@intutic/cli 1.10.0 → 2.0.0

package/dist/lib/caTrust.js

@@ -0,0 +1,169 @@
+/**
+ * OS trust-store injection for the Intutic proxy CA certificate.
+ *
+ * Two trust scopes:
+ * - `'user'` — per-user, non-elevated. Already shipping today via
+ *   `commands/connect.ts` (macOS login keychain, Windows `certutil`), run
+ *   silently on every `intutic connect`.
+ * - `'system'` — machine-wide, requires root/admin. New here — this is the
+ *   half `enterprise install` (`commands/enterprise.ts`) needs and the
+ *   deleted `enterprise-install.ts` (commit `8481b5d9`) used to provide.
+ *
+ * `caTrustCommandFor` is exported specifically so `doctor.ts`'s remediation
+ * strings can be generated from the same source as what actually runs here,
+ * rather than hand-duplicated — which is exactly how they already drifted
+ * once (the check there looks in three Linux cert-anchor directories; the
+ * remediation only ever names one).
+ *
+ * @module
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { copyFile, readFile } from 'node:fs/promises';
+const execFileAsync = promisify(execFile);
+const LINUX_DEBIAN_DEST = '/usr/local/share/ca-certificates/intutic-ca.crt';
+const LINUX_RHEL_DEST = '/etc/pki/ca-trust/source/anchors/intutic-ca.crt';
+/**
+ * The command(s) that trust `caCertPath` at the given scope, for the given
+ * platform. Pure — no I/O — so it doubles as the source of truth for
+ * `doctor.ts`'s remediation text.
+ *
+ * Linux `'user'` scope returns `null`: there is no single per-user NSS/OS
+ * trust-store equivalent worth building (each browser/runtime keeps its
+ * own), unlike macOS (login keychain) and Windows (`certutil`, which is
+ * elevation-agnostic — the same command works either way).
+ *
+ * Linux returns TWO commands (copy, then update) rather than one, since
+ * `execFile` can't run a shell pipeline — callers must run both in order.
+ */
+export function caTrustCommandFor(platform, scope, caCertPath) {
+    if (platform === 'darwin') {
+        const keychain = scope === 'system' ? '/Library/Keychains/System.keychain' : '~/Library/Keychains/login.keychain-db';
+        return [{
+                step: `Trust the CA cert in the macOS ${scope === 'system' ? 'System' : 'login'} keychain`,
+                cmd: 'security',
+                args: ['add-trusted-cert', '-d', '-r', 'trustRoot', '-k', keychain, caCertPath],
+            }];
+    }
+    if (platform === 'win32') {
+        return [{
+                step: 'Trust the CA cert in the Windows Root certificate store',
+                cmd: 'certutil',
+                args: ['-addstore', 'Root', caCertPath],
+            }];
+    }
+    if (platform === 'linux') {
+        if (scope === 'user')
+            return null;
+        // Debian/Ubuntu style is tried first by installCaTrust (most common);
+        // this function returns both possibilities so a caller (or doctor.ts)
+        // can describe either without probing which tool is actually present.
+        return [
+            { step: 'Copy the CA cert into the system trust anchor directory (Debian/Ubuntu)', cmd: 'cp', args: [caCertPath, LINUX_DEBIAN_DEST] },
+            { step: 'Rebuild the system CA bundle', cmd: 'update-ca-certificates', args: [] },
+        ];
+    }
+    return null;
+}
+async function commandExists(cmd) {
+    try {
+        await execFileAsync('which', [cmd]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function installLinuxSystemCaTrust(caCertPath) {
+    // Debian/Ubuntu is tried first (more common in practice); RHEL/Fedora's
+    // update-ca-trust is the fallback. Neither present -> fail loudly rather
+    // than silently doing nothing, matching this function's contract that a
+    // false `installed` always carries the real reason in `detail`.
+    if (await commandExists('update-ca-certificates')) {
+        await copyFile(caCertPath, LINUX_DEBIAN_DEST);
+        await execFileAsync('update-ca-certificates', []);
+        return { installed: true, scope: 'system', mechanism: 'update-ca-certificates', detail: `Installed to ${LINUX_DEBIAN_DEST}` };
+    }
+    if (await commandExists('update-ca-trust')) {
+        await copyFile(caCertPath, LINUX_RHEL_DEST);
+        await execFileAsync('update-ca-trust', ['extract']);
+        return { installed: true, scope: 'system', mechanism: 'update-ca-trust', detail: `Installed to ${LINUX_RHEL_DEST}` };
+    }
+    return {
+        installed: false,
+        scope: 'system',
+        mechanism: 'none',
+        detail: 'Neither update-ca-certificates (Debian/Ubuntu) nor update-ca-trust (RHEL/Fedora) is available on this system.',
+    };
+}
+/**
+ * Installs `caCertPath` into the OS trust store at `scope`.
+ *
+ * Uses `execFile` with array arguments throughout — never `execSync` with
+ * string interpolation, which `connect.ts`'s existing per-user calls use and
+ * which is unsafe if a path ever contained a shell metacharacter. Does not
+ * throw on a failed underlying command; surfaces it as `installed: false`
+ * with the OS error text in `detail`, so a caller (e.g. `enterprise install`)
+ * can report it and continue rather than crashing the whole run over one
+ * platform-specific step.
+ */
+export async function installCaTrust(caCertPath, scope) {
+    const platform = process.platform;
+    if (platform === 'linux' && scope === 'system') {
+        try {
+            return await installLinuxSystemCaTrust(caCertPath);
+        }
+        catch (err) {
+            return { installed: false, scope, mechanism: 'linux', detail: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    const commands = caTrustCommandFor(platform, scope, caCertPath);
+    if (!commands) {
+        return {
+            installed: false,
+            scope,
+            mechanism: 'none',
+            detail: `No ${scope}-scope CA trust mechanism is implemented for ${platform}.`,
+        };
+    }
+    try {
+        for (const c of commands) {
+            await execFileAsync(c.cmd, c.args);
+        }
+        const mechanism = platform === 'darwin' ? 'security' : platform === 'win32' ? 'certutil' : commands[commands.length - 1].cmd;
+        return { installed: true, scope, mechanism, detail: `Trusted via ${mechanism}` };
+    }
+    catch (err) {
+        return { installed: false, scope, mechanism: platform, detail: err instanceof Error ? err.message : String(err) };
+    }
+}
+/**
+ * Best-effort check for whether `caCertPath` is already trusted — read-only,
+ * never installs anything. Used to skip a redundant (and log-noisy)
+ * re-install. Only implemented where a cheap, real check exists (macOS
+ * `security verify-cert`); returns `false` elsewhere rather than guessing,
+ * so a caller falls through to attempting installation, which is itself
+ * idempotent.
+ */
+export async function verifyCaTrust(caCertPath) {
+    if (process.platform === 'darwin') {
+        try {
+            await execFileAsync('security', ['verify-cert', '-c', caCertPath]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (process.platform === 'linux') {
+        try {
+            const installed = await readFile(LINUX_DEBIAN_DEST, 'utf-8').catch(() => readFile(LINUX_RHEL_DEST, 'utf-8'));
+            return installed.length > 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=caTrust.js.map

package/dist/lib/caTrust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caTrust.js","sourceRoot":"","sources":["../../src/lib/caTrust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAErD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAmBzC,MAAM,iBAAiB,GAAG,iDAAiD,CAAA;AAC3E,MAAM,eAAe,GAAG,iDAAiD,CAAA;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,KAAiB,EACjB,UAAkB;IAElB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,uCAAuC,CAAA;QACpH,OAAO,CAAC;gBACN,IAAI,EAAE,kCAAkC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,WAAW;gBAC1F,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;aAChF,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC;gBACN,IAAI,EAAE,yDAAyD;gBAC/D,GAAG,EAAE,UAAU;gBACf,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;aACxC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QACjC,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,OAAO;YACL,EAAE,IAAI,EAAE,yEAAyE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE;YACrI,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,EAAE;SAClF,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,UAAkB;IACzD,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,MAAM,aAAa,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAA;QAC7C,MAAM,aAAa,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAA;QACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,iBAAiB,EAAE,EAAE,CAAA;IAC/H,CAAC;IACD,IAAI,MAAM,aAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;QAC3C,MAAM,aAAa,CAAC,iBAAiB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACnD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,eAAe,EAAE,EAAE,CAAA;IACtH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+GAA+G;KACxH,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,KAAiB;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEjC,IAAI,QAAQ,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,yBAAyB,CAAC,UAAU,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QAClH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,KAAK;YACL,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,MAAM,KAAK,gDAAgD,QAAQ,GAAG;SAC/E,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5H,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,SAAS,EAAE,EAAE,CAAA;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACnH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAClE,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAA;YAC5G,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/lib/ciscoScanner.d.ts

@@ -0,0 +1,178 @@
+/**
+ * Cisco `skill-scanner` integration — OPTIONAL, opt-in shell-out to
+ * `cisco-ai-defense/skill-scanner`, a Cisco AI Defense open-source CLI that
+ * does static YARA/pattern detection, Python bytecode integrity checks,
+ * command-pipeline taint analysis, and (with `--use-behavioral`) full
+ * AST/dataflow analysis of skill content — genuinely deeper than this
+ * codebase's own regex-genre scanning (`packages/shared-types/src/scriptScan.ts`,
+ * Phase S2). TD-356 (`docs/TECH_DEBT.md`) named this integration as the
+ * follow-up to that phase's deliberately-scoped pattern matching.
+ *
+ * # Why a shell-out, not a dependency
+ *
+ * `apps/docs/guide/skill-scanning.md` previously declined adopting a Python
+ * runtime dependency for this codebase — that decision stands. This module
+ * does not embed, vendor, or depend on `skill-scanner`; it shells out to it
+ * via `execFile` when the operator has separately installed it (`pipx
+ * install cisco-ai-skill-scanner`), and degrades gracefully — never throws,
+ * never silently passes — when it is absent. OUR runtime stays Python-free;
+ * the binary is entirely the operator's own installation.
+ *
+ * # CLI invocation shape — VERIFIED against the real published tool
+ *
+ * This integration was written against the actual Cisco tool: PyPI package
+ * `cisco-ai-skill-scanner` (installs a binary named `skill-scanner` on
+ * PATH — same binary name as a DIFFERENT, unrelated PyPI package also
+ * called `skill-scanner`; see the correction note below), installed via
+ * `pipx install cisco-ai-skill-scanner` and inspected with `--help` and by
+ * reading its installed source, not guessed from a "typical SARIF scanner"
+ * shape:
+ *
+ *   skill-scanner scan <dir> --use-behavioral --format sarif --output-sarif <file>
+ *
+ * Load-bearing details confirmed from the installed 2.0.13 source
+ * (`skill_scanner/core/models.py`, `skill_scanner/cli/cli.py`) and by
+ * actually running the binary against test fixtures:
+ * - `skill_directory` is a POSITIONAL argument, not a `--path` flag, and
+ *   takes exactly one directory — {@link runCiscoScan} therefore invokes
+ *   the binary ONCE PER skill directory, exactly the shape this phase's
+ *   caller (`commands/skill.ts`) already iterates in.
+ * - `static_analyzer`, `bytecode_analyzer`, and `pipeline_analyzer` run BY
+ *   DEFAULT, no flag or API key required. `--use-behavioral` additionally
+ *   enables `behavioral_analyzer` (AST + taint tracking) — still fully
+ *   offline, no key — which is the analyzer this integration wants for the
+ *   "genuinely deeper than regex" claim, so it is always passed.
+ *   `--use-llm`, `--use-virustotal`, and `--use-aidefense` each require a
+ *   separately-configured API key and are NEVER passed by this module —
+ *   this integration only exercises skill-scanner's offline analyzers.
+ * - Each SARIF `result` carries `properties.category` (one of an 18-value
+ *   enum — `prompt_injection`, `command_injection`, `data_exfiltration`,
+ *   `unauthorized_tool_use`, `obfuscation`, `hardcoded_secrets`,
+ *   `social_engineering`, `resource_abuse`, `policy_violation`, `malware`,
+ *   `harmful_content`, `skill_discovery_abuse`, `transitive_trust_abuse`,
+ *   `autonomy_abuse`, `tool_chaining_abuse`, `unicode_steganography`,
+ *   `supply_chain_attack` — `skill_scanner/core/models.py`'s
+ *   `ThreatCategory` enum) and `properties.severity` DIRECTLY, not encoded
+ *   into `ruleId` — `ruleId` is a plain identifier like
+ *   `PIPELINE_TAINT_FLOW`, not `skill-scanner/<category>`. `mapCiscoCategory`
+ *   in `commands/skill.ts` maps from this real taxonomy, not a guess.
+ * - `artifactLocation.uri` is RELATIVE to the scanned directory (e.g.
+ *   `"SKILL.md"`, with `uriBaseId: "%SRCROOT%"` signalling exactly that) —
+ *   NOT absolute, confirmed by actually running the binary. {@link
+ *   scanOneDir} joins it against `dir` before returning it, honoring this
+ *   module's own `CiscoScanFinding.filePath` contract ("ABSOLUTE").
+ * - A `--fail-on-severity`/`--fail-on-findings` threshold crossing still
+ *   exits non-zero WHILE writing a valid SARIF file — confirmed
+ *   empirically — so {@link scanOneDir} always attempts to read the output
+ *   file first and only reports `ok: false` when that file is absent or
+ *   unparseable.
+ *
+ * # Correction: an earlier version of this integration shelled out to the
+ * # WRONG package
+ *
+ * `skill-scanner` is claimed on PyPI's generic namespace by an unrelated,
+ * unaffiliated project (`thedevappsecguy/skill-scanner`, MIT-licensed, no
+ * Cisco affiliation) that requires an LLM or VirusTotal API key to do
+ * anything at all — it has no offline analysis path. `pipx install
+ * skill-scanner` installs THAT package, not Cisco's. The real Cisco tool
+ * publishes under `cisco-ai-skill-scanner` on PyPI
+ * (github.com/cisco-ai-defense/skill-scanner, Apache 2.0, Cisco Systems
+ * Inc.) — install it with `pipx install cisco-ai-skill-scanner`. Once
+ * installed, its binary is ALSO named `skill-scanner` on PATH, so no other
+ * part of this integration (binary-name detection, doctor check) needed to
+ * change — only the install instructions and this module's invocation
+ * shape/category taxonomy, which were verified against the wrong package.
+ *
+ * @module
+ */
+/** The binary name this integration shells out to. Matches the doctor-check
+ *  remediation (`pipx install cisco-ai-skill-scanner`) — the PyPI package
+ *  name differs from the binary name it installs; see this module's doc
+ *  comment. */
+export declare const CISCO_SCANNER_BINARY = "skill-scanner";
+/**
+ * Bounded timeout per scanned directory. Generous relative to every other
+ * shell-out in this codebase (`elevation.ts`'s `net session` probe: 3s;
+ * `process.ts`'s `ps`/`tasklist`: 5s) because `--use-behavioral` runs a
+ * full AST/dataflow pass, not a fast pattern match — 60s is a floor meant
+ * to catch a genuinely hung process, not a tight budget for a fast local
+ * check.
+ */
+export declare const CISCO_SCAN_TIMEOUT_MS = 60000;
+/** Resolves `true` iff the `skill-scanner` binary is present on PATH. */
+export declare function ciscoScannerOnPath(): Promise<boolean>;
+/**
+ * `skill-scanner --version`'s stdout, trimmed, or `null` if the binary is
+ * absent or the invocation itself fails. Used only by the doctor check —
+ * never assumed non-null by any caller that gates on {@link ciscoScannerOnPath}.
+ */
+export declare function ciscoScannerVersion(): Promise<string | null>;
+/** One parsed SARIF result from a `skill-scanner` run, flattened out of
+ *  `runs[].results` for the internal finding-merge path. Bounded fields
+ *  only — never the tool's full result object — matching this codebase's
+ *  own findings' "never carry more than a caller needs" discipline. */
+export interface CiscoScanFinding {
+    /** The tool's own `ruleId`, e.g. `PIPELINE_TAINT_FLOW`. Not itself a
+     *  category — see {@link category}. */
+    ruleId: string;
+    level: string;
+    message: string;
+    /** The tool's own `properties.category` on this result, e.g.
+     *  `command_injection` — one of the `ThreatCategory` enum values
+     *  documented in this module's doc comment. Absent only for a
+     *  malformed/unexpected result shape. */
+    category?: string;
+    /** SARIF `artifactLocation.uri` — the tool's own path, ABSOLUTE (whatever
+     *  form `runCiscoScan`'s caller passed as the scanned directory), not yet
+     *  relativized to a workspace root. */
+    filePath?: string;
+    line?: number;
+}
+/** Result of scanning ONE directory with `skill-scanner`. */
+export interface CiscoDirScanResult {
+    /** The directory that was scanned — echoes the caller's input. */
+    dir: string;
+    /** `false` means this directory produced no usable result — binary
+     *  absent, timed out, or exited without a parseable SARIF file. Refusal-
+     *  not-pass: never treat `!ok` as "clean". */
+    ok: boolean;
+    /** Populated only when `!ok`. Human-readable — safe to log or surface to
+     *  the user directly. */
+    error?: string;
+    /** The RAW SARIF `runs[]` entries this invocation produced, exactly as
+     *  the tool emitted them — for verbatim passthrough into `--sarif` output.
+     *  Usually zero or one entry per directory; never edited or re-shaped. */
+    sarifRuns: unknown[];
+    /** Findings flattened out of `sarifRuns[].results`, for the internal
+     *  `SkillScanFinding` merge path (`commands/skill.ts`). */
+    findings: CiscoScanFinding[];
+}
+/**
+ * Scan each of `skillDirs` with `skill-scanner`, one invocation per
+ * directory (see this module's doc comment for why the tool takes exactly
+ * one directory per invocation). Directories are ABSOLUTE paths — callers
+ * resolve against the workspace root before calling, the same convention
+ * `oci.ts`/`firecracker.ts` use for the paths they hand external tools.
+ *
+ * Never throws: every failure mode (binary absent, timeout, unparseable
+ * output) is reported per-directory via `CiscoDirScanResult.ok`/`.error`,
+ * so one skill's scan failing does not abort the rest.
+ */
+export declare function runCiscoScan(skillDirs: readonly string[]): Promise<CiscoDirScanResult[]>;
+/**
+ * Combine the raw SARIF `runs[0]`-shaped objects from multiple
+ * `skill-scanner` invocations (one per scanned skill directory) into a
+ * SINGLE run, so `skill audit --sarif` appends Cisco's output as one
+ * additional entry in `runs[]`, not one per skill scanned — the multiple
+ * invocations are an artifact of this integration's own per-directory
+ * invocation strategy, not something the SARIF consumer should see.
+ *
+ * Only the CONTAINER is merged: rule catalogs are de-duplicated by `id`,
+ * results are concatenated. Every individual rule/result object is passed
+ * through unmodified — never rewritten — preserving the "append verbatim"
+ * contract this integration promises for `--sarif` output.
+ *
+ * Returns `null` when given no runs (nothing to append).
+ */
+export declare function combineCiscoSarifRuns(runs: readonly unknown[]): unknown | null;
+//# sourceMappingURL=ciscoScanner.d.ts.map

package/dist/lib/ciscoScanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciscoScanner.d.ts","sourceRoot":"","sources":["../../src/lib/ciscoScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAYH;;;eAGe;AACf,eAAO,MAAM,oBAAoB,kBAAkB,CAAA;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAA;AAE3C,yEAAyE;AACzE,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAErD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQlE;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B;2CACuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf;;;6CAGyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;2CAEuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAA;IACX;;kDAE8C;IAC9C,EAAE,EAAE,OAAO,CAAA;IACX;6BACyB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;8EAE0E;IAC1E,SAAS,EAAE,OAAO,EAAE,CAAA;IACpB;+DAC2D;IAC3D,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAkID;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAM9F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAyB9E"}

package/dist/lib/ciscoScanner.js

@@ -0,0 +1,292 @@
+/**
+ * Cisco `skill-scanner` integration — OPTIONAL, opt-in shell-out to
+ * `cisco-ai-defense/skill-scanner`, a Cisco AI Defense open-source CLI that
+ * does static YARA/pattern detection, Python bytecode integrity checks,
+ * command-pipeline taint analysis, and (with `--use-behavioral`) full
+ * AST/dataflow analysis of skill content — genuinely deeper than this
+ * codebase's own regex-genre scanning (`packages/shared-types/src/scriptScan.ts`,
+ * Phase S2). TD-356 (`docs/TECH_DEBT.md`) named this integration as the
+ * follow-up to that phase's deliberately-scoped pattern matching.
+ *
+ * # Why a shell-out, not a dependency
+ *
+ * `apps/docs/guide/skill-scanning.md` previously declined adopting a Python
+ * runtime dependency for this codebase — that decision stands. This module
+ * does not embed, vendor, or depend on `skill-scanner`; it shells out to it
+ * via `execFile` when the operator has separately installed it (`pipx
+ * install cisco-ai-skill-scanner`), and degrades gracefully — never throws,
+ * never silently passes — when it is absent. OUR runtime stays Python-free;
+ * the binary is entirely the operator's own installation.
+ *
+ * # CLI invocation shape — VERIFIED against the real published tool
+ *
+ * This integration was written against the actual Cisco tool: PyPI package
+ * `cisco-ai-skill-scanner` (installs a binary named `skill-scanner` on
+ * PATH — same binary name as a DIFFERENT, unrelated PyPI package also
+ * called `skill-scanner`; see the correction note below), installed via
+ * `pipx install cisco-ai-skill-scanner` and inspected with `--help` and by
+ * reading its installed source, not guessed from a "typical SARIF scanner"
+ * shape:
+ *
+ *   skill-scanner scan <dir> --use-behavioral --format sarif --output-sarif <file>
+ *
+ * Load-bearing details confirmed from the installed 2.0.13 source
+ * (`skill_scanner/core/models.py`, `skill_scanner/cli/cli.py`) and by
+ * actually running the binary against test fixtures:
+ * - `skill_directory` is a POSITIONAL argument, not a `--path` flag, and
+ *   takes exactly one directory — {@link runCiscoScan} therefore invokes
+ *   the binary ONCE PER skill directory, exactly the shape this phase's
+ *   caller (`commands/skill.ts`) already iterates in.
+ * - `static_analyzer`, `bytecode_analyzer`, and `pipeline_analyzer` run BY
+ *   DEFAULT, no flag or API key required. `--use-behavioral` additionally
+ *   enables `behavioral_analyzer` (AST + taint tracking) — still fully
+ *   offline, no key — which is the analyzer this integration wants for the
+ *   "genuinely deeper than regex" claim, so it is always passed.
+ *   `--use-llm`, `--use-virustotal`, and `--use-aidefense` each require a
+ *   separately-configured API key and are NEVER passed by this module —
+ *   this integration only exercises skill-scanner's offline analyzers.
+ * - Each SARIF `result` carries `properties.category` (one of an 18-value
+ *   enum — `prompt_injection`, `command_injection`, `data_exfiltration`,
+ *   `unauthorized_tool_use`, `obfuscation`, `hardcoded_secrets`,
+ *   `social_engineering`, `resource_abuse`, `policy_violation`, `malware`,
+ *   `harmful_content`, `skill_discovery_abuse`, `transitive_trust_abuse`,
+ *   `autonomy_abuse`, `tool_chaining_abuse`, `unicode_steganography`,
+ *   `supply_chain_attack` — `skill_scanner/core/models.py`'s
+ *   `ThreatCategory` enum) and `properties.severity` DIRECTLY, not encoded
+ *   into `ruleId` — `ruleId` is a plain identifier like
+ *   `PIPELINE_TAINT_FLOW`, not `skill-scanner/<category>`. `mapCiscoCategory`
+ *   in `commands/skill.ts` maps from this real taxonomy, not a guess.
+ * - `artifactLocation.uri` is RELATIVE to the scanned directory (e.g.
+ *   `"SKILL.md"`, with `uriBaseId: "%SRCROOT%"` signalling exactly that) —
+ *   NOT absolute, confirmed by actually running the binary. {@link
+ *   scanOneDir} joins it against `dir` before returning it, honoring this
+ *   module's own `CiscoScanFinding.filePath` contract ("ABSOLUTE").
+ * - A `--fail-on-severity`/`--fail-on-findings` threshold crossing still
+ *   exits non-zero WHILE writing a valid SARIF file — confirmed
+ *   empirically — so {@link scanOneDir} always attempts to read the output
+ *   file first and only reports `ok: false` when that file is absent or
+ *   unparseable.
+ *
+ * # Correction: an earlier version of this integration shelled out to the
+ * # WRONG package
+ *
+ * `skill-scanner` is claimed on PyPI's generic namespace by an unrelated,
+ * unaffiliated project (`thedevappsecguy/skill-scanner`, MIT-licensed, no
+ * Cisco affiliation) that requires an LLM or VirusTotal API key to do
+ * anything at all — it has no offline analysis path. `pipx install
+ * skill-scanner` installs THAT package, not Cisco's. The real Cisco tool
+ * publishes under `cisco-ai-skill-scanner` on PyPI
+ * (github.com/cisco-ai-defense/skill-scanner, Apache 2.0, Cisco Systems
+ * Inc.) — install it with `pipx install cisco-ai-skill-scanner`. Once
+ * installed, its binary is ALSO named `skill-scanner` on PATH, so no other
+ * part of this integration (binary-name detection, doctor check) needed to
+ * change — only the install instructions and this module's invocation
+ * shape/category taxonomy, which were verified against the wrong package.
+ *
+ * @module
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import * as fs from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { binaryOnPath } from './binaryOnPath.js';
+const execFileAsync = promisify(execFile);
+/** The binary name this integration shells out to. Matches the doctor-check
+ *  remediation (`pipx install cisco-ai-skill-scanner`) — the PyPI package
+ *  name differs from the binary name it installs; see this module's doc
+ *  comment. */
+export const CISCO_SCANNER_BINARY = 'skill-scanner';
+/**
+ * Bounded timeout per scanned directory. Generous relative to every other
+ * shell-out in this codebase (`elevation.ts`'s `net session` probe: 3s;
+ * `process.ts`'s `ps`/`tasklist`: 5s) because `--use-behavioral` runs a
+ * full AST/dataflow pass, not a fast pattern match — 60s is a floor meant
+ * to catch a genuinely hung process, not a tight budget for a fast local
+ * check.
+ */
+export const CISCO_SCAN_TIMEOUT_MS = 60_000;
+/** Resolves `true` iff the `skill-scanner` binary is present on PATH. */
+export function ciscoScannerOnPath() {
+    return binaryOnPath(CISCO_SCANNER_BINARY);
+}
+/**
+ * `skill-scanner --version`'s stdout, trimmed, or `null` if the binary is
+ * absent or the invocation itself fails. Used only by the doctor check —
+ * never assumed non-null by any caller that gates on {@link ciscoScannerOnPath}.
+ */
+export async function ciscoScannerVersion() {
+    try {
+        const { stdout } = await execFileAsync(CISCO_SCANNER_BINARY, ['--version'], { timeout: 5_000 });
+        const trimmed = stdout.trim();
+        return trimmed.length > 0 ? trimmed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function friendlyMissingBinaryError() {
+    return (`'${CISCO_SCANNER_BINARY}' not found on PATH. Install it with ` +
+        '`pipx install cisco-ai-skill-scanner`, or drop `--engine cisco` / ' +
+        "disable the 'ciscoSkillScannerEnabled' workspace setting to use native " +
+        'scanning only.');
+}
+/**
+ * Scan ONE directory with `skill-scanner`, writing SARIF to a scratch file
+ * (`--output-sarif`) rather than parsing stdout — stdout carries a
+ * human-readable summary this integration never needs to parse, and the
+ * SARIF exporter writes plain JSON to the file regardless of `--format`
+ * also being requested for stdout.
+ *
+ * A non-zero exit is NOT immediately treated as failure: `--fail-on-*`
+ * deliberately exits non-zero when a finding crosses a severity threshold
+ * while still writing a valid SARIF file (verified empirically), so this
+ * function always attempts to read the output file first and only reports
+ * `ok: false` when that file is absent or unparseable.
+ */
+async function scanOneDir(dir) {
+    const outFile = join(tmpdir(), `intutic-cisco-scan-${randomBytes(8).toString('hex')}.sarif.json`);
+    let execError;
+    try {
+        await execFileAsync(CISCO_SCANNER_BINARY, ['scan', dir, '--use-behavioral', '--format', 'sarif', '--output-sarif', outFile], { timeout: CISCO_SCAN_TIMEOUT_MS });
+    }
+    catch (err) {
+        const nodeErr = err;
+        if (nodeErr.code === 'ENOENT') {
+            return { dir, ok: false, sarifRuns: [], findings: [], error: friendlyMissingBinaryError() };
+        }
+        if (nodeErr.killed || nodeErr.signal) {
+            return {
+                dir,
+                ok: false,
+                sarifRuns: [],
+                findings: [],
+                error: `cisco skill-scanner timed out after ${CISCO_SCAN_TIMEOUT_MS}ms scanning ${dir}`,
+            };
+        }
+        // Any other non-zero exit — fall through and try the output file before
+        // giving up (see doc comment: --fail-on-* exits non-zero on real findings).
+        execError = nodeErr;
+    }
+    let raw;
+    try {
+        raw = await fs.readFile(outFile, 'utf8');
+    }
+    catch {
+        const stderrHint = execError?.stderr?.trim();
+        return {
+            dir,
+            ok: false,
+            sarifRuns: [],
+            findings: [],
+            error: `cisco skill-scanner produced no output scanning ${dir}` +
+                (stderrHint ? `: ${stderrHint}` : ' — the scan did not complete.'),
+        };
+    }
+    finally {
+        await fs.rm(outFile, { force: true });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            dir,
+            ok: false,
+            sarifRuns: [],
+            findings: [],
+            error: `cisco skill-scanner output for ${dir} was not valid JSON`,
+        };
+    }
+    const runs = Array.isArray(parsed.runs) ? parsed.runs : [];
+    const findings = [];
+    for (const run of runs) {
+        const results = run?.results;
+        if (!Array.isArray(results))
+            continue;
+        for (const result of results) {
+            const r = result;
+            const location = r.locations?.[0]?.physicalLocation;
+            const uri = typeof location?.artifactLocation?.uri === 'string' ? location.artifactLocation.uri : undefined;
+            // The tool's own URIs are RELATIVE to the scanned directory (verified
+            // empirically: `artifactLocation.uri` is `"SKILL.md"`, not an
+            // absolute path, with `uriBaseId: "%SRCROOT%"` signalling exactly
+            // that) — join against `dir` so this module's own contract
+            // ("filePath is ABSOLUTE") holds regardless of what the tool emits.
+            // Already-absolute URIs (a future tool version, or a result with no
+            // location at all) pass through unchanged.
+            const filePath = uri === undefined ? undefined : isAbsolute(uri) ? uri : join(dir, uri);
+            findings.push({
+                ruleId: typeof r.ruleId === 'string' ? r.ruleId : 'unknown',
+                level: typeof r.level === 'string' ? r.level : 'warning',
+                message: typeof r.message?.text === 'string' ? r.message.text : '',
+                category: typeof r.properties?.category === 'string' ? r.properties.category : undefined,
+                filePath,
+                line: typeof location?.region?.startLine === 'number' ? location.region.startLine : undefined,
+            });
+        }
+    }
+    return { dir, ok: true, sarifRuns: runs, findings };
+}
+/**
+ * Scan each of `skillDirs` with `skill-scanner`, one invocation per
+ * directory (see this module's doc comment for why the tool takes exactly
+ * one directory per invocation). Directories are ABSOLUTE paths — callers
+ * resolve against the workspace root before calling, the same convention
+ * `oci.ts`/`firecracker.ts` use for the paths they hand external tools.
+ *
+ * Never throws: every failure mode (binary absent, timeout, unparseable
+ * output) is reported per-directory via `CiscoDirScanResult.ok`/`.error`,
+ * so one skill's scan failing does not abort the rest.
+ */
+export async function runCiscoScan(skillDirs) {
+    const results = [];
+    for (const dir of skillDirs) {
+        results.push(await scanOneDir(dir));
+    }
+    return results;
+}
+/**
+ * Combine the raw SARIF `runs[0]`-shaped objects from multiple
+ * `skill-scanner` invocations (one per scanned skill directory) into a
+ * SINGLE run, so `skill audit --sarif` appends Cisco's output as one
+ * additional entry in `runs[]`, not one per skill scanned — the multiple
+ * invocations are an artifact of this integration's own per-directory
+ * invocation strategy, not something the SARIF consumer should see.
+ *
+ * Only the CONTAINER is merged: rule catalogs are de-duplicated by `id`,
+ * results are concatenated. Every individual rule/result object is passed
+ * through unmodified — never rewritten — preserving the "append verbatim"
+ * contract this integration promises for `--sarif` output.
+ *
+ * Returns `null` when given no runs (nothing to append).
+ */
+export function combineCiscoSarifRuns(runs) {
+    if (runs.length === 0)
+        return null;
+    const base = runs[0];
+    const rulesById = new Map();
+    const results = [];
+    for (const run of runs) {
+        const r = run;
+        for (const rule of r.tool?.driver?.rules ?? []) {
+            const id = rule?.id;
+            if (typeof id === 'string')
+                rulesById.set(id, rule);
+        }
+        if (Array.isArray(r.results))
+            results.push(...r.results);
+    }
+    return {
+        tool: {
+            driver: {
+                name: typeof base.tool?.driver?.name === 'string' ? base.tool.driver.name : CISCO_SCANNER_BINARY,
+                rules: [...rulesById.values()],
+            },
+        },
+        results,
+    };
+}
+//# sourceMappingURL=ciscoScanner.js.map

package/dist/lib/ciscoScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciscoScanner.js","sourceRoot":"","sources":["../../src/lib/ciscoScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC;;;eAGe;AACf,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAE3C,yEAAyE;AACzE,MAAM,UAAU,kBAAkB;IAChC,OAAO,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AA4CD,SAAS,0BAA0B;IACjC,OAAO,CACL,IAAI,oBAAoB,uCAAuC;QAC/D,oEAAoE;QACpE,yEAAyE;QACzE,gBAAgB,CACjB,CAAA;AACH,CAAC;AAWD;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,UAAU,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IACjG,IAAI,SAAoC,CAAA;IAExC,IAAI,CAAC;QACH,MAAM,aAAa,CACjB,oBAAoB,EACpB,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,EACjF,EAAE,OAAO,EAAE,qBAAqB,EAAE,CACnC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAoB,CAAA;QACpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAA;QAC7F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO;gBACL,GAAG;gBACH,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,uCAAuC,qBAAqB,eAAe,GAAG,EAAE;aACxF,CAAA;QACH,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,SAAS,GAAG,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QAC5C,OAAO;YACL,GAAG;YACH,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,KAAK,EACH,mDAAmD,GAAG,EAAE;gBACxD,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC;SACrE,CAAA;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,GAAG;YACH,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,kCAAkC,GAAG,qBAAqB;SAClE,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAE,MAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3G,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAI,GAA+B,EAAE,OAAO,CAAA;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAQ;QACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAMT,CAAA;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAA;YACnD,MAAM,GAAG,GAAG,OAAO,QAAQ,EAAE,gBAAgB,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3G,sEAAsE;YACtE,8DAA8D;YAC9D,kEAAkE;YAClE,2DAA2D;YAC3D,oEAAoE;YACpE,oEAAoE;YACpE,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACvF,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC3D,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACxD,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAClE,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACxF,QAAQ;gBACR,IAAI,EAAE,OAAO,QAAQ,EAAE,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC9F,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAA4B;IAC7D,MAAM,OAAO,GAAyB,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAyE,CAAA;IAC5F,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC5C,MAAM,OAAO,GAAc,EAAE,CAAA;IAE7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,GAAyE,CAAA;QACnF,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,EAAE,GAAI,IAAyB,EAAE,EAAE,CAAA;YACzC,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;gBAChG,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aAC/B;SACF;QACD,OAAO;KACR,CAAA;AACH,CAAC"}