npm - @conterra/vuln-scan - Versions diffs - 1.0.12 → 1.0.14 - Mend

@conterra/vuln-scan 1.0.12 → 1.0.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/README.md +99 -9
package/dist/add-project-to-vex.js +2 -2
package/dist/add-project.js +15 -15
package/dist/add-statement.js +19 -19
package/dist/auto-vex-creator.js +4 -4
package/dist/jira-reporter.js +12 -7
package/dist/remove-project.js +15 -15
package/dist/schema/auto-vex-config.schema.json +26 -0
package/dist/schema/jira-config-schema.json +31 -1
package/dist/vuln-scan.js +16 -16
package/package.json +3 -3

package/dist/vuln-scan.js CHANGED Viewed

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
-"use strict";var Mn=Object.create;var Zt=Object.defineProperty;var Nn=Object.getOwnPropertyDescriptor;var _n=Object.getOwnPropertyNames;var $n=Object.getPrototypeOf,Bn=Object.prototype.hasOwnProperty;var y=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}};var Un=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of _n(e))!Bn.call(t,n)&&n!==r&&Zt(t,n,{get:()=>e[n],enumerable:!(i=Nn(e,n))||i.enumerable});return t};var Te=(t,e,r)=>(r=t!=null?Mn($n(t)):{},Un(e||!t||!t.__esModule?Zt(r,"default",{value:t,enumerable:!0}):r,t));var O=y(Ft=>{"use strict";Ft.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};Ft.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var Or=y((Hc,Cr)=>{var ee=require("constants"),no=process.cwd,Ze=null,oo=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Ze||(Ze=no.call(process)),Ze};try{process.cwd()}catch{}typeof process.chdir=="function"&&(Tt=process.chdir,process.chdir=function(t){Ze=null,Tt.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,Tt));var Tt;Cr.exports=so;function so(t){ee.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=i(t.chmod),t.fchmod=i(t.fchmod),t.lchmod=i(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=n(t.chmodSync),t.fchmodSync=n(t.fchmodSync),t.lchmodSync=n(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=m(t.statSync),t.fstatSync=m(t.fstatSync),t.lstatSync=m(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,p,l){l&&process.nextTick(l)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,p,l,u){u&&process.nextTick(u)},t.lchownSync=function(){}),oo==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:(function(a){function p(l,u,f){var g=Date.now(),v=0;a(l,u,function P($){if($&&($.code==="EACCES"||$.code==="EPERM"||$.code==="EBUSY")&&Date.now()-g<6e4){setTimeout(function(){t.stat(u,function(I,we){I&&I.code==="ENOENT"?a(l,u,P):f($)})},v),v<100&&(v+=10);return}f&&f($)})}return Object.setPrototypeOf&&Object.setPrototypeOf(p,a),p})(t.rename)),t.read=typeof t.read!="function"?t.read:(function(a){function p(l,u,f,g,v,P){var $;if(P&&typeof P=="function"){var I=0;$=function(we,zt,Yt){if(we&&we.code==="EAGAIN"&&I<10)return I++,a.call(t,l,u,f,g,v,$);P.apply(this,arguments)}}return a.call(t,l,u,f,g,v,$)}return Object.setPrototypeOf&&Object.setPrototypeOf(p,a),p})(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:(function(a){return function(p,l,u,f,g){for(var v=0;;)try{return a.call(t,p,l,u,f,g)}catch(P){if(P.code==="EAGAIN"&&v<10){v++;continue}throw P}}})(t.readSync);function e(a){a.lchmod=function(p,l,u){a.open(p,ee.O_WRONLY|ee.O_SYMLINK,l,function(f,g){if(f){u&&u(f);return}a.fchmod(g,l,function(v){a.close(g,function(P){u&&u(v||P)})})})},a.lchmodSync=function(p,l){var u=a.openSync(p,ee.O_WRONLY|ee.O_SYMLINK,l),f=!0,g;try{g=a.fchmodSync(u,l),f=!1}finally{if(f)try{a.closeSync(u)}catch{}else a.closeSync(u)}return g}}function r(a){ee.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(p,l,u,f){a.open(p,ee.O_SYMLINK,function(g,v){if(g){f&&f(g);return}a.futimes(v,l,u,function(P){a.close(v,function($){f&&f(P||$)})})})},a.lutimesSync=function(p,l,u){var f=a.openSync(p,ee.O_SYMLINK),g,v=!0;try{g=a.futimesSync(f,l,u),v=!1}finally{if(v)try{a.closeSync(f)}catch{}else a.closeSync(f)}return g}):a.futimes&&(a.lutimes=function(p,l,u,f){f&&process.nextTick(f)},a.lutimesSync=function(){})}function i(a){return a&&function(p,l,u){return a.call(t,p,l,function(f){d(f)&&(f=null),u&&u.apply(this,arguments)})}}function n(a){return a&&function(p,l){try{return a.call(t,p,l)}catch(u){if(!d(u))throw u}}}function o(a){return a&&function(p,l,u,f){return a.call(t,p,l,u,function(g){d(g)&&(g=null),f&&f.apply(this,arguments)})}}function s(a){return a&&function(p,l,u){try{return a.call(t,p,l,u)}catch(f){if(!d(f))throw f}}}function c(a){return a&&function(p,l,u){typeof l=="function"&&(u=l,l=null);function f(g,v){v&&(v.uid<0&&(v.uid+=4294967296),v.gid<0&&(v.gid+=4294967296)),u&&u.apply(this,arguments)}return l?a.call(t,p,l,f):a.call(t,p,f)}}function m(a){return a&&function(p,l){var u=l?a.call(t,p,l):a.call(t,p);return u&&(u.uid<0&&(u.uid+=4294967296),u.gid<0&&(u.gid+=4294967296)),u}}function d(a){if(!a||a.code==="ENOSYS")return!0;var p=!process.getuid||process.getuid()!==0;return!!(p&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Tr=y((Kc,Fr)=>{var jr=require("stream").Stream;Fr.exports=ao;function ao(t){return{ReadStream:e,WriteStream:r};function e(i,n){if(!(this instanceof e))return new e(i,n);jr.call(this);var o=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,n=n||{};for(var s=Object.keys(n),c=0,m=s.length;c<m;c++){var d=s[c];this[d]=n[d]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,p){if(a){o.emit("error",a),o.readable=!1;return}o.fd=p,o.emit("open",p),o._read()})}function r(i,n){if(!(this instanceof r))return new r(i,n);jr.call(this),this.path=i,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,n=n||{};for(var o=Object.keys(n),s=0,c=o.length;s<c;s++){var m=o[s];this[m]=n[m]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var Vr=y((Qc,kr)=>{"use strict";kr.exports=lo;var co=Object.getPrototypeOf||function(t){return t.__proto__};function lo(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:co(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var he=y((zc,At)=>{var D=require("fs"),uo=Or(),po=Tr(),mo=Vr(),et=require("util"),V,rt;typeof Symbol=="function"&&typeof Symbol.for=="function"?(V=Symbol.for("graceful-fs.queue"),rt=Symbol.for("graceful-fs.previous")):(V="___graceful-fs.queue",rt="___graceful-fs.previous");function fo(){}function Rr(t,e){Object.defineProperty(t,V,{get:function(){return e}})}var ae=fo;et.debuglog?ae=et.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(ae=function(){var t=et.format.apply(et,arguments);t="GFS4: "+t.split(/\n/).join(`
-GFS4: `),console.error(t)});D[V]||(Ar=global[V]||[],Rr(D,Ar),D.close=(function(t){function e(r,i){return t.call(D,r,function(n){n||Ir(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,rt,{value:t}),e})(D.close),D.closeSync=(function(t){function e(r){t.apply(D,arguments),Ir()}return Object.defineProperty(e,rt,{value:t}),e})(D.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){ae(D[V]),require("assert").equal(D[V].length,0)}));var Ar;global[V]||Rr(global,D[V]);At.exports=kt(mo(D));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!D.__patched&&(At.exports=kt(D),D.__patched=!0);function kt(t){uo(t),t.gracefulify=kt,t.createReadStream=zt,t.createWriteStream=Yt;var e=t.readFile;t.readFile=r;function r(h,w,S){return typeof w=="function"&&(S=w,w=null),F(h,w,S);function F(T,C,L,E){return e(T,C,function(b){b&&(b.code==="EMFILE"||b.code==="ENFILE")?de([F,[T,C,L],b,E||Date.now(),Date.now()]):typeof L=="function"&&L.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(h,w,S,F){return typeof S=="function"&&(F=S,S=null),T(h,w,S,F);function T(C,L,E,b,k){return i(C,L,E,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?de([T,[C,L,E,b],x,k||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(h,w,S,F){return typeof S=="function"&&(F=S,S=null),T(h,w,S,F);function T(C,L,E,b,k){return o(C,L,E,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?de([T,[C,L,E,b],x,k||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=m);function m(h,w,S,F){return typeof S=="function"&&(F=S,S=0),T(h,w,S,F);function T(C,L,E,b,k){return c(C,L,E,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?de([T,[C,L,E,b],x,k||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var d=t.readdir;t.readdir=p;var a=/^v[0-5]\./;function p(h,w,S){typeof w=="function"&&(S=w,w=null);var F=a.test(process.version)?function(L,E,b,k){return d(L,T(L,E,b,k))}:function(L,E,b,k){return d(L,E,T(L,E,b,k))};return F(h,w,S);function T(C,L,E,b){return function(k,x){k&&(k.code==="EMFILE"||k.code==="ENFILE")?de([F,[C,L,E],k,b||Date.now(),Date.now()]):(x&&x.sort&&x.sort(),typeof E=="function"&&E.call(this,k,x))}}}if(process.version.substr(0,4)==="v0.8"){var l=po(t);P=l.ReadStream,I=l.WriteStream}var u=t.ReadStream;u&&(P.prototype=Object.create(u.prototype),P.prototype.open=$);var f=t.WriteStream;f&&(I.prototype=Object.create(f.prototype),I.prototype.open=we),Object.defineProperty(t,"ReadStream",{get:function(){return P},set:function(h){P=h},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return I},set:function(h){I=h},enumerable:!0,configurable:!0});var g=P;Object.defineProperty(t,"FileReadStream",{get:function(){return g},set:function(h){g=h},enumerable:!0,configurable:!0});var v=I;Object.defineProperty(t,"FileWriteStream",{get:function(){return v},set:function(h){v=h},enumerable:!0,configurable:!0});function P(h,w){return this instanceof P?(u.apply(this,arguments),this):P.apply(Object.create(P.prototype),arguments)}function $(){var h=this;gt(h.path,h.flags,h.mode,function(w,S){w?(h.autoClose&&h.destroy(),h.emit("error",w)):(h.fd=S,h.emit("open",S),h.read())})}function I(h,w){return this instanceof I?(f.apply(this,arguments),this):I.apply(Object.create(I.prototype),arguments)}function we(){var h=this;gt(h.path,h.flags,h.mode,function(w,S){w?(h.destroy(),h.emit("error",w)):(h.fd=S,h.emit("open",S))})}function zt(h,w){return new t.ReadStream(h,w)}function Yt(h,w){return new t.WriteStream(h,w)}var Rn=t.open;t.open=gt;function gt(h,w,S,F){return typeof S=="function"&&(F=S,S=null),T(h,w,S,F);function T(C,L,E,b,k){return Rn(C,L,E,function(x,La){x&&(x.code==="EMFILE"||x.code==="ENFILE")?de([T,[C,L,E,b],x,k||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}return t}function de(t){ae("ENQUEUE",t[0].name,t[1]),D[V].push(t),Vt()}var tt;function Ir(){for(var t=Date.now(),e=0;e<D[V].length;++e)D[V][e].length>2&&(D[V][e][3]=t,D[V][e][4]=t);Vt()}function Vt(){if(clearTimeout(tt),tt=void 0,D[V].length!==0){var t=D[V].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)ae("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){ae("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,m=Math.max(o-n,1),d=Math.min(m*1.2,100);c>=d?(ae("RETRY",e.name,r),e.apply(null,r.concat([n]))):D[V].push(t)}tt===void 0&&(tt=setTimeout(Vt,0))}}});var M=y(Q=>{"use strict";var Mr=O().fromCallback,R=he(),ho=["access","appendFile","chmod","chown","close","copyFile","cp","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","glob","lchmod","lchown","lutimes","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","statfs","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof R[t]=="function");Object.assign(Q,R);ho.forEach(t=>{Q[t]=Mr(R[t])});Q.exists=function(t,e){return typeof e=="function"?R.exists(t,e):new Promise(r=>R.exists(t,r))};Q.read=function(t,e,r,i,n,o){return typeof o=="function"?R.read(t,e,r,i,n,o):new Promise((s,c)=>{R.read(t,e,r,i,n,(m,d,a)=>{if(m)return c(m);s({bytesRead:d,buffer:a})})})};Q.write=function(t,e,...r){return typeof r[r.length-1]=="function"?R.write(t,e,...r):new Promise((i,n)=>{R.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};Q.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?R.readv(t,e,...r):new Promise((i,n)=>{R.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};Q.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?R.writev(t,e,...r):new Promise((i,n)=>{R.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof R.realpath.native=="function"?Q.realpath.native=Mr(R.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var _r=y((Zc,Nr)=>{"use strict";var yo=require("path");Nr.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(yo.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var qr=y((el,It)=>{"use strict";var $r=M(),{checkPath:Br}=_r(),Ur=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};It.exports.makeDir=async(t,e)=>(Br(t),$r.mkdir(t,{mode:Ur(e),recursive:!0}));It.exports.makeDirSync=(t,e)=>(Br(t),$r.mkdirSync(t,{mode:Ur(e),recursive:!0}))});var q=y((tl,Xr)=>{"use strict";var go=O().fromPromise,{makeDir:So,makeDirSync:Rt}=qr(),Mt=go(So);Xr.exports={mkdirs:Mt,mkdirsSync:Rt,mkdirp:Mt,mkdirpSync:Rt,ensureDir:Mt,ensureDirSync:Rt}});var te=y((rl,Wr)=>{"use strict";var vo=O().fromPromise,Jr=M();function wo(t){return Jr.access(t).then(()=>!0).catch(()=>!1)}Wr.exports={pathExists:vo(wo),pathExistsSync:Jr.existsSync}});var Nt=y((il,Gr)=>{"use strict";var ye=M(),bo=O().fromPromise;async function xo(t,e,r){let i=await ye.open(t,"r+"),n=null;try{await ye.futimes(i,e,r)}finally{try{await ye.close(i)}catch(o){n=o}}if(n)throw n}function Po(t,e,r){let i=ye.openSync(t,"r+");return ye.futimesSync(i,e,r),ye.closeSync(i)}Gr.exports={utimesMillis:bo(xo),utimesMillisSync:Po}});var ce=y((nl,zr)=>{"use strict";var ge=M(),j=require("path"),Hr=O().fromPromise;function Lo(t,e,r){let i=r.dereference?n=>ge.stat(n,{bigint:!0}):n=>ge.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function Do(t,e,r){let i,n=r.dereference?s=>ge.statSync(s,{bigint:!0}):s=>ge.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function Eo(t,e,r,i){let{srcStat:n,destStat:o}=await Lo(t,e,i);if(o){if(Pe(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&_t(t,e))throw new Error(it(t,e,r));return{srcStat:n,destStat:o}}function Co(t,e,r,i){let{srcStat:n,destStat:o}=Do(t,e,i);if(o){if(Pe(n,o)){let s=j.basename(t),c=j.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&_t(t,e))throw new Error(it(t,e,r));return{srcStat:n,destStat:o}}async function Kr(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=await ge.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(Pe(e,s))throw new Error(it(t,r,i));return Kr(t,e,o,i)}function Qr(t,e,r,i){let n=j.resolve(j.dirname(t)),o=j.resolve(j.dirname(r));if(o===n||o===j.parse(o).root)return;let s;try{s=ge.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(Pe(e,s))throw new Error(it(t,r,i));return Qr(t,e,o,i)}function Pe(t,e){return e.ino!==void 0&&e.dev!==void 0&&e.ino===t.ino&&e.dev===t.dev}function _t(t,e){let r=j.resolve(t).split(j.sep).filter(n=>n),i=j.resolve(e).split(j.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function it(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}zr.exports={checkPaths:Hr(Eo),checkPathsSync:Co,checkParentPaths:Hr(Kr),checkParentPathsSync:Qr,isSrcSubdir:_t,areIdentical:Pe}});var Zr=y((ol,Yr)=>{"use strict";async function Oo(t,e){let r=[];for await(let i of t)r.push(e(i).then(()=>null,n=>n??new Error("unknown error")));await Promise.all(r.map(i=>i.then(n=>{if(n!==null)throw n})))}Yr.exports={asyncIteratorConcurrentProcess:Oo}});var ni=y((sl,ii)=>{"use strict";var A=M(),Le=require("path"),{mkdirs:jo}=q(),{pathExists:Fo}=te(),{utimesMillis:To}=Nt(),De=ce(),{asyncIteratorConcurrentProcess:ko}=Zr();async function Vo(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
+"use strict";var Ni=Object.create;var tr=Object.defineProperty;var _i=Object.getOwnPropertyDescriptor;var $i=Object.getOwnPropertyNames;var Bi=Object.getPrototypeOf,Ui=Object.prototype.hasOwnProperty;var y=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}};var qi=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of $i(e))!Ui.call(t,i)&&i!==r&&tr(t,i,{get:()=>e[i],enumerable:!(n=_i(e,i))||n.enumerable});return t};var Te=(t,e,r)=>(r=t!=null?Ni(Bi(t)):{},qi(e||!t||!t.__esModule?tr(r,"default",{value:t,enumerable:!0}):r,t));var O=y(Tt=>{"use strict";Tt.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,n)=>{e.push((i,o)=>i!=null?n(i):r(o)),t.apply(this,e)})},"name",{value:t.name})};Tt.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(n=>r(null,n),r)},"name",{value:t.name})}});var Cr=y((Yc,Or)=>{var te=require("constants"),co=process.cwd,et=null,lo=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return et||(et=co.call(process)),et};try{process.cwd()}catch{}typeof process.chdir=="function"&&(Vt=process.chdir,process.chdir=function(t){et=null,Vt.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,Vt));var Vt;Or.exports=uo;function uo(t){te.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=n(t.chmod),t.fchmod=n(t.fchmod),t.lchmod=n(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=i(t.chmodSync),t.fchmodSync=i(t.fchmodSync),t.lchmodSync=i(t.lchmodSync),t.stat=a(t.stat),t.fstat=a(t.fstat),t.lstat=a(t.lstat),t.statSync=f(t.statSync),t.fstatSync=f(t.fstatSync),t.lstatSync=f(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(c,p,l){l&&process.nextTick(l)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(c,p,l,u){u&&process.nextTick(u)},t.lchownSync=function(){}),lo==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:(function(c){function p(l,u,m){var g=Date.now(),v=0;c(l,u,function P($){if($&&($.code==="EACCES"||$.code==="EPERM"||$.code==="EBUSY")&&Date.now()-g<6e4){setTimeout(function(){t.stat(u,function(I,we){I&&I.code==="ENOENT"?c(l,u,P):m($)})},v),v<100&&(v+=10);return}m&&m($)})}return Object.setPrototypeOf&&Object.setPrototypeOf(p,c),p})(t.rename)),t.read=typeof t.read!="function"?t.read:(function(c){function p(l,u,m,g,v,P){var $;if(P&&typeof P=="function"){var I=0;$=function(we,Zt,er){if(we&&we.code==="EAGAIN"&&I<10)return I++,c.call(t,l,u,m,g,v,$);P.apply(this,arguments)}}return c.call(t,l,u,m,g,v,$)}return Object.setPrototypeOf&&Object.setPrototypeOf(p,c),p})(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:(function(c){return function(p,l,u,m,g){for(var v=0;;)try{return c.call(t,p,l,u,m,g)}catch(P){if(P.code==="EAGAIN"&&v<10){v++;continue}throw P}}})(t.readSync);function e(c){c.lchmod=function(p,l,u){c.open(p,te.O_WRONLY|te.O_SYMLINK,l,function(m,g){if(m){u&&u(m);return}c.fchmod(g,l,function(v){c.close(g,function(P){u&&u(v||P)})})})},c.lchmodSync=function(p,l){var u=c.openSync(p,te.O_WRONLY|te.O_SYMLINK,l),m=!0,g;try{g=c.fchmodSync(u,l),m=!1}finally{if(m)try{c.closeSync(u)}catch{}else c.closeSync(u)}return g}}function r(c){te.hasOwnProperty("O_SYMLINK")&&c.futimes?(c.lutimes=function(p,l,u,m){c.open(p,te.O_SYMLINK,function(g,v){if(g){m&&m(g);return}c.futimes(v,l,u,function(P){c.close(v,function($){m&&m(P||$)})})})},c.lutimesSync=function(p,l,u){var m=c.openSync(p,te.O_SYMLINK),g,v=!0;try{g=c.futimesSync(m,l,u),v=!1}finally{if(v)try{c.closeSync(m)}catch{}else c.closeSync(m)}return g}):c.futimes&&(c.lutimes=function(p,l,u,m){m&&process.nextTick(m)},c.lutimesSync=function(){})}function n(c){return c&&function(p,l,u){return c.call(t,p,l,function(m){d(m)&&(m=null),u&&u.apply(this,arguments)})}}function i(c){return c&&function(p,l){try{return c.call(t,p,l)}catch(u){if(!d(u))throw u}}}function o(c){return c&&function(p,l,u,m){return c.call(t,p,l,u,function(g){d(g)&&(g=null),m&&m.apply(this,arguments)})}}function s(c){return c&&function(p,l,u){try{return c.call(t,p,l,u)}catch(m){if(!d(m))throw m}}}function a(c){return c&&function(p,l,u){typeof l=="function"&&(u=l,l=null);function m(g,v){v&&(v.uid<0&&(v.uid+=4294967296),v.gid<0&&(v.gid+=4294967296)),u&&u.apply(this,arguments)}return l?c.call(t,p,l,m):c.call(t,p,m)}}function f(c){return c&&function(p,l){var u=l?c.call(t,p,l):c.call(t,p);return u&&(u.uid<0&&(u.uid+=4294967296),u.gid<0&&(u.gid+=4294967296)),u}}function d(c){if(!c||c.code==="ENOSYS")return!0;var p=!process.getuid||process.getuid()!==0;return!!(p&&(c.code==="EINVAL"||c.code==="EPERM"))}}});var Tr=y((Zc,Fr)=>{var kr=require("stream").Stream;Fr.exports=po;function po(t){return{ReadStream:e,WriteStream:r};function e(n,i){if(!(this instanceof e))return new e(n,i);kr.call(this);var o=this;this.path=n,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,i=i||{};for(var s=Object.keys(i),a=0,f=s.length;a<f;a++){var d=s[a];this[d]=i[d]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(c,p){if(c){o.emit("error",c),o.readable=!1;return}o.fd=p,o.emit("open",p),o._read()})}function r(n,i){if(!(this instanceof r))return new r(n,i);kr.call(this),this.path=n,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,i=i||{};for(var o=Object.keys(i),s=0,a=o.length;s<a;s++){var f=o[s];this[f]=i[f]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var Ar=y((el,Vr)=>{"use strict";Vr.exports=mo;var fo=Object.getPrototypeOf||function(t){return t.__proto__};function mo(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:fo(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var he=y((tl,Rt)=>{var j=require("fs"),ho=Cr(),yo=Tr(),go=Ar(),tt=require("util"),V,nt;typeof Symbol=="function"&&typeof Symbol.for=="function"?(V=Symbol.for("graceful-fs.queue"),nt=Symbol.for("graceful-fs.previous")):(V="___graceful-fs.queue",nt="___graceful-fs.previous");function So(){}function Mr(t,e){Object.defineProperty(t,V,{get:function(){return e}})}var ae=So;tt.debuglog?ae=tt.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(ae=function(){var t=tt.format.apply(tt,arguments);t="GFS4: "+t.split(/\n/).join(`
+GFS4: `),console.error(t)});j[V]||(Ir=global[V]||[],Mr(j,Ir),j.close=(function(t){function e(r,n){return t.call(j,r,function(i){i||Rr(),typeof n=="function"&&n.apply(this,arguments)})}return Object.defineProperty(e,nt,{value:t}),e})(j.close),j.closeSync=(function(t){function e(r){t.apply(j,arguments),Rr()}return Object.defineProperty(e,nt,{value:t}),e})(j.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){ae(j[V]),require("assert").equal(j[V].length,0)}));var Ir;global[V]||Mr(global,j[V]);Rt.exports=At(go(j));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!j.__patched&&(Rt.exports=At(j),j.__patched=!0);function At(t){ho(t),t.gracefulify=At,t.createReadStream=Zt,t.createWriteStream=er;var e=t.readFile;t.readFile=r;function r(h,w,S){return typeof w=="function"&&(S=w,w=null),k(h,w,S);function k(F,D,L,E){return e(F,D,function(b){b&&(b.code==="EMFILE"||b.code==="ENFILE")?de([k,[F,D,L],b,E||Date.now(),Date.now()]):typeof L=="function"&&L.apply(this,arguments)})}}var n=t.writeFile;t.writeFile=i;function i(h,w,S,k){return typeof S=="function"&&(k=S,S=null),F(h,w,S,k);function F(D,L,E,b,T){return n(D,L,E,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?de([F,[D,L,E,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(h,w,S,k){return typeof S=="function"&&(k=S,S=null),F(h,w,S,k);function F(D,L,E,b,T){return o(D,L,E,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?de([F,[D,L,E,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var a=t.copyFile;a&&(t.copyFile=f);function f(h,w,S,k){return typeof S=="function"&&(k=S,S=0),F(h,w,S,k);function F(D,L,E,b,T){return a(D,L,E,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?de([F,[D,L,E,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var d=t.readdir;t.readdir=p;var c=/^v[0-5]\./;function p(h,w,S){typeof w=="function"&&(S=w,w=null);var k=c.test(process.version)?function(L,E,b,T){return d(L,F(L,E,b,T))}:function(L,E,b,T){return d(L,E,F(L,E,b,T))};return k(h,w,S);function F(D,L,E,b){return function(T,x){T&&(T.code==="EMFILE"||T.code==="ENFILE")?de([k,[D,L,E],T,b||Date.now(),Date.now()]):(x&&x.sort&&x.sort(),typeof E=="function"&&E.call(this,T,x))}}}if(process.version.substr(0,4)==="v0.8"){var l=yo(t);P=l.ReadStream,I=l.WriteStream}var u=t.ReadStream;u&&(P.prototype=Object.create(u.prototype),P.prototype.open=$);var m=t.WriteStream;m&&(I.prototype=Object.create(m.prototype),I.prototype.open=we),Object.defineProperty(t,"ReadStream",{get:function(){return P},set:function(h){P=h},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return I},set:function(h){I=h},enumerable:!0,configurable:!0});var g=P;Object.defineProperty(t,"FileReadStream",{get:function(){return g},set:function(h){g=h},enumerable:!0,configurable:!0});var v=I;Object.defineProperty(t,"FileWriteStream",{get:function(){return v},set:function(h){v=h},enumerable:!0,configurable:!0});function P(h,w){return this instanceof P?(u.apply(this,arguments),this):P.apply(Object.create(P.prototype),arguments)}function $(){var h=this;St(h.path,h.flags,h.mode,function(w,S){w?(h.autoClose&&h.destroy(),h.emit("error",w)):(h.fd=S,h.emit("open",S),h.read())})}function I(h,w){return this instanceof I?(m.apply(this,arguments),this):I.apply(Object.create(I.prototype),arguments)}function we(){var h=this;St(h.path,h.flags,h.mode,function(w,S){w?(h.destroy(),h.emit("error",w)):(h.fd=S,h.emit("open",S))})}function Zt(h,w){return new t.ReadStream(h,w)}function er(h,w){return new t.WriteStream(h,w)}var Mi=t.open;t.open=St;function St(h,w,S,k){return typeof S=="function"&&(k=S,S=null),F(h,w,S,k);function F(D,L,E,b,T){return Mi(D,L,E,function(x,Oa){x&&(x.code==="EMFILE"||x.code==="ENFILE")?de([F,[D,L,E,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}return t}function de(t){ae("ENQUEUE",t[0].name,t[1]),j[V].push(t),It()}var rt;function Rr(){for(var t=Date.now(),e=0;e<j[V].length;++e)j[V][e].length>2&&(j[V][e][3]=t,j[V][e][4]=t);It()}function It(){if(clearTimeout(rt),rt=void 0,j[V].length!==0){var t=j[V].shift(),e=t[0],r=t[1],n=t[2],i=t[3],o=t[4];if(i===void 0)ae("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-i>=6e4){ae("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,n)}else{var a=Date.now()-o,f=Math.max(o-i,1),d=Math.min(f*1.2,100);a>=d?(ae("RETRY",e.name,r),e.apply(null,r.concat([i]))):j[V].push(t)}rt===void 0&&(rt=setTimeout(It,0))}}});var M=y(z=>{"use strict";var Nr=O().fromCallback,R=he(),vo=["access","appendFile","chmod","chown","close","copyFile","cp","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","glob","lchmod","lchown","lutimes","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","statfs","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof R[t]=="function");Object.assign(z,R);vo.forEach(t=>{z[t]=Nr(R[t])});z.exists=function(t,e){return typeof e=="function"?R.exists(t,e):new Promise(r=>R.exists(t,r))};z.read=function(t,e,r,n,i,o){return typeof o=="function"?R.read(t,e,r,n,i,o):new Promise((s,a)=>{R.read(t,e,r,n,i,(f,d,c)=>{if(f)return a(f);s({bytesRead:d,buffer:c})})})};z.write=function(t,e,...r){return typeof r[r.length-1]=="function"?R.write(t,e,...r):new Promise((n,i)=>{R.write(t,e,...r,(o,s,a)=>{if(o)return i(o);n({bytesWritten:s,buffer:a})})})};z.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?R.readv(t,e,...r):new Promise((n,i)=>{R.readv(t,e,...r,(o,s,a)=>{if(o)return i(o);n({bytesRead:s,buffers:a})})})};z.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?R.writev(t,e,...r):new Promise((n,i)=>{R.writev(t,e,...r,(o,s,a)=>{if(o)return i(o);n({bytesWritten:s,buffers:a})})})};typeof R.realpath.native=="function"?z.realpath.native=Nr(R.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var $r=y((nl,_r)=>{"use strict";var wo=require("path");_r.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(wo.parse(e).root,""))){let n=new Error(`Path contains invalid characters: ${e}`);throw n.code="EINVAL",n}}});var Xr=y((il,Mt)=>{"use strict";var Br=M(),{checkPath:Ur}=$r(),qr=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};Mt.exports.makeDir=async(t,e)=>(Ur(t),Br.mkdir(t,{mode:qr(e),recursive:!0}));Mt.exports.makeDirSync=(t,e)=>(Ur(t),Br.mkdirSync(t,{mode:qr(e),recursive:!0}))});var q=y((ol,Jr)=>{"use strict";var bo=O().fromPromise,{makeDir:xo,makeDirSync:Nt}=Xr(),_t=bo(xo);Jr.exports={mkdirs:_t,mkdirsSync:Nt,mkdirp:_t,mkdirpSync:Nt,ensureDir:_t,ensureDirSync:Nt}});var re=y((sl,Gr)=>{"use strict";var Po=O().fromPromise,Wr=M();function Lo(t){return Wr.access(t).then(()=>!0).catch(()=>!1)}Gr.exports={pathExists:Po(Lo),pathExistsSync:Wr.existsSync}});var $t=y((al,Hr)=>{"use strict";var ye=M(),jo=O().fromPromise;async function Eo(t,e,r){let n=await ye.open(t,"r+"),i=null;try{await ye.futimes(n,e,r)}finally{try{await ye.close(n)}catch(o){i=o}}if(i)throw i}function Do(t,e,r){let n=ye.openSync(t,"r+");return ye.futimesSync(n,e,r),ye.closeSync(n)}Hr.exports={utimesMillis:jo(Eo),utimesMillisSync:Do}});var ce=y((cl,Yr)=>{"use strict";var ge=M(),C=require("path"),Kr=O().fromPromise;function Oo(t,e,r){let n=r.dereference?i=>ge.stat(i,{bigint:!0}):i=>ge.lstat(i,{bigint:!0});return Promise.all([n(t),n(e).catch(i=>{if(i.code==="ENOENT")return null;throw i})]).then(([i,o])=>({srcStat:i,destStat:o}))}function Co(t,e,r){let n,i=r.dereference?s=>ge.statSync(s,{bigint:!0}):s=>ge.lstatSync(s,{bigint:!0}),o=i(t);try{n=i(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:n}}async function ko(t,e,r,n){let{srcStat:i,destStat:o}=await Oo(t,e,n);if(o){if(Le(i,o)){let s=C.basename(t),a=C.basename(e);if(r==="move"&&s!==a&&s.toLowerCase()===a.toLowerCase())return{srcStat:i,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(i.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!i.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(i.isDirectory()&&Bt(t,e))throw new Error(it(t,e,r));return{srcStat:i,destStat:o}}function Fo(t,e,r,n){let{srcStat:i,destStat:o}=Co(t,e,n);if(o){if(Le(i,o)){let s=C.basename(t),a=C.basename(e);if(r==="move"&&s!==a&&s.toLowerCase()===a.toLowerCase())return{srcStat:i,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(i.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!i.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(i.isDirectory()&&Bt(t,e))throw new Error(it(t,e,r));return{srcStat:i,destStat:o}}async function Qr(t,e,r,n){let i=C.resolve(C.dirname(t)),o=C.resolve(C.dirname(r));if(o===i||o===C.parse(o).root)return;let s;try{s=await ge.stat(o,{bigint:!0})}catch(a){if(a.code==="ENOENT")return;throw a}if(Le(e,s))throw new Error(it(t,r,n));return Qr(t,e,o,n)}function zr(t,e,r,n){let i=C.resolve(C.dirname(t)),o=C.resolve(C.dirname(r));if(o===i||o===C.parse(o).root)return;let s;try{s=ge.statSync(o,{bigint:!0})}catch(a){if(a.code==="ENOENT")return;throw a}if(Le(e,s))throw new Error(it(t,r,n));return zr(t,e,o,n)}function Le(t,e){return e.ino!==void 0&&e.dev!==void 0&&e.ino===t.ino&&e.dev===t.dev}function Bt(t,e){let r=C.resolve(t).split(C.sep).filter(i=>i),n=C.resolve(e).split(C.sep).filter(i=>i);return r.every((i,o)=>n[o]===i)}function it(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}Yr.exports={checkPaths:Kr(ko),checkPathsSync:Fo,checkParentPaths:Kr(Qr),checkParentPathsSync:zr,isSrcSubdir:Bt,areIdentical:Le}});var en=y((ll,Zr)=>{"use strict";async function To(t,e){let r=[];for await(let n of t)r.push(e(n).then(()=>null,i=>i??new Error("unknown error")));await Promise.all(r.map(n=>n.then(i=>{if(i!==null)throw i})))}Zr.exports={asyncIteratorConcurrentProcess:To}});var sn=y((ul,on)=>{"use strict";var A=M(),je=require("path"),{mkdirs:Vo}=q(),{pathExists:Ao}=re(),{utimesMillis:Io}=$t(),Ee=ce(),{asyncIteratorConcurrentProcess:Ro}=en();async function Mo(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
-	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await De.checkPaths(t,e,"copy",r);if(await De.checkParentPaths(t,i,e,"copy"),!await ti(t,e,r))return;let s=Le.dirname(e);await Fo(s)||await jo(s),await ri(n,t,e,r)}async function ti(t,e,r){return r.filter?r.filter(t,e):!0}async function ri(t,e,r,i){let o=await(i.dereference?A.stat:A.lstat)(e);if(o.isDirectory())return Mo(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Ao(o,t,e,r,i);if(o.isSymbolicLink())return No(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Ao(t,e,r,i,n){if(!e)return ei(t,r,i,n);if(n.overwrite)return await A.unlink(i),ei(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function ei(t,e,r,i){if(await A.copyFile(e,r),i.preserveTimestamps){Io(t.mode)&&await Ro(r,t.mode);let n=await A.stat(e);await To(r,n.atime,n.mtime)}return A.chmod(r,t.mode)}function Io(t){return(t&128)===0}function Ro(t,e){return A.chmod(t,e|128)}async function Mo(t,e,r,i,n){e||await A.mkdir(i),await ko(await A.opendir(r),async o=>{let s=Le.join(r,o.name),c=Le.join(i,o.name);if(await ti(s,c,n)){let{destStat:d}=await De.checkPaths(s,c,"copy",n);await ri(d,s,c,n)}}),e||await A.chmod(i,t.mode)}async function No(t,e,r,i){let n=await A.readlink(e);if(i.dereference&&(n=Le.resolve(process.cwd(),n)),!t)return A.symlink(n,r);let o=null;try{o=await A.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return A.symlink(n,r);throw s}if(i.dereference&&(o=Le.resolve(process.cwd(),o)),De.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(De.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await A.unlink(r),A.symlink(n,r)}ii.exports=Vo});var li=y((al,ci)=>{"use strict";var N=he(),Ee=require("path"),_o=q().mkdirsSync,$o=Nt().utimesMillisSync,Ce=ce();function Bo(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
+	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await Ee.checkPaths(t,e,"copy",r);if(await Ee.checkParentPaths(t,n,e,"copy"),!await rn(t,e,r))return;let s=je.dirname(e);await Ao(s)||await Vo(s),await nn(i,t,e,r)}async function rn(t,e,r){return r.filter?r.filter(t,e):!0}async function nn(t,e,r,n){let o=await(n.dereference?A.stat:A.lstat)(e);if(o.isDirectory())return Bo(o,t,e,r,n);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return No(o,t,e,r,n);if(o.isSymbolicLink())return Uo(t,e,r,n);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function No(t,e,r,n,i){if(!e)return tn(t,r,n,i);if(i.overwrite)return await A.unlink(n),tn(t,r,n,i);if(i.errorOnExist)throw new Error(`'${n}' already exists`)}async function tn(t,e,r,n){if(await A.copyFile(e,r),n.preserveTimestamps){_o(t.mode)&&await $o(r,t.mode);let i=await A.stat(e);await Io(r,i.atime,i.mtime)}return A.chmod(r,t.mode)}function _o(t){return(t&128)===0}function $o(t,e){return A.chmod(t,e|128)}async function Bo(t,e,r,n,i){e||await A.mkdir(n),await Ro(await A.opendir(r),async o=>{let s=je.join(r,o.name),a=je.join(n,o.name);if(await rn(s,a,i)){let{destStat:d}=await Ee.checkPaths(s,a,"copy",i);await nn(d,s,a,i)}}),e||await A.chmod(n,t.mode)}async function Uo(t,e,r,n){let i=await A.readlink(e);if(n.dereference&&(i=je.resolve(process.cwd(),i)),!t)return A.symlink(i,r);let o=null;try{o=await A.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return A.symlink(i,r);throw s}if(n.dereference&&(o=je.resolve(process.cwd(),o)),Ee.isSrcSubdir(i,o))throw new Error(`Cannot copy '${i}' to a subdirectory of itself, '${o}'.`);if(Ee.isSrcSubdir(o,i))throw new Error(`Cannot overwrite '${o}' with '${i}'.`);return await A.unlink(r),A.symlink(i,r)}on.exports=Mo});var pn=y((pl,un)=>{"use strict";var N=he(),De=require("path"),qo=q().mkdirsSync,Xo=$t().utimesMillisSync,Oe=ce();function Jo(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
-	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=Ce.checkPathsSync(t,e,"copy",r);if(Ce.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=Ee.dirname(e);return N.existsSync(o)||_o(o),oi(n,t,e,r)}function oi(t,e,r,i){let o=(i.dereference?N.statSync:N.lstatSync)(e);if(o.isDirectory())return Ho(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Uo(o,t,e,r,i);if(o.isSymbolicLink())return zo(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function Uo(t,e,r,i,n){return e?qo(t,r,i,n):si(t,r,i,n)}function qo(t,e,r,i){if(i.overwrite)return N.unlinkSync(r),si(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function si(t,e,r,i){return N.copyFileSync(e,r),i.preserveTimestamps&&Xo(t.mode,e,r),$t(r,t.mode)}function Xo(t,e,r){return Jo(t)&&Wo(r,t),Go(e,r)}function Jo(t){return(t&128)===0}function Wo(t,e){return $t(t,e|128)}function $t(t,e){return N.chmodSync(t,e)}function Go(t,e){let r=N.statSync(t);return $o(e,r.atime,r.mtime)}function Ho(t,e,r,i,n){return e?ai(r,i,n):Ko(t.mode,r,i,n)}function Ko(t,e,r,i){return N.mkdirSync(r),ai(e,r,i),$t(r,t)}function ai(t,e,r){let i=N.opendirSync(t);try{let n;for(;(n=i.readSync())!==null;)Qo(n.name,t,e,r)}finally{i.closeSync()}}function Qo(t,e,r,i){let n=Ee.join(e,t),o=Ee.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=Ce.checkPathsSync(n,o,"copy",i);return oi(s,n,o,i)}function zo(t,e,r,i){let n=N.readlinkSync(e);if(i.dereference&&(n=Ee.resolve(process.cwd(),n)),t){let o;try{o=N.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return N.symlinkSync(n,r);throw s}if(i.dereference&&(o=Ee.resolve(process.cwd(),o)),Ce.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(Ce.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return Yo(n,r)}else return N.symlinkSync(n,r)}function Yo(t,e){return N.unlinkSync(e),N.symlinkSync(t,e)}ci.exports=Bo});var nt=y((cl,ui)=>{"use strict";var Zo=O().fromPromise;ui.exports={copy:Zo(ni()),copySync:li()}});var Oe=y((ll,mi)=>{"use strict";var pi=he(),es=O().fromCallback;function ts(t,e){pi.rm(t,{recursive:!0,force:!0},e)}function rs(t){pi.rmSync(t,{recursive:!0,force:!0})}mi.exports={remove:es(ts),removeSync:rs}});var wi=y((ul,vi)=>{"use strict";var is=O().fromPromise,hi=M(),yi=require("path"),gi=q(),Si=Oe(),fi=is(async function(e){let r;try{r=await hi.readdir(e)}catch{return gi.mkdirs(e)}return Promise.all(r.map(i=>Si.remove(yi.join(e,i))))});function di(t){let e;try{e=hi.readdirSync(t)}catch{return gi.mkdirsSync(t)}e.forEach(r=>{r=yi.join(t,r),Si.removeSync(r)})}vi.exports={emptyDirSync:di,emptydirSync:di,emptyDir:fi,emptydir:fi}});var Li=y((pl,Pi)=>{"use strict";var ns=O().fromPromise,bi=require("path"),z=M(),xi=q();async function os(t){let e;try{e=await z.stat(t)}catch{}if(e&&e.isFile())return;let r=bi.dirname(t),i=null;try{i=await z.stat(r)}catch(n){if(n.code==="ENOENT"){await xi.mkdirs(r),await z.writeFile(t,"");return}else throw n}i.isDirectory()?await z.writeFile(t,""):await z.readdir(r)}function ss(t){let e;try{e=z.statSync(t)}catch{}if(e&&e.isFile())return;let r=bi.dirname(t);try{z.statSync(r).isDirectory()||z.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")xi.mkdirsSync(r);else throw i}z.writeFileSync(t,"")}Pi.exports={createFile:ns(os),createFileSync:ss}});var ji=y((ml,Oi)=>{"use strict";var as=O().fromPromise,Di=require("path"),re=M(),Ei=q(),{pathExists:cs}=te(),{areIdentical:Ci}=ce();async function ls(t,e){let r;try{r=await re.lstat(e)}catch{}let i;try{i=await re.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&Ci(i,r))return;let n=Di.dirname(e);await cs(n)||await Ei.mkdirs(n),await re.link(t,e)}function us(t,e){let r;try{r=re.lstatSync(e)}catch{}try{let o=re.lstatSync(t);if(r&&Ci(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Di.dirname(e);return re.existsSync(i)||Ei.mkdirsSync(i),re.linkSync(t,e)}Oi.exports={createLink:as(ls),createLinkSync:us}});var Ti=y((fl,Fi)=>{"use strict";var ie=require("path"),je=M(),{pathExists:ps}=te(),ms=O().fromPromise;async function fs(t,e){if(ie.isAbsolute(t)){try{await je.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ie.dirname(e),i=ie.join(r,t);if(await ps(i))return{toCwd:i,toDst:t};try{await je.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ie.relative(r,t)}}function ds(t,e){if(ie.isAbsolute(t)){if(!je.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ie.dirname(e),i=ie.join(r,t);if(je.existsSync(i))return{toCwd:i,toDst:t};if(!je.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ie.relative(r,t)}}Fi.exports={symlinkPaths:ms(fs),symlinkPathsSync:ds}});var Ai=y((dl,Vi)=>{"use strict";var ki=M(),hs=O().fromPromise;async function ys(t,e){if(e)return e;let r;try{r=await ki.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function gs(t,e){if(e)return e;let r;try{r=ki.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Vi.exports={symlinkType:hs(ys),symlinkTypeSync:gs}});var Ni=y((hl,Mi)=>{"use strict";var Ss=O().fromPromise,Ii=require("path"),X=M(),{mkdirs:vs,mkdirsSync:ws}=q(),{symlinkPaths:bs,symlinkPathsSync:xs}=Ti(),{symlinkType:Ps,symlinkTypeSync:Ls}=Ai(),{pathExists:Ds}=te(),{areIdentical:Ri}=ce();async function Es(t,e,r){let i;try{i=await X.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,m]=await Promise.all([X.stat(t),X.stat(e)]);if(Ri(c,m))return}let n=await bs(t,e);t=n.toDst;let o=await Ps(n.toCwd,r),s=Ii.dirname(e);return await Ds(s)||await vs(s),X.symlink(t,e,o)}function Cs(t,e,r){let i;try{i=X.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=X.statSync(t),m=X.statSync(e);if(Ri(c,m))return}let n=xs(t,e);t=n.toDst,r=Ls(n.toCwd,r);let o=Ii.dirname(e);return X.existsSync(o)||ws(o),X.symlinkSync(t,e,r)}Mi.exports={createSymlink:Ss(Es),createSymlinkSync:Cs}});var Wi=y((yl,Ji)=>{"use strict";var{createFile:_i,createFileSync:$i}=Li(),{createLink:Bi,createLinkSync:Ui}=ji(),{createSymlink:qi,createSymlinkSync:Xi}=Ni();Ji.exports={createFile:_i,createFileSync:$i,ensureFile:_i,ensureFileSync:$i,createLink:Bi,createLinkSync:Ui,ensureLink:Bi,ensureLinkSync:Ui,createSymlink:qi,createSymlinkSync:Xi,ensureSymlink:qi,ensureSymlinkSync:Xi}});var ot=y((gl,Gi)=>{function Os(t,{EOL:e=`
-`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function js(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Gi.exports={stringify:Os,stripBom:js}});var zi=y((Sl,Qi)=>{var Se;try{Se=he()}catch{Se=require("fs")}var st=O(),{stringify:Hi,stripBom:Ki}=ot();async function Fs(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||Se,i="throws"in e?e.throws:!0,n=await st.fromCallback(r.readFile)(t,e);n=Ki(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Ts=st.fromPromise(Fs);function ks(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||Se,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Ki(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function Vs(t,e,r={}){let i=r.fs||Se,n=Hi(e,r);await st.fromCallback(i.writeFile)(t,n,r)}var As=st.fromPromise(Vs);function Is(t,e,r={}){let i=r.fs||Se,n=Hi(e,r);return i.writeFileSync(t,n,r)}Qi.exports={readFile:Ts,readFileSync:ks,writeFile:As,writeFileSync:Is}});var Zi=y((vl,Yi)=>{"use strict";var at=zi();Yi.exports={readJson:at.readFile,readJsonSync:at.readFileSync,writeJson:at.writeFile,writeJsonSync:at.writeFileSync}});var ct=y((wl,rn)=>{"use strict";var Rs=O().fromPromise,Bt=M(),en=require("path"),tn=q(),Ms=te().pathExists;async function Ns(t,e,r="utf-8"){let i=en.dirname(t);return await Ms(i)||await tn.mkdirs(i),Bt.writeFile(t,e,r)}function _s(t,...e){let r=en.dirname(t);Bt.existsSync(r)||tn.mkdirsSync(r),Bt.writeFileSync(t,...e)}rn.exports={outputFile:Rs(Ns),outputFileSync:_s}});var on=y((bl,nn)=>{"use strict";var{stringify:$s}=ot(),{outputFile:Bs}=ct();async function Us(t,e,r={}){let i=$s(e,r);await Bs(t,i,r)}nn.exports=Us});var an=y((xl,sn)=>{"use strict";var{stringify:qs}=ot(),{outputFileSync:Xs}=ct();function Js(t,e,r){let i=qs(e,r);Xs(t,i,r)}sn.exports=Js});var ln=y((Pl,cn)=>{"use strict";var Ws=O().fromPromise,_=Zi();_.outputJson=Ws(on());_.outputJsonSync=an();_.outputJSON=_.outputJson;_.outputJSONSync=_.outputJsonSync;_.writeJSON=_.writeJson;_.writeJSONSync=_.writeJsonSync;_.readJSON=_.readJson;_.readJSONSync=_.readJsonSync;cn.exports=_});var dn=y((Ll,fn)=>{"use strict";var Gs=M(),un=require("path"),{copy:Hs}=nt(),{remove:mn}=Oe(),{mkdirp:Ks}=q(),{pathExists:Qs}=te(),pn=ce();async function zs(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await pn.checkPaths(t,e,"move",r);await pn.checkParentPaths(t,n,e,"move");let s=un.dirname(e);return un.parse(s).root!==s&&await Ks(s),Ys(t,e,i,o)}async function Ys(t,e,r,i){if(!i){if(r)await mn(e);else if(await Qs(e))throw new Error("dest already exists.")}try{await Gs.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Zs(t,e,r)}}async function Zs(t,e,r){return await Hs(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),mn(t)}fn.exports=zs});var vn=y((Dl,Sn)=>{"use strict";var yn=he(),qt=require("path"),ea=nt().copySync,gn=Oe().removeSync,ta=q().mkdirpSync,hn=ce();function ra(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=hn.checkPathsSync(t,e,"move",r);return hn.checkParentPathsSync(t,n,e,"move"),ia(e)||ta(qt.dirname(e)),na(t,e,i,o)}function ia(t){let e=qt.dirname(t);return qt.parse(e).root===e}function na(t,e,r,i){if(i)return Ut(t,e,r);if(r)return gn(e),Ut(t,e,r);if(yn.existsSync(e))throw new Error("dest already exists.");return Ut(t,e,r)}function Ut(t,e,r){try{yn.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return oa(t,e,r)}}function oa(t,e,r){return ea(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),gn(t)}Sn.exports=ra});var bn=y((El,wn)=>{"use strict";var sa=O().fromPromise;wn.exports={move:sa(dn()),moveSync:vn()}});var Pn=y((Cl,xn)=>{"use strict";xn.exports={...M(),...nt(),...wi(),...Wi(),...ln(),...q(),...bn(),...ct(),...te(),...Oe()}});var Ln=y(lt=>{"use strict";Object.defineProperty(lt,"__esModule",{value:!0});lt.EXTENSIONS_LANGUAGES=void 0;lt.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"TypeScript",tsx:"TypeScript",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var Fe=y(Xt=>{"use strict";Object.defineProperty(Xt,"__esModule",{value:!0});Xt.setOptionValues=aa;function aa(t,e){for(let r of Object.keys(t))t[r]!==void 0&&(e[r]=t[r]);return e}});var En=y(J=>{"use strict";var ca=J&&J.__createBinding||(Object.create?(function(t,e,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(e,r);(!n||("get"in n?!e.__esModule:n.writable||n.configurable))&&(n={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(t,i,n)}):(function(t,e,r,i){i===void 0&&(i=r),t[i]=e[r]})),la=J&&J.__setModuleDefault||(Object.create?(function(t,e){Object.defineProperty(t,"default",{enumerable:!0,value:e})}):function(t,e){t.default=e}),ua=J&&J.__importStar||(function(){var t=function(e){return t=Object.getOwnPropertyNames||function(r){var i=[];for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&(i[i.length]=n);return i},t(e)};return function(e){if(e&&e.__esModule)return e;var r={};if(e!=null)for(var i=t(e),n=0;n<i.length;n++)i[n]!=="default"&&ca(r,e,i[n]);return la(r,e),r}})();Object.defineProperty(J,"__esModule",{value:!0});J.SarifBuilder=void 0;var Dn=ua(Pn()),pa=Ln(),ma=Fe(),Jt=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,ma.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Dn.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Dn.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o,s,c;e.artifacts=e.artifacts||[];let m=new Set(e.artifacts.map(p=>{var l;return(l=p?.location)===null||l===void 0?void 0:l.uri}).filter(Boolean));for(let p of e.results||[])for(let l of p.locations||[]){let u=(i=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0?void 0:i.uri;if(u&&!m.has(u)){let f=u.lastIndexOf("."),g=f!==-1?u.slice(f+1):"",v=pa.EXTENSIONS_LANGUAGES[g]||"unknown";e.artifacts.push({sourceLanguage:v,location:{uri:u}}),m.add(u)}}let d=new Map;e.artifacts.forEach((p,l)=>{var u;let f=(u=p?.location)===null||u===void 0?void 0:u.uri;f&&d.set(f,l)});let a=new Map;(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).forEach((p,l)=>{a.set(p.id,l)});for(let p of e.results||[]){if(p.ruleId){let l=a.get(p.ruleId);l!==void 0&&(p.ruleIndex=l)}if(p.locations)for(let l of p.locations){let u=(c=(s=l?.physicalLocation)===null||s===void 0?void 0:s.artifactLocation)===null||c===void 0?void 0:c.uri;if(u){let f=d.get(u);f!==void 0&&(l.physicalLocation.artifactLocation.index=f)}}}return e}};J.SarifBuilder=Jt});var Cn=y(ut=>{"use strict";Object.defineProperty(ut,"__esModule",{value:!0});ut.SarifResultBuilder=void 0;var fa=Fe(),Wt=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,fa.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){this.manageInitLocation(),!this.result.locations[0].physicalLocation&&(this.result.locations[0].physicalLocation={})}};ut.SarifResultBuilder=Wt});var On=y(pt=>{"use strict";Object.defineProperty(pt,"__esModule",{value:!0});pt.SarifRuleBuilder=void 0;var da=Fe(),Gt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,da.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};pt.SarifRuleBuilder=Gt});var jn=y(mt=>{"use strict";Object.defineProperty(mt,"__esModule",{value:!0});mt.SarifRunBuilder=void 0;var ha=Fe(),Ht=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,ha.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};mt.SarifRunBuilder=Ht});var Fn=y(W=>{"use strict";Object.defineProperty(W,"__esModule",{value:!0});W.SarifResultBuilder=W.SarifRuleBuilder=W.SarifRunBuilder=W.SarifBuilder=void 0;var ya=En();Object.defineProperty(W,"SarifBuilder",{enumerable:!0,get:function(){return ya.SarifBuilder}});var ga=Cn();Object.defineProperty(W,"SarifResultBuilder",{enumerable:!0,get:function(){return ga.SarifResultBuilder}});var Sa=On();Object.defineProperty(W,"SarifRuleBuilder",{enumerable:!0,get:function(){return Sa.SarifRuleBuilder}});var va=jn();Object.defineProperty(W,"SarifRunBuilder",{enumerable:!0,get:function(){return va.SarifRunBuilder}})});var kn=y((Il,Tn)=>{"use strict";var wa=/["'&<>]/;Tn.exports=ba;function ba(t){var e=""+t,r=wa.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Qt=require("fs/promises");var Y=Te(require("path")),xt=require("fs/promises");var B=require("fs/promises"),St=require("path");async function H(t){try{return await oe(t)?JSON.parse(await(0,B.readFile)(t,{encoding:"utf-8"})):void 0}catch(e){throw new Error(`Error reading JSON file ${t}: ${e}`,{cause:e})}}async function vt(t,e){let r=JSON.stringify(e,null,4)+`
-`,i=await qn(t,r);await(0,B.writeFile)(t,i,{encoding:"utf-8"})}function U(t){return t?t.replace(/\?.*$/,""):""}async function oe(t){try{return await(0,B.access)(t,B.constants.F_OK),!0}catch{return!1}}async function wt(t){let e=(0,St.resolve)(t),r=await(0,B.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,St.resolve)(i.parentPath,i.name);i.isDirectory()?await wt(n):await(0,B.rm)(n)}await(0,B.rmdir)(e)}function bt(t,e){return`Basic ${Buffer.from(`${t}:${e}`).toString("base64")}`}async function be(t,e){let r=e?.user&&e?.pw?{Authorization:bt(e.user,e.pw)}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function qn(t,e){let r=await Jn();if(!r)return e;let i=await r.resolveConfig(t);return i?await r.format(e,{...i,filepath:t}):e}var Xn;function Jn(){return Xn??=import("prettier").catch(()=>{})}var ke={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4},se=["UNKNOWN","LOW","MEDIUM","HIGH","CRITICAL"];function K(t,e){return ke[t]-ke[e]}function er(t,e){return K(t,e)>=0?t:e}function Ve(t,e){return ke[t]<ke[e]}function tr(t){switch(t){case"Negligible":case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}function rr(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}function ir(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function nr(t){switch(t){case"CRITICAL":case"HIGH":return"error";case"MEDIUM":case"LOW":return"warning";default:return"note"}}var Pt=class t{constructor(e){this.workingDir=e}workingDir;static DEFAULT_MAVEN_REPO="https://repository.conterra.de/repository/maven-mirror-ct";static DEFAULT_VEX_SUBDIR="input/vex";static DEFAULT_OUT_SUBDIR="output";static DEFAULT_CACHE_SUBDIR="cache";static DEFAULT_SCANNERS=["grype","trivy","ossindex"];normalize(e,r){let i=e.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:r,onNewVulnerabilities:e.onNewVulnerabilities??(e.failOnNewVulnerabilities?"fail":"warn"),onNoLongerDetectedVulnerabilities:e.onNoLongerDetectedVulnerabilities??"ignore",reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities??!0,consoleReport:e.consoleReport??"BY_PROJECT_DETAILED",createSubDirsForProject:e.createSubDirsForProject??!0,mavenRepo:e.mavenRepo??t.DEFAULT_MAVEN_REPO,vexUrls:e.vexUrls??[],vexDir:this.resolvePath(e.vexDir)??(0,Y.resolve)(this.workingDir,t.DEFAULT_VEX_SUBDIR),outDir:this.resolvePath(e.outDir)??(0,Y.resolve)(this.workingDir,t.DEFAULT_OUT_SUBDIR),cacheDir:this.resolvePath(e.cacheDir)??(0,Y.resolve)(this.workingDir,t.DEFAULT_CACHE_SUBDIR),scanners:this.normalizeScanners(e.scanners,r),projects:this.normalizeProjects(e.projects??[],i)}}normalizeScanners(e,r){return(e??t.DEFAULT_SCANNERS).map(n=>{if(typeof n!="string")throw new Error(`Invalid scanner name '${String(n)}' in configuration file '${r}'`);let o=n.split("@");if(o.length>2)throw new Error(`Invalid scanner name '${n}' in configuration file '${r}'`);return{name:o[0],version:o[1]??""}})}normalizeProjects(e,r){return e.map(i=>{let n=i;if(!n.name)throw new Error("Project name is missing on entry: "+JSON.stringify(n));if(!n.version)throw new Error("Project version is missing on entry: "+JSON.stringify(n));if(!n.purl)throw new Error("Project purl is missing on entry: "+JSON.stringify(n));let o={...n,purlAliases:n.purlAliases??[],enabled:n.enabled??!0,silent:n.silent??!1,minimumSeverity:n.minimumSeverity??"UNKNOWN"};return o.sbomFile?{...o,sbomFile:this.resolvePath(o.sbomFile)??o.sbomFile}:{...o,detectNoLongerUsedVulnerabilities:r?o.purl.endsWith("-SNAPSHOT"):!0}})}resolvePath(e){if(e)return Y.default.isAbsolute(e)?e:(0,Y.resolve)(this.workingDir,e)}},xe=class{constructor(e){this.workingDir=e;this.normalizer=new Pt(e)}workingDir;normalizer;projectConfigCache;async loadProjectConfig(){return this.projectConfigCache??=this.doLoadProjectConfig(),this.projectConfigCache}async doLoadProjectConfig(){let e=(0,Y.resolve)(this.workingDir,"vuln-scan-conf.json"),r=await H(e);if(!r)throw new Error(`Missing project configuration file '${e}'`);return this.normalizer.normalize(r,e)}async loadJiraConfig(e){let r=await(0,xt.readFile)(e,"utf8"),i=JSON.parse(r);if(!i.issues&&i.issue&&(i.issues=i.issue),!i.jiraUrl||typeof i.jiraUrl!="string")throw new Error("jira-conf.json: missing or invalid 'jiraUrl' field");if(!Array.isArray(i.issues))throw new Error("jira-conf.json: missing or invalid 'issues' array");this.validateAutoCloseSeverity(i.autoCloseBelowSeverity,"jira-conf.json: invalid 'autoCloseBelowSeverity'");for(let[n,o]of i.issues.entries())o&&typeof o=="object"&&this.validateAutoCloseSeverity(o.autoCloseBelowSeverity,`jira-conf.json: invalid 'issues[${n}].autoCloseBelowSeverity'`);return i}validateAutoCloseSeverity(e,r){if(e!==void 0&&!se.includes(e))throw new Error(`${r} value '${String(e)}'. Must be one of: ${se.join(", ")}`)}async loadAutoVexConfig(e){let r=await(0,xt.readFile)(e,"utf8"),i=JSON.parse(r);if(!i.impactStatement||typeof i.impactStatement!="string")throw new Error("auto-vex-conf.json: missing or invalid 'impactStatement' field (must be a non-empty string)");if(i.maxSeverity!==void 0&&!se.includes(i.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'maxSeverity' value '${String(i.maxSeverity)}'. Must be one of: ${se.join(", ")}`);return i}};var Ie=require("fs/promises");async function or(t,e,r){if("sbomFile"in t)return await(0,Ie.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Ie.writeFile)(e,i),{...t,sbomFile:e}}var Ae=class{constructor(e,r){this.repo=e;this.authn=r}repo;authn;async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await be(i,this.authn);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await be(r,this.authn)).text();return Wn(n,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function Wn(t,e){if(e.classifier&&e.extension){let n=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(n?.[1])return n[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),i=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!i)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${i[1]}`}var pr=require("fs/promises"),Dt=require("path"),mr=require("crypto");var ar=require("crypto");var sr="auto_vex_max_severity=";function cr(t){let e=t.status_notes;if(!e||!e.startsWith(sr))return;let r=e.slice(sr.length).trim();return se.includes(r)?r:void 0}var Gn="https://openvex.dev/ns/v0.2.0";function lr(t,e="conterra"){let i=`https://openvex.dev/docs/public/vex-${(0,ar.randomUUID)()}`,n=t.timestamp??new Date().toISOString();return{"@context":Gn,"@id":i,author:e,timestamp:n,last_updated:n,version:1,statements:[t]}}function ur(t,e){let r=e.timestamp??new Date().toISOString();return{...t,last_updated:r,version:t.version+1,statements:[...t.statements,e]}}var Me=require("fs/promises"),Ne=require("path");var Re=class{constructor(e){this.location=e}location;_content=void 0;_exists=!1;get exists(){return this._exists}get content(){return this._content}set content(e){this._content=e,this._exists=e!==void 0}async read(){let e=await H(this.location);this._content=e??void 0,this._exists=this._content!==void 0}async write(){if(this._content===void 0)throw new Error(`Cannot write VexFile: content is undefined (${this.location})`);await(0,Me.mkdir)((0,Ne.dirname)((0,Ne.resolve)(this.location)),{recursive:!0}),await vt(this.location,this._content)}async delete(){await(0,Me.unlink)(this.location),this._exists=!1}upsert(e,r){return this._content===void 0?(this._content=lr(e,r),this._exists=!0,{created:!0}):(this._content=ur(this._content,e),{created:!1})}addProductId(e,r){this.assertContentLoaded("addProductId");let i=!1;for(let n of this._content.statements){if(!n.products||n.products.some(s=>s["@id"]===r))continue;let o=n.products.findIndex(s=>s["@id"]===e);o!==-1&&(n.products.splice(o+1,0,{"@id":r}),i=!0)}return i}removeProductId(e,r){this.assertContentLoaded("removeProductId");let i=this._content.statements,n=[],o=!1;for(let s of i){if(r&&!Lt(s).has(r)||!s.products)continue;let c=s.products.findIndex(m=>m["@id"]===e);c!==-1&&(s.products.splice(c,1),o=!0,s.products.length===0&&n.push(s))}if(!o)return"unchanged";for(let s of n)i.splice(i.indexOf(s),1);return i.length===0?"emptied":"changed"}hasStatementForProduct(e){return this.assertContentLoaded("hasStatementForProduct"),this._content.statements.some(r=>r.products?.some(i=>i["@id"]===e)??!1)}assertContentLoaded(e){if(this._content===void 0)throw new Error(`VexFile.${e}(): content is not loaded. Call read() first (${this.location})`)}};async function _e(t,e){for(let r of await(0,pr.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new Re((0,Dt.resolve)(r.parentPath,r.name))):r.isDirectory()&&await _e((0,Dt.resolve)(r.parentPath,r.name),e)}function Lt(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var le=class t{statements=[];filteredToProducts=[];static async fromUrl(e,r,i=new t){let o=await(await be(e,r)).json();return i.add(o),i}static async fromFiles(e,r=new t){return await _e(e,async i=>{await i.read(),i.content&&r.add(i.content)}),r}add(e){Kn(e);let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=Lt(i),c=new Set(i.products?.map(d=>d["@id"]).filter(d=>!!d)??[]),m=new Et(n,o,s,c,i);this.statements.push(m)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){this.assertCorrectProductId(e);let r=new t;return r.filteredToProducts=e.slice(0),r.statements=this.statements.filter(i=>i.matchesAtLeastOneProduct(e)),r}findNotMatchingVulnerabilities(e,r){let i=this.filterByProduct(r??this.filteredToProducts),n=new Set;for(let o of i.statements)n.add(o.vulnName);for(let o of e)n.delete(o);return Array.from(n)}newestVulnerabilityStatement(e,r,i){let n=this.filterByProduct(r??this.filteredToProducts);for(let o of n.statements)if(o.matchesVulnerability(e)){if(i!==void 0){let s=cr(o.statement);if(s!==void 0&&!Ve(i,s))continue}return this.reduceToProductInformation(o,n.filteredToProducts[0])}}toVexFileForProduct(e){let r=this.filterByProduct(e??this.filteredToProducts),i=r.statements.map(n=>this.reduceToProductInformation(n,r.filteredToProducts[0]));return this.toVexFile(i)}toVexFile(e){let r=e.filter(o=>o.status!=="under_investigation");if(r.length===0)return;this.sortVexStatementsByTimestampNewestFirst(r);let i=r[0].timestamp;return{"@context":"https://openvex.dev/ns/v0.2.0","@id":Qn(r),author:"conterra",timestamp:i,last_updated:i,version:1,statements:r}}toVexFileWithComponentIds(e){let r=e.filter(i=>i.vexStatement).map(i=>{let n={...i.vexStatement},o=(i.components??[]).map(s=>({"@id":s}));return n.products=[...n.products??[],...o],n});return this.toVexFile(r)}assertCorrectProductId(e){if(!e||e.length===0)throw new Error("Product ID must be provided");if(this.filteredToProducts.length&&!Hn(this.filteredToProducts,e))throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){let i={timestamp:new Date(e.timestamp).toISOString(),...e.statement};if(!r)return i;let n=i.products?.filter(o=>o["@id"]===r);return n?.length||(n=[{"@id":r}]),{...i,products:n}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}sortVexStatementsByTimestampNewestFirst(e){e.sort((r,i)=>Date.parse(i.timestamp)-Date.parse(r.timestamp))}};function Hn(t,e){return t.length===e.length&&t.every((r,i)=>r===e[i])}var Et=class{constructor(e,r,i,n,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=i;this.products=n;this.statement=o}timestamp;vulnName;vulnAliases;products;statement;matchesProduct(e){return this.products.has(e)}matchesAtLeastOneProduct(e){return e.some(this.matchesProduct.bind(this))}matchesVulnerability(e){return this.vulnAliases.has(e)}};function Kn(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}function Qn(t){let e=t.map(i=>`${i.vulnerability.name}:${i.status}`).sort().join("|");return`https://openvex.dev/docs/public/vex-${(0,mr.createHash)("sha256").update(e).digest("hex")}`}var Be=require("path"),fr=require("fs/promises");function zn(t){throw new Error(`Unhandled value: ${String(t)}`)}var $e=class{constructor(e,r,i){this.project=e;this.outputDir=r;this.useSubDirForProject=i}project;outputDir;useSubDirForProject;async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",i=`${this.project.name}-${this.project.version}-`,n=this.getFileSuffix(e),o=(0,Be.resolve)(this.outputDir,r,`${i}${n}`),s=(0,Be.dirname)(o);return await oe(s)||await(0,fr.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:return zn(e)}}};var dr=require("zx"),Z=class{async run(e){let{image:r,volumes:i=[],envArgs:n=[],args:o=[]}=e,s=i.flatMap(m=>["-v",m]),c=await dr.$`docker run --rm ${s} ${n} ${r} ${o}`.nothrow();return{stdout:c.stdout,stderr:c.stderr,exitCode:c.exitCode}}};var Ue=require("path");var ue=class{};var pe=class extends ue{runner=new Z;buildDockerEnvArgs(e){return[]}buildExtraVolumes(e){return[]}async scan(e,r,i,n,o){let s=await r.lookupOutputFileForWriting(this.getOutputFileKey()),c=(0,Ue.dirname)(s),d=`/tmp/output/${(0,Ue.basename)(s)}`,a=`${this.dockerImage}:${this.version||this.defaultVersion}`,p=`${c}:/tmp/output`,l=`${e.sbomFile}:/tmp/input.json`,u=this.buildExtraVolumes({outputDir:c,outputFile:s,sbomFile:e.sbomFile}),f=await this.runner.run({image:a,volumes:[p,l,...u],envArgs:this.buildDockerEnvArgs(n),args:this.buildDockerArgs({outputPath:d,verbose:n})});if(f.stdout&&o(` Scan log: ${f.stdout}`),f.stderr&&o(` Scan error: ${f.stderr}`),f.exitCode!==0)throw new Error(`${this.scannerLabel} scan failed with exit code ${f.exitCode}: ${f.stderr}`);o(`  ${this.scannerLabel} output file: ${s}`);try{let g=await H(s);this.parseAndAdd(g,i)}catch(g){throw new Error(`${this.scannerLabel} scan results could not be read from '${s}': ${g}`,{cause:g})}}};var hr="anchore/grype",qe=class t extends pe{constructor(r,i){super();this.version=r;this.cacheDir=i}version;cacheDir;dockerImage=hr;defaultVersion="latest";scannerLabel="Grype";async init(r){r&&console.log(`Initializing Grype DB in cache directory: ${this.cacheDir}`);let i=`${hr}:${this.version||this.defaultVersion}`,n=await new Z().run({image:i,volumes:[`${this.cacheDir}:/tmp/.cache`],envArgs:["-e","GRYPE_DB_CACHE_DIR=/tmp/.cache","-e","TMPDIR=/tmp"],args:["db","update"]});if(n.stdout&&console.log(` Grype DB Update: ${n.stdout}`),n.stderr&&console.log(` Grype DB Update error: ${n.stderr}`),n.exitCode!==0)throw new Error(`Grype DB update failed with exit code ${n.exitCode}: ${n.stderr}`)}getOutputFileKey(){return"grype-results"}buildExtraVolumes(r){return[`${this.cacheDir}:/tmp/.cache`]}buildDockerEnvArgs(r){return["-e","GRYPE_DB_CACHE_DIR=/tmp/.cache","-e","TMPDIR=/tmp","-e","GRYPE_DB_AUTO_UPDATE=false"]}buildDockerArgs(r){let i=["sbom:/tmp/input.json","-o","json","--file",r.outputPath,"--by-cve"];return r.verbose||i.push("--quiet"),i}parseAndAdd(r,i){if(r)for(let n of r.matches)i.addVulnerability(t.createVulnerability(n),"grype")}addVulnerabilities(r,i){this.parseAndAdd(i,r)}static createVulnerability(r){let i=r.vulnerability,n=tr(i.severity);return{id:i.id,severity:n,scannerSeverity:{grype:n},title:"",description:i.description,components:[U(r.artifact.purl)],detectedBy:["grype"],refs:[U(i.dataSource)]}}};var yr="aquasec/trivy",Yn="latest",Zn="public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db",Xe=class t extends pe{constructor(r,i,n){super();this.version=r;this.cacheDir=i;this.githubToken=n}version;cacheDir;githubToken;dockerImage=yr;defaultVersion=Yn;scannerLabel="Trivy";async init(r){let i=[];this.githubToken&&i.push("-e",`GITHUB_TOKEN=${this.githubToken}`);let n=["--db-repository",Zn,"--cache-dir","/.cache","sbom","--download-db-only"];r||n.push("--quiet");let o=`${yr}:${this.version||this.defaultVersion}`,s=await new Z().run({image:o,volumes:[`${this.cacheDir}:/.cache`],envArgs:i,args:n});if(!s.stdout&&!s.stderr&&console.log(" Trivy DB Update: finished"),s.stdout&&console.log(` Trivy DB Update: ${s.stdout}`),s.stderr&&console.log(` Trivy DB Update error: ${s.stderr}`),s.exitCode!==0)throw new Error(`Trivy DB update failed with exit code ${s.exitCode}: ${s.stderr}`)}getOutputFileKey(){return"trivy-results"}buildExtraVolumes(r){return[`${this.cacheDir}:/.cache`]}buildDockerArgs(r){let i=["sbom","--cache-dir","/.cache","--format","json","--output",r.outputPath,"--skip-db-update","/tmp/input.json"];return r.verbose||i.push("--quiet"),i}parseAndAdd(r,i){if(r){for(let n of r.Results??[])if(n.Vulnerabilities)for(let o of n.Vulnerabilities)i.addVulnerability(t.createVulnerability(o),"trivy")}}addVulnerabilities(r,i){this.parseAndAdd(i,r)}static createVulnerability(r){let i=rr(r.Severity);return{id:r.VulnerabilityID,severity:i,scannerSeverity:{trivy:i},title:r.Title,description:r.Description,components:[U(r.PkgIdentifier.PURL)],detectedBy:["trivy"],refs:[U(r.PrimaryURL)]}}};var wr=require("fs/promises");function Ct(t,e=""){return gr(t,e,new Set,new Set)}function gr(t,e="",r,i){let n=`${e}- ${t.purl}`;if(r.has(t.purl))return n+=" (cycle detected)",n;if(i.has(t.purl))return n+=" (deduplicated)",n;i.add(t.purl),r.add(t.purl);let o=r.size===1;for(let s of t.usedBy){let c=gr(s,e+(o?"    ":"  "),r,i);c!==""&&(n+=`
-`,n+=c)}return r.delete(t.purl),n}var me=class t{constructor(e){this.sbom=e;for(let r of this.sbom.components||[]){let i={purl:U(r.purl),usedBy:[]};i.purl&&(this.purlToComponent.has(i.purl)||(this.purlToComponent.set(i.purl,i),this.sbomRefToComponent.set(r["bom-ref"],i)))}for(let r of this.sbom.dependencies||[]){let i=this.sbomRefToComponent.get(r.ref);if(i)for(let n of r.dependsOn||[]){let o=this.sbomRefToComponent.get(n);o&&!o.usedBy.includes(i)&&o.usedBy.push(i)}}}sbom;static createForSbom(e){return new t(e)}static printTree(e,r=""){return Ct(e,r)}sbomRefToComponent=new Map;purlToComponent=new Map;findUsagesOfComponent(e){if(!this.sbom)return{purl:e,usedBy:[]};let r=this.purlToComponent.get(e);return r?Sr(r):{purl:e,usedBy:[]}}};function Sr(t,e=new Set){let r={purl:t.purl,usedBy:[]};if(e.has(t.purl))return r;e.add(t.purl);for(let i of t.usedBy){let n=Sr(i,new Set(e));r.usedBy.push(n)}return r}var fe=class t{constructor(e,r){this.filePath=e;this.sbom=r}filePath;sbom;static async fromFile(e){let r=await H(e);if(!r)throw new Error(`Could not read SBOM file '${e}'`);if(!r.components||r.components.length===0)throw new Error(`SBOM file '${e}' does not contain any components`);return new t(e,r)}get path(){return this.filePath}getComponents(){return this.sbom.components??[]}getExternalComponents(e=eo){return this.getComponents().filter(e)}buildDependencyTree(){return me.createForSbom(this.sbom)}};function eo(t){return!!t.purl}var Je=class{components=new Map;has(e){return this.components.has(e)}update(e,r){for(let i of r)this.components.set(U(i.coordinates),i);for(let i of e)this.components.has(i)||this.components.set(i,{coordinates:i,description:"",reference:"",vulnerabilities:[]})}read(e){let r=[];for(let i of e){let n=this.components.get(i);n&&r.push(n)}return r}};var vr=128,to="https://api.guide.sonatype.com",We=class t{cache=new Je;baseUrl;authHeader;constructor(e={}){this.baseUrl=e.baseUrl??to,e.user&&e.token&&(this.authHeader=bt(e.user,e.token))}async fetchVulnerableComponents(e,r){let i=new Set(e.map(m=>m.replace(/\?.*$/,"")));t.addSnapshotBaseCoordinates(i);let n=Array.from(i),o=n.filter(m=>!this.cache.has(m));r?.(`  Sonatype OssIndex: ${o.length} packages to fetch, ${n.length-o.length} cache hits`);let s=this.authHeader?"/authorized":"",c=`${this.baseUrl}/api/v3${s}/component-report`;for(let m=0;m<o.length;m+=vr){let d=o.slice(m,m+vr),a=JSON.stringify({coordinates:d});r?.(`  Sonatype OssIndex request ${c} with body: ${a}`);let p={"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"};this.authHeader&&(p.Authorization=this.authHeader);let u=await(await fetch(c,{method:"POST",headers:p,body:a})).json();Array.isArray(u)?this.cache.update(d,u):r?.(`  Sonatype OssIndex Error: ${u.code} - ${u.message}`)}return this.cache.read(n).filter(m=>m.vulnerabilities.length>0)}static addSnapshotBaseCoordinates(e){let r=/(-SNAPSHOT|-\d{8}\.\d{6}-\d+)(?=(?:\?|$))/;for(let i of Array.from(e)){let n=i.replace(r,"");n!==i&&e.add(n)}}};var Ge=class t extends ue{client;constructor(e={}){super(),this.client=new We(e)}async init(){}async scan(e,r,i,n,o){let s=await r.lookupOutputFileForWriting("ossindex-results");try{let d=(await fe.fromFile(e.sbomFile)).getExternalComponents(l=>!!l.purl&&!ro(l)).map(l=>l.purl),a=n?l=>o(`  [${e.name}] ${l}`):void 0,p=await this.client.fetchVulnerableComponents(d,a);await(0,wr.writeFile)(s,JSON.stringify(p,null,2)),o(`  Sonatype OssIndex output file: ${s}`),this.addVulnerabilities(i,p)}catch(c){throw new Error(`Sonatype OSS Index scan failed: ${c}`,{cause:c})}}addVulnerabilities(e,r){if(r)for(let i of r)for(let n of i.vulnerabilities)e.addVulnerability(t.createVulnerability(n,i.coordinates),"ossindex")}static createVulnerability(e,r){let i=U(e.reference),n=ir(e.cvssScore);return{id:e.cve||e.id,severity:n,scannerSeverity:{ossindex:n},title:e.title,description:e.description,components:[U(r)],detectedBy:["ossindex"],refs:i?[i]:[]}}};function ro(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function io(t,e,r){switch(t.name){case"grype":return new qe(t.version,e);case"trivy":return new Xe(t.version,e,r.trivyGithubToken);case"ossindex":return new Ge({user:r.ossIndexApiUser,token:r.ossIndexApiToken,baseUrl:r.ossIndexBaseUrl})}}var He=class{scanners;constructor(e,r,i){this.scanners=e.map(n=>io(n,r,i))}async init(e){await Promise.all(this.scanners.map(r=>r.init(e)))}async scanProject(e,r,i,n,o){await Promise.all(this.scanners.map(s=>s.scan(e,r,i,n,o)))}};async function br(t,e,r){await _e(t,async i=>{await i.read();let n=i.removeProductId(e,r);n==="emptied"?(console.info(`Remove ${e} from ${i.location} and delete file.`),await i.delete()):n==="changed"&&(console.info(`Remove ${e} from ${i.location}`),await i.write())})}var Lr=require("fs/promises"),Dr=require("path");var Ke=class{data={hasError:!1,hasNewVuln:!1,hasNoLongerDetectedVuln:!1,cveDetails:new Map,vulnToProjects:new Map,noLongerDetectedVulnToProjects:new Map,projectToVulns:new Map,projectToNotLongerDetectedVulns:new Map,projectErrors:[],projectsToComponents:new Map};feed(e){let r=e.project,i=`${r.name}@${r.version}`;if(e.error&&(this.data.hasError=!0,this.data.projectErrors.push({project:i,error:e.error.message})),r.silent)return;let n=e.newVulns.filter(o=>!Ve(o.severity,r.minimumSeverity));for(let o of n){this.data.hasNewVuln=!0,this.mergeVulnDetails(o),this.data.vulnToProjects.has(o.id)||this.data.vulnToProjects.set(o.id,[]),this.data.projectToVulns.has(i)||this.data.projectToVulns.set(i,[]),this.data.projectsToComponents.has(i)||this.data.projectsToComponents.set(i,new Map),this.data.projectToVulns.get(i).push(o.id),this.data.vulnToProjects.get(o.id).push(i);for(let s of o.componentTree){if(!s.purl)continue;let c=this.data.projectsToComponents.get(i);c.has(s.purl)||c.set(s.purl,s)}}for(let o of e.noLongerDetectedVulns)this.data.hasNoLongerDetectedVuln=!0,this.data.noLongerDetectedVulnToProjects.has(o)||this.data.noLongerDetectedVulnToProjects.set(o,[]),this.data.projectToNotLongerDetectedVulns.has(i)||this.data.projectToNotLongerDetectedVulns.set(i,[]),this.data.projectToNotLongerDetectedVulns.get(i).push(o),this.data.noLongerDetectedVulnToProjects.get(o).push(i)}feedAll(e){for(let r of e.values())this.feed(r)}getData(){return this.data}toScanSummary(){let{data:e}=this;return{errors:e.projectErrors,vulnerabilities:Object.fromEntries(e.cveDetails),vulnerabilityToProject:Object.fromEntries(e.vulnToProjects.entries()),projectToVulnerability:Object.fromEntries(e.projectToVulns.entries()),projectsToComponents:Object.fromEntries(Array.from(e.projectsToComponents.entries()).map(([r,i])=>[r,Object.fromEntries(i.entries())])),noLongerDetectedVulnerabilities:Object.fromEntries(e.noLongerDetectedVulnToProjects)}}mergeVulnDetails(e){if(!this.data.cveDetails.has(e.id)){this.data.cveDetails.set(e.id,{id:e.id,title:e.title,severity:e.severity,description:e.description,components:e.components,refs:e.refs});return}let r=this.data.cveDetails.get(e.id);r.title=r.title||e.title,r.severity=K(r.severity,e.severity)>=0?r.severity:e.severity,r.description=r.description||e.description,r.components=xr(r.components,e.components),r.refs=xr(r.refs,e.refs)}};function xr(t,e){return Array.from(new Set([...t,...e]))}var ze=require("fs/promises"),Pr=require("path");var Qe=class{constructor(e={}){this.options=e}options;summaryLogFile;async render(e){let{orderBy:r="CVE",reportNoLongerDetectedVulnerabilities:i=!0,reportCveDetails:n=!1,outputDirectory:o}=this.options;return o&&(this.summaryLogFile=(0,Pr.join)(o,"scan-summary.txt"),await(0,ze.writeFile)(this.summaryLogFile,"","utf8")),await this.log("=== Scan summary ==="),e.projectErrors.length&&await this.logErrors(e.projectErrors),n&&await this.logCveDetails(e.cveDetails,e.projectsToComponents),r==="CVE"?await this.logOrderedByCve(e.vulnToProjects,e.cveDetails,i?e.noLongerDetectedVulnToProjects:new Map):await this.logOrderedByProject(e.projectToVulns,i?e.projectToNotLongerDetectedVulns:new Map,e.cveDetails),!e.hasError&&!e.hasNewVuln&&(!e.hasNoLongerDetectedVuln||!i)&&await this.log("  No issues found"),{hasError:e.hasError,hasNewVuln:e.hasNewVuln,hasNoLongerDetectedVuln:e.hasNoLongerDetectedVuln}}async log(e){console.log(e),this.summaryLogFile&&await(0,ze.appendFile)(this.summaryLogFile,e+`
-`,"utf8")}async logErrors(e){await this.log(""),await this.log("- Errors during scan:");for(let{project:r,error:i}of e)await this.log(`    - ${r}:`),await this.log(`        Error: ${i}`)}async logOrderedByCve(e,r,i){let n=Array.from(e.keys()).sort(Ot(s=>r.get(s)));if(n.length){await this.log(""),await this.log("- New vulnerabilities:");for(let s of n){let c=e.get(s),{severity:m}=r.get(s);await this.log(`    - [${m}] ${s}`);for(let d of c.slice().sort())await this.log(`        - ${d}`)}}let o=Array.from(i.keys()).sort();if(o.length){await this.log(""),await this.log("- Declared but no longer detected vulnerabilities:");for(let s of o){let c=i.get(s);await this.log(`    - ${s}`);for(let m of c.slice().sort())await this.log(`        - ${m}`)}}}async logOrderedByProject(e,r,i){let n=new Set([...Array.from(e.keys()),...Array.from(r.keys())]),o=Array.from(n.keys()).sort();if(o.length){await this.log(""),await this.log("- Vulnerabilities by project:");for(let s of o){await this.log(`    - ${s}:`);let c=e.get(s)??[];for(let d of c.slice().sort(Ot(a=>i.get(a)))){let{severity:a}=i.get(d);await this.log(`        - [${a}] ${d}`)}let m=(r.get(s)??[]).slice().sort();for(let d of m)await this.log(`        - ${d} (no longer detected)`)}}}async logCveDetails(e,r){if(e.size===0)return;await this.log(""),await this.log("- Vulnerability details:");let i=Array.from(e.keys()).sort(Ot(n=>e.get(n)));for(let n of i){let o=e.get(n);if(await this.log(`    - [${o.severity}] ${o.id} - ${o.title||""}:`),o.description){await this.log("        Description:");for(let s of o.description.split(/\r?\n/))await this.log(`          ${s}`)}if(o.components.length){await this.log("        Components:");for(let s of o.components)await this.log("          - "+s);if(r){for(let s of o.components)for(let[c,m]of r.entries())if(m.has(s)){await this.log(`          Usage Tree of ${s} by ${c} (as example):`),await this.log(me.printTree(m.get(s),"            "));break}}}if(o.refs.length){await this.log("        Links:");for(let s of o.refs)await this.log(`          - ${s}`)}}}};function Ot(t){return(e,r)=>{let i=K(t(r).severity,t(e).severity);return i!==0?i:e.localeCompare(r)}}async function Er(t,e){let r=new Ke;r.feedAll(t);let i=r.getData(),o=await new Qe(e).render(i);if(e.outputDirectory){let s=(0,Dr.join)(e.outputDirectory,"scan-summary.json");await(0,Lr.writeFile)(s,JSON.stringify(r.toScanSummary(),null,2),"utf8")}return o}var ft=require("fs/promises");var Ye=class{constructor(e){this.depProvider=e}depProvider;allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=K(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById,o=e;if(!n.has(i))n.set(i,e),o=e;else{let s=n.get(i);s.title=s.title||e.title,s.severity=er(s.severity,e.severity),s.scannerSeverity[r]=e.severity,s.detectedBy=jt(s.detectedBy,r),s.components=jt(s.components,e.components[0]),s.refs=jt(s.refs,e.refs[0]),o=s}o.componentTree=o.components?.map(s=>this.depProvider.findUsagesOfComponent(s))}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id,void 0,i.severity);if(!n){r.push({id:i.id,severity:i.severity,title:i.title,description:i.description,components:i.components??[],componentTree:i.componentTree??[],refs:i.refs});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function jt(t,e){return e==null?t:Array.from(new Set([...t,e]).values())}var ne=Te(Fn());var Vn=Te(kn());var Kt={kind:"external",status:"accepted"};function An(t,e){let r=new ne.SarifRunBuilder().initSimple({toolDriverName:`${e.name}@${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=nr(o.severity),c=o.id,m=xa(o.refs),d=new ne.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:m}),a=o.vexStatement,p,l="new",u="";a?(p=[{...Kt}],l="updated",u=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(p[0].status="underReview",u="--- UNDER INVESTIGATION --- ")):K(e.minimumSeverity,o.severity)>0?(p=[{...Kt}],l="updated",u=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(p=[{...Kt}],l="updated",u="--- PROJECT SILENT ---"),Object.assign(d.rule,{name:`${u}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:Pa(o,m,u)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(d);for(let f of o.components){let g=new ne.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${f}`});g.result.message.id="default",g.result.locations=[{logicalLocations:[{fullyQualifiedName:f}]}],g.result.baselineState=l,g.result.suppressions=p,r.addResult(g)}}let n=new ne.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function xa(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function Pa(t,e,r){let i=t.vexStatement,n=i?`
+	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=Oe.checkPathsSync(t,e,"copy",r);if(Oe.checkParentPathsSync(t,n,e,"copy"),r.filter&&!r.filter(t,e))return;let o=De.dirname(e);return N.existsSync(o)||qo(o),an(i,t,e,r)}function an(t,e,r,n){let o=(n.dereference?N.statSync:N.lstatSync)(e);if(o.isDirectory())return Yo(o,t,e,r,n);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Wo(o,t,e,r,n);if(o.isSymbolicLink())return ts(t,e,r,n);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function Wo(t,e,r,n,i){return e?Go(t,r,n,i):cn(t,r,n,i)}function Go(t,e,r,n){if(n.overwrite)return N.unlinkSync(r),cn(t,e,r,n);if(n.errorOnExist)throw new Error(`'${r}' already exists`)}function cn(t,e,r,n){return N.copyFileSync(e,r),n.preserveTimestamps&&Ho(t.mode,e,r),Ut(r,t.mode)}function Ho(t,e,r){return Ko(t)&&Qo(r,t),zo(e,r)}function Ko(t){return(t&128)===0}function Qo(t,e){return Ut(t,e|128)}function Ut(t,e){return N.chmodSync(t,e)}function zo(t,e){let r=N.statSync(t);return Xo(e,r.atime,r.mtime)}function Yo(t,e,r,n,i){return e?ln(r,n,i):Zo(t.mode,r,n,i)}function Zo(t,e,r,n){return N.mkdirSync(r),ln(e,r,n),Ut(r,t)}function ln(t,e,r){let n=N.opendirSync(t);try{let i;for(;(i=n.readSync())!==null;)es(i.name,t,e,r)}finally{n.closeSync()}}function es(t,e,r,n){let i=De.join(e,t),o=De.join(r,t);if(n.filter&&!n.filter(i,o))return;let{destStat:s}=Oe.checkPathsSync(i,o,"copy",n);return an(s,i,o,n)}function ts(t,e,r,n){let i=N.readlinkSync(e);if(n.dereference&&(i=De.resolve(process.cwd(),i)),t){let o;try{o=N.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return N.symlinkSync(i,r);throw s}if(n.dereference&&(o=De.resolve(process.cwd(),o)),Oe.isSrcSubdir(i,o))throw new Error(`Cannot copy '${i}' to a subdirectory of itself, '${o}'.`);if(Oe.isSrcSubdir(o,i))throw new Error(`Cannot overwrite '${o}' with '${i}'.`);return rs(i,r)}else return N.symlinkSync(i,r)}function rs(t,e){return N.unlinkSync(e),N.symlinkSync(t,e)}un.exports=Jo});var ot=y((fl,fn)=>{"use strict";var ns=O().fromPromise;fn.exports={copy:ns(sn()),copySync:pn()}});var Ce=y((ml,dn)=>{"use strict";var mn=he(),is=O().fromCallback;function os(t,e){mn.rm(t,{recursive:!0,force:!0},e)}function ss(t){mn.rmSync(t,{recursive:!0,force:!0})}dn.exports={remove:is(os),removeSync:ss}});var xn=y((dl,bn)=>{"use strict";var as=O().fromPromise,gn=M(),Sn=require("path"),vn=q(),wn=Ce(),hn=as(async function(e){let r;try{r=await gn.readdir(e)}catch{return vn.mkdirs(e)}return Promise.all(r.map(n=>wn.remove(Sn.join(e,n))))});function yn(t){let e;try{e=gn.readdirSync(t)}catch{return vn.mkdirsSync(t)}e.forEach(r=>{r=Sn.join(t,r),wn.removeSync(r)})}bn.exports={emptyDirSync:yn,emptydirSync:yn,emptyDir:hn,emptydir:hn}});var En=y((hl,jn)=>{"use strict";var cs=O().fromPromise,Pn=require("path"),Y=M(),Ln=q();async function ls(t){let e;try{e=await Y.stat(t)}catch{}if(e&&e.isFile())return;let r=Pn.dirname(t),n=null;try{n=await Y.stat(r)}catch(i){if(i.code==="ENOENT"){await Ln.mkdirs(r),await Y.writeFile(t,"");return}else throw i}n.isDirectory()?await Y.writeFile(t,""):await Y.readdir(r)}function us(t){let e;try{e=Y.statSync(t)}catch{}if(e&&e.isFile())return;let r=Pn.dirname(t);try{Y.statSync(r).isDirectory()||Y.readdirSync(r)}catch(n){if(n&&n.code==="ENOENT")Ln.mkdirsSync(r);else throw n}Y.writeFileSync(t,"")}jn.exports={createFile:cs(ls),createFileSync:us}});var Fn=y((yl,kn)=>{"use strict";var ps=O().fromPromise,Dn=require("path"),ne=M(),On=q(),{pathExists:fs}=re(),{areIdentical:Cn}=ce();async function ms(t,e){let r;try{r=await ne.lstat(e)}catch{}let n;try{n=await ne.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&Cn(n,r))return;let i=Dn.dirname(e);await fs(i)||await On.mkdirs(i),await ne.link(t,e)}function ds(t,e){let r;try{r=ne.lstatSync(e)}catch{}try{let o=ne.lstatSync(t);if(r&&Cn(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let n=Dn.dirname(e);return ne.existsSync(n)||On.mkdirsSync(n),ne.linkSync(t,e)}kn.exports={createLink:ps(ms),createLinkSync:ds}});var Vn=y((gl,Tn)=>{"use strict";var ie=require("path"),ke=M(),{pathExists:hs}=re(),ys=O().fromPromise;async function gs(t,e){if(ie.isAbsolute(t)){try{await ke.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ie.dirname(e),n=ie.join(r,t);if(await hs(n))return{toCwd:n,toDst:t};try{await ke.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ie.relative(r,t)}}function Ss(t,e){if(ie.isAbsolute(t)){if(!ke.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ie.dirname(e),n=ie.join(r,t);if(ke.existsSync(n))return{toCwd:n,toDst:t};if(!ke.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ie.relative(r,t)}}Tn.exports={symlinkPaths:ys(gs),symlinkPathsSync:Ss}});var Rn=y((Sl,In)=>{"use strict";var An=M(),vs=O().fromPromise;async function ws(t,e){if(e)return e;let r;try{r=await An.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function bs(t,e){if(e)return e;let r;try{r=An.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}In.exports={symlinkType:vs(ws),symlinkTypeSync:bs}});var $n=y((vl,_n)=>{"use strict";var xs=O().fromPromise,Mn=require("path"),X=M(),{mkdirs:Ps,mkdirsSync:Ls}=q(),{symlinkPaths:js,symlinkPathsSync:Es}=Vn(),{symlinkType:Ds,symlinkTypeSync:Os}=Rn(),{pathExists:Cs}=re(),{areIdentical:Nn}=ce();async function ks(t,e,r){let n;try{n=await X.lstat(e)}catch{}if(n&&n.isSymbolicLink()){let[a,f]=await Promise.all([X.stat(t),X.stat(e)]);if(Nn(a,f))return}let i=await js(t,e);t=i.toDst;let o=await Ds(i.toCwd,r),s=Mn.dirname(e);return await Cs(s)||await Ps(s),X.symlink(t,e,o)}function Fs(t,e,r){let n;try{n=X.lstatSync(e)}catch{}if(n&&n.isSymbolicLink()){let a=X.statSync(t),f=X.statSync(e);if(Nn(a,f))return}let i=Es(t,e);t=i.toDst,r=Os(i.toCwd,r);let o=Mn.dirname(e);return X.existsSync(o)||Ls(o),X.symlinkSync(t,e,r)}_n.exports={createSymlink:xs(ks),createSymlinkSync:Fs}});var Hn=y((wl,Gn)=>{"use strict";var{createFile:Bn,createFileSync:Un}=En(),{createLink:qn,createLinkSync:Xn}=Fn(),{createSymlink:Jn,createSymlinkSync:Wn}=$n();Gn.exports={createFile:Bn,createFileSync:Un,ensureFile:Bn,ensureFileSync:Un,createLink:qn,createLinkSync:Xn,ensureLink:qn,ensureLinkSync:Xn,createSymlink:Jn,createSymlinkSync:Wn,ensureSymlink:Jn,ensureSymlinkSync:Wn}});var st=y((bl,Kn)=>{function Ts(t,{EOL:e=`
+`,finalEOL:r=!0,replacer:n=null,spaces:i}={}){let o=r?e:"";return JSON.stringify(t,n,i).replace(/\n/g,e)+o}function Vs(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Kn.exports={stringify:Ts,stripBom:Vs}});var Zn=y((xl,Yn)=>{var Se;try{Se=he()}catch{Se=require("fs")}var at=O(),{stringify:Qn,stripBom:zn}=st();async function As(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||Se,n="throws"in e?e.throws:!0,i=await at.fromCallback(r.readFile)(t,e);i=zn(i);let o;try{o=JSON.parse(i,e?e.reviver:null)}catch(s){if(n)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Is=at.fromPromise(As);function Rs(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||Se,n="throws"in e?e.throws:!0;try{let i=r.readFileSync(t,e);return i=zn(i),JSON.parse(i,e.reviver)}catch(i){if(n)throw i.message=`${t}: ${i.message}`,i;return null}}async function Ms(t,e,r={}){let n=r.fs||Se,i=Qn(e,r);await at.fromCallback(n.writeFile)(t,i,r)}var Ns=at.fromPromise(Ms);function _s(t,e,r={}){let n=r.fs||Se,i=Qn(e,r);return n.writeFileSync(t,i,r)}Yn.exports={readFile:Is,readFileSync:Rs,writeFile:Ns,writeFileSync:_s}});var ti=y((Pl,ei)=>{"use strict";var ct=Zn();ei.exports={readJson:ct.readFile,readJsonSync:ct.readFileSync,writeJson:ct.writeFile,writeJsonSync:ct.writeFileSync}});var lt=y((Ll,ii)=>{"use strict";var $s=O().fromPromise,qt=M(),ri=require("path"),ni=q(),Bs=re().pathExists;async function Us(t,e,r="utf-8"){let n=ri.dirname(t);return await Bs(n)||await ni.mkdirs(n),qt.writeFile(t,e,r)}function qs(t,...e){let r=ri.dirname(t);qt.existsSync(r)||ni.mkdirsSync(r),qt.writeFileSync(t,...e)}ii.exports={outputFile:$s(Us),outputFileSync:qs}});var si=y((jl,oi)=>{"use strict";var{stringify:Xs}=st(),{outputFile:Js}=lt();async function Ws(t,e,r={}){let n=Xs(e,r);await Js(t,n,r)}oi.exports=Ws});var ci=y((El,ai)=>{"use strict";var{stringify:Gs}=st(),{outputFileSync:Hs}=lt();function Ks(t,e,r){let n=Gs(e,r);Hs(t,n,r)}ai.exports=Ks});var ui=y((Dl,li)=>{"use strict";var Qs=O().fromPromise,_=ti();_.outputJson=Qs(si());_.outputJsonSync=ci();_.outputJSON=_.outputJson;_.outputJSONSync=_.outputJsonSync;_.writeJSON=_.writeJson;_.writeJSONSync=_.writeJsonSync;_.readJSON=_.readJson;_.readJSONSync=_.readJsonSync;li.exports=_});var hi=y((Ol,di)=>{"use strict";var zs=M(),pi=require("path"),{copy:Ys}=ot(),{remove:mi}=Ce(),{mkdirp:Zs}=q(),{pathExists:ea}=re(),fi=ce();async function ta(t,e,r={}){let n=r.overwrite||r.clobber||!1,{srcStat:i,isChangingCase:o=!1}=await fi.checkPaths(t,e,"move",r);await fi.checkParentPaths(t,i,e,"move");let s=pi.dirname(e);return pi.parse(s).root!==s&&await Zs(s),ra(t,e,n,o)}async function ra(t,e,r,n){if(!n){if(r)await mi(e);else if(await ea(e))throw new Error("dest already exists.")}try{await zs.rename(t,e)}catch(i){if(i.code!=="EXDEV")throw i;await na(t,e,r)}}async function na(t,e,r){return await Ys(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),mi(t)}di.exports=ta});var wi=y((Cl,vi)=>{"use strict";var gi=he(),Jt=require("path"),ia=ot().copySync,Si=Ce().removeSync,oa=q().mkdirpSync,yi=ce();function sa(t,e,r){r=r||{};let n=r.overwrite||r.clobber||!1,{srcStat:i,isChangingCase:o=!1}=yi.checkPathsSync(t,e,"move",r);return yi.checkParentPathsSync(t,i,e,"move"),aa(e)||oa(Jt.dirname(e)),ca(t,e,n,o)}function aa(t){let e=Jt.dirname(t);return Jt.parse(e).root===e}function ca(t,e,r,n){if(n)return Xt(t,e,r);if(r)return Si(e),Xt(t,e,r);if(gi.existsSync(e))throw new Error("dest already exists.");return Xt(t,e,r)}function Xt(t,e,r){try{gi.renameSync(t,e)}catch(n){if(n.code!=="EXDEV")throw n;return la(t,e,r)}}function la(t,e,r){return ia(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),Si(t)}vi.exports=sa});var xi=y((kl,bi)=>{"use strict";var ua=O().fromPromise;bi.exports={move:ua(hi()),moveSync:wi()}});var Li=y((Fl,Pi)=>{"use strict";Pi.exports={...M(),...ot(),...xn(),...Hn(),...ui(),...q(),...xi(),...lt(),...re(),...Ce()}});var ji=y(ut=>{"use strict";Object.defineProperty(ut,"__esModule",{value:!0});ut.EXTENSIONS_LANGUAGES=void 0;ut.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"TypeScript",tsx:"TypeScript",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var Fe=y(Wt=>{"use strict";Object.defineProperty(Wt,"__esModule",{value:!0});Wt.setOptionValues=pa;function pa(t,e){for(let r of Object.keys(t))t[r]!==void 0&&(e[r]=t[r]);return e}});var Di=y(J=>{"use strict";var fa=J&&J.__createBinding||(Object.create?(function(t,e,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(e,r);(!i||("get"in i?!e.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(t,n,i)}):(function(t,e,r,n){n===void 0&&(n=r),t[n]=e[r]})),ma=J&&J.__setModuleDefault||(Object.create?(function(t,e){Object.defineProperty(t,"default",{enumerable:!0,value:e})}):function(t,e){t.default=e}),da=J&&J.__importStar||(function(){var t=function(e){return t=Object.getOwnPropertyNames||function(r){var n=[];for(var i in r)Object.prototype.hasOwnProperty.call(r,i)&&(n[n.length]=i);return n},t(e)};return function(e){if(e&&e.__esModule)return e;var r={};if(e!=null)for(var n=t(e),i=0;i<n.length;i++)n[i]!=="default"&&fa(r,e,n[i]);return ma(r,e),r}})();Object.defineProperty(J,"__esModule",{value:!0});J.SarifBuilder=void 0;var Ei=da(Li()),ha=ji(),ya=Fe(),Gt=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,ya.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Ei.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Ei.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,n,i,o,s,a;e.artifacts=e.artifacts||[];let f=new Set(e.artifacts.map(p=>{var l;return(l=p?.location)===null||l===void 0?void 0:l.uri}).filter(Boolean));for(let p of e.results||[])for(let l of p.locations||[]){let u=(n=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||n===void 0?void 0:n.uri;if(u&&!f.has(u)){let m=u.lastIndexOf("."),g=m!==-1?u.slice(m+1):"",v=ha.EXTENSIONS_LANGUAGES[g]||"unknown";e.artifacts.push({sourceLanguage:v,location:{uri:u}}),f.add(u)}}let d=new Map;e.artifacts.forEach((p,l)=>{var u;let m=(u=p?.location)===null||u===void 0?void 0:u.uri;m&&d.set(m,l)});let c=new Map;(((o=(i=e?.tool)===null||i===void 0?void 0:i.driver)===null||o===void 0?void 0:o.rules)||[]).forEach((p,l)=>{c.set(p.id,l)});for(let p of e.results||[]){if(p.ruleId){let l=c.get(p.ruleId);l!==void 0&&(p.ruleIndex=l)}if(p.locations)for(let l of p.locations){let u=(a=(s=l?.physicalLocation)===null||s===void 0?void 0:s.artifactLocation)===null||a===void 0?void 0:a.uri;if(u){let m=d.get(u);m!==void 0&&(l.physicalLocation.artifactLocation.index=m)}}}return e}};J.SarifBuilder=Gt});var Oi=y(pt=>{"use strict";Object.defineProperty(pt,"__esModule",{value:!0});pt.SarifResultBuilder=void 0;var ga=Fe(),Ht=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,ga.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){this.manageInitLocation(),!this.result.locations[0].physicalLocation&&(this.result.locations[0].physicalLocation={})}};pt.SarifResultBuilder=Ht});var Ci=y(ft=>{"use strict";Object.defineProperty(ft,"__esModule",{value:!0});ft.SarifRuleBuilder=void 0;var Sa=Fe(),Kt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,Sa.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};ft.SarifRuleBuilder=Kt});var ki=y(mt=>{"use strict";Object.defineProperty(mt,"__esModule",{value:!0});mt.SarifRunBuilder=void 0;var va=Fe(),Qt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,va.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};mt.SarifRunBuilder=Qt});var Fi=y(W=>{"use strict";Object.defineProperty(W,"__esModule",{value:!0});W.SarifResultBuilder=W.SarifRuleBuilder=W.SarifRunBuilder=W.SarifBuilder=void 0;var wa=Di();Object.defineProperty(W,"SarifBuilder",{enumerable:!0,get:function(){return wa.SarifBuilder}});var ba=Oi();Object.defineProperty(W,"SarifResultBuilder",{enumerable:!0,get:function(){return ba.SarifResultBuilder}});var xa=Ci();Object.defineProperty(W,"SarifRuleBuilder",{enumerable:!0,get:function(){return xa.SarifRuleBuilder}});var Pa=ki();Object.defineProperty(W,"SarifRunBuilder",{enumerable:!0,get:function(){return Pa.SarifRunBuilder}})});var Vi=y((_l,Ti)=>{"use strict";var La=/["'&<>]/;Ti.exports=ja;function ja(t){var e=""+t,r=La.exec(e);if(!r)return e;var n,i="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:n="&quot;";break;case 38:n="&amp;";break;case 39:n="&#39;";break;case 60:n="&lt;";break;case 62:n="&gt;";break;default:continue}s!==o&&(i+=e.substring(s,o)),s=o+1,i+=n}return s!==o?i+e.substring(s,o):i}});var Yt=require("fs/promises");var Z=Te(require("path")),Pt=require("fs/promises");var B=require("fs/promises"),vt=require("path");async function H(t){try{return await se(t)?JSON.parse(await(0,B.readFile)(t,{encoding:"utf-8"})):void 0}catch(e){throw new Error(`Error reading JSON file ${t}: ${e}`,{cause:e})}}async function wt(t,e){let r=JSON.stringify(e,null,4)+`
+`,n=await Xi(t,r);await(0,B.writeFile)(t,n,{encoding:"utf-8"})}function U(t){return t?t.replace(/\?.*$/,""):""}async function se(t){try{return await(0,B.access)(t,B.constants.F_OK),!0}catch{return!1}}async function bt(t){let e=(0,vt.resolve)(t),r=await(0,B.readdir)(e,{withFileTypes:!0});for(let n of r){let i=(0,vt.resolve)(n.parentPath,n.name);n.isDirectory()?await bt(i):await(0,B.rm)(i)}await(0,B.rmdir)(e)}function xt(t,e){return`Basic ${Buffer.from(`${t}:${e}`).toString("base64")}`}async function be(t,e){let r=e?.user&&e?.pw?{Authorization:xt(e.user,e.pw)}:{},n=await fetch(t,{headers:r});if(!n.ok){let i="";try{i=await n.text()}catch(o){i=`${o}`}throw new Error(`Failed to fetch: ${t}: ${n.status} - ${n.statusText}: ${i}`)}return n}async function Xi(t,e){let r=await Wi();if(!r)return e;let n=await r.resolveConfig(t);return n?await r.format(e,{...n,filepath:t}):e}var Ji;function Wi(){return Ji??=import("prettier").catch(()=>{})}var Ve={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4},K=["UNKNOWN","LOW","MEDIUM","HIGH","CRITICAL"];function Q(t,e){return Ve[t]-Ve[e]}function rr(t,e){return Q(t,e)>=0?t:e}function Ae(t,e){return Ve[t]<Ve[e]}function nr(t){switch(t){case"Negligible":case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}function ir(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}function or(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function sr(t){switch(t){case"CRITICAL":case"HIGH":return"error";case"MEDIUM":case"LOW":return"warning";default:return"note"}}var Lt=class t{constructor(e){this.workingDir=e}workingDir;static DEFAULT_MAVEN_REPO="https://repository.conterra.de/repository/maven-mirror-ct";static DEFAULT_VEX_SUBDIR="input/vex";static DEFAULT_OUT_SUBDIR="output";static DEFAULT_CACHE_SUBDIR="cache";static DEFAULT_SCANNERS=["grype","trivy","ossindex"];normalize(e,r){let n=e.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:r,onNewVulnerabilities:e.onNewVulnerabilities??(e.failOnNewVulnerabilities?"fail":"warn"),onNoLongerDetectedVulnerabilities:e.onNoLongerDetectedVulnerabilities??"ignore",reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities??!0,consoleReport:e.consoleReport??"BY_PROJECT_DETAILED",createSubDirsForProject:e.createSubDirsForProject??!0,mavenRepo:e.mavenRepo??t.DEFAULT_MAVEN_REPO,vexUrls:e.vexUrls??[],vexDir:this.resolvePath(e.vexDir)??(0,Z.resolve)(this.workingDir,t.DEFAULT_VEX_SUBDIR),outDir:this.resolvePath(e.outDir)??(0,Z.resolve)(this.workingDir,t.DEFAULT_OUT_SUBDIR),cacheDir:this.resolvePath(e.cacheDir)??(0,Z.resolve)(this.workingDir,t.DEFAULT_CACHE_SUBDIR),scanners:this.normalizeScanners(e.scanners,r),projects:this.normalizeProjects(e.projects??[],n)}}normalizeScanners(e,r){return(e??t.DEFAULT_SCANNERS).map(i=>{if(typeof i!="string")throw new Error(`Invalid scanner name '${String(i)}' in configuration file '${r}'`);let o=i.split("@");if(o.length>2)throw new Error(`Invalid scanner name '${i}' in configuration file '${r}'`);return{name:o[0],version:o[1]??""}})}normalizeProjects(e,r){return e.map(n=>{let i=n;if(!i.name)throw new Error("Project name is missing on entry: "+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry: "+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry: "+JSON.stringify(i));let o={...i,purlAliases:i.purlAliases??[],enabled:i.enabled??!0,silent:i.silent??!1,minimumSeverity:i.minimumSeverity??"UNKNOWN"};return o.sbomFile?{...o,sbomFile:this.resolvePath(o.sbomFile)??o.sbomFile}:{...o,detectNoLongerUsedVulnerabilities:r?o.purl.endsWith("-SNAPSHOT"):!0}})}resolvePath(e){if(e)return Z.default.isAbsolute(e)?e:(0,Z.resolve)(this.workingDir,e)}},xe=class{constructor(e){this.workingDir=e;this.normalizer=new Lt(e)}workingDir;normalizer;projectConfigCache;async loadProjectConfig(){return this.projectConfigCache??=this.doLoadProjectConfig(),this.projectConfigCache}async doLoadProjectConfig(){let e=(0,Z.resolve)(this.workingDir,"vuln-scan-conf.json"),r=await H(e);if(!r)throw new Error(`Missing project configuration file '${e}'`);return this.normalizer.normalize(r,e)}async loadJiraConfig(e){let r=await(0,Pt.readFile)(e,"utf8"),n=JSON.parse(r);if(!n.issues&&n.issue&&(n.issues=n.issue),!n.jiraUrl||typeof n.jiraUrl!="string")throw new Error("jira-conf.json: missing or invalid 'jiraUrl' field");if(!Array.isArray(n.issues))throw new Error("jira-conf.json: missing or invalid 'issues' array");this.validateAutoCloseSeverity(n.autoCloseBelowSeverity,"jira-conf.json: invalid 'autoCloseBelowSeverity'");for(let[i,o]of n.issues.entries())if(o&&typeof o=="object"){let s=o;this.validateAutoCloseSeverity(s.autoCloseBelowSeverity,`jira-conf.json: invalid 'issues[${i}].autoCloseBelowSeverity'`),this.validateAutoCloseProjectOverrides(s.projectOverrides,`jira-conf.json: invalid 'issues[${i}].projectOverrides'`)}return n}validateAutoCloseSeverity(e,r){if(e!==void 0&&!K.includes(e))throw new Error(`${r} value '${String(e)}'. Must be one of: ${K.join(", ")}`)}validateAutoCloseProjectOverrides(e,r){if(e!==void 0){if(!Array.isArray(e))throw new Error(`${r}: must be an array`);for(let n=0;n<e.length;n++){let i=e[n],o=`${r}[${n}]`;if(i==null||typeof i!="object")throw new Error(`${o}: must be an object`);let s=i,a=s.projects;if(!Array.isArray(a)||a.length===0)throw new Error(`${o}.projects: must be a non-empty array of strings`);for(let f=0;f<a.length;f++){let d=a[f];if(typeof d!="string"||d.length===0)throw new Error(`${o}.projects[${f}]: must be a non-empty string`)}if(s.autoCloseBelowSeverity===void 0)throw new Error(`${o}.autoCloseBelowSeverity: is required`);if(this.validateAutoCloseSeverity(s.autoCloseBelowSeverity,`${o}.autoCloseBelowSeverity`),s.comment!==void 0&&typeof s.comment!="string")throw new Error(`${o}.comment: must be a string`)}}}async loadAutoVexConfig(e){let r=await(0,Pt.readFile)(e,"utf8"),n=JSON.parse(r);if(!n.impactStatement||typeof n.impactStatement!="string")throw new Error("auto-vex-conf.json: missing or invalid 'impactStatement' field (must be a non-empty string)");if(n.maxSeverity!==void 0&&!K.includes(n.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'maxSeverity' value '${String(n.maxSeverity)}'. Must be one of: ${K.join(", ")}`);if(n.projectOverrides!==void 0){if(!Array.isArray(n.projectOverrides))throw new Error("auto-vex-conf.json: 'projectOverrides' must be an array");for(let[i,o]of n.projectOverrides.entries()){if(!o||typeof o!="object")throw new Error(`auto-vex-conf.json: 'projectOverrides[${i}]' must be an object`);let s=o;if(!Array.isArray(s.projects)||s.projects.length===0||!s.projects.every(a=>typeof a=="string"&&a.length>0))throw new Error(`auto-vex-conf.json: 'projectOverrides[${i}].projects' must be a non-empty array of non-empty strings`);if(!K.includes(s.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'projectOverrides[${i}].maxSeverity' value '${String(s.maxSeverity)}'. Must be one of: ${K.join(", ")}`)}}return n}};var Re=require("fs/promises");async function ar(t,e,r){if("sbomFile"in t)return await(0,Re.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let n=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,Re.writeFile)(e,n),{...t,sbomFile:e}}var Ie=class{constructor(e,r){this.repo=e;this.authn=r}repo;authn;async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let n=this.toArtifactUrl(r),i=await be(n,this.authn);return Buffer.from(await i.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,i=await(await be(r,this.authn)).text();return Gi(i,e)}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),n=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${n}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}};function Gi(t,e){if(e.classifier&&e.extension){let i=t.match(new RegExp(`<snapshotVersion>\\s*<classifier>${e.classifier}</classifier>\\s*<extension>${e.extension}</extension>\\s*<value>([^<]+)</value>\\s*<updated>[^<]+</updated>\\s*</snapshotVersion>`)),o=e.version.replace(/SNAPSHOT$/,"");if(i?.[1])return i[1].replace(o,"")}let r=t.match(/<timestamp>([^<]+)<\/timestamp>/),n=t.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!r||!n)throw new Error(`Failed to get timestamp and build number from ${t} for artifact '${e.artifactId}'`);return`${r[1]}-${n[1]}`}var fr=require("fs/promises"),Et=require("path"),mr=require("crypto");var lr=require("crypto");var cr="auto_vex_max_severity=";function Pe(t){let e=t.status_notes;if(!e||!e.startsWith(cr))return;let r=e.slice(cr.length).trim();return K.includes(r)?r:void 0}var Hi="https://openvex.dev/ns/v0.2.0";function ur(t,e="conterra"){let n=`https://openvex.dev/docs/public/vex-${(0,lr.randomUUID)()}`,i=t.timestamp??new Date().toISOString();return{"@context":Hi,"@id":n,author:e,timestamp:i,last_updated:i,version:1,statements:[t]}}function pr(t,e){let r=e.timestamp??new Date().toISOString();return{...t,last_updated:r,version:t.version+1,statements:[...t.statements,e]}}var Ne=require("fs/promises"),_e=require("path");var Me=class{constructor(e){this.location=e}location;_content=void 0;_exists=!1;get exists(){return this._exists}get content(){return this._content}set content(e){this._content=e,this._exists=e!==void 0}async read(){let e=await H(this.location);this._content=e??void 0,this._exists=this._content!==void 0}async write(){if(this._content===void 0)throw new Error(`Cannot write VexFile: content is undefined (${this.location})`);await(0,Ne.mkdir)((0,_e.dirname)((0,_e.resolve)(this.location)),{recursive:!0}),await wt(this.location,this._content)}async delete(){await(0,Ne.unlink)(this.location),this._exists=!1}upsert(e,r){if(this._content===void 0)return this._content=ur(e,r),this._exists=!0,{created:!0,changed:!0};let n=Pe(e);if(n!==void 0){let i=this._content.statements.findIndex(o=>o.vulnerability.name===e.vulnerability.name&&o.status===e.status&&Pe(o)===n);if(i!==-1){let o=this._content.statements[i];return Ki(o,e)?{created:!1,changed:!1}:(o.products=e.products,o.impact_statement=e.impact_statement,o.action_statement=e.action_statement,o.justification=e.justification,o.status_notes=e.status_notes,o.timestamp=e.timestamp,this._content.version+=1,this._content.last_updated=e.timestamp??new Date().toISOString(),{created:!1,changed:!0})}}return this._content=pr(this._content,e),{created:!1,changed:!0}}addProductId(e,r){this.assertContentLoaded("addProductId");let n=!1;for(let i of this._content.statements){if(!i.products||i.products.some(s=>s["@id"]===r))continue;let o=i.products.findIndex(s=>s["@id"]===e);o!==-1&&(i.products.splice(o+1,0,{"@id":r}),n=!0)}return n}removeProductId(e,r){this.assertContentLoaded("removeProductId");let n=this._content.statements,i=[],o=!1;for(let s of n){if(r&&!jt(s).has(r)||!s.products)continue;let a=s.products.findIndex(f=>f["@id"]===e);a!==-1&&(s.products.splice(a,1),o=!0,s.products.length===0&&i.push(s))}if(!o)return"unchanged";for(let s of i)n.splice(n.indexOf(s),1);return n.length===0?"emptied":"changed"}hasStatementForProduct(e){return this.assertContentLoaded("hasStatementForProduct"),this._content.statements.some(r=>r.products?.some(n=>n["@id"]===e)??!1)}assertContentLoaded(e){if(this._content===void 0)throw new Error(`VexFile.${e}(): content is not loaded. Call read() first (${this.location})`)}};function Ki(t,e){return t.impact_statement!==e.impact_statement||t.action_statement!==e.action_statement||t.justification!==e.justification||t.status_notes!==e.status_notes?!1:Qi(t.products,e.products)}function Qi(t,e){let r=o=>Array.from(new Set((o??[]).map(s=>s["@id"]).filter(s=>typeof s=="string"))).sort(),n=r(t),i=r(e);return n.length!==i.length?!1:n.every((o,s)=>o===i[s])}async function $e(t,e){for(let r of await(0,fr.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new Me((0,Et.resolve)(r.parentPath,r.name))):r.isDirectory()&&await $e((0,Et.resolve)(r.parentPath,r.name),e)}function jt(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}var le=class t{statements=[];filteredToProducts=[];static async fromUrl(e,r,n=new t){let o=await(await be(e,r)).json();return n.add(o),n}static async fromFiles(e,r=new t){return await $e(e,async n=>{await n.read(),n.content&&r.add(n.content)}),r}add(e){Yi(e);let r=e.timestamp;for(let n of e.statements){n.timestamp=n.timestamp??r;let i=Date.parse(n.timestamp),o=n.vulnerability.name,s=jt(n),a=new Set(n.products?.map(d=>d["@id"]).filter(d=>!!d)??[]),f=new Dt(i,o,s,a,n);this.statements.push(f)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){this.assertCorrectProductId(e);let r=new t;return r.filteredToProducts=e.slice(0),r.statements=this.statements.filter(n=>n.matchesAtLeastOneProduct(e)),r}hasStatementFor(e){return this.statements.some(r=>r.matchesVulnerability(e))}findNotMatchingVulnerabilities(e,r){let n=this.filterByProduct(r??this.filteredToProducts),i=new Set;for(let o of n.statements)i.add(o.vulnName);for(let o of e)i.delete(o);return Array.from(i)}newestVulnerabilityStatement(e,r,n){let i=this.filterByProduct(r??this.filteredToProducts);for(let o of i.statements)if(o.matchesVulnerability(e)){if(n!==void 0){let s=Pe(o.statement);if(s!==void 0&&!Ae(n,s))continue}return this.reduceToProductInformation(o,i.filteredToProducts[0])}}toVexFileForProduct(e){let r=this.filterByProduct(e??this.filteredToProducts),n=r.statements.map(i=>this.reduceToProductInformation(i,r.filteredToProducts[0]));return this.toVexFile(n)}toVexFile(e){let r=e.filter(o=>o.status!=="under_investigation");if(r.length===0)return;this.sortVexStatementsByTimestampNewestFirst(r);let n=r[0].timestamp;return{"@context":"https://openvex.dev/ns/v0.2.0","@id":Zi(r),author:"conterra",timestamp:n,last_updated:n,version:1,statements:r}}toVexFileWithComponentIds(e){let r=e.filter(n=>n.vexStatement).map(n=>{let i={...n.vexStatement},o=(n.components??[]).map(s=>({"@id":s}));return i.products=[...i.products??[],...o],i});return this.toVexFile(r)}assertCorrectProductId(e){if(!e||e.length===0)throw new Error("Product ID must be provided");if(this.filteredToProducts.length&&!zi(this.filteredToProducts,e))throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){let n={timestamp:new Date(e.timestamp).toISOString(),...e.statement};if(!r)return n;let i=n.products?.filter(o=>o["@id"]===r);return i?.length||(i=[{"@id":r}]),{...n,products:i}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}sortVexStatementsByTimestampNewestFirst(e){e.sort((r,n)=>Date.parse(n.timestamp)-Date.parse(r.timestamp))}};function zi(t,e){return t.length===e.length&&t.every((r,n)=>r===e[n])}var Dt=class{constructor(e,r,n,i,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=n;this.products=i;this.statement=o}timestamp;vulnName;vulnAliases;products;statement;matchesProduct(e){return this.products.has(e)}matchesAtLeastOneProduct(e){return e.some(this.matchesProduct.bind(this))}matchesVulnerability(e){return this.vulnAliases.has(e)}};function Yi(t){if(t?.["@context"]!=="https://openvex.dev/ns/v0.2.0")throw new Error("Invalid VEX file format")}function Zi(t){let e=t.map(n=>`${n.vulnerability.name}:${n.status}`).sort().join("|");return`https://openvex.dev/docs/public/vex-${(0,mr.createHash)("sha256").update(e).digest("hex")}`}var Ue=require("path"),dr=require("fs/promises");function eo(t){throw new Error(`Unhandled value: ${String(t)}`)}var Be=class{constructor(e,r,n){this.project=e;this.outputDir=r;this.useSubDirForProject=n}project;outputDir;useSubDirForProject;async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",n=`${this.project.name}-${this.project.version}-`,i=this.getFileSuffix(e),o=(0,Ue.resolve)(this.outputDir,r,`${n}${i}`),s=(0,Ue.dirname)(o);return await se(s)||await(0,dr.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:return eo(e)}}};var hr=require("zx"),ee=class{async run(e){let{image:r,volumes:n=[],envArgs:i=[],args:o=[]}=e,s=n.flatMap(f=>["-v",f]),a=await hr.$`docker run --rm ${s} ${i} ${r} ${o}`.nothrow();return{stdout:a.stdout,stderr:a.stderr,exitCode:a.exitCode}}};var qe=require("path");var ue=class{};var pe=class extends ue{runner=new ee;buildDockerEnvArgs(e){return[]}buildExtraVolumes(e){return[]}async scan(e,r,n,i,o){let s=await r.lookupOutputFileForWriting(this.getOutputFileKey()),a=(0,qe.dirname)(s),d=`/tmp/output/${(0,qe.basename)(s)}`,c=`${this.dockerImage}:${this.version||this.defaultVersion}`,p=`${a}:/tmp/output`,l=`${e.sbomFile}:/tmp/input.json`,u=this.buildExtraVolumes({outputDir:a,outputFile:s,sbomFile:e.sbomFile}),m=await this.runner.run({image:c,volumes:[p,l,...u],envArgs:this.buildDockerEnvArgs(i),args:this.buildDockerArgs({outputPath:d,verbose:i})});if(m.stdout&&o(` Scan log: ${m.stdout}`),m.stderr&&o(` Scan error: ${m.stderr}`),m.exitCode!==0)throw new Error(`${this.scannerLabel} scan failed with exit code ${m.exitCode}: ${m.stderr}`);o(`  ${this.scannerLabel} output file: ${s}`);try{let g=await H(s);this.parseAndAdd(g,n)}catch(g){throw new Error(`${this.scannerLabel} scan results could not be read from '${s}': ${g}`,{cause:g})}}};var yr="anchore/grype",Xe=class t extends pe{constructor(r,n){super();this.version=r;this.cacheDir=n}version;cacheDir;dockerImage=yr;defaultVersion="latest";scannerLabel="Grype";async init(r){r&&console.log(`Initializing Grype DB in cache directory: ${this.cacheDir}`);let n=`${yr}:${this.version||this.defaultVersion}`,i=await new ee().run({image:n,volumes:[`${this.cacheDir}:/tmp/.cache`],envArgs:["-e","GRYPE_DB_CACHE_DIR=/tmp/.cache","-e","TMPDIR=/tmp"],args:["db","update"]});if(i.stdout&&console.log(` Grype DB Update: ${i.stdout}`),i.stderr&&console.log(` Grype DB Update error: ${i.stderr}`),i.exitCode!==0)throw new Error(`Grype DB update failed with exit code ${i.exitCode}: ${i.stderr}`)}getOutputFileKey(){return"grype-results"}buildExtraVolumes(r){return[`${this.cacheDir}:/tmp/.cache`]}buildDockerEnvArgs(r){return["-e","GRYPE_DB_CACHE_DIR=/tmp/.cache","-e","TMPDIR=/tmp","-e","GRYPE_DB_AUTO_UPDATE=false"]}buildDockerArgs(r){let n=["sbom:/tmp/input.json","-o","json","--file",r.outputPath,"--by-cve"];return r.verbose||n.push("--quiet"),n}parseAndAdd(r,n){if(r)for(let i of r.matches)n.addVulnerability(t.createVulnerability(i),"grype")}addVulnerabilities(r,n){this.parseAndAdd(n,r)}static createVulnerability(r){let n=r.vulnerability,i=nr(n.severity);return{id:n.id,severity:i,scannerSeverity:{grype:i},title:"",description:n.description,components:[U(r.artifact.purl)],detectedBy:["grype"],refs:[U(n.dataSource)]}}};var gr="aquasec/trivy",to="latest",ro="public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db",Je=class t extends pe{constructor(r,n,i){super();this.version=r;this.cacheDir=n;this.githubToken=i}version;cacheDir;githubToken;dockerImage=gr;defaultVersion=to;scannerLabel="Trivy";async init(r){let n=[];this.githubToken&&n.push("-e",`GITHUB_TOKEN=${this.githubToken}`);let i=["--db-repository",ro,"--cache-dir","/.cache","sbom","--download-db-only"];r||i.push("--quiet");let o=`${gr}:${this.version||this.defaultVersion}`,s=await new ee().run({image:o,volumes:[`${this.cacheDir}:/.cache`],envArgs:n,args:i});if(!s.stdout&&!s.stderr&&console.log(" Trivy DB Update: finished"),s.stdout&&console.log(` Trivy DB Update: ${s.stdout}`),s.stderr&&console.log(` Trivy DB Update error: ${s.stderr}`),s.exitCode!==0)throw new Error(`Trivy DB update failed with exit code ${s.exitCode}: ${s.stderr}`)}getOutputFileKey(){return"trivy-results"}buildExtraVolumes(r){return[`${this.cacheDir}:/.cache`]}buildDockerArgs(r){let n=["sbom","--cache-dir","/.cache","--format","json","--output",r.outputPath,"--skip-db-update","/tmp/input.json"];return r.verbose||n.push("--quiet"),n}parseAndAdd(r,n){if(r){for(let i of r.Results??[])if(i.Vulnerabilities)for(let o of i.Vulnerabilities)n.addVulnerability(t.createVulnerability(o),"trivy")}}addVulnerabilities(r,n){this.parseAndAdd(n,r)}static createVulnerability(r){let n=ir(r.Severity);return{id:r.VulnerabilityID,severity:n,scannerSeverity:{trivy:n},title:r.Title,description:r.Description,components:[U(r.PkgIdentifier.PURL)],detectedBy:["trivy"],refs:[U(r.PrimaryURL)]}}};var br=require("fs/promises");function Ot(t,e=""){return Sr(t,e,new Set,new Set)}function Sr(t,e="",r,n){let i=`${e}- ${t.purl}`;if(r.has(t.purl))return i+=" (cycle detected)",i;if(n.has(t.purl))return i+=" (deduplicated)",i;n.add(t.purl),r.add(t.purl);let o=r.size===1;for(let s of t.usedBy){let a=Sr(s,e+(o?"    ":"  "),r,n);a!==""&&(i+=`
+`,i+=a)}return r.delete(t.purl),i}var fe=class t{constructor(e){this.sbom=e;for(let r of this.sbom.components||[]){let n={purl:U(r.purl),usedBy:[]};n.purl&&(this.purlToComponent.has(n.purl)||(this.purlToComponent.set(n.purl,n),this.sbomRefToComponent.set(r["bom-ref"],n)))}for(let r of this.sbom.dependencies||[]){let n=this.sbomRefToComponent.get(r.ref);if(n)for(let i of r.dependsOn||[]){let o=this.sbomRefToComponent.get(i);o&&!o.usedBy.includes(n)&&o.usedBy.push(n)}}}sbom;static createForSbom(e){return new t(e)}static printTree(e,r=""){return Ot(e,r)}sbomRefToComponent=new Map;purlToComponent=new Map;findUsagesOfComponent(e){if(!this.sbom)return{purl:e,usedBy:[]};let r=this.purlToComponent.get(e);return r?vr(r):{purl:e,usedBy:[]}}};function vr(t,e=new Set){let r={purl:t.purl,usedBy:[]};if(e.has(t.purl))return r;e.add(t.purl);for(let n of t.usedBy){let i=vr(n,new Set(e));r.usedBy.push(i)}return r}var me=class t{constructor(e,r){this.filePath=e;this.sbom=r}filePath;sbom;static async fromFile(e){let r=await H(e);if(!r)throw new Error(`Could not read SBOM file '${e}'`);if(!r.components||r.components.length===0)throw new Error(`SBOM file '${e}' does not contain any components`);return new t(e,r)}get path(){return this.filePath}getComponents(){return this.sbom.components??[]}getExternalComponents(e=no){return this.getComponents().filter(e)}buildDependencyTree(){return fe.createForSbom(this.sbom)}};function no(t){return!!t.purl}var We=class{components=new Map;has(e){return this.components.has(e)}update(e,r){for(let n of r)this.components.set(U(n.coordinates),n);for(let n of e)this.components.has(n)||this.components.set(n,{coordinates:n,description:"",reference:"",vulnerabilities:[]})}read(e){let r=[];for(let n of e){let i=this.components.get(n);i&&r.push(i)}return r}};var wr=128,io="https://api.guide.sonatype.com",Ge=class t{cache=new We;baseUrl;authHeader;constructor(e={}){this.baseUrl=e.baseUrl??io,e.user&&e.token&&(this.authHeader=xt(e.user,e.token))}async fetchVulnerableComponents(e,r){let n=new Set(e.map(f=>f.replace(/\?.*$/,"")));t.addSnapshotBaseCoordinates(n);let i=Array.from(n),o=i.filter(f=>!this.cache.has(f));r?.(`  Sonatype OssIndex: ${o.length} packages to fetch, ${i.length-o.length} cache hits`);let s=this.authHeader?"/authorized":"",a=`${this.baseUrl}/api/v3${s}/component-report`;for(let f=0;f<o.length;f+=wr){let d=o.slice(f,f+wr),c=JSON.stringify({coordinates:d});r?.(`  Sonatype OssIndex request ${a} with body: ${c}`);let p={"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"};this.authHeader&&(p.Authorization=this.authHeader);let u=await(await fetch(a,{method:"POST",headers:p,body:c})).json();Array.isArray(u)?this.cache.update(d,u):r?.(`  Sonatype OssIndex Error: ${u.code} - ${u.message}`)}return this.cache.read(i).filter(f=>f.vulnerabilities.length>0)}static addSnapshotBaseCoordinates(e){let r=/(-SNAPSHOT|-\d{8}\.\d{6}-\d+)(?=(?:\?|$))/;for(let n of Array.from(e)){let i=n.replace(r,"");i!==n&&e.add(i)}}};var He=class t extends ue{client;constructor(e={}){super(),this.client=new Ge(e)}async init(){}async scan(e,r,n,i,o){let s=await r.lookupOutputFileForWriting("ossindex-results");try{let d=(await me.fromFile(e.sbomFile)).getExternalComponents(l=>!!l.purl&&!oo(l)).map(l=>l.purl),c=i?l=>o(`  [${e.name}] ${l}`):void 0,p=await this.client.fetchVulnerableComponents(d,c);await(0,br.writeFile)(s,JSON.stringify(p,null,2)),o(`  Sonatype OssIndex output file: ${s}`),this.addVulnerabilities(n,p)}catch(a){throw new Error(`Sonatype OSS Index scan failed: ${a}`,{cause:a})}}addVulnerabilities(e,r){if(r)for(let n of r)for(let i of n.vulnerabilities)e.addVulnerability(t.createVulnerability(i,n.coordinates),"ossindex")}static createVulnerability(e,r){let n=U(e.reference),i=or(e.cvssScore);return{id:e.cve||e.id,severity:i,scannerSeverity:{ossindex:i},title:e.title,description:e.description,components:[U(r)],detectedBy:["ossindex"],refs:n?[n]:[]}}};function oo(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function so(t,e,r){switch(t.name){case"grype":return new Xe(t.version,e);case"trivy":return new Je(t.version,e,r.trivyGithubToken);case"ossindex":return new He({user:r.ossIndexApiUser,token:r.ossIndexApiToken,baseUrl:r.ossIndexBaseUrl})}}var Ke=class{scanners;constructor(e,r,n){this.scanners=e.map(i=>so(i,r,n))}async init(e){await Promise.all(this.scanners.map(r=>r.init(e)))}async scanProject(e,r,n,i,o){await Promise.all(this.scanners.map(s=>s.scan(e,r,n,i,o)))}};async function xr(t,e,r){await $e(t,async n=>{await n.read();let i=n.removeProductId(e,r);i==="emptied"?(console.info(`Remove ${e} from ${n.location} and delete file.`),await n.delete()):i==="changed"&&(console.info(`Remove ${e} from ${n.location}`),await n.write())})}var jr=require("fs/promises"),Er=require("path");var Qe=class{data={hasError:!1,hasNewVuln:!1,hasNoLongerDetectedVuln:!1,cveDetails:new Map,vulnToProjects:new Map,noLongerDetectedVulnToProjects:new Map,projectToVulns:new Map,projectToNotLongerDetectedVulns:new Map,projectErrors:[],projectsToComponents:new Map};feed(e){let r=e.project,n=`${r.name}@${r.version}`;if(e.error&&(this.data.hasError=!0,this.data.projectErrors.push({project:n,error:e.error.message})),r.silent)return;let i=e.newVulns.filter(o=>!Ae(o.severity,r.minimumSeverity));for(let o of i){this.data.hasNewVuln=!0,this.mergeVulnDetails(o),this.data.vulnToProjects.has(o.id)||this.data.vulnToProjects.set(o.id,[]),this.data.projectToVulns.has(n)||this.data.projectToVulns.set(n,[]),this.data.projectsToComponents.has(n)||this.data.projectsToComponents.set(n,new Map),this.data.projectToVulns.get(n).push(o.id),this.data.vulnToProjects.get(o.id).push(n);for(let s of o.componentTree){if(!s.purl)continue;let a=this.data.projectsToComponents.get(n);a.has(s.purl)||a.set(s.purl,s)}}for(let o of e.noLongerDetectedVulns)this.data.hasNoLongerDetectedVuln=!0,this.data.noLongerDetectedVulnToProjects.has(o)||this.data.noLongerDetectedVulnToProjects.set(o,[]),this.data.projectToNotLongerDetectedVulns.has(n)||this.data.projectToNotLongerDetectedVulns.set(n,[]),this.data.projectToNotLongerDetectedVulns.get(n).push(o),this.data.noLongerDetectedVulnToProjects.get(o).push(n)}feedAll(e){for(let r of e.values())this.feed(r)}getData(){return this.data}toScanSummary(){let{data:e}=this;return{errors:e.projectErrors,vulnerabilities:Object.fromEntries(e.cveDetails),vulnerabilityToProject:Object.fromEntries(e.vulnToProjects.entries()),projectToVulnerability:Object.fromEntries(e.projectToVulns.entries()),projectsToComponents:Object.fromEntries(Array.from(e.projectsToComponents.entries()).map(([r,n])=>[r,Object.fromEntries(n.entries())])),noLongerDetectedVulnerabilities:Object.fromEntries(e.noLongerDetectedVulnToProjects)}}mergeVulnDetails(e){if(!this.data.cveDetails.has(e.id)){this.data.cveDetails.set(e.id,{id:e.id,title:e.title,severity:e.severity,description:e.description,components:e.components,refs:e.refs,vexLookupStatus:e.vexLookupStatus});return}let r=this.data.cveDetails.get(e.id);r.title=r.title||e.title,r.severity=Q(r.severity,e.severity)>=0?r.severity:e.severity,r.description=r.description||e.description,r.components=Pr(r.components,e.components),r.refs=Pr(r.refs,e.refs),r.vexLookupStatus=ao(r.vexLookupStatus,e.vexLookupStatus)}};function ao(t,e){return t==="missing-for-project"||e==="missing-for-project"?"missing-for-project":t??e}function Pr(t,e){return Array.from(new Set([...t,...e]))}var Ye=require("fs/promises"),Lr=require("path");var ze=class{constructor(e={}){this.options=e}options;summaryLogFile;async render(e){let{orderBy:r="CVE",reportNoLongerDetectedVulnerabilities:n=!0,reportCveDetails:i=!1,outputDirectory:o}=this.options;return o&&(this.summaryLogFile=(0,Lr.join)(o,"scan-summary.txt"),await(0,Ye.writeFile)(this.summaryLogFile,"","utf8")),await this.log("=== Scan summary ==="),e.projectErrors.length&&await this.logErrors(e.projectErrors),i&&await this.logCveDetails(e.cveDetails,e.projectsToComponents),r==="CVE"?await this.logOrderedByCve(e.vulnToProjects,e.cveDetails,n?e.noLongerDetectedVulnToProjects:new Map):await this.logOrderedByProject(e.projectToVulns,n?e.projectToNotLongerDetectedVulns:new Map,e.cveDetails),!e.hasError&&!e.hasNewVuln&&(!e.hasNoLongerDetectedVuln||!n)&&await this.log("  No issues found"),{hasError:e.hasError,hasNewVuln:e.hasNewVuln,hasNoLongerDetectedVuln:e.hasNoLongerDetectedVuln}}async log(e){console.log(e),this.summaryLogFile&&await(0,Ye.appendFile)(this.summaryLogFile,e+`
+`,"utf8")}async logErrors(e){await this.log(""),await this.log("- Errors during scan:");for(let{project:r,error:n}of e)await this.log(`    - ${r}:`),await this.log(`        Error: ${n}`)}async logOrderedByCve(e,r,n){let i=Array.from(e.keys()).sort(Ct(s=>r.get(s)));if(i.length){await this.log(""),await this.log("- New vulnerabilities:");for(let s of i){let a=e.get(s),f=r.get(s);await this.log(`    - [${f.severity}] ${s}${kt(f)}`);for(let d of a.slice().sort())await this.log(`        - ${d}`)}}let o=Array.from(n.keys()).sort();if(o.length){await this.log(""),await this.log("- Declared but no longer detected vulnerabilities:");for(let s of o){let a=n.get(s);await this.log(`    - ${s}`);for(let f of a.slice().sort())await this.log(`        - ${f}`)}}}async logOrderedByProject(e,r,n){let i=new Set([...Array.from(e.keys()),...Array.from(r.keys())]),o=Array.from(i.keys()).sort();if(o.length){await this.log(""),await this.log("- Vulnerabilities by project:");for(let s of o){await this.log(`    - ${s}:`);let a=e.get(s)??[];for(let d of a.slice().sort(Ct(c=>n.get(c)))){let c=n.get(d);await this.log(`        - [${c.severity}] ${d}${kt(c)}`)}let f=(r.get(s)??[]).slice().sort();for(let d of f)await this.log(`        - ${d} (no longer detected)`)}}}async logCveDetails(e,r){if(e.size===0)return;await this.log(""),await this.log("- Vulnerability details:");let n=Array.from(e.keys()).sort(Ct(i=>e.get(i)));for(let i of n){let o=e.get(i);if(await this.log(`    - [${o.severity}] ${o.id} - ${o.title||""}:${kt(o)}`),o.description){await this.log("        Description:");for(let s of o.description.split(/\r?\n/))await this.log(`          ${s}`)}if(o.components.length){await this.log("        Components:");for(let s of o.components)await this.log("          - "+s);if(r){for(let s of o.components)for(let[a,f]of r.entries())if(f.has(s)){await this.log(`          Usage Tree of ${s} by ${a} (as example):`),await this.log(fe.printTree(f.get(s),"            "));break}}}if(o.refs.length){await this.log("        Links:");for(let s of o.refs)await this.log(`          - ${s}`)}}}};function Ct(t){return(e,r)=>{let n=Q(t(r).severity,t(e).severity);return n!==0?n:e.localeCompare(r)}}function kt(t){switch(t.vexLookupStatus){case"missing-for-project":return"  (VEX entry missing)";case"missing-entirely":return"  (VEX file missing)";default:return""}}async function Dr(t,e){let r=new Qe;r.feedAll(t);let n=r.getData(),o=await new ze(e).render(n);if(e.outputDirectory){let s=(0,Er.join)(e.outputDirectory,"scan-summary.json");await(0,jr.writeFile)(s,JSON.stringify(r.toScanSummary(),null,2),"utf8")}return o}var dt=require("fs/promises");var Ze=class{constructor(e){this.depProvider=e}depProvider;allById=new Map;getAllVulnIds(){return new Set(this.allById.keys())}getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,n)=>{let i=Q(r.severity,n.severity);return i===0?r.id.localeCompare(n.id):-i}),e}addVulnerability(e,r){let n=e.id,i=this.allById,o=e;if(!i.has(n))i.set(n,e),o=e;else{let s=i.get(n);s.title=s.title||e.title,s.severity=rr(s.severity,e.severity),s.scannerSeverity[r]=e.severity,s.detectedBy=Ft(s.detectedBy,r),s.components=Ft(s.components,e.components[0]),s.refs=Ft(s.refs,e.refs[0]),o=s}o.componentTree=o.components?.map(s=>this.depProvider.findUsagesOfComponent(s))}enhanceWithVexData(e){let r=[];for(let n of this.allById.values()){let i=e.newestVulnerabilityStatement(n.id,void 0,n.severity);if(!i){r.push({id:n.id,severity:n.severity,title:n.title,description:n.description,components:n.components??[],componentTree:n.componentTree??[],refs:n.refs});continue}n.vexStatement=i}return{unmatchedVulnerabilities:r}}};function Ft(t,e){return e==null?t:Array.from(new Set([...t,e]).values())}var oe=Te(Fi());var Ai=Te(Vi());var zt={kind:"external",status:"accepted"};function Ii(t,e){let r=new oe.SarifRunBuilder().initSimple({toolDriverName:`${e.name}@${e.version}`,toolDriverVersion:"0.0.1"}),n=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${n}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${n}`};for(let o of t){let s=sr(o.severity),a=o.id,f=Ea(o.refs),d=new oe.SarifRuleBuilder().initSimple({ruleId:a,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:f}),c=o.vexStatement,p,l="new",u="";c?(p=[{...zt}],l="updated",u=`--- INVESTIGATED (${c.status}) --- `,c.status==="under_investigation"&&(p[0].status="underReview",u="--- UNDER INVESTIGATION --- ")):Q(e.minimumSeverity,o.severity)>0?(p=[{...zt}],l="updated",u=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(p=[{...zt}],l="updated",u="--- PROJECT SILENT ---"),Object.assign(d.rule,{name:`${u}[${o.severity}] - ${o.title.replace(`[${a}]`,"")}`,messageStrings:{default:{text:o.description,markdown:Da(o,f,u)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(d);for(let m of o.components){let g=new oe.SarifResultBuilder().initSimple({ruleId:a,level:s,messageText:`${a} [${o.severity}] - ${m}`});g.result.message.id="default",g.result.locations=[{logicalLocations:[{fullyQualifiedName:m}]}],g.result.baselineState=l,g.result.suppressions=p,r.addResult(g)}}let i=new oe.SarifBuilder;return i.addRun(r),i.buildSarifOutput()}function Ea(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function Da(t,e,r){let n=t.vexStatement,i=n?`
 ${r}
-${i.justification??""}
-${i.impact_statement??""}
-${i.action_statement??""}`:"";return`
+${n.justification??""}
+${n.impact_statement??""}
+${n.action_statement??""}`:"";return`
 __[${t.id}](${e})__
-${n}
+${i}
 --- DETAILS ---
-${(0,Vn.default)(t.description)}
+${(0,Ai.default)(t.description)}
 ${t.refs.map(o=>`* <${o}>`).join(`
 `)}
@@ -33,11 +33,11 @@ ${t.refs.map(o=>`* <${o}>`).join(`
 Usage tree:
 \`\`\`plain
-${t.componentTree?.map(o=>Ct(o)).join(`
+${t.componentTree?.map(o=>Ot(o)).join(`
 `)}
 \`\`\`
-`}var dt=class{constructor(e,r,i,n,o,s){this.project=e;this.outputFiles=r;this.engine=i;this.mavenRepo=n;this.vexStore=o;this.verbose=s}project;outputFiles;engine;mavenRepo;vexStore;verbose;logBuffer=[];log(e){this.logBuffer.push(e)}flushLogs(){for(let e of this.logBuffer)console.log(e)}async run(){try{let{unmatchedVulnerabilities:e,noLongerDetectedVulnerabilities:r}=await this.scanAndWrite();return{project:this.project,newVulns:e,noLongerDetectedVulns:r}}catch(e){return{project:this.project,error:e instanceof Error?e:new Error(String(e)),newVulns:[],noLongerDetectedVulns:[]}}finally{this.verbose&&this.flushLogs()}}async scanAndWrite(){let e=await or(this.project,await this.outputFiles.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),this.mavenRepo);this.log(`Analyzing project: ${e.name} - ${e.version} - ${e.sbomFile}`);let r=await fe.fromFile(e.sbomFile),i=new Ye(r.buildDependencyTree());await this.engine.scanProject(e,this.outputFiles,i,this.verbose,this.log.bind(this));let n=this.vexStore.filterByProduct([e.purl,...e.purlAliases]),{unmatchedVulnerabilities:o}=i.enhanceWithVexData(n),s=e.detectNoLongerUsedVulnerabilities?n.findNotMatchingVulnerabilities(i.getAllVulnIds()):[];return await this.writeResults(e,i,n),{unmatchedVulnerabilities:o,noLongerDetectedVulnerabilities:s}}async writeResults(e,r,i){let n=r.getAllVulnerabilitiesSortedBySeverity(),o=await this.outputFiles.lookupOutputFileForWriting("aggregate-results");await(0,ft.writeFile)(o,JSON.stringify(n,null,2)),this.log(`  Vulnerabilities output file: ${o}`);let s=await this.outputFiles.lookupOutputFileForWriting("aggregated-sarif-results"),c=An(n,e);await(0,ft.writeFile)(s,JSON.stringify(c,null,2)),this.log(`  Vuln Sarif output file: ${s}`);let m=i.toVexFileWithComponentIds(n);if(!m)return;let d=await this.outputFiles.lookupOutputFileForWriting("project-openvex-file");await(0,ft.writeFile)(d,JSON.stringify(m,null,2)),this.log(`  OpenVex file: ${d}`)}};var ht=class{constructor(e=5){this.maxParallel=e}maxParallel;async run(e){let r=0,i=0,n=0,o=e.length;if(o===0)return;let s,c=new Promise(d=>{s=d}),m=()=>{for(;i<this.maxParallel&&r<o;){let d=e[r++];i++,d().catch(()=>{}).finally(()=>{i--,n++,n>=o?s():m()})}};m(),await c}};var yt=class{options;constructor(e){this.options=e}async run(){let e=await new xe(this.options.workingDir).loadProjectConfig();await this.prepareDirectories(e);let r=await this.createVexStore(e),i=new Ae(e.mavenRepo,{user:this.options.mavenRepoUser,pw:this.options.mavenRepoPw}),n=this.createEngine(e);console.log("Initializing scanner engines ...");let o=Date.now();await n.init(this.options.verbose),console.log(`Scanner engines initialization took ${Date.now()-o}ms
-`);let s=e.projects.filter(this.createProjectFilter());console.log("Scanning projects ...");let c=Date.now(),m=new Map;await new ht(5).run(s.map(p=>async()=>{let l=new $e(p,e.outDir,e.createSubDirsForProject),f=await new dt(p,l,n,i,r,this.options.verbose).run();m.set(p.purl,f)})),console.log(`Scanning took ${Date.now()-c}ms`),this.options.autoRemoveUnusedStatements&&await this.removeUnusedVexStatements(m,e.vexDir);let a=await Er(m,{orderBy:e.consoleReport.startsWith("BY_CVE")?"CVE":"PROJECT",reportCveDetails:e.consoleReport.endsWith("_DETAILED"),reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities,outputDirectory:e.outDir});return this.computeExitCode(e,a)}async prepareDirectories(e){await oe(e.cacheDir)||await(0,Qt.mkdir)(e.cacheDir),await oe(e.outDir)&&await wt(e.outDir),await(0,Qt.mkdir)(e.outDir)}async createVexStore(e){let r;await oe(e.vexDir)?r=await le.fromFiles(e.vexDir):r=new le;for(let i of e.vexUrls)await le.fromUrl(i,{user:this.options.vexUrlsUser,pw:this.options.vexUrlsPw},r);return r}createEngine(e){if(this.options.scannerEngine)return this.options.scannerEngine;if(e.scanners.length===0)throw new Error("No scanners configured");return new He(e.scanners,e.cacheDir,this.options)}createProjectFilter(){let{reduceToProjectName:e,reduceToProjectVersion:r}=this.options;return i=>!(!i.enabled||e&&(i.name!==e||r&&i.version!==r))}async removeUnusedVexStatements(e,r){for(let i of e.values())if(!i.project.silent)for(let n of i.noLongerDetectedVulns)await br(r,i.project.purl,n)}computeExitCode(e,r){if(r.hasError)return 1;if(r.hasNewVuln){if(e.onNewVulnerabilities==="fail")return 1;e.onNewVulnerabilities==="warn"&&(console.log("##vso[task.logissue type=warning;]NEW_VULNERABILITIES_DETECTED"),console.log("##vso[task.complete result=SucceededWithIssues;]"))}if(r.hasNoLongerDetectedVuln){if(e.onNoLongerDetectedVulnerabilities==="fail")return 1;e.onNoLongerDetectedVulnerabilities==="warn"&&(console.log("##vso[task.logissue type=warning;]NO_LONGER_DETECTED_VULNERABILITIES"),console.log("##vso[task.complete result=SucceededWithIssues;]"))}return 0}};async function In(t){return new yt(t).run()}var ve=require("zx");ve.dotenv.config();ve.os.type().startsWith("Windows")&&(0,ve.usePowerShell)();var G=process.env;(async()=>{let t=await In({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:G.OSS_INDEX_API_USER,ossIndexApiToken:G.OSS_INDEX_API_TOKEN,ossIndexBaseUrl:G.OSS_INDEX_BASE_URL,mavenRepoUser:G.MAVEN_REPO_USER,mavenRepoPw:G.MAVEN_REPO_PW,trivyGithubToken:G.TRIVY_GITHUB_TOKEN,vexUrlsUser:G.VEX_URLS_USER,vexUrlsPw:G.VEX_URLS_PW,verbose:G.VERBOSE==="true",autoRemoveUnusedStatements:G.AUTO_REMOVE_UNUSED_STATEMENTS==="true"});process.exitCode=t})();
+`}var ht=class{constructor(e,r,n,i,o,s){this.project=e;this.outputFiles=r;this.engine=n;this.mavenRepo=i;this.vexStore=o;this.verbose=s}project;outputFiles;engine;mavenRepo;vexStore;verbose;logBuffer=[];log(e){this.logBuffer.push(e)}flushLogs(){for(let e of this.logBuffer)console.log(e)}async run(){try{let{unmatchedVulnerabilities:e,noLongerDetectedVulnerabilities:r}=await this.scanAndWrite();return{project:this.project,newVulns:e,noLongerDetectedVulns:r}}catch(e){return{project:this.project,error:e instanceof Error?e:new Error(String(e)),newVulns:[],noLongerDetectedVulns:[]}}finally{this.verbose&&this.flushLogs()}}async scanAndWrite(){let e=await ar(this.project,await this.outputFiles.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),this.mavenRepo);this.log(`Analyzing project: ${e.name} - ${e.version} - ${e.sbomFile}`);let r=await me.fromFile(e.sbomFile),n=new Ze(r.buildDependencyTree());await this.engine.scanProject(e,this.outputFiles,n,this.verbose,this.log.bind(this));let i=this.vexStore.filterByProduct([e.purl,...e.purlAliases]),{unmatchedVulnerabilities:o}=n.enhanceWithVexData(i);for(let a of o)a.vexLookupStatus=this.vexStore.hasStatementFor(a.id)?"missing-for-project":"missing-entirely";let s=e.detectNoLongerUsedVulnerabilities?i.findNotMatchingVulnerabilities(n.getAllVulnIds()):[];return await this.writeResults(e,n,i),{unmatchedVulnerabilities:o,noLongerDetectedVulnerabilities:s}}async writeResults(e,r,n){let i=r.getAllVulnerabilitiesSortedBySeverity(),o=await this.outputFiles.lookupOutputFileForWriting("aggregate-results");await(0,dt.writeFile)(o,JSON.stringify(i,null,2)),this.log(`  Vulnerabilities output file: ${o}`);let s=await this.outputFiles.lookupOutputFileForWriting("aggregated-sarif-results"),a=Ii(i,e);await(0,dt.writeFile)(s,JSON.stringify(a,null,2)),this.log(`  Vuln Sarif output file: ${s}`);let f=n.toVexFileWithComponentIds(i);if(!f)return;let d=await this.outputFiles.lookupOutputFileForWriting("project-openvex-file");await(0,dt.writeFile)(d,JSON.stringify(f,null,2)),this.log(`  OpenVex file: ${d}`)}};var yt=class{constructor(e=5){this.maxParallel=e}maxParallel;async run(e){let r=0,n=0,i=0,o=e.length;if(o===0)return;let s,a=new Promise(d=>{s=d}),f=()=>{for(;n<this.maxParallel&&r<o;){let d=e[r++];n++,d().catch(()=>{}).finally(()=>{n--,i++,i>=o?s():f()})}};f(),await a}};var gt=class{options;constructor(e){this.options=e}async run(){let e=await new xe(this.options.workingDir).loadProjectConfig();await this.prepareDirectories(e);let r=await this.createVexStore(e),n=new Ie(e.mavenRepo,{user:this.options.mavenRepoUser,pw:this.options.mavenRepoPw}),i=this.createEngine(e);console.log("Initializing scanner engines ...");let o=Date.now();await i.init(this.options.verbose),console.log(`Scanner engines initialization took ${Date.now()-o}ms
+`);let s=e.projects.filter(this.createProjectFilter());console.log("Scanning projects ...");let a=Date.now(),f=new Map;await new yt(5).run(s.map(p=>async()=>{let l=new Be(p,e.outDir,e.createSubDirsForProject),m=await new ht(p,l,i,n,r,this.options.verbose).run();f.set(p.purl,m)})),console.log(`Scanning took ${Date.now()-a}ms`),this.options.autoRemoveUnusedStatements&&await this.removeUnusedVexStatements(f,e.vexDir);let c=await Dr(f,{orderBy:e.consoleReport.startsWith("BY_CVE")?"CVE":"PROJECT",reportCveDetails:e.consoleReport.endsWith("_DETAILED"),reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities,outputDirectory:e.outDir});return this.computeExitCode(e,c)}async prepareDirectories(e){await se(e.cacheDir)||await(0,Yt.mkdir)(e.cacheDir),await se(e.outDir)&&await bt(e.outDir),await(0,Yt.mkdir)(e.outDir)}async createVexStore(e){let r;await se(e.vexDir)?r=await le.fromFiles(e.vexDir):r=new le;for(let n of e.vexUrls)await le.fromUrl(n,{user:this.options.vexUrlsUser,pw:this.options.vexUrlsPw},r);return r}createEngine(e){if(this.options.scannerEngine)return this.options.scannerEngine;if(e.scanners.length===0)throw new Error("No scanners configured");return new Ke(e.scanners,e.cacheDir,this.options)}createProjectFilter(){let{reduceToProjectName:e,reduceToProjectVersion:r}=this.options;return n=>!(!n.enabled||e&&(n.name!==e||r&&n.version!==r))}async removeUnusedVexStatements(e,r){for(let n of e.values())if(!n.project.silent)for(let i of n.noLongerDetectedVulns)await xr(r,n.project.purl,i)}computeExitCode(e,r){if(r.hasError)return 1;if(r.hasNewVuln){if(e.onNewVulnerabilities==="fail")return 1;e.onNewVulnerabilities==="warn"&&(console.log("##vso[task.logissue type=warning;]NEW_VULNERABILITIES_DETECTED"),console.log("##vso[task.complete result=SucceededWithIssues;]"))}if(r.hasNoLongerDetectedVuln){if(e.onNoLongerDetectedVulnerabilities==="fail")return 1;e.onNoLongerDetectedVulnerabilities==="warn"&&(console.log("##vso[task.logissue type=warning;]NO_LONGER_DETECTED_VULNERABILITIES"),console.log("##vso[task.complete result=SucceededWithIssues;]"))}return 0}};async function Ri(t){return new gt(t).run()}var ve=require("zx");ve.dotenv.config();ve.os.type().startsWith("Windows")&&(0,ve.usePowerShell)();var G=process.env;(async()=>{let t=await Ri({workingDir:process.cwd(),reduceToProjectName:process.argv[2],reduceToProjectVersion:process.argv[3],ossIndexApiUser:G.OSS_INDEX_API_USER,ossIndexApiToken:G.OSS_INDEX_API_TOKEN,ossIndexBaseUrl:G.OSS_INDEX_BASE_URL,mavenRepoUser:G.MAVEN_REPO_USER,mavenRepoPw:G.MAVEN_REPO_PW,trivyGithubToken:G.TRIVY_GITHUB_TOKEN,vexUrlsUser:G.VEX_URLS_USER,vexUrlsPw:G.VEX_URLS_PW,verbose:G.VERBOSE==="true",autoRemoveUnusedStatements:G.AUTO_REMOVE_UNUSED_STATEMENTS==="true"});process.exitCode=t})();
 /*! Bundled license information:
 escape-html/index.js: