@mitre/hdf-converters 3.7.1 → 3.7.2-rc.2

package/dist/index.js

@@ -1,10 +1,11 @@
-import { n as detectFormat, o as isCheckovTestCaseName, r as detectConverter, t as registerAllFingerprints } from "./register-all-BEuKQGEZ.js";
+import { n as detectFormat, o as isCheckovTestCaseName, r as detectConverter, t as registerAllFingerprints } from "./register-all-BWm_HvZf.js";
 import { flattenOverlays } from "@mitre/hdf-parsers";
-import { buildCsv, buildXml, canonicalJson, computeCvssScore, computeEffectiveStatus, cvssScoreToSeverity, encodeBase64Utf8, formatJsonNumber, formatTimestamp, formatTimestampSeconds, governingStatusOverride, impactToSeverity, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, validateInputSize, worstStatus, xmlSafeText } from "@mitre/hdf-utilities";
+import { CWE_PATTERN as CWE_PATTERN$1, absentIfGoZeroTime, buildCsv, buildXml, canonicalJson, computeCvssScore, computeEffectiveImpact, computeEffectiveStatus, cvssScoreToSeverity, encodeBase64Utf8, extractCWEIDs, formatJsonNumber, formatTimestamp, formatTimestampSeconds, governingImpactOverrideIndex, governingOverrideIndex, governingStatusOverride, governingStatusOverrideIndex, impactToSeverity, isGoZeroTime, isUnratedSeverity, normalizeHdfTimestamps, parseCsv, parseJSON, parsePurl, parseTimestamp, parseXml, parseXmlWithArrays, replaceHtmlTags, roundImpact, severityToImpact, severityToImpactWithAliases, sha256, stripHtml, stripHtml as stripHTML, trimUtcFraction, validateInputSize, worstStatus, xmlSafeText } from "@mitre/hdf-utilities";
 import { Applicability, AuthorizationStatus, CVSSSeverity, CategorizationLevel, CloudProvider, ControlType, Ecosystem, EvidenceType, HashAlgorithm, IdentityType, Justification, MilestoneStatus, OverrideType, PlanType, ResultStatus, Severity, TargetType, VerificationMethodEnum, Version, affectedPackageSchema, amendmentsSchema, bomSchema, commonSchema, comparisonSchema, componentSchema, createDescription, createMinimalBaseline, createRequirement, createResult, cvssSchema, dataFlowSchema, epssSchema, eventsSchema, extensionsSchema, hdfAmendmentsSchema, hdfBaselineSchema, hdfComparisonSchema, hdfEvidencePackageSchema, hdfPlanSchema, hdfRequirementChangeEventSchema, hdfResultsSchema, hdfSystemSchema, kevSchema, parameterSchema, planSchema, platformSchema, resultSchema, runnerSchema, severityToImpact as severityToImpact$1, statisticsSchema, systemSchema, targetSchema } from "@mitre/hdf-schema";
-import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, SUPPORTED_NIST_REVISIONS, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCheckovCciNistMapping, getCurrentNistRevision, getCweNistControl, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistExists, nistToCci, normalizeNistId } from "@mitre/hdf-mappings";
+import { DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS as DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1, SUPPORTED_NIST_REVISIONS, awsConfigMappedRevisions, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getCCINistMappings, getCheckovCciNistMapping, getCurrentNistRevision, getCweNistControl, getHadolintNistMapping, getHipcheckNistControls, getNessusNistControl, getNiktoNistControl, getOwaspNistControl, getScoutsuiteNistControl, isNistStrict, nistExists, nistToCci, normalizeNistId } from "@mitre/hdf-mappings";
 import Ajv from "ajv";
 import addFormats from "ajv-formats";
+import { addCounts, calculateCompliance, countControlsByStatus, deriveSeverity, severityBucket, severityTotals } from "@mitre/hdf-engine";
 //#region ../hdf-validators/dist/index.js
 /**
 * Create and configure Ajv instance with all HDF schemas
@@ -145,6 +146,20 @@ async function chainOverrides(overrides) {
 	}
 }
 //#endregion
+//#region shared/typescript/unrated.ts
+/**
+* The tag a roll-up leaves on a requirement whose severity the source never
+* rated, and the value it carries. A leaf module: converterutil.ts re-exports
+* these as part of its surface, and rollup.ts imports them here rather than
+* from the barrel that re-exports rollup itself — which is the cycle a second
+* declaration used to work around.
+*/
+const UNRATED_SEVERITY_TAG = "severity_rating";
+const UNRATED_SEVERITY_VALUE = "unrated";
+function markUnratedSeverity(tags, severity) {
+	if (isUnratedSeverity(severity)) tags[UNRATED_SEVERITY_TAG] = UNRATED_SEVERITY_VALUE;
+}
+//#endregion
 //#region shared/typescript/converterutil.ts
 /**
 * Shared utilities for TypeScript HDF converters.
@@ -154,6 +169,18 @@ async function chainOverrides(overrides) {
 * - Re-exports of shared constants and utilities
 */
 /**
+* The identity a finding's affected package carries as its resourceId: the purl
+* when the source gives one, else name@version, else the bare name, else ''.
+* One rule for every converter that stamps a package, so a downstream join on
+* resourceId meets the same string whichever tool produced it.
+* Parity: PackageInstanceID in shared/go/converterutil.go.
+*/
+function packageInstanceId$2(purl, name, version) {
+	if (purl) return purl;
+	if (!name) return "";
+	return version ? `${name}@${version}` : name;
+}
+/**
 * Compute a SHA-256 checksum of raw converter input.
 *
 * Wraps the common 3-line pattern used in every converter into a single call.
@@ -294,22 +321,6 @@ function mapCWEToNIST(cweIDs, fallback) {
 	}
 	return controls.size > 0 ? [...controls].sort() : fallback;
 }
-/** Matches CWE identifiers like "CWE-79", "CWE 89", "cwe22"; group 1 is the number. */
-const CWE_PATTERN$1 = /CWE[- ]?(\d+)/gi;
-/**
-* Extract all numeric CWE IDs from text.
-* Returns deduplicated sorted array of numeric ID strings (e.g., ["79", "89"]).
-*
-* @param text - Text potentially containing CWE identifiers
-* @returns Sorted, deduplicated numeric CWE ID strings
-*/
-function extractCWEIDs(text) {
-	const matches = [...text.matchAll(CWE_PATTERN$1)];
-	if (matches.length === 0) return [];
-	const ids = [...new Set(matches.map((m) => m[1]))];
-	ids.sort();
-	return ids;
-}
 /**
 * Return the first candidate whose content is not empty or whitespace-only,
 * as-is (the emptiness test trims, the returned value does not). Returns '' when
@@ -714,16 +725,6 @@ function buildNoFindingsRequirement(id, codeDesc, startTime) {
 	};
 }
 /**
-* Shared marker converters emit when a source severity is unrated
-* (isUnratedSeverity), so a defaulted impact stays distinguishable from a
-* genuine rated medium. TS peer of MarkUnratedSeverity in converterutil.go.
-*/
-const UNRATED_SEVERITY_TAG = "severity_rating";
-const UNRATED_SEVERITY_VALUE = "unrated";
-function markUnratedSeverity(tags, severity) {
-	if (isUnratedSeverity(severity)) tags[UNRATED_SEVERITY_TAG] = UNRATED_SEVERITY_VALUE;
-}
-/**
 * The schema violations Go's typed decode would also reject.
 *
 * encoding/json refuses exactly two things: a JSON value whose type does not fit
@@ -1207,7 +1208,7 @@ function cvssSeverityFromScore(score) {
 * number is supplied; baseVector and source are set only when non-empty. Consumers
 * needing threat/environmental/computed enrichment set those fields on the result.
 */
-function buildCvss$3(input) {
+function buildCvss$4(input) {
 	const cv = { version: input.version };
 	if (typeof input.baseScore === "number" && Number.isFinite(input.baseScore)) {
 		cv.baseScore = input.baseScore;
@@ -1467,7 +1468,7 @@ function vulnCvss(f) {
 	const out = [];
 	for (const v of f.Vulnerabilities ?? []) for (const c of v.Cvss ?? []) {
 		if (typeof c.BaseScore !== "number") continue;
-		out.push(buildCvss$3({
+		out.push(buildCvss$4({
 			version: cvssVersionFromString(c.Version),
 			baseScore: c.BaseScore,
 			source: c.Source
@@ -1526,7 +1527,7 @@ function trivyLocation(o) {
 	if (el && el !== "0" && el !== sl) loc += `-${el}`;
 	return loc;
 }
-function buildRequirement$19(id, group) {
+function buildRequirement$20(id, group) {
 	const primary = group[0];
 	const impact = Math.max(...group.map(findingImpact));
 	const descriptions = [{
@@ -1573,7 +1574,7 @@ function buildBaseline$1(name, findings, resultsChecksum) {
 			groups.set(id, [f]);
 		}
 	}
-	const requirements = order.map((id) => buildRequirement$19(id, groups.get(id)));
+	const requirements = order.map((id) => buildRequirement$20(id, groups.get(id)));
 	return createMinimalBaseline(name, requirements, { resultsChecksum });
 }
 /** Converts an ASFF document to HDF Results JSON. */
@@ -1621,6 +1622,112 @@ async function convertAsffToHdf(input, converterVersion = "1.0.0") {
 	return serializeHdf(hdf);
 }
 //#endregion
+//#region shared/typescript/status.ts
+/**
+* Bridge from schema-typed requirements onto the canonical effective-status
+* helper in @mitre/hdf-utilities, so every consumer computes status through
+* the single shared implementation (twin of shared/go/status.go). The stored
+* effectiveStatus field is never read — it is an output cache (see
+* status-determination.md).
+*/
+/**
+* RFC3339 string from a schema timestamp (quicktype Date or raw string), with
+* Go's zero time read as absent.
+*/
+function schemaTimestamp(v) {
+	if (v instanceof Date) return absentIfGoZeroTime(v.toISOString());
+	if (typeof v === "string" && v !== "") return absentIfGoZeroTime(v);
+}
+/** Maps a requirement onto the canonical effective-status input shape. */
+function requirementStatusInput(req) {
+	return {
+		impact: req.impact ?? 0,
+		resultStatuses: (req.results ?? []).filter((r) => r != null).map((r) => String(r.status)),
+		overrides: (req.statusOverrides ?? []).filter((o) => o != null).map((o) => ({
+			status: o.status ? String(o.status) : void 0,
+			appliedAt: schemaTimestamp(o.appliedAt),
+			expiresAt: schemaTimestamp(o.expiresAt),
+			impact: o.impact?.value
+		}))
+	};
+}
+/** The requirement's canonical effective status via the shared ladder. */
+function requirementEffectiveStatus(req) {
+	return computeEffectiveStatus(requirementStatusInput(req));
+}
+/**
+* The requirement's canonical effective impact via the shared ladder: the
+* governing non-expired impact override's value, else the requirement's own. The
+* stored effectiveImpact field is an output cache and is never read, exactly as
+* effectiveStatus is not. Expiry is judged at now, else the clock, for a
+* renderer that promises assessment-time output. Parity: RequirementEffectiveImpact
+* and RequirementEffectiveImpactAt in shared/go.
+*/
+function requirementEffectiveImpact(req, now) {
+	return computeEffectiveImpact(requirementStatusInput(req), now);
+}
+/**
+* The override that governs a requirement — the most recently applied
+* non-expired one, whatever it carries — or undefined when none does.
+*
+* Resolution is by appliedAt, never by array position. The schema's description
+* says the most recent override "should be first in array", but nothing in this
+* repo sorts and both writers append, so on a document our own tooling amended
+* twice the newest override is LAST and statusOverrides[0] is the oldest.
+*
+* Parity: GoverningOverride in shared/go/status.go.
+*/
+function governingOverride(req, now) {
+	const overrides = req.statusOverrides ?? [];
+	const i = governingOverrideIndex(overrides.map((o) => ({
+		status: o?.status ? String(o.status) : void 0,
+		appliedAt: schemaTimestamp(o?.appliedAt),
+		expiresAt: schemaTimestamp(o?.expiresAt)
+	})), () => true, now);
+	return i >= 0 ? overrides[i] ?? void 0 : void 0;
+}
+/**
+* The override that governs a requirement's IMPACT — the most recently applied
+* non-expired one CARRYING an impact — or undefined when none does. Eligibility
+* is per field, so a newer override that says nothing about impact does not
+* displace an older re-score.
+*
+* Parity: GoverningImpactOverrideIndex usage in shared/go/checklist.
+*/
+function governingImpactOverride(req, now) {
+	const overrides = (req.statusOverrides ?? []).filter((o) => o != null);
+	const i = governingImpactOverrideIndex(overrides.map((o) => ({
+		appliedAt: schemaTimestamp(o.appliedAt),
+		expiresAt: schemaTimestamp(o.expiresAt),
+		impact: o.impact?.value
+	})), now);
+	return i >= 0 ? overrides[i] : void 0;
+}
+/**
+* The type of the override that governs a requirement, or '' when none does —
+* the disposition twin of requirementEffectiveStatus and
+* requirementEffectiveImpact.
+*
+* Whenever the requirement carries overrides, they decide: the stored
+* disposition field is an output cache that can disagree with them, or be stale,
+* and it is not read. The one exception is a requirement carrying NO overrides
+* at all, where the stored field is the only evidence in the document.
+*
+* This reads statusOverrides only. hdf-engine's filter and hdf-diff's checksum
+* fold poams[] into the same governing set and report 'poam' when a plan
+* governs; an export does not, because the exporters carry the plan separately
+* and a disposition of 'poam' would duplicate it in a column that names an
+* override type. Pinned by the "does not read poams" test.
+*
+* Parity: RequirementDisposition in shared/go/status.go.
+*/
+function requirementDisposition(req, now) {
+	const governing = governingOverride(req, now);
+	if (governing) return String(governing.type ?? "");
+	if ((req.statusOverrides ?? []).length === 0 && req.disposition) return String(req.disposition);
+	return "";
+}
+//#endregion
 //#region converters/sarif-to-hdf/typescript/converter.ts
 const SARIF_ALIASES = {
 	error: .7,
@@ -1703,9 +1810,9 @@ function convertResultGroup(ruleId, rule, sarifResults, timestamp) {
 	const sourceLocation = firstResult.locations && firstResult.locations.length > 0 ? extractSourceLocation$1(firstResult.locations[0]) : void 0;
 	const results = [];
 	for (const sr of sarifResults) results.push(...convertSarifResultToHDFResults(sr));
-	const descriptions = buildDescriptions$2(description, rule, firstResult);
+	const descriptions = buildDescriptions$3(description, rule, firstResult);
 	const allSuppressions = sarifResults.flatMap((sr) => sr.suppressions ?? []);
-	const options = { tags: buildTags$4(firstResult, rule, ruleLevel, cweIds, nistControls, cciControls, allSuppressions) };
+	const options = { tags: buildTags$5(firstResult, rule, ruleLevel, cweIds, nistControls, cciControls, allSuppressions) };
 	if (sourceLocation) options.sourceLocation = sourceLocation;
 	const req = createRequirement(ruleId, title, descriptions, impact, results, options);
 	req.severity = impactToSeverity(impact);
@@ -1923,7 +2030,7 @@ function rollupStatus(statuses) {
 }
 function governingDisposition(overrides, effective) {
 	for (const ov of overrides) if (ov.status === effective) return ov.type;
-	return overrides[0].type;
+	return governingOverride({ statusOverrides: overrides })?.type ?? overrides[0].type;
 }
 function extractBacktrace(codeFlows) {
 	if (!codeFlows || codeFlows.length === 0) return [];
@@ -1939,7 +2046,7 @@ function extractBacktrace(codeFlows) {
 	}
 	return backtrace;
 }
-function buildDescriptions$2(defaultDesc, rule, result) {
+function buildDescriptions$3(defaultDesc, rule, result) {
 	const descriptions = [createDescription("default", defaultDesc)];
 	if (rule) {
 		if (rule.fullDescription?.text) descriptions.push(createDescription("rationale", rule.fullDescription.text));
@@ -1949,7 +2056,7 @@ function buildDescriptions$2(defaultDesc, rule, result) {
 	if (result.fixes && result.fixes.length > 0 && result.fixes[0]?.description?.text) descriptions.push(createDescription("fix", result.fixes[0].description.text));
 	return descriptions;
 }
-function buildTags$4(result, rule, resolvedLevel, cweIds, nistControls, cciControls, allSuppressions) {
+function buildTags$5(result, rule, resolvedLevel, cweIds, nistControls, cciControls, allSuppressions) {
 	const tags = {
 		severity: resolvedLevel,
 		cwe: cweIds,
@@ -2118,7 +2225,7 @@ function testCaseToRequirement(tc, scanTime) {
 	const { status, message } = resolveStatus(tc);
 	const result = {
 		status,
-		codeDesc: buildCodeDesc$10(tc),
+		codeDesc: buildCodeDesc$11(tc),
 		startTime: scanTime
 	};
 	if (message !== void 0) result.message = message;
@@ -2206,7 +2313,7 @@ function buildFailureMessage(message, typeName, body) {
 	if (body) result += "\n" + decodeXmlEntities$6(body);
 	return result;
 }
-function buildCodeDesc$10(tc) {
+function buildCodeDesc$11(tc) {
 	if (tc["@_classname"]) return `${decodeXmlEntities$6(tc["@_classname"])} :: ${decodeXmlEntities$6(tc["@_name"])}`;
 	return decodeXmlEntities$6(tc["@_name"]);
 }
@@ -2552,7 +2659,7 @@ function ruleResultToRequirement(rr, ruleIndex, groupIndex, scanTime) {
 	const req = createRequirement(id, title, descriptions, impact, [result], { tags });
 	const code = buildCheckCode(check);
 	if (code) req.code = code;
-	const refs = buildRefs$10(ruleDef?.reference);
+	const refs = buildRefs$11(ruleDef?.reference);
 	if (refs.length > 0) req.refs = refs;
 	const hdfSeverity = xccdfSeverityToHdf(severity);
 	if (hdfSeverity) req.severity = hdfSeverity;
@@ -2709,7 +2816,7 @@ function checkDescriptionData(check) {
 * href, when present, populates url. References that carry nothing are skipped.
 * Inner keys are inserted alphabetically to match Go's map JSON ordering.
 */
-function buildRefs$10(refs) {
+function buildRefs$11(refs) {
 	if (!refs) return [];
 	const out = [];
 	for (const r of refs) {
@@ -3367,36 +3474,6 @@ function setIf$1(m, key, val) {
 	if (val) m[key] = val;
 }
 //#endregion
-//#region shared/typescript/status.ts
-/**
-* Bridge from schema-typed requirements onto the canonical effective-status
-* helper in @mitre/hdf-utilities, so every consumer computes status through
-* the single shared implementation (twin of shared/go/status.go). The stored
-* effectiveStatus field is never read — it is an output cache (see
-* status-determination.md).
-*/
-/** RFC3339 string from a schema timestamp (quicktype Date or raw string). */
-function stamp(v) {
-	if (v instanceof Date) return v.toISOString();
-	if (typeof v === "string" && v !== "") return v;
-}
-/** Maps a requirement onto the canonical effective-status input shape. */
-function requirementStatusInput(req) {
-	return {
-		impact: req.impact ?? 0,
-		resultStatuses: (req.results ?? []).filter((r) => r != null).map((r) => String(r.status)),
-		overrides: (req.statusOverrides ?? []).filter((o) => o != null).map((o) => ({
-			status: o.status ? String(o.status) : void 0,
-			appliedAt: stamp(o.appliedAt),
-			expiresAt: stamp(o.expiresAt)
-		}))
-	};
-}
-/** The requirement's canonical effective status via the shared ladder. */
-function requirementEffectiveStatus(req) {
-	return computeEffectiveStatus(requirementStatusInput(req));
-}
-//#endregion
 //#region shared/typescript/checklist/from-hdf.ts
 /**
 * Map HDF Results back to the format-neutral Checklist model. When the HDF
@@ -3519,7 +3596,8 @@ function composeComments(tags, req) {
 function overrideProvenance(req) {
 	const overrides = req.statusOverrides ?? [];
 	if (overrides.length > 0) return overrides.map(formatOverride).join("\n");
-	if (req.disposition) return `Disposition: ${req.disposition}`;
+	const disposition = requirementDisposition(req);
+	if (disposition) return `Disposition: ${disposition}`;
 	return "";
 }
 function formatOverride(o) {
@@ -3527,22 +3605,23 @@ function formatOverride(o) {
 	if (o.reason) s += `: ${o.reason}`;
 	const meta = [];
 	if (o.appliedBy?.identifier) meta.push(`by ${o.appliedBy.identifier}`);
-	const applied = hdfTime(o.appliedAt);
+	const applied = hdfTime(schemaTimestamp(o.appliedAt));
 	if (applied) meta.push(`applied ${formatTimestamp(applied)}`);
-	const expires = hdfTime(o.expiresAt);
+	const expires = hdfTime(schemaTimestamp(o.expiresAt));
 	if (expires) meta.push(`expires ${formatTimestamp(expires)}`);
 	if (meta.length > 0) s += ` (${meta.join(", ")})`;
 	return s;
 }
 function overrideSeverity(req) {
-	for (const o of req.statusOverrides ?? []) if (o.impact) return {
-		severity: cklSeverityOrFloor(o.impact.value),
-		justification: o.reason ?? ""
-	};
-	return {
+	const o = governingImpactOverride(req);
+	if (!o) return {
 		severity: "",
 		justification: ""
 	};
+	return {
+		severity: cklSeverityOrFloor(o.impact.value),
+		justification: o.reason ?? ""
+	};
 }
 function cklSeverityFromImpact(impact) {
 	switch (impactToSeverity(impact)) {
@@ -3703,7 +3782,7 @@ const NIST_MAPPING_TAG = "nistMapping";
 const NIST_MAPPING_TABLE = "mapped";
 const NIST_MAPPING_CWE = "cwe-derived";
 const NIST_MAPPING_FALLBACK = "static-fallback";
-function impactFor$1(severity) {
+function impactFor$2(severity) {
 	return severityToImpactWithAliases(severity, KICS_SEVERITY_ALIASES, DEFAULT_IMPACT$1);
 }
 /** KICS emits the bare number, e.g. "778". Normalize before the lookup. */
@@ -3826,7 +3905,7 @@ function buildCoverageRequirement$1(report, startTime) {
 		}
 	};
 }
-function buildRequirement$18(query, startTime) {
+function buildRequirement$19(query, startTime) {
 	const tags = tagsFor$1(query);
 	const descriptions = [{
 		label: "default",
@@ -3838,7 +3917,7 @@ function buildRequirement$18(query, startTime) {
 		message: evidenceFor(file),
 		startTime
 	}));
-	const requirement = createRequirement(query.query_id || query.query_name || "unknown", query.query_name || query.query_id || "Unnamed KICS query", descriptions, impactFor$1(query.severity), results, { tags });
+	const requirement = createRequirement(query.query_id || query.query_name || "unknown", query.query_name || query.query_id || "Unnamed KICS query", descriptions, impactFor$2(query.severity), results, { tags });
 	requirement.verificationMethod = VerificationMethodEnum.Automated;
 	const controlType = deriveControlTypeFromTags(tags.nist);
 	if (controlType !== void 0) requirement.controlType = controlType;
@@ -3861,7 +3940,7 @@ async function convertKicsToHdf(input, converterVersion = "1.0.0") {
 	const report = parseJSON(input);
 	if (!Array.isArray(report.queries) || typeof report.kics_version !== "string") throw new Error("kics: input does not look like a KICS report");
 	const startTime = /* @__PURE__ */ new Date();
-	const requirements = report.queries.filter((q) => Array.isArray(q.files) && q.files.length > 0).map((q) => buildRequirement$18(q, startTime));
+	const requirements = report.queries.filter((q) => Array.isArray(q.files) && q.files.length > 0).map((q) => buildRequirement$19(q, startTime));
 	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("kics-no-findings", `KICS scanned ${report.files_scanned ?? 0} file(s) and reported no findings.`, startTime));
 	requirements.push(buildCoverageRequirement$1(report, startTime));
 	const baseline = createMinimalBaseline("KICS Scan", requirements, {
@@ -3937,7 +4016,7 @@ function nistControlsFor(metadata) {
 	const deduped = [...new Set(controls)];
 	return deduped.length > 0 ? deduped : [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS$1];
 }
-function impactFor(result) {
+function impactFor$1(result) {
 	const severity = result.extra?.severity;
 	if (!isPresent(severity)) return DEFAULT_IMPACT;
 	return severityToImpactWithAliases(severity, SEMGREP_SEVERITY_ALIASES, DEFAULT_IMPACT);
@@ -3949,7 +4028,7 @@ function impactFor(result) {
 */
 function severityFor(result) {
 	if (!isPresent(result.extra?.severity)) return;
-	return impactToSeverity(impactFor(result));
+	return impactToSeverity(impactFor$1(result));
 }
 /**
 * Semgrep rule ids are dotted paths whose final segment is the rule name. The
@@ -3962,7 +4041,7 @@ function titleFor(checkId) {
 	const segments = checkId.split(".").filter((segment) => segment.length > 0);
 	return (segments[segments.length - 1] ?? checkId).split(/[-_]+/).filter((word) => word.length > 0).map((word) => word[0].toUpperCase() + word.slice(1)).join(" ");
 }
-function codeDescFor(result) {
+function codeDescFor$1(result) {
 	const path = isPresent(result.path) ? result.path : "unknown";
 	const startLine = lineOf(result.start);
 	const endLine = lineOf(result.end);
@@ -4063,7 +4142,7 @@ function codeFor(result) {
 	return JSON.stringify(envelope, null, 2);
 }
 /** Every occurrence of one rule becomes a result under a single requirement. */
-function buildRequirement$17(checkId, results, startTime) {
+function buildRequirement$18(checkId, results, startTime) {
 	const representative = results[0];
 	const metadata = representative.extra?.metadata ?? {};
 	const message = representative.extra?.message;
@@ -4073,7 +4152,7 @@ function buildRequirement$17(checkId, results, startTime) {
 	}];
 	const requirementResults = results.map((result) => ({
 		status: ResultStatus.Failed,
-		codeDesc: codeDescFor(result),
+		codeDesc: codeDescFor$1(result),
 		message: messageFor(result),
 		startTime
 	}));
@@ -4081,7 +4160,7 @@ function buildRequirement$17(checkId, results, startTime) {
 	const cwe = cweCatalogFor(metadata);
 	const refs = refsFor(metadata);
 	const sourceLocation = sourceLocationFor(representative);
-	const requirement = createRequirement(checkId, titleFor(checkId), descriptions, impactFor(representative), requirementResults, {
+	const requirement = createRequirement(checkId, titleFor(checkId), descriptions, impactFor$1(representative), requirementResults, {
 		tags,
 		code: codeFor(representative),
 		...cwe.length > 0 ? { cwe } : {},
@@ -4182,7 +4261,7 @@ async function convertSemgrepToHdf(input, converterVersion = "1.0.0") {
 		else groups.set(result.check_id, [result]);
 	}
 	const requirements = [];
-	for (const [checkId, results] of groups) requirements.push(buildRequirement$17(checkId, results, startTime));
+	for (const [checkId, results] of groups) requirements.push(buildRequirement$18(checkId, results, startTime));
 	if (groups.size === 0) {
 		const scanned = scannedCount(report);
 		requirements.push(buildNoFindingsRequirement("semgrep-no-findings", `Semgrep scanned ${scanned} file(s) and reported no findings.`, startTime));
@@ -4255,7 +4334,7 @@ function buildReferenceCode(r) {
 	if (r.url) o.url = r.url;
 	return o;
 }
-function buildVulnCode$2(v) {
+function buildVulnCode$3(v) {
 	const o = {};
 	if (v.id) o.id = v.id;
 	if (v.title) o.title = v.title;
@@ -4331,7 +4410,7 @@ function synthesizePurl(ecosystem, name, version) {
 */
 function buildSnykCvss(vuln) {
 	if (!vuln.cvssScore && !vuln.CVSSv3) return [];
-	return [buildCvss$3({
+	return [buildCvss$4({
 		version: cvssVersionFromVector(vuln.CVSSv3),
 		baseScore: vuln.cvssScore,
 		baseVector: vuln.CVSSv3
@@ -4360,7 +4439,7 @@ function formatUpgradePath(path) {
 	const steps = path.filter((e) => typeof e === "string" && e.length > 0);
 	return steps.length > 0 ? steps.join(" > ") : void 0;
 }
-function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
+function buildRequirement$17(vulnID, vulns, scanTime, packageManager) {
 	const rep = vulns[0];
 	const cweIDs = rep.identifiers.CWE ?? [];
 	const nist = mapCWEToNIST(cweIDs, DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
@@ -4392,7 +4471,7 @@ function buildRequirement$16(vulnID, vulns, scanTime, packageManager) {
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
 	req.verificationMethod = VerificationMethodEnum.Automated;
-	const code = buildVulnCode$2(rep);
+	const code = buildVulnCode$3(rep);
 	if (code) req.code = code;
 	const cvss = buildSnykCvss(rep);
 	if (cvss.length > 0) req.cvss = cvss;
@@ -4428,7 +4507,7 @@ function convertSingleProject(report, resultsChecksum, scanTime) {
 		else groups.set(vuln.id, [vuln]);
 	}
 	const requirements = [];
-	for (const [vulnID, vulns] of groups) requirements.push(buildRequirement$16(vulnID, vulns, scanTime, report.packageManager));
+	for (const [vulnID, vulns] of groups) requirements.push(buildRequirement$17(vulnID, vulns, scanTime, report.packageManager));
 	if (requirements.length === 0) {
 		const target = report.projectName ?? report.path ?? "project";
 		requirements.push(buildNoFindingsRequirement("snyk-no-findings", `Snyk scanned ${target} and reported zero vulnerable components.`, scanTime));
@@ -4528,7 +4607,18 @@ function getReferences(vuln, relatedVulns) {
 	}
 	return Array.from(refs);
 }
-function buildCodeDesc$9(match) {
+/**
+* The per-result instance identity for a grype match: the matched package's
+* purl, which is what distinguishes two entries reporting the same CVE. Falls
+* back to name@version when a source omits purl (optional in grype's schema,
+* though every committed fixture carries it) — the same identity twistlock
+* uses, whose source has no purl at all. Returns '' when the artifact names
+* nothing at all, so the caller leaves both fields unset.
+*/
+function packageInstanceId$1(a) {
+	return packageInstanceId$2(a.purl ?? "", a.name, a.version ?? "");
+}
+function buildCodeDesc$10(match) {
 	const parts = [];
 	parts.push(`Package: ${match.artifact.name}@${match.artifact.version}`);
 	if (match.artifact.type) parts.push(`Type: ${match.artifact.type}`);
@@ -4546,7 +4636,7 @@ function buildCvssEntries$7(vuln) {
 	if (!vuln.cvss || vuln.cvss.length === 0) return;
 	const entries = [];
 	for (const c of vuln.cvss) {
-		const entry = buildCvss$3({
+		const entry = buildCvss$4({
 			version: cvssVersionFromString(c.version),
 			baseScore: c.metrics?.baseScore,
 			baseVector: c.vector,
@@ -4568,7 +4658,7 @@ function mapGrypeTypeToEcosystem(grypeType) {
 		default: return ecosystemFromPurlType(grypeType);
 	}
 }
-function buildAffectedPackages(match) {
+function buildAffectedPackages$1(match) {
 	const artifact = match.artifact;
 	const fix = match.vulnerability.fix;
 	const pkg = buildAffectedPackage$1({
@@ -4625,10 +4715,15 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	const message = messageParts.join(" ");
 	const result = {
 		status,
-		codeDesc: buildCodeDesc$9(match),
+		codeDesc: buildCodeDesc$10(match),
 		message,
 		startTime
 	};
+	const instanceId = packageInstanceId$1(match.artifact);
+	if (instanceId) {
+		result.resource = "package";
+		result.resourceId = instanceId;
+	}
 	const cciTags = nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
 	const tags = buildNistCciTags(DEFAULT_STATIC_ANALYSIS_NIST_TAGS, cciTags);
 	markUnratedSeverity(tags, severity);
@@ -4660,7 +4755,7 @@ function convertMatchToRequirement(match, isIgnored, targetName, startTime) {
 	if (controlType !== void 0) requirement.controlType = controlType;
 	const cvss = buildCvssEntries$7(vuln);
 	if (cvss) requirement.cvss = cvss;
-	requirement.affectedPackages = buildAffectedPackages(match);
+	requirement.affectedPackages = buildAffectedPackages$1(match);
 	const cwe = extractCwe(vuln.cwe);
 	if (cwe) requirement.cwe = cwe;
 	const epss = buildEpss$3(vuln.epss);
@@ -4673,7 +4768,7 @@ function grypeTargetName(target) {
 	if (typeof target === "string") return target || "Grype Scan";
 	return target?.userInput || "Grype Scan";
 }
-function buildComponent$2(report, targetName) {
+function buildComponent$3(report, targetName) {
 	const rawTarget = report.source?.target;
 	const t = typeof rawTarget === "object" ? rawTarget : void 0;
 	const firstRepoDigest = t?.repoDigests?.find((d) => d);
@@ -4725,11 +4820,212 @@ async function convertGrypeToHdf(input, converterVersion = "1.0.0") {
 		toolName: "Grype",
 		toolVersion: grypeData.descriptor?.version,
 		baselines: [baseline],
-		components: [buildComponent$2(grypeData, targetName)],
+		components: [buildComponent$3(grypeData, targetName)],
 		timestamp: scanTime ?? void 0
 	});
 }
 //#endregion
+//#region converters/hadolint-to-hdf/typescript/rules.ts
+/**
+* Rule documentation links for the hadolint converter.
+*
+* hadolint's report carries a one-line message per finding and nothing else.
+* Each rule's rationale and fix live on a wiki page, and the two rule families
+* are documented in different projects, so every requirement links its own.
+*
+* Twin of go/rules.go.
+*/
+const HADOLINT_RULE_BASE = "https://github.com/hadolint/hadolint/wiki";
+const SHELLCHECK_RULE_BASE = "https://github.com/koalaman/shellcheck/wiki";
+/** Matches hadolint's own rule codes and the shellcheck codes it surfaces. */
+const RULE_CODE = /^(DL|SC)\d+$/;
+/** hadolint surfaces shellcheck's findings in its own report. */
+function isShellcheck(code) {
+	return code.startsWith("SC");
+}
+/**
+* The published documentation for a rule, or an empty string when the code is
+* not one. The code is checked first, so a report carrying a crafted code
+* cannot steer the link somewhere of its choosing.
+*/
+function ruleReferenceUrl(code) {
+	if (!RULE_CODE.test(code)) return "";
+	return `${isShellcheck(code) ? SHELLCHECK_RULE_BASE : HADOLINT_RULE_BASE}/${code}`;
+}
+//#endregion
+//#region converters/hadolint-to-hdf/typescript/converter.ts
+/**
+* hadolint Dockerfile linter output to HDF.
+*
+* hadolint's JSON formatter emits a bare array of flat findings, each carrying
+* only code, column, file, level, line and message. One requirement is produced
+* per distinct rule code and one result per finding, so a rule that fires on
+* several lines keeps every occurrence.
+*
+* Twin of go/converter.go.
+*/
+const CONVERTER_NAME$3 = "hadolint";
+/**
+* hadolint's severity vocabulary as its JSON writer spells it. An ignored rule
+* serializes as the empty string, and anything unrecognized scores zero rather
+* than guessing.
+*/
+const LEVEL_IMPACT = {
+	error: .7,
+	warning: .5,
+	info: .3,
+	style: .1,
+	"": 0
+};
+function impactFor(level) {
+	return severityToImpactWithAliases(level, LEVEL_IMPACT, 0);
+}
+/**
+* Resolves a rule's NIST controls and CCIs, falling back to the static-analysis
+* controls when the rule is unmapped. A mapped rule can still translate to
+* nothing — the table is authored at Rev 5 and SR-4 has no Rev 4 equivalent —
+* so an empty result takes the fallback too rather than leaving the finding
+* with an empty nist tag. Mirrors Go's `controlsFor`.
+*/
+function controlsFor$1(ruleId) {
+	const mapping = getHadolintNistMapping(ruleId);
+	if (mapping && mapping.nist.length > 0) return {
+		nist: mapping.nist,
+		cci: nistToCci(mapping.nist)
+	};
+	const fallback = [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
+	return {
+		nist: fallback,
+		cci: nistToCci(fallback)
+	};
+}
+function codeDescFor(f) {
+	return `File: ${f.file ?? ""} | Line: ${f.line ?? 0} | Column: ${f.column ?? 0}`;
+}
+function findingToResult(f, scanTime) {
+	return createResult(ResultStatus.Failed, f.message ?? "", {
+		codeDesc: codeDescFor(f),
+		startTime: scanTime
+	});
+}
+function buildRequirement$16(ruleId, group, scanTime) {
+	const first = group[0];
+	const { nist, cci } = controlsFor$1(ruleId);
+	const tags = buildNistCciTags(nist, cci);
+	const message = first.message ?? "";
+	const req = createRequirement(ruleId, message, [{
+		label: "default",
+		data: message
+	}], impactFor(first.level ?? ""), group.map((f) => findingToResult(f, scanTime)), { tags });
+	req.verificationMethod = VerificationMethodEnum.Automated;
+	const reference = ruleReferenceUrl(ruleId);
+	if (reference !== "") req.refs = [{ url: reference }];
+	req.code = JSON.stringify({
+		code: first.code ?? "",
+		column: first.column ?? 0,
+		file: first.file ?? "",
+		level: first.level ?? "",
+		line: first.line ?? 0,
+		message: first.message ?? ""
+	});
+	if (first.file) {
+		const location = { ref: first.file };
+		if (first.line !== void 0 && first.line > 0) location.line = first.line;
+		req.sourceLocation = location;
+	}
+	const controlType = deriveControlTypeFromTags(nist);
+	if (controlType !== void 0) req.controlType = controlType;
+	return req;
+}
+/**
+* Names each distinct scanned file. hadolint accepts several Dockerfiles in one
+* run and tags every finding with the file it came from.
+*/
+function componentsFor(findings) {
+	const seen = /* @__PURE__ */ new Set();
+	const components = [];
+	for (const f of findings) {
+		if (!f.file || seen.has(f.file)) continue;
+		seen.add(f.file);
+		components.push({
+			name: f.file,
+			type: TargetType.Repository
+		});
+	}
+	return components;
+}
+function baselineTitle(components) {
+	if (components.length === 0) return "Hadolint Scan";
+	if (components.length === 1) return `Hadolint Scan of ${components[0].name}`;
+	return `Hadolint Scan of ${components.length} files`;
+}
+const STRING_FIELDS = [
+	"code",
+	"file",
+	"level",
+	"message"
+];
+const INTEGER_FIELDS = ["column", "line"];
+/**
+* Parses the findings array, rejecting what the Go decoder rejects so both
+* public implementations accept the same inputs. Go decodes an absent or null
+* field to its zero value, so those stay valid; it refuses a field present
+* with the wrong type.
+*/
+function parseInput$2(input) {
+	const findings = parseJSON(input);
+	if (!Array.isArray(findings)) throw new Error(`${CONVERTER_NAME$3}: input is not a hadolint findings array`);
+	for (const finding of findings) {
+		if (typeof finding !== "object" || finding === null || Array.isArray(finding)) throw new Error(`${CONVERTER_NAME$3}: input is not a hadolint findings array`);
+		const fields = finding;
+		for (const key of STRING_FIELDS) {
+			const value = fields[key];
+			if (value !== void 0 && value !== null && typeof value !== "string") throw new Error(`${CONVERTER_NAME$3}: finding field ${key} is not a string`);
+		}
+		for (const key of INTEGER_FIELDS) {
+			const value = fields[key];
+			if (value !== void 0 && value !== null && !Number.isInteger(value)) throw new Error(`${CONVERTER_NAME$3}: finding field ${key} is not an integer`);
+		}
+	}
+	return findings;
+}
+/** Converts hadolint JSON output to HDF results. */
+async function convertHadolintToHdf(input, converterVersion = "1.0.0") {
+	validateInputSize$1(input, CONVERTER_NAME$3);
+	registerAllFingerprints();
+	const detected = detectConverter(input);
+	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
+	const resultsChecksum = await inputChecksum(input);
+	const scanTime = /* @__PURE__ */ new Date();
+	const parsed = parseInput$2(input);
+	const { items: findings, truncated } = limitArray(parsed);
+	/* v8 ignore next -- truncation only triggers with >100K items */
+	if (truncated) console.warn(`WARNING: Input truncated at ${findings.length} finding items (original: ${parsed.length})`);
+	const components = componentsFor(findings);
+	const groups = /* @__PURE__ */ new Map();
+	for (const f of findings) {
+		const code = f.code ?? "";
+		const existing = groups.get(code);
+		if (existing) existing.push(f);
+		else groups.set(code, [f]);
+	}
+	const requirements = [];
+	for (const [ruleId, group] of groups) requirements.push(buildRequirement$16(ruleId, group, scanTime));
+	if (requirements.length === 0) requirements.push(buildNoFindingsRequirement("hadolint-no-findings", "hadolint scanned the Dockerfile and reported zero findings.", scanTime));
+	const baseline = createMinimalBaseline("Hadolint Scan", requirements, {
+		title: baselineTitle(components),
+		resultsChecksum
+	});
+	return buildHdfResults({
+		generatorName: "hadolint-to-hdf",
+		converterVersion,
+		toolName: CONVERTER_NAME$3,
+		baselines: [baseline],
+		components: components.length > 0 ? components : void 0,
+		timestamp: scanTime
+	});
+}
+//#endregion
 //#region converters/defectdojo-to-hdf/typescript/converter.ts
 function deriveStatus(f) {
 	if (f.out_of_scope) return ResultStatus.NotApplicable;
@@ -4833,11 +5129,11 @@ function findingId(f) {
 function cveList(f) {
 	return (f.vulnerability_ids ?? []).map((v) => v.vulnerability_id).filter(Boolean);
 }
-function buildCvss$2(f) {
+function buildCvss$3(f) {
 	const out = [];
 	const add = (version, vector, score) => {
 		if ((score === void 0 || score === null) && !vector) return;
-		out.push(buildCvss$3({
+		out.push(buildCvss$4({
 			version,
 			baseScore: score,
 			baseVector: vector
@@ -4858,7 +5154,7 @@ function buildEpss$2(f) {
 function nistTags(f) {
 	return f.cwe && f.cwe > 0 ? mapCWEToNIST([`CWE-${f.cwe}`], DEFAULT_STATIC_ANALYSIS_NIST_TAGS) : DEFAULT_STATIC_ANALYSIS_NIST_TAGS;
 }
-function buildDescriptions$1(f) {
+function buildDescriptions$2(f) {
 	const descs = [{
 		label: "default",
 		data: f.description || f.title || "No description provided."
@@ -4886,7 +5182,7 @@ function sourceLocus(f) {
 	if (f.sast_source_file_path) return [f.sast_source_file_path, f.sast_source_line];
 	return [void 0, void 0];
 }
-function buildSourceLocation$5(f) {
+function buildSourceLocation$6(f) {
 	const [ref, line] = sourceLocus(f);
 	if (!ref) return void 0;
 	const loc = { ref };
@@ -4908,17 +5204,17 @@ function convertFinding(f) {
 		impact: severityToImpact(f.severity),
 		results: [result],
 		tags,
-		descriptions: buildDescriptions$1(f)
+		descriptions: buildDescriptions$2(f)
 	};
 	const controlType = deriveControlTypeFromTags(nist);
 	if (controlType !== void 0) req.controlType = controlType;
-	const cvss = buildCvss$2(f);
+	const cvss = buildCvss$3(f);
 	if (cvss.length > 0) req.cvss = cvss;
 	const epss = buildEpss$2(f);
 	if (epss) req.epss = epss;
 	if (f.cwe && f.cwe > 0) req.cwe = [`CWE-${f.cwe}`];
 	req.code = JSON.stringify(f, null, 2);
-	const sourceLocation = buildSourceLocation$5(f);
+	const sourceLocation = buildSourceLocation$6(f);
 	if (sourceLocation) req.sourceLocation = sourceLocation;
 	const firstRisk = f.accepted_risks?.[0];
 	if (f.risk_accepted && firstRisk) {
@@ -5111,10 +5407,10 @@ function convertReportItemToRequirement(item, host) {
 	const isCompliance = !!item["compliance-reference"];
 	const id = isCompliance ? parseComplianceRef(item["compliance-reference"], "Vuln-ID")[0] || item["pluginID"] : item["pluginID"];
 	const title = isCompliance ? item["compliance-check-name"] || item["pluginName"] : item["pluginName"];
-	const descriptions = buildDescriptions(item, isCompliance);
+	const descriptions = buildDescriptions$1(item, isCompliance);
 	const impact = calculateImpact(item, isCompliance);
-	const tags = buildTags$3(item, isCompliance);
-	const refs = buildRefs$9(item);
+	const tags = buildTags$4(item, isCompliance);
+	const refs = buildRefs$10(item);
 	const results = [buildResult$1(item, host, isCompliance)];
 	const code = JSON.stringify(item, null, 2);
 	const nistTags = tags["nist"];
@@ -5253,7 +5549,7 @@ function epssDate$1(host) {
 		if (d) return d.toISOString().slice(0, 10);
 	}
 }
-function buildDescriptions(item, isCompliance) {
+function buildDescriptions$1(item, isCompliance) {
 	const descriptions = [];
 	if (isCompliance && item["compliance-info"]) descriptions.push({
 		label: "default",
@@ -5301,7 +5597,7 @@ function calculateImpact(item, isCompliance) {
 function orDefaultNist(controls) {
 	return controls.length > 0 ? controls : [...DEFAULT_REMEDIATION_NIST_TAGS$1];
 }
-function buildTags$3(item, isCompliance) {
+function buildTags$4(item, isCompliance) {
 	const tags = { rid: isCompliance ? parseComplianceRef(item["compliance-reference"], "Rule-ID").join(",") : item["pluginID"] };
 	if (isCompliance && item["compliance-reference"]) {
 		const cciTags = parseComplianceRef(item["compliance-reference"], "CCI");
@@ -5324,7 +5620,7 @@ function buildTags$3(item, isCompliance) {
 	if (item.cvss_base_score) tags.cvss_base_score = item.cvss_base_score;
 	return tags;
 }
-function buildRefs$9(item) {
+function buildRefs$10(item) {
 	const refs = [];
 	if (item.see_also) for (const url of item.see_also.split(/\s+/).filter(Boolean)) refs.push({ url });
 	return refs.length > 0 ? refs : void 0;
@@ -5699,7 +5995,7 @@ function mapComplianceStatus(complianceType) {
 function splitControls(nistId) {
 	return nistId.split("|").map((c) => c.trim()).filter(Boolean);
 }
-function buildNistTags$3(sourceIdentifier, ruleName) {
+function buildNistTags$4(sourceIdentifier, ruleName) {
 	const byIdentifier = sourceIdentifier ? getAwsConfigNistControlByIdentifier(sourceIdentifier) : void 0;
 	if (byIdentifier) return splitControls(byIdentifier);
 	const byName = getAwsConfigNistControlByName(ruleName);
@@ -5748,7 +6044,7 @@ function buildCheckText(rule) {
 	}
 	return parts.join("<br/>");
 }
-function buildCodeDesc$8(q) {
+function buildCodeDesc$9(q) {
 	return `config_rule_name: ${q.ConfigRuleName}, resource_type: ${q.ResourceType}, resource_id: ${q.ResourceId}`;
 }
 function buildResultMessage(codeDesc, annotation, status) {
@@ -5765,7 +6061,7 @@ function computeRunTime$1(invoked, recorded) {
 function buildResult(r) {
 	const q = r.EvaluationResultIdentifier.EvaluationResultQualifier;
 	const status = mapComplianceStatus(r.ComplianceType);
-	const codeDesc = buildCodeDesc$8(q);
+	const codeDesc = buildCodeDesc$9(q);
 	const message = buildResultMessage(codeDesc, r.Annotation, status);
 	const startTime = (r.ConfigRuleInvokedTime ? parseTimestamp(r.ConfigRuleInvokedTime) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
 	const runTime = computeRunTime$1(r.ConfigRuleInvokedTime, r.ResultRecordedTime);
@@ -5790,7 +6086,7 @@ function buildNotApplicableResult(rule) {
 	});
 }
 function buildRequirement$15(rule) {
-	const rawNist = buildNistTags$3(rule.Source.SourceIdentifier, rule.ConfigRuleName);
+	const rawNist = buildNistTags$4(rule.Source.SourceIdentifier, rule.ConfigRuleName);
 	const nist = rawNist.length > 0 ? rawNist : DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS;
 	const tags = { nist };
 	const descriptions = [{
@@ -5964,7 +6260,7 @@ function buildRequirement$14(checkId, group, scanTime) {
 /**
 * Parses checkov input which can be a single object or array.
 */
-function parseInput(input) {
+function parseInput$1(input) {
 	const parsed = parseJSON(input);
 	if (Array.isArray(parsed)) return parsed;
 	if (!parsed || typeof parsed !== "object") throw new Error("Invalid checkov structure: not a valid JSON object");
@@ -5986,7 +6282,7 @@ async function convertCheckovToHdf(input, converterVersion = "1.0.0") {
 	if (detected && detected.fingerprint.id === "sarif-to-hdf") return convertSarifToHdf(input, converterVersion);
 	const resultsChecksum = await inputChecksum(input);
 	const scanTime = /* @__PURE__ */ new Date();
-	const reports = parseInput(input);
+	const reports = parseInput$1(input);
 	const allChecks = [];
 	const checkTypes = [];
 	let version;
@@ -6052,7 +6348,7 @@ function parseSourceLine(line) {
 * Promotes an issue's file/line locus into the structured HDF sourceLocation
 * field. Returns undefined when the issue carries no file path.
 */
-function buildSourceLocation$4(issue) {
+function buildSourceLocation$5(issue) {
 	if (!issue.file) return;
 	const loc = { ref: issue.file };
 	const line = parseSourceLine(issue.line);
@@ -6108,7 +6404,7 @@ function buildRequirement$13(ruleId, issues, scanTime) {
 		data: `CWE-${rep.cwe.id}: ${rep.cwe.url}`
 	}];
 	const options = { tags };
-	const sourceLocation = buildSourceLocation$4(rep);
+	const sourceLocation = buildSourceLocation$5(rep);
 	if (sourceLocation) options.sourceLocation = sourceLocation;
 	const req = createRequirement(ruleId, rep.details, descriptions, impact, results, options);
 	const cwe = cweIds(rep);
@@ -6200,23 +6496,23 @@ async function convertGosecToHdf(input, converterVersion = "1.0.0") {
 }
 //#endregion
 //#region converters/nikto-to-hdf/typescript/converter.ts
-function buildNistTags$2(niktoId) {
+function buildNistTags$3(niktoId) {
 	const control = getNiktoNistControl(niktoId);
 	if (control) return [control];
 	return [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
 }
-function buildCodeDesc$7(vuln) {
+function buildCodeDesc$8(vuln) {
 	const parts = [];
 	if (vuln.url) parts.push(`URL: ${vuln.url}`);
 	if (vuln.method) parts.push(`Method: ${vuln.method}`);
 	return parts.join(" ");
 }
 function convertVulnToRequirement(vuln) {
-	const nistTags = buildNistTags$2(vuln.id);
+	const nistTags = buildNistTags$3(vuln.id);
 	const cciTags = nistToCci(nistTags);
 	const result = {
 		status: ResultStatus.Failed,
-		codeDesc: buildCodeDesc$7(vuln),
+		codeDesc: buildCodeDesc$8(vuln),
 		startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 	};
 	const extras = {};
@@ -6259,7 +6555,7 @@ async function convertNiktoToHdf(input, converterVersion = "unknown") {
 		const req = convertVulnToRequirement(primary);
 		if (vulns.length > 1) for (let i = 1; i < vulns.length; i++) req.results.push({
 			status: ResultStatus.Failed,
-			codeDesc: buildCodeDesc$7(vulns[i]),
+			codeDesc: buildCodeDesc$8(vulns[i]),
 			startTime: /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 		});
 		requirements.push(req);
@@ -6303,7 +6599,7 @@ function riskCodeToImpact(riskCode) {
 		default: return .5;
 	}
 }
-function buildNistTags$1(cweid) {
+function buildNistTags$2(cweid) {
 	if (cweid && cweid !== "0") {
 		const cweNum = parseInt(cweid, 10);
 		if (!isNaN(cweNum)) {
@@ -6319,7 +6615,7 @@ function buildCwe(cweid) {
 	if (isNaN(cweNum)) return;
 	return [`CWE-${cweNum}`];
 }
-function buildCodeDesc$6(instance) {
+function buildCodeDesc$7(instance) {
 	const parts = [];
 	if (instance.uri) parts.push(`URI: ${instance.uri}`);
 	if (instance.method) parts.push(`Method: ${instance.method}`);
@@ -6342,13 +6638,13 @@ function buildRequirementCode$1(alert) {
 	if (parts.length === 0) return;
 	return parts.join("\n");
 }
-function buildSourceLocation$3(alert) {
+function buildSourceLocation$4(alert) {
 	const inst = (alert.instances ?? []).find((i) => i.uri);
 	if (!inst || !inst.uri) return;
 	return { ref: inst.uri };
 }
 const REF_URL_RE = /https?:\/\/[^\s<>"']+/g;
-function buildRefs$8(reference) {
+function buildRefs$9(reference) {
 	if (!reference) return;
 	const urls = reference.match(REF_URL_RE);
 	if (!urls || urls.length === 0) return;
@@ -6368,7 +6664,7 @@ function buildSiteRequirements(site, startTime) {
 		const count = pluginIdCount.get(alert.pluginid) ?? 0;
 		pluginIdCount.set(alert.pluginid, count + 1);
 		const reqId = count === 0 ? alert.pluginid : `${alert.pluginid}.${count}`;
-		const nistTags = buildNistTags$1(alert.cweid ?? "");
+		const nistTags = buildNistTags$2(alert.cweid ?? "");
 		const cciTags = nistToCci(nistTags);
 		const extras = {};
 		if (alert.wascid) extras.wascid = alert.wascid;
@@ -6383,9 +6679,13 @@ function buildSiteRequirements(site, startTime) {
 			for (const instance of limitedInstances) {
 				const result = {
 					status: ResultStatus.Failed,
-					codeDesc: buildCodeDesc$6(instance),
+					codeDesc: buildCodeDesc$7(instance),
 					startTime
 				};
+				if (instance.uri) {
+					result.resource = "url";
+					result.resourceId = instance.uri;
+				}
 				if (instance.attack) result.message = instance.attack;
 				results.push(result);
 			}
@@ -6421,9 +6721,9 @@ function buildSiteRequirements(site, startTime) {
 		if (controlType !== void 0) req.controlType = controlType;
 		const code = buildRequirementCode$1(alert);
 		if (code !== void 0) req.code = code;
-		const sourceLocation = buildSourceLocation$3(alert);
+		const sourceLocation = buildSourceLocation$4(alert);
 		if (sourceLocation !== void 0) req.sourceLocation = sourceLocation;
-		const refs = buildRefs$8(alert.reference);
+		const refs = buildRefs$9(alert.reference);
 		if (refs !== void 0) req.refs = refs;
 		requirements.push(req);
 	}
@@ -7068,8 +7368,8 @@ function statusOf(req) {
 		if (!o) return [];
 		return [{
 			status: getStr(o, "status") || void 0,
-			appliedAt: getStr(o, "appliedAt") || void 0,
-			expiresAt: getStr(o, "expiresAt") || void 0
+			appliedAt: absentIfGoZeroTime(getStr(o, "appliedAt") || void 0),
+			expiresAt: absentIfGoZeroTime(getStr(o, "expiresAt") || void 0)
 		}];
 	});
 	const impact = typeof req.impact === "number" ? req.impact : 1;
@@ -7306,6 +7606,48 @@ function epochMillis(s) {
 	if (d === null) return void 0;
 	return d.getTime();
 }
+/**
+* The index of the override that governs a requirement — the most recently
+* applied non-expired one — or -1 when none does. The map-shaped twin of
+* shared/go/exportmap GoverningOverrideIndex.
+*
+* Resolution is by appliedAt, never by array position. The schema's description
+* says the most recent override "should be first in array", but nothing sorts
+* and this repo's own writers append, so on a document amended twice the newest
+* override is LAST and overrides[0] is the oldest.
+*
+* An entry that is not an object sorts earliest and never governs, so a
+* malformed override cannot take a whole document's conversion down.
+*/
+function governingOverrideIndexOf(overrides, now) {
+	const inputs = overrides.map((raw) => {
+		const m = asMap(raw);
+		if (!m) return {};
+		return {
+			status: getStr(m, "status") || void 0,
+			appliedAt: getStr(m, "appliedAt") || void 0,
+			expiresAt: getStr(m, "expiresAt") || void 0
+		};
+	});
+	return governingOverrideIndex(inputs, (i) => asMap(overrides[i]) !== void 0, now);
+}
+/** The override object that governs a requirement, or undefined when none does. */
+function governingOverrideOf(overrides, now) {
+	const i = governingOverrideIndexOf(overrides, now);
+	return i >= 0 ? asMap(overrides[i]) : void 0;
+}
+/**
+* The type of the override that governs a requirement, or '' when none does —
+* the map-shaped twin of requirementDisposition, including its no-overrides
+* fallback to the stored field.
+*/
+function disposition(req, now) {
+	const overrides = asArr(req.statusOverrides) ?? [];
+	const gov = governingOverrideOf(overrides, now);
+	if (gov) return getStr(gov, "type");
+	if (overrides.length === 0) return getStr(req, "disposition");
+	return "";
+}
 //#endregion
 //#region converters/cyclonedx-to-hdf/typescript/converter.ts
 const CVSS_METHODS = /* @__PURE__ */ new Set([
@@ -7363,7 +7705,7 @@ function buildCvssEntries$5(ratings) {
 		const hasCvssMethod = r.method !== void 0 && CVSS_METHODS.has(r.method);
 		const hasMetric = r.score !== void 0 && r.score !== null || r.vector !== void 0 && r.vector !== "";
 		if (!hasCvssMethod || !hasMetric) continue;
-		entries.push(buildCvss$3({
+		entries.push(buildCvss$4({
 			version: cvssVersionFromMethod(r.method, r.vector),
 			baseScore: r.score,
 			baseVector: r.vector,
@@ -7378,7 +7720,7 @@ function buildCvssEntries$5(ratings) {
 * de-duplicated across all three in first-seen order. Returns undefined when the
 * vulnerability carries no links.
 */
-function buildRefs$7(vuln) {
+function buildRefs$8(vuln) {
 	const seen = /* @__PURE__ */ new Set();
 	const refs = [];
 	const add = (url) => {
@@ -7392,6 +7734,49 @@ function buildRefs$7(vuln) {
 	return refs.length > 0 ? refs : void 0;
 }
 /**
+* The per-result instance identity for a CycloneDX finding: the affected
+* component's purl, which is what distinguishes the several vulnerabilities that
+* land on different components. purl is optional in CycloneDX, so this falls
+* back to the bom-ref — also document-unique, and the only identifier a VEX
+* document (which carries no components[] to resolve the ref against) publishes
+* at all.
+*/
+function componentInstanceId(componentLookup, ref) {
+	return componentLookup.get(ref)?.purl ?? ref;
+}
+/**
+* Extracts the type segment of a purl ('pkg:maven/...' -> 'maven'). Returns
+* undefined for anything that is not a purl.
+*/
+function purlType(purl) {
+	return purl ? parsePurl(purl)?.type : void 0;
+}
+/**
+* Assembles the requirement's affected-package inventory from the components its
+* affects[] entries resolve to, de-duplicated by ref in first-seen order.
+* Components with neither a purl nor an ecosystem yield no schema-valid entry
+* and are skipped rather than emitted half-built.
+*/
+function buildAffectedPackages(componentLookup, affects) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const affect of affects) {
+		const comp = componentLookup.get(affect.ref);
+		if (!comp || seen.has(affect.ref)) continue;
+		seen.add(affect.ref);
+		const type = purlType(comp.purl);
+		const ecosystem = type ? ecosystemFromPurlType(type) : void 0;
+		const pkg = buildAffectedPackage$1({
+			name: comp.name,
+			version: comp.version,
+			ecosystem,
+			purl: comp.purl
+		});
+		if (pkg) out.push(pkg);
+	}
+	return out;
+}
+/**
 * Formats a component reference as a code_desc string.
 */
 function formatCodeDesc$4(componentLookup, ref) {
@@ -7462,7 +7847,7 @@ function projectLicenseEntry(l) {
 * both languages emit byte-identical code strings. JSON.stringify never escapes
 * `&`/`<`/`>`, matching Go's SetEscapeHTML(false).
 */
-function buildVulnCode$1(vuln) {
+function buildVulnCode$2(vuln) {
 	const proj = {
 		id: vuln.id,
 		source: projectSource(vuln.source),
@@ -7683,19 +8068,28 @@ async function convertCyclonedxToHdf(input, converterVersion = "1.0.0") {
 			data: fixParts.join("\n\n")
 		});
 		const affects = vuln.affects ?? [];
-		const results = affects.length > 0 ? affects.map((affect) => createResult(ResultStatus.Failed, componentSummary(componentLookup, affect.ref), {
-			codeDesc: formatCodeDesc$4(componentLookup, affect.ref),
-			startTime: scanTime
-		})) : [createResult(ResultStatus.Failed, void 0, {
+		const results = affects.length > 0 ? affects.map((affect) => {
+			const instanceId = componentInstanceId(componentLookup, affect.ref);
+			return createResult(ResultStatus.Failed, componentSummary(componentLookup, affect.ref), {
+				codeDesc: formatCodeDesc$4(componentLookup, affect.ref),
+				startTime: scanTime,
+				...instanceId ? {
+					resource: "component",
+					resourceId: instanceId
+				} : {}
+			});
+		}) : [createResult(ResultStatus.Failed, void 0, {
 			codeDesc: `Vulnerability ${vuln.id}`,
 			startTime: scanTime
 		})];
 		const title = vuln.source?.name ? `${vuln.id} (${vuln.source.name})` : vuln.id;
 		const req = createRequirement(vuln.id, title, descriptions, impact, results, { tags });
-		req.code = buildVulnCode$1(vuln);
+		req.code = buildVulnCode$2(vuln);
 		if (cvssEntries.length > 0) req.cvss = cvssEntries;
 		if (cweIds.length > 0) req.cwe = cweIds;
-		const refs = buildRefs$7(vuln);
+		const affectedPackages = buildAffectedPackages(componentLookup, affects);
+		if (affectedPackages.length > 0) req.affectedPackages = affectedPackages;
+		const refs = buildRefs$8(vuln);
 		if (refs !== void 0) req.refs = refs;
 		const controlType = deriveControlTypeFromTags(nist);
 		if (controlType !== void 0) req.controlType = controlType;
@@ -7758,7 +8152,7 @@ function convertHdfToCsv(input) {
 		ipAddress: ""
 	}];
 	for (const baseline of hdf.baselines) {
-		if (!Array.isArray(baseline.requirements) || baseline.requirements.length === 0) throw new Error(`hdf-to-csv: baseline "${text(baseline.name)}" has no requirements`);
+		if (!Array.isArray(baseline.requirements) || baseline.requirements.length === 0) throw new Error(`hdf-to-csv: baseline "${text$1(baseline.name)}" has no requirements`);
 		for (const requirement of baseline.requirements) for (const target of targetList) rows.push(createRow(baseline, requirement, target));
 	}
 	return buildCsv(rows, { sanitize: true });
@@ -7770,7 +8164,7 @@ function convertHdfToCsv(input) {
 * the converters deliberately do not do. Rendering 0 here matches what Go emits,
 * where reading .toFixed off an absent value threw a raw TypeError instead.
 */
-function numeric(value) {
+function numeric$1(value) {
 	return typeof value === "number" ? value : 0;
 }
 /**
@@ -7780,12 +8174,12 @@ function numeric(value) {
 * nothing. Every schema-required STRING cell goes through here; the numeric
 * ones go through numeric(), which serves the same purpose for a different type.
 */
-function text(value) {
+function text$1(value) {
 	return typeof value === "string" ? value : "";
 }
 /** The requirement id as text; also names the requirement in the no-results error. */
 function requirementIdText$1(id) {
-	return text(id);
+	return text$1(id);
 }
 /**
 * Create a CSV row from baseline, requirement, and target data
@@ -7806,14 +8200,14 @@ function createRow(baseline, requirement, target) {
 	const nistControls = extractArrayFromTags(requirement.tags, "nist");
 	const cciControls = extractArrayFromTags(requirement.tags, "cci");
 	const effectiveStatus = requirementEffectiveStatus(requirement);
-	const effectiveImpact = numeric(requirement.effectiveImpact ?? requirement.impact).toFixed(2);
-	const disposition = requirement.disposition ? String(requirement.disposition) : "";
+	const effectiveImpact = numeric$1(requirementEffectiveImpact(requirement)).toFixed(2);
+	const disposition = requirementDisposition(requirement);
 	return {
-		"Baseline ID": text(baseline.name),
+		"Baseline ID": text$1(baseline.name),
 		"Baseline Version": baseline.version || "",
 		"Baseline Title": baseline.title || "",
-		"Target ID": text(target.name),
-		"Target Type": text(target.type),
+		"Target ID": text$1(target.name),
+		"Target Type": text$1(target.type),
 		"Requirement ID": requirementIdText$1(requirement.id),
 		"Requirement Title": requirement.title || "",
 		"Description": description,
@@ -7823,8 +8217,8 @@ function createRow(baseline, requirement, target) {
 		"Code": code,
 		"References": references,
 		"Severity": severity,
-		"Impact": numeric(requirement.impact).toFixed(2),
-		"Status": text(status),
+		"Impact": numeric$1(requirement.impact).toFixed(2),
+		"Status": text$1(status),
 		"NIST Controls": nistControls,
 		"CCI Controls": cciControls,
 		"Control Type": requirement.controlType ?? "",
@@ -7839,7 +8233,7 @@ function createRow(baseline, requirement, target) {
 		"Expires At": joinOverrides(requirement.statusOverrides, (o) => formatExpires(o.expiresAt)),
 		"CVSS": cvssScores(requirement.cvss),
 		"CWE": (requirement.cwe ?? []).join("; "),
-		"EPSS": requirement.epss ? numeric(requirement.epss.score).toFixed(5) : "",
+		"EPSS": requirement.epss ? numeric$1(requirement.epss.score).toFixed(5) : "",
 		"KEV": requirement.kev ? requirement.kev.inKev ? "true" : "false" : "",
 		"Target FQDN": target.fqdn,
 		"Target IP": target.ipAddress
@@ -7918,17 +8312,1211 @@ function descriptionByLabel(requirement, label) {
 * it outright — a reject-versus-degrade split tracked on its own card. Joined with '; ' to
 * match the NIST/CCI column convention.
 */
-function flattenRefs(refs) {
-	if (!Array.isArray(refs)) return "";
-	const out = [];
-	for (const r of refs) {
-		if (!r || typeof r !== "object") continue;
-		const o = r;
-		if (typeof o.url === "string") out.push(o.url);
-		else if (typeof o.uri === "string") out.push(o.uri);
-		else if (typeof o.ref === "string") out.push(o.ref);
+function flattenRefs(refs) {
+	if (!Array.isArray(refs)) return "";
+	const out = [];
+	for (const r of refs) {
+		if (!r || typeof r !== "object") continue;
+		const o = r;
+		if (typeof o.url === "string") out.push(o.url);
+		else if (typeof o.uri === "string") out.push(o.uri);
+		else if (typeof o.ref === "string") out.push(o.ref);
+	}
+	return out.join("; ");
+}
+//#endregion
+//#region converters/hdf-to-html/typescript/assets.ts
+/** The vendored file carries no trailing newline, so one separates it from the report layer. */
+const STYLESHEET = "/*!\n * Blades CSS 🥷 v2.4\n * Copyright 2026 (https://blades.ninja/)\n * Licensed under MIT\n *//*!\n * Pico CSS ✨ v2.5\n * Copyright 2019-2025 (https://picocss.com)\n * Copyright 2026 (https://blades.ninja/css/pico/)\n * Licensed under MIT\n */:host,:scope{--pico-font-family-emoji:\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Segoe UI Symbol\",\"Noto Color Emoji\";--pico-font-family-sans-serif:system-ui,\"Segoe UI\",Roboto,Oxygen,Ubuntu,Cantarell,Helvetica,Arial,\"Helvetica Neue\",sans-serif,var(--pico-font-family-emoji);--pico-font-family-monospace:ui-monospace,SFMono-Regular,\"SF Mono\",Menlo,Consolas,\"Liberation Mono\",monospace,var(--pico-font-family-emoji);--pico-font-family:var(--pico-font-family-sans-serif);--pico-line-height:1.5;--pico-font-weight:400;--pico-font-size:100%;--pico-text-underline-offset:0.1rem;--pico-border-radius:0.25rem;--pico-border-width:0.0625rem;--pico-outline-width:0.125rem;--pico-transition:0.2s ease-in-out;--pico-spacing:1rem;--pico-typography-spacing-vertical:1rem;--pico-block-spacing-vertical:var(--pico-spacing);--pico-block-spacing-horizontal:var(--pico-spacing);--pico-grid-column-gap:var(--pico-spacing);--pico-grid-row-gap:var(--pico-spacing);--pico-form-element-spacing-vertical:0.75rem;--pico-form-element-spacing-horizontal:1rem;--pico-group-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-group-box-shadow-focus-with-button:0 0 0 var(--pico-outline-width) var(--pico-primary-focus);--pico-group-box-shadow-focus-with-input:0 0 0 0.0625rem var(--pico-form-element-border-color);--pico-modal-overlay-backdrop-filter:blur(0.375rem);--pico-nav-element-spacing-vertical:1rem;--pico-nav-element-spacing-horizontal:0.5rem;--pico-nav-link-spacing-vertical:0.5rem;--pico-nav-link-spacing-horizontal:0.5rem;--pico-nav-breadcrumb-divider:\">\";--pico-icon-checkbox:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E\");--pico-icon-minus:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cline x1='5' y1='12' x2='19' y2='12'%3E%3C/line%3E%3C/svg%3E\");--pico-icon-chevron:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(136, 145, 164)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E\");--pico-icon-date:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(136, 145, 164)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Crect x='3' y='4' width='18' height='18' rx='2' ry='2'%3E%3C/rect%3E%3Cline x1='16' y1='2' x2='16' y2='6'%3E%3C/line%3E%3Cline x1='8' y1='2' x2='8' y2='6'%3E%3C/line%3E%3Cline x1='3' y1='10' x2='21' y2='10'%3E%3C/line%3E%3C/svg%3E\");--pico-icon-time:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(136, 145, 164)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cpolyline points='12 6 12 12 16 14'%3E%3C/polyline%3E%3C/svg%3E\");--pico-icon-search:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(136, 145, 164)' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='11' cy='11' r='8'%3E%3C/circle%3E%3Cline x1='21' y1='21' x2='16.65' y2='16.65'%3E%3C/line%3E%3C/svg%3E\");--pico-icon-close:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(136, 145, 164)' stroke-width='3' stroke-linecap='round' stroke-linejoin='round'%3E%3Cline x1='18' y1='6' x2='6' y2='18'%3E%3C/line%3E%3Cline x1='6' y1='6' x2='18' y2='18'%3E%3C/line%3E%3C/svg%3E\");--pico-icon-loading:url(\"data:image/svg+xml,%3Csvg fill='none' height='24' width='24' viewBox='0 0 24 24' xmlns='http://www.w3.org/2000/svg' %3E%3Cstyle%3E g %7B animation: rotate 2s linear infinite; transform-origin: center center; %7D circle %7B stroke-dasharray: 75,100; stroke-dashoffset: -5; animation: dash 1.5s ease-in-out infinite; stroke-linecap: round; %7D @keyframes rotate %7B 0%25 %7B transform: rotate(0deg); %7D 100%25 %7B transform: rotate(360deg); %7D %7D @keyframes dash %7B 0%25 %7B stroke-dasharray: 1,100; stroke-dashoffset: 0; %7D 50%25 %7B stroke-dasharray: 44.5,100; stroke-dashoffset: -17.5; %7D 100%25 %7B stroke-dasharray: 44.5,100; stroke-dashoffset: -62; %7D %7D %3C/style%3E%3Cg%3E%3Ccircle cx='12' cy='12' r='10' fill='none' stroke='rgb(136, 145, 164)' stroke-width='4' /%3E%3C/g%3E%3C/svg%3E\")}@media (min-width:576px){:host,:scope{--pico-font-size:106.25%}}@media (min-width:768px){:host,:scope{--pico-font-size:112.5%}}@media (min-width:1024px){:host,:scope{--pico-font-size:118.75%}}@media (min-width:1280px){:host,:scope{--pico-font-size:125%}}@media (min-width:1536px){:host,:scope{--pico-font-size:131.25%}}a{--pico-text-decoration:underline}a.contrast,a.secondary{--pico-text-decoration:underline}small{--pico-font-size:0.875em}h1,h2,h3,h4,h5,h6{--pico-font-weight:700}h1{--pico-font-size:2rem;--pico-line-height:1.125;--pico-typography-spacing-top:3rem}h2{--pico-font-size:1.75rem;--pico-line-height:1.15;--pico-typography-spacing-top:2.625rem}h3{--pico-font-size:1.5rem;--pico-line-height:1.175;--pico-typography-spacing-top:2.25rem}h4{--pico-font-size:1.25rem;--pico-line-height:1.2;--pico-typography-spacing-top:1.874rem}h5{--pico-font-size:1.125rem;--pico-line-height:1.225;--pico-typography-spacing-top:1.6875rem}h6{--pico-font-size:1rem;--pico-line-height:1.25;--pico-typography-spacing-top:1.5rem}tfoot td,tfoot th,thead td,thead th{--pico-font-weight:600;--pico-border-width:0.1875rem}code,kbd,pre,samp{--pico-font-family:var(--pico-font-family-monospace)}kbd{--pico-font-weight:bolder}:where(select,textarea),input:not(\n[type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[type=file]\n){--pico-outline-width:0.0625rem}[type=search]{--pico-border-radius:5rem}[type=checkbox],[type=radio]{--pico-border-width:0.125rem}[type=checkbox][role=switch]{--pico-border-width:0.1875rem}details.dropdown summary:not([role=button]){--pico-outline-width:0.0625rem}nav details.dropdown summary:focus-visible{--pico-outline-width:0.125rem}[role=search]{--pico-border-radius:5rem}[role=group]:has(\nbutton.secondary:focus,[type=submit].secondary:focus,[type=button].secondary:focus,[role=button].secondary:focus\n),[role=search]:has(\nbutton.secondary:focus,[type=submit].secondary:focus,[type=button].secondary:focus,[role=button].secondary:focus\n){--pico-group-box-shadow-focus-with-button:0 0 0 var(--pico-outline-width) var(--pico-secondary-focus)}[role=group]:has(\nbutton.contrast:focus,[type=submit].contrast:focus,[type=button].contrast:focus,[role=button].contrast:focus\n),[role=search]:has(\nbutton.contrast:focus,[type=submit].contrast:focus,[type=button].contrast:focus,[role=button].contrast:focus\n){--pico-group-box-shadow-focus-with-button:0 0 0 var(--pico-outline-width) var(--pico-contrast-focus)}[role=group] [role=button],[role=group] [type=button],[role=group] [type=submit],[role=group] button,[role=search] [role=button],[role=search] [type=button],[role=search] [type=submit],[role=search] button{--pico-form-element-spacing-horizontal:2rem}details summary[role=button]:not(.outline)::after{filter:brightness(0) invert(1)}[aria-busy=true]:not(input,select,textarea):is(\nbutton,[type=submit],[type=button],[type=reset],[role=button]\n):not(.outline)::before{filter:brightness(0) invert(1)}:host(:not([data-theme=dark])),:scope:not([data-theme=dark]),[data-theme=light]{color-scheme:light;--pico-background-color:#fff;--pico-color:#373c44;--pico-text-selection-color:rgba(2, 154, 232, 0.25);--pico-muted-color:#646b79;--pico-muted-border-color:rgb(231, 234, 239.5);--pico-primary:#0172ad;--pico-primary-background:#0172ad;--pico-primary-border:var(--pico-primary-background);--pico-primary-underline:rgba(1, 114, 173, 0.5);--pico-primary-hover:#015887;--pico-primary-hover-background:#02659a;--pico-primary-hover-border:var(--pico-primary-hover-background);--pico-primary-hover-underline:var(--pico-primary-hover);--pico-primary-focus:rgba(2, 154, 232, 0.5);--pico-primary-inverse:#fff;--pico-secondary:#5d6b89;--pico-secondary-background:#525f7a;--pico-secondary-border:var(--pico-secondary-background);--pico-secondary-underline:rgba(93, 107, 137, 0.5);--pico-secondary-hover:#48536b;--pico-secondary-hover-background:#48536b;--pico-secondary-hover-border:var(--pico-secondary-hover-background);--pico-secondary-hover-underline:var(--pico-secondary-hover);--pico-secondary-focus:rgba(93, 107, 137, 0.25);--pico-secondary-inverse:#fff;--pico-contrast:#181c25;--pico-contrast-background:#181c25;--pico-contrast-border:var(--pico-contrast-background);--pico-contrast-underline:rgba(24, 28, 37, 0.5);--pico-contrast-hover:#000;--pico-contrast-hover-background:#000;--pico-contrast-hover-border:var(--pico-contrast-hover-background);--pico-contrast-hover-underline:var(--pico-secondary-hover);--pico-contrast-focus:rgba(93, 107, 137, 0.25);--pico-contrast-inverse:#fff;--pico-box-shadow:0 0.5rem 2.5rem rgba(129, 145, 181, 0.2);--pico-h1-color:#2d3138;--pico-h2-color:#373c44;--pico-h3-color:#424751;--pico-h4-color:#4d535e;--pico-h5-color:#5c6370;--pico-h6-color:#646b79;--pico-mark-background-color:rgb(252.5, 230.5, 191.5);--pico-mark-color:#0f1114;--pico-ins-color:rgb(28.5, 105.5, 84);--pico-del-color:rgb(136, 56.5, 53);--pico-blockquote-border-color:var(--pico-muted-border-color);--pico-blockquote-footer-color:var(--pico-muted-color);--pico-button-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-button-hover-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-table-border-color:var(--pico-muted-border-color);--pico-table-row-stripped-background-color:rgba(111, 120, 135, 0.0375);--pico-code-background-color:rgb(243, 244.5, 246.75);--pico-code-color:#646b79;--pico-code-kbd-background-color:var(--pico-color);--pico-code-kbd-color:var(--pico-background-color);--pico-form-element-background-color:rgb(251, 251.5, 252.25);--pico-form-element-selected-background-color:#dfe3eb;--pico-form-element-border-color:#cfd5e2;--pico-form-element-color:#23262c;--pico-form-element-placeholder-color:var(--pico-muted-color);--pico-form-element-active-background-color:#fff;--pico-form-element-active-border-color:var(--pico-primary-border);--pico-form-element-focus-color:var(--pico-primary-border);--pico-form-element-disabled-opacity:0.5;--pico-form-element-invalid-border-color:rgb(183.5, 105.5, 106.5);--pico-form-element-invalid-active-border-color:rgb(200.25, 79.25, 72.25);--pico-form-element-invalid-focus-color:var(--pico-form-element-invalid-active-border-color);--pico-form-element-valid-border-color:rgb(76, 154.5, 137.5);--pico-form-element-valid-active-border-color:rgb(39, 152.75, 118.75);--pico-form-element-valid-focus-color:var(--pico-form-element-valid-active-border-color);--pico-switch-background-color:#bfc7d9;--pico-switch-checked-background-color:var(--pico-primary-background);--pico-switch-color:#fff;--pico-switch-thumb-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-range-border-color:#dfe3eb;--pico-range-active-border-color:#bfc7d9;--pico-range-thumb-border-color:var(--pico-background-color);--pico-range-thumb-color:var(--pico-secondary-background);--pico-range-thumb-active-color:var(--pico-primary-background);--pico-accordion-border-color:var(--pico-muted-border-color);--pico-accordion-active-summary-color:var(--pico-primary-hover);--pico-accordion-close-summary-color:var(--pico-color);--pico-accordion-open-summary-color:var(--pico-muted-color);--pico-card-background-color:var(--pico-background-color);--pico-card-border-color:var(--pico-muted-border-color);--pico-card-box-shadow:var(--pico-box-shadow);--pico-card-sectioning-background-color:rgb(251, 251.5, 252.25);--pico-dropdown-background-color:#fff;--pico-dropdown-border-color:#eff1f4;--pico-dropdown-box-shadow:var(--pico-box-shadow);--pico-dropdown-color:var(--pico-color);--pico-dropdown-hover-background-color:#eff1f4;--pico-loading-spinner-opacity:0.5;--pico-modal-overlay-background-color:rgba(232, 234, 237, 0.75);--pico-progress-background-color:#dfe3eb;--pico-progress-color:var(--pico-primary-background);--pico-tooltip-background-color:var(--pico-contrast-background);--pico-tooltip-color:var(--pico-contrast-inverse);--pico-icon-valid:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(76, 154.5, 137.5)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E\");--pico-icon-invalid:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(200.25, 79.25, 72.25)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cline x1='12' y1='8' x2='12' y2='12'%3E%3C/line%3E%3Cline x1='12' y1='16' x2='12.01' y2='16'%3E%3C/line%3E%3C/svg%3E\")}:host(:not([data-theme=dark])) input:is(\n[type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[type=file]\n),:scope:not([data-theme=dark]) input:is(\n[type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[type=file]\n),[data-theme=light] input:is(\n[type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[type=file]\n){--pico-form-element-focus-color:var(--pico-primary-focus)}@media only screen and (prefers-color-scheme:dark){:host(:not([data-theme])),:scope:not([data-theme]){color-scheme:dark;--pico-background-color:rgb(19, 22.5, 30.5);--pico-color:#c2c7d0;--pico-text-selection-color:rgba(1, 170, 255, 0.1875);--pico-muted-color:#7b8495;--pico-muted-border-color:#202632;--pico-primary:#01aaff;--pico-primary-background:#0172ad;--pico-primary-border:var(--pico-primary-background);--pico-primary-underline:rgba(1, 170, 255, 0.5);--pico-primary-hover:#79c0ff;--pico-primary-hover-background:#017fc0;--pico-primary-hover-border:var(--pico-primary-hover-background);--pico-primary-hover-underline:var(--pico-primary-hover);--pico-primary-focus:rgba(1, 170, 255, 0.375);--pico-primary-inverse:#fff;--pico-secondary:#969eaf;--pico-secondary-background:#525f7a;--pico-secondary-border:var(--pico-secondary-background);--pico-secondary-underline:rgba(150, 158, 175, 0.5);--pico-secondary-hover:#b3b9c5;--pico-secondary-hover-background:#5d6b89;--pico-secondary-hover-border:var(--pico-secondary-hover-background);--pico-secondary-hover-underline:var(--pico-secondary-hover);--pico-secondary-focus:rgba(144, 158, 190, 0.25);--pico-secondary-inverse:#fff;--pico-contrast:#dfe3eb;--pico-contrast-background:#eff1f4;--pico-contrast-border:var(--pico-contrast-background);--pico-contrast-underline:rgba(223, 227, 235, 0.5);--pico-contrast-hover:#fff;--pico-contrast-hover-background:#fff;--pico-contrast-hover-border:var(--pico-contrast-hover-background);--pico-contrast-hover-underline:var(--pico-contrast-hover);--pico-contrast-focus:rgba(207, 213, 226, 0.25);--pico-contrast-inverse:#000;--pico-box-shadow:0 0.5rem 2.5rem rgba(7, 8.5, 12, 0.2);--pico-h1-color:#f0f1f3;--pico-h2-color:#e0e3e7;--pico-h3-color:#c2c7d0;--pico-h4-color:#b3b9c5;--pico-h5-color:#a4acba;--pico-h6-color:#8891a4;--pico-mark-background-color:#014063;--pico-mark-color:#fff;--pico-ins-color:#62af9a;--pico-del-color:rgb(205.5, 126, 123);--pico-blockquote-border-color:var(--pico-muted-border-color);--pico-blockquote-footer-color:var(--pico-muted-color);--pico-button-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-button-hover-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-table-border-color:var(--pico-muted-border-color);--pico-table-row-stripped-background-color:rgba(111, 120, 135, 0.0375);--pico-code-background-color:rgb(26, 30.5, 40.25);--pico-code-color:#8891a4;--pico-code-kbd-background-color:var(--pico-color);--pico-code-kbd-color:var(--pico-background-color);--pico-form-element-background-color:rgb(28, 33, 43.5);--pico-form-element-selected-background-color:#2a3140;--pico-form-element-border-color:#2a3140;--pico-form-element-color:#e0e3e7;--pico-form-element-placeholder-color:#8891a4;--pico-form-element-active-background-color:rgb(26, 30.5, 40.25);--pico-form-element-active-border-color:var(--pico-primary-border);--pico-form-element-focus-color:var(--pico-primary-border);--pico-form-element-disabled-opacity:0.5;--pico-form-element-invalid-border-color:rgb(149.5, 74, 80);--pico-form-element-invalid-active-border-color:rgb(183.25, 63.5, 59);--pico-form-element-invalid-focus-color:var(--pico-form-element-invalid-active-border-color);--pico-form-element-valid-border-color:#2a7b6f;--pico-form-element-valid-active-border-color:rgb(22, 137, 105.5);--pico-form-element-valid-focus-color:var(--pico-form-element-valid-active-border-color);--pico-switch-background-color:#333c4e;--pico-switch-checked-background-color:var(--pico-primary-background);--pico-switch-color:#fff;--pico-switch-thumb-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-range-border-color:#202632;--pico-range-active-border-color:#2a3140;--pico-range-thumb-border-color:var(--pico-background-color);--pico-range-thumb-color:var(--pico-secondary-background);--pico-range-thumb-active-color:var(--pico-primary-background);--pico-accordion-border-color:var(--pico-muted-border-color);--pico-accordion-active-summary-color:var(--pico-primary-hover);--pico-accordion-close-summary-color:var(--pico-color);--pico-accordion-open-summary-color:var(--pico-muted-color);--pico-card-background-color:#181c25;--pico-card-border-color:var(--pico-card-background-color);--pico-card-box-shadow:var(--pico-box-shadow);--pico-card-sectioning-background-color:rgb(26, 30.5, 40.25);--pico-dropdown-background-color:#181c25;--pico-dropdown-border-color:#202632;--pico-dropdown-box-shadow:var(--pico-box-shadow);--pico-dropdown-color:var(--pico-color);--pico-dropdown-hover-background-color:#202632;--pico-loading-spinner-opacity:0.5;--pico-modal-overlay-background-color:rgba(7.5, 8.5, 10, 0.75);--pico-progress-background-color:#202632;--pico-progress-color:var(--pico-primary-background);--pico-tooltip-background-color:var(--pico-contrast-background);--pico-tooltip-color:var(--pico-contrast-inverse);--pico-icon-valid:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(42, 123, 111)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E\");--pico-icon-invalid:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(149.5, 74, 80)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cline x1='12' y1='8' x2='12' y2='12'%3E%3C/line%3E%3Cline x1='12' y1='16' x2='12.01' y2='16'%3E%3C/line%3E%3C/svg%3E\")}:host(:not([data-theme])) input:is(\n[type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[type=file]\n),:scope:not([data-theme]) input:is(\n[type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[type=file]\n){--pico-form-element-focus-color:var(--pico-primary-focus)}:host(:not([data-theme])) details summary[role=button].contrast:not(.outline)::after,:scope:not([data-theme]) details summary[role=button].contrast:not(.outline)::after{filter:brightness(0)}:host(:not([data-theme])) [aria-busy=true]:not(input,select,textarea).contrast:is(\nbutton,[type=submit],[type=button],[type=reset],[role=button]\n):not(.outline)::before,:scope:not([data-theme]) [aria-busy=true]:not(input,select,textarea).contrast:is(\nbutton,[type=submit],[type=button],[type=reset],[role=button]\n):not(.outline)::before{filter:brightness(0)}}[data-theme=dark]{color-scheme:dark;--pico-background-color:rgb(19, 22.5, 30.5);--pico-color:#c2c7d0;--pico-text-selection-color:rgba(1, 170, 255, 0.1875);--pico-muted-color:#7b8495;--pico-muted-border-color:#202632;--pico-primary:#01aaff;--pico-primary-background:#0172ad;--pico-primary-border:var(--pico-primary-background);--pico-primary-underline:rgba(1, 170, 255, 0.5);--pico-primary-hover:#79c0ff;--pico-primary-hover-background:#017fc0;--pico-primary-hover-border:var(--pico-primary-hover-background);--pico-primary-hover-underline:var(--pico-primary-hover);--pico-primary-focus:rgba(1, 170, 255, 0.375);--pico-primary-inverse:#fff;--pico-secondary:#969eaf;--pico-secondary-background:#525f7a;--pico-secondary-border:var(--pico-secondary-background);--pico-secondary-underline:rgba(150, 158, 175, 0.5);--pico-secondary-hover:#b3b9c5;--pico-secondary-hover-background:#5d6b89;--pico-secondary-hover-border:var(--pico-secondary-hover-background);--pico-secondary-hover-underline:var(--pico-secondary-hover);--pico-secondary-focus:rgba(144, 158, 190, 0.25);--pico-secondary-inverse:#fff;--pico-contrast:#dfe3eb;--pico-contrast-background:#eff1f4;--pico-contrast-border:var(--pico-contrast-background);--pico-contrast-underline:rgba(223, 227, 235, 0.5);--pico-contrast-hover:#fff;--pico-contrast-hover-background:#fff;--pico-contrast-hover-border:var(--pico-contrast-hover-background);--pico-contrast-hover-underline:var(--pico-contrast-hover);--pico-contrast-focus:rgba(207, 213, 226, 0.25);--pico-contrast-inverse:#000;--pico-box-shadow:0 0.5rem 2.5rem rgba(7, 8.5, 12, 0.2);--pico-h1-color:#f0f1f3;--pico-h2-color:#e0e3e7;--pico-h3-color:#c2c7d0;--pico-h4-color:#b3b9c5;--pico-h5-color:#a4acba;--pico-h6-color:#8891a4;--pico-mark-background-color:#014063;--pico-mark-color:#fff;--pico-ins-color:#62af9a;--pico-del-color:rgb(205.5, 126, 123);--pico-blockquote-border-color:var(--pico-muted-border-color);--pico-blockquote-footer-color:var(--pico-muted-color);--pico-button-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-button-hover-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-table-border-color:var(--pico-muted-border-color);--pico-table-row-stripped-background-color:rgba(111, 120, 135, 0.0375);--pico-code-background-color:rgb(26, 30.5, 40.25);--pico-code-color:#8891a4;--pico-code-kbd-background-color:var(--pico-color);--pico-code-kbd-color:var(--pico-background-color);--pico-form-element-background-color:rgb(28, 33, 43.5);--pico-form-element-selected-background-color:#2a3140;--pico-form-element-border-color:#2a3140;--pico-form-element-color:#e0e3e7;--pico-form-element-placeholder-color:#8891a4;--pico-form-element-active-background-color:rgb(26, 30.5, 40.25);--pico-form-element-active-border-color:var(--pico-primary-border);--pico-form-element-focus-color:var(--pico-primary-border);--pico-form-element-disabled-opacity:0.5;--pico-form-element-invalid-border-color:rgb(149.5, 74, 80);--pico-form-element-invalid-active-border-color:rgb(183.25, 63.5, 59);--pico-form-element-invalid-focus-color:var(--pico-form-element-invalid-active-border-color);--pico-form-element-valid-border-color:#2a7b6f;--pico-form-element-valid-active-border-color:rgb(22, 137, 105.5);--pico-form-element-valid-focus-color:var(--pico-form-element-valid-active-border-color);--pico-switch-background-color:#333c4e;--pico-switch-checked-background-color:var(--pico-primary-background);--pico-switch-color:#fff;--pico-switch-thumb-box-shadow:0 0 0 rgba(0, 0, 0, 0);--pico-range-border-color:#202632;--pico-range-active-border-color:#2a3140;--pico-range-thumb-border-color:var(--pico-background-color);--pico-range-thumb-color:var(--pico-secondary-background);--pico-range-thumb-active-color:var(--pico-primary-background);--pico-accordion-border-color:var(--pico-muted-border-color);--pico-accordion-active-summary-color:var(--pico-primary-hover);--pico-accordion-close-summary-color:var(--pico-color);--pico-accordion-open-summary-color:var(--pico-muted-color);--pico-card-background-color:#181c25;--pico-card-border-color:var(--pico-card-background-color);--pico-card-box-shadow:var(--pico-box-shadow);--pico-card-sectioning-background-color:rgb(26, 30.5, 40.25);--pico-dropdown-background-color:#181c25;--pico-dropdown-border-color:#202632;--pico-dropdown-box-shadow:var(--pico-box-shadow);--pico-dropdown-color:var(--pico-color);--pico-dropdown-hover-background-color:#202632;--pico-loading-spinner-opacity:0.5;--pico-modal-overlay-background-color:rgba(7.5, 8.5, 10, 0.75);--pico-progress-background-color:#202632;--pico-progress-color:var(--pico-primary-background);--pico-tooltip-background-color:var(--pico-contrast-background);--pico-tooltip-color:var(--pico-contrast-inverse);--pico-icon-valid:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(42, 123, 111)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E\");--pico-icon-invalid:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(149.5, 74, 80)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cline x1='12' y1='8' x2='12' y2='12'%3E%3C/line%3E%3Cline x1='12' y1='16' x2='12.01' y2='16'%3E%3C/line%3E%3C/svg%3E\")}[data-theme=dark] input:is(\n[type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[type=file]\n){--pico-form-element-focus-color:var(--pico-primary-focus)}[data-theme=dark] details summary[role=button].contrast:not(.outline)::after{filter:brightness(0)}[data-theme=dark] [aria-busy=true]:not(input,select,textarea).contrast:is(\nbutton,[type=submit],[type=button],[type=reset],[role=button]\n):not(.outline)::before{filter:brightness(0)}[type=checkbox],[type=radio],[type=range],progress{accent-color:var(--pico-primary)}*,::after,::before{box-sizing:border-box;background-repeat:no-repeat}::after,::before{text-decoration:inherit;vertical-align:inherit}:where(:host),:where(:scope){-webkit-tap-highlight-color:transparent;-webkit-text-size-adjust:100%;-moz-text-size-adjust:100%;text-size-adjust:100%;background-color:var(--pico-background-color);color:var(--pico-color);font-weight:var(--pico-font-weight);font-size:var(--pico-font-size);line-height:var(--pico-line-height);font-family:var(--pico-font-family);text-underline-offset:var(--pico-text-underline-offset);text-rendering:optimizeLegibility;overflow-wrap:break-word;-moz-tab-size:4;-o-tab-size:4;tab-size:4}body{width:100%;margin:0}main{display:block}body>footer,body>header,body>main{padding-block:var(--pico-block-spacing-vertical)}section{margin-bottom:var(--pico-block-spacing-vertical)}.container,.container-fluid{width:100%;margin-right:auto;margin-left:auto;padding-right:var(--pico-spacing);padding-left:var(--pico-spacing)}@media (min-width:576px){.container{max-width:510px;padding-right:0;padding-left:0}}@media (min-width:768px){.container{max-width:700px}}@media (min-width:1024px){.container{max-width:950px}}@media (min-width:1280px){.container{max-width:1200px}}@media (min-width:1536px){.container{max-width:1450px}}.grid{grid-column-gap:var(--pico-grid-column-gap);grid-row-gap:var(--pico-grid-row-gap);display:grid;grid-template-columns:1fr}@media (min-width:768px){.grid{grid-template-columns:repeat(auto-fit,minmax(0%,1fr))}}.grid>:not(.does-not-exist){min-width:0;margin-bottom:0}.overflow-auto{overflow:auto}b,strong{font-weight:bolder}sub,sup{position:relative;font-size:.75em;line-height:0;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}address,blockquote,dl,ol,p,pre,table,ul{margin-top:0;margin-bottom:var(--pico-typography-spacing-vertical);color:var(--pico-color);font-style:normal;font-weight:var(--pico-font-weight)}h1,h2,h3,h4,h5,h6{margin-top:0;margin-bottom:var(--pico-typography-spacing-vertical);color:var(--pico-color);font-weight:var(--pico-font-weight);font-size:var(--pico-font-size);line-height:var(--pico-line-height);font-family:var(--pico-font-family)}h1{--pico-color:var(--pico-h1-color)}h2{--pico-color:var(--pico-h2-color)}h3{--pico-color:var(--pico-h3-color)}h4{--pico-color:var(--pico-h4-color)}h5{--pico-color:var(--pico-h5-color)}h6{--pico-color:var(--pico-h6-color)}:where(article,address,blockquote,dl,figure,form,ol,p,pre,table,ul)~:is(h1,h2,h3,h4,h5,h6){margin-top:var(--pico-typography-spacing-top)}p{margin-bottom:var(--pico-typography-spacing-vertical)}hgroup{margin-bottom:var(--pico-typography-spacing-vertical)}hgroup>*{margin-top:0;margin-bottom:0}hgroup>:not(:first-child):last-child{--pico-color:var(--pico-muted-color);--pico-font-weight:unset;font-size:1rem}:where(ol,ul) li{margin-bottom:calc(var(--pico-typography-spacing-vertical) * .25)}:where(dl,ol,ul) :where(dl,ol,ul){margin:0;margin-top:calc(var(--pico-typography-spacing-vertical) * .25)}ul li{list-style:square}mark{padding:.125rem .25rem;background-color:var(--pico-mark-background-color);color:var(--pico-mark-color);vertical-align:baseline}blockquote{display:block;margin:var(--pico-typography-spacing-vertical) 0;padding:var(--pico-spacing);border-right:none;border-left:.25rem solid var(--pico-blockquote-border-color);border-inline-start:0.25rem solid var(--pico-blockquote-border-color);border-inline-end:none}blockquote footer{margin-top:calc(var(--pico-typography-spacing-vertical) * .5);color:var(--pico-blockquote-footer-color)}abbr[title]{border-bottom:1px dotted;text-decoration:none;cursor:help}ins{color:var(--pico-ins-color);text-decoration:none}del{color:var(--pico-del-color)}::-moz-selection{background-color:var(--pico-text-selection-color)}::selection{background-color:var(--pico-text-selection-color)}:where(a:not([role=button])),[role=link]{--pico-color:var(--pico-primary);--pico-background-color:transparent;--pico-underline:var(--pico-primary-underline);outline:0;background-color:var(--pico-background-color);color:var(--pico-color);-webkit-text-decoration:var(--pico-text-decoration);text-decoration:var(--pico-text-decoration);text-decoration-color:var(--pico-underline);text-underline-offset:0.125em;transition:background-color var(--pico-transition),color var(--pico-transition),box-shadow var(--pico-transition),-webkit-text-decoration var(--pico-transition);transition:background-color var(--pico-transition),color var(--pico-transition),text-decoration var(--pico-transition),box-shadow var(--pico-transition);transition:background-color var(--pico-transition),color var(--pico-transition),text-decoration var(--pico-transition),box-shadow var(--pico-transition),-webkit-text-decoration var(--pico-transition)}:where(a:not([role=button])):is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n),[role=link]:is([aria-current]:not([aria-current=false]),:hover,:active,:focus){--pico-color:var(--pico-primary-hover);--pico-underline:var(--pico-primary-hover-underline);--pico-text-decoration:underline}:where(a:not([role=button])):focus-visible,[role=link]:focus-visible{box-shadow:0 0 0 var(--pico-outline-width) var(--pico-primary-focus)}:where(a:not([role=button])).secondary,[role=link].secondary{--pico-color:var(--pico-secondary);--pico-underline:var(--pico-secondary-underline)}:where(a:not([role=button])).secondary:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n),[role=link].secondary:is([aria-current]:not([aria-current=false]),:hover,:active,:focus){--pico-color:var(--pico-secondary-hover);--pico-underline:var(--pico-secondary-hover-underline)}:where(a:not([role=button])).contrast,[role=link].contrast{--pico-color:var(--pico-contrast);--pico-underline:var(--pico-contrast-underline)}:where(a:not([role=button])).contrast:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n),[role=link].contrast:is([aria-current]:not([aria-current=false]),:hover,:active,:focus){--pico-color:var(--pico-contrast-hover);--pico-underline:var(--pico-contrast-hover-underline)}a[role=button]{display:inline-block}button{margin:0;overflow:visible;font-family:inherit;text-transform:none}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}[role=button],[type=button],[type=file]::file-selector-button,[type=reset],[type=submit],button{--pico-background-color:var(--pico-primary-background);--pico-border-color:var(--pico-primary-border);--pico-color:var(--pico-primary-inverse);--pico-box-shadow:var(--pico-button-box-shadow, 0 0 0 rgba(0, 0, 0, 0));padding:var(--pico-form-element-spacing-vertical) var(--pico-form-element-spacing-horizontal);border:var(--pico-border-width) solid var(--pico-border-color);border-radius:var(--pico-border-radius);outline:0;background-color:var(--pico-background-color);box-shadow:var(--pico-box-shadow);color:var(--pico-color);font-weight:var(--pico-font-weight);font-size:1rem;line-height:var(--pico-line-height);text-align:center;text-decoration:none;cursor:pointer;-webkit-user-select:none;-moz-user-select:none;transition:background-color var(--pico-transition),border-color var(--pico-transition),color var(--pico-transition),box-shadow var(--pico-transition);user-select:none}[role=button]:is(:hover,:active,:focus),[role=button]:is([aria-current]:not([aria-current=false])),[type=button]:is(:hover,:active,:focus),[type=button]:is([aria-current]:not([aria-current=false])),[type=file]::file-selector-button:is(:hover,:active,:focus),[type=file]::file-selector-button:is([aria-current]:not([aria-current=false])),[type=reset]:is(:hover,:active,:focus),[type=reset]:is([aria-current]:not([aria-current=false])),[type=submit]:is(:hover,:active,:focus),[type=submit]:is([aria-current]:not([aria-current=false])),button:is(:hover,:active,:focus),button:is([aria-current]:not([aria-current=false])){--pico-background-color:var(--pico-primary-hover-background);--pico-border-color:var(--pico-primary-hover-border);--pico-box-shadow:var(--pico-button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0));--pico-color:var(--pico-primary-inverse)}[role=button]:focus,[role=button]:is([aria-current]:not([aria-current=false])):focus,[type=button]:focus,[type=button]:is([aria-current]:not([aria-current=false])):focus,[type=file]::file-selector-button:focus,[type=file]::file-selector-button:is([aria-current]:not([aria-current=false])):focus,[type=reset]:focus,[type=reset]:is([aria-current]:not([aria-current=false])):focus,[type=submit]:focus,[type=submit]:is([aria-current]:not([aria-current=false])):focus,button:focus,button:is([aria-current]:not([aria-current=false])):focus{--pico-box-shadow:var(--pico-button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0)),0 0 0 var(--pico-outline-width) var(--pico-primary-focus)}[type=button],[type=reset],[type=submit]{margin-bottom:var(--pico-spacing)}:is(button,[type=submit],[type=button],[role=button]).secondary,[type=file]::file-selector-button,[type=reset]{--pico-background-color:var(--pico-secondary-background);--pico-border-color:var(--pico-secondary-border);--pico-color:var(--pico-secondary-inverse);cursor:pointer}:is(button,[type=submit],[type=button],[role=button]).secondary:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n),[type=file]::file-selector-button:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n),[type=reset]:is([aria-current]:not([aria-current=false]),:hover,:active,:focus){--pico-background-color:var(--pico-secondary-hover-background);--pico-border-color:var(--pico-secondary-hover-border);--pico-color:var(--pico-secondary-inverse)}:is(button,[type=submit],[type=button],[role=button]).secondary:focus,:is(button,[type=submit],[type=button],[role=button]).secondary:is(\n[aria-current]:not([aria-current=false])\n):focus,[type=file]::file-selector-button:focus,[type=file]::file-selector-button:is([aria-current]:not([aria-current=false])):focus,[type=reset]:focus,[type=reset]:is([aria-current]:not([aria-current=false])):focus{--pico-box-shadow:var(--pico-button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0)),0 0 0 var(--pico-outline-width) var(--pico-secondary-focus)}:is(button,[type=submit],[type=button],[role=button]).contrast{--pico-background-color:var(--pico-contrast-background);--pico-border-color:var(--pico-contrast-border);--pico-color:var(--pico-contrast-inverse)}:is(button,[type=submit],[type=button],[role=button]).contrast:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n){--pico-background-color:var(--pico-contrast-hover-background);--pico-border-color:var(--pico-contrast-hover-border);--pico-color:var(--pico-contrast-inverse)}:is(button,[type=submit],[type=button],[role=button]).contrast:focus,:is(button,[type=submit],[type=button],[role=button]).contrast:is(\n[aria-current]:not([aria-current=false])\n):focus{--pico-box-shadow:var(--pico-button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0)),0 0 0 var(--pico-outline-width) var(--pico-contrast-focus)}:is(button,[type=submit],[type=button],[role=button]).outline,[type=reset].outline{--pico-background-color:transparent;--pico-color:var(--pico-primary);--pico-border-color:var(--pico-primary)}:is(button,[type=submit],[type=button],[role=button]).outline:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n),[type=reset].outline:is([aria-current]:not([aria-current=false]),:hover,:active,:focus){--pico-background-color:transparent;--pico-color:var(--pico-primary-hover);--pico-border-color:var(--pico-primary-hover)}:is(button,[type=submit],[type=button],[role=button]).outline.secondary,[type=reset].outline{--pico-color:var(--pico-secondary);--pico-border-color:var(--pico-secondary)}:is(button,[type=submit],[type=button],[role=button]).outline.secondary:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n),[type=reset].outline:is([aria-current]:not([aria-current=false]),:hover,:active,:focus){--pico-color:var(--pico-secondary-hover);--pico-border-color:var(--pico-secondary-hover)}:is(button,[type=submit],[type=button],[role=button]).outline.contrast{--pico-color:var(--pico-contrast);--pico-border-color:var(--pico-contrast)}:is(button,[type=submit],[type=button],[role=button]).outline.contrast:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n){--pico-color:var(--pico-contrast-hover);--pico-border-color:var(--pico-contrast-hover)}:where(button,[type=submit],[type=reset],[type=button],[role=button])[disabled],:where(fieldset[disabled]) :is(button,[type=submit],[type=button],[type=reset],[role=button]){opacity:.5;pointer-events:none}:where(table){width:100%;border-collapse:collapse;border-spacing:0;text-indent:0}td,th{padding:calc(var(--pico-spacing)/ 2) var(--pico-spacing);border-bottom:var(--pico-border-width) solid var(--pico-table-border-color);background-color:var(--pico-background-color);color:var(--pico-color);font-weight:var(--pico-font-weight);text-align:start}tfoot td,tfoot th{border-top:var(--pico-border-width) solid var(--pico-table-border-color);border-bottom:0}table.striped tbody tr:nth-child(odd) td,table.striped tbody tr:nth-child(odd) th{background-color:var(--pico-table-row-stripped-background-color)}:where(audio,canvas,iframe,img,svg,video){vertical-align:middle}audio,video{display:inline-block}audio:not([controls]){display:none;height:0}:where(iframe){border-style:none}img:not([height]){max-width:100%;height:auto}img{border-style:none}:where(svg:not([fill])){fill:currentColor}svg:not(:host),svg:not(:scope){overflow:hidden}code,kbd,pre,samp,var{font-size:.875em;font-family:var(--pico-font-family)}pre code,pre samp{font-size:inherit;font-family:inherit}pre{-ms-overflow-style:scrollbar;overflow:auto}code,kbd,pre,samp,var{border-radius:var(--pico-border-radius);background:var(--pico-code-background-color);color:var(--pico-code-color);font-weight:var(--pico-font-weight);line-height:initial}code,kbd,samp,var{display:inline-block;padding:.375rem}pre{display:block;margin-bottom:var(--pico-spacing);overflow-x:auto}pre>code,pre>samp{display:block;padding:var(--pico-spacing);background:0 0;line-height:var(--pico-line-height)}kbd{background-color:var(--pico-code-kbd-background-color);color:var(--pico-code-kbd-color);vertical-align:baseline}figure{display:block;margin:0;padding:0}figure figcaption{padding:calc(var(--pico-spacing) * .5) 0;color:var(--pico-muted-color)}hr{height:0;margin:var(--pico-typography-spacing-vertical) 0;border:0;border-top:1px solid var(--pico-muted-border-color);color:inherit}[hidden],template{display:none!important}canvas{display:inline-block}input,optgroup,select,textarea{margin:0;font-size:1rem;line-height:var(--pico-line-height);font-family:inherit;letter-spacing:inherit}input{overflow:visible}select{text-transform:none}legend{max-width:100%;padding:0;color:inherit;white-space:normal}textarea{overflow:auto}[type=checkbox],[type=radio]{padding:0}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}::-moz-focus-inner{padding:0;border-style:none}:-moz-focusring{outline:0}:-moz-ui-invalid{box-shadow:none}::-ms-expand{display:none}[type=file],[type=range]{padding:0;border-width:0}input:not([type=checkbox],[type=radio],[type=range]){height:calc(1rem * var(--pico-line-height) + var(--pico-form-element-spacing-vertical) * 2 + var(--pico-border-width) * 2)}fieldset{width:100%;min-width:0;margin:0;margin-bottom:var(--pico-spacing);padding:0;border:0}fieldset legend,label{display:block;margin-bottom:calc(var(--pico-spacing) * .375);color:var(--pico-color);font-weight:var(--pico-form-label-font-weight,var(--pico-font-weight))}fieldset legend{margin-bottom:calc(var(--pico-spacing) * .5)}button[type=submit],input:not([type=checkbox],[type=radio]),select,textarea{width:100%}input:not([type=checkbox],[type=radio],[type=range],[type=file]),select,textarea{-webkit-appearance:none;-moz-appearance:none;appearance:none;padding:var(--pico-form-element-spacing-vertical) var(--pico-form-element-spacing-horizontal)}input,select,textarea{--pico-background-color:var(--pico-form-element-background-color);--pico-border-color:var(--pico-form-element-border-color);--pico-color:var(--pico-form-element-color);--pico-box-shadow:none;border:var(--pico-border-width) solid var(--pico-border-color);border-radius:var(--pico-border-radius);outline:0;background-color:var(--pico-background-color);box-shadow:var(--pico-box-shadow);color:var(--pico-color);font-weight:var(--pico-font-weight);transition:background-color var(--pico-transition),border-color var(--pico-transition),color var(--pico-transition),box-shadow var(--pico-transition)}:where(select,textarea):not([readonly]):is(:active,:focus),input:not(\n[type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[readonly]\n):is(:active,:focus){--pico-background-color:var(--pico-form-element-active-background-color)}:where(select,textarea):not([readonly]):is(:active,:focus),input:not([type=submit],[type=button],[type=reset],[role=switch],[readonly]):is(\n:active,:focus\n){--pico-border-color:var(--pico-form-element-active-border-color)}:where(select,textarea):not([readonly]):focus,input:not(\n[type=submit],[type=button],[type=reset],[type=range],[type=file],[readonly]\n):focus{--pico-box-shadow:0 0 0 var(--pico-outline-width) var(--pico-form-element-focus-color)}:where(fieldset[disabled]) :is(input:not([type=submit],[type=button],[type=reset]),select,textarea),input:not([type=submit],[type=button],[type=reset])[disabled],label[aria-disabled=true],select[disabled],textarea[disabled]{opacity:var(--pico-form-element-disabled-opacity);pointer-events:none}label[aria-disabled=true] input[disabled]{opacity:1}:where(input,select,textarea):not(\n[type=checkbox],[type=radio],[type=date],[type=datetime-local],[type=month],[type=time],[type=week],[type=range]\n)[aria-invalid]{padding-right:calc(var(--pico-form-element-spacing-horizontal) + 1.5rem)!important;padding-left:var(--pico-form-element-spacing-horizontal);padding-inline-start:var(--pico-form-element-spacing-horizontal)!important;padding-inline-end:calc(var(--pico-form-element-spacing-horizontal) + 1.5rem)!important;background-position:center right .75rem;background-size:1rem auto;background-repeat:no-repeat}:where(input,select,textarea):not(\n[type=checkbox],[type=radio],[type=date],[type=datetime-local],[type=month],[type=time],[type=week],[type=range]\n)[aria-invalid=false]:not(select){background-image:var(--pico-icon-valid)}:where(input,select,textarea):not(\n[type=checkbox],[type=radio],[type=date],[type=datetime-local],[type=month],[type=time],[type=week],[type=range]\n)[aria-invalid=true]:not(select){background-image:var(--pico-icon-invalid)}:where(input,select,textarea)[aria-invalid=false]{--pico-border-color:var(--pico-form-element-valid-border-color)}:where(input,select,textarea)[aria-invalid=false]:is(:active,:focus){--pico-border-color:var(--pico-form-element-valid-active-border-color)!important}:where(input,select,textarea)[aria-invalid=false]:is(:active,:focus):not(\n[type=checkbox],[type=radio]\n){--pico-box-shadow:0 0 0 var(--pico-outline-width) var(--pico-form-element-valid-focus-color)!important}:where(input,select,textarea)[aria-invalid=true]{--pico-border-color:var(--pico-form-element-invalid-border-color)}:where(input,select,textarea)[aria-invalid=true]:is(:active,:focus){--pico-border-color:var(--pico-form-element-invalid-active-border-color)!important}:where(input,select,textarea)[aria-invalid=true]:is(:active,:focus):not(\n[type=checkbox],[type=radio]\n){--pico-box-shadow:0 0 0 var(--pico-outline-width) var(--pico-form-element-invalid-focus-color)!important}[dir=rtl] :where(input,select,textarea):not([type=checkbox],[type=radio]):is(\n[aria-invalid],[aria-invalid=true],[aria-invalid=false]\n){background-position:center left .75rem}input::-webkit-input-placeholder,input::placeholder,select:invalid,textarea::-webkit-input-placeholder,textarea::placeholder{color:var(--pico-form-element-placeholder-color);opacity:1}input:not([type=checkbox],[type=radio]),select,textarea{margin-bottom:var(--pico-spacing)}select::-ms-expand{border:0;background-color:transparent}select:not([multiple],[size]){padding-right:calc(var(--pico-form-element-spacing-horizontal) + 1.5rem);padding-left:var(--pico-form-element-spacing-horizontal);padding-inline-start:var(--pico-form-element-spacing-horizontal);padding-inline-end:calc(var(--pico-form-element-spacing-horizontal) + 1.5rem);background-image:var(--pico-icon-chevron);background-position:center right .75rem;background-size:1rem auto;background-repeat:no-repeat}select[multiple] option:checked{background:var(--pico-form-element-selected-background-color);color:var(--pico-form-element-color)}[dir=rtl] select:not([multiple],[size]){background-position:center left .75rem}textarea{display:block;resize:vertical}textarea[aria-invalid]{--pico-icon-height:calc(\n    1rem * var(--pico-line-height) + var(--pico-form-element-spacing-vertical) * 2 +\n      var(--pico-border-width) * 2\n  );background-position:top right .75rem!important;background-size:1rem var(--pico-icon-height)!important}:where(input,select,textarea,fieldset,.grid)+small{display:block;width:100%;margin-top:calc(var(--pico-spacing) * -.75);margin-bottom:var(--pico-spacing);color:var(--pico-muted-color)}:where(input,select,textarea,fieldset,.grid)[aria-invalid=false]+small{color:var(--pico-ins-color)}:where(input,select,textarea,fieldset,.grid)[aria-invalid=true]+small{color:var(--pico-del-color)}label>:where(input,select,textarea){margin-top:calc(var(--pico-spacing) * .25)}label:has([type=checkbox],[type=radio]){width:-moz-fit-content;width:fit-content;cursor:pointer}[type=checkbox],[type=radio]{-webkit-appearance:none;-moz-appearance:none;appearance:none;width:1.25em;height:1.25em;margin-top:-.125em;margin-inline-end:.5em;border-width:var(--pico-border-width);vertical-align:middle;cursor:pointer}[type=checkbox]::-ms-check,[type=radio]::-ms-check{display:none}[type=checkbox]:checked,[type=checkbox]:checked:active,[type=checkbox]:checked:focus,[type=radio]:checked,[type=radio]:checked:active,[type=radio]:checked:focus{--pico-background-color:var(--pico-primary-background);--pico-border-color:var(--pico-primary-border);background-image:var(--pico-icon-checkbox);background-position:center;background-size:.75em auto;background-repeat:no-repeat}[type=checkbox]~label,[type=radio]~label{display:inline-block;margin-bottom:0;cursor:pointer}[type=checkbox]~label:not(:last-of-type),[type=radio]~label:not(:last-of-type){margin-inline-end:1em}[type=checkbox]:indeterminate{--pico-background-color:var(--pico-primary-background);--pico-border-color:var(--pico-primary-border);background-image:var(--pico-icon-minus);background-position:center;background-size:.75em auto;background-repeat:no-repeat}[type=radio]{border-radius:50%}[type=radio]:checked,[type=radio]:checked:active,[type=radio]:checked:focus{--pico-background-color:var(--pico-primary-inverse);border-width:.35em;background-image:none}[type=checkbox][role=switch]{--pico-background-color:var(--pico-switch-background-color);--pico-color:var(--pico-switch-color);width:2.25em;height:1.25em;border:var(--pico-border-width) solid var(--pico-border-color);border-radius:1.25em;background-color:var(--pico-background-color);line-height:1.25em}[type=checkbox][role=switch]:not([aria-invalid]){--pico-border-color:var(--pico-switch-background-color)}[type=checkbox][role=switch]:before{display:block;aspect-ratio:1;height:100%;border-radius:50%;background-color:var(--pico-color);box-shadow:var(--pico-switch-thumb-box-shadow);content:\"\";transition:margin .1s ease-in-out}[type=checkbox][role=switch]:focus{--pico-background-color:var(--pico-switch-background-color);--pico-border-color:var(--pico-switch-background-color)}[type=checkbox][role=switch]:checked{--pico-background-color:var(--pico-switch-checked-background-color);--pico-border-color:var(--pico-switch-checked-background-color);background-image:none}[type=checkbox][role=switch]:checked::before{margin-inline-start:calc(2.25em - 1.25em)}[type=checkbox][role=switch][disabled]{--pico-background-color:var(--pico-border-color)}[type=checkbox][aria-invalid=false]:checked,[type=checkbox][aria-invalid=false]:checked:active,[type=checkbox][aria-invalid=false]:checked:focus,[type=checkbox][role=switch][aria-invalid=false]:checked,[type=checkbox][role=switch][aria-invalid=false]:checked:active,[type=checkbox][role=switch][aria-invalid=false]:checked:focus{--pico-background-color:var(--pico-form-element-valid-border-color)}[type=checkbox]:checked:active[aria-invalid=true],[type=checkbox]:checked:focus[aria-invalid=true],[type=checkbox]:checked[aria-invalid=true],[type=checkbox][role=switch]:checked:active[aria-invalid=true],[type=checkbox][role=switch]:checked:focus[aria-invalid=true],[type=checkbox][role=switch]:checked[aria-invalid=true]{--pico-background-color:var(--pico-form-element-invalid-border-color)}[type=checkbox][aria-invalid=false]:checked,[type=checkbox][aria-invalid=false]:checked:active,[type=checkbox][aria-invalid=false]:checked:focus,[type=checkbox][role=switch][aria-invalid=false]:checked,[type=checkbox][role=switch][aria-invalid=false]:checked:active,[type=checkbox][role=switch][aria-invalid=false]:checked:focus,[type=radio][aria-invalid=false]:checked,[type=radio][aria-invalid=false]:checked:active,[type=radio][aria-invalid=false]:checked:focus{--pico-border-color:var(--pico-form-element-valid-border-color)}[type=checkbox]:checked:active[aria-invalid=true],[type=checkbox]:checked:focus[aria-invalid=true],[type=checkbox]:checked[aria-invalid=true],[type=checkbox][role=switch]:checked:active[aria-invalid=true],[type=checkbox][role=switch]:checked:focus[aria-invalid=true],[type=checkbox][role=switch]:checked[aria-invalid=true],[type=radio]:checked:active[aria-invalid=true],[type=radio]:checked:focus[aria-invalid=true],[type=radio]:checked[aria-invalid=true]{--pico-border-color:var(--pico-form-element-invalid-border-color)}[type=color]::-webkit-color-swatch-wrapper{padding:0}[type=color]::-moz-focus-inner{padding:0}[type=color]::-webkit-color-swatch{border:0;border-radius:calc(var(--pico-border-radius) * .5)}[type=color]::-moz-color-swatch{border:0;border-radius:calc(var(--pico-border-radius) * .5)}input:not([type=checkbox],[type=radio],[type=range],[type=file]):is(\n[type=date],[type=datetime-local],[type=month],[type=time],[type=week]\n){--pico-icon-position:0.75rem;--pico-icon-width:1rem;min-width:0;padding-right:calc(var(--pico-icon-width) + var(--pico-icon-position));background-image:var(--pico-icon-date);background-position:center right var(--pico-icon-position);background-size:var(--pico-icon-width) auto;background-repeat:no-repeat}input:not([type=checkbox],[type=radio],[type=range],[type=file])[type=time]{background-image:var(--pico-icon-time)}[type=date]::-webkit-calendar-picker-indicator,[type=datetime-local]::-webkit-calendar-picker-indicator,[type=month]::-webkit-calendar-picker-indicator,[type=time]::-webkit-calendar-picker-indicator,[type=week]::-webkit-calendar-picker-indicator{width:var(--pico-icon-width);margin-right:calc(var(--pico-icon-width) * -1);margin-left:var(--pico-icon-position);opacity:0}@-moz-document url-prefix(){[type=date],[type=datetime-local],[type=month],[type=time],[type=week]{padding-right:var(--pico-form-element-spacing-horizontal)!important;background-image:none!important}}[dir=rtl] :is([type=date],[type=datetime-local],[type=month],[type=time],[type=week]){text-align:end}[type=file]{--pico-color:var(--pico-muted-color);margin-left:calc(var(--pico-outline-width) * -1);padding:calc(var(--pico-form-element-spacing-vertical) * .5) 0;padding-left:var(--pico-outline-width);border:0;border-radius:0;background:0 0}[type=file]::file-selector-button{margin-right:calc(var(--pico-spacing)/ 2);padding:calc(var(--pico-form-element-spacing-vertical) * .5) var(--pico-form-element-spacing-horizontal)}[type=file]:is(:hover,:active,:focus)::file-selector-button{--pico-background-color:var(--pico-secondary-hover-background);--pico-border-color:var(--pico-secondary-hover-border)}[type=file]:focus::file-selector-button{--pico-box-shadow:var(--pico-button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0)),0 0 0 var(--pico-outline-width) var(--pico-secondary-focus)}[type=range]{-webkit-appearance:none;-moz-appearance:none;appearance:none;width:100%;height:1.25rem;background:0 0}[type=range]::-webkit-slider-runnable-track{width:100%;height:.375rem;border-radius:var(--pico-border-radius);background-color:var(--pico-range-border-color);-webkit-transition:background-color var(--pico-transition),box-shadow var(--pico-transition);transition:background-color var(--pico-transition),box-shadow var(--pico-transition)}[type=range]::-moz-range-track{width:100%;height:.375rem;border-radius:var(--pico-border-radius);background-color:var(--pico-range-border-color);-moz-transition:background-color var(--pico-transition),box-shadow var(--pico-transition);transition:background-color var(--pico-transition),box-shadow var(--pico-transition)}[type=range]::-ms-track{width:100%;height:.375rem;border-radius:var(--pico-border-radius);background-color:var(--pico-range-border-color);-ms-transition:background-color var(--pico-transition),box-shadow var(--pico-transition);transition:background-color var(--pico-transition),box-shadow var(--pico-transition)}[type=range]::-webkit-slider-thumb{-webkit-appearance:none;width:1.25rem;height:1.25rem;margin-top:-.4375rem;border:2px solid var(--pico-range-thumb-border-color);border-radius:50%;background-color:var(--pico-range-thumb-color);cursor:pointer;-webkit-transition:background-color var(--pico-transition),transform var(--pico-transition);transition:background-color var(--pico-transition),transform var(--pico-transition)}[type=range]::-moz-range-thumb{-webkit-appearance:none;width:1.25rem;height:1.25rem;margin-top:-.4375rem;border:2px solid var(--pico-range-thumb-border-color);border-radius:50%;background-color:var(--pico-range-thumb-color);cursor:pointer;-moz-transition:background-color var(--pico-transition),transform var(--pico-transition);transition:background-color var(--pico-transition),transform var(--pico-transition)}[type=range]::-ms-thumb{-webkit-appearance:none;width:1.25rem;height:1.25rem;margin-top:-.4375rem;border:2px solid var(--pico-range-thumb-border-color);border-radius:50%;background-color:var(--pico-range-thumb-color);cursor:pointer;-ms-transition:background-color var(--pico-transition),transform var(--pico-transition);transition:background-color var(--pico-transition),transform var(--pico-transition)}[type=range]:active,[type=range]:focus-within{--pico-range-border-color:var(--pico-range-active-border-color);--pico-range-thumb-color:var(--pico-range-thumb-active-color)}[type=range]:active::-webkit-slider-thumb{transform:scale(1.25)}[type=range]:active::-moz-range-thumb{transform:scale(1.25)}[type=range]:active::-ms-thumb{transform:scale(1.25)}input:not([type=checkbox],[type=radio],[type=range],[type=file])[type=search]{padding-inline-start:calc(var(--pico-form-element-spacing-horizontal) + 1.75rem);background-image:var(--pico-icon-search);background-position:center left calc(var(--pico-form-element-spacing-horizontal) + .125rem);background-size:1rem auto;background-repeat:no-repeat}input:not(\n[type=checkbox],[type=radio],[type=range],[type=file]\n)[type=search][aria-invalid]{padding-inline-start:calc(var(--pico-form-element-spacing-horizontal) + 1.75rem)!important;background-position:center left 1.125rem,center right .75rem}input:not(\n[type=checkbox],[type=radio],[type=range],[type=file]\n)[type=search][aria-invalid=false]{background-image:var(--pico-icon-search),var(--pico-icon-valid)}input:not(\n[type=checkbox],[type=radio],[type=range],[type=file]\n)[type=search][aria-invalid=true]{background-image:var(--pico-icon-search),var(--pico-icon-invalid)}[dir=rtl] :where(input):not(\n[type=checkbox],[type=radio],[type=range],[type=file]\n)[type=search]{background-position:center right 1.125rem}[dir=rtl] :where(input):not(\n[type=checkbox],[type=radio],[type=range],[type=file]\n)[type=search][aria-invalid]{background-position:center right 1.125rem,center left .75rem}details{display:block;margin-bottom:var(--pico-spacing)}details summary{line-height:1rem;list-style-type:none;cursor:pointer;transition:color var(--pico-transition)}details summary:not([role]){color:var(--pico-accordion-close-summary-color)}details summary::-webkit-details-marker{display:none}details summary::marker{display:none}details summary::-moz-list-bullet{list-style-type:none}details summary::after{display:block;width:1rem;height:1rem;margin-inline-start:calc(var(--pico-spacing,1rem) * .5);float:right;transform:rotate(-90deg);background-image:var(--pico-icon-chevron);background-position:right center;background-size:1rem auto;background-repeat:no-repeat;content:\"\";transition:transform var(--pico-transition)}details summary:focus{outline:0}details summary:focus:not([role]){color:var(--pico-accordion-active-summary-color)}details summary:focus-visible:not([role]){outline:var(--pico-outline-width) solid var(--pico-primary-focus);outline-offset:calc(var(--pico-spacing,1rem) * 0.5);color:var(--pico-primary)}details summary[role=button]{width:100%;text-align:start}details summary[role=button]::after{height:calc(1rem * var(--pico-line-height,1.5))}details[open]>summary{margin-bottom:var(--pico-spacing)}details[open]>summary:not([role]):not(:focus){color:var(--pico-accordion-open-summary-color)}details[open]>summary::after{transform:rotate(0)}[dir=rtl] details summary{text-align:end}[dir=rtl] details summary::after{float:left;background-position:left center}article{margin-bottom:var(--pico-block-spacing-vertical);padding:var(--pico-block-spacing-vertical) var(--pico-block-spacing-horizontal);border-radius:var(--pico-border-radius);background:var(--pico-card-background-color);box-shadow:var(--pico-card-box-shadow)}article>footer,article>header{margin-right:calc(var(--pico-block-spacing-horizontal) * -1);margin-left:calc(var(--pico-block-spacing-horizontal) * -1);padding:calc(var(--pico-block-spacing-vertical) * .66) var(--pico-block-spacing-horizontal);background-color:var(--pico-card-sectioning-background-color)}article>header{margin-top:calc(var(--pico-block-spacing-vertical) * -1);margin-bottom:var(--pico-block-spacing-vertical);border-bottom:var(--pico-border-width) solid var(--pico-card-border-color);border-top-right-radius:var(--pico-border-radius);border-top-left-radius:var(--pico-border-radius)}article>footer{margin-top:var(--pico-block-spacing-vertical);margin-bottom:calc(var(--pico-block-spacing-vertical) * -1);border-top:var(--pico-border-width) solid var(--pico-card-border-color);border-bottom-right-radius:var(--pico-border-radius);border-bottom-left-radius:var(--pico-border-radius)}details.dropdown{position:relative;border-bottom:none}details.dropdown>a::after,details.dropdown>button::after,details.dropdown>summary::after{display:block;width:1rem;height:calc(1rem * var(--pico-line-height,1.5));margin-inline-start:.25rem;float:right;transform:rotate(0) translateX(.2rem);background-image:var(--pico-icon-chevron);background-position:right center;background-size:1rem auto;background-repeat:no-repeat;content:\"\"}nav details.dropdown{margin-bottom:0}details.dropdown>summary:not([role]){height:calc(1rem * var(--pico-line-height) + var(--pico-form-element-spacing-vertical) * 2 + var(--pico-border-width) * 2);padding:var(--pico-form-element-spacing-vertical) var(--pico-form-element-spacing-horizontal);border:var(--pico-border-width) solid var(--pico-form-element-border-color);border-radius:var(--pico-border-radius);background-color:var(--pico-form-element-background-color);color:var(--pico-form-element-placeholder-color);line-height:inherit;cursor:pointer;-webkit-user-select:none;-moz-user-select:none;transition:background-color var(--pico-transition),border-color var(--pico-transition),color var(--pico-transition),box-shadow var(--pico-transition);user-select:none}details.dropdown>summary:not([role]):active,details.dropdown>summary:not([role]):focus{border-color:var(--pico-form-element-active-border-color);background-color:var(--pico-form-element-active-background-color)}details.dropdown>summary:not([role]):focus{box-shadow:0 0 0 var(--pico-outline-width) var(--pico-form-element-focus-color)}details.dropdown>summary:not([role]):focus-visible{outline:0}details.dropdown>summary:not([role])[aria-invalid=false]{--pico-form-element-border-color:var(--pico-form-element-valid-border-color);--pico-form-element-active-border-color:var(--pico-form-element-valid-focus-color);--pico-form-element-focus-color:var(--pico-form-element-valid-focus-color)}details.dropdown>summary:not([role])[aria-invalid=true]{--pico-form-element-border-color:var(--pico-form-element-invalid-border-color);--pico-form-element-active-border-color:var(--pico-form-element-invalid-focus-color);--pico-form-element-focus-color:var(--pico-form-element-invalid-focus-color)}nav details.dropdown{display:inline-block;margin:calc(var(--pico-nav-element-spacing-vertical) * -1) 0}nav details.dropdown>summary::after{transform:rotate(0) translateX(0)}nav details.dropdown>summary:not([role]){height:calc(1rem * var(--pico-line-height) + var(--pico-nav-link-spacing-vertical) * 2);padding:calc(var(--pico-nav-link-spacing-vertical) - var(--pico-border-width) * 2) var(--pico-nav-link-spacing-horizontal)}nav details.dropdown>summary:not([role]):focus-visible{box-shadow:0 0 0 var(--pico-outline-width) var(--pico-primary-focus)}details.dropdown>summary+ul{display:flex;z-index:99;position:absolute;left:0;flex-direction:column;width:100%;min-width:-moz-fit-content;min-width:fit-content;margin:0;margin-top:var(--pico-outline-width);padding:0;border:var(--pico-border-width) solid var(--pico-dropdown-border-color);border-radius:var(--pico-border-radius);background-color:var(--pico-dropdown-background-color);box-shadow:var(--pico-dropdown-box-shadow);color:var(--pico-dropdown-color);white-space:nowrap;opacity:0;transition:opacity var(--pico-transition),transform 0s ease-in-out 1s}details.dropdown>summary+ul[dir=rtl]{right:0;left:auto}details.dropdown>summary+ul li{width:100%;margin-bottom:0;padding:calc(var(--pico-form-element-spacing-vertical) * .5) var(--pico-form-element-spacing-horizontal);list-style:none}details.dropdown>summary+ul li:first-of-type{margin-top:calc(var(--pico-form-element-spacing-vertical) * .5)}details.dropdown>summary+ul li:last-of-type{margin-bottom:calc(var(--pico-form-element-spacing-vertical) * .5)}details.dropdown>summary+ul li a{display:block;margin:calc(var(--pico-form-element-spacing-vertical) * -.5) calc(var(--pico-form-element-spacing-horizontal) * -1);padding:calc(var(--pico-form-element-spacing-vertical) * .5) var(--pico-form-element-spacing-horizontal);overflow:hidden;border-radius:0;color:var(--pico-dropdown-color);text-decoration:none;text-overflow:ellipsis}details.dropdown>summary+ul li a:active,details.dropdown>summary+ul li a:focus,details.dropdown>summary+ul li a:focus-visible,details.dropdown>summary+ul li a:hover,details.dropdown>summary+ul li a[aria-current]:not([aria-current=false]){background-color:var(--pico-dropdown-hover-background-color)}details.dropdown>summary+ul li label{width:100%}details.dropdown>summary+ul li:has(label):hover{background-color:var(--pico-dropdown-hover-background-color)}details.dropdown[open]>summary{margin-bottom:0}details.dropdown[open]>summary+ul{transform:scaleY(1);opacity:1;transition:opacity var(--pico-transition),transform 0s ease-in-out 0s}details.dropdown[open]>summary::before{display:block;z-index:1;position:fixed;width:100vw;height:100vh;inset:0;background:0 0;content:\"\";cursor:default}label>details.dropdown{margin-top:calc(var(--pico-spacing) * .25)}[role=group],[role=search]{display:inline-flex;position:relative;width:100%;margin-bottom:var(--pico-spacing);border-radius:var(--pico-border-radius);box-shadow:var(--pico-group-box-shadow,0 0 0 transparent);vertical-align:middle;transition:box-shadow var(--pico-transition)}[role=group] input:not([type=checkbox],[type=radio]),[role=group] select,[role=group]>*,[role=search] input:not([type=checkbox],[type=radio]),[role=search] select,[role=search]>*{position:relative;flex:1 1 auto;margin-bottom:0}[role=group] input:not([type=checkbox],[type=radio]):not(:first-child),[role=group] select:not(:first-child),[role=group]>:not(:first-child),[role=search] input:not([type=checkbox],[type=radio]):not(:first-child),[role=search] select:not(:first-child),[role=search]>:not(:first-child){margin-left:0;border-top-left-radius:0;border-bottom-left-radius:0}[role=group] input:not([type=checkbox],[type=radio]):not(:last-child),[role=group] select:not(:last-child),[role=group]>:not(:last-child),[role=search] input:not([type=checkbox],[type=radio]):not(:last-child),[role=search] select:not(:last-child),[role=search]>:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}[role=group] input:not([type=checkbox],[type=radio]):focus,[role=group] select:focus,[role=group]>:focus,[role=search] input:not([type=checkbox],[type=radio]):focus,[role=search] select:focus,[role=search]>:focus{z-index:2}[role=group] [role=button]:not(:first-child),[role=group] [type=button]:not(:first-child),[role=group] [type=reset]:not(:first-child),[role=group] [type=submit]:not(:first-child),[role=group] button:not(:first-child),[role=group] input:not([type=checkbox],[type=radio]):not(:first-child),[role=group] select:not(:first-child),[role=search] [role=button]:not(:first-child),[role=search] [type=button]:not(:first-child),[role=search] [type=reset]:not(:first-child),[role=search] [type=submit]:not(:first-child),[role=search] button:not(:first-child),[role=search] input:not([type=checkbox],[type=radio]):not(:first-child),[role=search] select:not(:first-child){margin-left:calc(var(--pico-border-width) * -1)}[role=group] [role=button],[role=group] [type=button],[role=group] [type=reset],[role=group] [type=submit],[role=group] button,[role=search] [role=button],[role=search] [type=button],[role=search] [type=reset],[role=search] [type=submit],[role=search] button{width:auto}@supports selector(:has(*)){[role=group]:has(\nbutton:focus,[type=submit]:focus,[type=button]:focus,[role=button]:focus\n),[role=search]:has(\nbutton:focus,[type=submit]:focus,[type=button]:focus,[role=button]:focus\n){--pico-group-box-shadow:var(--pico-group-box-shadow-focus-with-button)}[role=group]:has(\nbutton:focus,[type=submit]:focus,[type=button]:focus,[role=button]:focus\n) input:not([type=checkbox],[type=radio]),[role=group]:has(\nbutton:focus,[type=submit]:focus,[type=button]:focus,[role=button]:focus\n) select,[role=search]:has(\nbutton:focus,[type=submit]:focus,[type=button]:focus,[role=button]:focus\n) input:not([type=checkbox],[type=radio]),[role=search]:has(\nbutton:focus,[type=submit]:focus,[type=button]:focus,[role=button]:focus\n) select{border-color:transparent}[role=group]:has(input:not([type=submit],[type=button]):focus,select:focus),[role=search]:has(input:not([type=submit],[type=button]):focus,select:focus){--pico-group-box-shadow:var(--pico-group-box-shadow-focus-with-input)}[role=group]:has(input:not([type=submit],[type=button]):focus,select:focus) [role=button],[role=group]:has(input:not([type=submit],[type=button]):focus,select:focus) [type=button],[role=group]:has(input:not([type=submit],[type=button]):focus,select:focus) [type=submit],[role=group]:has(input:not([type=submit],[type=button]):focus,select:focus) button,[role=search]:has(input:not([type=submit],[type=button]):focus,select:focus) [role=button],[role=search]:has(input:not([type=submit],[type=button]):focus,select:focus) [type=button],[role=search]:has(input:not([type=submit],[type=button]):focus,select:focus) [type=submit],[role=search]:has(input:not([type=submit],[type=button]):focus,select:focus) button{--pico-button-box-shadow:0 0 0 var(--pico-border-width) var(--pico-primary-border);--pico-button-hover-box-shadow:0 0 0 var(--pico-border-width) var(--pico-primary-hover-border)}[role=group] [role=button]:focus,[role=group] [type=button]:focus,[role=group] [type=reset]:focus,[role=group] [type=submit]:focus,[role=group] button:focus,[role=search] [role=button]:focus,[role=search] [type=button]:focus,[role=search] [type=reset]:focus,[role=search] [type=submit]:focus,[role=search] button:focus{box-shadow:none}}[role=search]>:first-child{border-top-left-radius:5rem;border-bottom-left-radius:5rem}[role=search]>:last-child{border-top-right-radius:5rem;border-bottom-right-radius:5rem}[aria-busy=true]:not(input,select,textarea,html,form){white-space:nowrap}[aria-busy=true]:not(input,select,textarea,html,form)::before{display:inline-block;width:1em;height:1em;background-image:var(--pico-icon-loading);background-size:1em auto;background-repeat:no-repeat;content:\"\";vertical-align:-.125em}[aria-busy=true]:not(input,select,textarea,html,form):not(:empty)::before{margin-inline-end:calc(var(--pico-spacing) * .5)}[aria-busy=true]:not(input,select,textarea,html,form):empty{text-align:center}[role=button][aria-busy=true],[type=button][aria-busy=true],[type=reset][aria-busy=true],[type=submit][aria-busy=true],a[aria-busy=true],button[aria-busy=true]{pointer-events:none}:host,:scope{--pico-scrollbar-width:0px}dialog{display:flex;z-index:999;position:fixed;top:0;right:0;bottom:0;left:0;align-items:center;justify-content:center;width:inherit;min-width:100%;height:inherit;min-height:100%;padding:0;border:0;backdrop-filter:var(--pico-modal-overlay-backdrop-filter);background-color:var(--pico-modal-overlay-background-color);color:var(--pico-color)}dialog>article{width:100%;max-height:calc(100vh - var(--pico-spacing) * 2);margin:var(--pico-spacing);overflow:auto}@media (min-width:576px){dialog>article{max-width:510px}}@media (min-width:768px){dialog>article{max-width:700px}}dialog>article>header>*{margin-bottom:0}dialog>article>header .close,dialog>article>header :is(a,button)[rel=prev]{margin:0;margin-left:var(--pico-spacing);padding:0;float:right}dialog>article>footer{text-align:end}dialog>article>footer [role=button],dialog>article>footer button{margin-bottom:0}dialog>article>footer [role=button]:not(:first-of-type),dialog>article>footer button:not(:first-of-type){margin-left:calc(var(--pico-spacing) * .5)}dialog>article .close,dialog>article :is(a,button)[rel=prev]{display:block;width:1rem;height:1rem;margin-top:calc(var(--pico-spacing) * -1);margin-bottom:var(--pico-spacing);margin-left:auto;border:none;background-image:var(--pico-icon-close);background-position:center;background-size:auto 1rem;background-repeat:no-repeat;background-color:transparent;opacity:.5;transition:opacity var(--pico-transition)}dialog>article .close:is([aria-current]:not([aria-current=false]),:hover,:active,:focus),dialog>article :is(a,button)[rel=prev]:is(\n[aria-current]:not([aria-current=false]),:hover,:active,:focus\n){opacity:1}dialog:not([open]),dialog[open=false]{display:none}.modal-is-open{padding-right:var(--pico-scrollbar-width,0);overflow:hidden;pointer-events:none;touch-action:none}.modal-is-open dialog{pointer-events:auto;touch-action:auto}:where(.modal-is-opening,.modal-is-closing) dialog,:where(.modal-is-opening,.modal-is-closing) dialog>article{animation-duration:.2s;animation-timing-function:ease-in-out;animation-fill-mode:both}:where(.modal-is-opening,.modal-is-closing) dialog{animation-duration:.8s;animation-name:modal-overlay}:where(.modal-is-opening,.modal-is-closing) dialog>article{animation-delay:.2s;animation-name:modal}.modal-is-closing dialog,.modal-is-closing dialog>article{animation-delay:0s;animation-direction:reverse}@keyframes modal-overlay{from{backdrop-filter:none;background-color:transparent}}@keyframes modal{from{transform:translateY(-100%);opacity:0}}:where(nav li)::before{float:left;content:\"​\"}nav,nav ul{display:flex}nav{justify-content:space-between;overflow:visible}nav ol,nav ul{align-items:center;margin-bottom:0;padding:0;list-style:none}nav ol:first-of-type,nav ul:first-of-type{margin-left:calc(var(--pico-nav-element-spacing-horizontal) * -1)}nav ol:last-of-type,nav ul:last-of-type{margin-right:calc(var(--pico-nav-element-spacing-horizontal) * -1)}nav li{display:inline-block;margin:0;padding:var(--pico-nav-element-spacing-vertical) var(--pico-nav-element-spacing-horizontal)}nav li :where(a,[role=link]){display:inline-block;margin:calc(var(--pico-nav-link-spacing-vertical) * -1) calc(var(--pico-nav-link-spacing-horizontal) * -1);padding:var(--pico-nav-link-spacing-vertical) var(--pico-nav-link-spacing-horizontal);border-radius:var(--pico-border-radius)}nav li :where(a,[role=link]):not(:hover){text-decoration:none}nav li [role=button],nav li [type=button],nav li button,nav li input:not([type=checkbox],[type=radio],[type=range],[type=file]),nav li select{height:auto;margin-right:inherit;margin-bottom:0;margin-left:inherit;padding:calc(var(--pico-nav-link-spacing-vertical) - var(--pico-border-width) * 2) var(--pico-nav-link-spacing-horizontal)}nav[aria-label=breadcrumb]{align-items:center;justify-content:start}nav[aria-label=breadcrumb] ul li:not(:first-child){margin-inline-start:var(--pico-nav-link-spacing-horizontal)}nav[aria-label=breadcrumb] ul li a{margin:calc(var(--pico-nav-link-spacing-vertical) * -1) 0;margin-inline-start:calc(var(--pico-nav-link-spacing-horizontal) * -1)}nav[aria-label=breadcrumb] ul li:not(:last-child)::after{display:inline-block;position:absolute;width:calc(var(--pico-nav-link-spacing-horizontal) * 4);margin:0 calc(var(--pico-nav-link-spacing-horizontal) * -1);content:var(--pico-nav-breadcrumb-divider);color:var(--pico-muted-color);text-align:center;text-decoration:none;white-space:nowrap}nav[aria-label=breadcrumb] a[aria-current]:not([aria-current=false]){background-color:transparent;color:inherit;text-decoration:none;pointer-events:none}aside li,aside nav,aside ol,aside ul{display:block}aside li{padding:calc(var(--pico-nav-element-spacing-vertical) * .5) var(--pico-nav-element-spacing-horizontal)}aside li a{display:block}aside li [role=button]{margin:inherit}[dir=rtl] nav[aria-label=breadcrumb] ul li:not(:last-child)::after{content:\"\\\\\"}progress{display:inline-block;vertical-align:baseline}progress{-webkit-appearance:none;-moz-appearance:none;display:inline-block;appearance:none;width:100%;height:.5rem;margin-bottom:calc(var(--pico-spacing) * .5);overflow:hidden;border:0;border-radius:var(--pico-border-radius);background-color:var(--pico-progress-background-color);color:var(--pico-progress-color)}progress::-webkit-progress-bar{border-radius:var(--pico-border-radius);background:0 0}progress[value]::-webkit-progress-value{background-color:var(--pico-progress-color);-webkit-transition:inline-size var(--pico-transition);transition:inline-size var(--pico-transition)}progress::-moz-progress-bar{background-color:var(--pico-progress-color)}@media (prefers-reduced-motion:no-preference){progress:indeterminate{background:var(--pico-progress-background-color) linear-gradient(to right,var(--pico-progress-color) 30%,var(--pico-progress-background-color) 30%) top left/150% 150% no-repeat;animation:progress-indeterminate 1s linear infinite}progress:indeterminate[value]::-webkit-progress-value{background-color:transparent}progress:indeterminate::-moz-progress-bar{background-color:transparent}}@media (prefers-reduced-motion:no-preference){[dir=rtl] progress:indeterminate{animation-direction:reverse}}@keyframes progress-indeterminate{0%{background-position:200% 0}100%{background-position:-200% 0}}[data-tooltip]{position:relative}[data-tooltip]:not(a,button,input,[role=button]){border-bottom:1px dotted;text-decoration:none;cursor:help}[data-tooltip]::after,[data-tooltip]::before,[data-tooltip][data-placement=top]::after,[data-tooltip][data-placement=top]::before{display:block;z-index:99;position:absolute;bottom:100%;left:50%;padding:.25rem .5rem;overflow:hidden;transform:translate(-50%,-.25rem);border-radius:var(--pico-border-radius);background:var(--pico-tooltip-background-color);content:attr(data-tooltip);color:var(--pico-tooltip-color);font-style:normal;font-weight:var(--pico-font-weight);font-size:.875rem;text-decoration:none;text-overflow:ellipsis;white-space:nowrap;opacity:0;pointer-events:none}[data-tooltip]::after,[data-tooltip][data-placement=top]::after{padding:0;transform:translate(-50%,0);border-top:.3rem solid;border-right:.3rem solid transparent;border-left:.3rem solid transparent;border-radius:0;background-color:transparent;content:\"\";color:var(--pico-tooltip-background-color)}[data-tooltip][data-placement=bottom]::after,[data-tooltip][data-placement=bottom]::before{top:100%;bottom:auto;transform:translate(-50%,.25rem)}[data-tooltip][data-placement=bottom]:after{transform:translate(-50%,-.3rem);border:.3rem solid transparent;border-bottom:.3rem solid}[data-tooltip][data-placement=left]::after,[data-tooltip][data-placement=left]::before{top:50%;right:100%;bottom:auto;left:auto;transform:translate(-.25rem,-50%)}[data-tooltip][data-placement=left]:after{transform:translate(.3rem,-50%);border:.3rem solid transparent;border-left:.3rem solid}[data-tooltip][data-placement=right]::after,[data-tooltip][data-placement=right]::before{top:50%;right:auto;bottom:auto;left:100%;transform:translate(.25rem,-50%)}[data-tooltip][data-placement=right]:after{transform:translate(-.3rem,-50%);border:.3rem solid transparent;border-right:.3rem solid}[data-tooltip]:focus::after,[data-tooltip]:focus::before,[data-tooltip]:hover::after,[data-tooltip]:hover::before{opacity:1}@media (hover:hover) and (pointer:fine){[data-tooltip]:focus::after,[data-tooltip]:focus::before,[data-tooltip]:hover::after,[data-tooltip]:hover::before{--pico-tooltip-slide-to:translate(-50%, -0.25rem);transform:translate(-50%,.75rem);animation-duration:.2s;animation-fill-mode:forwards;animation-name:tooltip-slide;opacity:0}[data-tooltip]:focus::after,[data-tooltip]:hover::after{--pico-tooltip-caret-slide-to:translate(-50%, 0rem);transform:translate(-50%,-.25rem);animation-name:tooltip-caret-slide}[data-tooltip][data-placement=bottom]:focus::after,[data-tooltip][data-placement=bottom]:focus::before,[data-tooltip][data-placement=bottom]:hover::after,[data-tooltip][data-placement=bottom]:hover::before{--pico-tooltip-slide-to:translate(-50%, 0.25rem);transform:translate(-50%,-.75rem);animation-name:tooltip-slide}[data-tooltip][data-placement=bottom]:focus::after,[data-tooltip][data-placement=bottom]:hover::after{--pico-tooltip-caret-slide-to:translate(-50%, -0.3rem);transform:translate(-50%,-.5rem);animation-name:tooltip-caret-slide}[data-tooltip][data-placement=left]:focus::after,[data-tooltip][data-placement=left]:focus::before,[data-tooltip][data-placement=left]:hover::after,[data-tooltip][data-placement=left]:hover::before{--pico-tooltip-slide-to:translate(-0.25rem, -50%);transform:translate(.75rem,-50%);animation-name:tooltip-slide}[data-tooltip][data-placement=left]:focus::after,[data-tooltip][data-placement=left]:hover::after{--pico-tooltip-caret-slide-to:translate(0.3rem, -50%);transform:translate(.05rem,-50%);animation-name:tooltip-caret-slide}[data-tooltip][data-placement=right]:focus::after,[data-tooltip][data-placement=right]:focus::before,[data-tooltip][data-placement=right]:hover::after,[data-tooltip][data-placement=right]:hover::before{--pico-tooltip-slide-to:translate(0.25rem, -50%);transform:translate(-.75rem,-50%);animation-name:tooltip-slide}[data-tooltip][data-placement=right]:focus::after,[data-tooltip][data-placement=right]:hover::after{--pico-tooltip-caret-slide-to:translate(-0.3rem, -50%);transform:translate(-.05rem,-50%);animation-name:tooltip-caret-slide}}@keyframes tooltip-slide{to{transform:var(--pico-tooltip-slide-to);opacity:1}}@keyframes tooltip-caret-slide{50%{opacity:0}to{transform:var(--pico-tooltip-caret-slide-to);opacity:1}}[aria-controls]{cursor:pointer}[aria-disabled=true],[disabled]{cursor:not-allowed}[aria-hidden=false][hidden]{display:initial}[aria-hidden=false][hidden]:not(:focus){clip:rect(0,0,0,0);position:absolute}[tabindex],a,area,button,input,label,select,summary,textarea{-ms-touch-action:manipulation}[dir=rtl]{direction:rtl}@media (prefers-reduced-motion:reduce){:not([aria-busy=true])::after,:not([aria-busy=true])::before,:not([aria-busy=true]):not(.unreduce-motion){background-attachment:initial!important;animation-duration:1ms!important;animation-delay:-1ms!important;animation-iteration-count:1!important;scroll-behavior:auto!important;transition-delay:0s!important;transition-duration:0s!important}}.columns{-moz-columns:25ch auto;columns:25ch auto}.columns>*{-moz-column-break-inside:avoid;break-inside:avoid}[data-jump-to=top]{position:fixed;right:0;bottom:0;padding-top:50vh}.breakout,.breakout-all{max-width:calc(10% + 65ch + 10%);padding-inline:10%}@media (width < 768px){.breakout,.breakout-all{max-width:calc(1rem + 65ch + 1rem);padding-inline:1rem}}.breakout-all>:is(\ntable,pre,figure,video,iframe,canvas,img,picture,.breakout-item,.breakout-item-max\n),.breakout>:is(\ntable,pre,figure,video,iframe,canvas,img,picture,.breakout-item,.breakout-item-max\n){width:-moz-fit-content;width:fit-content;min-width:100%;max-width:min(125%,100dvw);margin-left:50%;transform:translateX(-50%)}.breakout-all>:is(img,picture):not(.does-not-exist),.breakout>:is(img,picture):not(.does-not-exist){min-width:auto}.breakout-all>.breakout-item-max,.breakout>.breakout-item-max{width:min(125%,100dvw)!important}.breakout-all>:is(h2,h3,h4,h5,h6,hr):not([class]){position:relative}.breakout-all>:is(h2,h3,h4,h5,h6,hr):not([class])::before{display:block;position:absolute;background:gray;content:\"\";opacity:12.5%}.breakout-all>:is(h2,h3,h4,h5,h6):not([class])::before{top:50%;right:100%;width:10em;height:.25em;margin-right:.8ch;transform:translateY(-50%);background:linear-gradient(to left,gray,transparent)}.breakout-all>:is(h2,h3,h4,h5,h6):not([class]):where(hr + *)::before{display:none!important}.breakout-all>:is(hr){height:.5rem;overflow:visible;border:none}.breakout-all>:is(hr)::before{left:50%;width:100dvw;height:100%;transform:translateX(-50%)}h1,h2,h3,h4,h5,h6{position:relative}h1 a[aria-hidden=true],h2 a[aria-hidden=true],h3 a[aria-hidden=true],h4 a[aria-hidden=true],h5 a[aria-hidden=true],h6 a[aria-hidden=true]{visibility:hidden;position:absolute;top:50%;right:100%;padding-right:.2ch;transform:translateY(-50%);color:silver;text-decoration:none}@media (hover:hover){h1:hover a[aria-hidden=true],h2:hover a[aria-hidden=true],h3:hover a[aria-hidden=true],h4:hover a[aria-hidden=true],h5:hover a[aria-hidden=true],h6:hover a[aria-hidden=true]{visibility:visible}}ol[style*=\"--list-marker:\"],ul[style*=\"--list-marker:\"]{list-style-type:var(--list-marker)}ol[style*=\"--list-marker:\"]>li,ul[style*=\"--list-marker:\"]>li{list-style-type:inherit}ol li[style*=\"--list-marker:\"],ul li[style*=\"--list-marker:\"]{list-style-type:var(--list-marker)}ol li[data-marker]::marker,ul li[data-marker]::marker{content:attr(data-marker) \" \"}ol.markerless,ul.markerless{padding-inline-start:1.25rem}ol.markerless li,ul.markerless li{list-style:none}.unlist-all ol,.unlist-all ul,ol.unlist,ol.unlist-all,ul.unlist,ul.unlist-all{padding-inline-start:0}.unlist-all ol>li,.unlist-all ul>li,ol.unlist-all>li,ol.unlist>li,ul.unlist-all>li,ul.unlist>li{list-style:none}a:not(.does-not-exist):has(> i){display:inline-flex;overflow-y:clip;gap:.375ch;text-wrap:balance}a:not(.does-not-exist)>i{float:left;font-style:normal;text-underline-offset:-2em}a:not(.does-not-exist)>i>img{display:inline-block;max-width:none;height:1.25em;margin-block-start:calc(-0.25em / 2)}a:not(.does-not-exist)>i[class*=\" fa-\"],a:not(.does-not-exist)>i[class^=fa-]{line-height:inherit;--fa-width:auto}a:not(.does-not-exist)>i.fa-lg{line-height:normal}th hr{visibility:hidden;width:12ch;height:0;margin:0}th hr.lg{width:18ch}th hr.x2{width:24ch}table.borderless td,table.borderless th{border:none}.breakout-all>table:not(.does-not-exist),.breakout>table:not(.does-not-exist),table.responsive{display:block;width:-moz-max-content;width:max-content;min-width:auto;max-width:100dvw;margin-left:50%;padding-inline:7.5%;overflow-x:auto;transform:translateX(-50%);-webkit-overflow-scrolling:touch}.breakout-all>table:not(.does-not-exist) td,.breakout-all>table:not(.does-not-exist) th,.breakout>table:not(.does-not-exist) td,.breakout>table:not(.does-not-exist) th,table.responsive td,table.responsive th{padding-inline-start:0}@media (width < 768px){pre{border-radius:0}}code[data-caption]::before{display:block;margin-bottom:1rem;content:attr(data-caption);font-style:italic;opacity:50%}.has-float-label,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select){display:block;position:relative}.has-float-label label,.has-float-label>span,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) label,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select)>span{position:absolute;top:0;left:0;font-size:75%;cursor:text}.has-float-label :placeholder-shown:not(:focus)::-moz-placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) :placeholder-shown:not(:focus)::-moz-placeholder{opacity:0}.has-float-label :-moz-placeholder:not(:focus)::placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) :-moz-placeholder:not(:focus)::placeholder{opacity:0}.has-float-label :placeholder-shown:not(:focus)::placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) :placeholder-shown:not(:focus)::placeholder{opacity:0}.has-float-label:has(:-moz-placeholder:not(:focus)) label,.has-float-label:has(:-moz-placeholder:not(:focus))>span,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select):has(:-moz-placeholder:not(:focus)) label,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select):has(:-moz-placeholder:not(:focus))>span{font-size:inherit;opacity:50%}.has-float-label:has(:placeholder-shown:not(:focus)) label,.has-float-label:has(:placeholder-shown:not(:focus))>span,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select):has(:placeholder-shown:not(:focus)) label,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select):has(:placeholder-shown:not(:focus))>span{font-size:inherit;opacity:50%}.has-timeline>dl dd,dl.timeline dd{margin-block:0;padding:.25rem 0 .75rem 1rem;border-inline-start:0.25rem solid gray}:root{--blades-dark-filter:invert(100%) hue-rotate(180deg)}@media (prefers-color-scheme:dark){.dark-auto{filter:var(--blades-dark-filter)}}.dark-auto:where([data-theme=dark] *),.dark-auto[data-theme=dark]{filter:var(--blades-dark-filter)}.faded{opacity:50%}.faded:hover{opacity:87.5%}.invert ::-webkit-scrollbar{filter:invert(1)!important}.has-float-label label,.has-float-label>span,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) label,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select)>span{padding-inline-start:calc(1rem + 1px);padding-block-start:0.25rem;opacity:75%;transition:all .25s}.has-float-label input,.has-float-label select,.has-float-label textarea,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) input,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) select,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) textarea{margin-block-start:0;padding-inline-start:1rem;padding-block:1.125rem 0.375rem}.has-float-label input::-moz-placeholder,.has-float-label select::-moz-placeholder,.has-float-label textarea::-moz-placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) input::-moz-placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) select::-moz-placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) textarea::-moz-placeholder{opacity:100%;-moz-transition:all .25s;transition:all .25s}.has-float-label input::placeholder,.has-float-label select::placeholder,.has-float-label textarea::placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) input::placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) select::placeholder,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select) textarea::placeholder{opacity:100%;transition:all .25s}.has-float-label:has(:-moz-placeholder:not(:focus)) label,.has-float-label:has(:-moz-placeholder:not(:focus))>span,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select):has(:-moz-placeholder:not(:focus)) label,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select):has(:-moz-placeholder:not(:focus))>span{padding-block:0.75rem}.has-float-label:has(:placeholder-shown:not(:focus)) label,.has-float-label:has(:placeholder-shown:not(:focus))>span,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select):has(:placeholder-shown:not(:focus)) label,label:has(> span):has(input:not([type=checkbox],[type=radio],[type=range]),textarea,select):has(:placeholder-shown:not(:focus))>span{padding-block:0.75rem}html{overflow-x:clip;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}body{display:flex;flex-direction:column;min-height:100dvh}body>main{flex-grow:1}body{hyphens:auto;text-wrap:pretty}body a,body table{hyphens:none}a:not([href^=\"#\"]){text-decoration-thickness:1px}a:not([href^=\"#\"]):hover{text-decoration-thickness:2px}h1,h2,h3,h4,h5,h6{text-wrap:balance}h1{margin-bottom:1rem;font-size:2.5em}hr{margin-block:2em}ul ul{font-size:87.5%}dl dt{margin-block:0.25rem;font-weight:500}dl dd{margin-block-end:1rem}pre small{font-weight:lighter;opacity:75%}pre:has(code){background:#181c25!important}table th{font-weight:700;vertical-align:bottom}table td{vertical-align:top}table pre{margin-bottom:.25rem}[data-jump-to=top]{opacity:25%}[data-jump-to=top]:hover{opacity:75%}[data-jump-to=top]>i{display:inline-block;margin:.5rem;padding:.25rem .375rem;border-color:#000;color:#000;font-size:.75rem}.breakout-all>figure,.breakout-all>img,.breakout>figure,.breakout>img{margin-bottom:1rem}.faded a{text-decoration-style:dotted}\n/* The report layer, inlined after the vendored Pico+Blades stylesheet. It holds\n   only what no framework ships: the status and severity palette, the dashboard,\n   and the print rules. Everything else is driven through --pico-* variables so\n   the vendored file is never edited. */\n\n:root {\n  /* Stated here rather than inherited so the report's typography is system\n     fonts by declaration, with nothing to download. */\n  --pico-font-family-sans-serif: system-ui, -apple-system, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif;\n  --pico-font-family-monospace: ui-monospace, SFMono-Regular, Menlo, Consolas, \"Liberation Mono\", monospace;\n  --pico-font-family: var(--pico-font-family-sans-serif);\n  /* Pico scales the root to 131.25% on a wide screen. A compliance report is a\n     dense document read at length, so it stays at the browser's own size. */\n  --pico-font-size: 100%;\n  /* The page's own text colour, captured before the headings below redefine it. */\n  --pico-report-ink: var(--pico-color);\n}\n/* Pico's heading scale is for prose; these are the report's section, panel and\n   block labels, so they are driven back through its own per-heading token. */\nh2 { --pico-font-size: 1.3rem; letter-spacing: -0.01em; }\nh3 { --pico-font-size: 1.02rem; }\nh4, h5 { --pico-font-size: 0.78rem; margin: 1.2rem 0 0.45rem; color: var(--pico-muted-color); text-transform: uppercase; letter-spacing: 0.07em; }\n/* The three scopes Pico itself uses: light by default or when light is chosen,\n   dark when the system asks and nothing was chosen, dark when dark was chosen. */\n:root:not([data-theme=\"dark\"]), [data-theme=\"light\"] {\n  /* Pico's own input border is 1.47:1 against the page, under the 3:1 WCAG 1.4.11\n     asks of a control boundary; the report raises it in both schemes. */\n  --pico-form-element-border-color: #767f91;\n  --pico-s-passed: #2e7d32; --pico-s-passed-inverse: #ffffff; --pico-t-passed: #e8f5e9; --pico-t-passed-inverse: #1b5e20;\n  --pico-s-failed: #c62828; --pico-s-failed-inverse: #ffffff; --pico-t-failed: #ffebee; --pico-t-failed-inverse: #8e1616;\n  --pico-s-not-applicable: #0277bd; --pico-s-not-applicable-inverse: #ffffff; --pico-t-not-applicable: #e1f5fe; --pico-t-not-applicable-inverse: #01497c;\n  --pico-s-not-reviewed: #b45300; --pico-s-not-reviewed-inverse: #ffffff; --pico-t-not-reviewed: #fff3e0; --pico-t-not-reviewed-inverse: #7a3600;\n  --pico-s-error: #3f51b5; --pico-s-error-inverse: #ffffff; --pico-t-error: #e8eaf6; --pico-t-error-inverse: #1a237e;\n  --pico-s-unknown: #5c6670; --pico-s-unknown-inverse: #ffffff; --pico-t-unknown: #e9edf1; --pico-t-unknown-inverse: #16212d;\n  --pico-s-critical: #c62828; --pico-s-critical-inverse: #ffffff; --pico-t-critical: #ffebee; --pico-t-critical-inverse: #8e1616;\n  --pico-s-high: #bf360c; --pico-s-high-inverse: #ffffff; --pico-t-high: #fbe9e7; --pico-t-high-inverse: #8a2607;\n  --pico-s-medium: #b45300; --pico-s-medium-inverse: #ffffff; --pico-t-medium: #fff3e0; --pico-t-medium-inverse: #7a3600;\n  --pico-s-low: #806600; --pico-s-low-inverse: #ffffff; --pico-t-low: #fffde7; --pico-t-low-inverse: #5c4a00;\n  --pico-s-none: #0277bd; --pico-s-none-inverse: #ffffff; --pico-t-none: #e1f5fe; --pico-t-none-inverse: #01497c;\n}\n@media only screen and (prefers-color-scheme: dark) {\n  :root:not([data-theme]) {\n    --pico-form-element-border-color: #6b7488;\n    /* Pico's dark muted text is 4.41:1 on its own sectioning background. */\n    --pico-muted-color: #868fa0;\n    --pico-s-passed: #4cb04f; --pico-s-passed-inverse: #06200a; --pico-t-passed: #12301a; --pico-t-passed-inverse: #b9e4bb;\n    --pico-s-failed: #ef7a70; --pico-s-failed-inverse: #2b0603; --pico-t-failed: #3d1614; --pico-t-failed-inverse: #ffc9c4;\n    --pico-s-not-applicable: #03a9f4; --pico-s-not-applicable-inverse: #02202e; --pico-t-not-applicable: #0c3048; --pico-t-not-applicable-inverse: #b3e5fc;\n    --pico-s-not-reviewed: #fe9900; --pico-s-not-reviewed-inverse: #2e1b00; --pico-t-not-reviewed: #3d2a0a; --pico-t-not-reviewed-inverse: #ffe0b2;\n    --pico-s-error: #9fa8da; --pico-s-error-inverse: #10153d; --pico-t-error: #262c58; --pico-t-error-inverse: #dfe2f5;\n    --pico-s-unknown: #aab6c2; --pico-s-unknown-inverse: #101820; --pico-t-unknown: #26374a; --pico-t-unknown-inverse: #e8edf2;\n    --pico-s-critical: #ef7a70; --pico-s-critical-inverse: #2b0603; --pico-t-critical: #3d1614; --pico-t-critical-inverse: #ffc9c4;\n    --pico-s-high: #ff8a65; --pico-s-high-inverse: #2e0d02; --pico-t-high: #3f1d12; --pico-t-high-inverse: #ffccbc;\n    --pico-s-medium: #ff9800; --pico-s-medium-inverse: #2e1b00; --pico-t-medium: #3d2a0a; --pico-t-medium-inverse: #ffe0b2;\n    --pico-s-low: #ffeb3b; --pico-s-low-inverse: #2b2600; --pico-t-low: #3a3508; --pico-t-low-inverse: #fff59d;\n    --pico-s-none: #03a9f4; --pico-s-none-inverse: #02202e; --pico-t-none: #0c3048; --pico-t-none-inverse: #b3e5fc;\n  }\n}\n[data-theme=\"dark\"] {\n  --pico-form-element-border-color: #6b7488;\n  --pico-muted-color: #868fa0;\n  --pico-s-passed: #4cb04f; --pico-s-passed-inverse: #06200a; --pico-t-passed: #12301a; --pico-t-passed-inverse: #b9e4bb;\n  --pico-s-failed: #ef7a70; --pico-s-failed-inverse: #2b0603; --pico-t-failed: #3d1614; --pico-t-failed-inverse: #ffc9c4;\n  --pico-s-not-applicable: #03a9f4; --pico-s-not-applicable-inverse: #02202e; --pico-t-not-applicable: #0c3048; --pico-t-not-applicable-inverse: #b3e5fc;\n  --pico-s-not-reviewed: #fe9900; --pico-s-not-reviewed-inverse: #2e1b00; --pico-t-not-reviewed: #3d2a0a; --pico-t-not-reviewed-inverse: #ffe0b2;\n  --pico-s-error: #9fa8da; --pico-s-error-inverse: #10153d; --pico-t-error: #262c58; --pico-t-error-inverse: #dfe2f5;\n  --pico-s-unknown: #aab6c2; --pico-s-unknown-inverse: #101820; --pico-t-unknown: #26374a; --pico-t-unknown-inverse: #e8edf2;\n  --pico-s-critical: #ef7a70; --pico-s-critical-inverse: #2b0603; --pico-t-critical: #3d1614; --pico-t-critical-inverse: #ffc9c4;\n  --pico-s-high: #ff8a65; --pico-s-high-inverse: #2e0d02; --pico-t-high: #3f1d12; --pico-t-high-inverse: #ffccbc;\n  --pico-s-medium: #ff9800; --pico-s-medium-inverse: #2e1b00; --pico-t-medium: #3d2a0a; --pico-t-medium-inverse: #ffe0b2;\n  --pico-s-low: #ffeb3b; --pico-s-low-inverse: #2b2600; --pico-t-low: #3a3508; --pico-t-low-inverse: #fff59d;\n  --pico-s-none: #03a9f4; --pico-s-none-inverse: #02202e; --pico-t-none: #0c3048; --pico-t-none-inverse: #b3e5fc;\n}\n.c-passed { --c: var(--pico-s-passed); --c-inverse: var(--pico-s-passed-inverse); --t: var(--pico-t-passed); --t-inverse: var(--pico-t-passed-inverse); }\n.c-failed { --c: var(--pico-s-failed); --c-inverse: var(--pico-s-failed-inverse); --t: var(--pico-t-failed); --t-inverse: var(--pico-t-failed-inverse); }\n.c-not-applicable { --c: var(--pico-s-not-applicable); --c-inverse: var(--pico-s-not-applicable-inverse); --t: var(--pico-t-not-applicable); --t-inverse: var(--pico-t-not-applicable-inverse); }\n.c-not-reviewed { --c: var(--pico-s-not-reviewed); --c-inverse: var(--pico-s-not-reviewed-inverse); --t: var(--pico-t-not-reviewed); --t-inverse: var(--pico-t-not-reviewed-inverse); }\n.c-error { --c: var(--pico-s-error); --c-inverse: var(--pico-s-error-inverse); --t: var(--pico-t-error); --t-inverse: var(--pico-t-error-inverse); }\n.c-unknown { --c: var(--pico-s-unknown); --c-inverse: var(--pico-s-unknown-inverse); --t: var(--pico-t-unknown); --t-inverse: var(--pico-t-unknown-inverse); }\n.c-critical { --c: var(--pico-s-critical); --c-inverse: var(--pico-s-critical-inverse); --t: var(--pico-t-critical); --t-inverse: var(--pico-t-critical-inverse); }\n.c-high { --c: var(--pico-s-high); --c-inverse: var(--pico-s-high-inverse); --t: var(--pico-t-high); --t-inverse: var(--pico-t-high-inverse); }\n.c-medium { --c: var(--pico-s-medium); --c-inverse: var(--pico-s-medium-inverse); --t: var(--pico-t-medium); --t-inverse: var(--pico-t-medium-inverse); }\n.c-low { --c: var(--pico-s-low); --c-inverse: var(--pico-s-low-inverse); --t: var(--pico-t-low); --t-inverse: var(--pico-t-low-inverse); }\n.c-none { --c: var(--pico-s-none); --c-inverse: var(--pico-s-none-inverse); --t: var(--pico-t-none); --t-inverse: var(--pico-t-none-inverse); }\n\nhtml { scroll-padding-top: 5rem; }\n:focus-visible { outline: 3px solid var(--pico-primary); outline-offset: 2px; }\n.vh { position: absolute; width: 1px; height: 1px; margin: -1px; padding: 0; overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0; }\n.skip { position: absolute; left: 0.75rem; top: -4rem; z-index: 20; background: var(--pico-card-background-color); color: var(--pico-color); padding: 0.5rem 0.9rem; border-radius: var(--pico-border-radius); border: 2px solid var(--pico-primary); font-weight: 600; text-decoration: none; }\n.skip:focus { top: 0.6rem; }\n\n.topbar { position: sticky; top: 0; z-index: 10; display: flex; flex-wrap: wrap; align-items: center; gap: 0.4rem 1.25rem; background: var(--pico-primary-background); color: var(--pico-primary-inverse); padding: 0.85rem 1.75rem; }\n.topbar .brand { font-size: 1.2rem; font-weight: 700; margin: 0; color: inherit; }\n.topbar .report-type { font-size: 0.8rem; font-weight: 600; border: 1px solid currentcolor; border-radius: 5rem; padding: 0.1rem 0.7rem; }\n.topbar nav { margin-left: auto; padding: 0; }\n.topbar nav ul { margin: 0; color: inherit; }\n.topbar nav li { padding: 0; }\n.topbar a { color: inherit; text-decoration: none; font-size: 0.9rem; font-weight: 600; padding: 0.3rem 0.75rem; border-radius: 5rem; }\n.topbar a:hover { text-decoration: underline; }\n.topbar :focus-visible { outline-color: var(--pico-primary-inverse); }\n.theme-toggle { display: none; width: auto; font-size: 0.85rem; font-weight: 600; margin: 0; padding: 0.2rem 0.85rem; border: 1px solid currentcolor; border-radius: 5rem; background: transparent; color: inherit; }\n.js .theme-toggle { display: inline-flex; align-items: center; }\n\nsection.card { padding: var(--pico-block-spacing-vertical) var(--pico-block-spacing-horizontal); border: var(--pico-border-width) solid var(--pico-card-border-color); border-radius: var(--pico-border-radius); background: var(--pico-card-background-color); box-shadow: var(--pico-card-box-shadow); }\nsection.card > h2 { margin-bottom: 0.85rem; }\nsection.card > h3 { margin-top: 1.25rem; }\n.as-of, .empty, .formula { color: var(--pico-muted-color); font-size: 0.88rem; }\n\ndetails.fold { margin: 0.6rem 0; border: var(--pico-border-width) solid var(--pico-muted-border-color); border-radius: var(--pico-border-radius); background: var(--pico-card-background-color); }\ndetails.fold > summary { display: flex; align-items: center; gap: 0.6rem; line-height: inherit; padding: 0.55rem 2.2rem 0.55rem 0.9rem; position: relative; border-radius: var(--pico-border-radius); }\ndetails.fold > summary::after { position: absolute; right: 0.9rem; top: calc(50% - 0.5rem); margin-inline-start: 0; }\ndetails.fold > summary:hover { background: var(--pico-card-sectioning-background-color); }\ndetails.fold[open] > summary { border-bottom: var(--pico-border-width) solid var(--pico-muted-border-color); background: var(--pico-card-sectioning-background-color); }\ndetails.fold > summary > :where(h3, h4, h5) { display: inline; margin: 0; min-width: 0; overflow-wrap: anywhere; color: var(--pico-report-ink); }\ndetails.fold.source > summary > h3, details.fold.baseline > summary > :where(h3, h4) { font-size: 1.02rem; text-transform: none; letter-spacing: 0; }\ndetails.fold > summary > .count { flex: none; margin-left: auto; }\n.fold-body { padding: 0.75rem 0.9rem 0.9rem; }\n.fold-body > :first-child { margin-top: 0; }\n.fold-body > :last-child { margin-bottom: 0; }\n.count { display: inline-block; min-width: 1.6rem; text-align: center; font-size: 0.75rem; font-weight: 700; border-radius: 5rem; padding: 0.05rem 0.5rem; background: var(--pico-t-unknown); color: var(--pico-t-unknown-inverse); }\n.to-top { margin: 0.9rem 0 0; font-size: 0.85rem; text-align: right; }\n.page-top { position: fixed; right: 1rem; bottom: 1rem; z-index: 9; padding: 0.4rem 0.9rem; border-radius: 5rem; background: var(--pico-primary-background); color: var(--pico-primary-inverse); text-decoration: none; font-weight: 600; }\n\n.dashboard { display: grid; grid-template-columns: minmax(0, 2fr) minmax(0, 1.25fr) minmax(0, 1fr); gap: 1rem; margin: 1rem 0 1.25rem; align-items: stretch; }\n.facts, .components { display: grid; grid-template-columns: repeat(auto-fit, minmax(21rem, 1fr)); gap: 0.75rem; align-items: start; }\n.facts > details.fold, .components > details.fold { margin: 0; background: var(--pico-card-sectioning-background-color); }\n.panel { border: var(--pico-border-width) solid var(--pico-muted-border-color); border-radius: var(--pico-border-radius); padding: 1rem 1.1rem 1.15rem; background: var(--pico-card-sectioning-background-color); display: flex; flex-direction: column; }\n.panel > h3 { font-size: 1.02rem; margin-bottom: 0.7rem; }\n.stats { list-style: none; margin: 0; padding: 0; display: grid; grid-template-columns: repeat(auto-fit, minmax(8.5rem, 1fr)); gap: 0.6rem; }\n.stat { display: flex; flex-direction: column; gap: 0.1rem; border-radius: var(--pico-border-radius); padding: 0.65rem 0.8rem 0.7rem; background: var(--t); color: var(--t-inverse); border-left: 6px solid var(--c); }\n.stat .num { font-size: 1.9rem; font-weight: 800; line-height: 1.1; font-variant-numeric: tabular-nums; }\n.stat .lbl { font-weight: 700; font-size: 0.92rem; }\n.stat .sub { font-size: 0.78rem; }\n.stat-total { background: none; color: var(--pico-color); border: var(--pico-border-width) dashed var(--pico-form-element-border-color); border-left: 6px solid var(--pico-s-unknown); }\n.bar { display: flex; gap: 2px; height: 0.8rem; border-radius: 5rem; overflow: hidden; background: var(--pico-progress-background-color); margin-top: auto; }\n.stats + .bar { margin-top: 1rem; }\n.seg { flex: var(--n) 0 0; background: var(--c); }\n\n.compliance { text-align: center; align-items: center; }\n/* The ring's auto margins can only centre it if nothing else around it claims\n   vertical space, so the heading and the lines below it carry none of their own. */\n.compliance > h3 { align-self: flex-start; margin-bottom: 0; }\n.compliance > p { margin: 0; }\n.compliance > .level { margin-bottom: 0.45rem; }\n/* The ring: the percentage swept out of the track, with the same number printed\n   inside it, and the engine's 60/90 bands as its colour. The auto block margins\n   centre it in whatever height the row settles on. */\n.gauge { --ring: var(--pico-s-failed); width: 10.5rem; height: 10.5rem; margin: auto; border-radius: 50%; display: grid; place-items: center; background: conic-gradient(var(--ring) calc(var(--pct) * 1%), var(--pico-progress-background-color) 0); }\n.gauge .pct { width: 8.1rem; height: 8.1rem; border-radius: 50%; background: var(--pico-card-sectioning-background-color); display: grid; place-items: center; font-size: 1.75rem; font-weight: 800; font-variant-numeric: tabular-nums; color: var(--pico-report-ink); }\n.compliance-high .gauge { --ring: var(--pico-s-passed); }\n.compliance-medium .gauge { --ring: var(--pico-s-not-reviewed); }\n.level { font-weight: 700; display: inline-block; border-radius: 5rem; padding: 0.1rem 0.85rem; background: var(--t); color: var(--t-inverse); }\n.compliance-high { --t: var(--pico-t-passed); --t-inverse: var(--pico-t-passed-inverse); }\n.compliance-medium { --t: var(--pico-t-not-reviewed); --t-inverse: var(--pico-t-not-reviewed-inverse); }\n.compliance-low { --t: var(--pico-t-failed); --t-inverse: var(--pico-t-failed-inverse); }\n\ndl { display: grid; grid-template-columns: max-content 1fr; gap: 0.3rem 1.25rem; margin: 0.5rem 0; }\ndt { font-weight: 600; color: var(--pico-muted-color); }\ndd { margin: 0; overflow-wrap: anywhere; }\n.table-wrap { overflow-x: auto; border: var(--pico-border-width) solid var(--pico-muted-border-color); border-radius: var(--pico-border-radius); margin: 0.5rem 0; }\n.table-wrap > table { margin: 0; font-size: 0.9rem; }\nth, td { padding: 0.5rem 0.8rem; vertical-align: top; }\nthead th { background: var(--pico-card-sectioning-background-color); font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.05em; color: var(--pico-muted-color); }\ntfoot th, tfoot td { font-weight: 700; background: var(--pico-card-sectioning-background-color); }\ntd.text { white-space: pre-wrap; overflow-wrap: anywhere; }\ntable.summary td, table.summary thead th:not(:first-child) { text-align: right; font-variant-numeric: tabular-nums; }\ntable.details th { width: 11.5rem; background: var(--pico-card-sectioning-background-color); color: var(--pico-muted-color); font-weight: 600; }\n\n.component .type { font-weight: 600; font-size: 0.75rem; border-radius: 5rem; padding: 0.05rem 0.6rem; background: var(--pico-primary-background); color: var(--pico-primary-inverse); }\n.chips { list-style: none; display: flex; flex-wrap: wrap; gap: 0.4rem; margin: 0.25rem 0 0; padding: 0; }\n.chips li { display: inline-flex; border: var(--pico-border-width) solid var(--pico-form-element-border-color); border-radius: var(--pico-border-radius); overflow: hidden; font-size: 0.82rem; background: var(--pico-card-background-color); }\n.chips .k { background: var(--pico-t-unknown); color: var(--pico-t-unknown-inverse); padding: 0.15rem 0.5rem; font-weight: 700; }\n.chips .v { padding: 0.15rem 0.55rem; overflow-wrap: anywhere; }\n\n.toolbar { display: none; flex-wrap: wrap; align-items: center; gap: 0.6rem 0.75rem; margin: 0 0 1.1rem; padding: 0.75rem; border: var(--pico-border-width) solid var(--pico-muted-border-color); border-radius: var(--pico-border-radius); background: var(--pico-card-sectioning-background-color); }\n.js .toolbar { display: flex; }\n.toolbar input { flex: 1 1 16rem; width: auto; margin: 0; }\n.toolbar button { width: auto; margin: 0; font-size: 0.86rem; padding: 0.3rem 0.85rem; }\n.toolbar button[aria-pressed=\"false\"] { --pico-background-color: var(--pico-card-background-color); --pico-border-color: var(--pico-form-element-border-color); --pico-color: var(--pico-contrast); }\n.filters { display: flex; flex-wrap: wrap; gap: 0.35rem; }\n.shown { color: var(--pico-muted-color); font-size: 0.86rem; margin-left: auto; }\n\ndetails.fold.source { border-left: 5px solid var(--pico-primary); }\ndetails.fold.baseline { border-left: 5px solid var(--pico-muted-border-color); }\narticle.requirement { margin: 0.5rem 0; padding: 0; border: var(--pico-border-width) solid var(--pico-muted-border-color); border-left: 6px solid var(--c); border-radius: var(--pico-border-radius); background: var(--pico-card-background-color); box-shadow: none; }\narticle.requirement > details { margin: 0; }\n.req-head, article.requirement summary { display: grid; grid-template-columns: 11rem minmax(6rem, 11rem) 7.5rem minmax(10rem, 2fr) minmax(8rem, 1.4fr); gap: 0.85rem; align-items: center; }\n.req-head { padding: 0.4rem 2.6rem 0.4rem 1.1rem; font-size: 0.74rem; font-weight: 700; color: var(--pico-muted-color); text-transform: uppercase; letter-spacing: 0.06em; }\narticle.requirement summary { line-height: inherit; padding: 0.7rem 2.6rem 0.7rem 0.95rem; position: relative; }\narticle.requirement summary::after { position: absolute; right: 1.1rem; top: calc(50% - 0.5rem); margin-inline-start: 0; }\narticle.requirement summary:hover { background: var(--pico-card-sectioning-background-color); }\narticle.requirement details[open] > summary { border-bottom: var(--pico-border-width) solid var(--pico-muted-border-color); background: var(--pico-card-sectioning-background-color); }\narticle.requirement details[open] > summary { position: sticky; top: 3.4rem; z-index: 5; }\n.req-body { padding: 0.9rem 1.1rem 1.1rem; }\n.req-body > :last-child { margin-bottom: 0; }\n.req-id { font-weight: 700; overflow-wrap: anywhere; }\n.req-title { overflow-wrap: anywhere; }\n.location { display: flex; flex-wrap: wrap; align-items: center; gap: 0.6rem; margin: 0 0 0.6rem; padding: 0.5rem 0.75rem; border: var(--pico-border-width) solid var(--pico-muted-border-color); border-left: 4px solid var(--pico-primary); border-radius: var(--pico-border-radius); background: var(--pico-card-sectioning-background-color); }\n.location .k, .sub .k { font-size: 0.74rem; font-weight: 700; text-transform: uppercase; letter-spacing: 0.06em; color: var(--pico-muted-color); }\n.sub { display: block; margin-top: 0.35rem; font-size: 0.85rem; }\n.tags { display: flex; flex-wrap: wrap; gap: 0.3rem; }\n.tag { font-size: 0.75rem; font-weight: 600; border: var(--pico-border-width) solid var(--pico-form-element-border-color); border-radius: 5rem; padding: 0.05rem 0.55rem; background: var(--pico-card-background-color); white-space: nowrap; }\n.tag.enriched { background: var(--pico-primary-background); border-color: var(--pico-primary-background); color: var(--pico-primary-inverse); }\n/* Status and severity carry a mark and a word as well as a colour, so neither\n   colour vision nor a greyscale printer is needed to read them. */\n.status, .sev { display: inline-flex; align-items: center; gap: 0.35rem; border-radius: 5rem; padding: 0.15rem 0.7rem; font-size: 0.8rem; font-weight: 700; white-space: nowrap; width: fit-content; }\n.status { color: var(--c-inverse); background: var(--c); }\n.status .ico { font-weight: 400; }\n.sev { background: var(--t); color: var(--t-inverse); }\n.sev::before { content: \"\"; width: 0.6rem; height: 0.6rem; border-radius: 50%; background: var(--c); flex: none; }\ndetails.doc { margin: 0.5rem 0 0; }\ndetails.doc > summary { font-weight: 600; font-size: 0.85rem; width: fit-content; }\ndetails.doc > pre { white-space: pre-wrap; }\npre { margin: 0.25rem 0 0.5rem; white-space: pre-wrap; overflow-wrap: anywhere; font-size: 0.85rem; }\npre.prose { font-family: var(--pico-font-family-sans-serif); font-size: 0.92rem; margin: 0; padding: 0; background: none; color: inherit; }\n.req-body > pre.prose { margin-bottom: 0.25rem; }\npre.code { background: var(--pico-code-background-color); color: var(--pico-code-color); border-radius: var(--pico-border-radius); padding: 0.85rem 1rem; }\n\n@media (prefers-reduced-motion: no-preference) { html { scroll-behavior: smooth; } }\n@media (forced-colors: active) { .status, .sev, .tag, .stat, .seg, .gauge, .level, .count, .component .type { border: 1px solid; forced-color-adjust: auto; } }\n@media (max-width: 68rem) { .dashboard { grid-template-columns: 1fr 1fr; } .dashboard .panel:first-child { grid-column: 1 / -1; } }\n@media (max-width: 60rem) { .topbar { position: static; } article.requirement details[open] > summary { top: 0; } .req-head { display: none; } article.requirement summary { grid-template-columns: 1fr 1fr; } .req-title, .tags { grid-column: 1 / -1; } }\n@media (max-width: 40rem) { .dashboard { grid-template-columns: 1fr; } .topbar { padding: 0.75rem 1rem; } dl { grid-template-columns: 1fr; gap: 0 0; } dd { margin-bottom: 0.4rem; } }\n\n/* Pico ships no print rules. Collapsed content is invisible on paper and to the\n   reader's find-in-page, so every disclosure is opened and the chrome removed. */\n@media print {\n  :root, [data-theme=\"dark\"] { color-scheme: light; }\n  body { background: #ffffff; color: #000000; }\n  .topbar { position: static; }\n  .skip, .toolbar, .theme-toggle, .page-top, .to-top, .topbar nav { display: none !important; }\n  details { display: block; }\n  details > *:not(summary) { display: revert !important; }\n  details > summary::after { display: none; }\n  main { padding: 0; max-width: none; }\n  section.card, article.requirement, details.fold { box-shadow: none; }\n  thead { display: table-header-group; }\n  tr, article.requirement, pre, figure, table { break-inside: avoid; }\n  h2, h3, h4 { break-after: avoid; }\n  p, li { orphans: 3; widows: 3; }\n  * { -webkit-print-color-adjust: exact; print-color-adjust: exact; }\n  @page { margin: 1.5cm; }\n}\n";
+/** The only script the report carries. */
+const SCRIPT = "(function () {\n  'use strict';\n  var slice = Array.prototype.slice;\n  var root = document.documentElement;\n  var themeKey = 'hdf-report-theme';\n\n  function all(selector) {\n    return slice.call(document.querySelectorAll(selector));\n  }\n\n  // Theme: the reader's choice wins over the system setting and is remembered.\n  var toggle = document.getElementById('theme-toggle');\n\n  function systemDark() {\n    return window.matchMedia('(prefers-color-scheme: dark)').matches;\n  }\n\n  function currentTheme() {\n    var chosen = root.getAttribute('data-theme');\n    if (chosen === 'dark' || chosen === 'light') {\n      return chosen;\n    }\n    return systemDark() ? 'dark' : 'light';\n  }\n\n  function showTheme() {\n    var dark = currentTheme() === 'dark';\n    toggle.textContent = dark ? 'Light mode' : 'Dark mode';\n    toggle.setAttribute('aria-label', dark ? 'Switch to light mode' : 'Switch to dark mode');\n  }\n\n  function remember(theme) {\n    try {\n      window.localStorage.setItem(themeKey, theme);\n    } catch (ignore) {\n      return;\n    }\n  }\n\n  function recall() {\n    try {\n      return window.localStorage.getItem(themeKey);\n    } catch (ignore) {\n      return null;\n    }\n  }\n\n  var saved = recall();\n  if (saved === 'dark' || saved === 'light') {\n    root.setAttribute('data-theme', saved);\n  }\n  toggle.addEventListener('click', function () {\n    var next = currentTheme() === 'dark' ? 'light' : 'dark';\n    root.setAttribute('data-theme', next);\n    remember(next);\n    showTheme();\n  });\n  showTheme();\n\n  // Print the whole report, in the light palette, whatever is open on screen.\n  var beforePrint = null;\n  window.addEventListener('beforeprint', function () {\n    beforePrint = root.getAttribute('data-theme');\n    root.setAttribute('data-theme', 'light');\n    all('details').forEach(function (d) {\n      d.open = true;\n    });\n  });\n  window.addEventListener('afterprint', function () {\n    if (beforePrint === null) {\n      root.removeAttribute('data-theme');\n    } else {\n      root.setAttribute('data-theme', beforePrint);\n    }\n  });\n\n  root.classList.add('js');\n\n  // Results filter: only the reports that list requirements carry it.\n  var box = document.getElementById('filter-text');\n  if (box === null) {\n    return;\n  }\n  var reqs = all('article.requirement');\n  var groups = all('#results details.group');\n  var shown = document.getElementById('filter-count');\n  var buttons = all('button.filter');\n  var status = 'all';\n\n  // Each requirement is an article holding one disclosure, so opening and\n  // closing it reaches past the article to that element.\n  function panel(req) {\n    return req.querySelector('details');\n  }\n\n  function matches(d, query) {\n    if (status !== 'all') {\n      if (d.getAttribute('data-status') !== status) {\n        return false;\n      }\n    }\n    if (query === '') {\n      return true;\n    }\n    return d.querySelector('summary').textContent.toLowerCase().indexOf(query) !== -1;\n  }\n\n  function apply() {\n    var query = box.value.trim().toLowerCase();\n    var filtering = query !== '' || status !== 'all';\n    var visible = 0;\n    reqs.forEach(function (d) {\n      var ok = matches(d, query);\n      d.hidden = !ok;\n      if (ok) {\n        visible += 1;\n      }\n    });\n    // A filter is no use if its matches sit inside closed groups.\n    groups.forEach(function (g) {\n      var any = g.querySelector('article.requirement:not([hidden])') !== null;\n      g.hidden = filtering ? !any : false;\n      if (filtering) {\n        g.open = any;\n      }\n    });\n    shown.textContent = visible + ' of ' + reqs.length + ' requirements shown';\n  }\n\n  function setOpen(open) {\n    groups.forEach(function (g) {\n      if (!g.hidden) {\n        g.open = open;\n      }\n    });\n    reqs.forEach(function (d) {\n      if (!d.hidden) {\n        panel(d).open = open;\n      }\n    });\n  }\n\n  buttons.forEach(function (b) {\n    b.addEventListener('click', function () {\n      status = b.getAttribute('data-status');\n      buttons.forEach(function (other) {\n        other.setAttribute('aria-pressed', other === b ? 'true' : 'false');\n      });\n      apply();\n    });\n  });\n  box.addEventListener('input', apply);\n  document.getElementById('expand-all').addEventListener('click', function () {\n    setOpen(true);\n  });\n  document.getElementById('collapse-all').addEventListener('click', function () {\n    setOpen(false);\n  });\n  apply();\n})();\n";
+/** The CSP source expression for SCRIPT; a test recomputes it from the file. */
+const SCRIPT_HASH = "sha256-8niHkNd3MWeaLiFb0O47hR5NXEwDnmbycK+zHXeWXN0=";
+//#endregion
+//#region converters/hdf-to-html/typescript/converter.ts
+/**
+* Renders an HDF results document as one self-contained HTML report. The Go
+* peer emits the same bytes for the same input, so every choice here that
+* affects output (ordering, escaping, number and time formatting) mirrors it
+* and is pinned by the shared goldens.
+*/
+const CONVERTER_NAME$2 = "hdf-to-html";
+/** Reads a report type case-insensitively; empty selects 'administrator'. */
+function parseReportType(value) {
+	switch ((value ?? "").trim().toLowerCase()) {
+		case "":
+		case "administrator": return "administrator";
+		case "manager": return "manager";
+		case "executive": return "executive";
+		default: throw new Error(`unknown report type ${JSON.stringify(value)}: must be one of executive, manager, administrator`);
+	}
+}
+/**
+* Renders an HDF results document as HTML. The output depends on the input and
+* options alone: nothing is read from the clock or the host, so the same
+* document always yields the same report.
+*/
+function convertHdfToHtml(input, options = {}) {
+	return render([{
+		name: "",
+		content: input
+	}], options, false);
+}
+/**
+* Renders several results documents as one report: combined status, severity
+* and compliance, then each document's own context, components and results
+* under its name. Documents appear in the order given.
+*/
+function convertHdfDocumentsToHtml(documents, options = {}) {
+	if (documents.length === 0) throw new Error(`${CONVERTER_NAME$2}: no documents to report on`);
+	return render(documents, options, true);
+}
+function render(documents, options, aggregated) {
+	let reportType;
+	try {
+		reportType = parseReportType(options.reportType);
+	} catch (err) {
+		throw new Error(`${CONVERTER_NAME$2}: ${err.message}`);
+	}
+	const sources = documents.map((document) => {
+		let doc;
+		try {
+			({doc} = requireHdfResults(document.content, CONVERTER_NAME$2));
+		} catch (err) {
+			if (!aggregated) throw err;
+			throw new Error(`${document.name}: ${err.message}`);
+		}
+		const baselines = list(doc.baselines).map(obj);
+		return {
+			name: document.name,
+			doc,
+			baselines,
+			baselineLabels: baselineLabels(baselines),
+			attributed: attributesResults(doc, baselines),
+			ref: assessmentTime(doc, baselines)
+		};
+	});
+	const r = new Renderer(reportType, sources, aggregated);
+	r.document();
+	return r.lines.join("");
+}
+/**
+* Names each baseline as the report shows it: its title, which is what carries
+* the scan target in real scanner output, falling back to its name. A label two
+* baselines would share takes the 1-based document position of the baseline it
+* names (hdf-engine's 0-based baselineIndex plus one).
+*/
+function baselineLabels(baselines) {
+	const shared = /* @__PURE__ */ new Map();
+	const suffixed = baselines.map((baseline) => {
+		const title = text(baseline.title);
+		const label = title !== "" ? title : text(baseline.name);
+		shared.set(label, (shared.get(label) ?? 0) + 1);
+		return label;
+	}).map((label, i) => (shared.get(label) ?? 0) > 1 ? label + ordinalSuffix(i) : label);
+	const taken = /* @__PURE__ */ new Set();
+	return suffixed.map((label, i) => {
+		let unique = label;
+		while (taken.has(unique)) unique += ordinalSuffix(i);
+		taken.add(unique);
+		return unique;
+	});
+}
+function ordinalSuffix(i) {
+	return ` #${i + 1}`;
+}
+/** The well-known baseline label naming the component a baseline's requirements were assessed against. */
+const LABEL_COMPONENT = "component";
+/**
+* Whether the document ties any requirement to a component. HDF results carry
+* that link at baseline granularity only — a baseline's labels.component names a
+* component, or a component's baselineRefs name a baseline — so a per-component
+* number means nothing without one.
+*/
+function attributesResults(doc, baselines) {
+	for (const baseline of baselines) {
+		const labels = obj(baseline.labels);
+		if (Object.prototype.hasOwnProperty.call(labels, LABEL_COMPONENT) && text(labels[LABEL_COMPONENT]) !== "") return true;
+	}
+	return list(doc.components).map(obj).some((c) => list(c.baselineRefs).length > 0);
+}
+/** A JSON value as an object; anything else reads as an empty one, as Go's zero struct does. */
+function obj(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function list(value) {
+	return Array.isArray(value) ? value : [];
+}
+/** A string field as text; absent or wrong-typed reads as empty, as Go's zero value does. */
+function text(value) {
+	return typeof value === "string" ? value : "";
+}
+function numeric(value) {
+	return typeof value === "number" ? value : 0;
+}
+/** HDF's canonical trimmed-UTC RFC3339; absent or unparseable is empty. */
+function formatTime(value) {
+	const parsed = toDate$1(value);
+	return parsed ? formatTimestamp(parsed) : "";
+}
+function toDate$1(value) {
+	const parsed = parsedDate(value);
+	return parsed && !isGoZeroTime(parsed) ? parsed : null;
+}
+function parsedDate(value) {
+	if (value instanceof Date) return value;
+	return typeof value === "string" ? parseTimestamp(value) : null;
+}
+/**
+* When the assessment ran: the document timestamp, else its latest result start
+* time. Overrides are judged against it instead of the wall clock, which is
+* what keeps the report reproducible.
+*/
+function assessmentTime(doc, baselines) {
+	const latest = toDate$1(doc.timestamp) ?? latestStart(baselines);
+	if (!latest) {
+		const epoch = /* @__PURE__ */ new Date(0);
+		return {
+			stamp: formatTimestamp(epoch),
+			date: epoch,
+			known: false
+		};
+	}
+	return {
+		stamp: formatTimestamp(latest),
+		date: latest,
+		known: true
+	};
+}
+/** The latest result start time in the document, if any result carries one. */
+function latestStart(baselines) {
+	let latest = null;
+	const results = baselines.flatMap((baseline) => list(baseline.requirements).map(obj)).flatMap((req) => list(req.results).map(obj));
+	for (const res of results) {
+		const start = toDate$1(res.startTime);
+		if (start && (!latest || start > latest)) latest = start;
+	}
+	return latest;
+}
+/**
+* The compliance percentage hdf-engine computes, to two places, so the report
+* never disagrees with `hdf validate threshold` in the last digit. The Go peer
+* formats the same number with FormatFixed, which is toFixed's rounding.
+*/
+function compliancePercent(c) {
+	return calculateCompliance(c).toFixed(2);
+}
+function compliance(c) {
+	return `${compliancePercent(c)}%`;
+}
+/** The requirement's severity through the engine, exactly as its tally derives it. */
+function requirementSeverity(req, now) {
+	return deriveSeverity(requirementEffectiveImpact(req, now), req.severity ?? null);
+}
+/**
+* Maps overrides onto the canonical effective-status input shape. formatTime
+* drops Go's zero time, which the legacy converters leave in `expiresAt` to
+* mean "no expiry": handing the raw value to the status ladder would read it as
+* an expiry in the year 1 and disagree with both the overrides table and Go,
+* whose zero time.Time already means absent. Effective status and the table's
+* governing/expired column read the same normalized overrides.
+*/
+function overrideInputs(overrides) {
+	return overrides.map((o) => ({
+		status: text(o.status) === "" ? void 0 : text(o.status),
+		appliedAt: formatTime(o.appliedAt) || void 0,
+		expiresAt: formatTime(o.expiresAt) || void 0
+	}));
+}
+/** Bands the engine's compliance percentage at 90 and 60. */
+function complianceLevel(pct) {
+	if (pct >= 90) return ["high", "High compliance"];
+	if (pct >= 60) return ["medium", "Medium compliance"];
+	return ["low", "Low compliance"];
+}
+/** Maps a severity onto the fixed set the stylesheet knows; an informational, absent or unrecognized one is 'none'. */
+function severityClass(severity) {
+	const bucket = severityBucket(severity);
+	return bucket === "informational" ? "none" : bucket;
+}
+function severityLabel(severity) {
+	switch (severity) {
+		case "critical": return "Critical";
+		case "high": return "High";
+		case "medium": return "Medium";
+		case "low": return "Low";
+		case "":
+		case "none":
+		case "informational": return "None";
+		default: return severity;
+	}
+}
+/** Names a description the way the Heimdall report does. */
+function descriptionHeading(label) {
+	switch (label) {
+		case "default": return "Description";
+		case "check": return "Check Text";
+		case "fix": return "Fix Text";
+		case "rationale": return "Rationale";
+		case "caveat": return "Caveat";
+		default: return label;
+	}
+}
+function plural(n, noun) {
+	return n === 1 ? `1 ${noun}` : `${n} ${noun}s`;
+}
+function stat(cls, n, label, sub) {
+	return `<li class="stat c-${cls}"><span class="num">${n}</span><span class="lbl">${label}</span>${sub === "" ? "" : `<span class="sub">${sub}</span>`}</li>`;
+}
+/**
+* A proportional strip; a zero count contributes no segment. It is an image to
+* assistive technology, described by the same counts the list above it states,
+* so nothing is conveyed by colour alone.
+*/
+function bar(label, segments) {
+	return `<div class="bar" role="img" aria-label="${label}: ${segments.map(([, name, n]) => `${n} ${name}`).join(", ")}">${segments.filter(([, , n]) => n > 0).map(([cls, , n]) => `<span class="seg c-${cls}" style="--n:${n}"></span>`).join("")}</div>`;
+}
+/** A heading and a value that are already HTML. */
+function detailRow(heading, value) {
+	return `<tr><th scope="row">${heading}</th><td>${value}</td></tr>`;
+}
+/** Carries text verbatim. An HTML parser drops one newline directly after <pre>, so one is always written for it to drop. */
+function prose(value) {
+	return `<pre class="prose">\n${escapeHtml(value)}</pre>`;
+}
+const REPORT_TYPE_LABEL = {
+	executive: "Executive",
+	manager: "Manager",
+	administrator: "Administrator"
+};
+const STATUS_FILTERS = [
+	["passed", "Passed"],
+	["failed", "Failed"],
+	["not-applicable", "Not Applicable"],
+	["not-reviewed", "Not Reviewed"],
+	["error", "Error"]
+];
+/**
+* The size past which a block starts closed: anything longer than two lines or
+* rows is behind its heading, so a long report is a list of headings with
+* counts instead of a scroll.
+*/
+const COLLAPSED_ABOVE = 2;
+/** How many lines text occupies. */
+function lineCount(value) {
+	return value.split("\n").length;
+}
+/** Text that would take more than two lines on the page: more than two lines of its own, or one long enough to wrap that far. */
+function isLongText(value) {
+	return lineCount(value) > COLLAPSED_ABOVE || Array.from(value).length > 240;
+}
+function countFacts(pairs) {
+	return pairs.filter(([, value]) => value !== "").length;
+}
+var Renderer = class {
+	/**
+	* `aggregated` lays the report out by source, even for a single document;
+	* the single-document layout has no source level.
+	*/
+	constructor(reportType, sources, aggregated) {
+		this.reportType = reportType;
+		this.sources = sources;
+		this.aggregated = aggregated;
+		this.lines = [];
+		this.folds = 0;
+		this.requirements = 0;
+		this.src = sources[0];
+	}
+	/** The heading outline stays in order: the aggregated layout has a source heading above the baselines. */
+	get baselineHeading() {
+		return this.aggregated ? "h4" : "h3";
+	}
+	get detailHeading() {
+		return this.aggregated ? "h5" : "h4";
+	}
+	/**
+	* Starts a collapsible block: a heading with a count that opens onto the
+	* content. `title` is HTML; `label` is the plain text the return link names.
+	* An empty id takes the next number.
+	*/
+	openFold(cls, id, tag, title, label, count) {
+		return this.openFoldCounted(cls, id, tag, title, label, count, true);
+	}
+	/** openFold with the choice of whether the heading states its count. A block that drops it still collapses at the same size. */
+	openFoldCounted(cls, id, tag, title, label, count, counted) {
+		if (id === "") {
+			this.folds++;
+			id = `block-${this.folds}`;
+		}
+		const long = count > COLLAPSED_ABOVE;
+		const classes = cls === "" ? "fold" : `fold ${cls}`;
+		const badge = counted ? `<span class="count">${count}</span>` : "";
+		this.line(`<details class="${classes}" id="${id}"${long ? "" : " open=\"open\""}>`);
+		this.line(`<summary><${tag}>${title}</${tag}>${badge}</summary>`);
+		this.line("<div class=\"fold-body\">");
+		return {
+			id,
+			label,
+			long
+		};
+	}
+	/** Ends the block, with a way back to its top when it is long enough to need one. */
+	closeFold(f) {
+		if (f.long) this.line(`<p class="to-top"><a href="#${f.id}">Back to the top of ${escapeHtml(f.label)}</a></p>`);
+		this.line("</div>");
+		this.line("</details>");
+	}
+	line(s) {
+		this.lines.push(s, "\n");
+	}
+	document() {
+		const detailed = this.reportType !== "executive";
+		const policy = `default-src 'none'; style-src 'unsafe-inline'; script-src '${SCRIPT_HASH}'`;
+		this.line("<!DOCTYPE html>");
+		this.line("<html lang=\"en\">");
+		this.line("<head>");
+		this.line("<meta charset=\"utf-8\" />");
+		this.line(`<meta http-equiv="Content-Security-Policy" content="${policy}" />`);
+		this.line("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />");
+		this.line("<meta name=\"color-scheme\" content=\"light dark\" />");
+		this.line("<title>HDF Assessment Report</title>");
+		this.line("<style>");
+		this.lines.push(STYLESHEET);
+		this.line("</style>");
+		this.line("</head>");
+		this.line("<body>");
+		this.line("<a class=\"skip\" href=\"#main\">Skip to content</a>");
+		this.line("<header class=\"topbar\" id=\"top\">");
+		this.line("<h1 class=\"brand\">HDF Assessment Report</h1>");
+		this.line(`<span class="report-type">Report type: ${REPORT_TYPE_LABEL[this.reportType]}</span>`);
+		this.line("<nav aria-label=\"Sections\">");
+		this.line("<ul>");
+		this.line("<li><a href=\"#status\">Status</a></li>");
+		this.line(this.aggregated ? "<li><a href=\"#sources\">Sources</a></li>" : "<li><a href=\"#assessment\">Assessment</a></li>");
+		this.line("<li><a href=\"#components\">Components</a></li>");
+		if (detailed) this.line("<li><a href=\"#results\">Results</a></li>");
+		this.line("</ul>");
+		this.line("</nav>");
+		this.line("<button type=\"button\" id=\"theme-toggle\" class=\"theme-toggle\" aria-label=\"Switch to dark mode\">Dark mode</button>");
+		this.line("</header>");
+		this.line("<main id=\"main\" class=\"container\">");
+		this.status();
+		if (this.aggregated) this.sourceList();
+		else this.assessment(this.sources[0].doc);
+		this.components();
+		if (detailed) this.results();
+		this.line("</main>");
+		this.line("<a class=\"page-top\" href=\"#top\">Top</a>");
+		this.line("<script>");
+		this.lines.push(SCRIPT);
+		this.line("<\/script>");
+		this.line("</body>");
+		this.line("</html>");
+	}
+	/** Writes the non-empty pairs and reports whether it wrote any. */
+	definitionList(pairs) {
+		let wrote = false;
+		for (const [term, value] of pairs) {
+			if (value === "") continue;
+			if (!wrote) {
+				this.line("<dl>");
+				wrote = true;
+			}
+			this.line(`<dt>${escapeHtml(term)}</dt><dd>${escapeHtml(value)}</dd>`);
+		}
+		if (wrote) this.line("</dl>");
+		return wrote;
+	}
+	assessment(doc) {
+		this.line("<section id=\"assessment\" class=\"card\" aria-labelledby=\"assessment-heading\">");
+		this.line("<h2 id=\"assessment-heading\">Assessment</h2>");
+		this.line("<div class=\"facts\">");
+		const facts = documentFacts(doc);
+		const f = this.openFold("", "", "h3", "Document", "the document facts", countFacts(facts));
+		if (!this.definitionList(facts)) this.line("<p class=\"empty\">The document carries no assessment metadata.</p>");
+		this.closeFold(f);
+		if (doc.runner != null) {
+			const runner = runnerFacts(obj(doc.runner));
+			const rf = this.openFold("", "", "h3", "Runner", "the runner facts", countFacts(runner));
+			this.definitionList(runner);
+			this.closeFold(rf);
+		}
+		this.line("</div>");
+		this.externalReferences("h3", "Enrichment and External References", doc.externalReferences);
+		this.line("</section>");
+	}
+	/** The aggregated layout's assessment section: one panel per input document, each the target of the links in the status tables. */
+	sourceList() {
+		this.line("<section id=\"sources\" class=\"card\" aria-labelledby=\"sources-heading\">");
+		this.line(`<h2 id="sources-heading">Sources (${this.sources.length})</h2>`);
+		this.line("<div class=\"facts\">");
+		this.sources.forEach((src, i) => {
+			const facts = documentFacts(src.doc);
+			const f = this.openFold("", sourceId(i), "h3", escapeHtml(src.name), src.name, countFacts(facts));
+			if (!this.definitionList(facts)) this.line("<p class=\"empty\">The document carries no assessment metadata.</p>");
+			if (src.doc.runner != null) {
+				this.line("<h4>Runner</h4>");
+				this.definitionList(runnerFacts(obj(src.doc.runner)));
+			}
+			this.externalReferences("h4", "Enrichment and External References", src.doc.externalReferences);
+			this.closeFold(f);
+		});
+		this.line("</div>");
+		this.line("</section>");
+	}
+	components() {
+		const perSource = this.sources.map((src) => list(src.doc.components).map(obj));
+		const total = perSource.reduce((n, components) => n + components.length, 0);
+		this.line("<section id=\"components\" class=\"card\" aria-labelledby=\"components-heading\">");
+		this.line(`<h2 id="components-heading">Components (${total})</h2>`);
+		if (total > 0) {
+			this.line("<div class=\"components\">");
+			this.sources.forEach((src, i) => {
+				this.src = src;
+				for (const c of perSource[i]) this.component(c);
+			});
+			this.line("</div>");
+		} else if (this.aggregated) this.line("<p class=\"empty\">The documents name no components.</p>");
+		else this.line("<p class=\"empty\">The document names no components.</p>");
+		this.line("</section>");
+	}
+	component(c) {
+		const pairs = [["Source", this.aggregated ? this.src.name : ""]];
+		for (const [term, key] of COMPONENT_FIELDS) pairs.push(componentField(c, term, key));
+		const f = this.openFoldCounted("component", "", "h3", `${escapeHtml(text(c.name))} <span class="type">${escapeHtml(text(c.type))}</span>`, text(c.name), countFacts(pairs) + Object.keys(obj(c.labels)).length + Object.keys(obj(c.externalIds)).length, this.src.attributed);
+		this.definitionList(pairs);
+		this.chips("Labels", c.labels);
+		this.chips("External IDs", c.externalIds);
+		this.closeFold(f);
+	}
+	/** A map as key/value chips in key order. An empty value is kept: the key itself is the information. */
+	chips(heading, value) {
+		const m = obj(value);
+		const keys = Object.keys(m).sort(byCodePoint);
+		if (keys.length === 0) return;
+		this.line(`<h4>${heading}</h4>`);
+		this.line("<ul class=\"chips\">");
+		for (const k of keys) this.line(`<li><span class="k">${escapeHtml(k)}</span><span class="v">${escapeHtml(text(m[k]))}</span></li>`);
+		this.line("</ul>");
+	}
+	effectiveStatus(req) {
+		return computeEffectiveStatus({
+			impact: numeric(req.impact),
+			resultStatuses: list(req.results).map(obj).map((res) => text(res.status)),
+			overrides: overrideInputs(list(req.statusOverrides).map(obj))
+		}, this.src.ref.stamp);
+	}
+	status() {
+		const checks = {
+			underPassed: 0,
+			passedUnderFailed: 0,
+			failedUnderFailed: 0,
+			total: 0
+		};
+		const perBaseline = this.sources.map((src) => {
+			this.src = src;
+			return src.baselines.map((baseline) => {
+				const requirements = list(baseline.requirements).map(obj);
+				for (const req of requirements) {
+					const status = this.effectiveStatus(req);
+					for (const res of list(req.results).map(obj)) {
+						checks.total++;
+						const resultStatus = text(res.status);
+						if (status === "passed" && resultStatus === "passed") checks.underPassed++;
+						else if (status === "failed" && resultStatus === "passed") checks.passedUnderFailed++;
+						else if (status === "failed" && resultStatus === "failed") checks.failedUnderFailed++;
+					}
+				}
+				return countControlsByStatus({ baselines: [{ requirements }] }, (req) => this.effectiveStatus(req), this.src.ref.stamp);
+			});
+		});
+		const perSource = perBaseline.map((counts) => addCounts(...counts));
+		const all = addCounts(...perSource);
+		const severities = severityTotals(all);
+		const anyRef = this.sources.some((src) => src.ref.known);
+		this.line("<section id=\"status\" class=\"card\" aria-labelledby=\"status-heading\">");
+		this.line("<h2 id=\"status-heading\">Status</h2>");
+		if (severities.total > 0 && anyRef) {
+			if (this.aggregated) this.line("<p class=\"as-of\">Effective status evaluated for each source as of its own assessment time. Overrides that had expired by then are not applied.</p>");
+			else this.line(`<p class="as-of">Effective status evaluated as of ${escapeHtml(this.sources[0].ref.stamp)}, the time of the assessment. Overrides that had expired by then are not applied.</p>`);
+		}
+		this.line("<div class=\"dashboard\">");
+		this.line("<div class=\"panel\">");
+		this.line("<h3>Requirements</h3>");
+		this.line("<ul class=\"stats\">");
+		this.line(stat("passed", all.passed.total, "Passed", `${plural(checks.underPassed, "individual check")} passed`));
+		this.line(stat("failed", all.failed.total, "Failed", `${plural(checks.passedUnderFailed, "individual check")} passed, ${checks.failedUnderFailed} failed out of ${plural(checks.total, "total check")}`));
+		this.line(stat("not-applicable", all.noImpact.total, "Not Applicable", ""));
+		this.line(stat("not-reviewed", all.skipped.total, "Not Reviewed", ""));
+		this.line(stat("error", all.error.total, "Error", ""));
+		this.line(`<li class="stat stat-total"><span class="num">${severities.total}</span><span class="lbl">Total</span></li>`);
+		this.line("</ul>");
+		this.line(bar("Requirements by status", [
+			[
+				"passed",
+				"passed",
+				all.passed.total
+			],
+			[
+				"failed",
+				"failed",
+				all.failed.total
+			],
+			[
+				"not-applicable",
+				"not applicable",
+				all.noImpact.total
+			],
+			[
+				"not-reviewed",
+				"not reviewed",
+				all.skipped.total
+			],
+			[
+				"error",
+				"error",
+				all.error.total
+			]
+		]));
+		this.line("</div>");
+		this.line("<div class=\"panel\">");
+		this.line("<h3>Severity</h3>");
+		this.line("<ul class=\"stats\">");
+		this.line(stat("critical", severities.critical, "Critical", ""));
+		this.line(stat("high", severities.high, "High", ""));
+		this.line(stat("medium", severities.medium, "Medium", ""));
+		this.line(stat("low", severities.low, "Low", ""));
+		this.line(stat("none", severities.informational, "None", ""));
+		this.line("</ul>");
+		this.line(bar("Requirements by severity", [
+			[
+				"critical",
+				"critical",
+				severities.critical
+			],
+			[
+				"high",
+				"high",
+				severities.high
+			],
+			[
+				"medium",
+				"medium",
+				severities.medium
+			],
+			[
+				"low",
+				"low",
+				severities.low
+			],
+			[
+				"none",
+				"none",
+				severities.informational
+			]
+		]));
+		this.line("</div>");
+		const [level, levelLabel] = complianceLevel(calculateCompliance(all));
+		this.line(`<div class="panel compliance compliance-${level}">`);
+		this.line("<h3 id=\"compliance-heading\">Compliance</h3>");
+		this.line(`<div class="gauge" role="meter" aria-valuemin="0" aria-valuemax="100" aria-valuenow="${compliancePercent(all)}" aria-labelledby="compliance-heading" style="--pct:${compliancePercent(all)}"><span class="pct">${compliance(all)}</span></div>`);
+		this.line(`<p class="level">${levelLabel}</p>`);
+		this.line("<p class=\"formula\">Passed / (Passed + Failed + Not Reviewed + Error) × 100</p>");
+		this.line("</div>");
+		this.line("</div>");
+		if (this.aggregated) {
+			const bySource = this.openFold("", "", "h3", "Status by source", "the status by source", this.sources.length);
+			this.line("<div class=\"table-wrap\">");
+			this.line("<table class=\"summary\" aria-label=\"Status by source\">");
+			this.line(summaryHead("Source"));
+			this.line("<tbody>");
+			this.sources.forEach((src, si) => this.line(summaryRow(`<a href="#${sourceId(si)}">${escapeHtml(src.name)}</a>`, perSource[si])));
+			this.line("</tbody>");
+			this.line("<tfoot>");
+			this.line(summaryRow("All sources", all));
+			this.line("</tfoot>");
+			this.line("</table>");
+			this.line("</div>");
+			this.closeFold(bySource);
+		}
+		const baselineCount = this.sources.reduce((n, src) => n + src.baselines.length, 0);
+		const byBaseline = this.openFold("", "", "h3", "Status by baseline", "the status by baseline", baselineCount);
+		this.line("<div class=\"table-wrap\">");
+		this.line("<table class=\"summary\" aria-label=\"Status by baseline\">");
+		this.line(summaryHead("Baseline"));
+		this.line("<tbody>");
+		this.sources.forEach((src, si) => {
+			src.baselineLabels.forEach((own, i) => {
+				const label = this.aggregated ? `${src.name} \u203a ${own}` : own;
+				this.line(summaryRow(escapeHtml(label), perBaseline[si][i]));
+			});
+		});
+		this.line("</tbody>");
+		this.line("<tfoot>");
+		this.line(summaryRow("All baselines", all));
+		this.line("</tfoot>");
+		this.line("</table>");
+		this.line("</div>");
+		this.closeFold(byBaseline);
+		this.line("</section>");
+	}
+	results() {
+		this.line("<section id=\"results\" class=\"card\" aria-labelledby=\"results-heading\">");
+		this.line("<h2 id=\"results-heading\">Results</h2>");
+		this.line("<div class=\"toolbar\">");
+		this.line("<input type=\"search\" id=\"filter-text\" placeholder=\"Filter by ID, title or control\" aria-label=\"Filter requirements by ID, title or control\" />");
+		this.line("<div class=\"filters\" role=\"group\" aria-label=\"Filter by status\">");
+		this.line("<button type=\"button\" class=\"filter\" data-status=\"all\" aria-pressed=\"true\">All</button>");
+		for (const [key, label] of STATUS_FILTERS) this.line(`<button type="button" class="filter" data-status="${key}" aria-pressed="false">${label}</button>`);
+		this.line("</div>");
+		this.line("<button type=\"button\" id=\"expand-all\">Expand all</button>");
+		this.line("<button type=\"button\" id=\"collapse-all\">Collapse all</button>");
+		this.line("<span id=\"filter-count\" class=\"shown\" aria-live=\"polite\"></span>");
+		this.line("</div>");
+		for (const src of this.sources) {
+			this.src = src;
+			let f;
+			if (this.aggregated) {
+				const total = src.baselines.reduce((n, baseline) => n + list(baseline.requirements).length, 0);
+				f = this.openFold("group source", "", "h3", escapeHtml(src.name), src.name, total);
+			}
+			src.baselines.forEach((baseline, i) => this.baseline(baseline, src.baselineLabels[i]));
+			if (f) this.closeFold(f);
+		}
+		this.line("</section>");
+	}
+	baseline(baseline, label) {
+		const requirements = list(baseline.requirements).map(obj);
+		const f = this.openFold("group baseline", "", this.baselineHeading, escapeHtml(label), label, requirements.length);
+		const facts = [
+			["Name", text(baseline.name)],
+			["Title", text(baseline.title)],
+			["Version", text(baseline.version)],
+			["Summary", text(baseline.summary)],
+			["Description", text(baseline.description)],
+			["Maintainer", text(baseline.maintainer)],
+			["License", text(baseline.license)],
+			["Copyright", text(baseline.copyright)],
+			["Status message", text(baseline.statusMessage)]
+		];
+		const factCount = countFacts(facts);
+		if (factCount > 0) {
+			const details = this.openFold("", "", this.detailHeading, "Baseline details", "the baseline details", factCount);
+			this.definitionList(facts);
+			this.closeFold(details);
+		}
+		this.externalReferences(this.detailHeading, "Enrichment and External References", baseline.externalReferences);
+		if (requirements.length > 0) this.line("<div class=\"req-head\" aria-hidden=\"true\"><span>Status</span><span>ID</span><span>Severity</span><span>Title</span><span>800-53 Controls &amp; CCIs</span></div>");
+		for (const req of requirements) this.requirement(req);
+		this.closeFold(f);
+	}
+	requirement(req) {
+		const effective = this.effectiveStatus(req);
+		const results = list(req.results).map(obj);
+		const severity = requirementSeverity(req, this.src.ref.stamp);
+		const tags = obj(req.tags);
+		const nist = tagItems(tags, "nist");
+		const cci = tagItems(tags, "cci");
+		const [cls] = statusPresentation(effective);
+		this.requirements++;
+		const id = `req-${this.requirements}`;
+		this.line(`<article class="requirement c-${cls}" data-status="${cls}" id="${id}">`);
+		this.line("<details>");
+		const referenceCount = list(req.externalReferences).length;
+		const tagHtml = [...nist, ...cci].map((t, i) => `${i === 0 ? "<span class=\"vh\">Controls: </span>" : ""}<span class="tag">${escapeHtml(t)}</span>`).join("") + (referenceCount > 0 ? `<span class="tag enriched">Enriched (${referenceCount})</span>` : "");
+		this.line(`<summary>${statusBadge(effective)}<span class="req-id">${escapeHtml(text(req.id))}</span><span class="sev c-${severityClass(severity)}"><span class="vh">Severity: </span>${escapeHtml(severityLabel(severity))}</span><span class="req-title">${escapeHtml(text(req.title))}</span><span class="tags">${tagHtml}</span></summary>`);
+		this.line("<div class=\"req-body\">");
+		const descriptions = list(req.descriptions).map(obj);
+		const lead = descriptions.findIndex((d) => d.label === "default");
+		const location = sourceLocation(req.sourceLocation);
+		if (location !== "") this.line(`<p class="location"><span class="k">Location</span><code>${escapeHtml(location)}</code></p>`);
+		const leadText = lead >= 0 ? text(descriptions[lead].data) : "";
+		if (leadText !== "" && isLongText(leadText)) {
+			const f = this.openFold("", "", this.detailHeading, "Description", "the description", lineCount(leadText));
+			this.line(prose(leadText));
+			this.closeFold(f);
+		} else if (leadText !== "") this.line(prose(leadText));
+		this.resultRows(results);
+		const impact = numeric(req.impact);
+		const rows = [detailRow("Effective status", statusBadge(effective)), detailRow("Assessed status", statusBadge(worstStatus(results.map((r) => text(r.status)))))];
+		const details = [
+			["Control", text(req.id)],
+			["Title", text(req.title)],
+			["Severity", severity],
+			["Impact", impact.toFixed(2)],
+			["Effective impact", requirementEffectiveImpact(req, this.src.ref.stamp).toFixed(2)],
+			["Disposition", requirementDisposition(req, this.src.ref.stamp)],
+			["Control type", text(req.controlType)],
+			["Verification method", text(req.verificationMethod)],
+			["Applicability", text(req.applicability)],
+			["Source location", location],
+			["NIST Controls", nist.join(", ")],
+			["CCI Controls", cci.join(", ")],
+			["CWE", strings(req.cwe).join(", ")],
+			["CVSS", cvssText(list(req.cvss).map(obj))],
+			["EPSS", epssText(req.epss)],
+			["KEV", kevText(req.kev)],
+			["Affected packages", packagesText(list(req.affectedPackages).map(obj))],
+			["Evidence", evidenceText(list(req.evidence).map(obj))]
+		];
+		for (const [term, value] of details) if (value !== "") rows.push(detailRow(term, escapeHtml(value)));
+		const references = referenceLines(list(req.refs).map(obj));
+		if (references.length > 0) rows.push(detailRow("References", prose(references.join("\n"))));
+		descriptions.forEach((d, i) => {
+			if (i !== lead) rows.push(detailRow(escapeHtml(descriptionHeading(text(d.label))), prose(text(d.data))));
+		});
+		const detailsFold = this.openFold("", "", this.detailHeading, "Result Details", "the result details", rows.length);
+		this.line("<div class=\"table-wrap\">");
+		this.line("<table class=\"details\" aria-label=\"Result details\">");
+		this.line("<tbody>");
+		for (const row of rows) this.line(row);
+		this.line("</tbody>");
+		this.line("</table>");
+		this.line("</div>");
+		this.closeFold(detailsFold);
+		this.tagChips(tags);
+		this.externalReferences(this.detailHeading, "Enrichment and External References", req.externalReferences);
+		const overrides = list(req.statusOverrides).map(obj);
+		this.overrideRows(overrides);
+		overrides.forEach((o, i) => this.externalReferences(this.detailHeading, `References for override ${i + 1}`, o.externalReferences));
+		this.poamRows(list(req.poams).map(obj));
+		const code = text(req.code);
+		if (this.reportType === "administrator" && code !== "") {
+			const f = this.openFold("", "", this.detailHeading, "Code", "the code", lineCount(code));
+			this.line(`<pre class="code">\n${escapeHtml(code)}</pre>`);
+			this.closeFold(f);
+		}
+		this.line(`<p class="to-top"><a href="#${id}">Back to the top of this requirement</a></p>`);
+		this.line("</div>");
+		this.line("</details>");
+		this.line("</article>");
+	}
+	resultRows(results) {
+		if (results.length === 0) return;
+		const f = this.openFold("", "", this.detailHeading, "Test Results", "the test results", results.length);
+		this.line("<div class=\"table-wrap\">");
+		this.line("<table aria-label=\"Test results\">");
+		this.line("<thead><tr><th scope=\"col\">Status</th><th scope=\"col\">Test</th><th scope=\"col\">Result</th><th scope=\"col\">Started</th></tr></thead>");
+		this.line("<tbody>");
+		for (const res of results) {
+			const runTime = typeof res.runTime === "number" ? `${res.runTime.toFixed(3)} s` : "";
+			this.line(`<tr><td>${statusBadge(text(res.status))}</td><td class="text">${escapeHtml(text(res.codeDesc))}` + subLine("Resource", joinNonEmpty(" · ", text(res.resource), text(res.resourceId))) + `</td><td class="text">${escapeHtml(text(res.message))}` + subLine("Exception", text(res.exception)) + subLine("Backtrace", strings(res.backtrace).join("\n")) + `</td><td>${escapeHtml(formatTime(res.startTime))}${subLine("Run time", runTime)}</td></tr>`);
+		}
+		this.line("</tbody>");
+		this.line("</table>");
+		this.line("</div>");
+		this.closeFold(f);
+	}
+	overrideRows(overrides) {
+		if (overrides.length === 0) return;
+		const governing = governingStatusOverrideIndex(overrideInputs(overrides), this.src.ref.stamp);
+		const f = this.openFold("", "", this.detailHeading, "Overrides", "the overrides", overrides.length);
+		this.line("<div class=\"table-wrap\">");
+		this.line("<table aria-label=\"Overrides\">");
+		this.line("<thead><tr><th scope=\"col\">Type</th><th scope=\"col\">Status</th><th scope=\"col\">Reason</th><th scope=\"col\">Applied by</th><th scope=\"col\">Applied at</th><th scope=\"col\">Expires at</th><th scope=\"col\">State</th></tr></thead>");
+		this.line("<tbody>");
+		overrides.forEach((o, i) => {
+			const status = text(o.status) === "" ? "" : statusBadge(text(o.status));
+			const expires = toDate$1(o.expiresAt);
+			let state = "";
+			if (i === governing) state = "governing";
+			else if (expires && expires <= this.src.ref.date) state = "expired";
+			const impact = o.impact == null ? "" : numeric(obj(o.impact).value).toFixed(2);
+			this.line(`<tr><td>${escapeHtml(text(o.type))}</td><td>${status}${subLine("Impact", impact)}` + subLine("CVSS", o.cvss == null ? "" : cvssText([obj(o.cvss)])) + `</td><td class="text">${escapeHtml(text(o.reason))}${subLine("Justification", text(o.justification))}</td><td>${escapeHtml(text(obj(o.appliedBy).identifier))}</td><td>${escapeHtml(formatTime(o.appliedAt))}</td><td>${escapeHtml(formatTime(o.expiresAt))}</td><td>${state}</td></tr>`);
+		});
+		this.line("</tbody>");
+		this.line("</table>");
+		this.line("</div>");
+		this.closeFold(f);
+	}
+	/**
+	* References to artifacts outside the document: a CVE, an ATT&CK technique, a
+	* STIX object. A reference that embeds its payload is an enrichment envelope,
+	* and the payload is shown whole because HDF carries it untouched rather than
+	* mapping it into fields.
+	*/
+	externalReferences(headingTag, heading, value) {
+		const refs = list(value).map(obj);
+		if (refs.length === 0) return;
+		const f = this.openFold("", "", headingTag, heading, heading.charAt(0).toLowerCase() + heading.slice(1), refs.length);
+		this.line("<div class=\"table-wrap\">");
+		this.line(`<table aria-label="${heading}">`);
+		this.line("<thead><tr><th scope=\"col\">Source</th><th scope=\"col\">ID</th><th scope=\"col\">Kind</th><th scope=\"col\">Relation</th><th scope=\"col\">Detail</th></tr></thead>");
+		this.line("<tbody>");
+		for (const ref of refs) {
+			const checksum = ref.checksum == null ? {} : obj(ref.checksum);
+			const added = joinNonEmpty(" · ", ref.addedBy == null ? "" : text(obj(ref.addedBy).identifier), formatTime(ref.addedAt));
+			this.line(`<tr><td>${escapeHtml(text(ref.sourceName))}</td><td>${escapeHtml(text(ref.externalId))}</td><td>${escapeHtml(text(ref.kind))}</td><td>${escapeHtml(text(ref.rel))}</td><td class="text">` + escapeHtml(text(ref.description)) + subLine("Location", text(ref.href)) + subLine("Media type", text(ref.mediaType)) + subLine("Checksum", joinNonEmpty(":", text(checksum.algorithm), text(checksum.value))) + subLine("Added", added) + embeddedDocument(ref.document) + "</td></tr>");
+		}
+		this.line("</tbody>");
+		this.line("</table>");
+		this.line("</div>");
+		this.closeFold(f);
+	}
+	poamRows(poams) {
+		if (poams.length === 0) return;
+		const f = this.openFold("", "", this.detailHeading, "POA&amp;Ms", "the POA&Ms", poams.length);
+		this.line("<div class=\"table-wrap\">");
+		this.line("<table aria-label=\"Plans of action and milestones\">");
+		this.line("<thead><tr><th scope=\"col\">Type</th><th scope=\"col\">Explanation</th><th scope=\"col\">Applied by</th><th scope=\"col\">Applied at</th><th scope=\"col\">Expires at</th></tr></thead>");
+		this.line("<tbody>");
+		for (const p of poams) {
+			const milestones = list(p.milestones).map(obj).map((m) => subLine("Milestone", joinNonEmpty(" · ", text(m.status), text(m.title), text(m.description), formatTime(m.estimatedCompletion)))).join("");
+			this.line(`<tr><td>${escapeHtml(text(p.type))}</td><td class="text">${escapeHtml(text(p.explanation))}${milestones}</td><td>${escapeHtml(text(obj(p.appliedBy).identifier))}</td><td>${escapeHtml(formatTime(p.appliedAt))}</td><td>${escapeHtml(formatTime(p.expiresAt))}</td></tr>`);
+		}
+		this.line("</tbody>");
+		this.line("</table>");
+		this.line("</div>");
+		this.closeFold(f);
+	}
+	/**
+	* The tags the detail table does not show: every tag but nist and cci whose
+	* value is text, a list of text, or a boolean. Numbers and nested values are
+	* left out because the two languages do not print them alike.
+	*/
+	tagChips(tags) {
+		const entries = [];
+		for (const key of Object.keys(tags).sort(byCodePoint)) {
+			if (key === "nist" || key === "cci") continue;
+			const value = tagText(tags[key]);
+			if (value !== null) entries.push([key, value]);
+		}
+		if (entries.length === 0) return;
+		const f = this.openFold("", "", this.detailHeading, "Tags", "the tags", entries.length);
+		this.line("<ul class=\"chips\">");
+		for (const [k, v] of entries) this.line(`<li><span class="k">${escapeHtml(k)}</span><span class="v">${escapeHtml(v)}</span></li>`);
+		this.line("</ul>");
+		this.closeFold(f);
+	}
+};
+/**
+* Counts the external references anywhere in the document and breaks them down
+* by kind, so even the executive report says whether the results carry
+* enrichment.
+*/
+function referenceCensus(doc) {
+	let total = 0;
+	const kinds = /* @__PURE__ */ new Map();
+	const count = (value) => {
+		for (const ref of list(value).map(obj)) {
+			total++;
+			const kind = text(ref.kind);
+			if (kind !== "") kinds.set(kind, (kinds.get(kind) ?? 0) + 1);
+		}
+	};
+	count(doc.externalReferences);
+	for (const baseline of list(doc.baselines).map(obj)) {
+		count(baseline.externalReferences);
+		for (const req of list(baseline.requirements).map(obj)) {
+			count(req.externalReferences);
+			for (const o of list(req.statusOverrides).map(obj)) count(o.externalReferences);
+		}
+	}
+	if (total === 0) return "";
+	const parts = [...kinds.keys()].sort(byCodePoint).map((kind) => `${kind} ${kinds.get(kind)}`);
+	return parts.length === 0 ? String(total) : `${total} (${parts.join(", ")})`;
+}
+/**
+* An enrichment payload: what it says it is, then the whole object. Canonical
+* JSON is what makes the text the same in both languages.
+*/
+function embeddedDocument(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return "";
+	const document = value;
+	return subLine("Embedded", joinNonEmpty(" · ", text(document.type), text(document.name))) + `<details class="doc"><summary>Embedded document</summary><pre class="code">
+${escapeHtml(indentJson(canonicalJson(document)))}</pre></details>`;
+}
+/**
+* Lays compact JSON out over lines, two spaces a level. It only inserts
+* whitespace between tokens, so the values stay exactly as serialized.
+*/
+function indentJson(compact) {
+	let out = "";
+	let depth = 0;
+	const newline = () => `\n${"  ".repeat(depth)}`;
+	let i = 0;
+	while (i < compact.length) {
+		const c = compact[i];
+		const next = compact[i + 1];
+		let end = i + 1;
+		if (c === "\"") {
+			end = stringEnd(compact, i);
+			out += compact.slice(i, end);
+		} else if ((c === "{" || c === "[") && (next === "}" || next === "]")) {
+			end = i + 2;
+			out += c + next;
+		} else if (c === "{" || c === "[") {
+			depth++;
+			out += c + newline();
+		} else if (c === "}" || c === "]") {
+			depth--;
+			out += newline() + c;
+		} else if (c === ",") out += c + newline();
+		else out += c === ":" ? ": " : c;
+		i = end;
+	}
+	return out;
+}
+/** The index just past the JSON string that opens at `start`; the end of the text when it never closes. */
+function stringEnd(text, start) {
+	let i = start + 1;
+	while (i < text.length) {
+		if (text[i] === "\"") return i + 1;
+		i += text[i] === "\\" ? 2 : 1;
+	}
+	return text.length;
+}
+function strings(value) {
+	return list(value).filter((item) => typeof item === "string");
+}
+function tagText(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "boolean") return String(value);
+	if (Array.isArray(value)) {
+		const items = strings(value);
+		return items.length > 0 ? items.join(", ") : null;
+	}
+	return null;
+}
+/** A labelled secondary line inside a table cell; empty when there is nothing to say. */
+function subLine(label, value) {
+	return value === "" ? "" : `<span class="sub"><span class="k">${label}</span> ${escapeHtml(value)}</span>`;
+}
+/** Where the finding sits in the assessed source: file, and line when there is one. */
+function sourceLocation(value) {
+	if (value == null) return "";
+	const loc = obj(value);
+	const ref = text(loc.ref);
+	if (typeof loc.line !== "number") return ref;
+	return ref === "" ? `line ${loc.line}` : `${ref}:${loc.line}`;
+}
+function cvssText(entries) {
+	const parts = [];
+	for (const c of entries) {
+		const score = typeof c.computedScore === "number" ? c.computedScore : c.baseScore;
+		const severity = typeof c.computedSeverity === "string" ? c.computedSeverity : text(c.baseSeverity);
+		const version = text(c.version);
+		const source = text(c.source);
+		const part = joinNonEmpty(" ", version === "" ? "" : `v${version}`, typeof score === "number" ? score.toFixed(1) : "", severity, text(c.baseVector), source === "" ? "" : `(${source})`);
+		if (part !== "") parts.push(part);
+	}
+	return parts.join("; ");
+}
+function epssText(value) {
+	if (value == null) return "";
+	const e = obj(value);
+	const date = text(e.date);
+	return `score ${numeric(e.score).toFixed(5)}, percentile ${numeric(e.percentile).toFixed(5)}` + (date === "" ? "" : `, as of ${date}`);
+}
+function kevText(value) {
+	if (value == null) return "";
+	const k = obj(value);
+	let out = k.inKev === true ? "Listed" : "Not listed";
+	if (text(k.dateAdded) !== "") out += `, added ${text(k.dateAdded)}`;
+	if (text(k.dueDate) !== "") out += `, due ${text(k.dueDate)}`;
+	if (text(k.notes) !== "") out += `, ${text(k.notes)}`;
+	return out;
+}
+function packagesText(packages) {
+	const parts = [];
+	for (const p of packages) {
+		let part = joinNonEmpty(" ", text(p.name), text(p.version));
+		if (part === "") part = joinNonEmpty(" ", text(p.purl), text(p.cpe));
+		const fixed = text(p.fixedInVersion);
+		if (fixed !== "") part = joinNonEmpty(" ", part, `(fixed in ${fixed})`);
+		if (part !== "") parts.push(part);
+	}
+	return parts.join("; ");
+}
+function evidenceText(evidence) {
+	return evidence.map((e) => joinNonEmpty(": ", text(e.type), text(e.description))).filter((part) => part !== "").join("; ");
+}
+/**
+* Each reference's text. A structured ref is reduced to the URLs inside it,
+* sorted, because the Go peer decodes it to a map, which has no order to
+* preserve.
+*/
+function referenceLines(refs) {
+	const lines = [];
+	for (const ref of refs) {
+		if (typeof ref.ref === "string") {
+			if (ref.ref !== "") lines.push(ref.ref);
+		} else if (Array.isArray(ref.ref)) {
+			const urls = /* @__PURE__ */ new Set();
+			collectUrls(ref.ref, urls);
+			lines.push(...[...urls].sort(byCodePoint));
+		}
+		for (const s of [text(ref.url), text(ref.uri)]) if (s !== "") lines.push(s);
+	}
+	return lines;
+}
+function collectUrls(value, into) {
+	if (Array.isArray(value)) for (const child of value) collectUrls(child, into);
+	else if (typeof value === "object" && value !== null) for (const [k, child] of Object.entries(value)) if (k === "url" && typeof child === "string" && child !== "") into.add(child);
+	else collectUrls(child, into);
+}
+/** Component fields in display order; the second member is the JSON key. */
+const COMPONENT_FIELDS = [
+	["Component ID", "componentId"],
+	["Description", "description"],
+	["Hostname", "hostname"],
+	["FQDN", "fqdn"],
+	["Domain", "domain"],
+	["IP address", "ipAddress"],
+	["MAC address", "macAddress"],
+	["OS name", "osName"],
+	["OS version", "osVersion"],
+	["Image ID", "imageId"],
+	["Registry", "registry"],
+	["Repository", "repository"],
+	["Tag", "tag"],
+	["Container ID", "containerId"],
+	["Image", "image"],
+	["Runtime", "runtime"],
+	["Cluster name", "clusterName"],
+	["Namespace", "namespace"],
+	["Platform type", "platformType"],
+	["Version", "version"],
+	["Account ID", "accountId"],
+	["Provider", "provider"],
+	["Region", "region"],
+	["ARN", "arn"],
+	["Resource ID", "resourceId"],
+	["Resource type", "resourceType"],
+	["Branch", "branch"],
+	["Commit", "commit"],
+	["URL", "url"],
+	["Environment", "environment"],
+	["Package manager", "packageManager"],
+	["Package name", "packageName"],
+	["CIDR", "cidr"],
+	["Gateway", "gateway"],
+	["Engine", "engine"],
+	["Host", "host"],
+	["Port", "port"],
+	["Model ID", "modelId"],
+	["Dataset ID", "datasetId"],
+	["Owner", "owner"]
+];
+function identity(value) {
+	if (value == null) return "";
+	const id = obj(value);
+	const type = text(id.type);
+	if (type === "") return text(id.identifier);
+	return joinNonEmpty(" ", text(id.identifier), `(${type})`);
+}
+/** A summary table row; `name` is already HTML. */
+function summaryRow(name, c) {
+	return `<tr><th scope="row">${name}</th>${[
+		c.passed.total,
+		c.failed.total,
+		c.skipped.total,
+		c.noImpact.total,
+		c.error.total,
+		severityTotals(c).total
+	].map((n) => `<td>${n}</td>`).join("")}<td>${compliance(c)}</td></tr>`;
+}
+function summaryHead(first) {
+	return `<thead><tr><th scope="col">${first}</th><th scope="col">Passed</th><th scope="col">Failed</th><th scope="col">Not Reviewed</th><th scope="col">Not Applicable</th><th scope="col">Error</th><th scope="col">Total</th><th scope="col">Compliance</th></tr></thead>`;
+}
+function sourceId(i) {
+	return `source-${i + 1}`;
+}
+function componentField(c, term, key) {
+	if (key === "port") return [term, typeof c.port === "number" ? String(c.port) : ""];
+	if (key === "owner") return [term, identity(c.owner)];
+	return [term, text(c[key])];
+}
+function documentFacts(doc) {
+	const tool = obj(doc.tool);
+	const generator = obj(doc.generator);
+	const duration = obj(doc.statistics).duration;
+	return [
+		["Tool", joinNonEmpty(" ", text(tool.name), text(tool.version))],
+		["Tool format", text(tool.format)],
+		["Generator", joinNonEmpty(" ", text(generator.name), text(generator.version))],
+		["Assessed", formatTime(doc.timestamp)],
+		["Duration", typeof duration === "number" ? `${duration.toFixed(2)} s` : ""],
+		["System reference", text(doc.systemRef)],
+		["Plan reference", text(doc.planRef)],
+		["Document ID", text(doc.id)],
+		["External references", referenceCensus(doc)]
+	];
+}
+function runnerFacts(runner) {
+	return [
+		["Name", text(runner.name)],
+		["Hostname", text(runner.hostname)],
+		["FQDN", text(runner.fqdn)],
+		["Domain", text(runner.domain)],
+		["Architecture", text(runner.architecture)],
+		["Release", text(runner.release)],
+		["Container image", text(runner.containerImage)],
+		["Container ID", text(runner.containerId)],
+		["Operator", identity(runner.operator)]
+	];
+}
+const STATUS_PRESENTATION = {
+	passed: ["passed", "Passed"],
+	failed: ["failed", "Failed"],
+	notReviewed: ["not-reviewed", "Not Reviewed"],
+	notApplicable: ["not-applicable", "Not Applicable"],
+	error: ["error", "Error"]
+};
+/** A status with a class drawn from a fixed set, never from the document: one outside the enum is shown as text under one class. */
+function statusPresentation(status) {
+	return Object.prototype.hasOwnProperty.call(STATUS_PRESENTATION, status) ? STATUS_PRESENTATION[status] : ["unknown", status];
+}
+/**
+* The mark beside the status word. Colour is the least reliable of the three
+* channels — it is lost to colour-vision deficiency and to a greyscale printer —
+* so every status carries a shape and a word as well.
+*/
+const STATUS_ICON = {
+	passed: "✓",
+	failed: "✗",
+	"not-applicable": "–",
+	"not-reviewed": "?",
+	error: "!"
+};
+function statusIcon(cls) {
+	return Object.prototype.hasOwnProperty.call(STATUS_ICON, cls) ? STATUS_ICON[cls] : "·";
+}
+function statusBadge(status) {
+	const [cls, label] = statusPresentation(status);
+	return `<span class="status c-${cls}"><span class="ico" aria-hidden="true">${statusIcon(cls)}</span>${escapeHtml(label)}</span>`;
+}
+/** The string members of an array-valued tag; a bare string tag is a one-member list. */
+function tagItems(tags, key) {
+	const value = Object.prototype.hasOwnProperty.call(tags, key) ? tags[key] : void 0;
+	if (typeof value === "string") return [value];
+	if (Array.isArray(value)) return value.filter((item) => typeof item === "string");
+	return [];
+}
+function joinNonEmpty(sep, ...parts) {
+	return parts.filter((p) => p !== "").join(sep);
+}
+/**
+* Makes text safe as HTML content and inside a double-quoted attribute. A
+* carriage return is written as a character reference because a parser would
+* otherwise fold it into the following newline. Characters HTML cannot carry at
+* all, and unpaired surrogates, become U+FFFD.
+*/
+function escapeHtml(value) {
+	let out = "";
+	for (const ch of value) {
+		const c = ch.codePointAt(0);
+		if (ch === "&") out += "&amp;";
+		else if (ch === "<") out += "&lt;";
+		else if (ch === ">") out += "&gt;";
+		else if (ch === "\"") out += "&quot;";
+		else if (ch === "'") out += "&#39;";
+		else if (ch === "\r") out += "&#13;";
+		else if (ch === "	" || ch === "\n") out += ch;
+		else if (c < 32 || c === 127 || c === 65534 || c === 65535 || c >= 55296 && c <= 57343) out += "�";
+		else out += ch;
 	}
-	return out.join("; ");
+	return out;
 }
 //#endregion
 //#region converters/hdf-to-ecs/typescript/converter.ts
@@ -8017,15 +9605,17 @@ function buildEvent(req, baseline, docTimestamp, tool, generator, component, con
 }
 /**
 * Surface override provenance into ECS labels.* (keyword bag): the disposition
-* plus the governing statusOverrides[0] fields. Returns undefined when the
-* requirement carries no disposition or overrides.
+* plus the fields of the override that GOVERNS — the most recently applied
+* non-expired one, resolved by appliedAt rather than by array position, because
+* this repo's writers append and so put the newest override last. Returns
+* undefined when the requirement carries no disposition or overrides.
 */
 function buildLabels(req) {
 	const labels = {};
-	setIf(labels, "hdf_disposition", getStr(req, "disposition"));
+	setIf(labels, "hdf_disposition", disposition(req));
 	const overrides = asArr(req.statusOverrides);
 	if (overrides && overrides.length > 0) {
-		const ov = asMap(overrides[0]);
+		const ov = governingOverrideOf(overrides);
 		if (ov) {
 			setIf(labels, "hdf_override_type", getStr(ov, "type"));
 			setIf(labels, "hdf_override_reason", getStr(ov, "reason"));
@@ -8389,13 +9979,13 @@ function complianceStatusCaption(statusID) {
 	}
 }
 function overrideComment(req) {
-	const disposition = getStr(req, "disposition");
+	const disp = disposition(req);
 	const overrides = asArr(req.statusOverrides) ?? [];
-	if (disposition === "" && overrides.length === 0) return "";
+	if (disp === "" && overrides.length === 0) return "";
 	let reason = "";
-	if (overrides.length > 0) reason = getStr(asMap(overrides[0]), "reason");
-	if (disposition !== "" && reason !== "") return `${disposition}: ${reason}`;
-	if (disposition !== "") return disposition;
+	if (overrides.length > 0) reason = getStr(governingOverrideOf(overrides), "reason");
+	if (disp !== "" && reason !== "") return `${disp}: ${reason}`;
+	if (disp !== "") return disp;
 	return reason;
 }
 function buildMetadata$1(tool, generator, converterVersion) {
@@ -8616,7 +10206,7 @@ function floatMetric(f) {
 * byte-identical with the Go implementation via canonicalize + stringifyLine.
 */
 const ASFF_SCHEMA_VERSION = "2018-10-08";
-const CONVERTER_NAME = "hdf-to-asff";
+const CONVERTER_NAME$1 = "hdf-to-asff";
 const PLACEHOLDER_REGION = "us-east-1";
 const PLACEHOLDER_ACCOUNT_ID = "000000000000";
 const DEFAULT_PARTITION = "aws";
@@ -8624,7 +10214,7 @@ const MAX_TITLE = 256;
 const MAX_DESCRIPTION = 1024;
 const EPOCH_SENTINEL = "1970-01-01T00:00:00Z";
 function convertHdfToAsff(input, converterVersion = "0.1.0") {
-	const name = CONVERTER_NAME;
+	const name = CONVERTER_NAME$1;
 	validateInputSize$1(input, name);
 	const doc = parseHdf(input);
 	const baselines = asArr(doc.baselines);
@@ -8670,7 +10260,7 @@ function recoverAccountID(doc) {
 	return PLACEHOLDER_ACCOUNT_ID;
 }
 function buildFinding(req, ctx) {
-	const controlID = firstNonEmpty(getStr(req, "id"), getStr(req, "title"), CONVERTER_NAME);
+	const controlID = firstNonEmpty(getStr(req, "id"), getStr(req, "title"), CONVERTER_NAME$1);
 	const st = statusOf(req);
 	const title = getStr(req, "title") || controlID;
 	const desc = defaultDescription(req) || title;
@@ -9161,7 +10751,7 @@ function convertHdfToXml(input) {
 }
 //#endregion
 //#region converters/gitlab-to-hdf/typescript/converter.ts
-function buildRefs$6(vuln) {
+function buildRefs$7(vuln) {
 	const refs = [];
 	const seen = /* @__PURE__ */ new Set();
 	const appendUrl = (url) => {
@@ -9201,7 +10791,7 @@ function scanTypeLabel(scanType) {
 		api_fuzzing: "API Fuzzing"
 	}[scanType] ?? scanType.toUpperCase();
 }
-function buildNistTags(identifiers) {
+function buildNistTags$1(identifiers) {
 	const seen = /* @__PURE__ */ new Set();
 	const controls = [];
 	for (const id of identifiers) if (id.type === "cwe" && id.value) {
@@ -9226,14 +10816,14 @@ function collectIdentifierTags(identifiers) {
 	}
 	return result;
 }
-function buildSourceLocation$2(location) {
+function buildSourceLocation$3(location) {
 	if (!location?.file) return void 0;
 	const sourceLocation = { ref: location.file };
 	const line = location.start_line ?? location.end_line;
 	if (line != null) sourceLocation.line = line;
 	return sourceLocation;
 }
-function buildCodeDesc$5(scanType, location) {
+function buildCodeDesc$6(scanType, location) {
 	if (!location) return "";
 	switch (scanType) {
 		case "sast":
@@ -9295,7 +10885,7 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 	const requirements = [];
 	for (const vuln of limitedVulns) {
 		const identifiers = vuln.identifiers ?? [];
-		const nistTags = buildNistTags(identifiers);
+		const nistTags = buildNistTags$1(identifiers);
 		const cciTags = nistToCci(nistTags);
 		const idTags = collectIdentifierTags(identifiers);
 		const extras = {};
@@ -9322,7 +10912,7 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 		}
 		const result = {
 			status: ResultStatus.Failed,
-			codeDesc: buildCodeDesc$5(scanType, vuln.location),
+			codeDesc: buildCodeDesc$6(scanType, vuln.location),
 			startTime: startTime ? parseTimestamp(startTime) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z") : /* @__PURE__ */ new Date("0001-01-01T00:00:00Z")
 		};
 		const impact = gitlabSeverityToImpact(vuln.severity ?? "Unknown");
@@ -9336,11 +10926,11 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 			descriptions,
 			verificationMethod: VerificationMethodEnum.Automated
 		};
-		const refs = buildRefs$6(vuln);
+		const refs = buildRefs$7(vuln);
 		if (refs) req.refs = refs;
 		const controlType = deriveControlTypeFromTags(nistTags);
 		if (controlType !== void 0) req.controlType = controlType;
-		const sourceLocation = buildSourceLocation$2(vuln.location);
+		const sourceLocation = buildSourceLocation$3(vuln.location);
 		if (sourceLocation) req.sourceLocation = sourceLocation;
 		requirements.push(req);
 	}
@@ -9379,6 +10969,678 @@ async function convertGitlabToHdf(input, converterVersion = "1.0.0") {
 	return serializeHdf(hdf);
 }
 //#endregion
+//#region converters/gitlab-vulnerabilities-to-hdf/typescript/converter.ts
+/**
+* GitLab Vulnerability Report (GraphQL) to HDF Results — TypeScript twin of
+* go/converter.go. Converts the envelope the gitlab-vulnerabilities fetcher
+* assembles for one project into HDF, keeping triage state lossless.
+*
+* Status is raw-primary: results[].status is what the scanner last reported on
+* the default branch, and every human triage decision rides as an attributed,
+* expiring Status_Override so effectiveStatus, effectiveImpact and disposition
+* are computed through the shared ladder rather than assigned.
+*/
+const CONVERTER_NAME = "gitlab-vulnerabilities";
+const SOURCE_NAME = "GitLab Vulnerability Report";
+const GENERATOR_NAME = "gitlab-vulnerabilities-to-hdf";
+function filtersActive(f) {
+	return !!f && ((f.states?.length ?? 0) > 0 || (f.reportTypes?.length ?? 0) > 0);
+}
+function describeFilters(f) {
+	const parts = [];
+	if (f.states?.length) parts.push(`states ${f.states.join(", ")}`);
+	if (f.reportTypes?.length) parts.push(`report types ${f.reportTypes.join(", ")}`);
+	return parts.join("; ");
+}
+function parseInput(input) {
+	if (!input || input.trim() === "") throw new Error(`${CONVERTER_NAME}: empty input`);
+	validateInputSize$1(input, CONVERTER_NAME);
+	let env;
+	try {
+		env = parseJSON(input);
+	} catch (e) {
+		throw new Error(`${CONVERTER_NAME}: invalid envelope JSON: ${e.message}`);
+	}
+	if (typeof env !== "object" || env === null || Array.isArray(env)) throw new Error(`${CONVERTER_NAME}: input is not a Vulnerability Report envelope (project.fullPath missing)`);
+	if (!env.project?.fullPath) throw new Error(`${CONVERTER_NAME}: input is not a Vulnerability Report envelope (project.fullPath missing)`);
+	if (!env.metadata?.enterprise) throw new Error(`${CONVERTER_NAME}: GitLab Community Edition has no Vulnerability Report; use the gitlab (CI artifact) converter instead`);
+	if (!Array.isArray(env.vulnerabilities)) throw new Error(`${CONVERTER_NAME}: envelope has no vulnerabilities array; an absent or null list is a malformed envelope, not an empty report`);
+	return env;
+}
+function sortedSectionKeys(pipeline) {
+	const summary = pipeline.securityReportSummary ?? {};
+	return Object.keys(summary).filter((k) => summary[k] != null).sort();
+}
+function scansOf(pipeline, key) {
+	return pipeline.securityReportSummary?.[key]?.scans?.nodes ?? [];
+}
+function ingestionError(env) {
+	const project = env.project;
+	if (project.vulnerabilityStatistic != null) return void 0;
+	const pipeline = project.latestDefaultBranchPipeline;
+	if (!pipeline) return /* @__PURE__ */ new Error(`${CONVERTER_NAME}: ${project.fullPath} has no default-branch pipeline; no security scanner has run`);
+	const created = [];
+	const failed = [];
+	let succeeded = false;
+	for (const reportType of sortedSectionKeys(pipeline)) for (const scan of scansOf(pipeline, reportType)) switch (scan.status ?? "") {
+		case "SUCCEEDED":
+			succeeded = true;
+			break;
+		case "CREATED":
+		case "PREPARING":
+			created.push(reportType);
+			break;
+		case "":
+			failed.push(`${reportType}: status unknown`);
+			break;
+		default: {
+			let desc = `${reportType}: ${scan.status}`;
+			const notes = [...scan.errors ?? [], ...scan.warnings ?? []];
+			if (notes.length > 0) desc += ` (${notes.join("; ")})`;
+			failed.push(desc);
+		}
+	}
+	if (succeeded) return void 0;
+	if (failed.length > 0) return /* @__PURE__ */ new Error(`${CONVERTER_NAME}: scanner jobs on the default branch of ${project.fullPath} produced no usable report: ${failed.join(", ")}`);
+	if (created.length > 0) return /* @__PURE__ */ new Error(`${CONVERTER_NAME}: security reports for ${project.fullPath} were produced but never ingested (${created.join(", ")} stuck at CREATED); the Vulnerability Report requires GitLab Ultimate`);
+	return /* @__PURE__ */ new Error(`${CONVERTER_NAME}: no security scanner has run on the default branch of ${project.fullPath}`);
+}
+function ingestedReportTypes(pipeline) {
+	if (!pipeline) return [];
+	return sortedSectionKeys(pipeline).filter((key) => scansOf(pipeline, key).some((s) => s.status === "SUCCEEDED"));
+}
+async function convertGitlabVulnerabilitiesToHdf(input, converterVersion = "1.0.0") {
+	const env = parseInput(input);
+	const fetchedAt = parseTimestamp(env.fetchedAt ?? "");
+	if (!fetchedAt) throw new Error(`${CONVERTER_NAME}: envelope fetchedAt "${env.fetchedAt ?? ""}" is not a valid timestamp`);
+	const resultsChecksum = await inputChecksum(input);
+	const project = env.project;
+	const vulnerabilities = env.vulnerabilities ?? [];
+	let baselines;
+	if (vulnerabilities.length === 0) {
+		const err = ingestionError(env);
+		if (err) throw err;
+		baselines = filtersActive(env.filters) ? filteredNoMatchBaselines(env.filters, project, fetchedAt, resultsChecksum) : noFindingsBaselines(project, fetchedAt, resultsChecksum);
+	} else baselines = findingBaselines(vulnerabilities, project, fetchedAt, resultsChecksum);
+	return buildHdfResults({
+		generatorName: GENERATOR_NAME,
+		converterVersion,
+		toolName: SOURCE_NAME,
+		toolVersion: env.metadata?.version,
+		baselines,
+		components: [buildComponent$2(project)],
+		timestamp: fetchedAt
+	});
+}
+function findingBaselines(vulnerabilities, project, fetchedAt, checksum) {
+	const limited = limitArrayWithWarning(vulnerabilities, "vulnerability");
+	const byType = /* @__PURE__ */ new Map();
+	const scanners = /* @__PURE__ */ new Map();
+	for (const v of limited) {
+		const reportType = v.reportType || "GENERIC";
+		if (!byType.has(reportType)) {
+			byType.set(reportType, []);
+			scanners.set(reportType, /* @__PURE__ */ new Set());
+		}
+		if (v.scanner?.name) scanners.get(reportType).add(v.scanner.name);
+		byType.get(reportType).push(convertVulnerability(v, project, fetchedAt));
+	}
+	return [...byType.keys()].sort().map((reportType) => {
+		const title = reportTypeLabel(reportType);
+		const names = [...scanners.get(reportType)].sort();
+		return {
+			name: `${SOURCE_NAME}: ${title}`,
+			title,
+			summary: names.length > 0 ? `Scanner: ${names.join(", ")}` : "Scanner: unknown",
+			requirements: byType.get(reportType),
+			resultsChecksum: checksum
+		};
+	});
+}
+function noFindingsBaselines(project, fetchedAt, checksum) {
+	let types = ingestedReportTypes(project.latestDefaultBranchPipeline);
+	if (types.length === 0) types = ["generic"];
+	const requirements = types.map((key) => {
+		const reportType = summaryKeyToReportType(key);
+		return buildNoFindingsRequirement(`gitlab-vulnerability-report-no-findings-${reportType.toLowerCase()}`, `GitLab Vulnerability Report for ${project.fullPath} lists zero ${reportTypeLabel(reportType)} vulnerabilities after a successful scan ingestion.`, fetchedAt);
+	});
+	return [{
+		name: SOURCE_NAME,
+		title: "No findings",
+		summary: `Ingested scanner types: ${types.join(", ")}`,
+		requirements,
+		resultsChecksum: checksum
+	}];
+}
+/**
+* Renders "nothing matched what you asked for", deliberately not the
+* no-findings wording: this describes the selection, not the project.
+*/
+function filteredNoMatchBaselines(filters, project, fetchedAt, checksum) {
+	const selection = describeFilters(filters);
+	const req = buildNoFindingsRequirement("gitlab-vulnerability-report-no-match", `No vulnerability in the GitLab Vulnerability Report for ${project.fullPath} matches the requested selection (${selection}). This describes the selection only, not the project's overall posture.`, fetchedAt);
+	req.tags["gitlab/filtered"] = true;
+	req.tags["gitlab/filterStates"] = filters.states ?? [];
+	req.tags["gitlab/filterReportTypes"] = filters.reportTypes ?? [];
+	return [{
+		name: SOURCE_NAME,
+		title: "No matching findings",
+		summary: `Filtered selection: ${selection}`,
+		requirements: [req],
+		resultsChecksum: checksum
+	}];
+}
+function summaryKeyToReportType(key) {
+	return key.replace(/([A-Z])/g, "_$1").toUpperCase();
+}
+const REPORT_TYPE_LABELS = {
+	SAST: "SAST",
+	DEPENDENCY_SCANNING: "Dependency Scanning",
+	CONTAINER_SCANNING: "Container Scanning",
+	CONTAINER_SCANNING_FOR_REGISTRY: "Container Scanning for Registry",
+	DAST: "DAST",
+	SECRET_DETECTION: "Secret Detection",
+	COVERAGE_FUZZING: "Coverage Fuzzing",
+	API_FUZZING: "API Fuzzing",
+	CLUSTER_IMAGE_SCANNING: "Cluster Image Scanning",
+	GENERIC: "Generic"
+};
+function reportTypeLabel(reportType) {
+	return REPORT_TYPE_LABELS[reportType] ?? reportType;
+}
+function buildComponent$2(project) {
+	const c = {
+		name: project.fullPath ?? "",
+		type: TargetType.Repository,
+		labels: {
+			"gitlab/project-id": project.id ?? "",
+			"gitlab/full-path": project.fullPath ?? ""
+		}
+	};
+	if (project.webUrl) c.url = project.webUrl;
+	if (project.repository?.rootRef) c.branch = project.repository.rootRef;
+	if (project.latestDefaultBranchPipeline?.sha) c.commit = project.latestDefaultBranchPipeline.sha;
+	return c;
+}
+function convertVulnerability(v, project, fetchedAt) {
+	const { original, current } = severityPair(v);
+	const code = buildVulnCode$1(v);
+	const tags = buildTags$3(v, project, original, current);
+	const result = {
+		status: rawStatus(v),
+		codeDesc: buildCodeDesc$5(v),
+		startTime: resultStartTime(v, fetchedAt)
+	};
+	const req = {
+		id: v.uuid ?? "",
+		title: v.title ?? "",
+		descriptions: buildDescriptions(v),
+		impact: severityToImpact$1(original),
+		tags,
+		code,
+		results: [result]
+	};
+	const refs = buildRefs$6(v);
+	if (refs.length > 0) req.refs = refs;
+	const sourceLocation = buildSourceLocation$2(v.location);
+	if (sourceLocation) req.sourceLocation = sourceLocation;
+	const cvss = buildCvss$2(v);
+	if (cvss.length > 0) req.cvss = cvss;
+	const verificationMethod = deriveVerificationMethod(code);
+	if (verificationMethod !== void 0) req.verificationMethod = verificationMethod;
+	const controlType = deriveControlTypeFromTags(tags.nist ?? []);
+	if (controlType !== void 0) req.controlType = controlType;
+	const overrides = [...buildStatusOverrides(v, fetchedAt), ...buildSeverityOverrides(v, fetchedAt)];
+	if (overrides.length > 0) {
+		sortMostRecentFirst(overrides);
+		req.statusOverrides = overrides;
+		applyEffectivePosture(req, fetchedAt);
+	}
+	return req;
+}
+function rawStatus(v) {
+	if (v.state === "RESOLVED" && v.resolvedOnDefaultBranch) return ResultStatus.Passed;
+	return ResultStatus.Failed;
+}
+/**
+* GitLab's `severity` already reflects human overrides, so the original comes
+* from the earliest one. The connection's order is not part of GitLab's
+* contract, so the earliest is found by timestamp rather than by position.
+*/
+function severityPair(v) {
+	const current = v.severity ?? "";
+	let original = current;
+	let earliest;
+	let found = false;
+	for (const o of v.severityOverrides?.nodes ?? []) {
+		if (!o.originalSeverity) continue;
+		const at = parseTimestamp(o.createdAt ?? "");
+		if (!found) {
+			original = o.originalSeverity;
+			earliest = at;
+			found = true;
+			continue;
+		}
+		if (!at) continue;
+		if (!earliest || at < earliest) {
+			original = o.originalSeverity;
+			earliest = at;
+		}
+	}
+	return {
+		original,
+		current
+	};
+}
+function resultStartTime(v, fetchedAt) {
+	return firstTime(v.latestDetectedPipeline?.createdAt, v.detectedAt) ?? fetchedAt;
+}
+/**
+* Renders the node as canonical JSON. Echoing the source layout instead would
+* make the twins disagree: one language's parser spells 3.0 where the other
+* spells 3.
+*/
+function buildVulnCode$1(v) {
+	return JSON.stringify(sortKeysDeep(v), null, 2);
+}
+function sortKeysDeep(value) {
+	if (Array.isArray(value)) return value.map(sortKeysDeep);
+	if (value !== null && typeof value === "object") {
+		const out = {};
+		for (const key of Object.keys(value).sort()) out[key] = sortKeysDeep(value[key]);
+		return out;
+	}
+	return value;
+}
+function buildDescriptions(v) {
+	const descriptions = [{
+		label: "default",
+		data: v.description || v.title || ""
+	}];
+	if (v.solution) descriptions.push({
+		label: "fix",
+		data: v.solution
+	});
+	return descriptions;
+}
+function buildTags$3(v, project, original, current) {
+	const nist = buildNistTags(v.identifiers ?? []);
+	const tags = buildNistCciTags(nist, nistToCci(nist), collectIdentifierExtras(v.identifiers ?? []));
+	markUnratedSeverity(tags, original);
+	const transitions = v.stateTransitions?.nodes ?? [];
+	tags["gitlab/id"] = v.id ?? "";
+	tags["gitlab/uuid"] = v.uuid ?? "";
+	tags["gitlab/webUrl"] = v.webUrl ?? "";
+	tags["gitlab/project"] = project.fullPath ?? "";
+	tags["gitlab/reportType"] = v.reportType ?? "";
+	tags["gitlab/severity"] = current;
+	tags["gitlab/originalSeverity"] = original;
+	tags["gitlab/state"] = v.state ?? "";
+	tags["gitlab/dismissalReason"] = v.dismissalReason ?? null;
+	tags["gitlab/stateComment"] = v.stateComment ?? null;
+	tags["gitlab/falsePositive"] = v.falsePositive ?? false;
+	tags["gitlab/presentOnDefaultBranch"] = v.presentOnDefaultBranch ?? false;
+	tags["gitlab/resolvedOnDefaultBranch"] = v.resolvedOnDefaultBranch ?? false;
+	tags["gitlab/detectedAt"] = v.detectedAt ?? "";
+	tags["gitlab/updatedAt"] = v.updatedAt ?? "";
+	tags["gitlab/confirmedAt"] = v.confirmedAt ?? null;
+	tags["gitlab/confirmedBy"] = userTag(v.confirmedBy);
+	tags["gitlab/dismissedAt"] = v.dismissedAt ?? null;
+	tags["gitlab/dismissedBy"] = userTag(v.dismissedBy);
+	tags["gitlab/resolvedAt"] = v.resolvedAt ?? null;
+	tags["gitlab/resolvedBy"] = userTag(v.resolvedBy);
+	tags["gitlab/initialDetectedPipeline"] = pipelineTag(v.initialDetectedPipeline);
+	tags["gitlab/latestDetectedPipeline"] = pipelineTag(v.latestDetectedPipeline);
+	tags["gitlab/scanner"] = v.scanner ? {
+		name: v.scanner.name ?? "",
+		vendor: v.scanner.vendor ?? "",
+		externalId: v.scanner.externalId ?? ""
+	} : null;
+	tags["gitlab/primaryIdentifier"] = v.primaryIdentifier ? {
+		externalType: v.primaryIdentifier.externalType ?? "",
+		externalId: v.primaryIdentifier.externalId ?? "",
+		name: v.primaryIdentifier.name ?? ""
+	} : null;
+	tags["gitlab/stateTransitionCount"] = transitions.length;
+	if (transitions.length > 0 && transitions[transitions.length - 1].toState !== v.state) tags["gitlab/stateHistoryInconsistent"] = true;
+	return tags;
+}
+function userTag(u) {
+	return u ? u.username ?? "" : null;
+}
+function pipelineTag(p) {
+	if (!p) return null;
+	return {
+		iid: p.iid ?? "",
+		sha: p.sha ?? "",
+		ref: p.ref ?? "",
+		createdAt: p.createdAt ?? ""
+	};
+}
+function buildNistTags(identifiers) {
+	return mapCWEToNIST(identifiers.filter((id) => (id.externalType ?? "").toLowerCase() === "cwe" && !!id.externalId).map((id) => id.externalId), DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
+}
+/**
+* Maps every vendor assessment GitLab attached to the finding, in the order
+* GitLab returned them. GitLab's own severity band is preferred over one
+* derived from the score.
+*/
+function buildCvss$2(v) {
+	const entries = v.cvss ?? [];
+	if (entries.length === 0) return [];
+	const source = cveIdentifier$1(v.identifiers ?? []);
+	return entries.map((e) => {
+		const entry = buildCvss$4({
+			version: cvssVersion$1(e),
+			baseScore: e.baseScore,
+			baseVector: e.vector,
+			source
+		});
+		const sev = cvssSeverity$1(e.severity);
+		if (sev) entry.baseSeverity = sev;
+		if (typeof e.overallScore === "number" && Number.isFinite(e.overallScore)) {
+			entry.computedScore = e.overallScore;
+			entry.computedSeverity = cvssSeverityFromScore(e.overallScore);
+		}
+		return entry;
+	});
+}
+/**
+* Prefers the vector's own prefix and falls back to GitLab's numeric version
+* field, which is a Float and so cannot name 3.1 exactly without the ladder.
+*/
+function cvssVersion$1(e) {
+	const n = e.version ?? 0;
+	let fallback = Version.The31;
+	if (n >= 4) fallback = Version.The40;
+	else if (n >= 3.1) fallback = Version.The31;
+	else if (n >= 3) fallback = Version.The30;
+	else if (n >= 2) fallback = Version.The20;
+	return cvssVersionFromVector(e.vector, fallback);
+}
+/**
+* Maps GitLab's CvssSeverity enum; an unknown value yields undefined so the
+* score-derived band stands instead of an invented one.
+*/
+function cvssSeverity$1(s) {
+	switch ((s ?? "").toUpperCase()) {
+		case "CRITICAL": return CVSSSeverity.Critical;
+		case "HIGH": return CVSSSeverity.High;
+		case "MEDIUM": return CVSSSeverity.Medium;
+		case "LOW": return CVSSSeverity.Low;
+		case "NONE": return CVSSSeverity.None;
+		default: return;
+	}
+}
+/**
+* What the schema's cvss[].source names: the advisory the scores belong to,
+* not the scanner that reported them.
+*/
+function cveIdentifier$1(identifiers) {
+	for (const id of identifiers) if ((id.externalType ?? "").toLowerCase() === "cve" && id.externalId) return id.externalId;
+	return "";
+}
+function collectIdentifierExtras(identifiers) {
+	const grouped = {};
+	for (const id of identifiers) {
+		if (!id.externalType || !id.externalId) continue;
+		const key = id.externalType.toLowerCase();
+		(grouped[key] ??= []).push(id.externalId);
+	}
+	return grouped;
+}
+function buildRefs$6(v) {
+	const refs = [];
+	const seen = /* @__PURE__ */ new Set();
+	const add = (url) => {
+		if (!url || seen.has(url)) return;
+		seen.add(url);
+		refs.push({ url });
+	};
+	add(v.webUrl);
+	for (const id of v.identifiers ?? []) add(id.url);
+	for (const link of v.links ?? []) add(link.url);
+	return refs;
+}
+function parseLine(s) {
+	if (!s) return void 0;
+	const n = parseInt(s, 10);
+	return Number.isNaN(n) || String(n) !== s ? void 0 : n;
+}
+function buildSourceLocation$2(loc) {
+	if (!loc || !loc.file) return void 0;
+	const sl = { ref: loc.file };
+	const line = parseLine(loc.startLine) ?? parseLine(loc.endLine);
+	if (line !== void 0) sl.line = line;
+	return sl;
+}
+function packageLabel(d) {
+	return packageInstanceId$2("", d?.package?.name ?? "", d?.version ?? "");
+}
+function buildCodeDesc$5(v) {
+	const loc = v.location;
+	if (!loc) return `Report type: ${v.reportType ?? ""}`;
+	const parts = [];
+	switch (loc.__typename) {
+		case "VulnerabilityLocationGeneric":
+			if (loc.description) parts.push(`Location: ${loc.description}`);
+			break;
+		case "VulnerabilityLocationSast":
+		case "VulnerabilityLocationSecretDetection":
+		case "VulnerabilityLocationCoverageFuzzing":
+			if (loc.file) parts.push(`File: ${loc.file}`);
+			if (loc.startLine) {
+				if (loc.endLine && loc.endLine !== loc.startLine) parts.push(`Line: ${loc.startLine}-${loc.endLine}`);
+				else parts.push(`Line: ${loc.startLine}`);
+			}
+			if (loc.vulnerableClass) parts.push(`Class: ${loc.vulnerableClass}`);
+			if (loc.vulnerableMethod) parts.push(`Method: ${loc.vulnerableMethod}`);
+			break;
+		case "VulnerabilityLocationDependencyScanning": {
+			if (loc.file) parts.push(`File: ${loc.file}`);
+			const pkg = packageLabel(loc.dependency);
+			if (pkg) parts.push(`Package: ${pkg}`);
+			break;
+		}
+		case "VulnerabilityLocationContainerScanning":
+		case "VulnerabilityLocationClusterImageScanning": {
+			if (loc.image) parts.push(`Image: ${loc.image}`);
+			if (loc.operatingSystem) parts.push(`OS: ${loc.operatingSystem}`);
+			const pkg = packageLabel(loc.dependency);
+			if (pkg) parts.push(`Package: ${pkg}`);
+			break;
+		}
+		case "VulnerabilityLocationDast":
+			if (loc.hostname) parts.push(`URL: ${loc.hostname}${loc.path ?? ""}`);
+			if (loc.requestMethod) parts.push(`Method: ${loc.requestMethod}`);
+			if (loc.param) parts.push(`Param: ${loc.param}`);
+			break;
+		default: return `Location: ${JSON.stringify(loc)}`;
+	}
+	return parts.length > 0 ? parts.join(" | ") : `Report type: ${v.reportType ?? ""}`;
+}
+function decisionFor(toState, dismissalReason, scannerResolved) {
+	switch (toState) {
+		case "DISMISSED": return dismissalDecision(dismissalReason ?? "");
+		case "RESOLVED":
+			if (scannerResolved) return void 0;
+			return {
+				overrideType: OverrideType.Attestation,
+				status: ResultStatus.Passed,
+				defaultReason: "Marked resolved in GitLab"
+			};
+		default: return;
+	}
+}
+function dismissalDecision(reason) {
+	switch (reason) {
+		case "FALSE_POSITIVE": return {
+			overrideType: OverrideType.FalsePositive,
+			status: ResultStatus.NotApplicable,
+			defaultReason: "Dismissed as FALSE_POSITIVE in GitLab"
+		};
+		case "ACCEPTABLE_RISK": return {
+			overrideType: OverrideType.Waiver,
+			status: ResultStatus.Passed,
+			defaultReason: "Dismissed as ACCEPTABLE_RISK in GitLab"
+		};
+		case "MITIGATING_CONTROL": return {
+			overrideType: OverrideType.Waiver,
+			status: ResultStatus.Passed,
+			justification: Justification.InlineMitigationsAlreadyExist,
+			defaultReason: "Dismissed as MITIGATING_CONTROL in GitLab"
+		};
+		case "USED_IN_TESTS": return {
+			overrideType: OverrideType.Waiver,
+			status: ResultStatus.NotApplicable,
+			justification: Justification.VulnerableCodeNotInExecutePath,
+			defaultReason: "Dismissed as USED_IN_TESTS in GitLab"
+		};
+		case "NOT_APPLICABLE":
+		case "": return {
+			overrideType: OverrideType.Waiver,
+			status: ResultStatus.NotApplicable,
+			defaultReason: "Dismissed as NOT_APPLICABLE in GitLab"
+		};
+		default: return {
+			overrideType: OverrideType.Waiver,
+			status: ResultStatus.NotApplicable,
+			defaultReason: `Dismissed as ${reason} in GitLab`
+		};
+	}
+}
+function buildStatusOverrides(v, fetchedAt) {
+	const scannerResolved = v.state === "RESOLVED" && !!v.resolvedOnDefaultBranch;
+	const overrides = [];
+	const transitions = v.stateTransitions?.nodes ?? [];
+	for (const tr of transitions) {
+		if (tr.toState === "DETECTED") {
+			const at = firstTime(tr.createdAt);
+			if (overrides.length > 0 && at) overrides[overrides.length - 1].expiresAt = at;
+			continue;
+		}
+		const d = decisionFor(tr.toState, tr.dismissalReason, scannerResolved);
+		if (!d) continue;
+		const appliedAt = firstTime(tr.createdAt, v.updatedAt, v.detectedAt) ?? fetchedAt;
+		overrides.push(newOverride(v, d, appliedAt, tr.comment, tr.author));
+	}
+	if (transitions.length > 0 && transitions[transitions.length - 1].toState === v.state) return overrides;
+	closeOpenOverrides(overrides, firstTime(v.updatedAt) ?? fetchedAt);
+	const d = decisionFor(v.state, v.dismissalReason, scannerResolved);
+	if (d) {
+		const { at, by } = currentDecisionProvenance(v);
+		overrides.push(newOverride(v, d, at ?? fetchedAt, v.stateComment, by));
+	}
+	return overrides;
+}
+/**
+* Brings every expiry back to `at`, never earlier than the override's own
+* appliedAt so the record stays internally consistent.
+*/
+function closeOpenOverrides(overrides, at) {
+	for (const o of overrides) {
+		if (o.expiresAt <= at) continue;
+		o.expiresAt = at < o.appliedAt ? o.appliedAt : at;
+	}
+}
+function currentDecisionProvenance(v) {
+	switch (v.state) {
+		case "DISMISSED": return {
+			at: firstTime(v.dismissedAt, v.updatedAt, v.detectedAt),
+			by: v.dismissedBy
+		};
+		case "RESOLVED": return {
+			at: firstTime(v.resolvedAt, v.updatedAt, v.detectedAt),
+			by: v.resolvedBy
+		};
+		default: return {
+			at: firstTime(v.updatedAt, v.detectedAt),
+			by: void 0
+		};
+	}
+}
+function firstTime(...candidates) {
+	for (const c of candidates) {
+		if (!c) continue;
+		const ts = parseTimestamp(c);
+		if (ts) return ts;
+	}
+}
+function newOverride(v, d, appliedAt, comment, author) {
+	const o = {
+		type: d.overrideType,
+		status: d.status,
+		reason: comment && comment.trim() !== "" ? comment : d.defaultReason,
+		appliedBy: identityFor$3(author),
+		appliedAt,
+		expiresAt: defaultOverrideExpiry(appliedAt)
+	};
+	if (d.justification !== void 0) o.justification = d.justification;
+	if (v.webUrl) o.externalReferences = [{
+		sourceName: SOURCE_NAME,
+		href: v.webUrl
+	}];
+	return o;
+}
+function identityFor$3(u) {
+	if (u) {
+		const description = u.name ? u.name : void 0;
+		if (u.publicEmail) {
+			const id = {
+				type: IdentityType.Email,
+				identifier: u.publicEmail
+			};
+			if (description) id.description = description;
+			return id;
+		}
+		if (u.username) {
+			const id = {
+				type: IdentityType.Username,
+				identifier: u.username
+			};
+			if (description) id.description = description;
+			return id;
+		}
+	}
+	return {
+		type: IdentityType.System,
+		identifier: "gitlab",
+		description: "GitLab automatic state change"
+	};
+}
+function buildSeverityOverrides(v, fetchedAt) {
+	return (v.severityOverrides?.nodes ?? []).map((sc) => {
+		const appliedAt = firstTime(sc.createdAt, v.updatedAt, v.detectedAt) ?? fetchedAt;
+		const o = {
+			type: OverrideType.RiskAdjustment,
+			impact: { value: severityToImpact$1(sc.newSeverity ?? "") },
+			reason: `Severity changed from ${sc.originalSeverity ?? ""} to ${sc.newSeverity ?? ""} in GitLab`,
+			appliedBy: identityFor$3(sc.author),
+			appliedAt,
+			expiresAt: defaultOverrideExpiry(appliedAt)
+		};
+		if (v.webUrl) o.externalReferences = [{
+			sourceName: SOURCE_NAME,
+			href: v.webUrl
+		}];
+		return o;
+	});
+}
+function sortMostRecentFirst(overrides) {
+	overrides.reverse();
+	overrides.sort((a, b) => b.appliedAt.getTime() - a.appliedAt.getTime());
+}
+function applyEffectivePosture(req, fetchedAt) {
+	const overrides = req.statusOverrides ?? [];
+	const ref = fetchedAt.toISOString();
+	const inputs = requirementStatusInput(req).overrides ?? [];
+	req.effectiveStatus = computeEffectiveStatus(requirementStatusInput(req), ref);
+	const impactIdx = governingOverrideIndex(inputs, (i) => overrides[i]?.impact !== void 0, ref);
+	if (impactIdx >= 0) req.effectiveImpact = overrides[impactIdx].impact.value;
+	const dispositionIdx = governingOverrideIndex(inputs, (i) => overrides[i]?.status !== void 0 || overrides[i]?.impact !== void 0, ref);
+	if (dispositionIdx >= 0) req.disposition = overrides[dispositionIdx].type;
+}
+//#endregion
 //#region converters/trivy-to-hdf/typescript/converter.ts
 const BASELINE_NAME = "Trivy Scan";
 const STATIC_CCI = nistToCci(DEFAULT_STATIC_ANALYSIS_NIST_TAGS);
@@ -9613,19 +11875,19 @@ function buildCvssEntries$4(m) {
 	for (const src of Object.keys(m).sort()) {
 		const c = m[src];
 		if (!c) continue;
-		if (c.V2Vector || c.V2Score !== void 0) entries.push(buildCvss$3({
+		if (c.V2Vector || c.V2Score !== void 0) entries.push(buildCvss$4({
 			version: Version.The20,
 			baseVector: c.V2Vector,
 			baseScore: c.V2Score,
 			source: src
 		}));
-		if (c.V3Vector || c.V3Score !== void 0) entries.push(buildCvss$3({
+		if (c.V3Vector || c.V3Score !== void 0) entries.push(buildCvss$4({
 			version: cvssVersionFromVector(c.V3Vector, Version.The31),
 			baseVector: c.V3Vector,
 			baseScore: c.V3Score,
 			source: src
 		}));
-		if (c.V40Vector || c.V40Score !== void 0) entries.push(buildCvss$3({
+		if (c.V40Vector || c.V40Score !== void 0) entries.push(buildCvss$4({
 			version: Version.The40,
 			baseVector: c.V40Vector,
 			baseScore: c.V40Score,
@@ -10482,7 +12744,7 @@ function buildCvss$1(vuln) {
 	const hasScore = typeof vuln.cvss === "number" && Number.isFinite(vuln.cvss);
 	const hasVector = !!vuln.vector;
 	if (!hasScore && !hasVector) return void 0;
-	return buildCvss$3({
+	return buildCvss$4({
 		version: cvssVersionFromVector(vuln.vector),
 		baseScore: hasScore ? vuln.cvss : void 0,
 		baseVector: vuln.vector,
@@ -10568,6 +12830,17 @@ function buildAffectedPackage(vuln, packageTypes, distro) {
 	});
 }
 /**
+* The per-result instance identity for a Twistlock vulnerability: the vulnerable
+* package, which is what distinguishes the several entries that report the same
+* CVE. Twistlock's output carries no purl, so the identity is name@version —
+* grype's fallback form. Falls back to the name alone when a version is absent,
+* and returns undefined when there is no package name at all, in which case the
+* caller leaves the fields unset rather than inventing an id.
+*/
+function packageInstanceId(vuln) {
+	return packageInstanceId$2("", vuln.packageName ?? "", vuln.packageVersion ?? "") || void 0;
+}
+/**
 * Indexes packageName → packageType from the result-level packages array.
 */
 function buildPackageTypeIndex(pkgs) {
@@ -10646,9 +12919,14 @@ function buildRequirement$9(vuln, packageTypes, distro) {
 		data: vuln.description
 	}];
 	const startTime = (vuln.discoveredDate ? parseTimestamp(vuln.discoveredDate) : null) ?? /* @__PURE__ */ new Date("0001-01-01T00:00:00Z");
+	const instanceId = packageInstanceId(vuln);
 	const results = [createResult(ResultStatus.Failed, formatMessage$2(vuln), {
 		codeDesc: formatCodeDesc$2(vuln),
-		startTime
+		startTime,
+		...instanceId ? {
+			resource: "package",
+			resourceId: instanceId
+		} : {}
 	})];
 	const req = createRequirement(vuln.id, vuln.id, descriptions, twistlockSeverityToImpact(vuln.severity), results, { tags });
 	const controlType = deriveControlTypeFromTags(nist);
@@ -10797,12 +13075,12 @@ function resolveCVE(vuln) {
 function buildCvssEntries$3(vuln) {
 	const source = resolveCVE(vuln);
 	const entries = [];
-	if (typeof vuln.cvssV3BaseScore === "number") entries.push(buildCvss$3({
+	if (typeof vuln.cvssV3BaseScore === "number") entries.push(buildCvss$4({
 		version: Version.The31,
 		baseScore: vuln.cvssV3BaseScore,
 		source
 	}));
-	if (typeof vuln.cvssV2BaseScore === "number") entries.push(buildCvss$3({
+	if (typeof vuln.cvssV2BaseScore === "number") entries.push(buildCvss$4({
 		version: Version.The20,
 		baseScore: vuln.cvssV2BaseScore,
 		source
@@ -11020,14 +13298,14 @@ function buildCvssEntries$2(cves) {
 	const out = [];
 	for (const cve of cves ?? []) {
 		const v3 = parseCvssField(cve.cvss_v3);
-		if (v3.score !== void 0 || v3.vector !== "") out.push(buildCvss$3({
+		if (v3.score !== void 0 || v3.vector !== "") out.push(buildCvss$4({
 			version: cvssVersionFromVector(v3.vector),
 			baseScore: v3.score,
 			baseVector: v3.vector,
 			source: cve.cve
 		}));
 		const v2 = parseCvssField(cve.cvss_v2);
-		if (v2.score !== void 0 || v2.vector !== "") out.push(buildCvss$3({
+		if (v2.score !== void 0 || v2.vector !== "") out.push(buildCvss$4({
 			version: cvssVersionFromString("2.0"),
 			baseScore: v2.score,
 			baseVector: v2.vector,
@@ -11285,13 +13563,13 @@ function extractCVEs(vuln) {
 * its score still drives impact.
 */
 function buildCvssEntries$1(vuln) {
-	if (vuln.vectors_v3) return [buildCvss$3({
+	if (vuln.vectors_v3) return [buildCvss$4({
 		version: cvssVersionFromVector(vuln.vectors_v3),
 		baseScore: vuln.score_v3 > 0 ? vuln.score_v3 : void 0,
 		baseVector: vuln.vectors_v3,
 		source: "NeuVector"
 	})];
-	if (vuln.vectors) return [buildCvss$3({
+	if (vuln.vectors) return [buildCvss$4({
 		version: cvssVersionFromString("2.0"),
 		baseScore: vuln.score > 0 ? vuln.score : void 0,
 		baseVector: vuln.vectors,
@@ -11316,6 +13594,30 @@ function vulnID(vuln) {
 	return `${vuln.name}/${vuln.package_name}/${vuln.package_version}`;
 }
 /**
+* The per-result instance identity for a NeuVector finding, as a (resource kind,
+* id) pair. file_name is the discriminator — the only field separating the two
+* braces@3.0.2 entries that both report CVE-2024-4068 — but NeuVector populates
+* it on a minority of entries. An entry without one names no file, so it
+* identifies the vulnerable package instead (the identity
+* name/package_name/package_version already keys the requirement on) rather than
+* claiming a 'file' resource with nothing to point at. With neither, the id is ''
+* and the caller leaves the fields unset.
+*/
+function vulnInstance(vuln) {
+	if (vuln.file_name) return {
+		resource: "file",
+		id: vuln.file_name
+	};
+	const id = packageInstanceId$2("", vuln.package_name ?? "", vuln.package_version ?? "");
+	return id ? {
+		resource: "package",
+		id
+	} : {
+		resource: "",
+		id: ""
+	};
+}
+/**
 * Generates a human-readable title for the vulnerability.
 */
 function vulnTitle(vuln) {
@@ -11394,9 +13696,14 @@ function buildRequirement$6(vuln, scanTime, ml) {
 		label: "default",
 		data: vuln.description
 	}];
+	const instance = vulnInstance(vuln);
 	const results = [createResult(ResultStatus.Failed, vulnMessage(vuln), {
 		codeDesc: buildCodeDesc$3(vuln),
-		startTime: scanTime
+		startTime: scanTime,
+		...instance.id ? {
+			resource: instance.resource,
+			resourceId: instance.id
+		} : {}
 	})];
 	const req = createRequirement(vulnID(vuln), vulnTitle(vuln), descriptions, getImpact$4(vuln), results, { tags });
 	req.code = JSON.stringify(vuln, null, 2);
@@ -11939,7 +14246,7 @@ function buildRefs$1(rec) {
 function buildCvssEntries(rec) {
 	const score = parseCvssScore(rec.CVSS);
 	if (score === void 0) return void 0;
-	return [buildCvss$3({
+	return [buildCvss$4({
 		version: cvssVersionFromString(void 0),
 		baseScore: score,
 		source: rec["CVE ID"] || void 0
@@ -12132,7 +14439,7 @@ function buildNetsparkerCvss(classification) {
 		const baseScore = baseScoreFromBlock(block);
 		const vector = block?.vector ?? "";
 		if (!vector && baseScore === void 0) continue;
-		out.push(buildCvss$3({
+		out.push(buildCvss$4({
 			version: cvssVersionFromVector(vector, elementVersion),
 			baseScore,
 			baseVector: vector
@@ -12882,14 +15189,33 @@ function formatFlawMessage(flaw) {
 	return notes.join("\n");
 }
 /**
+* A static flaw's source position — sourcefilepath+sourcefile, with :line
+* appended when both are present. It is both the per-result instance identity
+* (resourceId) and the position half of the synthesized code snippet, so the two
+* cannot drift apart. Returns '' for the NOT-IN-SOURCE case.
+*/
+function flawLocus(flaw) {
+	const locus = attr(flaw, "sourcefilepath") + attr(flaw, "sourcefile");
+	const line = attr(flaw, "line");
+	return locus && line ? `${locus}:${line}` : locus;
+}
+/**
+* The per-result instance identity for an SCA finding: the component_id Veracode
+* assigns the third-party component. Falls back to the component's sha1 —
+* component_id is optional in the report and sha1 is the documented secondary
+* identity — and returns '' when neither is present, in which case the caller
+* leaves the fields unset rather than inventing an id.
+*/
+function scaInstanceId(comp) {
+	return attr(comp, "component_id") || attr(comp, "sha1");
+}
+/**
 * Synthesize a static flaw's source-context locus from its function prototype
 * and source-file position. Returns '' when the flaw carries neither a prototype
 * nor a source location (the NOT-IN-SOURCE case).
 */
 function synthesizeFlawCode(flaw) {
-	let locus = attr(flaw, "sourcefilepath") + attr(flaw, "sourcefile");
-	const line = attr(flaw, "line");
-	if (locus && line) locus += `:${line}`;
+	const locus = flawLocus(flaw);
 	const proto = attr(flaw, "functionprototype");
 	if (proto && locus) return `${proto} at ${locus}`;
 	if (proto) return proto;
@@ -12997,10 +15323,17 @@ function buildCWERequirement(cat, sevLevel, impact, firstBuildDate) {
 	const startTime = parseVeracodeTimestamp(firstBuildDate) ?? /* @__PURE__ */ new Date();
 	const results = cwes.flatMap((c) => {
 		const staticflaws = c.staticflaws;
-		return ensureArray(staticflaws?.flaw).map((flaw) => createResult(ResultStatus.Failed, formatFlawMessage(flaw) || void 0, {
-			codeDesc: formatFlawCodeDesc(flaw),
-			startTime
-		}));
+		return ensureArray(staticflaws?.flaw).map((flaw) => {
+			const locus = flawLocus(flaw);
+			return createResult(ResultStatus.Failed, formatFlawMessage(flaw) || void 0, {
+				codeDesc: formatFlawCodeDesc(flaw),
+				startTime,
+				...locus ? {
+					resource: "file",
+					resourceId: locus
+				} : {}
+			});
+		});
 	});
 	const sourceRef = cwes.flatMap((c) => {
 		const staticflaws = c.staticflaws;
@@ -13076,7 +15409,7 @@ function buildVeracodeCvss(vuln, components) {
 	if (!scoreStr) return [];
 	const score = Number(scoreStr);
 	if (!Number.isFinite(score)) return [];
-	return [buildCvss$3({
+	return [buildCvss$4({
 		version: cvssVersionFromString(void 0),
 		baseScore: score
 	})];
@@ -13092,10 +15425,17 @@ function buildCVERequirement(vuln, components, firstBuildDate) {
 	const tags = buildNistCciTags(nist, cciTags, {});
 	markUnratedSeverity(tags, attr(vuln, "severity"));
 	const startTime = parseVeracodeTimestamp(firstBuildDate) ?? /* @__PURE__ */ new Date();
-	const results = components.map((comp) => createResult(ResultStatus.Failed, void 0, {
-		codeDesc: formatSCACodeDesc(comp),
-		startTime
-	}));
+	const results = components.map((comp) => {
+		const instanceId = scaInstanceId(comp);
+		return createResult(ResultStatus.Failed, void 0, {
+			codeDesc: formatSCACodeDesc(comp),
+			startTime,
+			...instanceId ? {
+				resource: "component",
+				resourceId: instanceId
+			} : {}
+		});
+	});
 	const cveSummary = attr(vuln, "cve_summary");
 	const cveId = attr(vuln, "cve_id");
 	const descriptions = [{
@@ -16434,11 +18774,11 @@ function oscalStateFromStatus(status) {
 */
 function overrideRemarks(req) {
 	const parts = [];
-	if (req.disposition) parts.push("Disposition: " + String(req.disposition));
-	const overrides = req.statusOverrides ?? [];
-	if (overrides.length > 0) {
-		const o = overrides[0];
-		parts.push("Override: " + String(o.type));
+	const disposition = requirementDisposition(req);
+	if (disposition) parts.push("Disposition: " + disposition);
+	const o = governingOverride(req);
+	if (o) {
+		parts.push("Override: " + String(o.type ?? ""));
 		if (o.reason) parts.push("Reason: " + o.reason);
 		if (o.appliedBy?.identifier) parts.push("Applied by: " + o.appliedBy.identifier);
 		const appliedAt = hdfTime(o.appliedAt);
@@ -16533,13 +18873,14 @@ function buildRemediations(req) {
 		description: fix.data,
 		props: [descriptionLabelProp("fix")]
 	});
-	const overrides = req.statusOverrides ?? [];
-	if (req.disposition && overrides.length > 0) {
-		const desc = overrides[0].reason || "Risk accepted via " + String(req.disposition);
+	const o = governingOverride(req);
+	if (o) {
+		const disp = String(o.type ?? "");
+		const desc = o.reason || "Risk accepted via " + disp;
 		rems.push({
 			uuid: crypto.randomUUID(),
 			lifecycle: "accepted",
-			title: String(req.disposition),
+			title: disp,
 			description: desc
 		});
 	}
@@ -16550,9 +18891,9 @@ function buildRemediations(req) {
 * (the field the OSCAL POA&M importer reads back). Returns '' when none applies.
 */
 function riskDeadline(req) {
-	const overrides = req.statusOverrides ?? [];
-	if (overrides.length > 0) {
-		const expiresAt = hdfTime(overrides[0].expiresAt);
+	const o = governingOverride(req);
+	if (o) {
+		const expiresAt = hdfTime(o.expiresAt);
 		if (expiresAt) return formatTimestampSeconds(expiresAt);
 	}
 	return "";
@@ -20912,7 +23253,7 @@ function toRfc3339(d) {
 * each STIX object as an inert externalReferences[] entry: a CVE-bearing object
 * attaches to the finding whose requirementId is that CVE (fanning out to every
 * match), and everything else — non-CVE objects and CVEs with no matching
-* finding — attaches to the results root. Each entry carries the raw STIX object
+* finding — attaches to the document root. Each entry carries the raw STIX object
 * losslessly in `document`.
 *
 * Informational only: authors no overrides and fabricates no status/impact (the
@@ -20944,7 +23285,7 @@ function enrichStix(resultsInput, bundleInput, opts) {
 		if (!matched) appendExternalReference(doc, buildStixRef(obj, "reference"));
 	}
 	for (const reqs of reqById.values()) for (const req of reqs) capStixExternalRefs(req, "finding");
-	capStixExternalRefs(doc, "results root");
+	capStixExternalRefs(doc, "document root");
 	if (opts?.recomputeCvss) recomputeExploitation(bundle, reqById, opts);
 	return JSON.stringify(doc, null, 2);
 }
@@ -21086,6 +23427,6 @@ function capStixExternalRefs(container, label) {
 	container.externalReferences = [...other, ...capped];
 }
 //#endregion
-export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDefectDojoToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGosecToHdf, convertGrypeToHdf, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertHipcheckToHdf, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertKicsToHdf, convertLegacyHdf, convertLegacyHdf as convertV1ToV2, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSemgrepToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSpdxVexToHdf, convertSplunkToHdf, convertTrivyToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, detectStixBundle, enrichStix, isLegacyHdf as isHDFV1, isLegacyHdf, parseStixBundle };
+export { convertAsffToHdf, convertAwsConfigToHdf, convertBurpsuiteToHdf, convertCheckovToHdf, convertCklToHdf, convertCklbToHdf, convertConveyorToHdf, convertCsafVexToHdf, convertCyclonedxToHdf, convertCyclonedxVexToHdf, convertDbprotectToHdf, convertDefectDojoToHdf, convertDeptrackToHdf, convertFortifyToHdf, convertGitlabToHdf, convertGitlabVulnerabilitiesToHdf, convertGosecToHdf, convertGrypeToHdf, convertHadolintToHdf, convertHdfDocumentsToHtml, convertHdfToAsff, convertHdfToCkl, convertHdfToCklb, convertHdfToCsafVex, convertHdfToCsv, convertHdfToCyclonedxVex, convertHdfToEcs, convertHdfToHtml, convertHdfToOcsf, convertHdfToOpenVex, convertHdfToOscalPoam, convertHdfToOscalSar, convertHdfToSplunk, convertHdfToXccdf, convertHdfToXml, convertHipcheckToHdf, convertIonchannelToHdf, convertJfrogXrayToHdf, convertJunitToHdf, convertKicsToHdf, convertLegacyHdf, convertLegacyHdf as convertV1ToV2, convertMsftDefenderCloudToHdf, convertMsftDefenderDevopsToHdf, convertMsftDefenderEndpointToHdf, convertMsftSecureScoreToHdf, convertNessusToHdf, convertNetsparkerToHdf, convertNeuvectorToHdf, convertNiktoToHdf, convertOpenVexToHdf, convertOscalCatalogToHdf, convertOscalComponentToHdf, convertOscalPoamToHdf, convertOscalProfileToHdf, convertOscalSapToHdf, convertOscalSarToHdf, convertOscalSspToHdf, convertPrismaToHdf, convertSarifToHdf, convertScoutsuiteToHdf, convertSemgrepToHdf, convertSnykToHdf, convertSonarqubeToHdf, convertSpdxVexToHdf, convertSplunkToHdf, convertTrivyToHdf, convertTrufflehogToHdf, convertTwistlockToHdf, convertVeracodeToHdf, convertXccdfResultsToHdf, convertZapToHdf, detectOscalDocumentType, detectStixBundle, enrichStix, isLegacyHdf as isHDFV1, isLegacyHdf, parseReportType, parseStixBundle };
 
 //# sourceMappingURL=index.js.map