@conterra/vuln-scan 1.0.14 → 1.0.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/dist/add-project-to-vex.js +2 -2
  2. package/dist/add-project.js +15 -15
  3. package/dist/add-statement.js +17 -17
  4. package/dist/auto-vex-creator.js +4 -4
  5. package/dist/jira-reporter.js +8 -8
  6. package/dist/remove-project.js +16 -16
  7. package/dist/vuln-scan.js +16 -16
  8. package/package.json +1 -1
package/dist/jira-reporter.js CHANGED
@@ -1,14 +1,14 @@
1
1
  #!/usr/bin/env node
2
- "use strict";var Ne=Object.create;var re=Object.defineProperty;var Ee=Object.getOwnPropertyDescriptor;var Le=Object.getOwnPropertyNames;var Je=Object.getPrototypeOf,Be=Object.prototype.hasOwnProperty;var Oe=(o,e,r,t)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Le(e))!Be.call(o,n)&&n!==r&&re(o,n,{get:()=>e[n],enumerable:!(t=Ee(e,n))||t.enumerable});return o};var De=(o,e,r)=>(r=o!=null?Ne(Je(o)):{},Oe(e||!o||!o.__esModule?re(r,"default",{value:o,enumerable:!0}):r,o));var Q=require("path"),Te=require("zx");var be=require("fs/promises");var I={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4},y=["UNKNOWN","LOW","MEDIUM","HIGH","CRITICAL"];function V(o,e){return I[o]-I[e]}function k(o,e){return I[o]<I[e]}function C(...o){return{type:"doc",version:1,content:o}}function j(o,e){return{type:"heading",attrs:{level:o},content:[{type:"text",text:e}]}}function N(o,e="text"){return{type:"codeBlock",attrs:{language:e},content:[{type:"text",text:o}]}}function ne(o){return{type:"bulletList",content:o.map(e=>({type:"listItem",content:[{type:"paragraph",content:[{type:"text",text:e}]}]}))}}function oe(o){return{type:"bulletList",content:o.map(e=>({type:"listItem",content:[{type:"paragraph",content:[{type:"text",text:e,marks:[{type:"link",attrs:{href:e}}]}]}]}))}}function E(o,...e){return{type:"expand",attrs:{title:o},content:e}}function h(o){return{type:"paragraph",content:[{type:"text",text:o,marks:[{type:"em"}]}]}}var m=require("fs/promises");async function se(o){try{return await Ue(o)?JSON.parse(await(0,m.readFile)(o,{encoding:"utf-8"})):void 0}catch(e){throw new Error(`Error reading JSON file ${o}: ${e}`,{cause:e})}}async function Ue(o){try{return await(0,m.access)(o,m.constants.F_OK),!0}catch{return!1}}function ie(o,e){return`Basic ${Buffer.from(`${o}:${e}`).toString("base64")}`}var L=class{authHeader;baseUrl;constructor(e,r,t){this.baseUrl=e.replace(/\/$/,""),this.authHeader=ie(r,t)}get headers(){return{Authorization:this.authHeader,"Content-Type":"application/json",Accept:"application/json"}}async safeJson(e,r){let t=await e.text();try{return JSON.parse(t)}catch{let n=t.slice(0,500).replace(/\s+/g," ").trim();throw new Error(`${r}: expected JSON but got (HTTP ${e.status}): ${n}`)}}async findExistingIssue(e,r){let t=e.replace(/"/g,'\\"'),n=r.replace(/"/g,'\\"'),s=`project = "${t}" AND summary ~ "\\"${n}\\""`,i=`${this.baseUrl}/rest/api/3/search/jql?jql=${encodeURIComponent(s)}&maxResults=1&fields=summary,labels,status`,c=await fetch(i,{method:"GET",headers:this.headers});if(!c.ok){let d=await c.text();throw new Error(`Jira search failed (${c.status}): ${d}`)}let l=(await this.safeJson(c,"Jira search")).issues[0];return l?{key:l.key,summary:l.fields?.summary??"",labels:l.fields?.labels??[],statusCategory:l.fields?.status?.statusCategory?.key??"new"}:null}async createIssue(e){let r={project:{key:e.projectKey},issuetype:{name:e.issueType},summary:e.summary,description:e.description};e.labels&&e.labels.length>0&&(r.labels=e.labels),e.sprintId!=null&&(r.customfield_10020=e.sprintId);let t={fields:r},n=await fetch(`${this.baseUrl}/rest/api/3/issue`,{method:"POST",headers:this.headers,body:JSON.stringify(t)});if(!n.ok){let i=await n.text();throw new Error(`Jira create issue failed (${n.status}): ${i}`)}return(await this.safeJson(n,"Jira create issue")).key}async addLabels(e,r){if(r.length===0)return;let t={update:{labels:r.map(s=>({add:s}))}},n=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}`,{method:"PUT",headers:this.headers,body:JSON.stringify(t)});if(!n.ok){let s=await n.text();throw new Error(`Jira add labels failed (${n.status}): ${s}`)}}async updateIssueSummary(e,r){let t={fields:{summary:r}},n=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}`,{method:"PUT",headers:this.headers,body:JSON.stringify(t)});if(!n.ok){let s=await n.text();throw new Error(`Jira update summary failed (${n.status}): ${s}`)}}async setSprint(e,r){let t={fields:{customfield_10020:r}},n=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}`,{method:"PUT",headers:this.headers,body:JSON.stringify(t)});if(!n.ok){let s=await n.text();throw new Error(`Jira set sprint failed (${n.status}): ${s}`)}}async addComment(e,r){let t=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}/comment`,{method:"POST",headers:this.headers,body:JSON.stringify({body:r})});if(!t.ok){let n=await t.text();throw new Error(`Jira add comment failed (${t.status}): ${n}`)}}async getTransitions(e){let r=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}/transitions`,{method:"GET",headers:this.headers});if(!r.ok){let n=await r.text();throw new Error(`Jira get transitions failed (${r.status}): ${n}`)}return(await this.safeJson(r,"Jira transitions lookup")).transitions.map(n=>({id:n.id,name:n.name,toStatusName:n.to?.name??"",toStatusCategory:n.to?.statusCategory?.key??""}))}async transitionIssue(e,r){let t=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}/transitions`,{method:"POST",headers:this.headers,body:JSON.stringify({transition:{id:r}})});if(!t.ok){let n=await t.text();throw new Error(`Jira transition issue failed (${t.status}): ${n}`)}}async attachMarkdown(e,r,t){let n=`${this.baseUrl}/rest/api/3/issue/${e}/attachments`,s=new FormData;s.append("file",new Blob([t],{type:"text/markdown"}),r);let i=await fetch(n,{method:"POST",headers:{Authorization:this.authHeader,"X-Atlassian-Token":"no-check"},body:s});if(!i.ok){let c=await i.text();throw new Error(`Jira attach file failed (${i.status}): ${c}`)}}async getActiveSprintId(e){let r=`${this.baseUrl}/rest/agile/1.0/board/${e}/sprint?state=active&maxResults=1`,t=await fetch(r,{method:"GET",headers:this.headers});if(!t.ok){let s=await t.text();throw new Error(`Jira agile sprint lookup failed (${t.status}): ${s}`)}return(await this.safeJson(t,"Jira sprint lookup")).values[0]?.id??null}};function Me(o){return o.replace(/[.+?^${}()|[\]\\]/g,"\\$&")}function Fe(o,e){let r=e.split("*").map(Me).join(".*");return new RegExp(`^${r}$`).test(o)}function J(o,e){return e.some(r=>Fe(o,r))}function ae(o,e=""){return ce(o,e,new Set,new Set)}function ce(o,e="",r,t){let n=`${e}- ${o.purl}`;if(r.has(o.purl))return n+=" (cycle detected)",n;if(t.has(o.purl))return n+=" (deduplicated)",n;t.add(o.purl),r.add(o.purl);let s=r.size===1;for(let i of o.usedBy){let c=ce(i,e+(s?" ":" "),r,t);c!==""&&(n+=`
2
+ "use strict";var Ee=Object.create;var re=Object.defineProperty;var Ne=Object.getOwnPropertyDescriptor;var Le=Object.getOwnPropertyNames;var Je=Object.getPrototypeOf,Be=Object.prototype.hasOwnProperty;var Oe=(o,e,r,t)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Le(e))!Be.call(o,n)&&n!==r&&re(o,n,{get:()=>e[n],enumerable:!(t=Ne(e,n))||t.enumerable});return o};var De=(o,e,r)=>(r=o!=null?Ee(Je(o)):{},Oe(e||!o||!o.__esModule?re(r,"default",{value:o,enumerable:!0}):r,o));var Q=require("path"),Te=require("zx");var be=require("fs/promises");var I={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4},y=["UNKNOWN","LOW","MEDIUM","HIGH","CRITICAL"];function k(o,e){return I[o]-I[e]}function E(o,e){return I[o]<I[e]}function j(...o){return{type:"doc",version:1,content:o}}function C(o,e){return{type:"heading",attrs:{level:o},content:[{type:"text",text:e}]}}function N(o,e="text"){return{type:"codeBlock",attrs:{language:e},content:[{type:"text",text:o}]}}function ne(o){return{type:"bulletList",content:o.map(e=>({type:"listItem",content:[{type:"paragraph",content:[{type:"text",text:e}]}]}))}}function oe(o){return{type:"bulletList",content:o.map(e=>({type:"listItem",content:[{type:"paragraph",content:[{type:"text",text:e,marks:[{type:"link",attrs:{href:e}}]}]}]}))}}function L(o,...e){return{type:"expand",attrs:{title:o},content:e}}function h(o){return{type:"paragraph",content:[{type:"text",text:o,marks:[{type:"em"}]}]}}var m=require("fs/promises");async function se(o){try{return await Ue(o)?JSON.parse(await(0,m.readFile)(o,{encoding:"utf-8"})):void 0}catch(e){throw new Error(`Error reading JSON file ${o}: ${e}`,{cause:e})}}async function Ue(o){try{return await(0,m.access)(o,m.constants.F_OK),!0}catch{return!1}}function ie(o,e){return`Basic ${Buffer.from(`${o}:${e}`).toString("base64")}`}var J=class{authHeader;baseUrl;constructor(e,r,t){this.baseUrl=e.replace(/\/$/,""),this.authHeader=ie(r,t)}get headers(){return{Authorization:this.authHeader,"Content-Type":"application/json",Accept:"application/json"}}async safeJson(e,r){let t=await e.text();try{return JSON.parse(t)}catch{let n=t.slice(0,500).replace(/\s+/g," ").trim();throw new Error(`${r}: expected JSON but got (HTTP ${e.status}): ${n}`)}}async findExistingIssue(e,r){let t=e.replace(/"/g,'\\"'),n=r.replace(/"/g,'\\"'),s=`project = "${t}" AND summary ~ "\\"${n}\\""`,i=`${this.baseUrl}/rest/api/3/search/jql?jql=${encodeURIComponent(s)}&maxResults=1&fields=summary,labels,status`,c=await fetch(i,{method:"GET",headers:this.headers});if(!c.ok){let d=await c.text();throw new Error(`Jira search failed (${c.status}): ${d}`)}let l=(await this.safeJson(c,"Jira search")).issues[0];return l?{key:l.key,summary:l.fields?.summary??"",labels:l.fields?.labels??[],statusCategory:l.fields?.status?.statusCategory?.key??"new"}:null}async createIssue(e){let r={project:{key:e.projectKey},issuetype:{name:e.issueType},summary:e.summary,description:e.description};e.labels&&e.labels.length>0&&(r.labels=e.labels),e.sprintId!=null&&(r.customfield_10020=e.sprintId);let t={fields:r},n=await fetch(`${this.baseUrl}/rest/api/3/issue`,{method:"POST",headers:this.headers,body:JSON.stringify(t)});if(!n.ok){let i=await n.text();throw new Error(`Jira create issue failed (${n.status}): ${i}`)}return(await this.safeJson(n,"Jira create issue")).key}async addLabels(e,r){if(r.length===0)return;let t={update:{labels:r.map(s=>({add:s}))}},n=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}`,{method:"PUT",headers:this.headers,body:JSON.stringify(t)});if(!n.ok){let s=await n.text();throw new Error(`Jira add labels failed (${n.status}): ${s}`)}}async updateIssueSummary(e,r){let t={fields:{summary:r}},n=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}`,{method:"PUT",headers:this.headers,body:JSON.stringify(t)});if(!n.ok){let s=await n.text();throw new Error(`Jira update summary failed (${n.status}): ${s}`)}}async setSprint(e,r){let t={fields:{customfield_10020:r}},n=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}`,{method:"PUT",headers:this.headers,body:JSON.stringify(t)});if(!n.ok){let s=await n.text();throw new Error(`Jira set sprint failed (${n.status}): ${s}`)}}async addComment(e,r){let t=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}/comment`,{method:"POST",headers:this.headers,body:JSON.stringify({body:r})});if(!t.ok){let n=await t.text();throw new Error(`Jira add comment failed (${t.status}): ${n}`)}}async getTransitions(e){let r=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}/transitions`,{method:"GET",headers:this.headers});if(!r.ok){let n=await r.text();throw new Error(`Jira get transitions failed (${r.status}): ${n}`)}return(await this.safeJson(r,"Jira transitions lookup")).transitions.map(n=>({id:n.id,name:n.name,toStatusName:n.to?.name??"",toStatusCategory:n.to?.statusCategory?.key??""}))}async transitionIssue(e,r){let t=await fetch(`${this.baseUrl}/rest/api/3/issue/${e}/transitions`,{method:"POST",headers:this.headers,body:JSON.stringify({transition:{id:r}})});if(!t.ok){let n=await t.text();throw new Error(`Jira transition issue failed (${t.status}): ${n}`)}}async attachMarkdown(e,r,t){let n=`${this.baseUrl}/rest/api/3/issue/${e}/attachments`,s=new FormData;s.append("file",new Blob([t],{type:"text/markdown"}),r);let i=await fetch(n,{method:"POST",headers:{Authorization:this.authHeader,"X-Atlassian-Token":"no-check"},body:s});if(!i.ok){let c=await i.text();throw new Error(`Jira attach file failed (${i.status}): ${c}`)}}async getActiveSprintId(e){let r=`${this.baseUrl}/rest/agile/1.0/board/${e}/sprint?state=active&maxResults=1`,t=await fetch(r,{method:"GET",headers:this.headers});if(!t.ok){let s=await t.text();throw new Error(`Jira agile sprint lookup failed (${t.status}): ${s}`)}return(await this.safeJson(t,"Jira sprint lookup")).values[0]?.id??null}};function Me(o){return o.replace(/[.+?^${}()|[\]\\]/g,"\\$&")}function Fe(o,e){let r=e.split("*").map(Me).join(".*");return new RegExp(`^${r}$`).test(o)}function B(o,e){return e.some(r=>Fe(o,r))}function ae(o,e=""){return ce(o,e,new Set,new Set)}function ce(o,e="",r,t){let n=`${e}- ${o.purl}`;if(r.has(o.purl))return n+=" (cycle detected)",n;if(t.has(o.purl))return n+=" (deduplicated)",n;t.add(o.purl),r.add(o.purl);let s=r.size===1;for(let i of o.usedBy){let c=ce(i,e+(s?" ":" "),r,t);c!==""&&(n+=`
3
3
  `,n+=c)}return r.delete(o.purl),n}function le(o){let e=o.split(/\r?\n/),r=[],t=0;for(;t<e.length;){let n=e[t],s=n.match(/^```(\w*)$/);if(s){let a=s[1]??"text",l=[];for(t++;t<e.length&&!e[t].startsWith("```");)l.push(e[t]),t++;t++,r.push(N(l.join(`
4
- `),a));continue}let i=n.match(/^(#{1,3})\s+(.+)$/);if(i){let a=Math.min(i[1].length,3);r.push({type:"heading",attrs:{level:a},content:[{type:"text",text:i[2].trim()}]}),t++;continue}if(/^[-*]\s/.test(n)){let a=[];for(;t<e.length&&/^[-*]\s/.test(e[t]);){let l=e[t].replace(/^[-*]\s+/,"");a.push({type:"listItem",content:[{type:"paragraph",content:_(l)}]}),t++}r.push({type:"bulletList",content:a});continue}if(/^\d+\.\s/.test(n)){let a=[];for(;t<e.length&&/^\d+\.\s/.test(e[t]);){let l=e[t].replace(/^\d+\.\s+/,"");a.push({type:"listItem",content:[{type:"paragraph",content:_(l)}]}),t++}r.push({type:"orderedList",content:a});continue}if(n.trim()===""){t++;continue}let c=[];for(;t<e.length&&e[t].trim()!==""&&!/^(#{1,3}\s|[-*]\s|\d+\.\s|```)/.test(e[t]);)c.push(e[t]),t++;if(c.length>0){let a=[];for(let l=0;l<c.length;l++)a.push(..._(c[l])),l<c.length-1&&a.push({type:"hardBreak"});r.push({type:"paragraph",content:a})}}return r}function _(o){let e=[],r=/(\*\*(.+?)\*\*|\*(.+?)\*|`(.+?)`|_(.+?)_)/g,t=0,n;for(;(n=r.exec(o))!==null;)n.index>t&&e.push({type:"text",text:o.slice(t,n.index)}),n[2]!==void 0?e.push({type:"text",text:n[2],marks:[{type:"strong"}]}):n[3]!==void 0?e.push({type:"text",text:n[3],marks:[{type:"em"}]}):n[4]!==void 0?e.push({type:"text",text:n[4],marks:[{type:"code"}]}):n[5]!==void 0&&e.push({type:"text",text:n[5],marks:[{type:"em"}]}),t=n.index+n[0].length;return t<o.length&&e.push({type:"text",text:o.slice(t)}),e.length>0?e:[{type:"text",text:o}]}var Ve=2e4;function z(o){let e=o.title?`: ${o.title}`:"";return`[${o.severity}] ${o.id}${e}`}function de(o){let e=o.match(/^\[([A-Z]+)\]\s+(\S+?)(?::\s*(.*))?$/);if(!e)return;let[,r,t,n]=e;if(!(!r||!t)&&y.includes(r))return{severity:r,vulnId:t,title:n??""}}function ue(o,e,r=new Map){let t=[];if(t.push(j(1,"Informationen zur Schwachstelle")),t.push(h("Diese Informationen wurden automatisch generiert.")),o.refs&&o.refs.length>0&&t.push(oe(o.refs)),o.description){let n=le(o.description);t.push(E("Beschreibung",...n))}return t.push(j(2,"Betroffene Artefakte")),o.components&&o.components.length>0?t.push(ne(o.components)):t.push(h("Keine Komponenten bekannt.")),t.push(j(2,"Gemeldet f\xFCr")),ge(t,e,r),t.push(j(1,"Einwertung")),t.push(h("Einwertung des CVE in Bezug auf die gemeldeten Projekte/Produkte. Dies kann eine Bewertung der Schwere, der Auswirkungen und der Wahrscheinlichkeit eines Angriffs umfassen.")),t.push(j(1,"Betroffen sind")),t.push(h("Abschlie\xDFende Darstellung, welche Projekte/Produkte tats\xE4chlich betroffen oder nicht betroffen sind.")),t.push(j(1,"Ma\xDFnahmen")),t.push(h("\xDCbersicht der zu ergreifenden Ma\xDFnahmen, um den CVE zu beheben oder zu mitigieren. Dies kann Patches, Updates oder Konfigurations\xE4nderungen umfassen.")),C(...t)}function pe(o,e=new Map){let r=[];return r.push(h("Diese Projekte sind ebenfalls von dieser Schwachstelle betroffen und wurden automatisch erg\xE4nzt.")),r.push(j(2,"Zus\xE4tzlich gemeldet f\xFCr")),ge(r,o,e),C(...r)}function T(o){return o.slice().sort((e,r)=>e.projectId.localeCompare(r.projectId)).map(e=>` - ${e.projectId} (Schwelle ${e.threshold})`).join(`
5
- `)}function fe(o,e){let r=[`Automatisch geschlossen: Schwere ${o} liegt unterhalb der konfigurierten Auto-Close-Schwelle.`];return e.length>0&&(r.push("Auto-akzeptiert f\xFCr:"),r.push(T(e))),C(h(r.join(`
6
- `)))}function H(o,e,r){let t=[`Teilweise auto-akzeptiert. Schwere ${o}.`];return e.length>0&&(t.push("Auto-akzeptiert f\xFCr:"),t.push(T(e))),r.length>0&&(t.push("Manuelle Bewertung erforderlich f\xFCr:"),t.push(T(r))),C(h(t.join(`
4
+ `),a));continue}let i=n.match(/^(#{1,3})\s+(.+)$/);if(i){let a=Math.min(i[1].length,3);r.push({type:"heading",attrs:{level:a},content:[{type:"text",text:i[2].trim()}]}),t++;continue}if(/^[-*]\s/.test(n)){let a=[];for(;t<e.length&&/^[-*]\s/.test(e[t]);){let l=e[t].replace(/^[-*]\s+/,"");a.push({type:"listItem",content:[{type:"paragraph",content:_(l)}]}),t++}r.push({type:"bulletList",content:a});continue}if(/^\d+\.\s/.test(n)){let a=[];for(;t<e.length&&/^\d+\.\s/.test(e[t]);){let l=e[t].replace(/^\d+\.\s+/,"");a.push({type:"listItem",content:[{type:"paragraph",content:_(l)}]}),t++}r.push({type:"orderedList",content:a});continue}if(n.trim()===""){t++;continue}let c=[];for(;t<e.length&&e[t].trim()!==""&&!/^(#{1,3}\s|[-*]\s|\d+\.\s|```)/.test(e[t]);)c.push(e[t]),t++;if(c.length>0){let a=[];for(let l=0;l<c.length;l++)a.push(..._(c[l])),l<c.length-1&&a.push({type:"hardBreak"});r.push({type:"paragraph",content:a})}}return r}function _(o){let e=[],r=/(\*\*(.+?)\*\*|\*(.+?)\*|`(.+?)`|_(.+?)_)/g,t=0,n;for(;(n=r.exec(o))!==null;)n.index>t&&e.push({type:"text",text:o.slice(t,n.index)}),n[2]!==void 0?e.push({type:"text",text:n[2],marks:[{type:"strong"}]}):n[3]!==void 0?e.push({type:"text",text:n[3],marks:[{type:"em"}]}):n[4]!==void 0?e.push({type:"text",text:n[4],marks:[{type:"code"}]}):n[5]!==void 0&&e.push({type:"text",text:n[5],marks:[{type:"em"}]}),t=n.index+n[0].length;return t<o.length&&e.push({type:"text",text:o.slice(t)}),e.length>0?e:[{type:"text",text:o}]}var Ve=2e4;function z(o){let e=o.title?`: ${o.title}`:"";return`[${o.severity}] ${o.id}${e}`}function de(o){let e=o.match(/^\[([A-Z]+)\]\s+(\S+?)(?::\s*(.*))?$/);if(!e)return;let[,r,t,n]=e;if(!(!r||!t)&&y.includes(r))return{severity:r,vulnId:t,title:n??""}}function ue(o,e,r=new Map){let t=[];if(t.push(C(1,"Informationen zur Schwachstelle")),t.push(h("Diese Informationen wurden automatisch generiert.")),o.refs&&o.refs.length>0&&t.push(oe(o.refs)),o.description){let n=le(o.description);t.push(L("Beschreibung",...n))}return t.push(C(2,"Betroffene Artefakte")),o.components&&o.components.length>0?t.push(ne(o.components)):t.push(h("Keine Komponenten bekannt.")),t.push(C(2,"Gemeldet f\xFCr")),ge(t,e,r),t.push(C(1,"Einwertung")),t.push(h("Einwertung des CVE in Bezug auf die gemeldeten Projekte/Produkte. Dies kann eine Bewertung der Schwere, der Auswirkungen und der Wahrscheinlichkeit eines Angriffs umfassen.")),t.push(C(1,"Betroffen sind")),t.push(h("Abschlie\xDFende Darstellung, welche Projekte/Produkte tats\xE4chlich betroffen oder nicht betroffen sind.")),t.push(C(1,"Ma\xDFnahmen")),t.push(h("\xDCbersicht der zu ergreifenden Ma\xDFnahmen, um den CVE zu beheben oder zu mitigieren. Dies kann Patches, Updates oder Konfigurations\xE4nderungen umfassen.")),j(...t)}function pe(o,e=new Map){let r=[];return r.push(h("Diese Projekte sind ebenfalls von dieser Schwachstelle betroffen und wurden automatisch erg\xE4nzt.")),r.push(C(2,"Zus\xE4tzlich gemeldet f\xFCr")),ge(r,o,e),j(...r)}function T(o){return o.slice().sort((e,r)=>e.projectId.localeCompare(r.projectId)).map(e=>` - ${e.projectId} (Schwelle ${e.threshold})`).join(`
5
+ `)}function fe(o,e){let r=[`Automatisch geschlossen: Schwere ${o} liegt unterhalb der konfigurierten Auto-Close-Schwelle.`];return e.length>0&&(r.push("Auto-akzeptiert f\xFCr:"),r.push(T(e))),j(h(r.join(`
6
+ `)))}function H(o,e,r){let t=[`Teilweise auto-akzeptiert. Schwere ${o}.`];return e.length>0&&(t.push("Auto-akzeptiert f\xFCr:"),t.push(T(e))),r.length>0&&(t.push("Manuelle Bewertung erforderlich f\xFCr:"),t.push(T(r))),j(h(t.join(`
7
7
  `)))}function he(o,e){let r=[];return o.length>0&&(r.push("Auto-akzeptiert f\xFCr:"),r.push(T(o))),e.length>0&&(r.push("Manuelle Bewertung erforderlich f\xFCr:"),r.push(T(e))),r.join(`
8
- `)}function ge(o,e,r){let t=0;for(let n of e.slice().sort()){o.push({type:"paragraph",content:[{type:"text",text:n,marks:[{type:"strong"}]}]});let s=r.get(n);if(s&&s.length>0){let i=ye(s);i&&(t+=i.length,t>Ve?o.push(E("Verwendungsbaum",h("Gesamtgr\xF6\xDFe der Verwendungsb\xE4ume \xFCberschreitet Limit. Siehe Issue-Attachments f\xFCr vollst\xE4ndige B\xE4ume."))):o.push(E("Verwendungsbaum",N(i))))}}}function me(o,e){if(e.size===0)return"";let r=[`# Verwendungsb\xE4ume f\xFCr ${o}`,""];for(let[t,n]of[...e.entries()].sort(([s],[i])=>s.localeCompare(i))){r.push(`## ${t}`,"");let s=ye(n);s&&r.push("```",s,"```"),r.push("")}return r.join(`
8
+ `)}function ge(o,e,r){let t=0;for(let n of e.slice().sort()){o.push({type:"paragraph",content:[{type:"text",text:n,marks:[{type:"strong"}]}]});let s=r.get(n);if(s&&s.length>0){let i=ye(s);i&&(t+=i.length,t>Ve?o.push(L("Verwendungsbaum",h("Gesamtgr\xF6\xDFe der Verwendungsb\xE4ume \xFCberschreitet Limit. Siehe Issue-Attachments f\xFCr vollst\xE4ndige B\xE4ume."))):o.push(L("Verwendungsbaum",N(i))))}}}function me(o,e){if(e.size===0)return"";let r=[`# Verwendungsb\xE4ume f\xFCr ${o}`,""];for(let[t,n]of[...e.entries()].sort(([s],[i])=>s.localeCompare(i))){r.push(`## ${t}`,"");let s=ye(n);s&&r.push("```",s,"```"),r.push("")}return r.join(`
9
9
  `)}function ye(o){return!o||o.length===0?"":o.map(e=>ae(e,"")).join(`
10
10
 
11
- `)}var W="proj:";function G(o){let e=o.replace(/@/g,"_v").replace(/\s+/g,"_");return`${W}${e}`}function _e(o){if(!o.startsWith(W))return null;let e=o.slice(W.length),r=e.lastIndexOf("_v");return r<0?e:e.slice(0,r)+"@"+e.slice(r+2)}function we(o){let e=new Set;if(!o)return e;for(let r of o){let t=_e(r);t!==null&&e.add(t)}return e}function ve(o){let e=o.severityChange,r=o.newProjects;return e&&r&&r.length>0?`Issue wieder ge\xF6ffnet, da sich der Schweregrad von ${e.from} auf ${e.to} ge\xE4ndert hat und zus\xE4tzlich neue betroffene Projekte gefunden wurden: ${r.join(", ")}.`:e?`Issue wieder ge\xF6ffnet: Schweregrad hat sich von ${e.from} auf ${e.to} ge\xE4ndert. Eine ggf. bestehende automatische VEX-Ausnahme ist nicht mehr g\xFCltig und sollte erneut bewertet werden.`:r&&r.length>0?`Issue wieder ge\xF6ffnet, da die Schwachstelle nun zus\xE4tzlich folgende Projekte betrifft: ${r.join(", ")}. Bitte erneut bewerten, ob die urspr\xFCngliche L\xF6sung/Mitigation weiterhin ausreicht.`:"Issue wieder ge\xF6ffnet."}function Se(o){let e=[];return o.severityChange&&e.push(`severity ${o.severityChange.from}->${o.severityChange.to}`),o.newProjects&&o.newProjects.length>0&&e.push(`new projects: ${o.newProjects.join(", ")}`),e.join(" + ")||"unspecified"}function w(o){return o.length===0?"-":o.map(e=>e.projectId).slice().sort((e,r)=>e.localeCompare(r)).join(", ")}function ze(o){let e=[];return o.autoAcknowledged.length>0&&e.push(`auto-ack: ${w(o.autoAcknowledged)}`),o.manualEvaluation.length>0&&e.push(`manual: ${w(o.manualEvaluation)}`),e.join("; ")}var Ce=10,je=" ".repeat(Ce);function K(o){return`[${o}]`.padEnd(Ce," ")}function $e(o){return o==="warn"?console.warn:o==="error"?console.error:console.log}function He(o,e,r=[]){let t=$e(o);t(`${K(o)}${e}`);for(let n of r)t(`${je}${n}`)}function We(o){let e="\u2500".repeat(Math.max(0,62-o.length-4));console.log(""),console.log(`\u2500\u2500 ${o} ${e}`)}var X=class{vulnId;jiraProject;severity;issueKey;kind="skip";header="";details=[];constructor(e,r,t){this.vulnId=e,this.jiraProject=r,this.severity=t}setOutcome(e,r){this.kind=e,this.header=this.composeHeader(r)}detail(e,r){this.details.push(`${e.padEnd(9," ")}: ${r}`)}note(e){this.details.push(e)}warn(e,r){console.warn(`${K("warn")}${e}`),this.detail("warn",e),r.warnings.push(e)}flush(){let e=$e(this.kind);e(`${K(this.kind)}${this.header}`);for(let r of this.details)e(`${je}${r}`)}composeHeader(e){let r=this.issueKey??"<new>",t=e?` ${e}`:"",n=r.padEnd(12," ");return`${this.vulnId} -> ${n} in ${this.jiraProject}, severity=${this.severity}${t}`}},B=class{constructor(e,r,t){this.config=e;this.client=new L(e.jiraUrl,r,t)}config;client;activeSprintCache=new Map;async report(e,r){let t={created:[],updated:[],skipped:[],errors:[],warnings:[],noMatchingRule:[],reopened:[],autoClosed:[],keptClosed:[]};We("Issue processing");for(let[n,s]of Object.entries(e.vulnerabilities)){let i=e.vulnerabilityToProject[n]??[],c=!1;for(let a of this.config.issues){let l=i.filter(u=>J(u,a.reportProjects));if(l.length===0)continue;c=!0;let d=new X(n,a.jiraProject,s.severity);try{let u=await this.client.findExistingIssue(a.jiraProject,n);u?(d.issueKey=u.key,await this.handleExistingIssue(e,s,u,a,l,r,t,d)):await this.handleNewIssue(e,n,s,a,l,r,t,d)}catch(u){let p=`Failed to process ${n} for project ${a.jiraProject}: ${String(u)}`;t.errors.push(p),d.setOutcome("error"),d.note(`error : ${String(u)}`)}d.flush()}c||(t.noMatchingRule.push(n),He("skip",`${n} (no matching jira-project rule, severity=${s.severity})`))}return t}async handleNewIssue(e,r,t,n,s,i,c,a){let l=z(t),d=this.bucketProjects(s,t.severity,n),u=d.shouldAutoClose,p=!u&&d.autoAcknowledged.length>0&&d.manualEvaluation.length>0;if(i){a.setOutcome("dry-run"),a.detail("would",`create issue with title "${l}"`),a.detail("projects",s.join(", "));let f=`${n.jiraProject}::${r}`;u?(a.detail("would",`auto-close (severity ${t.severity} below threshold ${d.strictestThreshold}; auto-ack: ${w(d.autoAcknowledged)})`),c.autoClosed.push(f)):p&&a.detail("would",`post partial-ack comment (auto: ${w(d.autoAcknowledged)}; manual: ${w(d.manualEvaluation)})`),c.created.push(f);return}let{activeSprintId:v,allLabels:S}=await this.resolveBoardRouting(n,s,a,c),P=this.collectProjectComponentTrees(e,s,t.components),R=ue(t,s,P),A=[...S,...s.map(G)],g=await this.client.createIssue({projectKey:n.jiraProject,issueType:n.issueType,summary:l,description:R,labels:A.length>0?A:void 0,sprintId:v});if(a.issueKey=g,a.setOutcome("create"),a.detail("title",l),a.detail("projects",s.join(", ")),c.created.push(g),P.size>0){let f=me(r,P);if(f){let x=`${r}-dependency-trees.md`;await this.client.attachMarkdown(g,x,f),a.detail("attach",x)}}u?await this.autoCloseIssue(g,t.severity,d,a,c):p&&await this.postPartialAckComment(g,t.severity,d,a,c)}async handleExistingIssue(e,r,t,n,s,i,c,a){let l=we(t.labels),d=s.filter(b=>!l.has(b)),p=de(t.summary)?.severity,v=p!==void 0&&p!==r.severity;if(d.length===0&&!v){a.setOutcome("skip"),a.detail("reason",`already covers all matching projects (${s.join(", ")})`),c.skipped.push(t.key);return}let S=t.statusCategory==="done",P=this.bucketProjects(s,r.severity,n),R=P.strictestThreshold,A=P.shouldAutoClose,g=S&&!A,f=this.bucketProjects(d,r.severity,n),x=g?he(f.autoAcknowledged,f.manualEvaluation):"",ee=!g&&d.length>0&&f.autoAcknowledged.length>0&&f.manualEvaluation.length>0,U=g?{severityChange:v?{from:p,to:r.severity}:void 0,newProjects:d.length>0?d:void 0}:void 0;if(i){if(a.setOutcome("dry-run"),v&&a.detail("would",`retitle severity ${p} -> ${r.severity}`),d.length>0&&a.detail("would",`add project tag(s) ${d.join(", ")}`),g){a.note("would re-open + re-add to active sprint");let b=x?`${Se(U)}; ${ze(f)}`:Se(U);a.detail("would",`post reopen-reason comment (${b})`),c.reopened.push(t.key)}else S&&(a.note(`would keep closed (severity ${r.severity} below auto-close threshold ${R})`),c.keptClosed.push(t.key));ee&&a.detail("would",`post partial-ack comment (auto: ${w(f.autoAcknowledged)}; manual: ${w(f.manualEvaluation)})`),c.updated.push(t.key);return}let{activeSprintId:Re,allLabels:Ie}=await this.resolveBoardRouting(n,s,a,c);if(v){let b=z(r);try{await this.client.updateIssueSummary(t.key,b),a.detail("retitle",`${p} -> ${r.severity}`)}catch(M){a.warn(`Could not update summary of ${t.key}: ${String(M)}`,c)}g||await this.postSeverityChangeComment(t.key,p,r.severity,a,c)}if(d.length>0){let b=this.collectProjectComponentTrees(e,d,r.components),M=[...Ie,...d.map(G)],ke=new Set(t.labels),te=M.filter(F=>!ke.has(F));if(te.length>0&&await this.client.addLabels(t.key,te),!g){let F=ee?H(r.severity,f.autoAcknowledged,f.manualEvaluation):pe(d,b);await this.client.addComment(t.key,F)}a.setOutcome("update"),a.detail("projects",`added ${d.join(", ")}`)}else a.setOutcome("update"),a.detail("reason","severity changed (no new projects)");S&&A?(a.note(`kept closed: severity ${r.severity} below auto-close threshold ${R}`),c.keptClosed.push(t.key)):S&&await this.reopenAndReassignSprint(t.key,Re,U,x,a,c),c.updated.push(t.key)}async postSeverityChangeComment(e,r,t,n,s){try{let i=C(h(`Schweregrad ge\xE4ndert von ${r} auf ${t}. Falls eine automatisch erstellte VEX-Ausnahme bestand, ist sie nicht mehr g\xFCltig.`));await this.client.addComment(e,i)}catch(i){n.warn(`Could not post severity-change comment on ${e}: ${String(i)}`,s)}}async reopenAndReassignSprint(e,r,t,n,s,i){let c;try{c=await this.client.getTransitions(e)}catch(l){s.warn(`Could not list transitions for ${e}: ${String(l)}`,i);return}let a=c.find(l=>l.toStatusCategory==="new");if(!a){s.warn(`${e} is closed but no transition leading to a non-done status is available; leaving status unchanged`,i);return}try{await this.client.transitionIssue(e,a.id),s.detail("reopen",`via "${a.name}"`),i.reopened.push(e)}catch(l){s.warn(`Could not transition ${e} to a non-done status: ${String(l)}`,i);return}if(await this.postReopenReasonComment(e,t,n,s,i),r!=null)try{await this.client.setSprint(e,r),s.detail("sprint",`added to active sprint ${r}`)}catch(l){s.warn(`Could not set sprint for ${e}: ${String(l)}`,i)}}async postReopenReasonComment(e,r,t,n,s){try{let i=t?`${ve(r)}
12
- ${t}`:ve(r),c=C(h(i));await this.client.addComment(e,c),n.detail("comment","reopen-reason posted")}catch(i){n.warn(`Could not post reopen-reason comment on ${e}: ${String(i)}`,s)}}resolveAutoCloseThreshold(e){return e.autoCloseBelowSeverity??this.config.autoCloseBelowSeverity}effectiveProjectThreshold(e,r){let t;for(let n of r.projectOverrides??[])J(e,n.projects)&&(t==null||V(n.autoCloseBelowSeverity,t)<0)&&(t=n.autoCloseBelowSeverity);return t??this.resolveAutoCloseThreshold(r)}bucketProjects(e,r,t){if(e.length===0){let l=this.resolveAutoCloseThreshold(t);return{strictestThreshold:l,autoAcknowledged:[],manualEvaluation:[],shouldAutoClose:l!=null&&k(r,l)}}let n=[],s=[],i,c=!1;for(let l of e){let d=this.effectiveProjectThreshold(l,t);if(d==null){c=!0;continue}(i==null||V(d,i)<0)&&(i=d);let u={projectId:l,threshold:d};k(r,d)?n.push(u):s.push(u)}let a=!c&&s.length===0&&n.length>0&&i!=null&&k(r,i);return{strictestThreshold:i,autoAcknowledged:n,manualEvaluation:s,shouldAutoClose:a}}async autoCloseIssue(e,r,t,n,s){let i=t.strictestThreshold,c;try{c=await this.client.getTransitions(e)}catch(d){n.warn(`Could not list transitions for ${e} (auto-close): ${String(d)}`,s);return}let a=c.filter(d=>d.toStatusCategory==="done"),l=a.find(d=>d.toStatusName.toLowerCase()==="closed")??a.find(d=>{let u=d.name.toLowerCase();return u==="close"||u==="closed"})??a[0];if(!l){n.warn(`${e} has no transition leading to a done status; cannot auto-close`,s);return}try{await this.client.transitionIssue(e,l.id),n.detail("close",`auto-closed (severity ${r} below ${i}) via "${l.name}"`),s.autoClosed.push(e)}catch(d){n.warn(`Could not transition ${e} to a done status: ${String(d)}`,s);return}try{let d=fe(r,t.autoAcknowledged);await this.client.addComment(e,d)}catch(d){n.warn(`Could not post auto-close comment on ${e}: ${String(d)}`,s)}}async postPartialAckComment(e,r,t,n,s){try{let i=H(r,t.autoAcknowledged,t.manualEvaluation);await this.client.addComment(e,i),n.detail("comment",`partial-ack posted (auto: ${w(t.autoAcknowledged)}; manual: ${w(t.manualEvaluation)})`)}catch(i){n.warn(`Could not post partial-ack comment on ${e}: ${String(i)}`,s)}}async resolveBoardRouting(e,r,t,n){let s,i=[],c=!1;for(let l of e.addToBoard??[]){let d=l.matchProjects??["*"];if(r.some(p=>J(p,d)))if(l.sprintBoardId!=null){if(!c){c=!0;let p=l.sprintBoardId;if(!this.activeSprintCache.has(p)){let v=await this.client.getActiveSprintId(p).catch(S=>(t.warn(`Could not resolve active sprint for boardId ${p}: ${String(S)}`,n),null));this.activeSprintCache.set(p,v)}s=this.activeSprintCache.get(p)??void 0,l.issueLabels&&i.push(...l.issueLabels)}}else l.issueLabels&&i.push(...l.issueLabels)}let a=[...e.issueLabels??[],...i];return{activeSprintId:s,allLabels:a}}collectProjectComponentTrees(e,r,t){let n=new Map;if(!e.projectsToComponents)return n;for(let s of r){let i=e.projectsToComponents[s]??{},c=[];for(let a of t){let l=i[a];l&&c.push(l)}c.length>0&&n.set(s,c)}return n}};var $=De(require("path")),q=require("fs/promises");var Y=class o{constructor(e){this.workingDir=e}workingDir;static DEFAULT_MAVEN_REPO="https://repository.conterra.de/repository/maven-mirror-ct";static DEFAULT_VEX_SUBDIR="input/vex";static DEFAULT_OUT_SUBDIR="output";static DEFAULT_CACHE_SUBDIR="cache";static DEFAULT_SCANNERS=["grype","trivy","ossindex"];normalize(e,r){let t=e.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:r,onNewVulnerabilities:e.onNewVulnerabilities??(e.failOnNewVulnerabilities?"fail":"warn"),onNoLongerDetectedVulnerabilities:e.onNoLongerDetectedVulnerabilities??"ignore",reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities??!0,consoleReport:e.consoleReport??"BY_PROJECT_DETAILED",createSubDirsForProject:e.createSubDirsForProject??!0,mavenRepo:e.mavenRepo??o.DEFAULT_MAVEN_REPO,vexUrls:e.vexUrls??[],vexDir:this.resolvePath(e.vexDir)??(0,$.resolve)(this.workingDir,o.DEFAULT_VEX_SUBDIR),outDir:this.resolvePath(e.outDir)??(0,$.resolve)(this.workingDir,o.DEFAULT_OUT_SUBDIR),cacheDir:this.resolvePath(e.cacheDir)??(0,$.resolve)(this.workingDir,o.DEFAULT_CACHE_SUBDIR),scanners:this.normalizeScanners(e.scanners,r),projects:this.normalizeProjects(e.projects??[],t)}}normalizeScanners(e,r){return(e??o.DEFAULT_SCANNERS).map(n=>{if(typeof n!="string")throw new Error(`Invalid scanner name '${String(n)}' in configuration file '${r}'`);let s=n.split("@");if(s.length>2)throw new Error(`Invalid scanner name '${n}' in configuration file '${r}'`);return{name:s[0],version:s[1]??""}})}normalizeProjects(e,r){return e.map(t=>{let n=t;if(!n.name)throw new Error("Project name is missing on entry: "+JSON.stringify(n));if(!n.version)throw new Error("Project version is missing on entry: "+JSON.stringify(n));if(!n.purl)throw new Error("Project purl is missing on entry: "+JSON.stringify(n));let s={...n,purlAliases:n.purlAliases??[],enabled:n.enabled??!0,silent:n.silent??!1,minimumSeverity:n.minimumSeverity??"UNKNOWN"};return s.sbomFile?{...s,sbomFile:this.resolvePath(s.sbomFile)??s.sbomFile}:{...s,detectNoLongerUsedVulnerabilities:r?s.purl.endsWith("-SNAPSHOT"):!0}})}resolvePath(e){if(e)return $.default.isAbsolute(e)?e:(0,$.resolve)(this.workingDir,e)}},O=class{constructor(e){this.workingDir=e;this.normalizer=new Y(e)}workingDir;normalizer;projectConfigCache;async loadProjectConfig(){return this.projectConfigCache??=this.doLoadProjectConfig(),this.projectConfigCache}async doLoadProjectConfig(){let e=(0,$.resolve)(this.workingDir,"vuln-scan-conf.json"),r=await se(e);if(!r)throw new Error(`Missing project configuration file '${e}'`);return this.normalizer.normalize(r,e)}async loadJiraConfig(e){let r=await(0,q.readFile)(e,"utf8"),t=JSON.parse(r);if(!t.issues&&t.issue&&(t.issues=t.issue),!t.jiraUrl||typeof t.jiraUrl!="string")throw new Error("jira-conf.json: missing or invalid 'jiraUrl' field");if(!Array.isArray(t.issues))throw new Error("jira-conf.json: missing or invalid 'issues' array");this.validateAutoCloseSeverity(t.autoCloseBelowSeverity,"jira-conf.json: invalid 'autoCloseBelowSeverity'");for(let[n,s]of t.issues.entries())if(s&&typeof s=="object"){let i=s;this.validateAutoCloseSeverity(i.autoCloseBelowSeverity,`jira-conf.json: invalid 'issues[${n}].autoCloseBelowSeverity'`),this.validateAutoCloseProjectOverrides(i.projectOverrides,`jira-conf.json: invalid 'issues[${n}].projectOverrides'`)}return t}validateAutoCloseSeverity(e,r){if(e!==void 0&&!y.includes(e))throw new Error(`${r} value '${String(e)}'. Must be one of: ${y.join(", ")}`)}validateAutoCloseProjectOverrides(e,r){if(e!==void 0){if(!Array.isArray(e))throw new Error(`${r}: must be an array`);for(let t=0;t<e.length;t++){let n=e[t],s=`${r}[${t}]`;if(n==null||typeof n!="object")throw new Error(`${s}: must be an object`);let i=n,c=i.projects;if(!Array.isArray(c)||c.length===0)throw new Error(`${s}.projects: must be a non-empty array of strings`);for(let a=0;a<c.length;a++){let l=c[a];if(typeof l!="string"||l.length===0)throw new Error(`${s}.projects[${a}]: must be a non-empty string`)}if(i.autoCloseBelowSeverity===void 0)throw new Error(`${s}.autoCloseBelowSeverity: is required`);if(this.validateAutoCloseSeverity(i.autoCloseBelowSeverity,`${s}.autoCloseBelowSeverity`),i.comment!==void 0&&typeof i.comment!="string")throw new Error(`${s}.comment: must be a string`)}}}async loadAutoVexConfig(e){let r=await(0,q.readFile)(e,"utf8"),t=JSON.parse(r);if(!t.impactStatement||typeof t.impactStatement!="string")throw new Error("auto-vex-conf.json: missing or invalid 'impactStatement' field (must be a non-empty string)");if(t.maxSeverity!==void 0&&!y.includes(t.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'maxSeverity' value '${String(t.maxSeverity)}'. Must be one of: ${y.join(", ")}`);if(t.projectOverrides!==void 0){if(!Array.isArray(t.projectOverrides))throw new Error("auto-vex-conf.json: 'projectOverrides' must be an array");for(let[n,s]of t.projectOverrides.entries()){if(!s||typeof s!="object")throw new Error(`auto-vex-conf.json: 'projectOverrides[${n}]' must be an object`);let i=s;if(!Array.isArray(i.projects)||i.projects.length===0||!i.projects.every(c=>typeof c=="string"&&c.length>0))throw new Error(`auto-vex-conf.json: 'projectOverrides[${n}].projects' must be a non-empty array of non-empty strings`);if(!y.includes(i.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'projectOverrides[${n}].maxSeverity' value '${String(i.maxSeverity)}'. Must be one of: ${y.join(", ")}`)}}return t}};async function Pe(o){let{scanSummaryPath:e,jiraConfigPath:r,jiraUser:t,jiraApiToken:n,dryRun:s=!1}=o,i=new O(process.cwd()),[c,a]=await Promise.all([Ge(e),i.loadJiraConfig(r)]);return new B(a,t,n).report(c,s)}function Ae(o){return o.created.length===0&&o.updated.length===0&&o.skipped.length===0&&o.noMatchingRule.length===0&&o.autoClosed.length===0&&o.reopened.length===0&&o.keptClosed.length===0&&o.warnings.length===0&&o.errors.length===0}async function Ge(o){let e=await(0,be.readFile)(o,"utf8");return JSON.parse(e)}var Z={flag:"--dry-run",description:"Print what would happen without making changes"},D=class{specs;booleanSpecs;commandName;helpLines;constructor(e,r,t=[],n=[]){this.commandName=e,this.specs=r;let s=n.some(i=>i.flag===Z.flag);this.booleanSpecs=s?n:[...n,Z],this.helpLines=t}parse(e){let r=e.slice(2),t=new Map(this.specs.map(s=>[s.flag,s.defaultValue])),n=new Map(this.booleanSpecs.map(s=>[s.flag,!1]));for(let s=0;s<r.length;s++){let i=r[s];(i==="--help"||i==="-h")&&(this.printHelp(),process.exit(0));let c=this.booleanSpecs.find(l=>l.flag===i||l.alias===i);if(c){n.set(c.flag,!0);continue}let a=this.specs.find(l=>l.flag===i||l.alias===i);a&&r[s+1]?t.set(a.flag,r[++s]):(console.error(`Unknown argument: ${i}`),this.printHelp(),process.exit(1))}return{values:t,dryRun:n.get(Z.flag)===!0,booleans:n}}printHelp(){let e=this.specs.map(t=>` ${(t.alias?`${t.alias}, ${t.flag} <path>`:` ${t.flag} <path>`).padEnd(38)}${t.description}
11
+ `)}var W="proj:";function G(o){let e=o.replace(/@/g,"_v").replace(/\s+/g,"_");return`${W}${e}`}function _e(o){if(!o.startsWith(W))return null;let e=o.slice(W.length),r=e.lastIndexOf("_v");return r<0?e:e.slice(0,r)+"@"+e.slice(r+2)}function we(o){let e=new Set;if(!o)return e;for(let r of o){let t=_e(r);t!==null&&e.add(t)}return e}function ve(o){let e=o.severityChange,r=o.newProjects;return e&&r&&r.length>0?`Issue wieder ge\xF6ffnet, da sich der Schweregrad von ${e.from} auf ${e.to} ge\xE4ndert hat und zus\xE4tzlich neue betroffene Projekte gefunden wurden: ${r.join(", ")}.`:e?`Issue wieder ge\xF6ffnet: Schweregrad hat sich von ${e.from} auf ${e.to} ge\xE4ndert. Eine ggf. bestehende automatische VEX-Ausnahme ist nicht mehr g\xFCltig und sollte erneut bewertet werden.`:r&&r.length>0?`Issue wieder ge\xF6ffnet, da die Schwachstelle nun zus\xE4tzlich folgende Projekte betrifft: ${r.join(", ")}. Bitte erneut bewerten, ob die urspr\xFCngliche L\xF6sung/Mitigation weiterhin ausreicht.`:"Issue wieder ge\xF6ffnet."}function Se(o){let e=[];return o.severityChange&&e.push(`severity ${o.severityChange.from}->${o.severityChange.to}`),o.newProjects&&o.newProjects.length>0&&e.push(`new projects: ${o.newProjects.join(", ")}`),e.join(" + ")||"unspecified"}function w(o){return o.length===0?"-":o.map(e=>e.projectId).slice().sort((e,r)=>e.localeCompare(r)).join(", ")}function ze(o){let e=[];return o.autoAcknowledged.length>0&&e.push(`auto-ack: ${w(o.autoAcknowledged)}`),o.manualEvaluation.length>0&&e.push(`manual: ${w(o.manualEvaluation)}`),e.join("; ")}var je=10,Ce=" ".repeat(je);function q(o){return`[${o}]`.padEnd(je," ")}function $e(o){return o==="warn"?console.warn:o==="error"?console.error:console.log}function He(o,e,r=[]){let t=$e(o);t(`${q(o)}${e}`);for(let n of r)t(`${Ce}${n}`)}function We(o){let e="\u2500".repeat(Math.max(0,62-o.length-4));console.log(""),console.log(`\u2500\u2500 ${o} ${e}`)}var K=class{vulnId;jiraProject;severity;issueKey;kind="skip";header="";details=[];constructor(e,r,t){this.vulnId=e,this.jiraProject=r,this.severity=t}setOutcome(e,r){this.kind=e,this.header=this.composeHeader(r)}detail(e,r){this.details.push(`${e.padEnd(9," ")}: ${r}`)}note(e){this.details.push(e)}warn(e,r){console.warn(`${q("warn")}${e}`),this.detail("warn",e),r.warnings.push(e)}flush(){let e=$e(this.kind);e(`${q(this.kind)}${this.header}`);for(let r of this.details)e(`${Ce}${r}`)}composeHeader(e){let r=this.issueKey??"<new>",t=e?` ${e}`:"",n=r.padEnd(12," ");return`${this.vulnId} -> ${n} in ${this.jiraProject}, severity=${this.severity}${t}`}},O=class{constructor(e,r,t){this.config=e;this.client=new J(e.jiraUrl,r,t)}config;client;activeSprintCache=new Map;async report(e,r){let t={created:[],updated:[],skipped:[],errors:[],warnings:[],noMatchingRule:[],reopened:[],autoClosed:[],keptClosed:[]};We("Issue processing");for(let[n,s]of Object.entries(e.vulnerabilities)){let i=e.vulnerabilityToProject[n]??[],c=!1;for(let a of this.config.issues){let l=i.filter(u=>B(u,a.reportProjects));if(l.length===0)continue;c=!0;let d=new K(n,a.jiraProject,s.severity);try{let u=await this.client.findExistingIssue(a.jiraProject,n);u?(d.issueKey=u.key,await this.handleExistingIssue(e,s,u,a,l,r,t,d)):await this.handleNewIssue(e,n,s,a,l,r,t,d)}catch(u){let p=`Failed to process ${n} for project ${a.jiraProject}: ${String(u)}`;t.errors.push(p),d.setOutcome("error"),d.note(`error : ${String(u)}`)}d.flush()}c||(t.noMatchingRule.push(n),He("skip",`${n} (no matching jira-project rule, severity=${s.severity})`))}return t}async handleNewIssue(e,r,t,n,s,i,c,a){let l=z(t),d=this.bucketProjects(s,t.severity,n),u=d.shouldAutoClose,p=!u&&d.autoAcknowledged.length>0&&d.manualEvaluation.length>0;if(i){a.setOutcome("dry-run"),a.detail("would",`create issue with title "${l}"`),a.detail("projects",s.join(", "));let f=`${n.jiraProject}::${r}`;u?(a.detail("would",`auto-close (severity ${t.severity} below threshold ${d.strictestThreshold}; auto-ack: ${w(d.autoAcknowledged)})`),c.autoClosed.push(f)):p&&a.detail("would",`post partial-ack comment (auto: ${w(d.autoAcknowledged)}; manual: ${w(d.manualEvaluation)})`),c.created.push(f);return}let{activeSprintId:v,allLabels:S}=await this.resolveBoardRouting(n,s,a,c),P=this.collectProjectComponentTrees(e,s,t.components),R=ue(t,s,P),A=[...S,...s.map(G)],g=await this.client.createIssue({projectKey:n.jiraProject,issueType:n.issueType,summary:l,description:R,labels:A.length>0?A:void 0,sprintId:v});if(a.issueKey=g,a.setOutcome("create"),a.detail("title",l),a.detail("projects",s.join(", ")),c.created.push(g),P.size>0){let f=me(r,P);if(f){let x=`${r}-dependency-trees.md`;await this.client.attachMarkdown(g,x,f),a.detail("attach",x)}}u?await this.autoCloseIssue(g,t.severity,d,a,c):p&&await this.postPartialAckComment(g,t.severity,d,a,c)}async handleExistingIssue(e,r,t,n,s,i,c,a){let l=we(t.labels),d=s.filter(b=>!l.has(b)),p=de(t.summary)?.severity,v=p!==void 0&&k(r.severity,p)>0;if(d.length===0&&!v){a.setOutcome("skip"),a.detail("reason",`already covers all matching projects (${s.join(", ")})`),c.skipped.push(t.key);return}let S=t.statusCategory==="done",P=this.bucketProjects(s,r.severity,n),R=P.strictestThreshold,A=P.shouldAutoClose,g=S&&!A,f=this.bucketProjects(d,r.severity,n),x=g?he(f.autoAcknowledged,f.manualEvaluation):"",ee=!g&&d.length>0&&f.autoAcknowledged.length>0&&f.manualEvaluation.length>0,M=g?{severityChange:v?{from:p,to:r.severity}:void 0,newProjects:d.length>0?d:void 0}:void 0;if(i){if(a.setOutcome("dry-run"),v&&a.detail("would",`retitle severity ${p} -> ${r.severity}`),d.length>0&&a.detail("would",`add project tag(s) ${d.join(", ")}`),g){a.note("would re-open + re-add to active sprint");let b=x?`${Se(M)}; ${ze(f)}`:Se(M);a.detail("would",`post reopen-reason comment (${b})`),c.reopened.push(t.key)}else S&&(a.note(`would keep closed (severity ${r.severity} below auto-close threshold ${R})`),c.keptClosed.push(t.key));ee&&a.detail("would",`post partial-ack comment (auto: ${w(f.autoAcknowledged)}; manual: ${w(f.manualEvaluation)})`),c.updated.push(t.key);return}let{activeSprintId:Re,allLabels:Ie}=await this.resolveBoardRouting(n,s,a,c);if(v){let b=z(r);try{await this.client.updateIssueSummary(t.key,b),a.detail("retitle",`${p} -> ${r.severity}`)}catch(F){a.warn(`Could not update summary of ${t.key}: ${String(F)}`,c)}g||await this.postSeverityChangeComment(t.key,p,r.severity,a,c)}if(d.length>0){let b=this.collectProjectComponentTrees(e,d,r.components),F=[...Ie,...d.map(G)],ke=new Set(t.labels),te=F.filter(V=>!ke.has(V));if(te.length>0&&await this.client.addLabels(t.key,te),!g){let V=ee?H(r.severity,f.autoAcknowledged,f.manualEvaluation):pe(d,b);await this.client.addComment(t.key,V)}a.setOutcome("update"),a.detail("projects",`added ${d.join(", ")}`)}else a.setOutcome("update"),a.detail("reason","severity changed (no new projects)");S&&A?(a.note(`kept closed: severity ${r.severity} below auto-close threshold ${R}`),c.keptClosed.push(t.key)):S&&await this.reopenAndReassignSprint(t.key,Re,M,x,a,c),c.updated.push(t.key)}async postSeverityChangeComment(e,r,t,n,s){try{let i=j(h(`Schweregrad ge\xE4ndert von ${r} auf ${t}. Falls eine automatisch erstellte VEX-Ausnahme bestand, ist sie nicht mehr g\xFCltig.`));await this.client.addComment(e,i)}catch(i){n.warn(`Could not post severity-change comment on ${e}: ${String(i)}`,s)}}async reopenAndReassignSprint(e,r,t,n,s,i){let c;try{c=await this.client.getTransitions(e)}catch(l){s.warn(`Could not list transitions for ${e}: ${String(l)}`,i);return}let a=c.find(l=>l.toStatusCategory==="new");if(!a){s.warn(`${e} is closed but no transition leading to a non-done status is available; leaving status unchanged`,i);return}try{await this.client.transitionIssue(e,a.id),s.detail("reopen",`via "${a.name}"`),i.reopened.push(e)}catch(l){s.warn(`Could not transition ${e} to a non-done status: ${String(l)}`,i);return}if(await this.postReopenReasonComment(e,t,n,s,i),r!=null)try{await this.client.setSprint(e,r),s.detail("sprint",`added to active sprint ${r}`)}catch(l){s.warn(`Could not set sprint for ${e}: ${String(l)}`,i)}}async postReopenReasonComment(e,r,t,n,s){try{let i=t?`${ve(r)}
12
+ ${t}`:ve(r),c=j(h(i));await this.client.addComment(e,c),n.detail("comment","reopen-reason posted")}catch(i){n.warn(`Could not post reopen-reason comment on ${e}: ${String(i)}`,s)}}resolveAutoCloseThreshold(e){return e.autoCloseBelowSeverity??this.config.autoCloseBelowSeverity}effectiveProjectThreshold(e,r){let t;for(let n of r.projectOverrides??[])B(e,n.projects)&&(t==null||k(n.autoCloseBelowSeverity,t)<0)&&(t=n.autoCloseBelowSeverity);return t??this.resolveAutoCloseThreshold(r)}bucketProjects(e,r,t){if(e.length===0){let l=this.resolveAutoCloseThreshold(t);return{strictestThreshold:l,autoAcknowledged:[],manualEvaluation:[],shouldAutoClose:l!=null&&E(r,l)}}let n=[],s=[],i,c=!1;for(let l of e){let d=this.effectiveProjectThreshold(l,t);if(d==null){c=!0;continue}(i==null||k(d,i)<0)&&(i=d);let u={projectId:l,threshold:d};E(r,d)?n.push(u):s.push(u)}let a=!c&&s.length===0&&n.length>0&&i!=null&&E(r,i);return{strictestThreshold:i,autoAcknowledged:n,manualEvaluation:s,shouldAutoClose:a}}async autoCloseIssue(e,r,t,n,s){let i=t.strictestThreshold,c;try{c=await this.client.getTransitions(e)}catch(d){n.warn(`Could not list transitions for ${e} (auto-close): ${String(d)}`,s);return}let a=c.filter(d=>d.toStatusCategory==="done"),l=a.find(d=>d.toStatusName.toLowerCase()==="closed")??a.find(d=>{let u=d.name.toLowerCase();return u==="close"||u==="closed"})??a[0];if(!l){n.warn(`${e} has no transition leading to a done status; cannot auto-close`,s);return}try{await this.client.transitionIssue(e,l.id),n.detail("close",`auto-closed (severity ${r} below ${i}) via "${l.name}"`),s.autoClosed.push(e)}catch(d){n.warn(`Could not transition ${e} to a done status: ${String(d)}`,s);return}try{let d=fe(r,t.autoAcknowledged);await this.client.addComment(e,d)}catch(d){n.warn(`Could not post auto-close comment on ${e}: ${String(d)}`,s)}}async postPartialAckComment(e,r,t,n,s){try{let i=H(r,t.autoAcknowledged,t.manualEvaluation);await this.client.addComment(e,i),n.detail("comment",`partial-ack posted (auto: ${w(t.autoAcknowledged)}; manual: ${w(t.manualEvaluation)})`)}catch(i){n.warn(`Could not post partial-ack comment on ${e}: ${String(i)}`,s)}}async resolveBoardRouting(e,r,t,n){let s,i=[],c=!1;for(let l of e.addToBoard??[]){let d=l.matchProjects??["*"];if(r.some(p=>B(p,d)))if(l.sprintBoardId!=null){if(!c){c=!0;let p=l.sprintBoardId;if(!this.activeSprintCache.has(p)){let v=await this.client.getActiveSprintId(p).catch(S=>(t.warn(`Could not resolve active sprint for boardId ${p}: ${String(S)}`,n),null));this.activeSprintCache.set(p,v)}s=this.activeSprintCache.get(p)??void 0,l.issueLabels&&i.push(...l.issueLabels)}}else l.issueLabels&&i.push(...l.issueLabels)}let a=[...e.issueLabels??[],...i];return{activeSprintId:s,allLabels:a}}collectProjectComponentTrees(e,r,t){let n=new Map;if(!e.projectsToComponents)return n;for(let s of r){let i=e.projectsToComponents[s]??{},c=[];for(let a of t){let l=i[a];l&&c.push(l)}c.length>0&&n.set(s,c)}return n}};var $=De(require("path")),X=require("fs/promises");var Y=class o{constructor(e){this.workingDir=e}workingDir;static DEFAULT_MAVEN_REPO="https://repository.conterra.de/repository/maven-mirror-ct";static DEFAULT_VEX_SUBDIR="input/vex";static DEFAULT_OUT_SUBDIR="output";static DEFAULT_CACHE_SUBDIR="cache";static DEFAULT_SCANNERS=["grype","trivy","ossindex"];normalize(e,r){let t=e.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:r,onNewVulnerabilities:e.onNewVulnerabilities??(e.failOnNewVulnerabilities?"fail":"warn"),onNoLongerDetectedVulnerabilities:e.onNoLongerDetectedVulnerabilities??"ignore",reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities??!0,consoleReport:e.consoleReport??"BY_PROJECT_DETAILED",createSubDirsForProject:e.createSubDirsForProject??!0,mavenRepo:e.mavenRepo??o.DEFAULT_MAVEN_REPO,vexUrls:e.vexUrls??[],vexDir:this.resolvePath(e.vexDir)??(0,$.resolve)(this.workingDir,o.DEFAULT_VEX_SUBDIR),outDir:this.resolvePath(e.outDir)??(0,$.resolve)(this.workingDir,o.DEFAULT_OUT_SUBDIR),cacheDir:this.resolvePath(e.cacheDir)??(0,$.resolve)(this.workingDir,o.DEFAULT_CACHE_SUBDIR),scanners:this.normalizeScanners(e.scanners,r),projects:this.normalizeProjects(e.projects??[],t)}}normalizeScanners(e,r){return(e??o.DEFAULT_SCANNERS).map(n=>{if(typeof n!="string")throw new Error(`Invalid scanner name '${String(n)}' in configuration file '${r}'`);let s=n.split("@");if(s.length>2)throw new Error(`Invalid scanner name '${n}' in configuration file '${r}'`);return{name:s[0],version:s[1]??""}})}normalizeProjects(e,r){let t=e.map(n=>{let s=n;if(!s.name)throw new Error("Project name is missing on entry: "+JSON.stringify(s));if(!s.version)throw new Error("Project version is missing on entry: "+JSON.stringify(s));if(!s.purl)throw new Error("Project purl is missing on entry: "+JSON.stringify(s));let i={...s,purlAliases:s.purlAliases??[],enabled:s.enabled??!0,silent:s.silent??!1,minimumSeverity:s.minimumSeverity??"UNKNOWN"};return i.sbomFile?{...i,sbomFile:this.resolvePath(i.sbomFile)??i.sbomFile}:{...i,detectNoLongerUsedVulnerabilities:r?i.purl.endsWith("-SNAPSHOT"):!0}});return this.assertUniqueProjectIds(t),this.assertUniqueProjectPurls(t),t}assertUniqueProjectIds(e){let r=new Set;for(let t of e){let n=`${t.name}@${t.version}`;if(r.has(n))throw new Error(`Duplicate project id '${n}' in vuln-scan-conf.json: each 'name@version' pair must be unique across the projects array.`);r.add(n)}}assertUniqueProjectPurls(e){let r=new Map;for(let t of e){let n=`${t.name}@${t.version}`,s=r.get(t.purl);if(s!==void 0)throw new Error(`Duplicate project purl '${t.purl}' in vuln-scan-conf.json: used by '${s}' and '${n}'. Each project must have a unique purl; use 'purlAliases' when two projects should be matched by the same VEX statement.`);r.set(t.purl,n)}}resolvePath(e){if(e)return $.default.isAbsolute(e)?e:(0,$.resolve)(this.workingDir,e)}},D=class{constructor(e){this.workingDir=e;this.normalizer=new Y(e)}workingDir;normalizer;projectConfigCache;async loadProjectConfig(){return this.projectConfigCache??=this.doLoadProjectConfig(),this.projectConfigCache}async doLoadProjectConfig(){let e=(0,$.resolve)(this.workingDir,"vuln-scan-conf.json"),r=await se(e);if(!r)throw new Error(`Missing project configuration file '${e}'`);return this.normalizer.normalize(r,e)}async loadJiraConfig(e){let r=await(0,X.readFile)(e,"utf8"),t=JSON.parse(r);if(!t.issues&&t.issue&&(t.issues=t.issue),!t.jiraUrl||typeof t.jiraUrl!="string")throw new Error("jira-conf.json: missing or invalid 'jiraUrl' field");if(!Array.isArray(t.issues))throw new Error("jira-conf.json: missing or invalid 'issues' array");this.validateAutoCloseSeverity(t.autoCloseBelowSeverity,"jira-conf.json: invalid 'autoCloseBelowSeverity'");for(let[n,s]of t.issues.entries())if(s&&typeof s=="object"){let i=s;this.validateAutoCloseSeverity(i.autoCloseBelowSeverity,`jira-conf.json: invalid 'issues[${n}].autoCloseBelowSeverity'`),this.validateAutoCloseProjectOverrides(i.projectOverrides,`jira-conf.json: invalid 'issues[${n}].projectOverrides'`)}return t}validateAutoCloseSeverity(e,r){if(e!==void 0&&!y.includes(e))throw new Error(`${r} value '${String(e)}'. Must be one of: ${y.join(", ")}`)}validateAutoCloseProjectOverrides(e,r){if(e!==void 0){if(!Array.isArray(e))throw new Error(`${r}: must be an array`);for(let t=0;t<e.length;t++){let n=e[t],s=`${r}[${t}]`;if(n==null||typeof n!="object")throw new Error(`${s}: must be an object`);let i=n,c=i.projects;if(!Array.isArray(c)||c.length===0)throw new Error(`${s}.projects: must be a non-empty array of strings`);for(let a=0;a<c.length;a++){let l=c[a];if(typeof l!="string"||l.length===0)throw new Error(`${s}.projects[${a}]: must be a non-empty string`)}if(i.autoCloseBelowSeverity===void 0)throw new Error(`${s}.autoCloseBelowSeverity: is required`);if(this.validateAutoCloseSeverity(i.autoCloseBelowSeverity,`${s}.autoCloseBelowSeverity`),i.comment!==void 0&&typeof i.comment!="string")throw new Error(`${s}.comment: must be a string`)}}}async loadAutoVexConfig(e){let r=await(0,X.readFile)(e,"utf8"),t=JSON.parse(r);if(!t.impactStatement||typeof t.impactStatement!="string")throw new Error("auto-vex-conf.json: missing or invalid 'impactStatement' field (must be a non-empty string)");if(t.maxSeverity!==void 0&&!y.includes(t.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'maxSeverity' value '${String(t.maxSeverity)}'. Must be one of: ${y.join(", ")}`);if(t.projectOverrides!==void 0){if(!Array.isArray(t.projectOverrides))throw new Error("auto-vex-conf.json: 'projectOverrides' must be an array");for(let[n,s]of t.projectOverrides.entries()){if(!s||typeof s!="object")throw new Error(`auto-vex-conf.json: 'projectOverrides[${n}]' must be an object`);let i=s;if(!Array.isArray(i.projects)||i.projects.length===0||!i.projects.every(c=>typeof c=="string"&&c.length>0))throw new Error(`auto-vex-conf.json: 'projectOverrides[${n}].projects' must be a non-empty array of non-empty strings`);if(!y.includes(i.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'projectOverrides[${n}].maxSeverity' value '${String(i.maxSeverity)}'. Must be one of: ${y.join(", ")}`)}}return t}};async function Pe(o){let{scanSummaryPath:e,jiraConfigPath:r,jiraUser:t,jiraApiToken:n,dryRun:s=!1}=o,i=new D(process.cwd()),[c,a]=await Promise.all([Ge(e),i.loadJiraConfig(r)]);return new O(a,t,n).report(c,s)}function Ae(o){return o.created.length===0&&o.updated.length===0&&o.skipped.length===0&&o.noMatchingRule.length===0&&o.autoClosed.length===0&&o.reopened.length===0&&o.keptClosed.length===0&&o.warnings.length===0&&o.errors.length===0}async function Ge(o){let e=await(0,be.readFile)(o,"utf8");return JSON.parse(e)}var Z={flag:"--dry-run",description:"Print what would happen without making changes"},U=class{specs;booleanSpecs;commandName;helpLines;constructor(e,r,t=[],n=[]){this.commandName=e,this.specs=r;let s=n.some(i=>i.flag===Z.flag);this.booleanSpecs=s?n:[...n,Z],this.helpLines=t}parse(e){let r=e.slice(2),t=new Map(this.specs.map(s=>[s.flag,s.defaultValue])),n=new Map(this.booleanSpecs.map(s=>[s.flag,!1]));for(let s=0;s<r.length;s++){let i=r[s];(i==="--help"||i==="-h")&&(this.printHelp(),process.exit(0));let c=this.booleanSpecs.find(l=>l.flag===i||l.alias===i);if(c){n.set(c.flag,!0);continue}let a=this.specs.find(l=>l.flag===i||l.alias===i);a&&r[s+1]?t.set(a.flag,r[++s]):(console.error(`Unknown argument: ${i}`),this.printHelp(),process.exit(1))}return{values:t,dryRun:n.get(Z.flag)===!0,booleans:n}}printHelp(){let e=this.specs.map(t=>` ${(t.alias?`${t.alias}, ${t.flag} <path>`:` ${t.flag} <path>`).padEnd(38)}${t.description}
13
13
  ${"".padEnd(42)}(default: ${t.defaultValue})`),r=this.booleanSpecs.map(t=>` ${(t.alias?`${t.alias}, ${t.flag}`:` ${t.flag}`).padEnd(38)}${t.description}`);console.log([`Usage: ${this.commandName} [options]`,"","Options:",...e,...r," -h, --help"+" ".repeat(32)+"Show this help message",...this.helpLines].join(`
14
- `))}};Te.dotenv.config();var xe=process.env,Ke=new D("ct-vuln-jira-report",[{flag:"--jira-config",alias:"-c",description:"Path to jira-conf.json configuration file",defaultValue:(0,Q.join)(process.cwd(),"jira-conf.json")},{flag:"--summary",alias:"-s",description:"Path to scan-summary.json produced by ct-vuln-scan",defaultValue:(0,Q.join)(process.cwd(),"output","scan-summary.json")}],["","Required environment variables:"," JIRA_USER Jira account e-mail address"," JIRA_API_TOKEN Jira API token (see https://id.atlassian.com/manage-profile/security/api-tokens)"]);(async()=>{let{values:o,dryRun:e}=Ke.parse(process.argv),r=o.get("--jira-config"),t=o.get("--summary"),n=xe.JIRA_USER,s=xe.JIRA_API_TOKEN;(!n||!s)&&(console.error("Error: JIRA_USER and JIRA_API_TOKEN environment variables must be set."),process.exit(1)),console.log(`Jira reporter${e?" [dry-run]":""}`);try{let c=await Pe({scanSummaryPath:t,jiraConfigPath:r,jiraUser:n,jiraApiToken:s,dryRun:e});Ae(c)&&console.log("[info] nothing to do"),e&&(console.log(""),console.log("No issues were created or modified (dry-run). Re-run without --dry-run to apply.")),c.errors.length>0&&(process.exitCode=1)}catch(c){console.error(`Fatal error: ${String(c)}`),process.exit(1)}})();
14
+ `))}};Te.dotenv.config();var xe=process.env,qe=new U("ct-vuln-jira-report",[{flag:"--jira-config",alias:"-c",description:"Path to jira-conf.json configuration file",defaultValue:(0,Q.join)(process.cwd(),"jira-conf.json")},{flag:"--summary",alias:"-s",description:"Path to scan-summary.json produced by ct-vuln-scan",defaultValue:(0,Q.join)(process.cwd(),"output","scan-summary.json")}],["","Required environment variables:"," JIRA_USER Jira account e-mail address"," JIRA_API_TOKEN Jira API token (see https://id.atlassian.com/manage-profile/security/api-tokens)"]);(async()=>{let{values:o,dryRun:e}=qe.parse(process.argv),r=o.get("--jira-config"),t=o.get("--summary"),n=xe.JIRA_USER,s=xe.JIRA_API_TOKEN;(!n||!s)&&(console.error("Error: JIRA_USER and JIRA_API_TOKEN environment variables must be set."),process.exit(1)),console.log(`Jira reporter${e?" [dry-run]":""}`);try{let c=await Pe({scanSummaryPath:t,jiraConfigPath:r,jiraUser:n,jiraApiToken:s,dryRun:e});Ae(c)&&console.log("[info] nothing to do"),e&&(console.log(""),console.log("No issues were created or modified (dry-run). Re-run without --dry-run to apply.")),c.errors.length>0&&(process.exitCode=1)}catch(c){console.error(`Fatal error: ${String(c)}`),process.exit(1)}})();
package/dist/remove-project.js CHANGED
@@ -1,21 +1,21 @@
1
1
  #!/usr/bin/env node
2
- "use strict";var er=Object.create;var Ze=Object.defineProperty;var tr=Object.getOwnPropertyDescriptor;var rr=Object.getOwnPropertyNames;var nr=Object.getPrototypeOf,ir=Object.prototype.hasOwnProperty;var et=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}};var or=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of rr(e))!ir.call(t,i)&&i!==r&&Ze(t,i,{get:()=>e[i],enumerable:!(n=tr(e,i))||n.enumerable});return t};var $=(t,e,r)=>(r=t!=null?er(nr(t)):{},or(e||!t||!t.__esModule?Ze(r,"default",{value:t,enumerable:!0}):r,t));var xt=et((ei,St)=>{"use strict";St.exports=Ir;function Rr(t){let e={defaultWidth:0,output:process.stdout,tty:require("tty")};return t?(Object.keys(e).forEach(function(r){t[r]||(t[r]=e[r])}),t):e}function Ir(t){let e=Rr(t);if(e.output.getWindowSize)return e.output.getWindowSize()[0]||e.defaultWidth;if(e.tty.getWindowSize)return e.tty.getWindowSize()[1]||e.defaultWidth;if(e.output.columns)return e.output.columns;if(process.env.CLI_WIDTH){let r=parseInt(process.env.CLI_WIDTH,10);if(!isNaN(r)&&r!==0)return r}return e.defaultWidth}});var Ot=et((mi,At)=>{var Wr=require("stream"),Ne=class extends Wr{#r=null;constructor(e={}){super(e),this.writable=this.readable=!0,this.muted=!1,this.on("pipe",this._onpipe),this.replace=e.replace,this._prompt=e.prompt||null,this._hadControl=!1}#t(e,r){return this._dest?this._dest[e]:this._src?this._src[e]:r}#e(e,...r){typeof this._dest?.[e]=="function"&&this._dest[e](...r),typeof this._src?.[e]=="function"&&this._src[e](...r)}get isTTY(){return this.#r!==null?this.#r:this.#t("isTTY",!1)}set isTTY(e){this.#r=e}get rows(){return this.#t("rows")}get columns(){return this.#t("columns")}mute(){this.muted=!0}unmute(){this.muted=!1}_onpipe(e){this._src=e}pipe(e,r){return this._dest=e,super.pipe(e,r)}pause(){if(this._src)return this._src.pause()}resume(){if(this._src)return this._src.resume()}write(e){if(this.muted){if(!this.replace)return!0;if(e.match(/^\u001b/))return e.indexOf(this._prompt)===0&&(e=e.slice(this._prompt.length),e=e.replace(/./g,this.replace),e=this._prompt+e),this._hadControl=!0,this.emit("data",e);this._prompt&&this._hadControl&&e.indexOf(this._prompt)===0&&(this._hadControl=!1,this.emit("data",this._prompt),e=e.slice(this._prompt.length)),e=e.toString().replace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#e("destroy",...e)}destroySoon(...e){return this.#e("destroySoon",...e)}close(...e){return this.#e("close",...e)}};At.exports=Ne});var V=$(require("path")),Re=require("fs/promises");var T=require("fs/promises");async function X(t){try{return await sr(t)?JSON.parse(await(0,T.readFile)(t,{encoding:"utf-8"})):void 0}catch(e){throw new Error(`Error reading JSON file ${t}: ${e}`,{cause:e})}}async function re(t,e){let r=JSON.stringify(e,null,4)+`
3
- `,n=await ar(t,r);await(0,T.writeFile)(t,n,{encoding:"utf-8"})}async function sr(t){try{return await(0,T.access)(t,T.constants.F_OK),!0}catch{return!1}}async function ar(t,e){let r=await cr();if(!r)return e;let n=await r.resolveConfig(t);return n?await r.format(e,{...n,filepath:t}):e}var lr;function cr(){return lr??=import("prettier").catch(()=>{})}var U=["UNKNOWN","LOW","MEDIUM","HIGH","CRITICAL"];var Ie=class t{constructor(e){this.workingDir=e}workingDir;static DEFAULT_MAVEN_REPO="https://repository.conterra.de/repository/maven-mirror-ct";static DEFAULT_VEX_SUBDIR="input/vex";static DEFAULT_OUT_SUBDIR="output";static DEFAULT_CACHE_SUBDIR="cache";static DEFAULT_SCANNERS=["grype","trivy","ossindex"];normalize(e,r){let n=e.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:r,onNewVulnerabilities:e.onNewVulnerabilities??(e.failOnNewVulnerabilities?"fail":"warn"),onNoLongerDetectedVulnerabilities:e.onNoLongerDetectedVulnerabilities??"ignore",reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities??!0,consoleReport:e.consoleReport??"BY_PROJECT_DETAILED",createSubDirsForProject:e.createSubDirsForProject??!0,mavenRepo:e.mavenRepo??t.DEFAULT_MAVEN_REPO,vexUrls:e.vexUrls??[],vexDir:this.resolvePath(e.vexDir)??(0,V.resolve)(this.workingDir,t.DEFAULT_VEX_SUBDIR),outDir:this.resolvePath(e.outDir)??(0,V.resolve)(this.workingDir,t.DEFAULT_OUT_SUBDIR),cacheDir:this.resolvePath(e.cacheDir)??(0,V.resolve)(this.workingDir,t.DEFAULT_CACHE_SUBDIR),scanners:this.normalizeScanners(e.scanners,r),projects:this.normalizeProjects(e.projects??[],n)}}normalizeScanners(e,r){return(e??t.DEFAULT_SCANNERS).map(i=>{if(typeof i!="string")throw new Error(`Invalid scanner name '${String(i)}' in configuration file '${r}'`);let o=i.split("@");if(o.length>2)throw new Error(`Invalid scanner name '${i}' in configuration file '${r}'`);return{name:o[0],version:o[1]??""}})}normalizeProjects(e,r){return e.map(n=>{let i=n;if(!i.name)throw new Error("Project name is missing on entry: "+JSON.stringify(i));if(!i.version)throw new Error("Project version is missing on entry: "+JSON.stringify(i));if(!i.purl)throw new Error("Project purl is missing on entry: "+JSON.stringify(i));let o={...i,purlAliases:i.purlAliases??[],enabled:i.enabled??!0,silent:i.silent??!1,minimumSeverity:i.minimumSeverity??"UNKNOWN"};return o.sbomFile?{...o,sbomFile:this.resolvePath(o.sbomFile)??o.sbomFile}:{...o,detectNoLongerUsedVulnerabilities:r?o.purl.endsWith("-SNAPSHOT"):!0}})}resolvePath(e){if(e)return V.default.isAbsolute(e)?e:(0,V.resolve)(this.workingDir,e)}},z=class{constructor(e){this.workingDir=e;this.normalizer=new Ie(e)}workingDir;normalizer;projectConfigCache;async loadProjectConfig(){return this.projectConfigCache??=this.doLoadProjectConfig(),this.projectConfigCache}async doLoadProjectConfig(){let e=(0,V.resolve)(this.workingDir,"vuln-scan-conf.json"),r=await X(e);if(!r)throw new Error(`Missing project configuration file '${e}'`);return this.normalizer.normalize(r,e)}async loadJiraConfig(e){let r=await(0,Re.readFile)(e,"utf8"),n=JSON.parse(r);if(!n.issues&&n.issue&&(n.issues=n.issue),!n.jiraUrl||typeof n.jiraUrl!="string")throw new Error("jira-conf.json: missing or invalid 'jiraUrl' field");if(!Array.isArray(n.issues))throw new Error("jira-conf.json: missing or invalid 'issues' array");this.validateAutoCloseSeverity(n.autoCloseBelowSeverity,"jira-conf.json: invalid 'autoCloseBelowSeverity'");for(let[i,o]of n.issues.entries())if(o&&typeof o=="object"){let s=o;this.validateAutoCloseSeverity(s.autoCloseBelowSeverity,`jira-conf.json: invalid 'issues[${i}].autoCloseBelowSeverity'`),this.validateAutoCloseProjectOverrides(s.projectOverrides,`jira-conf.json: invalid 'issues[${i}].projectOverrides'`)}return n}validateAutoCloseSeverity(e,r){if(e!==void 0&&!U.includes(e))throw new Error(`${r} value '${String(e)}'. Must be one of: ${U.join(", ")}`)}validateAutoCloseProjectOverrides(e,r){if(e!==void 0){if(!Array.isArray(e))throw new Error(`${r}: must be an array`);for(let n=0;n<e.length;n++){let i=e[n],o=`${r}[${n}]`;if(i==null||typeof i!="object")throw new Error(`${o}: must be an object`);let s=i,a=s.projects;if(!Array.isArray(a)||a.length===0)throw new Error(`${o}.projects: must be a non-empty array of strings`);for(let c=0;c<a.length;c++){let u=a[c];if(typeof u!="string"||u.length===0)throw new Error(`${o}.projects[${c}]: must be a non-empty string`)}if(s.autoCloseBelowSeverity===void 0)throw new Error(`${o}.autoCloseBelowSeverity: is required`);if(this.validateAutoCloseSeverity(s.autoCloseBelowSeverity,`${o}.autoCloseBelowSeverity`),s.comment!==void 0&&typeof s.comment!="string")throw new Error(`${o}.comment: must be a string`)}}}async loadAutoVexConfig(e){let r=await(0,Re.readFile)(e,"utf8"),n=JSON.parse(r);if(!n.impactStatement||typeof n.impactStatement!="string")throw new Error("auto-vex-conf.json: missing or invalid 'impactStatement' field (must be a non-empty string)");if(n.maxSeverity!==void 0&&!U.includes(n.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'maxSeverity' value '${String(n.maxSeverity)}'. Must be one of: ${U.join(", ")}`);if(n.projectOverrides!==void 0){if(!Array.isArray(n.projectOverrides))throw new Error("auto-vex-conf.json: 'projectOverrides' must be an array");for(let[i,o]of n.projectOverrides.entries()){if(!o||typeof o!="object")throw new Error(`auto-vex-conf.json: 'projectOverrides[${i}]' must be an object`);let s=o;if(!Array.isArray(s.projects)||s.projects.length===0||!s.projects.every(a=>typeof a=="string"&&a.length>0))throw new Error(`auto-vex-conf.json: 'projectOverrides[${i}].projects' must be a non-empty array of non-empty strings`);if(!U.includes(s.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'projectOverrides[${i}].maxSeverity' value '${String(s.maxSeverity)}'. Must be one of: ${U.join(", ")}`)}}return n}};var ue=class{constructor(e){this.configFilePath=e}configFilePath;async readRawConfig(){let e=await X(this.configFilePath);if(!e)throw new Error(`Missing project configuration file '${this.configFilePath}'`);return e}async insertAfter(e,r){let n=await this.readRawConfig(),i=n.projects??[],o=i.findIndex(s=>s.name===e.name&&s.version===e.version);if(o===-1)throw new Error(`Reference project ${e.name}@${e.version} not found in config`);i.splice(o+1,0,r),n.projects=i,await re(this.configFilePath,n)}async remove(e,r){let n=await this.readRawConfig(),i=n.projects??[],o=i.findIndex(s=>s.name===e&&s.version===r);return o===-1?!1:(i.splice(o,1),n.projects=i,await re(this.configFilePath,n),!0)}};var st=require("fs/promises"),Ce=require("path");var rt=require("crypto");var tt="auto_vex_max_severity=";function fe(t){let e=t.status_notes;if(!e||!e.startsWith(tt))return;let r=e.slice(tt.length).trim();return U.includes(r)?r:void 0}var ur="https://openvex.dev/ns/v0.2.0";function nt(t,e="conterra"){let n=`https://openvex.dev/docs/public/vex-${(0,rt.randomUUID)()}`,i=t.timestamp??new Date().toISOString();return{"@context":ur,"@id":n,author:e,timestamp:i,last_updated:i,version:1,statements:[t]}}function it(t,e){let r=e.timestamp??new Date().toISOString();return{...t,last_updated:r,version:t.version+1,statements:[...t.statements,e]}}var pe=require("fs/promises"),me=require("path");var de=class{constructor(e){this.location=e}location;_content=void 0;_exists=!1;get exists(){return this._exists}get content(){return this._content}set content(e){this._content=e,this._exists=e!==void 0}async read(){let e=await X(this.location);this._content=e??void 0,this._exists=this._content!==void 0}async write(){if(this._content===void 0)throw new Error(`Cannot write VexFile: content is undefined (${this.location})`);await(0,pe.mkdir)((0,me.dirname)((0,me.resolve)(this.location)),{recursive:!0}),await re(this.location,this._content)}async delete(){await(0,pe.unlink)(this.location),this._exists=!1}upsert(e,r){if(this._content===void 0)return this._content=nt(e,r),this._exists=!0,{created:!0,changed:!0};let n=fe(e);if(n!==void 0){let i=this._content.statements.findIndex(o=>o.vulnerability.name===e.vulnerability.name&&o.status===e.status&&fe(o)===n);if(i!==-1){let o=this._content.statements[i];return fr(o,e)?{created:!1,changed:!1}:(o.products=e.products,o.impact_statement=e.impact_statement,o.action_statement=e.action_statement,o.justification=e.justification,o.status_notes=e.status_notes,o.timestamp=e.timestamp,this._content.version+=1,this._content.last_updated=e.timestamp??new Date().toISOString(),{created:!1,changed:!0})}}return this._content=it(this._content,e),{created:!1,changed:!0}}addProductId(e,r){this.assertContentLoaded("addProductId");let n=!1;for(let i of this._content.statements){if(!i.products||i.products.some(s=>s["@id"]===r))continue;let o=i.products.findIndex(s=>s["@id"]===e);o!==-1&&(i.products.splice(o+1,0,{"@id":r}),n=!0)}return n}removeProductId(e,r){this.assertContentLoaded("removeProductId");let n=this._content.statements,i=[],o=!1;for(let s of n){if(r&&!ot(s).has(r)||!s.products)continue;let a=s.products.findIndex(c=>c["@id"]===e);a!==-1&&(s.products.splice(a,1),o=!0,s.products.length===0&&i.push(s))}if(!o)return"unchanged";for(let s of i)n.splice(n.indexOf(s),1);return n.length===0?"emptied":"changed"}hasStatementForProduct(e){return this.assertContentLoaded("hasStatementForProduct"),this._content.statements.some(r=>r.products?.some(n=>n["@id"]===e)??!1)}assertContentLoaded(e){if(this._content===void 0)throw new Error(`VexFile.${e}(): content is not loaded. Call read() first (${this.location})`)}};function fr(t,e){return t.impact_statement!==e.impact_statement||t.action_statement!==e.action_statement||t.justification!==e.justification||t.status_notes!==e.status_notes?!1:dr(t.products,e.products)}function dr(t,e){let r=o=>Array.from(new Set((o??[]).map(s=>s["@id"]).filter(s=>typeof s=="string"))).sort(),n=r(t),i=r(e);return n.length!==i.length?!1:n.every((o,s)=>o===i[s])}async function je(t,e){for(let r of await(0,st.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new de((0,Ce.resolve)(r.parentPath,r.name))):r.isDirectory()&&await je((0,Ce.resolve)(r.parentPath,r.name),e)}function ot(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}async function at({workingDir:t,projectName:e,projectVersion:r,vulnId:n}){let i=await new z(t).loadProjectConfig();if(!i.projectConfigFileLocation)throw new Error("Missing project configuration file.");let o=i.projects.find(s=>s.name===e&&s.version===r);if(!o){console.info(`Project ${e} with version ${r} not found.`);return}n||await pr(i.projectConfigFileLocation,o),await mr(i.vexDir,o.purl,n)}async function pr(t,e){await new ue(t).remove(e.name,e.version)&&console.info(`Remove project ${e.name} with version ${e.version} from ${t}`)}async function mr(t,e,r){await je(t,async n=>{await n.read();let i=n.removeProductId(e,r);i==="emptied"?(console.info(`Remove ${e} from ${n.location} and delete file.`),await n.delete()):i==="changed"&&(console.info(`Remove ${e} from ${n.location}`),await n.write())})}var hr=["emacs","vim"],gr=new Set(hr);function wr(t){return gr.has(t)}function lt(){let t=process.env.INQUIRER_KEYBINDINGS;return t?Array.from(new Set(t.toLowerCase().split(/[\s,]+/).filter(wr))):[]}var ne=(t,e=[])=>t.name==="up"||e.includes("vim")&&t.name==="k"||e.includes("emacs")&&t.ctrl&&t.name==="p",he=(t,e=[])=>t.name==="down"||e.includes("vim")&&t.name==="j"||e.includes("emacs")&&t.ctrl&&t.name==="n";var ie=t=>t.name==="backspace",oe=t=>t.name==="tab",Fe=t=>"1234567890".includes(t.name),k=t=>t.name==="enter"||t.name==="return";var ge=class extends Error{name="AbortPromptError";message="Prompt was aborted";constructor(e){super(),this.cause=e?.cause}},we=class extends Error{name="CancelPromptError";message="Prompt was canceled"},se=class extends Error{name="ExitPromptError"},Se=class extends Error{name="HookError"},Y=class extends Error{name="ValidationError"};var dt=require("node:async_hooks");var xe=require("node:async_hooks");var ct=new xe.AsyncLocalStorage;function Sr(t){return{rl:t,hooks:[],hooksCleanup:[],hooksEffect:[],index:0,handleChange(){}}}function ut(t,e){let r=Sr(t);return ct.run(r,()=>{function n(i){r.handleChange=()=>{r.index=0,i()},r.handleChange()}return e(n)})}function M(){let t=ct.getStore();if(!t)throw new Se("[Inquirer] Hook functions can only be called from within a prompt");return t}function Te(){return M().rl}function _e(t){let e=(...r)=>{let n=M(),i=!1,o=n.handleChange;n.handleChange=()=>{i=!0};let s=t(...r);return i&&o(),n.handleChange=o,s};return xe.AsyncResource.bind(e)}function Q(t){let e=M(),{index:r}=e,n={get(){return e.hooks[r]},set(o){e.hooks[r]=o},initialized:r in e.hooks},i=t(n);return e.index++,i}function ft(){M().handleChange()}var W={queue(t){let e=M(),{index:r}=e;e.hooksEffect.push(()=>{e.hooksCleanup[r]?.();let n=t(Te());if(n!=null&&typeof n!="function")throw new Y("useEffect return value must be a cleanup function or nothing.");e.hooksCleanup[r]=n})},run(){let t=M();_e(()=>{t.hooksEffect.forEach(e=>{e()}),t.hooksEffect.length=0})()},clearAll(){let t=M();t.hooksCleanup.forEach(e=>{e?.()}),t.hooksEffect.length=0,t.hooksCleanup.length=0}};function xr(t){return typeof t=="function"}function D(t){return Q(e=>{let r=dt.AsyncResource.bind(function(o){e.get()!==o&&(e.set(o),ft())});if(e.initialized)return[e.get(),r];let n=xr(t)?t():t;return e.set(n),[n,r]})}function A(t,e){Q(r=>{let n=r.get();(!Array.isArray(n)||e.some((o,s)=>!Object.is(o,n[s])))&&W.queue(t),r.set(e)})}var F=require("node:util");var j=$(require("node:process"),1);function yr(){return j.default.platform.startsWith("win")?!!j.default.env.CI||!!j.default.env.WT_SESSION||!!j.default.env.TERMINUS_SUBLIME||j.default.env.ConEmuTask==="{cmd::Cmder}"||j.default.env.TERM_PROGRAM==="Terminus-Sublime"||j.default.env.TERM_PROGRAM==="vscode"||j.default.env.TERM==="xterm-256color"||j.default.env.TERM==="alacritty"||j.default.env.TERMINAL_EMULATOR==="JetBrains-JediTerm":j.default.env.TERM!=="linux"}var pt={circleQuestionMark:"(?)",questionMarkPrefix:"(?)",square:"\u2588",squareDarkShade:"\u2593",squareMediumShade:"\u2592",squareLightShade:"\u2591",squareTop:"\u2580",squareBottom:"\u2584",squareLeft:"\u258C",squareRight:"\u2590",squareCenter:"\u25A0",bullet:"\u25CF",dot:"\u2024",ellipsis:"\u2026",pointerSmall:"\u203A",triangleUp:"\u25B2",triangleUpSmall:"\u25B4",triangleDown:"\u25BC",triangleDownSmall:"\u25BE",triangleLeftSmall:"\u25C2",triangleRightSmall:"\u25B8",home:"\u2302",heart:"\u2665",musicNote:"\u266A",musicNoteBeamed:"\u266B",arrowUp:"\u2191",arrowDown:"\u2193",arrowLeft:"\u2190",arrowRight:"\u2192",arrowLeftRight:"\u2194",arrowUpDown:"\u2195",almostEqual:"\u2248",notEqual:"\u2260",lessOrEqual:"\u2264",greaterOrEqual:"\u2265",identical:"\u2261",infinity:"\u221E",subscriptZero:"\u2080",subscriptOne:"\u2081",subscriptTwo:"\u2082",subscriptThree:"\u2083",subscriptFour:"\u2084",subscriptFive:"\u2085",subscriptSix:"\u2086",subscriptSeven:"\u2087",subscriptEight:"\u2088",subscriptNine:"\u2089",oneHalf:"\xBD",oneThird:"\u2153",oneQuarter:"\xBC",oneFifth:"\u2155",oneSixth:"\u2159",oneEighth:"\u215B",twoThirds:"\u2154",twoFifths:"\u2156",threeQuarters:"\xBE",threeFifths:"\u2157",threeEighths:"\u215C",fourFifths:"\u2158",fiveSixths:"\u215A",fiveEighths:"\u215D",sevenEighths:"\u215E",line:"\u2500",lineBold:"\u2501",lineDouble:"\u2550",lineDashed0:"\u2504",lineDashed1:"\u2505",lineDashed2:"\u2508",lineDashed3:"\u2509",lineDashed4:"\u254C",lineDashed5:"\u254D",lineDashed6:"\u2574",lineDashed7:"\u2576",lineDashed8:"\u2578",lineDashed9:"\u257A",lineDashed10:"\u257C",lineDashed11:"\u257E",lineDashed12:"\u2212",lineDashed13:"\u2013",lineDashed14:"\u2010",lineDashed15:"\u2043",lineVertical:"\u2502",lineVerticalBold:"\u2503",lineVerticalDouble:"\u2551",lineVerticalDashed0:"\u2506",lineVerticalDashed1:"\u2507",lineVerticalDashed2:"\u250A",lineVerticalDashed3:"\u250B",lineVerticalDashed4:"\u254E",lineVerticalDashed5:"\u254F",lineVerticalDashed6:"\u2575",lineVerticalDashed7:"\u2577",lineVerticalDashed8:"\u2579",lineVerticalDashed9:"\u257B",lineVerticalDashed10:"\u257D",lineVerticalDashed11:"\u257F",lineDownLeft:"\u2510",lineDownLeftArc:"\u256E",lineDownBoldLeftBold:"\u2513",lineDownBoldLeft:"\u2512",lineDownLeftBold:"\u2511",lineDownDoubleLeftDouble:"\u2557",lineDownDoubleLeft:"\u2556",lineDownLeftDouble:"\u2555",lineDownRight:"\u250C",lineDownRightArc:"\u256D",lineDownBoldRightBold:"\u250F",lineDownBoldRight:"\u250E",lineDownRightBold:"\u250D",lineDownDoubleRightDouble:"\u2554",lineDownDoubleRight:"\u2553",lineDownRightDouble:"\u2552",lineUpLeft:"\u2518",lineUpLeftArc:"\u256F",lineUpBoldLeftBold:"\u251B",lineUpBoldLeft:"\u251A",lineUpLeftBold:"\u2519",lineUpDoubleLeftDouble:"\u255D",lineUpDoubleLeft:"\u255C",lineUpLeftDouble:"\u255B",lineUpRight:"\u2514",lineUpRightArc:"\u2570",lineUpBoldRightBold:"\u2517",lineUpBoldRight:"\u2516",lineUpRightBold:"\u2515",lineUpDoubleRightDouble:"\u255A",lineUpDoubleRight:"\u2559",lineUpRightDouble:"\u2558",lineUpDownLeft:"\u2524",lineUpBoldDownBoldLeftBold:"\u252B",lineUpBoldDownBoldLeft:"\u2528",lineUpDownLeftBold:"\u2525",lineUpBoldDownLeftBold:"\u2529",lineUpDownBoldLeftBold:"\u252A",lineUpDownBoldLeft:"\u2527",lineUpBoldDownLeft:"\u2526",lineUpDoubleDownDoubleLeftDouble:"\u2563",lineUpDoubleDownDoubleLeft:"\u2562",lineUpDownLeftDouble:"\u2561",lineUpDownRight:"\u251C",lineUpBoldDownBoldRightBold:"\u2523",lineUpBoldDownBoldRight:"\u2520",lineUpDownRightBold:"\u251D",lineUpBoldDownRightBold:"\u2521",lineUpDownBoldRightBold:"\u2522",lineUpDownBoldRight:"\u251F",lineUpBoldDownRight:"\u251E",lineUpDoubleDownDoubleRightDouble:"\u2560",lineUpDoubleDownDoubleRight:"\u255F",lineUpDownRightDouble:"\u255E",lineDownLeftRight:"\u252C",lineDownBoldLeftBoldRightBold:"\u2533",lineDownLeftBoldRightBold:"\u252F",lineDownBoldLeftRight:"\u2530",lineDownBoldLeftBoldRight:"\u2531",lineDownBoldLeftRightBold:"\u2532",lineDownLeftRightBold:"\u252E",lineDownLeftBoldRight:"\u252D",lineDownDoubleLeftDoubleRightDouble:"\u2566",lineDownDoubleLeftRight:"\u2565",lineDownLeftDoubleRightDouble:"\u2564",lineUpLeftRight:"\u2534",lineUpBoldLeftBoldRightBold:"\u253B",lineUpLeftBoldRightBold:"\u2537",lineUpBoldLeftRight:"\u2538",lineUpBoldLeftBoldRight:"\u2539",lineUpBoldLeftRightBold:"\u253A",lineUpLeftRightBold:"\u2536",lineUpLeftBoldRight:"\u2535",lineUpDoubleLeftDoubleRightDouble:"\u2569",lineUpDoubleLeftRight:"\u2568",lineUpLeftDoubleRightDouble:"\u2567",lineUpDownLeftRight:"\u253C",lineUpBoldDownBoldLeftBoldRightBold:"\u254B",lineUpDownBoldLeftBoldRightBold:"\u2548",lineUpBoldDownLeftBoldRightBold:"\u2547",lineUpBoldDownBoldLeftRightBold:"\u254A",lineUpBoldDownBoldLeftBoldRight:"\u2549",lineUpBoldDownLeftRight:"\u2540",lineUpDownBoldLeftRight:"\u2541",lineUpDownLeftBoldRight:"\u253D",lineUpDownLeftRightBold:"\u253E",lineUpBoldDownBoldLeftRight:"\u2542",lineUpDownLeftBoldRightBold:"\u253F",lineUpBoldDownLeftBoldRight:"\u2543",lineUpBoldDownLeftRightBold:"\u2544",lineUpDownBoldLeftBoldRight:"\u2545",lineUpDownBoldLeftRightBold:"\u2546",lineUpDoubleDownDoubleLeftDoubleRightDouble:"\u256C",lineUpDoubleDownDoubleLeftRight:"\u256B",lineUpDownLeftDoubleRightDouble:"\u256A",lineCross:"\u2573",lineBackslash:"\u2572",lineSlash:"\u2571"},mt={tick:"\u2714",info:"\u2139",warning:"\u26A0",cross:"\u2718",squareSmall:"\u25FB",squareSmallFilled:"\u25FC",circle:"\u25EF",circleFilled:"\u25C9",circleDotted:"\u25CC",circleDouble:"\u25CE",circleCircle:"\u24DE",circleCross:"\u24E7",circlePipe:"\u24BE",radioOn:"\u25C9",radioOff:"\u25EF",checkboxOn:"\u2612",checkboxOff:"\u2610",checkboxCircleOn:"\u24E7",checkboxCircleOff:"\u24BE",pointer:"\u276F",triangleUpOutline:"\u25B3",triangleLeft:"\u25C0",triangleRight:"\u25B6",lozenge:"\u25C6",lozengeOutline:"\u25C7",hamburger:"\u2630",smiley:"\u32E1",mustache:"\u0DF4",star:"\u2605",play:"\u25B6",nodejs:"\u2B22",oneSeventh:"\u2150",oneNinth:"\u2151",oneTenth:"\u2152"},vr={tick:"\u221A",info:"i",warning:"\u203C",cross:"\xD7",squareSmall:"\u25A1",squareSmallFilled:"\u25A0",circle:"( )",circleFilled:"(*)",circleDotted:"( )",circleDouble:"( )",circleCircle:"(\u25CB)",circleCross:"(\xD7)",circlePipe:"(\u2502)",radioOn:"(*)",radioOff:"( )",checkboxOn:"[\xD7]",checkboxOff:"[ ]",checkboxCircleOn:"(\xD7)",checkboxCircleOff:"( )",pointer:">",triangleUpOutline:"\u2206",triangleLeft:"\u25C4",triangleRight:"\u25BA",lozenge:"\u2666",lozengeOutline:"\u25CA",hamburger:"\u2261",smiley:"\u263A",mustache:"\u250C\u2500\u2510",star:"\u2736",play:"\u25BA",nodejs:"\u2666",oneSeventh:"1/7",oneNinth:"1/9",oneTenth:"1/10"},br={...pt,...mt},Er={...pt,...vr},Dr=yr(),Pr=Dr?br:Er,Z=Pr,Un=Object.entries(mt);var Lr={prefix:{idle:(0,F.styleText)("blue","?"),done:(0,F.styleText)("green",Z.tick)},spinner:{interval:80,frames:["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"].map(t=>(0,F.styleText)("yellow",t))},keybindings:[],style:{answer:t=>(0,F.styleText)("cyan",t),message:t=>(0,F.styleText)("bold",t),error:t=>(0,F.styleText)("red",`> ${t}`),defaultAnswer:t=>(0,F.styleText)("dim",`(${t})`),help:t=>(0,F.styleText)("dim",t),highlight:t=>(0,F.styleText)("cyan",t),key:t=>(0,F.styleText)("cyan",(0,F.styleText)("bold",`<${t}>`))}};function ht(){return{...Lr,keybindings:lt()}}function gt(t){if(typeof t!="object"||t===null)return!1;let e=t;for(;Object.getPrototypeOf(e)!==null;)e=Object.getPrototypeOf(e);return Object.getPrototypeOf(t)===e}function wt(...t){let e={};for(let r of t)for(let[n,i]of Object.entries(r)){let o=e[n];e[n]=gt(o)&&gt(i)?wt(o,i):i}return e}function O(...t){let e=[ht(),...t.filter(r=>r!=null)];return wt(...e)}function K({status:t="idle",theme:e}){let[r,n]=D(!1),[i,o]=D(0),{prefix:s,spinner:a}=O(e);return A(()=>{if(t==="loading"){let u,f=-1,l=setTimeout(()=>{n(!0),u=setInterval(()=>{f=f+1,o(f%a.frames.length)},a.interval)},300);return()=>{clearTimeout(l),clearInterval(u)}}else n(!1)},[t]),r?a.frames[i]:typeof s=="string"?s:s[t==="loading"?"idle":t]??s.idle}function ae(t,e){return Q(r=>{let n=r.get();if(!n||n.dependencies.length!==e.length||n.dependencies.some((i,o)=>i!==e[o])){let i=t();return r.set({value:i,dependencies:e}),i}return n.value})}function H(t){return D({current:t})[0]}function G(t){let e=H(t);e.current=t,A(r=>{let n=!1,i=_e((o,s)=>{n||e.current(s,r)});return r.input.on("keypress",i),()=>{n=!0,r.input.removeListener("keypress",i)}},[])}var Ut=$(xt(),1);var yt=(()=>{let t=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g;return e=>{let r=0;for(t.lastIndex=0;t.test(e);)r+=1;return e.length-r}})(),vt=t=>t===12288||t>=65281&&t<=65376||t>=65504&&t<=65510,bt=t=>t===8987||t===9001||t>=12272&&t<=12287||t>=12289&&t<=12350||t>=12441&&t<=12543||t>=12549&&t<=12591||t>=12593&&t<=12686||t>=12688&&t<=12771||t>=12783&&t<=12830||t>=12832&&t<=12871||t>=12880&&t<=19903||t>=65040&&t<=65049||t>=65072&&t<=65106||t>=65108&&t<=65126||t>=65128&&t<=65131||t>=127488&&t<=127490||t>=127504&&t<=127547||t>=127552&&t<=127560||t>=131072&&t<=196605||t>=196608&&t<=262141;var Cr=/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y,jr=/[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y,Et=/(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu,Fr=/\t{1,1000}/y,Dt=new RegExp("[\\u{1F1E6}-\\u{1F1FF}]{2}|\\u{1F3F4}[\\u{E0061}-\\u{E007A}]{2}[\\u{E0030}-\\u{E0039}\\u{E0061}-\\u{E007A}]{1,3}\\u{E007F}|(?:\\p{Emoji}\\uFE0F\\u20E3?|\\p{Emoji_Modifier_Base}\\p{Emoji_Modifier}?|\\p{Emoji_Presentation})(?:\\u200D(?:\\p{Emoji_Modifier_Base}\\p{Emoji_Modifier}?|\\p{Emoji_Presentation}|\\p{Emoji}\\uFE0F\\u20E3?))*","yu"),Tr=/(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y,_r=new RegExp("\\p{M}+","gu"),Br={limit:1/0,ellipsis:""},Pt=(t,e={},r={})=>{let n=e.limit??1/0,i=e.ellipsis??"",o=e?.ellipsisWidth??(i?Pt(i,Br,r).width:0),s=0,a=r.controlWidth??0,c=r.tabWidth??8,u=r.emojiWidth??2,f=2,l=r.regularWidth??1,p=r.wideWidth??f,S=[[Tr,l],[Cr,s],[jr,a],[Fr,c],[Dt,u],[Et,p]],h=0,d=0,m=t.length,x=0,g=!1,y=m,v=Math.max(0,n-o),P=0,L=0,I=0,C=0;e:for(;;){if(L>P||d>=m&&d>h){let w=t.slice(P,L)||t.slice(h,d);x=0;for(let b of w.replaceAll(_r,"")){let E=b.codePointAt(0)||0;if(vt(E)?C=f:bt(E)?C=p:C=l,I+C>v&&(y=Math.min(y,Math.max(P,h)+x)),I+C>n){g=!0;break e}x+=b.length,I+=C}P=L=0}if(d>=m)break e;for(let w=0,b=S.length;w<b;w++){let[E,R]=S[w];if(E.lastIndex=d,E.test(t)){if(x=E===Et?yt(t.slice(d,E.lastIndex)):E===Dt?1:E.lastIndex-d,C=x*R,I+C>v&&(y=Math.min(y,d+Math.floor((v-I)/R))),I+C>n){g=!0;break e}I+=C,P=h,L=d,d=h=E.lastIndex;continue e}}d+=1}return{width:g?v:I,index:g?y:m,truncated:g,ellipsed:g&&n>=o}},Lt=Pt;var Ur={limit:1/0,ellipsis:"",ellipsisWidth:0},Ar=(t,e={})=>Lt(t,Ur,e).width,N=Ar;var ye="\x1B",Ft="\x9B",Or=39,Ue="\x07",Tt="[",Nr="]",_t="m",Ae=`${Nr}8;;`,Rt=new RegExp(`(?:\\${Tt}(?<code>\\d+)m|\\${Ae}(?<uri>.*)${Ue})`,"y"),It=t=>{if(t>=30&&t<=37||t>=90&&t<=97)return 39;if(t>=40&&t<=47||t>=100&&t<=107)return 49;if(t===1||t===2)return 22;if(t===3)return 23;if(t===4)return 24;if(t===7)return 27;if(t===8)return 28;if(t===9)return 29;if(t===0)return 0},Ct=t=>`${ye}${Tt}${t}${_t}`,jt=t=>`${ye}${Ae}${t}${Ue}`,Be=(t,e,r)=>{let n=e[Symbol.iterator](),i=!1,o=!1,s=t.at(-1),a=s===void 0?0:N(s),c=n.next(),u=n.next(),f=0;for(;!c.done;){let l=c.value,p=N(l);a+p<=r?t[t.length-1]+=l:(t.push(l),a=0),(l===ye||l===Ft)&&(i=!0,o=e.startsWith(Ae,f+1)),i?o?l===Ue&&(i=!1,o=!1):l===_t&&(i=!1):(a+=p,a===r&&!u.done&&(t.push(""),a=0)),c=u,u=n.next(),f+=l.length}s=t.at(-1),!a&&s!==void 0&&s.length&&t.length>1&&(t[t.length-2]+=t.pop())},Vr=t=>{let e=t.split(" "),r=e.length;for(;r&&!N(e[r-1]);)r--;return r===e.length?t:e.slice(0,r).join(" ")+e.slice(r).join("")},$r=(t,e,r={})=>{if(r.trim!==!1&&t.trim()==="")return"";let n="",i,o,s=t.split(" "),a=[""],c=0;for(let l=0;l<s.length;l++){let p=s[l];if(r.trim!==!1){let h=a.at(-1)??"",d=h.trimStart();h.length!==d.length&&(a[a.length-1]=d,c=N(d))}l!==0&&(c>=e&&(r.wordWrap===!1||r.trim===!1)&&(a.push(""),c=0),(c||r.trim===!1)&&(a[a.length-1]+=" ",c++));let S=N(p);if(r.hard&&S>e){let h=e-c,d=1+Math.floor((S-h-1)/e);Math.floor((S-1)/e)<d&&a.push(""),Be(a,p,e),c=N(a.at(-1)??"");continue}if(c+S>e&&c&&S){if(r.wordWrap===!1&&c<e){Be(a,p,e),c=N(a.at(-1)??"");continue}a.push(""),c=0}if(c+S>e&&r.wordWrap===!1){Be(a,p,e),c=N(a.at(-1)??"");continue}a[a.length-1]+=p,c+=S}r.trim!==!1&&(a=a.map(l=>Vr(l)));let u=a.join(`
4
- `),f=!1;for(let l=0;l<u.length;l++){let p=u[l];if(n+=p,f)f=!1;else if(f=p>="\uD800"&&p<="\uDBFF",f)continue;if(p===ye||p===Ft){Rt.lastIndex=l+1;let h=Rt.exec(u)?.groups;if(h?.code!==void 0){let d=Number.parseFloat(h.code);i=d===Or?void 0:d}else h?.uri!==void 0&&(o=h.uri.length===0?void 0:h.uri)}if(u[l+1]===`
5
- `){o&&(n+=jt(""));let S=i?It(i):void 0;i&&S&&(n+=Ct(S))}else p===`
6
- `&&(i&&It(i)&&(n+=Ct(i)),o&&(n+=jt(o)))}return n},kr=/\r?\n/;function Bt(t,e,r){return String(t).normalize().split(kr).map(n=>$r(n,e,r)).join(`
2
+ "use strict";var Qt=Object.create;var Qe=Object.defineProperty;var Zt=Object.getOwnPropertyDescriptor;var er=Object.getOwnPropertyNames;var tr=Object.getPrototypeOf,rr=Object.prototype.hasOwnProperty;var Ze=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}};var nr=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of er(e))!rr.call(t,i)&&i!==r&&Qe(t,i,{get:()=>e[i],enumerable:!(n=Zt(e,i))||n.enumerable});return t};var $=(t,e,r)=>(r=t!=null?Qt(tr(t)):{},nr(e||!t||!t.__esModule?Qe(r,"default",{value:t,enumerable:!0}):r,t));var wt=Ze((Zn,gt)=>{"use strict";gt.exports=Lr;function Pr(t){let e={defaultWidth:0,output:process.stdout,tty:require("tty")};return t?(Object.keys(e).forEach(function(r){t[r]||(t[r]=e[r])}),t):e}function Lr(t){let e=Pr(t);if(e.output.getWindowSize)return e.output.getWindowSize()[0]||e.defaultWidth;if(e.tty.getWindowSize)return e.tty.getWindowSize()[1]||e.defaultWidth;if(e.output.columns)return e.output.columns;if(process.env.CLI_WIDTH){let r=parseInt(process.env.CLI_WIDTH,10);if(!isNaN(r)&&r!==0)return r}return e.defaultWidth}});var Ut=Ze((pi,Bt)=>{var kr=require("stream"),Ae=class extends kr{#r=null;constructor(e={}){super(e),this.writable=this.readable=!0,this.muted=!1,this.on("pipe",this._onpipe),this.replace=e.replace,this._prompt=e.prompt||null,this._hadControl=!1}#t(e,r){return this._dest?this._dest[e]:this._src?this._src[e]:r}#e(e,...r){typeof this._dest?.[e]=="function"&&this._dest[e](...r),typeof this._src?.[e]=="function"&&this._src[e](...r)}get isTTY(){return this.#r!==null?this.#r:this.#t("isTTY",!1)}set isTTY(e){this.#r=e}get rows(){return this.#t("rows")}get columns(){return this.#t("columns")}mute(){this.muted=!0}unmute(){this.muted=!1}_onpipe(e){this._src=e}pipe(e,r){return this._dest=e,super.pipe(e,r)}pause(){if(this._src)return this._src.pause()}resume(){if(this._src)return this._src.resume()}write(e){if(this.muted){if(!this.replace)return!0;if(e.match(/^\u001b/))return e.indexOf(this._prompt)===0&&(e=e.slice(this._prompt.length),e=e.replace(/./g,this.replace),e=this._prompt+e),this._hadControl=!0,this.emit("data",e);this._prompt&&this._hadControl&&e.indexOf(this._prompt)===0&&(this._hadControl=!1,this.emit("data",this._prompt),e=e.slice(this._prompt.length)),e=e.toString().replace(/./g,this.replace)}this.emit("data",e)}end(e){this.muted&&(e&&this.replace?e=e.toString().replace(/./g,this.replace):e=null),e&&this.emit("data",e),this.emit("end")}destroy(...e){return this.#e("destroy",...e)}destroySoon(...e){return this.#e("destroySoon",...e)}close(...e){return this.#e("close",...e)}};Bt.exports=Ae});var V=$(require("path")),Le=require("fs/promises");var T=require("fs/promises");async function X(t){try{return await ir(t)?JSON.parse(await(0,T.readFile)(t,{encoding:"utf-8"})):void 0}catch(e){throw new Error(`Error reading JSON file ${t}: ${e}`,{cause:e})}}async function re(t,e){let r=JSON.stringify(e,null,4)+`
3
+ `,n=await or(t,r);await(0,T.writeFile)(t,n,{encoding:"utf-8"})}async function ir(t){try{return await(0,T.access)(t,T.constants.F_OK),!0}catch{return!1}}async function or(t,e){let r=await ar();if(!r)return e;let n=await r.resolveConfig(t);return n?await r.format(e,{...n,filepath:t}):e}var sr;function ar(){return sr??=import("prettier").catch(()=>{})}var N=["UNKNOWN","LOW","MEDIUM","HIGH","CRITICAL"];var Ie=class t{constructor(e){this.workingDir=e}workingDir;static DEFAULT_MAVEN_REPO="https://repository.conterra.de/repository/maven-mirror-ct";static DEFAULT_VEX_SUBDIR="input/vex";static DEFAULT_OUT_SUBDIR="output";static DEFAULT_CACHE_SUBDIR="cache";static DEFAULT_SCANNERS=["grype","trivy","ossindex"];normalize(e,r){let n=e.findNoLongerDetectedVulnerabilitiesOnlyForSnapshots??!1;return{projectConfigFileLocation:r,onNewVulnerabilities:e.onNewVulnerabilities??(e.failOnNewVulnerabilities?"fail":"warn"),onNoLongerDetectedVulnerabilities:e.onNoLongerDetectedVulnerabilities??"ignore",reportNoLongerDetectedVulnerabilities:e.reportNoLongerDetectedVulnerabilities??!0,consoleReport:e.consoleReport??"BY_PROJECT_DETAILED",createSubDirsForProject:e.createSubDirsForProject??!0,mavenRepo:e.mavenRepo??t.DEFAULT_MAVEN_REPO,vexUrls:e.vexUrls??[],vexDir:this.resolvePath(e.vexDir)??(0,V.resolve)(this.workingDir,t.DEFAULT_VEX_SUBDIR),outDir:this.resolvePath(e.outDir)??(0,V.resolve)(this.workingDir,t.DEFAULT_OUT_SUBDIR),cacheDir:this.resolvePath(e.cacheDir)??(0,V.resolve)(this.workingDir,t.DEFAULT_CACHE_SUBDIR),scanners:this.normalizeScanners(e.scanners,r),projects:this.normalizeProjects(e.projects??[],n)}}normalizeScanners(e,r){return(e??t.DEFAULT_SCANNERS).map(i=>{if(typeof i!="string")throw new Error(`Invalid scanner name '${String(i)}' in configuration file '${r}'`);let s=i.split("@");if(s.length>2)throw new Error(`Invalid scanner name '${i}' in configuration file '${r}'`);return{name:s[0],version:s[1]??""}})}normalizeProjects(e,r){let n=e.map(i=>{let s=i;if(!s.name)throw new Error("Project name is missing on entry: "+JSON.stringify(s));if(!s.version)throw new Error("Project version is missing on entry: "+JSON.stringify(s));if(!s.purl)throw new Error("Project purl is missing on entry: "+JSON.stringify(s));let o={...s,purlAliases:s.purlAliases??[],enabled:s.enabled??!0,silent:s.silent??!1,minimumSeverity:s.minimumSeverity??"UNKNOWN"};return o.sbomFile?{...o,sbomFile:this.resolvePath(o.sbomFile)??o.sbomFile}:{...o,detectNoLongerUsedVulnerabilities:r?o.purl.endsWith("-SNAPSHOT"):!0}});return this.assertUniqueProjectIds(n),this.assertUniqueProjectPurls(n),n}assertUniqueProjectIds(e){let r=new Set;for(let n of e){let i=`${n.name}@${n.version}`;if(r.has(i))throw new Error(`Duplicate project id '${i}' in vuln-scan-conf.json: each 'name@version' pair must be unique across the projects array.`);r.add(i)}}assertUniqueProjectPurls(e){let r=new Map;for(let n of e){let i=`${n.name}@${n.version}`,s=r.get(n.purl);if(s!==void 0)throw new Error(`Duplicate project purl '${n.purl}' in vuln-scan-conf.json: used by '${s}' and '${i}'. Each project must have a unique purl; use 'purlAliases' when two projects should be matched by the same VEX statement.`);r.set(n.purl,i)}}resolvePath(e){if(e)return V.default.isAbsolute(e)?e:(0,V.resolve)(this.workingDir,e)}},z=class{constructor(e){this.workingDir=e;this.normalizer=new Ie(e)}workingDir;normalizer;projectConfigCache;async loadProjectConfig(){return this.projectConfigCache??=this.doLoadProjectConfig(),this.projectConfigCache}async doLoadProjectConfig(){let e=(0,V.resolve)(this.workingDir,"vuln-scan-conf.json"),r=await X(e);if(!r)throw new Error(`Missing project configuration file '${e}'`);return this.normalizer.normalize(r,e)}async loadJiraConfig(e){let r=await(0,Le.readFile)(e,"utf8"),n=JSON.parse(r);if(!n.issues&&n.issue&&(n.issues=n.issue),!n.jiraUrl||typeof n.jiraUrl!="string")throw new Error("jira-conf.json: missing or invalid 'jiraUrl' field");if(!Array.isArray(n.issues))throw new Error("jira-conf.json: missing or invalid 'issues' array");this.validateAutoCloseSeverity(n.autoCloseBelowSeverity,"jira-conf.json: invalid 'autoCloseBelowSeverity'");for(let[i,s]of n.issues.entries())if(s&&typeof s=="object"){let o=s;this.validateAutoCloseSeverity(o.autoCloseBelowSeverity,`jira-conf.json: invalid 'issues[${i}].autoCloseBelowSeverity'`),this.validateAutoCloseProjectOverrides(o.projectOverrides,`jira-conf.json: invalid 'issues[${i}].projectOverrides'`)}return n}validateAutoCloseSeverity(e,r){if(e!==void 0&&!N.includes(e))throw new Error(`${r} value '${String(e)}'. Must be one of: ${N.join(", ")}`)}validateAutoCloseProjectOverrides(e,r){if(e!==void 0){if(!Array.isArray(e))throw new Error(`${r}: must be an array`);for(let n=0;n<e.length;n++){let i=e[n],s=`${r}[${n}]`;if(i==null||typeof i!="object")throw new Error(`${s}: must be an object`);let o=i,a=o.projects;if(!Array.isArray(a)||a.length===0)throw new Error(`${s}.projects: must be a non-empty array of strings`);for(let c=0;c<a.length;c++){let u=a[c];if(typeof u!="string"||u.length===0)throw new Error(`${s}.projects[${c}]: must be a non-empty string`)}if(o.autoCloseBelowSeverity===void 0)throw new Error(`${s}.autoCloseBelowSeverity: is required`);if(this.validateAutoCloseSeverity(o.autoCloseBelowSeverity,`${s}.autoCloseBelowSeverity`),o.comment!==void 0&&typeof o.comment!="string")throw new Error(`${s}.comment: must be a string`)}}}async loadAutoVexConfig(e){let r=await(0,Le.readFile)(e,"utf8"),n=JSON.parse(r);if(!n.impactStatement||typeof n.impactStatement!="string")throw new Error("auto-vex-conf.json: missing or invalid 'impactStatement' field (must be a non-empty string)");if(n.maxSeverity!==void 0&&!N.includes(n.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'maxSeverity' value '${String(n.maxSeverity)}'. Must be one of: ${N.join(", ")}`);if(n.projectOverrides!==void 0){if(!Array.isArray(n.projectOverrides))throw new Error("auto-vex-conf.json: 'projectOverrides' must be an array");for(let[i,s]of n.projectOverrides.entries()){if(!s||typeof s!="object")throw new Error(`auto-vex-conf.json: 'projectOverrides[${i}]' must be an object`);let o=s;if(!Array.isArray(o.projects)||o.projects.length===0||!o.projects.every(a=>typeof a=="string"&&a.length>0))throw new Error(`auto-vex-conf.json: 'projectOverrides[${i}].projects' must be a non-empty array of non-empty strings`);if(!N.includes(o.maxSeverity))throw new Error(`auto-vex-conf.json: invalid 'projectOverrides[${i}].maxSeverity' value '${String(o.maxSeverity)}'. Must be one of: ${N.join(", ")}`)}}return n}};var ue=class{constructor(e){this.configFilePath=e}configFilePath;async readRawConfig(){let e=await X(this.configFilePath);if(!e)throw new Error(`Missing project configuration file '${this.configFilePath}'`);return e}async insertAfter(e,r){let n=await this.readRawConfig(),i=n.projects??[],s=i.findIndex(o=>o.name===e.name&&o.version===e.version);if(s===-1)throw new Error(`Reference project ${e.name}@${e.version} not found in config`);i.splice(s+1,0,r),n.projects=i,await re(this.configFilePath,n)}async remove(e,r){let n=await this.readRawConfig(),i=n.projects??[],s=i.findIndex(o=>o.name===e&&o.version===r);return s===-1?!1:(i.splice(s,1),n.projects=i,await re(this.configFilePath,n),!0)}};var it=require("fs/promises"),je=require("path");var et=require("crypto");var lr="https://openvex.dev/ns/v0.2.0";function tt(t,e="conterra"){let n=`https://openvex.dev/docs/public/vex-${(0,et.randomUUID)()}`,i=t.timestamp??new Date().toISOString();return{"@context":lr,"@id":n,author:e,timestamp:i,last_updated:i,version:1,statements:[t]}}var de=require("fs/promises"),pe=require("path");var fe=class{constructor(e){this.location=e}location;_content=void 0;_exists=!1;get exists(){return this._exists}get content(){return this._content}set content(e){this._content=e,this._exists=e!==void 0}async read(){let e=await X(this.location);this._content=e??void 0,this._exists=this._content!==void 0}async write(){if(this._content===void 0)throw new Error(`Cannot write VexFile: content is undefined (${this.location})`);await(0,de.mkdir)((0,pe.dirname)((0,pe.resolve)(this.location)),{recursive:!0}),await re(this.location,this._content)}async delete(){await(0,de.unlink)(this.location),this._exists=!1}upsert(e,r){if(this._content===void 0)return this._content=tt(e,r),this._exists=!0,{created:!0,changed:!0};let n=rt(e.products),i=this._content.statements,s=[];for(let o=0;o<i.length;o++){let a=i[o];a.vulnerability.name===e.vulnerability.name&&a.status===e.status&&ur(rt(a.products),n)&&s.push(o)}if(s.length>0){let o=s[0],a=i[o],c=s.slice(1),u=!cr(a,e);if(c.length===0&&!u)return{created:!1,changed:!1};u&&(a.impact_statement=e.impact_statement,a.action_statement=e.action_statement,a.justification=e.justification,a.status_notes=e.status_notes,a.timestamp=e.timestamp);for(let f=c.length-1;f>=0;f--)i.splice(c[f],1);return this._content.version+=1,this._content.last_updated=e.timestamp??new Date().toISOString(),{created:!1,changed:!0}}for(let o=i.length-1;o>=0;o--){let a=i[o];if(a.vulnerability.name!==e.vulnerability.name||a.status!==e.status||!a.products||a.products.length===0)continue;let c=a.products.filter(u=>{let f=u["@id"];return typeof f!="string"||!n.has(f)});c.length!==a.products.length&&(c.length===0?i.splice(o,1):a.products=c)}return i.push(e),this._content.version+=1,this._content.last_updated=e.timestamp??new Date().toISOString(),{created:!1,changed:!0}}addProductId(e,r){this.assertContentLoaded("addProductId");let n=!1;for(let i of this._content.statements){if(!i.products||i.products.some(o=>o["@id"]===r))continue;let s=i.products.findIndex(o=>o["@id"]===e);s!==-1&&(i.products.splice(s+1,0,{"@id":r}),n=!0)}return n}removeProductId(e,r){this.assertContentLoaded("removeProductId");let n=this._content.statements,i=[],s=!1;for(let o of n){if(r&&!nt(o).has(r)||!o.products)continue;let a=o.products.findIndex(c=>c["@id"]===e);a!==-1&&(o.products.splice(a,1),s=!0,o.products.length===0&&i.push(o))}if(!s)return"unchanged";for(let o of i)n.splice(n.indexOf(o),1);return n.length===0?"emptied":"changed"}hasStatementForProduct(e){return this.assertContentLoaded("hasStatementForProduct"),this._content.statements.some(r=>r.products?.some(n=>n["@id"]===e)??!1)}assertContentLoaded(e){if(this._content===void 0)throw new Error(`VexFile.${e}(): content is not loaded. Call read() first (${this.location})`)}};function cr(t,e){return t.impact_statement===e.impact_statement&&t.action_statement===e.action_statement&&t.justification===e.justification&&t.status_notes===e.status_notes}function rt(t){let e=new Set;if(!t)return e;for(let r of t){let n=r["@id"];typeof n=="string"&&e.add(n)}return e}function ur(t,e){if(t.size!==e.size)return!1;for(let r of t)if(!e.has(r))return!1;return!0}async function Re(t,e){for(let r of await(0,it.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new fe((0,je.resolve)(r.parentPath,r.name))):r.isDirectory()&&await Re((0,je.resolve)(r.parentPath,r.name),e)}function nt(t){let e=t.vulnerability.name;return new Set([e,...t.vulnerability.aliases??[]])}async function ot({workingDir:t,projectName:e,projectVersion:r,vulnId:n}){let i=await new z(t).loadProjectConfig();if(!i.projectConfigFileLocation)throw new Error("Missing project configuration file.");let s=i.projects.find(o=>o.name===e&&o.version===r);if(!s){console.info(`Project ${e} with version ${r} not found.`);return}n||await fr(i.projectConfigFileLocation,s),await dr(i.vexDir,s.purl,n)}async function fr(t,e){await new ue(t).remove(e.name,e.version)&&console.info(`Remove project ${e.name} with version ${e.version} from ${t}`)}async function dr(t,e,r){await Re(t,async n=>{await n.read();let i=n.removeProductId(e,r);i==="emptied"?(console.info(`Remove ${e} from ${n.location} and delete file.`),await n.delete()):i==="changed"&&(console.info(`Remove ${e} from ${n.location}`),await n.write())})}var pr=["emacs","vim"],mr=new Set(pr);function hr(t){return mr.has(t)}function st(){let t=process.env.INQUIRER_KEYBINDINGS;return t?Array.from(new Set(t.toLowerCase().split(/[\s,]+/).filter(hr))):[]}var ne=(t,e=[])=>t.name==="up"||e.includes("vim")&&t.name==="k"||e.includes("emacs")&&t.ctrl&&t.name==="p",me=(t,e=[])=>t.name==="down"||e.includes("vim")&&t.name==="j"||e.includes("emacs")&&t.ctrl&&t.name==="n";var ie=t=>t.name==="backspace",oe=t=>t.name==="tab",Ce=t=>"1234567890".includes(t.name),k=t=>t.name==="enter"||t.name==="return";var he=class extends Error{name="AbortPromptError";message="Prompt was aborted";constructor(e){super(),this.cause=e?.cause}},ge=class extends Error{name="CancelPromptError";message="Prompt was canceled"},se=class extends Error{name="ExitPromptError"},we=class extends Error{name="HookError"},Y=class extends Error{name="ValidationError"};var ut=require("node:async_hooks");var Se=require("node:async_hooks");var at=new Se.AsyncLocalStorage;function gr(t){return{rl:t,hooks:[],hooksCleanup:[],hooksEffect:[],index:0,handleChange(){}}}function lt(t,e){let r=gr(t);return at.run(r,()=>{function n(i){r.handleChange=()=>{r.index=0,i()},r.handleChange()}return e(n)})}function M(){let t=at.getStore();if(!t)throw new we("[Inquirer] Hook functions can only be called from within a prompt");return t}function Fe(){return M().rl}function Te(t){let e=(...r)=>{let n=M(),i=!1,s=n.handleChange;n.handleChange=()=>{i=!0};let o=t(...r);return i&&s(),n.handleChange=s,o};return Se.AsyncResource.bind(e)}function Q(t){let e=M(),{index:r}=e,n={get(){return e.hooks[r]},set(s){e.hooks[r]=s},initialized:r in e.hooks},i=t(n);return e.index++,i}function ct(){M().handleChange()}var W={queue(t){let e=M(),{index:r}=e;e.hooksEffect.push(()=>{e.hooksCleanup[r]?.();let n=t(Fe());if(n!=null&&typeof n!="function")throw new Y("useEffect return value must be a cleanup function or nothing.");e.hooksCleanup[r]=n})},run(){let t=M();Te(()=>{t.hooksEffect.forEach(e=>{e()}),t.hooksEffect.length=0})()},clearAll(){let t=M();t.hooksCleanup.forEach(e=>{e?.()}),t.hooksEffect.length=0,t.hooksCleanup.length=0}};function wr(t){return typeof t=="function"}function D(t){return Q(e=>{let r=ut.AsyncResource.bind(function(s){e.get()!==s&&(e.set(s),ct())});if(e.initialized)return[e.get(),r];let n=wr(t)?t():t;return e.set(n),[n,r]})}function U(t,e){Q(r=>{let n=r.get();(!Array.isArray(n)||e.some((s,o)=>!Object.is(s,n[o])))&&W.queue(t),r.set(e)})}var F=require("node:util");var C=$(require("node:process"),1);function Sr(){return C.default.platform.startsWith("win")?!!C.default.env.CI||!!C.default.env.WT_SESSION||!!C.default.env.TERMINUS_SUBLIME||C.default.env.ConEmuTask==="{cmd::Cmder}"||C.default.env.TERM_PROGRAM==="Terminus-Sublime"||C.default.env.TERM_PROGRAM==="vscode"||C.default.env.TERM==="xterm-256color"||C.default.env.TERM==="alacritty"||C.default.env.TERMINAL_EMULATOR==="JetBrains-JediTerm":C.default.env.TERM!=="linux"}var ft={circleQuestionMark:"(?)",questionMarkPrefix:"(?)",square:"\u2588",squareDarkShade:"\u2593",squareMediumShade:"\u2592",squareLightShade:"\u2591",squareTop:"\u2580",squareBottom:"\u2584",squareLeft:"\u258C",squareRight:"\u2590",squareCenter:"\u25A0",bullet:"\u25CF",dot:"\u2024",ellipsis:"\u2026",pointerSmall:"\u203A",triangleUp:"\u25B2",triangleUpSmall:"\u25B4",triangleDown:"\u25BC",triangleDownSmall:"\u25BE",triangleLeftSmall:"\u25C2",triangleRightSmall:"\u25B8",home:"\u2302",heart:"\u2665",musicNote:"\u266A",musicNoteBeamed:"\u266B",arrowUp:"\u2191",arrowDown:"\u2193",arrowLeft:"\u2190",arrowRight:"\u2192",arrowLeftRight:"\u2194",arrowUpDown:"\u2195",almostEqual:"\u2248",notEqual:"\u2260",lessOrEqual:"\u2264",greaterOrEqual:"\u2265",identical:"\u2261",infinity:"\u221E",subscriptZero:"\u2080",subscriptOne:"\u2081",subscriptTwo:"\u2082",subscriptThree:"\u2083",subscriptFour:"\u2084",subscriptFive:"\u2085",subscriptSix:"\u2086",subscriptSeven:"\u2087",subscriptEight:"\u2088",subscriptNine:"\u2089",oneHalf:"\xBD",oneThird:"\u2153",oneQuarter:"\xBC",oneFifth:"\u2155",oneSixth:"\u2159",oneEighth:"\u215B",twoThirds:"\u2154",twoFifths:"\u2156",threeQuarters:"\xBE",threeFifths:"\u2157",threeEighths:"\u215C",fourFifths:"\u2158",fiveSixths:"\u215A",fiveEighths:"\u215D",sevenEighths:"\u215E",line:"\u2500",lineBold:"\u2501",lineDouble:"\u2550",lineDashed0:"\u2504",lineDashed1:"\u2505",lineDashed2:"\u2508",lineDashed3:"\u2509",lineDashed4:"\u254C",lineDashed5:"\u254D",lineDashed6:"\u2574",lineDashed7:"\u2576",lineDashed8:"\u2578",lineDashed9:"\u257A",lineDashed10:"\u257C",lineDashed11:"\u257E",lineDashed12:"\u2212",lineDashed13:"\u2013",lineDashed14:"\u2010",lineDashed15:"\u2043",lineVertical:"\u2502",lineVerticalBold:"\u2503",lineVerticalDouble:"\u2551",lineVerticalDashed0:"\u2506",lineVerticalDashed1:"\u2507",lineVerticalDashed2:"\u250A",lineVerticalDashed3:"\u250B",lineVerticalDashed4:"\u254E",lineVerticalDashed5:"\u254F",lineVerticalDashed6:"\u2575",lineVerticalDashed7:"\u2577",lineVerticalDashed8:"\u2579",lineVerticalDashed9:"\u257B",lineVerticalDashed10:"\u257D",lineVerticalDashed11:"\u257F",lineDownLeft:"\u2510",lineDownLeftArc:"\u256E",lineDownBoldLeftBold:"\u2513",lineDownBoldLeft:"\u2512",lineDownLeftBold:"\u2511",lineDownDoubleLeftDouble:"\u2557",lineDownDoubleLeft:"\u2556",lineDownLeftDouble:"\u2555",lineDownRight:"\u250C",lineDownRightArc:"\u256D",lineDownBoldRightBold:"\u250F",lineDownBoldRight:"\u250E",lineDownRightBold:"\u250D",lineDownDoubleRightDouble:"\u2554",lineDownDoubleRight:"\u2553",lineDownRightDouble:"\u2552",lineUpLeft:"\u2518",lineUpLeftArc:"\u256F",lineUpBoldLeftBold:"\u251B",lineUpBoldLeft:"\u251A",lineUpLeftBold:"\u2519",lineUpDoubleLeftDouble:"\u255D",lineUpDoubleLeft:"\u255C",lineUpLeftDouble:"\u255B",lineUpRight:"\u2514",lineUpRightArc:"\u2570",lineUpBoldRightBold:"\u2517",lineUpBoldRight:"\u2516",lineUpRightBold:"\u2515",lineUpDoubleRightDouble:"\u255A",lineUpDoubleRight:"\u2559",lineUpRightDouble:"\u2558",lineUpDownLeft:"\u2524",lineUpBoldDownBoldLeftBold:"\u252B",lineUpBoldDownBoldLeft:"\u2528",lineUpDownLeftBold:"\u2525",lineUpBoldDownLeftBold:"\u2529",lineUpDownBoldLeftBold:"\u252A",lineUpDownBoldLeft:"\u2527",lineUpBoldDownLeft:"\u2526",lineUpDoubleDownDoubleLeftDouble:"\u2563",lineUpDoubleDownDoubleLeft:"\u2562",lineUpDownLeftDouble:"\u2561",lineUpDownRight:"\u251C",lineUpBoldDownBoldRightBold:"\u2523",lineUpBoldDownBoldRight:"\u2520",lineUpDownRightBold:"\u251D",lineUpBoldDownRightBold:"\u2521",lineUpDownBoldRightBold:"\u2522",lineUpDownBoldRight:"\u251F",lineUpBoldDownRight:"\u251E",lineUpDoubleDownDoubleRightDouble:"\u2560",lineUpDoubleDownDoubleRight:"\u255F",lineUpDownRightDouble:"\u255E",lineDownLeftRight:"\u252C",lineDownBoldLeftBoldRightBold:"\u2533",lineDownLeftBoldRightBold:"\u252F",lineDownBoldLeftRight:"\u2530",lineDownBoldLeftBoldRight:"\u2531",lineDownBoldLeftRightBold:"\u2532",lineDownLeftRightBold:"\u252E",lineDownLeftBoldRight:"\u252D",lineDownDoubleLeftDoubleRightDouble:"\u2566",lineDownDoubleLeftRight:"\u2565",lineDownLeftDoubleRightDouble:"\u2564",lineUpLeftRight:"\u2534",lineUpBoldLeftBoldRightBold:"\u253B",lineUpLeftBoldRightBold:"\u2537",lineUpBoldLeftRight:"\u2538",lineUpBoldLeftBoldRight:"\u2539",lineUpBoldLeftRightBold:"\u253A",lineUpLeftRightBold:"\u2536",lineUpLeftBoldRight:"\u2535",lineUpDoubleLeftDoubleRightDouble:"\u2569",lineUpDoubleLeftRight:"\u2568",lineUpLeftDoubleRightDouble:"\u2567",lineUpDownLeftRight:"\u253C",lineUpBoldDownBoldLeftBoldRightBold:"\u254B",lineUpDownBoldLeftBoldRightBold:"\u2548",lineUpBoldDownLeftBoldRightBold:"\u2547",lineUpBoldDownBoldLeftRightBold:"\u254A",lineUpBoldDownBoldLeftBoldRight:"\u2549",lineUpBoldDownLeftRight:"\u2540",lineUpDownBoldLeftRight:"\u2541",lineUpDownLeftBoldRight:"\u253D",lineUpDownLeftRightBold:"\u253E",lineUpBoldDownBoldLeftRight:"\u2542",lineUpDownLeftBoldRightBold:"\u253F",lineUpBoldDownLeftBoldRight:"\u2543",lineUpBoldDownLeftRightBold:"\u2544",lineUpDownBoldLeftBoldRight:"\u2545",lineUpDownBoldLeftRightBold:"\u2546",lineUpDoubleDownDoubleLeftDoubleRightDouble:"\u256C",lineUpDoubleDownDoubleLeftRight:"\u256B",lineUpDownLeftDoubleRightDouble:"\u256A",lineCross:"\u2573",lineBackslash:"\u2572",lineSlash:"\u2571"},dt={tick:"\u2714",info:"\u2139",warning:"\u26A0",cross:"\u2718",squareSmall:"\u25FB",squareSmallFilled:"\u25FC",circle:"\u25EF",circleFilled:"\u25C9",circleDotted:"\u25CC",circleDouble:"\u25CE",circleCircle:"\u24DE",circleCross:"\u24E7",circlePipe:"\u24BE",radioOn:"\u25C9",radioOff:"\u25EF",checkboxOn:"\u2612",checkboxOff:"\u2610",checkboxCircleOn:"\u24E7",checkboxCircleOff:"\u24BE",pointer:"\u276F",triangleUpOutline:"\u25B3",triangleLeft:"\u25C0",triangleRight:"\u25B6",lozenge:"\u25C6",lozengeOutline:"\u25C7",hamburger:"\u2630",smiley:"\u32E1",mustache:"\u0DF4",star:"\u2605",play:"\u25B6",nodejs:"\u2B22",oneSeventh:"\u2150",oneNinth:"\u2151",oneTenth:"\u2152"},yr={tick:"\u221A",info:"i",warning:"\u203C",cross:"\xD7",squareSmall:"\u25A1",squareSmallFilled:"\u25A0",circle:"( )",circleFilled:"(*)",circleDotted:"( )",circleDouble:"( )",circleCircle:"(\u25CB)",circleCross:"(\xD7)",circlePipe:"(\u2502)",radioOn:"(*)",radioOff:"( )",checkboxOn:"[\xD7]",checkboxOff:"[ ]",checkboxCircleOn:"(\xD7)",checkboxCircleOff:"( )",pointer:">",triangleUpOutline:"\u2206",triangleLeft:"\u25C4",triangleRight:"\u25BA",lozenge:"\u2666",lozengeOutline:"\u25CA",hamburger:"\u2261",smiley:"\u263A",mustache:"\u250C\u2500\u2510",star:"\u2736",play:"\u25BA",nodejs:"\u2666",oneSeventh:"1/7",oneNinth:"1/9",oneTenth:"1/10"},xr={...ft,...dt},vr={...ft,...yr},br=Sr(),Er=br?xr:vr,Z=Er,Bn=Object.entries(dt);var Dr={prefix:{idle:(0,F.styleText)("blue","?"),done:(0,F.styleText)("green",Z.tick)},spinner:{interval:80,frames:["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"].map(t=>(0,F.styleText)("yellow",t))},keybindings:[],style:{answer:t=>(0,F.styleText)("cyan",t),message:t=>(0,F.styleText)("bold",t),error:t=>(0,F.styleText)("red",`> ${t}`),defaultAnswer:t=>(0,F.styleText)("dim",`(${t})`),help:t=>(0,F.styleText)("dim",t),highlight:t=>(0,F.styleText)("cyan",t),key:t=>(0,F.styleText)("cyan",(0,F.styleText)("bold",`<${t}>`))}};function pt(){return{...Dr,keybindings:st()}}function mt(t){if(typeof t!="object"||t===null)return!1;let e=t;for(;Object.getPrototypeOf(e)!==null;)e=Object.getPrototypeOf(e);return Object.getPrototypeOf(t)===e}function ht(...t){let e={};for(let r of t)for(let[n,i]of Object.entries(r)){let s=e[n];e[n]=mt(s)&&mt(i)?ht(s,i):i}return e}function O(...t){let e=[pt(),...t.filter(r=>r!=null)];return ht(...e)}function K({status:t="idle",theme:e}){let[r,n]=D(!1),[i,s]=D(0),{prefix:o,spinner:a}=O(e);return U(()=>{if(t==="loading"){let u,f=-1,l=setTimeout(()=>{n(!0),u=setInterval(()=>{f=f+1,s(f%a.frames.length)},a.interval)},300);return()=>{clearTimeout(l),clearInterval(u)}}else n(!1)},[t]),r?a.frames[i]:typeof o=="string"?o:o[t==="loading"?"idle":t]??o.idle}function ae(t,e){return Q(r=>{let n=r.get();if(!n||n.dependencies.length!==e.length||n.dependencies.some((i,s)=>i!==e[s])){let i=t();return r.set({value:i,dependencies:e}),i}return n.value})}function H(t){return D({current:t})[0]}function G(t){let e=H(t);e.current=t,U(r=>{let n=!1,i=Te((s,o)=>{n||e.current(o,r)});return r.input.on("keypress",i),()=>{n=!0,r.input.removeListener("keypress",i)}},[])}var _t=$(wt(),1);var St=(()=>{let t=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g;return e=>{let r=0;for(t.lastIndex=0;t.test(e);)r+=1;return e.length-r}})(),yt=t=>t===12288||t>=65281&&t<=65376||t>=65504&&t<=65510,xt=t=>t===8987||t===9001||t>=12272&&t<=12287||t>=12289&&t<=12350||t>=12441&&t<=12543||t>=12549&&t<=12591||t>=12593&&t<=12686||t>=12688&&t<=12771||t>=12783&&t<=12830||t>=12832&&t<=12871||t>=12880&&t<=19903||t>=65040&&t<=65049||t>=65072&&t<=65106||t>=65108&&t<=65126||t>=65128&&t<=65131||t>=127488&&t<=127490||t>=127504&&t<=127547||t>=127552&&t<=127560||t>=131072&&t<=196605||t>=196608&&t<=262141;var Ir=/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y,jr=/[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y,vt=/(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu,Rr=/\t{1,1000}/y,bt=new RegExp("[\\u{1F1E6}-\\u{1F1FF}]{2}|\\u{1F3F4}[\\u{E0061}-\\u{E007A}]{2}[\\u{E0030}-\\u{E0039}\\u{E0061}-\\u{E007A}]{1,3}\\u{E007F}|(?:\\p{Emoji}\\uFE0F\\u20E3?|\\p{Emoji_Modifier_Base}\\p{Emoji_Modifier}?|\\p{Emoji_Presentation})(?:\\u200D(?:\\p{Emoji_Modifier_Base}\\p{Emoji_Modifier}?|\\p{Emoji_Presentation}|\\p{Emoji}\\uFE0F\\u20E3?))*","yu"),Cr=/(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y,Fr=new RegExp("\\p{M}+","gu"),Tr={limit:1/0,ellipsis:""},Et=(t,e={},r={})=>{let n=e.limit??1/0,i=e.ellipsis??"",s=e?.ellipsisWidth??(i?Et(i,Tr,r).width:0),o=0,a=r.controlWidth??0,c=r.tabWidth??8,u=r.emojiWidth??2,f=2,l=r.regularWidth??1,p=r.wideWidth??f,S=[[Cr,l],[Ir,o],[jr,a],[Rr,c],[bt,u],[vt,p]],h=0,d=0,m=t.length,y=0,g=!1,x=m,v=Math.max(0,n-s),P=0,L=0,j=0,R=0;e:for(;;){if(L>P||d>=m&&d>h){let w=t.slice(P,L)||t.slice(h,d);y=0;for(let b of w.replaceAll(Fr,"")){let E=b.codePointAt(0)||0;if(yt(E)?R=f:xt(E)?R=p:R=l,j+R>v&&(x=Math.min(x,Math.max(P,h)+y)),j+R>n){g=!0;break e}y+=b.length,j+=R}P=L=0}if(d>=m)break e;for(let w=0,b=S.length;w<b;w++){let[E,I]=S[w];if(E.lastIndex=d,E.test(t)){if(y=E===vt?St(t.slice(d,E.lastIndex)):E===bt?1:E.lastIndex-d,R=y*I,j+R>v&&(x=Math.min(x,d+Math.floor((v-j)/I))),j+R>n){g=!0;break e}j+=R,P=h,L=d,d=h=E.lastIndex;continue e}}d+=1}return{width:g?v:j,index:g?x:m,truncated:g,ellipsed:g&&n>=s}},Dt=Et;var _r={limit:1/0,ellipsis:"",ellipsisWidth:0},Br=(t,e={})=>Dt(t,_r,e).width,A=Br;var ye="\x1B",Rt="\x9B",Ur=39,Be="\x07",Ct="[",Or="]",Ft="m",Ue=`${Or}8;;`,Pt=new RegExp(`(?:\\${Ct}(?<code>\\d+)m|\\${Ue}(?<uri>.*)${Be})`,"y"),Lt=t=>{if(t>=30&&t<=37||t>=90&&t<=97)return 39;if(t>=40&&t<=47||t>=100&&t<=107)return 49;if(t===1||t===2)return 22;if(t===3)return 23;if(t===4)return 24;if(t===7)return 27;if(t===8)return 28;if(t===9)return 29;if(t===0)return 0},It=t=>`${ye}${Ct}${t}${Ft}`,jt=t=>`${ye}${Ue}${t}${Be}`,_e=(t,e,r)=>{let n=e[Symbol.iterator](),i=!1,s=!1,o=t.at(-1),a=o===void 0?0:A(o),c=n.next(),u=n.next(),f=0;for(;!c.done;){let l=c.value,p=A(l);a+p<=r?t[t.length-1]+=l:(t.push(l),a=0),(l===ye||l===Rt)&&(i=!0,s=e.startsWith(Ue,f+1)),i?s?l===Be&&(i=!1,s=!1):l===Ft&&(i=!1):(a+=p,a===r&&!u.done&&(t.push(""),a=0)),c=u,u=n.next(),f+=l.length}o=t.at(-1),!a&&o!==void 0&&o.length&&t.length>1&&(t[t.length-2]+=t.pop())},Ar=t=>{let e=t.split(" "),r=e.length;for(;r&&!A(e[r-1]);)r--;return r===e.length?t:e.slice(0,r).join(" ")+e.slice(r).join("")},Nr=(t,e,r={})=>{if(r.trim!==!1&&t.trim()==="")return"";let n="",i,s,o=t.split(" "),a=[""],c=0;for(let l=0;l<o.length;l++){let p=o[l];if(r.trim!==!1){let h=a.at(-1)??"",d=h.trimStart();h.length!==d.length&&(a[a.length-1]=d,c=A(d))}l!==0&&(c>=e&&(r.wordWrap===!1||r.trim===!1)&&(a.push(""),c=0),(c||r.trim===!1)&&(a[a.length-1]+=" ",c++));let S=A(p);if(r.hard&&S>e){let h=e-c,d=1+Math.floor((S-h-1)/e);Math.floor((S-1)/e)<d&&a.push(""),_e(a,p,e),c=A(a.at(-1)??"");continue}if(c+S>e&&c&&S){if(r.wordWrap===!1&&c<e){_e(a,p,e),c=A(a.at(-1)??"");continue}a.push(""),c=0}if(c+S>e&&r.wordWrap===!1){_e(a,p,e),c=A(a.at(-1)??"");continue}a[a.length-1]+=p,c+=S}r.trim!==!1&&(a=a.map(l=>Ar(l)));let u=a.join(`
4
+ `),f=!1;for(let l=0;l<u.length;l++){let p=u[l];if(n+=p,f)f=!1;else if(f=p>="\uD800"&&p<="\uDBFF",f)continue;if(p===ye||p===Rt){Pt.lastIndex=l+1;let h=Pt.exec(u)?.groups;if(h?.code!==void 0){let d=Number.parseFloat(h.code);i=d===Ur?void 0:d}else h?.uri!==void 0&&(s=h.uri.length===0?void 0:h.uri)}if(u[l+1]===`
5
+ `){s&&(n+=jt(""));let S=i?Lt(i):void 0;i&&S&&(n+=It(S))}else p===`
6
+ `&&(i&&Lt(i)&&(n+=It(i)),s&&(n+=jt(s)))}return n},Vr=/\r?\n/;function Tt(t,e,r){return String(t).normalize().split(Vr).map(n=>Nr(n,e,r)).join(`
7
7
  `)}function le(t,e){return t.split(`
8
- `).flatMap(r=>Bt(r,e,{trim:!1,wordWrap:!1}).split(`
8
+ `).flatMap(r=>Tt(r,e,{trim:!1,wordWrap:!1}).split(`
9
9
  `).map(n=>n.trimEnd())).join(`
10
- `)}function ve(){return(0,Ut.default)({defaultWidth:80,output:Te().output})}function Mr({active:t,renderedItems:e,pageSize:r,loop:n}){let i=H({lastPointer:t,lastActive:void 0}),{lastPointer:o,lastActive:s}=i.current,a=Math.floor(r/2),c=e.reduce((l,p)=>l+p.length,0),u=e.slice(0,t).reduce((l,p)=>l+p.length,0),f=u;if(c>r)if(n)f=o,s!=null&&s<t&&t-s<r&&(f=Math.min(a,Math.abs(t-s)===1?Math.min(o+(e[s]?.length??0),Math.max(u,o)):o+t-s));else{let l=e.slice(t).reduce((p,S)=>p+S.length,0);f=l<r-a?r-l:Math.min(u,a)}return i.current.lastPointer=f,i.current.lastActive=t,f}function Oe({items:t,active:e,renderItem:r,pageSize:n,loop:i=!0}){let o=ve(),s=x=>(x%t.length+t.length)%t.length,a=t.map((x,g)=>x==null?[]:le(r({item:x,index:g,isActive:g===e}),o).split(`
11
- `)),c=a.reduce((x,g)=>x+g.length,0),u=x=>a[x]??[],f=Mr({active:e,renderedItems:a,pageSize:n,loop:i}),l=u(e).slice(0,n),p=f+l.length<=n?f:n-l.length,S=Array.from({length:n});S.splice(p,l.length,...l);let h=new Set([e]),d=p+l.length,m=s(e+1);for(;d<n&&!h.has(m)&&(i&&c>n?m!==e:m>e);){let g=u(m).slice(0,n-d);S.splice(d,g.length,...g),h.add(m),d+=g.length,m=s(m+1)}for(d=p-1,m=s(e-1);d>=0&&!h.has(m)&&(i&&c>n?m!==e:m<e);){let x=u(m),g=x.slice(Math.max(0,x.length-d-1));S.splice(d-g.length+1,g.length,...g),h.add(m),d-=g.length,m=s(m-1)}return S.filter(x=>typeof x=="string").join(`
12
- `)}var Kt=$(require("node:readline"),1),Ht=require("node:async_hooks"),Gt=$(Ot(),1);var q=[];q.push("SIGHUP","SIGINT","SIGTERM");process.platform!=="win32"&&q.push("SIGALRM","SIGABRT","SIGVTALRM","SIGXCPU","SIGXFSZ","SIGUSR2","SIGTRAP","SIGSYS","SIGQUIT","SIGIOT");process.platform==="linux"&&q.push("SIGIO","SIGPOLL","SIGPWR","SIGSTKFLT");var be=t=>!!t&&typeof t=="object"&&typeof t.removeListener=="function"&&typeof t.emit=="function"&&typeof t.reallyExit=="function"&&typeof t.listeners=="function"&&typeof t.kill=="function"&&typeof t.pid=="number"&&typeof t.on=="function",Ve=Symbol.for("signal-exit emitter"),$e=globalThis,Kr=Object.defineProperty.bind(Object),ke=class{emitted={afterExit:!1,exit:!1};listeners={afterExit:[],exit:[]};count=0;id=Math.random();constructor(){if($e[Ve])return $e[Ve];Kr($e,Ve,{value:this,writable:!1,enumerable:!1,configurable:!1})}on(e,r){this.listeners[e].push(r)}removeListener(e,r){let n=this.listeners[e],i=n.indexOf(r);i!==-1&&(i===0&&n.length===1?n.length=0:n.splice(i,1))}emit(e,r,n){if(this.emitted[e])return!1;this.emitted[e]=!0;let i=!1;for(let o of this.listeners[e])i=o(r,n)===!0||i;return e==="exit"&&(i=this.emit("afterExit",r,n)||i),i}},Ee=class{},Hr=t=>({onExit(e,r){return t.onExit(e,r)},load(){return t.load()},unload(){return t.unload()}}),Me=class extends Ee{onExit(){return()=>{}}load(){}unload(){}},We=class extends Ee{#r=Ke.platform==="win32"?"SIGINT":"SIGHUP";#t=new ke;#e;#o;#s;#i={};#n=!1;constructor(e){super(),this.#e=e,this.#i={};for(let r of q)this.#i[r]=()=>{let n=this.#e.listeners(r),{count:i}=this.#t,o=e;if(typeof o.__signal_exit_emitter__=="object"&&typeof o.__signal_exit_emitter__.count=="number"&&(i+=o.__signal_exit_emitter__.count),n.length===i){this.unload();let s=this.#t.emit("exit",null,r),a=r==="SIGHUP"?this.#r:r;s||e.kill(e.pid,a)}};this.#s=e.reallyExit,this.#o=e.emit}onExit(e,r){if(!be(this.#e))return()=>{};this.#n===!1&&this.load();let n=r?.alwaysLast?"afterExit":"exit";return this.#t.on(n,e),()=>{this.#t.removeListener(n,e),this.#t.listeners.exit.length===0&&this.#t.listeners.afterExit.length===0&&this.unload()}}load(){if(!this.#n){this.#n=!0,this.#t.count+=1;for(let e of q)try{let r=this.#i[e];r&&this.#e.on(e,r)}catch{}this.#e.emit=(e,...r)=>this.#l(e,...r),this.#e.reallyExit=e=>this.#a(e)}}unload(){this.#n&&(this.#n=!1,q.forEach(e=>{let r=this.#i[e];if(!r)throw new Error("Listener not defined for signal: "+e);try{this.#e.removeListener(e,r)}catch{}}),this.#e.emit=this.#o,this.#e.reallyExit=this.#s,this.#t.count-=1)}#a(e){return be(this.#e)?(this.#e.exitCode=e||0,this.#t.emit("exit",this.#e.exitCode,null),this.#s.call(this.#e,this.#e.exitCode)):0}#l(e,...r){let n=this.#o;if(e==="exit"&&be(this.#e)){typeof r[0]=="number"&&(this.#e.exitCode=r[0]);let i=n.call(this.#e,e,...r);return this.#t.emit("exit",this.#e.exitCode,null),i}else return n.call(this.#e,e,...r)}},Ke=globalThis.process,{onExit:Nt,load:wi,unload:Si}=Hr(be(Ke)?new We(Ke):new Me);var Wt=require("node:util");var $t="\x1B[?25l",kt="\x1B[?25h",He=(t=1)=>t>0?`\x1B[${t}A`:"",Ge=(t=1)=>t>0?`\x1B[${t}B`:"",qe=(t,e)=>typeof e=="number"&&!Number.isNaN(e)?`\x1B[${e+1};${t+1}H`:`\x1B[${t+1}G`,Vt="\x1B[2K",Je=t=>t>0?(Vt+He(1)).repeat(t-1)+Vt+"\x1B[G":"";var Mt=t=>t.split(`
13
- `).length,qr=t=>t.split(`
14
- `).pop()??"",ce=class{height=0;extraLinesUnderPrompt=0;cursorPos;rl;constructor(e){this.rl=e,this.cursorPos=e.getCursorPos()}write(e){this.rl.output.unmute(),this.rl.output.write(e),this.rl.output.mute()}render(e,r=""){let n=qr(e),i=(0,Wt.stripVTControlCharacters)(n),o=i;this.rl.line.length>0&&(o=o.slice(0,-this.rl.line.length)),this.rl.setPrompt(o),this.cursorPos=this.rl.getCursorPos();let s=ve();e=le(e,s),r=le(r,s),i.length%s===0&&(e+=`
10
+ `)}function xe(){return(0,_t.default)({defaultWidth:80,output:Fe().output})}function $r({active:t,renderedItems:e,pageSize:r,loop:n}){let i=H({lastPointer:t,lastActive:void 0}),{lastPointer:s,lastActive:o}=i.current,a=Math.floor(r/2),c=e.reduce((l,p)=>l+p.length,0),u=e.slice(0,t).reduce((l,p)=>l+p.length,0),f=u;if(c>r)if(n)f=s,o!=null&&o<t&&t-o<r&&(f=Math.min(a,Math.abs(t-o)===1?Math.min(s+(e[o]?.length??0),Math.max(u,s)):s+t-o));else{let l=e.slice(t).reduce((p,S)=>p+S.length,0);f=l<r-a?r-l:Math.min(u,a)}return i.current.lastPointer=f,i.current.lastActive=t,f}function Oe({items:t,active:e,renderItem:r,pageSize:n,loop:i=!0}){let s=xe(),o=y=>(y%t.length+t.length)%t.length,a=t.map((y,g)=>y==null?[]:le(r({item:y,index:g,isActive:g===e}),s).split(`
11
+ `)),c=a.reduce((y,g)=>y+g.length,0),u=y=>a[y]??[],f=$r({active:e,renderedItems:a,pageSize:n,loop:i}),l=u(e).slice(0,n),p=f+l.length<=n?f:n-l.length,S=Array.from({length:n});S.splice(p,l.length,...l);let h=new Set([e]),d=p+l.length,m=o(e+1);for(;d<n&&!h.has(m)&&(i&&c>n?m!==e:m>e);){let g=u(m).slice(0,n-d);S.splice(d,g.length,...g),h.add(m),d+=g.length,m=o(m+1)}for(d=p-1,m=o(e-1);d>=0&&!h.has(m)&&(i&&c>n?m!==e:m<e);){let y=u(m),g=y.slice(Math.max(0,y.length-d-1));S.splice(d-g.length+1,g.length,...g),h.add(m),d-=g.length,m=o(m-1)}return S.filter(y=>typeof y=="string").join(`
12
+ `)}var Mt=$(require("node:readline"),1),Wt=require("node:async_hooks"),Kt=$(Ut(),1);var q=[];q.push("SIGHUP","SIGINT","SIGTERM");process.platform!=="win32"&&q.push("SIGALRM","SIGABRT","SIGVTALRM","SIGXCPU","SIGXFSZ","SIGUSR2","SIGTRAP","SIGSYS","SIGQUIT","SIGIOT");process.platform==="linux"&&q.push("SIGIO","SIGPOLL","SIGPWR","SIGSTKFLT");var ve=t=>!!t&&typeof t=="object"&&typeof t.removeListener=="function"&&typeof t.emit=="function"&&typeof t.reallyExit=="function"&&typeof t.listeners=="function"&&typeof t.kill=="function"&&typeof t.pid=="number"&&typeof t.on=="function",Ne=Symbol.for("signal-exit emitter"),Ve=globalThis,Mr=Object.defineProperty.bind(Object),$e=class{emitted={afterExit:!1,exit:!1};listeners={afterExit:[],exit:[]};count=0;id=Math.random();constructor(){if(Ve[Ne])return Ve[Ne];Mr(Ve,Ne,{value:this,writable:!1,enumerable:!1,configurable:!1})}on(e,r){this.listeners[e].push(r)}removeListener(e,r){let n=this.listeners[e],i=n.indexOf(r);i!==-1&&(i===0&&n.length===1?n.length=0:n.splice(i,1))}emit(e,r,n){if(this.emitted[e])return!1;this.emitted[e]=!0;let i=!1;for(let s of this.listeners[e])i=s(r,n)===!0||i;return e==="exit"&&(i=this.emit("afterExit",r,n)||i),i}},be=class{},Wr=t=>({onExit(e,r){return t.onExit(e,r)},load(){return t.load()},unload(){return t.unload()}}),ke=class extends be{onExit(){return()=>{}}load(){}unload(){}},Me=class extends be{#r=We.platform==="win32"?"SIGINT":"SIGHUP";#t=new $e;#e;#o;#s;#i={};#n=!1;constructor(e){super(),this.#e=e,this.#i={};for(let r of q)this.#i[r]=()=>{let n=this.#e.listeners(r),{count:i}=this.#t,s=e;if(typeof s.__signal_exit_emitter__=="object"&&typeof s.__signal_exit_emitter__.count=="number"&&(i+=s.__signal_exit_emitter__.count),n.length===i){this.unload();let o=this.#t.emit("exit",null,r),a=r==="SIGHUP"?this.#r:r;o||e.kill(e.pid,a)}};this.#s=e.reallyExit,this.#o=e.emit}onExit(e,r){if(!ve(this.#e))return()=>{};this.#n===!1&&this.load();let n=r?.alwaysLast?"afterExit":"exit";return this.#t.on(n,e),()=>{this.#t.removeListener(n,e),this.#t.listeners.exit.length===0&&this.#t.listeners.afterExit.length===0&&this.unload()}}load(){if(!this.#n){this.#n=!0,this.#t.count+=1;for(let e of q)try{let r=this.#i[e];r&&this.#e.on(e,r)}catch{}this.#e.emit=(e,...r)=>this.#l(e,...r),this.#e.reallyExit=e=>this.#a(e)}}unload(){this.#n&&(this.#n=!1,q.forEach(e=>{let r=this.#i[e];if(!r)throw new Error("Listener not defined for signal: "+e);try{this.#e.removeListener(e,r)}catch{}}),this.#e.emit=this.#o,this.#e.reallyExit=this.#s,this.#t.count-=1)}#a(e){return ve(this.#e)?(this.#e.exitCode=e||0,this.#t.emit("exit",this.#e.exitCode,null),this.#s.call(this.#e,this.#e.exitCode)):0}#l(e,...r){let n=this.#o;if(e==="exit"&&ve(this.#e)){typeof r[0]=="number"&&(this.#e.exitCode=r[0]);let i=n.call(this.#e,e,...r);return this.#t.emit("exit",this.#e.exitCode,null),i}else return n.call(this.#e,e,...r)}},We=globalThis.process,{onExit:Ot,load:gi,unload:wi}=Wr(ve(We)?new Me(We):new ke);var kt=require("node:util");var Nt="\x1B[?25l",Vt="\x1B[?25h",Ke=(t=1)=>t>0?`\x1B[${t}A`:"",He=(t=1)=>t>0?`\x1B[${t}B`:"",Ge=(t,e)=>typeof e=="number"&&!Number.isNaN(e)?`\x1B[${e+1};${t+1}H`:`\x1B[${t+1}G`,At="\x1B[2K",qe=t=>t>0?(At+Ke(1)).repeat(t-1)+At+"\x1B[G":"";var $t=t=>t.split(`
13
+ `).length,Hr=t=>t.split(`
14
+ `).pop()??"",ce=class{height=0;extraLinesUnderPrompt=0;cursorPos;rl;constructor(e){this.rl=e,this.cursorPos=e.getCursorPos()}write(e){this.rl.output.unmute(),this.rl.output.write(e),this.rl.output.mute()}render(e,r=""){let n=Hr(e),i=(0,kt.stripVTControlCharacters)(n),s=i;this.rl.line.length>0&&(s=s.slice(0,-this.rl.line.length)),this.rl.setPrompt(s),this.cursorPos=this.rl.getCursorPos();let o=xe();e=le(e,o),r=le(r,o),i.length%o===0&&(e+=`
15
15
  `);let a=e+(r?`
16
- `+r:""),u=Math.floor(i.length/s)-this.cursorPos.rows+(r?Mt(r):0);u>0&&(a+=He(u)),a+=qe(this.cursorPos.cols),this.write(Ge(this.extraLinesUnderPrompt)+Je(this.height)+a),this.extraLinesUnderPrompt=u,this.height=Mt(a)}checkCursorPos(){let e=this.rl.getCursorPos();e.cols!==this.cursorPos.cols&&(this.write(qe(e.cols)),this.cursorPos=e)}done({clearContent:e}){this.rl.setPrompt("");let r=Ge(this.extraLinesUnderPrompt);r+=e?Je(this.height):`
17
- `,r+="\x1B[G",r+=kt,this.write(r),this.rl.close()}};var De=class extends Promise{static withResolver(){let e,r;return{promise:new Promise((i,o)=>{e=i,r=o}),resolve:e,reject:r}}};var qt=$(require("node:path"),1),Jr=globalThis.setImmediate;function Xr(){let t=Error.prepareStackTrace,e=[];try{Error.prepareStackTrace=(r,n)=>{let i=n.slice(1);return e=i,i},new Error().stack}catch{return e}return Error.prepareStackTrace=t,e}function J(t){let e=Xr();return(n,i={})=>{let{input:o=process.stdin,signal:s}=i,a=new Set,c=new Gt.default;c.pipe(i.output??process.stdout);let u=Kt.createInterface({terminal:!0,input:o,output:c});c.mute();let f=new ce(u),{promise:l,resolve:p,reject:S}=De.withResolver(),h=()=>S(new we);if(s){let m=()=>S(new ge({cause:s.reason}));if(s.aborted)return m(),Object.assign(l,{cancel:h});s.addEventListener("abort",m),a.add(()=>s.removeEventListener("abort",m))}a.add(Nt((m,x)=>{S(new se(`User force closed the prompt with ${m} ${x}`))}));let d=()=>S(new se("User force closed the prompt with SIGINT"));return u.on("SIGINT",d),a.add(()=>u.removeListener("SIGINT",d)),ut(u,m=>{let x=Ht.AsyncResource.bind(()=>W.clearAll());u.on("close",x),a.add(()=>u.removeListener("close",x));let g=()=>{let y=()=>f.checkCursorPos();u.input.on("keypress",y),a.add(()=>u.input.removeListener("keypress",y));let v=null;m(()=>{let P=!1;try{let L=t(n,w=>{P?p(w):v={value:w}});if(L===void 0){let w=e[1]?.getFileName();throw w&&!w.startsWith("file://")&&(w=qt.default.resolve(w)),new Error(`Prompt functions must return a string.
18
- at ${w}`)}let[I,C]=typeof L=="string"?[L]:L;f.render(I,C),W.run()}catch(L){S(L)}if(P=!0,v!==null){let{value:L}=v;v=null,p(L)}})};return"readableFlowing"in o?Jr(g):g(),Object.assign(l.then(y=>(W.clearAll(),y),y=>{throw W.clearAll(),y}).finally(()=>{a.forEach(y=>y()),f.done({clearContent:!!i.clearPromptOnDone}),c.end()}).then(()=>l),{cancel:h})})}}var Jt=require("node:util");var _=class{separator=(0,Jt.styleText)("dim",Array.from({length:15}).join(Z.line));type="separator";constructor(e){e&&(this.separator=e)}static isSeparator(e){return!!(e&&typeof e=="object"&&"type"in e&&e.type==="separator")}};function Xt(t,e){let r=e!==!1;return/^(y|yes)/i.test(t)?r=!0:/^(n|no)/i.test(t)&&(r=!1),r}function zt(t){return t?"Yes":"No"}var Xe=J((t,e)=>{let{transformer:r=zt}=t,[n,i]=D("idle"),[o,s]=D(""),a=O(t.theme),c=K({status:n,theme:a});G((p,S)=>{if(n==="idle")if(k(p)){let h=Xt(o,t.default);s(r(h)),i("done"),e(h)}else if(oe(p)){let h=zt(!Xt(o,t.default));S.clearLine(0),S.write(h),s(h)}else s(S.line)});let u=o,f="";n==="done"?u=a.style.answer(o):f=` ${a.style.defaultAnswer(t.default===!1?"y/N":"Y/n")}`;let l=a.style.message(t.message,n);return`${c} ${l}${f} ${u}`});var zr={validationFailureMode:"keep"},ze=J((t,e)=>{let{prefill:r="tab"}=t,n=O(zr,t.theme),[i,o]=D("idle"),[s,a]=D(String(t.default??"")),[c,u]=D(),[f,l]=D(""),p=K({status:i,theme:n});async function S(g){let{required:y,pattern:v,patternError:P="Invalid input"}=t;return y&&!g?"You must provide a value":v&&!v.test(g)?P:typeof t.validate=="function"?await t.validate(g)||"You must provide a valid value":!0}G(async(g,y)=>{if(i==="idle")if(k(g)){let v=f||s;o("loading");let P=await S(v);P===!0?(l(v),o("done"),e(v)):(n.validationFailureMode==="clear"?l(""):y.write(f),u(P),o("idle"))}else ie(g)&&!f?a(""):oe(g)&&!f?(a(""),y.clearLine(0),y.write(s),l(s)):(l(y.line),u(void 0))}),A(g=>{r==="editable"&&s&&(g.write(s),l(s))},[]);let h=n.style.message(t.message,i),d=f;typeof t.transformer=="function"?d=t.transformer(f,{isFinal:i==="done"}):i==="done"&&(d=n.style.answer(f));let m;s&&i!=="done"&&!f&&(m=n.style.defaultAnswer(s));let x="";return c&&(x=n.style.error(c)),[[p,h,m,d].filter(g=>g!==void 0).join(" "),x]});var ee=require("node:util");var Yr={icon:{cursor:Z.pointer},style:{disabled:t=>(0,ee.styleText)("dim",t),description:t=>(0,ee.styleText)("cyan",t),keysHelpTip:t=>t.map(([e,r])=>`${(0,ee.styleText)("bold",e)} ${(0,ee.styleText)("dim",r)}`).join((0,ee.styleText)("dim"," \u2022 "))},i18n:{disabledError:"This option is disabled and cannot be selected."},indexMode:"hidden"};function Ye(t){return!_.isSeparator(t)&&!t.disabled}function Qe(t){return!_.isSeparator(t)}function Qr(t){return t.map(e=>{if(_.isSeparator(e))return e;if(typeof e!="object"||e===null||!("value"in e)){let i=String(e);return{value:e,name:i,short:i,disabled:!1}}let r=e.name??String(e.value),n={value:e.value,name:r,short:e.short??r,disabled:e.disabled??!1};return e.description&&(n.description=e.description),n})}var Pe=J((t,e)=>{let{loop:r=!0,pageSize:n=7}=t,i=O(Yr,t.theme),{keybindings:o}=i,[s,a]=D("idle"),c=K({status:s,theme:i}),u=H(),f=!o.includes("vim"),l=ae(()=>Qr(t.choices),[t.choices]),p=ae(()=>{let w=l.findIndex(Qe),b=l.findLastIndex(Qe);if(w===-1)throw new Y("[select prompt] No selectable choices. All choices are disabled.");return{first:w,last:b}},[l]),S=ae(()=>"default"in t?l.findIndex(w=>Ye(w)&&w.value===t.default):-1,[t.default,l]),[h,d]=D(S===-1?p.first:S),m=l[h];if(m==null||_.isSeparator(m))throw new Error("Active index does not point to a choice");let[x,g]=D();G((w,b)=>{if(clearTimeout(u.current),x&&g(void 0),k(w))m.disabled?g(i.i18n.disabledError):(a("done"),e(m.value));else if(ne(w,o)||he(w,o)){if(b.clearLine(0),r||ne(w,o)&&h!==p.first||he(w,o)&&h!==p.last){let E=ne(w,o)?-1:1,R=h;do R=(R+E+l.length)%l.length;while(!Qe(l[R]));d(R)}}else if(Fe(w)&&!Number.isNaN(Number(b.line))){let E=Number(b.line)-1,R=-1,B=l.findIndex(te=>_.isSeparator(te)?!1:(R++,R===E)),Le=l[B];Le!=null&&Ye(Le)&&d(B),u.current=setTimeout(()=>{b.clearLine(0)},700)}else if(ie(w))b.clearLine(0);else if(f){let E=b.line.toLowerCase(),R=l.findIndex(B=>_.isSeparator(B)||!Ye(B)?!1:B.name.toLowerCase().startsWith(E));R!==-1&&d(R),u.current=setTimeout(()=>{b.clearLine(0)},700)}}),A(()=>()=>{clearTimeout(u.current)},[]);let y=i.style.message(t.message,s),v=i.style.keysHelpTip([["\u2191\u2193","navigate"],["\u23CE","select"]]),P=0,L=Oe({items:l,active:h,renderItem({item:w,isActive:b,index:E}){if(_.isSeparator(w))return P++,` ${w.separator}`;let R=b?i.icon.cursor:" ",B=i.indexMode==="number"?`${E+1-P}. `:"";if(w.disabled){let te=typeof w.disabled=="string"?w.disabled:"(disabled)",Zt=b?i.icon.cursor:"-";return i.style.disabled(`${Zt} ${B}${w.name} ${te}`)}return(b?i.style.highlight:te=>te)(`${R} ${B}${w.name}`)},pageSize:n,loop:r});if(s==="done")return[c,y,i.style.answer(m.short)].filter(Boolean).join(" ");let{description:I}=m;return`${[[c,y].filter(Boolean).join(" "),L," ",I?i.style.description(I):"",x?i.style.error(x):"",v].filter(Boolean).join(`
19
- `).trimEnd()}${$t}`});async function Yt(t){let e=new Map;for(let s of t.projects){let a=e.get(s.name);a?a.push(s.version):e.set(s.name,[s.version])}let r=Array.from(e.keys()).sort(),n=await Pe({message:"Choose project name:",choices:r.map(s=>({name:s,value:s})),pageSize:15}),i=(e.get(n)??[]).sort(),o=await Pe({message:"Choose project version:",choices:i.map(s=>({name:s,value:s})),pageSize:15});return{projectName:n,projectVersion:o}}var Qt=process.cwd();(async()=>{let{projectName:t,projectVersion:e,vulnId:r}=await Zr();await at({workingDir:Qt,projectName:t,projectVersion:e,vulnId:r})})();async function Zr(){let t=process.argv[2];if(!t)return en();let e=process.argv[3];if(!e)throw new Error("Missing project version.");let r=process.argv[4];return{projectName:t,projectVersion:e,vulnId:r}}async function en(){try{let t=await new z(Qt).loadProjectConfig(),{projectName:e,projectVersion:r}=await Yt(t),n=await ze({message:`Enter a CVE name from where the project should be removed (e.g. CVE-2023-52070)
20
- if empty the project is complete removed.:`,required:!1});return await Xe({message:`The project ${e}@${r} will be removed${n?`from ${n}`:" completely"}.
16
+ `+r:""),u=Math.floor(i.length/o)-this.cursorPos.rows+(r?$t(r):0);u>0&&(a+=Ke(u)),a+=Ge(this.cursorPos.cols),this.write(He(this.extraLinesUnderPrompt)+qe(this.height)+a),this.extraLinesUnderPrompt=u,this.height=$t(a)}checkCursorPos(){let e=this.rl.getCursorPos();e.cols!==this.cursorPos.cols&&(this.write(Ge(e.cols)),this.cursorPos=e)}done({clearContent:e}){this.rl.setPrompt("");let r=He(this.extraLinesUnderPrompt);r+=e?qe(this.height):`
17
+ `,r+="\x1B[G",r+=Vt,this.write(r),this.rl.close()}};var Ee=class extends Promise{static withResolver(){let e,r;return{promise:new Promise((i,s)=>{e=i,r=s}),resolve:e,reject:r}}};var Ht=$(require("node:path"),1),Gr=globalThis.setImmediate;function qr(){let t=Error.prepareStackTrace,e=[];try{Error.prepareStackTrace=(r,n)=>{let i=n.slice(1);return e=i,i},new Error().stack}catch{return e}return Error.prepareStackTrace=t,e}function J(t){let e=qr();return(n,i={})=>{let{input:s=process.stdin,signal:o}=i,a=new Set,c=new Kt.default;c.pipe(i.output??process.stdout);let u=Mt.createInterface({terminal:!0,input:s,output:c});c.mute();let f=new ce(u),{promise:l,resolve:p,reject:S}=Ee.withResolver(),h=()=>S(new ge);if(o){let m=()=>S(new he({cause:o.reason}));if(o.aborted)return m(),Object.assign(l,{cancel:h});o.addEventListener("abort",m),a.add(()=>o.removeEventListener("abort",m))}a.add(Ot((m,y)=>{S(new se(`User force closed the prompt with ${m} ${y}`))}));let d=()=>S(new se("User force closed the prompt with SIGINT"));return u.on("SIGINT",d),a.add(()=>u.removeListener("SIGINT",d)),lt(u,m=>{let y=Wt.AsyncResource.bind(()=>W.clearAll());u.on("close",y),a.add(()=>u.removeListener("close",y));let g=()=>{let x=()=>f.checkCursorPos();u.input.on("keypress",x),a.add(()=>u.input.removeListener("keypress",x));let v=null;m(()=>{let P=!1;try{let L=t(n,w=>{P?p(w):v={value:w}});if(L===void 0){let w=e[1]?.getFileName();throw w&&!w.startsWith("file://")&&(w=Ht.default.resolve(w)),new Error(`Prompt functions must return a string.
18
+ at ${w}`)}let[j,R]=typeof L=="string"?[L]:L;f.render(j,R),W.run()}catch(L){S(L)}if(P=!0,v!==null){let{value:L}=v;v=null,p(L)}})};return"readableFlowing"in s?Gr(g):g(),Object.assign(l.then(x=>(W.clearAll(),x),x=>{throw W.clearAll(),x}).finally(()=>{a.forEach(x=>x()),f.done({clearContent:!!i.clearPromptOnDone}),c.end()}).then(()=>l),{cancel:h})})}}var Gt=require("node:util");var _=class{separator=(0,Gt.styleText)("dim",Array.from({length:15}).join(Z.line));type="separator";constructor(e){e&&(this.separator=e)}static isSeparator(e){return!!(e&&typeof e=="object"&&"type"in e&&e.type==="separator")}};function qt(t,e){let r=e!==!1;return/^(y|yes)/i.test(t)?r=!0:/^(n|no)/i.test(t)&&(r=!1),r}function Jt(t){return t?"Yes":"No"}var Je=J((t,e)=>{let{transformer:r=Jt}=t,[n,i]=D("idle"),[s,o]=D(""),a=O(t.theme),c=K({status:n,theme:a});G((p,S)=>{if(n==="idle")if(k(p)){let h=qt(s,t.default);o(r(h)),i("done"),e(h)}else if(oe(p)){let h=Jt(!qt(s,t.default));S.clearLine(0),S.write(h),o(h)}else o(S.line)});let u=s,f="";n==="done"?u=a.style.answer(s):f=` ${a.style.defaultAnswer(t.default===!1?"y/N":"Y/n")}`;let l=a.style.message(t.message,n);return`${c} ${l}${f} ${u}`});var Jr={validationFailureMode:"keep"},Xe=J((t,e)=>{let{prefill:r="tab"}=t,n=O(Jr,t.theme),[i,s]=D("idle"),[o,a]=D(String(t.default??"")),[c,u]=D(),[f,l]=D(""),p=K({status:i,theme:n});async function S(g){let{required:x,pattern:v,patternError:P="Invalid input"}=t;return x&&!g?"You must provide a value":v&&!v.test(g)?P:typeof t.validate=="function"?await t.validate(g)||"You must provide a valid value":!0}G(async(g,x)=>{if(i==="idle")if(k(g)){let v=f||o;s("loading");let P=await S(v);P===!0?(l(v),s("done"),e(v)):(n.validationFailureMode==="clear"?l(""):x.write(f),u(P),s("idle"))}else ie(g)&&!f?a(""):oe(g)&&!f?(a(""),x.clearLine(0),x.write(o),l(o)):(l(x.line),u(void 0))}),U(g=>{r==="editable"&&o&&(g.write(o),l(o))},[]);let h=n.style.message(t.message,i),d=f;typeof t.transformer=="function"?d=t.transformer(f,{isFinal:i==="done"}):i==="done"&&(d=n.style.answer(f));let m;o&&i!=="done"&&!f&&(m=n.style.defaultAnswer(o));let y="";return c&&(y=n.style.error(c)),[[p,h,m,d].filter(g=>g!==void 0).join(" "),y]});var ee=require("node:util");var Xr={icon:{cursor:Z.pointer},style:{disabled:t=>(0,ee.styleText)("dim",t),description:t=>(0,ee.styleText)("cyan",t),keysHelpTip:t=>t.map(([e,r])=>`${(0,ee.styleText)("bold",e)} ${(0,ee.styleText)("dim",r)}`).join((0,ee.styleText)("dim"," \u2022 "))},i18n:{disabledError:"This option is disabled and cannot be selected."},indexMode:"hidden"};function ze(t){return!_.isSeparator(t)&&!t.disabled}function Ye(t){return!_.isSeparator(t)}function zr(t){return t.map(e=>{if(_.isSeparator(e))return e;if(typeof e!="object"||e===null||!("value"in e)){let i=String(e);return{value:e,name:i,short:i,disabled:!1}}let r=e.name??String(e.value),n={value:e.value,name:r,short:e.short??r,disabled:e.disabled??!1};return e.description&&(n.description=e.description),n})}var De=J((t,e)=>{let{loop:r=!0,pageSize:n=7}=t,i=O(Xr,t.theme),{keybindings:s}=i,[o,a]=D("idle"),c=K({status:o,theme:i}),u=H(),f=!s.includes("vim"),l=ae(()=>zr(t.choices),[t.choices]),p=ae(()=>{let w=l.findIndex(Ye),b=l.findLastIndex(Ye);if(w===-1)throw new Y("[select prompt] No selectable choices. All choices are disabled.");return{first:w,last:b}},[l]),S=ae(()=>"default"in t?l.findIndex(w=>ze(w)&&w.value===t.default):-1,[t.default,l]),[h,d]=D(S===-1?p.first:S),m=l[h];if(m==null||_.isSeparator(m))throw new Error("Active index does not point to a choice");let[y,g]=D();G((w,b)=>{if(clearTimeout(u.current),y&&g(void 0),k(w))m.disabled?g(i.i18n.disabledError):(a("done"),e(m.value));else if(ne(w,s)||me(w,s)){if(b.clearLine(0),r||ne(w,s)&&h!==p.first||me(w,s)&&h!==p.last){let E=ne(w,s)?-1:1,I=h;do I=(I+E+l.length)%l.length;while(!Ye(l[I]));d(I)}}else if(Ce(w)&&!Number.isNaN(Number(b.line))){let E=Number(b.line)-1,I=-1,B=l.findIndex(te=>_.isSeparator(te)?!1:(I++,I===E)),Pe=l[B];Pe!=null&&ze(Pe)&&d(B),u.current=setTimeout(()=>{b.clearLine(0)},700)}else if(ie(w))b.clearLine(0);else if(f){let E=b.line.toLowerCase(),I=l.findIndex(B=>_.isSeparator(B)||!ze(B)?!1:B.name.toLowerCase().startsWith(E));I!==-1&&d(I),u.current=setTimeout(()=>{b.clearLine(0)},700)}}),U(()=>()=>{clearTimeout(u.current)},[]);let x=i.style.message(t.message,o),v=i.style.keysHelpTip([["\u2191\u2193","navigate"],["\u23CE","select"]]),P=0,L=Oe({items:l,active:h,renderItem({item:w,isActive:b,index:E}){if(_.isSeparator(w))return P++,` ${w.separator}`;let I=b?i.icon.cursor:" ",B=i.indexMode==="number"?`${E+1-P}. `:"";if(w.disabled){let te=typeof w.disabled=="string"?w.disabled:"(disabled)",Yt=b?i.icon.cursor:"-";return i.style.disabled(`${Yt} ${B}${w.name} ${te}`)}return(b?i.style.highlight:te=>te)(`${I} ${B}${w.name}`)},pageSize:n,loop:r});if(o==="done")return[c,x,i.style.answer(m.short)].filter(Boolean).join(" ");let{description:j}=m;return`${[[c,x].filter(Boolean).join(" "),L," ",j?i.style.description(j):"",y?i.style.error(y):"",v].filter(Boolean).join(`
19
+ `).trimEnd()}${Nt}`});async function Xt(t){let e=new Map;for(let o of t.projects){let a=e.get(o.name);a?a.push(o.version):e.set(o.name,[o.version])}let r=Array.from(e.keys()).sort(),n=await De({message:"Choose project name:",choices:r.map(o=>({name:o,value:o})),pageSize:15}),i=(e.get(n)??[]).sort(),s=await De({message:"Choose project version:",choices:i.map(o=>({name:o,value:o})),pageSize:15});return{projectName:n,projectVersion:s}}var zt=process.cwd();(async()=>{let{projectName:t,projectVersion:e,vulnId:r}=await Yr();await ot({workingDir:zt,projectName:t,projectVersion:e,vulnId:r})})();async function Yr(){let t=process.argv[2];if(!t)return Qr();let e=process.argv[3];if(!e)throw new Error("Missing project version.");let r=process.argv[4];return{projectName:t,projectVersion:e,vulnId:r}}async function Qr(){try{let t=await new z(zt).loadProjectConfig(),{projectName:e,projectVersion:r}=await Xt(t),n=await Xe({message:`Enter a CVE name from where the project should be removed (e.g. CVE-2023-52070)
20
+ if empty the project is complete removed.:`,required:!1});return await Je({message:`The project ${e}@${r} will be removed${n?`from ${n}`:" completely"}.
21
21
  Do you want to proceed?`})||(console.log("Aborted."),process.exit(0)),{projectName:e,projectVersion:r,vulnId:n}}catch(t){console.error(`Error: ${t}`),process.exitCode=1;return}}