@oculum/scanner 1.0.11 → 1.0.13

package/dist/pipeline/index.js

@@ -0,0 +1,377 @@
+"use strict";
+/**
+ * Pipeline Orchestrator — Thin orchestrator calling stages in sequence.
+ *
+ * Pipeline flow:
+ *  1. resolveScanModeConfig()
+ *  2. Filter locale files
+ *  3. buildProjectModel(files)
+ *  4. runDetectors(input)
+ *  5. aggregateNoisyFindings(findings)
+ *  6. enrichWithMetadata(findings, ctx)
+ *  7. scoreFindings(findings, depth)
+ *  8. Route by confidence (surface/validate/suppress)
+ *  9. capValidationCandidatesPerFile()
+ * 10. validateFindingsWithAI()
+ * 11. Combine surfaced + validated
+ * 12. postprocessFindings(input)
+ * 13. buildScanResult(input)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runScan = runScan;
+const config_1 = require("./config");
+const file_classifier_1 = require("../parse/file-classifier");
+const model_1 = require("../model");
+const detect_1 = require("../detect");
+const aggregation_1 = require("../postprocess/aggregation");
+const enrichment_1 = require("../report/enrichment");
+const score_1 = require("../score");
+const validation_cap_1 = require("../postprocess/validation-cap");
+const validate_1 = require("../validate");
+const postprocess_1 = require("../postprocess");
+const build_result_1 = require("../report/build-result");
+const pipeline_1 = require("../postprocess/filtering/pipeline");
+const summary_1 = require("../report/summary");
+const dedup_1 = require("../postprocess/dedup");
+const contradictions_1 = require("../postprocess/contradictions");
+/**
+ * Run a complete security scan on the provided files
+ *
+ * Supports two scan modes:
+ * - full: Complete scan with AI validation on all files (initial onboarding, deep audits)
+ * - incremental: Focused scan on changed files only (CI/CD, fast feedback)
+ */
+async function runScan(files, repoInfo, options = {}, onProgress) {
+    const startTime = Date.now();
+    const allVulnerabilities = [];
+    // Filter audit pipeline (zero overhead when disabled)
+    const filterPipeline = new pipeline_1.FilterPipeline(options.includeFilterAudit ?? false);
+    const fid = (v) => `${v.filePath}:${v.lineNumber}:${v.category}`;
+    // Resolve scan mode configuration
+    const scanModeConfig = (0, config_1.resolveScanModeConfig)(options);
+    const isIncremental = scanModeConfig.mode === 'incremental';
+    const depth = scanModeConfig.scanDepth || 'local';
+    const quiet = options.quiet ?? false;
+    const cancellationToken = options.cancellationToken;
+    // Conditional logging helper - suppresses output in quiet mode (interactive CLI)
+    const log = (message) => {
+        if (!quiet) {
+            console.log(message);
+        }
+    };
+    // Helper to check cancellation and throw if cancelled
+    const checkCancelled = () => {
+        if (cancellationToken?.cancelled) {
+            throw new Error(`Scan cancelled: ${cancellationToken.reason || 'user requested'}`);
+        }
+    };
+    log(`[Scanner] repo=${repoInfo.name} mode=${scanModeConfig.mode} depth=${depth} files=${files.length}`);
+    if (isIncremental && scanModeConfig.changedFiles) {
+        log(`[Scanner] repo=${repoInfo.name} incremental_files=${scanModeConfig.changedFiles.length}`);
+    }
+    // Filter out locale/i18n files - they contain translations, not code
+    const localeFileCount = files.filter(f => (0, file_classifier_1.isLocaleFile)(f.path)).length;
+    if (localeFileCount > 0) {
+        files = files.filter(f => !(0, file_classifier_1.isLocaleFile)(f.path));
+        log(`[Scanner] repo=${repoInfo.name} skipped_locale_files=${localeFileCount} remaining_files=${files.length}`);
+    }
+    // Report progress helper
+    const reportProgress = (status, message, vulnerabilitiesFound = allVulnerabilities.length) => {
+        if (onProgress) {
+            onProgress({
+                status,
+                message,
+                filesProcessed: files.length,
+                totalFiles: files.length,
+                vulnerabilitiesFound,
+            });
+        }
+    };
+    // For incremental scans, filter to only changed files for AI-heavy operations
+    const filesForAI = isIncremental && scanModeConfig.changedFiles
+        ? files.filter(f => scanModeConfig.changedFiles.some(cf => f.path.endsWith(cf) || f.path.includes(cf)))
+        : files;
+    // Declare variables that need to be accessible in catch block
+    let middlewareConfig;
+    let capturedValidationStats;
+    try {
+        checkCancelled();
+        // ===== Build Project Model =====
+        const modelStart = Date.now();
+        const model = (0, model_1.buildProjectModel)(files);
+        const modelDuration = Date.now() - modelStart;
+        middlewareConfig = model.middlewareConfig;
+        log(`[Model] repo=${repoInfo.name} build_duration=${modelDuration}ms taint_duration=${model.taintStats.duration}ms`);
+        if (model.middlewareConfig.hasAuthMiddleware) {
+            log(`[Scanner] repo=${repoInfo.name} auth_middleware=${model.middlewareConfig.authType || 'unknown'} file=${model.middlewareConfig.middlewareFile}`);
+        }
+        const filesWithImportedAuth = Array.from(model.fileAuthImports.values()).filter(f => f.usesImportedAuth).length;
+        if (filesWithImportedAuth > 0) {
+            log(`[Scanner] repo=${repoInfo.name} files_with_imported_auth=${filesWithImportedAuth}`);
+        }
+        // Log route discovery stats
+        const rs = model.routeStats;
+        if (rs.totalRoutes > 0) {
+            log(`[Routes] repo=${repoInfo.name} total=${rs.totalRoutes} authed=${rs.authedRoutes} public=${rs.publicRoutes} unprotected=${rs.unprotectedRoutes} frameworks=${rs.frameworksDetected.join(',')} duration=${rs.duration}ms`);
+        }
+        // Log taint analysis stats
+        const ts = model.taintStats;
+        log(`[Taint] repo=${repoInfo.name} files_analyzed=${ts.filesAnalyzed} files_with_sources=${ts.filesWithSources} files_with_taint_paths=${ts.filesWithTaintPaths} duration=${ts.duration}ms`);
+        if (ts.totalSources > 0) {
+            log(`[Taint] repo=${repoInfo.name} sources=${ts.totalSources} tainted_vars=${ts.totalTaintedVars} taint_paths=${ts.totalTaintPaths} (unsanitised=${ts.unsanitisedPaths} sanitised=${ts.sanitisedPaths}) sanitisers=${ts.totalSanitisers}`);
+            const sourceBreakdown = Object.entries(ts.sourceTypeBreakdown).map(([k, v]) => `${k}:${v}`).join(',');
+            if (sourceBreakdown)
+                log(`[Taint] repo=${repoInfo.name} source_types={${sourceBreakdown}}`);
+            const sinkBreakdown = Object.entries(ts.sinkTypeBreakdown).map(([k, v]) => `${k}:${v}`).join(',');
+            if (sinkBreakdown)
+                log(`[Taint] repo=${repoInfo.name} sink_types={${sinkBreakdown}}`);
+        }
+        checkCancelled();
+        // ===== Run Detectors (Layer 1 + Layer 2) =====
+        const detectorOutput = await (0, detect_1.runDetectors)({
+            files,
+            middlewareConfig: model.middlewareConfig,
+            fileAuthImports: model.fileAuthImports,
+            detectorContext: model.detectorContext,
+            onProgress,
+            cancellationToken,
+            filterPipeline,
+            repoName: repoInfo.name,
+            quiet,
+        });
+        const phaseTiming = {
+            ...detectorOutput.phaseTiming,
+        };
+        // ===== Aggregate Noisy Findings =====
+        const beforeAggregationCount = detectorOutput.findings.length;
+        const aggregatedFindings = (0, aggregation_1.aggregateNoisyFindings)(detectorOutput.findings);
+        if (filterPipeline.isEnabled) {
+            const afterIds = new Set(aggregatedFindings.map(fid));
+            for (const v of detectorOutput.findings) {
+                if (!afterIds.has(fid(v))) {
+                    filterPipeline.record(fid(v), { stage: 'noisy_aggregation', action: 'aggregated', reason: 'Aggregated noisy finding (3+ similar per file)' });
+                }
+            }
+        }
+        // ===== Enrich With Metadata =====
+        const enrichedFindings = (0, enrichment_1.enrichWithMetadata)(aggregatedFindings, model.contextEngine.projectContext);
+        // ===== Confidence Scoring =====
+        const { scored: scoredFindings, diagnostics: scoringDiagnostics } = (0, score_1.scoreFindings)(enrichedFindings, depth, model.contextEngine);
+        // ===== Confidence-based Routing =====
+        const toSurface = scoredFindings.filter(f => f.confidence_score.routing === 'surface');
+        const toValidate = scoredFindings.filter(f => f.confidence_score.routing === 'validate');
+        const suppressed = scoredFindings.filter(f => f.confidence_score.routing === 'suppress');
+        log(`[Confidence] repo=${repoInfo.name} depth=${depth} routing: surface=${toSurface.length} validate=${toValidate.length} suppress=${suppressed.length}`);
+        // Log scoring diagnostics
+        const dist = scoringDiagnostics.scoreDistribution;
+        log(`[Scoring] repo=${repoInfo.name} score_distribution: [0-0.2]=${dist['0.0-0.2']} [0.2-0.4]=${dist['0.2-0.4']} [0.4-0.6]=${dist['0.4-0.6']} [0.6-0.8]=${dist['0.6-0.8']} [0.8-1.0]=${dist['0.8-1.0']}`);
+        const ruleHits = Object.entries(scoringDiagnostics.ruleHitCounts)
+            .sort(([, a], [, b]) => b - a)
+            .map(([name, count]) => `${name}:${count}`)
+            .join(',');
+        if (ruleHits)
+            log(`[Scoring] repo=${repoInfo.name} rule_hits={${ruleHits}}`);
+        const taintHits = Object.entries(scoringDiagnostics.taintRuleHits)
+            .map(([name, count]) => `${name}:${count}`)
+            .join(',');
+        if (taintHits)
+            log(`[Scoring] repo=${repoInfo.name} taint_rule_hits={${taintHits}}`);
+        const catScores = Object.entries(scoringDiagnostics.categoryAvgScores)
+            .sort(([, a], [, b]) => b.avg - a.avg)
+            .map(([cat, d]) => `${cat}:${d.avg.toFixed(2)}(n=${d.count})`)
+            .join(',');
+        if (catScores)
+            log(`[Scoring] repo=${repoInfo.name} category_avg_scores={${catScores}}`);
+        // Record suppressed findings in filter pipeline
+        if (filterPipeline.isEnabled) {
+            for (const v of suppressed) {
+                const adjustmentSummary = v.confidence_score.adjustments
+                    .map(a => `${a.factor}(${a.delta > 0 ? '+' : ''}${a.delta.toFixed(2)})`)
+                    .join(', ');
+                filterPipeline.record(fid(v), {
+                    stage: 'confidence_scoring',
+                    action: 'dismissed',
+                    reason: `Suppressed by confidence score (${v.confidence_score.score.toFixed(2)}): ${adjustmentSummary || 'base too low'}`,
+                });
+            }
+        }
+        // ===== Per-File Validation Cap =====
+        const maxValidationFiles = scanModeConfig.maxAIValidationFiles || 10;
+        const cappedValidation = (0, validation_cap_1.capValidationCandidatesPerFile)(toValidate, maxValidationFiles);
+        checkCancelled();
+        // ===== AI Validation =====
+        let validatedFindings = cappedValidation;
+        const shouldValidate = options.enableAI !== false && !scanModeConfig.skipAIValidation && cappedValidation.length > 0;
+        if (shouldValidate) {
+            checkCancelled();
+            const aiValidationStart = Date.now();
+            reportProgress('validating', 'AI validating findings (entropy, secrets, AI patterns)...', cappedValidation.length);
+            // For incremental scans, only validate findings in changed files
+            const findingsToValidate = isIncremental && scanModeConfig.changedFiles
+                ? cappedValidation.filter(v => scanModeConfig.changedFiles.some(cf => v.filePath.endsWith(cf) || v.filePath.includes(cf)))
+                : cappedValidation;
+            if (findingsToValidate.length > 0) {
+                const validationResult = await (0, validate_1.validateFindingsWithAI)(findingsToValidate, filesForAI, model.contextEngine, onProgress ? (progress) => {
+                    onProgress({
+                        status: 'validating',
+                        message: progress.status,
+                        filesProcessed: progress.filesProcessed,
+                        totalFiles: progress.totalFiles,
+                        vulnerabilitiesFound: allVulnerabilities.length,
+                    });
+                } : undefined);
+                validatedFindings = validationResult.vulnerabilities;
+                const { stats: validationStats } = validationResult;
+                capturedValidationStats = validationStats;
+                phaseTiming.aiValidation = Date.now() - aiValidationStart;
+                if (filterPipeline.isEnabled) {
+                    const validatedIds = new Set(validatedFindings.map(fid));
+                    for (const v of findingsToValidate) {
+                        if (!validatedIds.has(fid(v))) {
+                            filterPipeline.record(fid(v), { stage: 'ai_validation', action: 'dismissed', reason: 'Dismissed by AI validation' });
+                        }
+                    }
+                    for (const v of validatedFindings) {
+                        if (v.validationNotes?.toLowerCase().includes('downgrad')) {
+                            filterPipeline.record(fid(v), { stage: 'ai_validation', action: 'downgraded', reason: v.validationNotes || 'Downgraded by AI validation', originalSeverity: undefined, newSeverity: v.severity });
+                        }
+                    }
+                }
+                log(`[AI Validation] repo=${repoInfo.name} depth=${depth} duration=${phaseTiming.aiValidation}ms candidates=${findingsToValidate.length} kept=${validationStats.confirmedFindings} rejected=${validationStats.dismissedFindings} downgraded=${validationStats.downgradedFindings}`);
+                log(`[AI Validation] cost_estimate: input_tokens=${validationStats.estimatedInputTokens} output_tokens=${validationStats.estimatedOutputTokens} cost=$${validationStats.estimatedCost.toFixed(4)} api_calls=${validationStats.apiCalls}`);
+                // Per-category AI validation breakdown
+                const categorySubmitted = {};
+                const categoryKept = {};
+                const categoryRejected = {};
+                const categoryDowngraded = {};
+                for (const f of findingsToValidate) {
+                    categorySubmitted[f.category] = (categorySubmitted[f.category] || 0) + 1;
+                }
+                for (const f of validatedFindings) {
+                    if (f.validationStatus === 'confirmed') {
+                        categoryKept[f.category] = (categoryKept[f.category] || 0) + 1;
+                    }
+                    else if (f.validationStatus === 'downgraded') {
+                        categoryDowngraded[f.category] = (categoryDowngraded[f.category] || 0) + 1;
+                    }
+                }
+                for (const [cat, submitted] of Object.entries(categorySubmitted)) {
+                    const kept = (categoryKept[cat] || 0) + (categoryDowngraded[cat] || 0);
+                    categoryRejected[cat] = submitted - kept;
+                }
+                const rejBreakdown = Object.entries(categoryRejected).filter(([, v]) => v > 0).sort(([, a], [, b]) => b - a).map(([k, v]) => `${k}:${v}`).join(',');
+                if (rejBreakdown)
+                    log(`[AI Validation] repo=${repoInfo.name} rejected_by_category={${rejBreakdown}}`);
+                const keptBreakdown = Object.entries(categoryKept).filter(([, v]) => v > 0).sort(([, a], [, b]) => b - a).map(([k, v]) => `${k}:${v}`).join(',');
+                if (keptBreakdown)
+                    log(`[AI Validation] repo=${repoInfo.name} confirmed_by_category={${keptBreakdown}}`);
+                const dgBreakdown = Object.entries(categoryDowngraded).filter(([, v]) => v > 0).sort(([, a], [, b]) => b - a).map(([k, v]) => `${k}:${v}`).join(',');
+                if (dgBreakdown)
+                    log(`[AI Validation] repo=${repoInfo.name} downgraded_by_category={${dgBreakdown}}`);
+                // Add back findings that weren't validated (not in changed files)
+                const notValidated = cappedValidation.filter(v => !findingsToValidate.includes(v)).map(v => ({
+                    ...v,
+                    validatedByAI: false,
+                    validationStatus: 'not_validated',
+                    validationNotes: 'Skipped validation (not in changed files for incremental scan)',
+                }));
+                validatedFindings.push(...notValidated);
+            }
+        }
+        else if (scanModeConfig.skipAIValidation) {
+            log(`[AI Validation] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config findings_requiring_validation=${cappedValidation.length}`);
+            validatedFindings = [];
+        }
+        // ===== Combine surfaced + validated =====
+        allVulnerabilities.push(...validatedFindings, ...toSurface);
+        // Layer 3: AI Semantic Analysis (removed — deep mode unused in production)
+        if (scanModeConfig.skipLayer3) {
+            log(`[Layer3] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
+        }
+        // Log phase timing summary
+        const allTimings = {
+            model: modelDuration,
+            ...phaseTiming,
+        };
+        const phaseTimingStr = Object.entries(allTimings)
+            .filter(([, ms]) => ms !== undefined)
+            .map(([phase, ms]) => `${phase}=${ms}ms`)
+            .join(' ');
+        if (phaseTimingStr) {
+            log(`[Scanner] repo=${repoInfo.name} phase_timing: ${phaseTimingStr}`);
+        }
+        // ===== Postprocess Findings =====
+        const postprocessed = (0, postprocess_1.postprocessFindings)({
+            findings: allVulnerabilities,
+            files,
+            middlewareConfig: model.middlewareConfig,
+            projectPath: options.projectPath,
+            filterPipeline,
+            showSuppressed: options.showSuppressed,
+        });
+        // Log suppression stats if any were suppressed
+        if (postprocessed.suppressionResult.suppressed.length > 0 || postprocessed.suppressionResult.expiredSuppressions > 0) {
+            log(`[Suppression] repo=${repoInfo.name} suppressed=${postprocessed.suppressionResult.suppressed.length} (inline=${postprocessed.suppressionResult.stats.inlineSuppressed} config_finding=${postprocessed.suppressionResult.stats.configFindingSuppressed} config_rule=${postprocessed.suppressionResult.stats.configRuleSuppressed}) expired=${postprocessed.suppressionResult.expiredSuppressions}`);
+        }
+        reportProgress('complete', 'Scan complete!', postprocessed.findings.length);
+        // ===== Pipeline Funnel Summary =====
+        const totalDuration = Date.now() - startTime;
+        const funnelParts = [
+            `raw=${beforeAggregationCount}`,
+            `aggregated=${aggregatedFindings.length}`,
+            `scored=${scoredFindings.length}`,
+            `surface=${toSurface.length}`,
+            `validate=${toValidate.length}`,
+            `suppress=${suppressed.length}`,
+        ];
+        if (shouldValidate && capturedValidationStats) {
+            funnelParts.push(`ai_kept=${capturedValidationStats.confirmedFindings + capturedValidationStats.downgradedFindings}`);
+            funnelParts.push(`ai_rejected=${capturedValidationStats.dismissedFindings}`);
+        }
+        funnelParts.push(`postprocessed=${postprocessed.findings.length}`);
+        log(`[Funnel] repo=${repoInfo.name} ${funnelParts.join(' → ')}`);
+        log(`[Summary] repo=${repoInfo.name} total_duration=${totalDuration}ms files=${files.length} final_findings=${postprocessed.findings.length}`);
+        // ===== Build Final Result =====
+        return (0, build_result_1.buildScanResult)({
+            repoInfo,
+            files,
+            findings: postprocessed.findings,
+            suppressionResult: postprocessed.suppressionResult,
+            startTime,
+            validationStats: capturedValidationStats,
+            showSuppressed: options.showSuppressed,
+            filterPipeline,
+        });
+    }
+    catch (error) {
+        if (cancellationToken?.cancelled) {
+            // Return partial results on cancellation
+            reportProgress('failed', 'Scan cancelled');
+            // Compute partial results
+            const uniqueVulnerabilities = (0, dedup_1.deduplicateVulnerabilities)(allVulnerabilities);
+            const resolvedVulnerabilities = (0, contradictions_1.resolveContradictions)(uniqueVulnerabilities, middlewareConfig);
+            const sortedVulnerabilities = (0, summary_1.sortBySeverity)(resolvedVulnerabilities);
+            const severityCounts = (0, summary_1.computeSeverityCounts)(sortedVulnerabilities);
+            const categoryCounts = (0, summary_1.computeCategoryCounts)(sortedVulnerabilities);
+            return {
+                repoName: repoInfo.name,
+                repoUrl: repoInfo.url,
+                branch: repoInfo.branch,
+                filesScanned: files.length,
+                filesSkipped: 0,
+                vulnerabilities: sortedVulnerabilities,
+                severityCounts,
+                categoryCounts,
+                hasBlockingIssues: false, // Don't block on partial results
+                scanDuration: Date.now() - startTime,
+                timestamp: new Date().toISOString(),
+                validationStats: capturedValidationStats,
+                cancelled: true,
+                cancelReason: cancellationToken.reason,
+            };
+        }
+        reportProgress('failed', `Scan failed: ${error}`);
+        throw error;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/pipeline/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pipeline/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAsCH,0BA6XC;AAzZD,qCAAgD;AAChD,8DAAuD;AACvD,oCAA4C;AAC5C,sCAAwC;AACxC,4DAAmE;AACnE,qDAAyD;AACzD,oCAAiE;AAGjE,kEAA8E;AAC9E,0CAA0E;AAC1E,gDAAoD;AACpD,yDAAwD;AACxD,gEAAkE;AAClE,+CAAgG;AAChG,gDAAiE;AACjE,kEAAqE;AAKrE;;;;;;GAMG;AACI,KAAK,UAAU,OAAO,CAC3B,KAAiB,EACjB,QAAuD,EACvD,UAAuB,EAAE,EACzB,UAA6B;IAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,MAAM,kBAAkB,GAAoB,EAAE,CAAA;IAE9C,sDAAsD;IACtD,MAAM,cAAc,GAAG,IAAI,yBAAc,CAAC,OAAO,CAAC,kBAAkB,IAAI,KAAK,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,CAAC,CAA8D,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAA;IAE7H,kCAAkC;IAClC,MAAM,cAAc,GAAG,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAA;IACrD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,KAAK,aAAa,CAAA;IAC3D,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,IAAI,OAAO,CAAA;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACpC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAA;IAEnD,iFAAiF;IACjF,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,CAAA;IAED,sDAAsD;IACtD,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,mBAAmB,iBAAiB,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAA;QACpF,CAAC;IACH,CAAC,CAAA;IAED,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,SAAS,cAAc,CAAC,IAAI,UAAU,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACvG,IAAI,aAAa,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,sBAAsB,cAAc,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,qEAAqE;IACrE,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,8BAAY,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;IACtE,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAA,8BAAY,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAChD,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,yBAAyB,eAAe,oBAAoB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,yBAAyB;IACzB,MAAM,cAAc,GAAG,CACrB,MAA8B,EAC9B,OAAe,EACf,uBAA+B,kBAAkB,CAAC,MAAM,EACxD,EAAE;QACF,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC;gBACT,MAAM;gBACN,OAAO;gBACP,cAAc,EAAE,KAAK,CAAC,MAAM;gBAC5B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,oBAAoB;aACrB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,aAAa,IAAI,cAAc,CAAC,YAAY;QAC7D,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,YAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACxG,CAAC,CAAC,KAAK,CAAA;IAET,8DAA8D;IAC9D,IAAI,gBAAsF,CAAA;IAC1F,IAAI,uBAAoD,CAAA;IAExD,IAAI,CAAC;QACH,cAAc,EAAE,CAAA;QAEhB,kCAAkC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC7B,MAAM,KAAK,GAAG,IAAA,yBAAiB,EAAC,KAAK,CAAC,CAAA;QACtC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAA;QAC7C,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAA;QAEzC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,IAAI,mBAAmB,aAAa,qBAAqB,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAA;QAEpH,IAAI,KAAK,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;YAC7C,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,oBAAoB,KAAK,CAAC,gBAAgB,CAAC,QAAQ,IAAI,SAAS,SAAS,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAA;QACtJ,CAAC;QAED,MAAM,qBAAqB,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAA;QAC/G,IAAI,qBAAqB,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,6BAA6B,qBAAqB,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,4BAA4B;QAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAA;QAC3B,IAAI,EAAE,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,iBAAiB,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC,WAAW,WAAW,EAAE,CAAC,YAAY,WAAW,EAAE,CAAC,YAAY,gBAAgB,EAAE,CAAC,iBAAiB,eAAe,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAA;QAC/N,CAAC;QAED,2BAA2B;QAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAA;QAC3B,GAAG,CAAC,gBAAgB,QAAQ,CAAC,IAAI,mBAAmB,EAAE,CAAC,aAAa,uBAAuB,EAAE,CAAC,gBAAgB,2BAA2B,EAAE,CAAC,mBAAmB,aAAa,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAA;QAC5L,IAAI,EAAE,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,gBAAgB,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,YAAY,iBAAiB,EAAE,CAAC,gBAAgB,gBAAgB,EAAE,CAAC,eAAe,iBAAiB,EAAE,CAAC,gBAAgB,cAAc,EAAE,CAAC,cAAc,gBAAgB,EAAE,CAAC,eAAe,EAAE,CAAC,CAAA;YAC1O,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACrG,IAAI,eAAe;gBAAE,GAAG,CAAC,gBAAgB,QAAQ,CAAC,IAAI,kBAAkB,eAAe,GAAG,CAAC,CAAA;YAC3F,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjG,IAAI,aAAa;gBAAE,GAAG,CAAC,gBAAgB,QAAQ,CAAC,IAAI,gBAAgB,aAAa,GAAG,CAAC,CAAA;QACvF,CAAC;QAED,cAAc,EAAE,CAAA;QAEhB,gDAAgD;QAChD,MAAM,cAAc,GAAG,MAAM,IAAA,qBAAY,EAAC;YACxC,KAAK;YACL,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU;YACV,iBAAiB;YACjB,cAAc;YACd,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,KAAK;SACN,CAAC,CAAA;QAEF,MAAM,WAAW,GAAiF;YAChG,GAAG,cAAc,CAAC,WAAW;SAC9B,CAAA;QAED,uCAAuC;QACvC,MAAM,sBAAsB,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAA;QAC7D,MAAM,kBAAkB,GAAG,IAAA,oCAAsB,EAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC1E,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YACrD,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1B,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC,CAAA;gBAC/I,CAAC;YACH,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,MAAM,gBAAgB,GAAG,IAAA,+BAAkB,EAAC,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,CAAA;QAEnG,iCAAiC;QACjC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,GAAG,IAAA,qBAAa,EAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;QAE/H,uCAAuC;QACvC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,KAAK,SAAS,CAAC,CAAA;QACtF,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,KAAK,UAAU,CAAC,CAAA;QACxF,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,KAAK,UAAU,CAAC,CAAA;QAExF,GAAG,CAAC,qBAAqB,QAAQ,CAAC,IAAI,UAAU,KAAK,qBAAqB,SAAS,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QAEzJ,0BAA0B;QAC1B,MAAM,IAAI,GAAG,kBAAkB,CAAC,iBAAiB,CAAA;QACjD,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,gCAAgC,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACzM,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC;aAC9D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,IAAI,QAAQ;YAAE,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,eAAe,QAAQ,GAAG,CAAC,CAAA;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC;aAC/D,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,IAAI,SAAS;YAAE,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,qBAAqB,SAAS,GAAG,CAAC,CAAA;QACpF,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;aACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC;aAC7D,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,IAAI,SAAS;YAAE,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,yBAAyB,SAAS,GAAG,CAAC,CAAA;QAExF,gDAAgD;QAChD,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,MAAM,iBAAiB,GAAG,CAAC,CAAC,gBAAgB,CAAC,WAAW;qBACrD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;qBACvE,IAAI,CAAC,IAAI,CAAC,CAAA;gBACb,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;oBAC5B,KAAK,EAAE,oBAAoB;oBAC3B,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,mCAAmC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,IAAI,cAAc,EAAE;iBAC1H,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,kBAAkB,GAAG,cAAc,CAAC,oBAAoB,IAAI,EAAE,CAAA;QACpE,MAAM,gBAAgB,GAAG,IAAA,+CAA8B,EAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAEvF,cAAc,EAAE,CAAA;QAEhB,4BAA4B;QAC5B,IAAI,iBAAiB,GAAoB,gBAAgB,CAAA;QACzD,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,cAAc,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAA;QAEpH,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,EAAE,CAAA;YAChB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACpC,cAAc,CAAC,YAAY,EAAE,2DAA2D,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;YAElH,iEAAiE;YACjE,MAAM,kBAAkB,GAAG,aAAa,IAAI,cAAc,CAAC,YAAY;gBACrE,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,YAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC3H,CAAC,CAAC,gBAAgB,CAAA;YAEpB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,gBAAgB,GAAG,MAAM,IAAA,iCAAsB,EACnD,kBAAkB,EAClB,UAAU,EACV,KAAK,CAAC,aAAa,EACnB,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;oBACxB,UAAU,CAAC;wBACT,MAAM,EAAE,YAAY;wBACpB,OAAO,EAAE,QAAQ,CAAC,MAAM;wBACxB,cAAc,EAAE,QAAQ,CAAC,cAAc;wBACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,oBAAoB,EAAE,kBAAkB,CAAC,MAAM;qBAChD,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAC,CAAC,SAAS,CACd,CAAA;gBACD,iBAAiB,GAAG,gBAAgB,CAAC,eAAe,CAAA;gBACpD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAAA;gBACnD,uBAAuB,GAAG,eAAe,CAAA;gBACzC,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAA;gBAEzD,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;oBACxD,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;wBACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC9B,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAA;wBACtH,CAAC;oBACH,CAAC;oBACD,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;wBAClC,IAAI,CAAC,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC1D,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,eAAe,IAAI,6BAA6B,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;wBACnM,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,wBAAwB,QAAQ,CAAC,IAAI,UAAU,KAAK,aAAa,WAAW,CAAC,YAAY,iBAAiB,kBAAkB,CAAC,MAAM,SAAS,eAAe,CAAC,iBAAiB,aAAa,eAAe,CAAC,iBAAiB,eAAe,eAAe,CAAC,kBAAkB,EAAE,CAAC,CAAA;gBACnR,GAAG,CAAC,+CAA+C,eAAe,CAAC,oBAAoB,kBAAkB,eAAe,CAAC,qBAAqB,UAAU,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAA;gBAEzO,uCAAuC;gBACvC,MAAM,iBAAiB,GAA2B,EAAE,CAAA;gBACpD,MAAM,YAAY,GAA2B,EAAE,CAAA;gBAC/C,MAAM,gBAAgB,GAA2B,EAAE,CAAA;gBACnD,MAAM,kBAAkB,GAA2B,EAAE,CAAA;gBACrD,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;oBACnC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC1E,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;oBAClC,IAAI,CAAC,CAAC,gBAAgB,KAAK,WAAW,EAAE,CAAC;wBACvC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;oBAChE,CAAC;yBAAM,IAAI,CAAC,CAAC,gBAAgB,KAAK,YAAY,EAAE,CAAC;wBAC/C,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;oBAC5E,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBACjE,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBACtE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,IAAI,CAAA;gBAC1C,CAAC;gBACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACnJ,IAAI,YAAY;oBAAE,GAAG,CAAC,wBAAwB,QAAQ,CAAC,IAAI,0BAA0B,YAAY,GAAG,CAAC,CAAA;gBACrG,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAChJ,IAAI,aAAa;oBAAE,GAAG,CAAC,wBAAwB,QAAQ,CAAC,IAAI,2BAA2B,aAAa,GAAG,CAAC,CAAA;gBACxG,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpJ,IAAI,WAAW;oBAAE,GAAG,CAAC,wBAAwB,QAAQ,CAAC,IAAI,4BAA4B,WAAW,GAAG,CAAC,CAAA;gBAErG,kEAAkE;gBAClE,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC3F,GAAG,CAAC;oBACJ,aAAa,EAAE,KAAK;oBACpB,gBAAgB,EAAE,eAAwB;oBAC1C,eAAe,EAAE,gEAAgE;iBAClF,CAAC,CAAC,CAAA;gBACH,iBAAiB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;YACzC,CAAC;QACH,CAAC;aAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,CAAC;YAC3C,GAAG,CAAC,wBAAwB,QAAQ,CAAC,IAAI,UAAU,KAAK,uEAAuE,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;YACzJ,iBAAiB,GAAG,EAAE,CAAA;QACxB,CAAC;QAED,2CAA2C;QAC3C,kBAAkB,CAAC,IAAI,CAAC,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAAC,CAAA;QAE3D,2EAA2E;QAC3E,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;YAC9B,GAAG,CAAC,iBAAiB,QAAQ,CAAC,IAAI,UAAU,KAAK,uCAAuC,CAAC,CAAA;QAC3F,CAAC;QAED,2BAA2B;QAC3B,MAAM,UAAU,GAAuC;YACrD,KAAK,EAAE,aAAa;YACpB,GAAG,WAAW;SACf,CAAA;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,EAAE,IAAI,CAAC;aACxC,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,IAAI,cAAc,EAAE,CAAC;YACnB,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,kBAAkB,cAAc,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,mCAAmC;QACnC,MAAM,aAAa,GAAG,IAAA,iCAAmB,EAAC;YACxC,QAAQ,EAAE,kBAAkB;YAC5B,KAAK;YACL,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc;YACd,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAA;QAEF,+CAA+C;QAC/C,IAAI,aAAa,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,iBAAiB,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YACrH,GAAG,CAAC,sBAAsB,QAAQ,CAAC,IAAI,eAAe,aAAa,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,YAAY,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,gBAAgB,mBAAmB,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,uBAAuB,gBAAgB,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,aAAa,aAAa,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,CAAC,CAAA;QACxY,CAAC;QAED,cAAc,CAAC,UAAU,EAAE,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAE3E,sCAAsC;QACtC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;QAC5C,MAAM,WAAW,GAAG;YAClB,OAAO,sBAAsB,EAAE;YAC/B,cAAc,kBAAkB,CAAC,MAAM,EAAE;YACzC,UAAU,cAAc,CAAC,MAAM,EAAE;YACjC,WAAW,SAAS,CAAC,MAAM,EAAE;YAC7B,YAAY,UAAU,CAAC,MAAM,EAAE;YAC/B,YAAY,UAAU,CAAC,MAAM,EAAE;SAChC,CAAA;QACD,IAAI,cAAc,IAAI,uBAAuB,EAAE,CAAC;YAC9C,WAAW,CAAC,IAAI,CAAC,WAAW,uBAAuB,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,kBAAkB,EAAE,CAAC,CAAA;YACrH,WAAW,CAAC,IAAI,CAAC,eAAe,uBAAuB,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,iBAAiB,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,GAAG,CAAC,iBAAiB,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAChE,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,mBAAmB,aAAa,YAAY,KAAK,CAAC,MAAM,mBAAmB,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAE9I,iCAAiC;QACjC,OAAO,IAAA,8BAAe,EAAC;YACrB,QAAQ;YACR,KAAK;YACL,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;YAClD,SAAS;YACT,eAAe,EAAE,uBAAuB;YACxC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc;SACf,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;YACjC,yCAAyC;YACzC,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;YAE1C,0BAA0B;YAC1B,MAAM,qBAAqB,GAAG,IAAA,kCAA0B,EAAC,kBAAkB,CAAC,CAAA;YAC5E,MAAM,uBAAuB,GAAG,IAAA,sCAAqB,EAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAA;YAC9F,MAAM,qBAAqB,GAAG,IAAA,wBAAc,EAAC,uBAAuB,CAAC,CAAA;YACrE,MAAM,cAAc,GAAG,IAAA,+BAAqB,EAAC,qBAAqB,CAAC,CAAA;YACnE,MAAM,cAAc,GAAG,IAAA,+BAAqB,EAAC,qBAAqB,CAAC,CAAA;YAEnE,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE,QAAQ,CAAC,GAAG;gBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,YAAY,EAAE,CAAC;gBACf,eAAe,EAAE,qBAAqB;gBACtC,cAAc;gBACd,cAAc;gBACd,iBAAiB,EAAE,KAAK,EAAE,iCAAiC;gBAC3D,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,eAAe,EAAE,uBAAuB;gBACxC,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,iBAAiB,CAAC,MAAM;aACvC,CAAA;QACH,CAAC;QAED,cAAc,CAAC,QAAQ,EAAE,gBAAgB,KAAK,EAAE,CAAC,CAAA;QACjD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/pipeline/modes/incremental.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Incremental Scan Mode
+ * Optimized scanning for PR workflows - only scan changed files and surface relevant findings
+ */
+import type { ScanFile, Vulnerability, ScanModeConfig } from '../../shared/types';
+import { type FileDiff } from '../../shared/diff-parser';
+/**
+ * Options for incremental scanning
+ */
+export interface IncrementalScanOptions {
+    /** Git diff output (if available) */
+    diffContent?: string;
+    /** List of changed file paths (alternative to diff) */
+    changedFiles?: string[];
+    /** Whether to only show findings on exactly changed lines (strict) or nearby (default) */
+    strictLineMatching?: boolean;
+    /** Context window for "near changed line" (default: 5) */
+    contextWindow?: number;
+    /** Whether to mark findings as "introduced in this PR" */
+    markAsIntroduced?: boolean;
+    /** Previous findings to compare against (for suppressing pre-existing issues) */
+    previousFindings?: Vulnerability[];
+}
+/**
+ * Result of incremental scan with additional PR-specific metadata
+ */
+export interface IncrementalScanResult {
+    /** All findings (filtered to changed lines) */
+    findings: Vulnerability[];
+    /** Findings that are new in this PR */
+    introduced: Vulnerability[];
+    /** Findings that existed before (if previousFindings provided) */
+    preExisting: Vulnerability[];
+    /** Number of files scanned */
+    filesScanned: number;
+    /** Number of files that were changed */
+    filesChanged: number;
+    /** Parsed diff information */
+    diffs: Map<string, FileDiff>;
+    /** Scan duration in ms */
+    duration: number;
+}
+/**
+ * Run an incremental scan optimized for PR workflows
+ *
+ * This scans:
+ * 1. All changed files (added + modified)
+ * 2. Files that import changed files (for context)
+ * 3. Middleware files (for auth context)
+ *
+ * And only surfaces findings on/near changed lines.
+ */
+export declare function runIncrementalScan(allFiles: ScanFile[], options: IncrementalScanOptions): Promise<IncrementalScanResult>;
+/**
+ * Create a PR-optimized scan config
+ */
+export declare function createPRScanConfig(changedFiles: string[], options?: Partial<ScanModeConfig>): ScanModeConfig;
+/**
+ * Format incremental scan result for PR comment
+ */
+export declare function formatIncrementalForPR(result: IncrementalScanResult): {
+    summary: string;
+    hasNewIssues: boolean;
+    blockingIssues: number;
+};
+//# sourceMappingURL=incremental.d.ts.map

package/dist/pipeline/modes/incremental.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incremental.d.ts","sourceRoot":"","sources":["../../../src/pipeline/modes/incremental.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAc,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAG7F,OAAO,EAKL,KAAK,QAAQ,EACd,MAAM,0BAA0B,CAAA;AAGjC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,0FAA0F;IAC1F,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,uCAAuC;IACvC,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,kEAAkE;IAClE,WAAW,EAAE,aAAa,EAAE,CAAA;IAC5B,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,wCAAwC;IACxC,YAAY,EAAE,MAAM,CAAA;IACpB,8BAA8B;IAC9B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC5B,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,QAAQ,EAAE,EACpB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA+HhC;AA+CD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,GAAE,OAAO,CAAC,cAAc,CAAM,GACpC,cAAc,CAWhB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG;IACrE,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,OAAO,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB,CAwBA"}