPO_PW,trivyGithubToken:z.TRIVY_GITHUB_TOKEN,vexUrlsUser:z.VEX_URLS_USER,vexUrlsPw:z.VEX_URLS_PW,verbose:z.VERBOSE==="true",autoRemoveUnusedStatements:z.AUTO_REMOVE_UNUSED_STATEMENTS==="true"});process.exitCode=t})();
32
+ <details><summary>Tree</summary>
33
+ <p>
34
+ \`\`\`plain
35
+ ${t.componentTree?.map(o=>Pe(o)).join(`
36
+ `)}
37
+ \`\`\`
38
+ </p>
39
+ </details>
40
+ `}var Je=require("fs/promises");async function Wn(t,e,r){if("sbomFile"in t)return await(0,Je.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let n=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Je.writeFile)(e,n),{...t,sbomFile:e}}var Ge=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let n=this.toArtifactUrl(r),i=await ye(n,this.authn);return Buffer.from(await i.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,i=await(await ye(r,this.authn)).text();return Ms(i,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),n=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${n}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function Ms(t,e){if(e.classifier&&e.extension){let i=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(i?.[1])return i[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),n=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!n)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${n[1]}`}var We=require("fs/promises"),Tt=require("path");var Ct=class{constructor(e){this.location=e}async read(){let e=await G(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await st(this.location,e)}async delete(){await(0,We.unlink)(this.location)}};async function He(t,e){for(let r of await(0,We.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new Ct((0,Tt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await He((0,Tt.resolve)(r.parentPath,r.name),e)}function It(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var de=class t{statements=[];filteredToProducts=[];static async fromUrl(e,r,n=new t){let o=await(await ye(e,r)).json();return n.add(o),n}static async fromFiles(e,r=new t){return await He(e,async n=>{let i=await n.read();r.add(i)}),r}add(e){Rs(e);let r=e.timestamp;for(let n of e.statements){n.timestamp=n.timestamp??r;let i=Date.parse(n.timestamp),o=n.vulnerability.name,s=It(n),c=new Set(n.products?.map(l=>l["@id"]).filter(l=>!!l)??[]),u=new jt(i,o,s,c,n);this.statements.push(u)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProducts.length)return this;let r=new t;return r.filteredToProducts=e.slice(0),r.statements=this.statements.filter(n=>n.matchesAtLeastOneProduct(e)),r}findNotMatchingVulnerabilities(e,r){let n=this.filterByProduct(r??this.filteredToProducts),i=new Set;for(let o of n.statements)i.add(o.vulnName);for(let o of e)i.delete(o);return Array.from(i)}newestVulnerabilityStatement(e,r){let n=this.filterByProduct(r??this.filteredToProducts);for(let i of n.statements)if(i.matchesVulnerability(e))return this.reduceToProductInformation(i,n.filteredToProducts[0])}toVexFileForProduct(e){let r=this.filterByProduct(e??this.filteredToProducts),n=r.statements.map(i=>this.reduceToProductInformation(i,r.filteredToProducts[0]));return this.toVexFile(n)}toVexFile(e){let r=e.filter(i=>i.status!=="under_investigation");if(r.length===0)return;this.sortVexStatementsByTimestampNewestFirst(r);let n=r[0].timestamp;return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:n,last_updated:n,version:1,statements:r}}assertCorrectProductId(e){if(!e||e.length===0)throw new Error("Product ID must be provided");if(this.filteredToProducts.length&&!Ns(this.filteredToProducts,e))throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){let n={timestamp:new Date(e.timestamp).toISOString(),...e.statement};if(!r)return n;let i=n.products?.filter(o=>o["@id"]===r);return i?.length||(i=[{"@id":r}]),{...n,products:i}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}sortVexStatementsByTimestampNewestFirst(e){e.sort((r,n)=>Date.parse(n.timestamp)-Date.parse(r.timestamp))}};function Ns(t,e){return t.length===e.length&&t.every((r,n)=>r===e[n])}var jt=class{constructor(e,r,n,i,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=n;this.products=i;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesAtLeastOneProduct(e){return e.some(this.matchesProduct.bind(this))}matchesVulnerability(e){return this.vulnAliases.has(e)}};function Rs(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}var Qe=require("path"),Hn=require("fs/promises");var Ye=class{constructor(e,r,n){this.project=e;this.outputDir=r;this.useSubDirForProject=n}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",n=`${this.project.name}-${this.project.version}-`,i=this.getFileSuffix(e),o=(0,Qe.resolve)(this.outputDir,r,`${n}${i}`),s=(0,Qe.dirname)(o);return await oe(s)||await(0,Hn.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};var Ft=require("zx");var Ke=require("path"),Yn="anchore/grype";async function Qn(t,e,r){r&&console.log(`Initializing Grype DB in cache directory: ${e}`);let n=`${Yn}:${t||"latest"}`,i=await Ft.$`docker run --rm -v '${e}:/tmp/.cache' -e GRYPE_DB_CACHE_DIR=/tmp/.cache -e TMPDIR=/tmp ${n} db update`.nothrow();if(i.stdout&&console.log(` Grype DB Update: ${i.stdout}`),i.stderr&&console.log(` Grype DB Update error: ${i.stderr}`),i.exitCode!==0)throw new Error(`Grype DB update failed with exit code ${i.exitCode}: ${i.stderr}`)}async function Kn(t,e,r,n,i,o,s){let c=(0,Ke.dirname)(r),u=(0,Ke.basename)(r),l=[];o||l.push("--quiet");let a=`${Yn}:${t||"latest"}`,f=`${e}:/tmp/.cache`,p=`${c}:/tmp/output`,m=`${n.sbomFile}:/tmp/input.json`,d=`/tmp/output/${u}`,y=await Ft.$`docker run --rm -v ${f} -v ${p} -v ${m} -e GRYPE_DB_CACHE_DIR=/tmp/.cache -e TMPDIR=/tmp -e GRYPE_DB_AUTO_UPDATE=false ${a} sbom:/tmp/input.json -o json --file ${d} --by-cve ${l}`.nothrow();if(y.stdout&&s(` Scan log: ${y.stdout}`),y.stderr&&s(` Scan error: ${y.stderr}`),y.exitCode!==0)throw new Error(`Grype scan failed with exit code ${y.exitCode}: ${y.stderr}`);s(` Grype output file: ${r}`);try{let h=await G(r);Vs(i,h)}catch(h){throw new Error(`Grype scan results could not be read from '${r}': ${h}`,{cause:h})}}function Vs(t,e){if(e)for(let r of e.matches){let n=As(r);t.addVulnerability(n,"grype")}}function As(t){let e=t.vulnerability,r=e.id,n=J(t.artifact.purl),i=J(e.dataSource),o=$s(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[n],detectedBy:["grype"],refs:[i]}}function $s(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var zn=require("fs/promises");async function Zn(t,e,r,n,i,o){try{let s={},c="";r.user&&r.token&&(s.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,c="/authorized");let u=`https://ossindex.sonatype.org/api/v3${c}/component-report`,l=await _s(e.sbomFile),a=new Set(l.map(m=>m.purl.replace(/\?.*$/,"")));Js(a);let f=Array.from(a),p=[];for(let m=0;m<f.length;m+=128){let d=JSON.stringify({coordinates:f.slice(m,m+128)});i&&o(` Sonatype OssIndex request ${u} with body: ${d}`);let h=await(await fetch(u,{method:"POST",headers:{...s,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:d})).json();Array.isArray(h)?p.push(...h.filter(w=>w.vulnerabilities.length>0)):o(` Sonatype OssIndex Error: ${h.code} - ${h.message}`)}await(0,zn.writeFile)(t,JSON.stringify(p,null,2)),o(` Sonatype OssIndex output file: ${t}`),Us(n,p)}catch(s){throw new Error(`Sonatype OSS Index scan failed: ${s}`,{cause:s})}}async function _s(t){return(await G(t)).components.filter(r=>qs(r)&&!Bs(r))}function qs(t){return!!t.purl}function Bs(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function Us(t,e){if(e)for(let r of e)for(let n of r.vulnerabilities){let i=Xs(n,r.coordinates);t.addVulnerability(i,"ossindex")}}function Xs(t,e){let r=t.cve||t.id,n=J(e),i=J(t.reference),o=Gs(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[n],detectedBy:["ossindex"],refs:i?[i]:[]}}function Gs(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function Js(t){let e=Array.from(t);for(let r of e){let n=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(n)}}var Mt=require("zx");var ze=require("path"),ei="aquasec/trivy";async function ti(t,e,r,n){let i=[];r&&(i.push("-e"),i.push(`GITHUB_TOKEN=${r}`));let o=[];o.push("--db-repository"),o.push("public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db"),n||o.push("--quiet");let s=`${ei}:${t||"latest"}`,c=await Mt.$`docker run --rm -v '${e}:/.cache' ${i} ${s} ${o} --cache-dir '/.cache' sbom --download-db-only`.nothrow();if(!c.stdout&&!c.stderr&&console.log(" Trivy DB Update: finished"),c.stdout&&console.log(` Trivy DB Update: ${c.stdout}`),c.stderr&&console.log(` Trivy DB Update error: ${c.stderr}`),c.exitCode!==0)throw new Error(`Trivy DB update failed with exit code ${c.exitCode}: ${c.stderr}`)}async function ri(t,e,r,n,i,o,s){let c=(0,ze.dirname)(r),u=(0,ze.basename)(r),l=[];o||l.push("--quiet");let a=`${ei}:${t||"latest"}`,f=`${e}:/.cache`,p=`${c}:/tmp/output`,m=`${n.sbomFile}:/tmp/input.json`,d=`/tmp/output/${u}`,y=await Mt.$`docker run --rm -v ${f} -v ${p} -v ${m} ${a} sbom --cache-dir '/.cache' --format json --output ${d} ${l} --skip-db-update /tmp/input.json`.nothrow();if(y.stdout&&s(` Scan log: ${y.stdout}`),y.stderr&&s(` Scan error: ${y.stderr}`),y.exitCode!==0)throw new Error(`Trivy scan failed with exit code ${y.exitCode}: ${y.stderr}`);s(` Trivy output file: ${r}`);try{let h=await G(r);Ws(i,h)}catch(h){throw new Error(`Trivy scan results could not be read from '${r}': ${h}`,{cause:h})}}function Ws(t,e){if(e){for(let r of e.Results??[])if(r.Vulnerabilities)for(let n of r.Vulnerabilities){let i=Hs(n);t.addVulnerability(i,"trivy")}}}function Hs(t){let e=t.VulnerabilityID,r=J(t.PkgIdentifier.PURL),n=J(t.PrimaryURL),i=Ys(t.Severity);return{id:e,severity:i,scannerSeverity:{trivy:i},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[n]}}function Ys(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var Ze=class{constructor(e,r,n){this.scanners=e;this.cacheDir=r;this.options=n}async init(e){let r=[];for(let n of this.scanners)switch(n.name){case"grype":r.push(Qn(n.version,this.cacheDir,e));break;case"trivy":r.push(ti(n.version,this.cacheDir,this.options.trivyGithubToken,e));break;case"ossindex":continue}await Promise.all(r)}async scanProject(e,r,n,i,o){let s=[];for(let c of this.scanners)s.push(this.scanProjectBy(c,e,r,this.cacheDir,n,this.options.ossIndexApiUser,this.options.ossIndexApiToken,i,o));await Promise.all(s)}async scanProjectBy(e,r,n,i,o,s,c,u,l){switch(e.name){case"grype":return Kn(e.version,i,await n.lookupOutputFileForWriting("grype-results"),r,o,u,l);case"trivy":return ri(e.version,i,await n.lookupOutputFileForWriting("trivy-results"),r,o,u,l);case"ossindex":return Zn(await n.lookupOutputFileForWriting("ossindex-results"),r,{user:s,token:c},o,u,l)}}};async function ni(t,e,r){await He(t,async n=>{let i=await n.read(),o=!1,s=i.statements,c=[];for(let u of s){if(r&&!It(u).has(r)||!u.products)continue;let l=u.products.findIndex(a=>a["@id"]===e);l!==-1&&(u.products.splice(l,1),o=!0,u.products.length===0&&c.push(u))}if(o){for(let u of c){let l=s.indexOf(u);s.splice(l,1)}if(s.length===0){console.info(`Remove ${e} from ${n.location} and delete file.`),await n.delete();return}console.info(`Remove ${e} from ${n.location}`),await n.write(i)}})}var ke=require("fs/promises"),Nt=require("path");async function oi(t,e){let{orderBy:r,reportNoLongerDetectedVulnerabilities:n,reportCveDetails:i,outputDirectory:o}={orderBy:"CVE",reportNoLongerDetectedVulnerabilities:!0,reportCveDetails:!1,...e},s=!1,c=!1,u=!1,l=new Map,a=new Map,f=new Map,p=new Map,m=new Map,d=[];for(let x of t.values()){let D=x.project,A=`${D.name}@${D.version}`;if(x.error&&(s=!0,d.push({project:A,error:x.error})),D.silent)continue;let Ee=X[D.minimumSeverity],rt=x.newVulns.filter(T=>Ee<=X[T.severity]);for(let T of rt){if(c=!0,!l.has(T.id))l.set(T.id,T);else{let S=l.get(T.id);ea(S,T)}a.has(T.id)||a.set(T.id,[]),p.has(A)||p.set(A,[]),p.get(A).push(T.id),a.get(T.id).push(A)}for(let T of x.noLongerDetectedVulns)u=!0,f.has(T)||f.set(T,[]),m.has(A)||m.set(A,[]),m.get(A).push(T),f.get(T).push(A)}let y;o&&(y=(0,Nt.join)(o,"scan-summary.txt"),await(0,ke.writeFile)(y,"","utf8"));let h=async x=>{console.log(x),y&&await(0,ke.appendFile)(y,x+`
41
+ `,"utf8")};switch(await h("=== Scan summary ==="),d.length&&await Qs(h,d),i&&await Zs(h,l),r){case"CVE":{await zs(h,a,l,n?f:new Map);break}case"PROJECT":{await Ks(h,p,n?m:new Map,l);break}}!s&&!c&&(!u||!n)&&await h(" No issues found");let w={errors:d,vulnerabilities:Object.fromEntries(l),vulnerabilityToProject:Object.fromEntries(a.entries()),projectToVulnerability:Object.fromEntries(p.entries()),noLongerDetectedVulnerabilities:Object.fromEntries(f)};if(o){let x=(0,Nt.join)(o,"scan-summary.json");await(0,ke.writeFile)(x,JSON.stringify(w,null,2),"utf8")}return{hasError:s,hasNewVuln:c,hasNoLongerDetectedVuln:u}}async function Qs(t,e){await t(""),await t("- Errors during scan:");for(let{project:r,error:n}of e)await t(` - ${r}:`),await t(` Error: ${n}`)}async function Ks(t,e,r,n){let i=new Set([...Array.from(e.keys()),...Array.from(r.keys())]),o=Array.from(i.keys()).sort();if(o.length){await t(""),await t("- Vulnerabilities by project:");for(let s of o){await t(` - ${s}:`);let c=e.get(s)??[];for(let l of c.slice().sort(Rt(a=>n.get(a).severity))){let{severity:a}=n.get(l);await t(` - [${a}] ${l}`)}let u=(r.get(s)??[]).slice().sort();for(let l of u)await t(` - ${l} (no longer detected)`)}}}async function zs(t,e,r,n){let i=Array.from(e.keys()).sort(Rt(s=>r.get(s).severity));if(i.length){await t(""),await t("- New vulnerabilities:");for(let s of i){let c=e.get(s),{severity:u}=r.get(s);await t(` - [${u}] ${s}`);for(let l of c.slice().sort())await t(` - ${l}`)}}let o=Array.from(n.keys()).sort();if(o.length){await t(""),await t("- Declared but no longer detected vulnerabilities:");for(let s of o){let c=n.get(s);await t(` - ${s}`);for(let u of c.slice().sort())await t(` - ${u}`)}}}async function Zs(t,e){if(e.size===0)return;await t(""),await t("- Vulnerability details:");let r=Array.from(e.keys()).sort(Rt(n=>e.get(n).severity));for(let n of r){let i=e.get(n);if(await t(` - [${i.severity}] ${i.id} - ${i.title||""}:`),i.description){await t(" Description:");let o=i.description.split(/\r?\n/);for(let s of o)await t(` ${s}`)}if(i.components.length){await t(" Components:");for(let o of i.components)await t(" - "+o);if(i.componentTree){await t(" Usage Tree:");for(let o of i.componentTree)await t(Pe(o," "))}}if(i.refs.length){await t(" Links:");for(let o of i.refs)await t(` - ${o}`)}}}function ea(t,e){t.title=t.title||e.title,t.severity=X[t.severity]>X[e.severity]?t.severity:e.severity,t.description=t.description||e.description,t.components=ii(t.components,e.components),t.refs=ii(t.refs,e.refs)}function ii(t,e){let r=new Set([...t,...e]);return Array.from(r)}function Rt(t){return(e,r)=>{let n=t(e),i=t(r),o=X[n],s=X[i];return o!==s?o>s?-1:1:e.localeCompare(r)}}et.os.type().startsWith("Windows")&&(0,et.usePowerShell)();async function si(t){let e=await lt(t),r=e.cacheDir;await oe(r)||await(0,ce.mkdir)(r);let n=e.outDir;await oe(n)&&await at(n),await(0,ce.mkdir)(n);let i=await ia(e,{user:t.vexUrlsUser,pw:t.vexUrlsPw}),o=new Ge(e.mavenRepo,{user:t.mavenRepoUser,pw:t.mavenRepoPw}),s=oa(e,t,r),c=Date.now();console.log("Initializing scanner engines ..."),await s.init(t.verbose),console.log(`Scanner engines initialization took ${Date.now()-c}ms
42
+ `);let u=sa(t),l=e.projects,a=new Map,f=Date.now();console.log("Scanning projects ...");let p=l.filter(u).map(d=>{let y=new Ye(d,n,e.createSubDirsForProject),h=[],w=D=>{h.push(D)};return{scan(){return ta(d,y,o,s,i,w,a,t,h)}}});await ca(p),console.log(`Scanning took ${Date.now()-f}ms`),t.autoRemoveUnusedStatements&&await aa(a,e.vexDir);let m=await oi(a,{orderBy:e.consoleReport.startsWith("BY_CVE")?"CVE":"PROJECT",reportCveDetails:e.consoleReport.endsWith("_DETAILED"),reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities,outputDirectory:n});if(m.hasError)return 1;if(m.hasNewVuln){if(e.onNewVulnerabilities==="fail")return 1;e.onNewVulnerabilities==="warn"&&(console.log("##vso[task.logissue type=warning;]NEW_VULNERABILITIES_DETECTED"),console.log("##vso[task.complete result=SucceededWithIssues;]"))}if(m.hasNoLongerDetectedVuln){if(e.onNoLongerDetectedVulnerabilities==="fail")return 1;e.onNoLongerDetectedVulnerabilities==="warn"&&(console.log("##vso[task.logissue type=warning;]NO_LONGER_DETECTED_VULNERABILITIES"),console.log("##vso[task.complete result=SucceededWithIssues;]"))}return 0}async function ta(t,e,r,n,i,o,s,c,u){try{let{unmatchedVulnerabilities:l,noLongerDetectedVulnerabilities:a}=await ra(t,e,r,n,i,c.verbose,o);s.set(t.purl,{project:t,newVulns:l,noLongerDetectedVulns:a})}catch(l){let a=l;s.set(t.purl,{project:t,error:`${a}`,newVulns:[],noLongerDetectedVulns:[]})}if(c.verbose)for(let l of u)console.log(l)}async function ra(t,e,r,n,i,o,s){let c=await Wn(t,await e.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),r);s(`Analyzing project: ${c.name} - ${c.version} - ${c.sbomFile}`);let u=await G(c.sbomFile),l=new De(Xe.createForSbom(u));await n.scanProject(c,e,l,o,s);let a=i.filterByProduct([c.purl,...c.purlAliases]),{unmatchedVulnerabilities:f}=l.enhanceWithVexData(a),p=c.detectNoLongerUsedVulnerabilities?a.findNotMatchingVulnerabilities(l.getAllVulnIds()):[];return await na(e,c,l,a,s),{unmatchedVulnerabilities:f,noLongerDetectedVulnerabilities:p}}async function na(t,e,r,n,i){let o=r.getAllVulnerabilitiesSortedBySeverity(),s=await t.lookupOutputFileForWriting("aggregate-results");await(0,ce.writeFile)(s,JSON.stringify(o,null,2)),i(` Vulnerabilities output file: ${s}`);let c=await t.lookupOutputFileForWriting("aggregated-sarif-results"),u=Jn(o,e);await(0,ce.writeFile)(c,JSON.stringify(u,null,2)),i(` Vuln Sarif output file: ${c}`);let l=n.toVexFile(o.filter(f=>f.vexStatement).map(f=>{let p=f.vexStatement;for(let m of f.components??[])p.products.push({"@id":m});return p}));if(!l)return;let a=await t.lookupOutputFileForWriting("project-openvex-file");await(0,ce.writeFile)(a,JSON.stringify(l,null,2)),i(` OpenVex file: ${a}`)}async function ia(t,e){let r=t.vexDir,n;await oe(r)?n=await de.fromFiles(r):n=new de;for(let i of t.vexUrls)await de.fromUrl(i,e,n);return n}function oa(t,e,r){if(e.scannerEngine)return e.scannerEngine;if(t.scanners.length===0)throw new Error("No scanners configured");return new Ze(t.scanners,r,e)}function sa(t){let{reduceToProjectName:e,reduceToProjectVersion:r}=t;return n=>!(!n.enabled||e&&(n.name!==e||r&&n.version!==r))}async function aa(t,e){for(let r of t.values())if(!r.project.silent)for(let n of r.noLongerDetectedVulns)await ni(e,r.project.purl,n)}async function ca(t,e=5){let r=0,n=0,i=0,o=t.length,s,c=new Promise(l=>{s=l});function u(){for(;r<e&&i<o;){let l=t[i++];r++,l.scan().finally(()=>{r--,n++,n>=o?s():u()})}}u(),await c}var ai=require("zx");ai.dotenv.config();var z=process.env;(async()=>{let t=await si({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:z.OSS_INDEX_API_USER,ossIndexApiToken:z.OSS_INDEX_API_TOKEN,mavenRepoUser:z.MAVEN_REPO_USER,mavenRepoPw:z.MAVEN_REPO_PW,trivyGithubToken:z.TRIVY_GITHUB_TOKEN,vexUrlsUser:z.VEX_URLS_USER,vexUrlsPw:z.VEX_URLS_PW,verbose:z.VERBOSE==="true",autoRemoveUnusedStatements:z.AUTO_REMOVE_UNUSED_STATEMENTS==="true"});process.exitCode=t})();
35
43
  /*! Bundled license information:
36
44
 
37
45
  escape-html/index.js:
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@conterra/vuln-scan",
3
- "version": "0.0.30",
3
+ "version": "0.0.31",
4
4
  "description": "con terra vulnerability scan process",
5
5
  "author": "con terra GmbH",
6
6
  "license": "Apache-2.0",