@opencodehub/ingestion 0.1.0

package/dist/pipeline/phases/routes.js

@@ -0,0 +1,262 @@
+/**
+ * Routes phase — materialises HTTP route metadata emitted by the static
+ * detectors (Next.js, Express, FastAPI, NestJS, Spring MVC, Rails) as
+ * graph nodes and edges.
+ *
+ * The phase:
+ *   1. Feeds the scanned files through every detector that matches the
+ *      active {@link ProjectProfileNode.frameworks} list. Next.js +
+ *      Express always run when TS/JS files are present. FastAPI runs on
+ *      `fastapi`, NestJS on `nestjs`, Spring on any `spring-*` variant,
+ *      Rails on `rails`.
+ *   2. Creates one `Route` node per unique `(url, method)` pair, keyed
+ *      by the handler file so two frameworks declaring the same URL on
+ *      the same file reuse the node.
+ *   3. Emits `HANDLES_ROUTE` edges from the declaring File node to the
+ *      Route node with a fixed confidence of 0.9.
+ *   4. Detects cross-file duplicates for the same `(url, method)` and
+ *      surfaces them as warnings via the progress callback — but keeps
+ *      one edge per handler file (the route *is* re-declared).
+ *
+ * Depends on `parse` to order the DAG; the profile node is read from
+ * the in-memory graph.
+ */
+import { promises as fs } from "node:fs";
+import { makeNodeId } from "@opencodehub/core-types";
+import { importsMapFromExtracted } from "../../extract/receiver-resolver.js";
+import { detectExpressRoutes, detectNextJsRoutes, populateNextJsResponseKeys, } from "../../extract/route-detector.js";
+import { detectSpringRoutes } from "../../extract/route-detector-java.js";
+import { detectNestJsRoutes } from "../../extract/route-detector-nestjs.js";
+import { detectFastApiRoutes } from "../../extract/route-detector-python.js";
+import { detectRailsRoutes } from "../../extract/route-detector-rails.js";
+import { PARSE_PHASE_NAME } from "./parse.js";
+import { SCAN_PHASE_NAME } from "./scan.js";
+/** Extensions that could plausibly host a Next.js route or Express code. */
+const JS_TS_EXTS = new Set([
+    ".ts",
+    ".tsx",
+    ".mts",
+    ".cts",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+]);
+/** Extensions the FastAPI detector scans. */
+const PYTHON_EXTS = new Set([".py"]);
+/** Extensions the Spring detector scans. */
+const JAVA_EXTS = new Set([".java"]);
+export const ROUTES_PHASE_NAME = "routes";
+export const routesPhase = {
+    name: ROUTES_PHASE_NAME,
+    // `profile` is a dependency so the detected-frameworks gating can
+    // read the ProjectProfile node out of the graph without a race.
+    deps: [PARSE_PHASE_NAME, "profile"],
+    async run(ctx, deps) {
+        const scan = ctx.phaseOutputs.get(SCAN_PHASE_NAME);
+        if (scan === undefined) {
+            throw new Error("routes: scan output missing from phase outputs");
+        }
+        const parse = deps.get(PARSE_PHASE_NAME);
+        if (parse === undefined) {
+            throw new Error("routes: parse output missing from dependency map");
+        }
+        return runRoutes(ctx, scan, parse);
+    },
+};
+async function runRoutes(ctx, scan, parse) {
+    const frameworks = readDetectedFrameworks(ctx);
+    const importsByFile = importsMapFromExtracted(parse.importsByFile);
+    const strictDetectors = ctx.options.strictDetectors === true;
+    // Bundle files we might hand to TS/JS detectors (Next.js, Express,
+    // NestJS). Each entry is read once so all three detectors share the
+    // same buffer.
+    const jsTsCandidates = scan.files.filter((f) => JS_TS_EXTS.has(extLower(f.relPath)));
+    const bundle = await readBundle(ctx, jsTsCandidates);
+    // Next.js App Router is filesystem-routed — pass the full bundle.
+    const nextRoutesRaw = detectNextJsRoutes(bundle, ctx.repoPath);
+    // Walk each verb handler's body for `NextResponse.json({...})` /
+    // `Response.json({...})` literals and promote the keys onto `responseKeys`.
+    const nextRoutes = populateNextJsResponseKeys(nextRoutesRaw, bundle);
+    // Express is file-local.
+    const expressRoutes = [];
+    for (const entry of bundle) {
+        for (const r of detectExpressRoutes({
+            filePath: entry.filePath,
+            content: entry.content,
+            importsByFile,
+            strictDetectors,
+        })) {
+            expressRoutes.push(r);
+        }
+    }
+    // NestJS — profile-gated.
+    const nestRoutes = [];
+    if (frameworks.has("nestjs")) {
+        for (const entry of bundle) {
+            for (const r of detectNestJsRoutes({ filePath: entry.filePath, content: entry.content })) {
+                nestRoutes.push(r);
+            }
+        }
+    }
+    // FastAPI — profile-gated. Reads `.py` candidates from the scan.
+    const fastApiRoutes = [];
+    if (frameworks.has("fastapi")) {
+        const pyFiles = scan.files.filter((f) => PYTHON_EXTS.has(extLower(f.relPath)));
+        const pyBundle = await readBundle(ctx, pyFiles);
+        for (const entry of pyBundle) {
+            for (const r of detectFastApiRoutes({ filePath: entry.filePath, content: entry.content })) {
+                fastApiRoutes.push(r);
+            }
+        }
+    }
+    // Spring — profile-gated on any `spring-*` detected framework.
+    const springRoutes = [];
+    const hasSpring = [...frameworks].some((f) => f === "spring" || f.startsWith("spring-"));
+    if (hasSpring) {
+        const javaFiles = scan.files.filter((f) => JAVA_EXTS.has(extLower(f.relPath)));
+        const javaBundle = await readBundle(ctx, javaFiles);
+        for (const entry of javaBundle) {
+            for (const r of detectSpringRoutes({ filePath: entry.filePath, content: entry.content })) {
+                springRoutes.push(r);
+            }
+        }
+    }
+    // Rails — profile-gated. Only scans `config/routes*.rb`.
+    const railsRoutes = [];
+    if (frameworks.has("rails")) {
+        const routeFiles = scan.files.filter((f) => /(^|\/)config\/routes(?:\.[\w-]+)?\.rb$/.test(f.relPath));
+        const routesBundle = await readBundle(ctx, routeFiles);
+        for (const entry of routesBundle) {
+            for (const r of detectRailsRoutes(entry.filePath, entry.content)) {
+                railsRoutes.push(r);
+            }
+        }
+    }
+    // Stable ordering so edge insertion is deterministic.
+    const all = [
+        ...nextRoutes,
+        ...expressRoutes,
+        ...nestRoutes,
+        ...fastApiRoutes,
+        ...springRoutes,
+        ...railsRoutes,
+    ]
+        .slice()
+        .sort(compareRoute);
+    // Dedupe (url, method) to count duplicates while still emitting one edge
+    // per (handlerFile, url, method). Multiple files claiming the same URL
+    // is a warning; multiple edges from the same file to the same route
+    // collapse in addEdge.
+    const globalKeyCounts = new Map();
+    for (const r of all) {
+        const key = globalKey(r);
+        globalKeyCounts.set(key, (globalKeyCounts.get(key) ?? 0) + 1);
+    }
+    let duplicateCount = 0;
+    const warnedKeys = new Set();
+    const emittedEdgeKeys = new Set();
+    let routeCount = 0;
+    for (const r of all) {
+        const method = r.method ?? "ANY";
+        const routeId = makeNodeId("Route", r.handlerFile, `${method}:${r.url}`);
+        const routeNode = {
+            id: routeId,
+            kind: "Route",
+            name: `${method} ${r.url}`,
+            filePath: r.handlerFile,
+            url: r.url,
+            ...(r.method !== undefined ? { method: r.method } : {}),
+            ...(r.responseKeys !== undefined ? { responseKeys: r.responseKeys } : {}),
+        };
+        ctx.graph.addNode(routeNode);
+        routeCount += 1;
+        const fileId = makeNodeId("File", r.handlerFile, r.handlerFile);
+        const edgeKey = `${r.handlerFile}\u0000${method}\u0000${r.url}`;
+        if (!emittedEdgeKeys.has(edgeKey)) {
+            emittedEdgeKeys.add(edgeKey);
+            ctx.graph.addEdge({
+                from: fileId,
+                to: routeId,
+                type: "HANDLES_ROUTE",
+                confidence: 0.9,
+                reason: `${r.framework}-handler`,
+            });
+        }
+        const gKey = globalKey(r);
+        if ((globalKeyCounts.get(gKey) ?? 0) > 1 && !warnedKeys.has(gKey)) {
+            warnedKeys.add(gKey);
+            duplicateCount += 1;
+            ctx.onProgress?.({
+                phase: ROUTES_PHASE_NAME,
+                kind: "warn",
+                message: `routes: duplicate registration for ${method} ${r.url}`,
+            });
+        }
+    }
+    return { routeCount, duplicateCount };
+}
+function globalKey(r) {
+    const method = r.method ?? "ANY";
+    return `${method}\u0000${r.url}`;
+}
+function compareRoute(a, b) {
+    if (a.handlerFile !== b.handlerFile)
+        return a.handlerFile < b.handlerFile ? -1 : 1;
+    const am = a.method ?? "";
+    const bm = b.method ?? "";
+    if (am !== bm)
+        return am < bm ? -1 : 1;
+    if (a.url !== b.url)
+        return a.url < b.url ? -1 : 1;
+    return 0;
+}
+function extLower(relPath) {
+    const idx = relPath.lastIndexOf(".");
+    if (idx < 0)
+        return "";
+    return relPath.slice(idx).toLowerCase();
+}
+/**
+ * Read a list of scan files into a [path, content] bundle for a
+ * detector. Errors are logged as warnings; affected files simply don't
+ * appear in the returned bundle.
+ */
+async function readBundle(ctx, files) {
+    const out = [];
+    for (const f of files) {
+        try {
+            const buf = await fs.readFile(f.absPath);
+            out.push({ filePath: f.relPath, content: buf.toString("utf8") });
+        }
+        catch (err) {
+            ctx.onProgress?.({
+                phase: ROUTES_PHASE_NAME,
+                kind: "warn",
+                message: `routes: cannot read ${f.relPath}: ${err.message}`,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Pull the detected framework set from the in-memory graph's singleton
+ * `ProjectProfile` node. Returns an empty set when the profile phase
+ * has not yet populated the node — which is also the default when the
+ * profile phase is disabled.
+ */
+function readDetectedFrameworks(ctx) {
+    const out = new Set();
+    for (const n of ctx.graph.nodes()) {
+        if (n.kind !== "ProjectProfile")
+            continue;
+        const profile = n;
+        for (const name of profile.frameworks ?? [])
+            out.add(name);
+        for (const d of profile.frameworksDetected ?? [])
+            out.add(d.name);
+        break;
+    }
+    return out;
+}
+//# sourceMappingURL=routes.js.map

package/dist/pipeline/phases/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/pipeline/phases/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,gBAAgB,EAAoB,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,eAAe,EAAmB,MAAM,WAAW,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC9C,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAE1D,4CAA4C;AAC5C,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAO1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,CAAC,MAAM,WAAW,GAAgC;IACtD,IAAI,EAAE,iBAAiB;IACvB,kEAAkE;IAClE,gEAAgE;IAChE,IAAI,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC;IACnC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAA2B,CAAC;QAC7E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAA4B,CAAC;QACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,SAAS,CACtB,GAAoB,EACpB,IAAgB,EAChB,KAAkB;IAElB,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC;IAE7D,mEAAmE;IACnE,oEAAoE;IACpE,eAAe;IACf,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAErD,kEAAkE;IAClE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/D,iEAAiE;IACjE,4EAA4E;IAC5E,MAAM,UAAU,GAAG,0BAA0B,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAErE,yBAAyB;IACzB,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa;YACb,eAAe;SAChB,CAAC,EAAE,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACzF,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC1F,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,MAAM,YAAY,GAAqB,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACzF,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACzC,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CACzD,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,GAAG,GAAG;QACV,GAAG,UAAU;QACb,GAAG,aAAa;QAChB,GAAG,UAAU;QACb,GAAG,aAAa;QAChB,GAAG,YAAY;QACf,GAAG,WAAW;KACf;SACE,KAAK,EAAE;SACP,IAAI,CAAC,YAAY,CAAC,CAAC;IAEtB,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,SAAS,GAAc;YAC3B,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE;YAC1B,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7B,UAAU,IAAI,CAAC,CAAC;QAEhB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,WAAW,SAAS,MAAM,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC;QAChE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;gBAChB,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,OAAO;gBACX,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,UAAU;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrB,cAAc,IAAI,CAAC,CAAC;YACpB,GAAG,CAAC,UAAU,EAAE,CAAC;gBACf,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,sCAAsC,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,CAAiB;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;IACjC,OAAO,GAAG,MAAM,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,CAAiB,EAAE,CAAiB;IACxD,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC1B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,KAAsD;IAEtD,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,EAAE,CAAC;gBACf,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,uBAAuB,CAAC,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,GAAoB;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;YAAE,SAAS;QAC1C,MAAM,OAAO,GAAG,CAAuB,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,kBAAkB,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/pipeline/phases/sbom.d.ts

@@ -0,0 +1,45 @@
+/**
+ * SBOM phase — emit CycloneDX 1.5 + SPDX 2.3 from Dependency nodes.
+ *
+ * Responsibilities
+ *   1. Collect every DependencyNode the `dependencies` phase produced.
+ *   2. Emit a CycloneDX 1.5 JSON document to
+ *      `.codehub/sbom.cyclonedx.json` via `@cyclonedx/cyclonedx-library`.
+ *   3. Emit a SPDX 2.3 JSON document (DIY emitter) to
+ *      `.codehub/sbom.spdx.json`.
+ *
+ * Opt-in: the phase is a no-op unless `options.sbom === true` (default
+ * false). This keeps `codehub analyze` quiet for repos where supply-chain
+ * documentation is not part of the flow.
+ *
+ * Determinism
+ *   - Components and packages are emitted in canonical order
+ *     (ecosystem, name, version).
+ *   - When `options.reproducibleSbom` is `true` (default), the CycloneDX
+ *     `metadata.timestamp` is fixed to the Unix epoch, the CycloneDX
+ *     serialNumber is derived from a sha256 hash of the dependency
+ *     fingerprint, and the SPDX `creationInfo.created` is fixed to the
+ *     epoch. The SPDX `documentNamespace` is `urn:uuid:<sha256[0..32]>` of
+ *     the same fingerprint — a stable URN, still globally unique for a
+ *     given dependency set.
+ *   - When `reproducibleSbom === false`, timestamps become `Date.now()`
+ *     (floored to the second) and the namespace becomes a random v4 UUID.
+ *     We still sort components.
+ *
+ * Licensing
+ *   - `@cyclonedx/cyclonedx-library@10.0.0` is Apache-2.0 (bundle-safe for
+ *     our Apache-2.0 host).
+ *   - The SPDX emitter is a ~150 LOC DIY transform of Dependency nodes
+ *     into JSON — no third-party SPDX library is linked.
+ *
+ * No network: PURLs and IDs are synthesised from Dependency fields only.
+ */
+import type { PipelinePhase } from "../types.js";
+export declare const SBOM_PHASE_NAME: "sbom";
+export interface SbomOutput {
+    readonly cyclonedxPath: string | null;
+    readonly spdxPath: string | null;
+    readonly componentCount: number;
+}
+export declare const sbomPhase: PipelinePhase<SbomOutput>;
+//# sourceMappingURL=sbom.d.ts.map

package/dist/pipeline/phases/sbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../../src/pipeline/phases/sbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AASH,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAGlE,eAAO,MAAM,eAAe,EAAG,MAAe,CAAC;AAS/C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,eAAO,MAAM,SAAS,EAAE,aAAa,CAAC,UAAU,CAS/C,CAAC"}

package/dist/pipeline/phases/sbom.js

@@ -0,0 +1,289 @@
+/**
+ * SBOM phase — emit CycloneDX 1.5 + SPDX 2.3 from Dependency nodes.
+ *
+ * Responsibilities
+ *   1. Collect every DependencyNode the `dependencies` phase produced.
+ *   2. Emit a CycloneDX 1.5 JSON document to
+ *      `.codehub/sbom.cyclonedx.json` via `@cyclonedx/cyclonedx-library`.
+ *   3. Emit a SPDX 2.3 JSON document (DIY emitter) to
+ *      `.codehub/sbom.spdx.json`.
+ *
+ * Opt-in: the phase is a no-op unless `options.sbom === true` (default
+ * false). This keeps `codehub analyze` quiet for repos where supply-chain
+ * documentation is not part of the flow.
+ *
+ * Determinism
+ *   - Components and packages are emitted in canonical order
+ *     (ecosystem, name, version).
+ *   - When `options.reproducibleSbom` is `true` (default), the CycloneDX
+ *     `metadata.timestamp` is fixed to the Unix epoch, the CycloneDX
+ *     serialNumber is derived from a sha256 hash of the dependency
+ *     fingerprint, and the SPDX `creationInfo.created` is fixed to the
+ *     epoch. The SPDX `documentNamespace` is `urn:uuid:<sha256[0..32]>` of
+ *     the same fingerprint — a stable URN, still globally unique for a
+ *     given dependency set.
+ *   - When `reproducibleSbom === false`, timestamps become `Date.now()`
+ *     (floored to the second) and the namespace becomes a random v4 UUID.
+ *     We still sort components.
+ *
+ * Licensing
+ *   - `@cyclonedx/cyclonedx-library@10.0.0` is Apache-2.0 (bundle-safe for
+ *     our Apache-2.0 host).
+ *   - The SPDX emitter is a ~150 LOC DIY transform of Dependency nodes
+ *     into JSON — no third-party SPDX library is linked.
+ *
+ * No network: PURLs and IDs are synthesised from Dependency fields only.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir } from "node:fs/promises";
+import path from "node:path";
+import { Enums, Models, Serialize, Spec } from "@cyclonedx/cyclonedx-library";
+import { META_DIR_NAME } from "@opencodehub/storage";
+import wfa from "write-file-atomic";
+import { DEPENDENCIES_PHASE_NAME } from "./dependencies.js";
+export const SBOM_PHASE_NAME = "sbom";
+const CYCLONEDX_FILE = "sbom.cyclonedx.json";
+const SPDX_FILE = "sbom.spdx.json";
+const TOOL_NAME = "opencodehub";
+const TOOL_VERSION = "1.1.0";
+// Stable epoch = 0 (1970-01-01T00:00:00Z) for reproducible builds.
+const REPRODUCIBLE_EPOCH = new Date(0);
+export const sbomPhase = {
+    name: SBOM_PHASE_NAME,
+    deps: [DEPENDENCIES_PHASE_NAME],
+    async run(ctx) {
+        if (ctx.options.sbom !== true) {
+            return { cyclonedxPath: null, spdxPath: null, componentCount: 0 };
+        }
+        return runSbom(ctx);
+    },
+};
+async function runSbom(ctx) {
+    const reproducible = ctx.options.reproducibleSbom !== false;
+    // Collect and sort Dependency nodes. Sorting by (ecosystem, name,
+    // version) is the contract that makes SBOM output byte-identical
+    // across runs; node insertion order is already canonical per the
+    // dependencies phase but we sort again defensively.
+    const deps = [];
+    for (const n of ctx.graph.nodes()) {
+        if (n.kind === "Dependency")
+            deps.push(n);
+    }
+    deps.sort(compareDeps);
+    const repoMeta = path.join(ctx.repoPath, META_DIR_NAME);
+    await mkdir(repoMeta, { recursive: true });
+    const cyclonedxPath = path.join(repoMeta, CYCLONEDX_FILE);
+    const spdxPath = path.join(repoMeta, SPDX_FILE);
+    const fingerprint = fingerprintDeps(deps);
+    const timestamp = reproducible ? REPRODUCIBLE_EPOCH : new Date(floorMs(Date.now()));
+    const cycloneDxJson = emitCycloneDx(deps, {
+        reproducible,
+        timestamp,
+        fingerprint,
+    });
+    await wfa(cyclonedxPath, cycloneDxJson, { encoding: "utf8", fsync: false });
+    const spdxJson = emitSpdx(deps, {
+        reproducible,
+        timestamp,
+        fingerprint,
+    });
+    await wfa(spdxPath, spdxJson, { encoding: "utf8", fsync: false });
+    return {
+        cyclonedxPath,
+        spdxPath,
+        componentCount: deps.length,
+    };
+}
+function compareDeps(a, b) {
+    if (a.ecosystem !== b.ecosystem)
+        return a.ecosystem < b.ecosystem ? -1 : 1;
+    if (a.name !== b.name)
+        return a.name < b.name ? -1 : 1;
+    if (a.version !== b.version)
+        return a.version < b.version ? -1 : 1;
+    return 0;
+}
+function floorMs(ms) {
+    return Math.floor(ms / 1000) * 1000;
+}
+/**
+ * Content-addressed hash of the Dependency set. Used as the CycloneDX
+ * serialNumber and SPDX documentNamespace so byte-identical Dependency
+ * graphs produce byte-identical SBOM documents.
+ */
+function fingerprintDeps(deps) {
+    const h = createHash("sha256");
+    for (const d of deps) {
+        h.update(`${d.ecosystem}\x1f${d.name}\x1f${d.version}\x1f${d.license ?? ""}\x1e`);
+    }
+    return h.digest("hex");
+}
+function emitCycloneDx(deps, emit) {
+    const bom = new Models.Bom();
+    bom.metadata.timestamp = emit.timestamp;
+    // Tool that generated the SBOM. Using `.components.add` rather than the
+    // legacy `.tools.tools` set — `Tools.components` is the modern 1.5+ path.
+    // `bomRef` is set to a stable string so serialized output is byte-stable
+    // across runs; unset, the library generates a random address-backed ref.
+    const toolComponent = new Models.Component(Enums.ComponentType.Application, TOOL_NAME, {
+        version: TOOL_VERSION,
+        bomRef: `tool-${TOOL_NAME}-${TOOL_VERSION}`,
+    });
+    bom.metadata.tools.components.add(toolComponent);
+    // Deterministic serialNumber from the fingerprint. CycloneDX requires
+    // `urn:uuid:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX`; we map the first 32
+    // hex chars of the fingerprint into a v4-shaped UUID string.
+    bom.serialNumber = emit.reproducible
+        ? `urn:uuid:${fingerprintToUuid(emit.fingerprint)}`
+        : `urn:uuid:${randomUUID()}`;
+    for (const d of deps) {
+        const purl = buildPurl(d.ecosystem, d.name, d.version);
+        // Use PURL as the bomRef so two Dependency sets with the same
+        // (ecosystem, name, version) trio yield byte-identical serialised
+        // SBOMs. PURLs are unique by construction of the dependencies phase.
+        const comp = new Models.Component(Enums.ComponentType.Library, d.name, {
+            version: d.version,
+            purl,
+            bomRef: purl,
+        });
+        if (d.license && d.license !== "UNKNOWN") {
+            // Use a NamedLicense so we do not inadvertently emit invalid SPDX
+            // IDs; CycloneDX validators reject unknown IDs on SpdxLicense.
+            comp.licenses.add(new Models.NamedLicense(d.license));
+        }
+        bom.components.add(comp);
+    }
+    const spec = Spec.Spec1dot5;
+    // `@cyclonedx/cyclonedx-library@10` relocated the JSON normalizer factory
+    // from `Serialize.JSON.Factory` to `Serialize.JSON.Normalize.Factory`.
+    const factory = new Serialize.JSON.Normalize.Factory(spec);
+    const serializer = new Serialize.JsonSerializer(factory);
+    // sortLists=true so repository iteration order never affects output.
+    // space=2 so the emitted file is human-reviewable.
+    return serializer.serialize(bom, { sortLists: true, space: 2 });
+}
+/**
+ * Map a 64-hex-char sha256 fingerprint into a UUID-shaped string.
+ * The output is a well-formed UUID (hex + dashes) but is NOT a true RFC
+ * 4122 UUID — callers MUST treat it as an opaque content fingerprint, not
+ * a unique identifier.
+ */
+function fingerprintToUuid(fingerprint) {
+    const hex = fingerprint.slice(0, 32);
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+/**
+ * Build a PURL (https://github.com/package-url/purl-spec).
+ * Centralises ecosystem-specific quirks so both CycloneDX and SPDX
+ * emitters agree.
+ */
+function buildPurl(ecosystem, name, version) {
+    switch (ecosystem) {
+        case "npm":
+            return `pkg:npm/${encodePurlName(name)}@${encodePurlVersion(version)}`;
+        case "pypi":
+            // PURL spec §Known types — PyPI normalises names to lowercase, dashes.
+            return `pkg:pypi/${encodePurlName(name.toLowerCase().replace(/_/g, "-"))}@${encodePurlVersion(version)}`;
+        case "go":
+            // Go module paths may contain `/`. The PURL spec treats the path
+            // as-is inside the name segment but spec requires `/` to mark the
+            // namespace, so embedded slashes stay literal. We do percent-encode
+            // only the few illegal chars (space, `#`, `?`).
+            return `pkg:golang/${encodePurlGoName(name)}@${encodePurlVersion(version)}`;
+        case "cargo":
+            return `pkg:cargo/${encodePurlName(name)}@${encodePurlVersion(version)}`;
+        case "maven": {
+            // Maven names are `groupId:artifactId`.
+            const colon = name.indexOf(":");
+            if (colon === -1) {
+                return `pkg:maven/${encodePurlName(name)}@${encodePurlVersion(version)}`;
+            }
+            const group = name.slice(0, colon);
+            const artifact = name.slice(colon + 1);
+            return `pkg:maven/${encodePurlName(group)}/${encodePurlName(artifact)}@${encodePurlVersion(version)}`;
+        }
+        case "nuget":
+            return `pkg:nuget/${encodePurlName(name)}@${encodePurlVersion(version)}`;
+        default: {
+            // Exhaustiveness check: if a new ecosystem shows up, TypeScript will
+            // flag it at build time and we fall back to a best-effort PURL.
+            const _exhaustive = ecosystem;
+            return `pkg:generic/${encodePurlName(String(_exhaustive ?? name))}@${encodePurlVersion(version)}`;
+        }
+    }
+}
+function encodePurlName(raw) {
+    // PURL spec: name must be percent-encoded except for unreserved chars.
+    // encodeURIComponent handles this correctly for single-segment names.
+    return encodeURIComponent(raw);
+}
+function encodePurlGoName(raw) {
+    // Preserve path separators in Go module paths; encode each segment.
+    return raw
+        .split("/")
+        .map((seg) => encodeURIComponent(seg))
+        .join("/");
+}
+function encodePurlVersion(raw) {
+    return encodeURIComponent(raw);
+}
+function emitSpdx(deps, emit) {
+    const packages = deps.map((d) => ({
+        SPDXID: makeSpdxId(d),
+        name: d.name,
+        versionInfo: d.version,
+        downloadLocation: "NOASSERTION",
+        filesAnalyzed: false,
+        licenseConcluded: "NOASSERTION",
+        licenseDeclared: d.license && d.license !== "UNKNOWN" ? d.license : "NOASSERTION",
+        copyrightText: "NOASSERTION",
+        externalRefs: [
+            {
+                referenceCategory: "PACKAGE-MANAGER",
+                referenceType: "purl",
+                referenceLocator: buildPurl(d.ecosystem, d.name, d.version),
+            },
+        ],
+    }));
+    // Stable sort by SPDXID — the SPDX spec mandates uniqueness but not a
+    // specific order; we pick ID-ascending so diff-based review stays quiet.
+    packages.sort((a, b) => (a.SPDXID < b.SPDXID ? -1 : a.SPDXID > b.SPDXID ? 1 : 0));
+    const doc = {
+        spdxVersion: "SPDX-2.3",
+        dataLicense: "CC0-1.0",
+        SPDXID: "SPDXRef-DOCUMENT",
+        name: "opencodehub-sbom",
+        documentNamespace: emit.reproducible
+            ? `urn:uuid:${fingerprintToUuid(emit.fingerprint)}`
+            : `urn:uuid:${randomUUID()}`,
+        creationInfo: {
+            created: toSpdxTimestamp(emit.timestamp),
+            creators: [`Tool: ${TOOL_NAME}-${TOOL_VERSION}`],
+        },
+        packages,
+    };
+    return `${JSON.stringify(doc, null, 2)}\n`;
+}
+/**
+ * SPDX timestamps are ISO-8601 with second precision: `YYYY-MM-DDThh:mm:ssZ`.
+ */
+function toSpdxTimestamp(d) {
+    // `Date.prototype.toISOString` returns millisecond precision. Strip the
+    // `.xxxZ` tail and replace with `Z`.
+    const iso = d.toISOString();
+    return iso.replace(/\.\d{3}Z$/, "Z");
+}
+/**
+ * SPDXID grammar (§3.2 spec): `SPDXRef-` + [A-Za-z0-9.-]+.
+ * We derive deterministic IDs from (ecosystem, name, version) and replace
+ * every illegal char with `-`. Ambiguity is acceptable because SPDX only
+ * requires IDs be unique within the document, which holds as long as
+ * (ecosystem, name, version) is unique — which is the Dependency phase's
+ * invariant.
+ */
+function makeSpdxId(d) {
+    const raw = `Pkg-${d.ecosystem}-${d.name}-${d.version}`;
+    const safe = raw.replace(/[^A-Za-z0-9.-]/g, "-");
+    return `SPDXRef-${safe}`;
+}
+//# sourceMappingURL=sbom.js.map

package/dist/pipeline/phases/sbom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../../src/pipeline/phases/sbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,GAAG,MAAM,mBAAmB,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAe,CAAC;AAE/C,MAAM,cAAc,GAAG,qBAA8B,CAAC;AACtD,MAAM,SAAS,GAAG,gBAAyB,CAAC;AAC5C,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAQvC,MAAM,CAAC,MAAM,SAAS,GAA8B;IAClD,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,CAAC,uBAAuB,CAAC;IAC/B,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,OAAO,CAAC,GAAoB;IACzC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC;IAE5D,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,oDAAoD;IACpD,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEpF,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,EAAE;QACxC,YAAY;QACZ,SAAS;QACT,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5E,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC9B,YAAY;QACZ,SAAS;QACT,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAElE,OAAO;QACL,aAAa;QACb,QAAQ;QACR,cAAc,EAAE,IAAI,CAAC,MAAM;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAiB,EAAE,CAAiB;IACvD,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAA+B;IACtD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAYD,SAAS,aAAa,CAAC,IAA+B,EAAE,IAAiB;IACvE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7B,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAExC,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE;QACrF,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,QAAQ,SAAS,IAAI,YAAY,EAAE;KAC5C,CAAC,CAAC;IACH,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEjD,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY;QAClC,CAAC,CAAC,YAAY,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;QACnD,CAAC,CAAC,YAAY,UAAU,EAAE,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACvD,8DAA8D;QAC9D,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;YACrE,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI;YACJ,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzC,kEAAkE;YAClE,+DAA+D;YAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;IAC5B,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACzD,qEAAqE;IACrE,mDAAmD;IACnD,OAAO,UAAU,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,SAAsC,EAAE,IAAY,EAAE,OAAe;IACtF,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,WAAW,cAAc,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,KAAK,MAAM;YACT,uEAAuE;YACvE,OAAO,YAAY,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3G,KAAK,IAAI;YACP,iEAAiE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,gDAAgD;YAChD,OAAO,cAAc,gBAAgB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,KAAK,OAAO;YACV,OAAO,aAAa,cAAc,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3E,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,wCAAwC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,OAAO,aAAa,cAAc,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvC,OAAO,aAAa,cAAc,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxG,CAAC;QACD,KAAK,OAAO;YACV,OAAO,aAAa,cAAc,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,CAAC,CAAC;YACR,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,WAAW,GAAU,SAAS,CAAC;YACrC,OAAO,eAAe,cAAc,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpG,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,uEAAuE;IACvE,sEAAsE;IACtE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,oEAAoE;IACpE,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;SACrC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAmCD,SAAS,QAAQ,CAAC,IAA+B,EAAE,IAAiB;IAClE,MAAM,QAAQ,GAAkB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,OAAO;QACtB,gBAAgB,EAAE,aAAa;QAC/B,aAAa,EAAE,KAAK;QACpB,gBAAgB,EAAE,aAAa;QAC/B,eAAe,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;QACjF,aAAa,EAAE,aAAa;QAC5B,YAAY,EAAE;YACZ;gBACE,iBAAiB,EAAE,iBAAiB;gBACpC,aAAa,EAAE,MAAM;gBACrB,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;aAC5D;SACF;KACF,CAAC,CAAC,CAAC;IACJ,sEAAsE;IACtE,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElF,MAAM,GAAG,GAAiB;QACxB,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,kBAAkB;QACxB,iBAAiB,EAAE,IAAI,CAAC,YAAY;YAClC,CAAC,CAAC,YAAY,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;YACnD,CAAC,CAAC,YAAY,UAAU,EAAE,EAAE;QAC9B,YAAY,EAAE;YACZ,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YACxC,QAAQ,EAAE,CAAC,SAAS,SAAS,IAAI,YAAY,EAAE,CAAC;SACjD;QACD,QAAQ;KACT,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,CAAO;IAC9B,wEAAwE;IACxE,qCAAqC;IACrC,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,CAAiB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,WAAW,IAAI,EAAE,CAAC;AAC3B,CAAC"}