@opensip-cli/external-tool-adapter 0.1.15

package/dist/exit-model.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @fileoverview Scanner exit-code interpretation (ADR-0091, Phase-0 decision 4).
+ *
+ * Pure: takes a code + the per-command {@link ScannerExitModel} and returns one
+ * of `'ok' | 'findings' | 'fault'`. NEVER throws — it returns data and the
+ * caller decides whether to raise a typed error.
+ *
+ * The sharp edge is gitleaks (and the disambiguation it forces): gitleaks exits
+ * `1` for BOTH leaks and an internal `log.Fatal`, so an exit in `findings` is
+ * only a findings verdict when the artifact actually parsed. The caller passes
+ * `artifactValid: false` when the report file is missing/garbage, which downgrades
+ * a `findings` code to a `fault`.
+ */
+import type { ScannerExitModel } from './types.js';
+/** The interpreted verdict of a scanner process exit. */
+export type ExitVerdict = 'ok' | 'findings' | 'fault';
+export declare const DEFAULT_EXIT_MODEL: ScannerExitModel;
+/**
+ * Interpret a scanner process exit code against its {@link ScannerExitModel}.
+ *
+ * - code ∈ `ok` ⇒ `'ok'`.
+ * - code ∈ `findings` ⇒ `'findings'`, UNLESS `opts.artifactValid === false`
+ *   (the gitleaks disambiguation: exit 1 + missing/garbage report ⇒ `'fault'`).
+ *   `artifactValid` left `undefined` is treated as valid (stdout scanners, no
+ *   artifact to validate).
+ * - code `>= errorFrom`, or any other unmodeled value, ⇒ `'fault'`.
+ *
+ * `ok` is checked before `findings` so an overlap resolves to the cleaner verdict.
+ */
+export declare function interpretExit(code: number, model: ScannerExitModel, opts?: {
+    readonly artifactValid?: boolean;
+}): ExitVerdict;
+//# sourceMappingURL=exit-model.d.ts.map

package/dist/exit-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-model.d.ts","sourceRoot":"","sources":["../src/exit-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;AAEtD,eAAO,MAAM,kBAAkB,EAAE,gBAA2D,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1C,WAAW,CAMb"}

package/dist/exit-model.js

@@ -0,0 +1,35 @@
+/**
+ * @fileoverview Scanner exit-code interpretation (ADR-0091, Phase-0 decision 4).
+ *
+ * Pure: takes a code + the per-command {@link ScannerExitModel} and returns one
+ * of `'ok' | 'findings' | 'fault'`. NEVER throws — it returns data and the
+ * caller decides whether to raise a typed error.
+ *
+ * The sharp edge is gitleaks (and the disambiguation it forces): gitleaks exits
+ * `1` for BOTH leaks and an internal `log.Fatal`, so an exit in `findings` is
+ * only a findings verdict when the artifact actually parsed. The caller passes
+ * `artifactValid: false` when the report file is missing/garbage, which downgrades
+ * a `findings` code to a `fault`.
+ */
+export const DEFAULT_EXIT_MODEL = { ok: [0], findings: [1], errorFrom: 2 };
+/**
+ * Interpret a scanner process exit code against its {@link ScannerExitModel}.
+ *
+ * - code ∈ `ok` ⇒ `'ok'`.
+ * - code ∈ `findings` ⇒ `'findings'`, UNLESS `opts.artifactValid === false`
+ *   (the gitleaks disambiguation: exit 1 + missing/garbage report ⇒ `'fault'`).
+ *   `artifactValid` left `undefined` is treated as valid (stdout scanners, no
+ *   artifact to validate).
+ * - code `>= errorFrom`, or any other unmodeled value, ⇒ `'fault'`.
+ *
+ * `ok` is checked before `findings` so an overlap resolves to the cleaner verdict.
+ */
+export function interpretExit(code, model, opts) {
+    if (model.ok.includes(code))
+        return 'ok';
+    if (model.findings.includes(code)) {
+        return opts?.artifactValid === false ? 'fault' : 'findings';
+    }
+    return 'fault';
+}
+//# sourceMappingURL=exit-model.js.map

package/dist/exit-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-model.js","sourceRoot":"","sources":["../src/exit-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,CAAC,MAAM,kBAAkB,GAAqB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,KAAuB,EACvB,IAA2C;IAE3C,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,EAAE,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/fingerprint.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @fileoverview The adapter fingerprint strategy map (ADR-0091 §4.5).
+ *
+ * Scanner output is line-volatile (dependency manifests and IaC files shift line
+ * numbers constantly), so the adapter DEFAULT is `message-hash`
+ * (`sha256(filePath\nruleId\nmessage)`) — line-shift tolerant — not the host
+ * default (`ruleId|filePath|line|col`), which would churn baselines on every
+ * unrelated edit. The strategy is stamped WORKER-SIDE when the envelope is built
+ * (the host ratchet only reads `signal.fingerprint`; `synthesizeExternalTool`
+ * drops `fingerprintStrategy`, so the host never reads it off the synthetic Tool).
+ *
+ * Byte-identical hash shape to fitness's `message-hash`; a distinct id keeps the
+ * adapter family's baseline meta self-describing (ADR-0075).
+ */
+import type { FingerprintStrategyChoice } from './types.js';
+import type { FingerprintStrategy } from '@opensip-cli/core';
+/** `sha256(filePath\nruleId\nmessage)` — the adapter default (line-shift tolerant). */
+export declare const messageHashFingerprintStrategy: FingerprintStrategy;
+/**
+ * Resolve a {@link FingerprintStrategyChoice} to a concrete `FingerprintStrategy`.
+ * `'message-hash'` (default) → {@link messageHashFingerprintStrategy};
+ * `'rule-location'` → the host default (`ruleId|filePath|line|col`), for the rare
+ * scanner with stable line anchors.
+ */
+export declare function resolveFingerprintStrategy(choice: FingerprintStrategyChoice | undefined): FingerprintStrategy;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,EAAE,mBAK3C,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,yBAAyB,GAAG,SAAS,GAC5C,mBAAmB,CAErB"}

package/dist/fingerprint.js

@@ -0,0 +1,32 @@
+/**
+ * @fileoverview The adapter fingerprint strategy map (ADR-0091 §4.5).
+ *
+ * Scanner output is line-volatile (dependency manifests and IaC files shift line
+ * numbers constantly), so the adapter DEFAULT is `message-hash`
+ * (`sha256(filePath\nruleId\nmessage)`) — line-shift tolerant — not the host
+ * default (`ruleId|filePath|line|col`), which would churn baselines on every
+ * unrelated edit. The strategy is stamped WORKER-SIDE when the envelope is built
+ * (the host ratchet only reads `signal.fingerprint`; `synthesizeExternalTool`
+ * drops `fingerprintStrategy`, so the host never reads it off the synthetic Tool).
+ *
+ * Byte-identical hash shape to fitness's `message-hash`; a distinct id keeps the
+ * adapter family's baseline meta self-describing (ADR-0075).
+ */
+import { createHash } from 'node:crypto';
+import { defaultFingerprintStrategy, defineFingerprintStrategy } from '@opensip-cli/core';
+/** `sha256(filePath\nruleId\nmessage)` — the adapter default (line-shift tolerant). */
+export const messageHashFingerprintStrategy = defineFingerprintStrategy({
+    id: 'external-tool-adapter.sha256-file-rule-message',
+    version: 1,
+    fingerprint: (s) => createHash('sha256').update(`${s.filePath}\n${s.ruleId}\n${s.message}`).digest('hex'),
+});
+/**
+ * Resolve a {@link FingerprintStrategyChoice} to a concrete `FingerprintStrategy`.
+ * `'message-hash'` (default) → {@link messageHashFingerprintStrategy};
+ * `'rule-location'` → the host default (`ruleId|filePath|line|col`), for the rare
+ * scanner with stable line anchors.
+ */
+export function resolveFingerprintStrategy(choice) {
+    return choice === 'rule-location' ? defaultFingerprintStrategy : messageHashFingerprintStrategy;
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAK1F,uFAAuF;AACvF,MAAM,CAAC,MAAM,8BAA8B,GAAwB,yBAAyB,CAAC;IAC3F,EAAE,EAAE,gDAAgD;IACpD,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;CACxF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA6C;IAE7C,OAAO,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,8BAA8B,CAAC;AAClG,CAAC"}

package/dist/gate-render.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview Pure gate-ratchet presentation for the scan loop (ADR-0036).
+ *
+ * The substrate inherits the host baseline/ratchet plane verbatim (the four
+ * `ToolCliContext` baseline seams over `signal.fingerprint`); these helpers
+ * render the `gate-done` presentation lines for `--gate-save` (baseline written)
+ * and `--gate-compare` (the added/resolved/unchanged diff + verdict). They are
+ * the adapter-family equivalent of fitness's `gate-compare-render` — a separate
+ * pure module so the run loop (the IO-excluded orchestration) stays thin and the
+ * rendering is unit-covered. No `cli`/IO here: input is the `GateCompareResult`
+ * the host compare seam returns; output is plain `string[]` for `cli.render`.
+ */
+import type { GateCompareResult } from '@opensip-cli/core';
+/** The `gate-save` lines: baseline captured into the project store. */
+export declare function renderGateSaveLines(tool: string, signalCount: number): string[];
+/** The full `gate-compare` presentation lines for a {@link GateCompareResult}. */
+export declare function renderGateCompareLines(tool: string, result: GateCompareResult): string[];
+//# sourceMappingURL=gate-render.d.ts.map

package/dist/gate-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-render.d.ts","sourceRoot":"","sources":["../src/gate-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAE/E;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAKxF"}

package/dist/gate-render.js

@@ -0,0 +1,25 @@
+/**
+ * @fileoverview Pure gate-ratchet presentation for the scan loop (ADR-0036).
+ *
+ * The substrate inherits the host baseline/ratchet plane verbatim (the four
+ * `ToolCliContext` baseline seams over `signal.fingerprint`); these helpers
+ * render the `gate-done` presentation lines for `--gate-save` (baseline written)
+ * and `--gate-compare` (the added/resolved/unchanged diff + verdict). They are
+ * the adapter-family equivalent of fitness's `gate-compare-render` — a separate
+ * pure module so the run loop (the IO-excluded orchestration) stays thin and the
+ * rendering is unit-covered. No `cli`/IO here: input is the `GateCompareResult`
+ * the host compare seam returns; output is plain `string[]` for `cli.render`.
+ */
+import { renderGateCompareLines as renderCoreGateCompareLines } from '@opensip-cli/core';
+/** The `gate-save` lines: baseline captured into the project store. */
+export function renderGateSaveLines(tool, signalCount) {
+    return [`${tool}: baseline saved (project SQLite store)`, `  ${signalCount} finding(s) recorded`];
+}
+/** The full `gate-compare` presentation lines for a {@link GateCompareResult}. */
+export function renderGateCompareLines(tool, result) {
+    return renderCoreGateCompareLines(result, {
+        title: `${tool} gate compare`,
+        singularNoun: 'finding',
+    });
+}
+//# sourceMappingURL=gate-render.js.map

package/dist/gate-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-render.js","sourceRoot":"","sources":["../src/gate-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,IAAI,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAIzF,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAmB;IACnE,OAAO,CAAC,GAAG,IAAI,yCAAyC,EAAE,KAAK,WAAW,sBAAsB,CAAC,CAAC;AACpG,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAAyB;IAC5E,OAAO,0BAA0B,CAAC,MAAM,EAAE;QACxC,KAAK,EAAE,GAAG,IAAI,eAAe;QAC7B,YAAY,EAAE,SAAS;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @opensip-cli/external-tool-adapter — substrate for External Tool Adapters.
+ *
+ * Wrap a user-installed CLI scanner (gitleaks/osv-scanner/trivy/…) as an ordinary
+ * opensip-cli `Tool`: `defineExternalToolAdapter(spec)`. The substrate owns binary
+ * resolution, the run loop (resolve → execFile → ingest → normalize → persist via
+ * the host artifact seam), the shared SARIF/JSON ingest + severity mapping, the
+ * `doctor`/`version` commands, secret redaction, and provenance. ADR-0090/0091/0092.
+ */
+export { defineExternalToolAdapter } from './define-external-tool-adapter.js';
+export type { AdapterProvenance, AdapterRunContext, BinaryResolutionLayer, BinarySpec, ExternalCommandSpec, ExternalToolAdapterSpec, FingerprintStrategyChoice, ManifestCommandShell, NetworkPosture, ParsedScannerOutput, ResolvedBinary, ScannerExitModel, ScannerOutputKind, } from './types.js';
+export { ingestSarif } from './ingest-sarif.js';
+export type { IngestSarifOptions, SarifDriver, SarifLocation, SarifLog, SarifMessage, SarifPhysicalLocation, SarifReportingDescriptor, SarifResult, SarifRun, SarifTool, } from './ingest-sarif.js';
+export { asArray, asObject, getNumber, getString, navigate, safeParseJson } from './ingest-json.js';
+export type { JsonParseResult } from './ingest-json.js';
+export { cvssToSeverity, parseCvss, sarifLevelToSeverity, withNativeSeverity, } from './severity-map.js';
+export type { SarifLevel } from './severity-map.js';
+export { DEFAULT_EXIT_MODEL, interpretExit } from './exit-model.js';
+export type { ExitVerdict } from './exit-model.js';
+export { defaultBinaryEnvVar, resolveBinary } from './binary-resolver.js';
+export type { BinaryResolution, BinaryResolveDeps, ResolveBinaryInput } from './binary-resolver.js';
+export { messageHashFingerprintStrategy, resolveFingerprintStrategy } from './fingerprint.js';
+export { stampProvenance, stampProvenanceAll } from './provenance.js';
+export { redactSecret, secretHash } from './redact.js';
+export { buildAdapterSessionPayload } from './session-payload.js';
+export type { AdapterFindingSeverity, AdapterSessionCheck, AdapterSessionFinding, AdapterSessionPayload, } from './session-payload.js';
+export { resolveScannerArtifactPath } from './artifact-path.js';
+export type { ArtifactPathScope } from './artifact-path.js';
+export { deriveAdapterManifestCommands } from './manifest-commands.js';
+export { adapterConfigManifestOf, adapterNetworkOf, deriveAdapterConfigManifest, deriveAdapterManifestRequires, } from './adapter-manifest.js';
+export type { AdapterToolMarkers } from './adapter-manifest.js';
+export { defaultAdapterConfig, defaultAdapterConfigManifest, defaultAdapterConfigSchema, } from './adapter-config.js';
+export type { AdapterConfigContribution } from './adapter-config.js';
+export { compareVersion } from './doctor-command.js';
+export type { AdapterDoctorReport, VersionStatus } from './doctor-command.js';
+export type { AdapterVersionReport } from './version-command.js';
+export { normalizedSignalShape, runAcceptanceCase } from './acceptance-harness.js';
+export type { AcceptanceFixture, AcceptanceResult, SignalShape } from './acceptance-harness.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,QAAQ,EACR,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,YAAY,EACV,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC9E,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGjE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACnF,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -0,0 +1,35 @@
+/**
+ * @opensip-cli/external-tool-adapter — substrate for External Tool Adapters.
+ *
+ * Wrap a user-installed CLI scanner (gitleaks/osv-scanner/trivy/…) as an ordinary
+ * opensip-cli `Tool`: `defineExternalToolAdapter(spec)`. The substrate owns binary
+ * resolution, the run loop (resolve → execFile → ingest → normalize → persist via
+ * the host artifact seam), the shared SARIF/JSON ingest + severity mapping, the
+ * `doctor`/`version` commands, secret redaction, and provenance. ADR-0090/0091/0092.
+ */
+// ── The factory + author surface ────────────────────────────────────────────
+export { defineExternalToolAdapter } from './define-external-tool-adapter.js';
+// ── Ingest + normalization ──────────────────────────────────────────────────
+export { ingestSarif } from './ingest-sarif.js';
+export { asArray, asObject, getNumber, getString, navigate, safeParseJson } from './ingest-json.js';
+export { cvssToSeverity, parseCvss, sarifLevelToSeverity, withNativeSeverity, } from './severity-map.js';
+// ── Exit modeling ───────────────────────────────────────────────────────────
+export { DEFAULT_EXIT_MODEL, interpretExit } from './exit-model.js';
+// ── Binary resolution + provenance + fingerprints ───────────────────────────
+export { defaultBinaryEnvVar, resolveBinary } from './binary-resolver.js';
+export { messageHashFingerprintStrategy, resolveFingerprintStrategy } from './fingerprint.js';
+export { stampProvenance, stampProvenanceAll } from './provenance.js';
+export { redactSecret, secretHash } from './redact.js';
+// ── Session payload (tool-owned, dashboard-shaped detail) ────────────────────
+export { buildAdapterSessionPayload } from './session-payload.js';
+// ── Artifact path + manifest parity ─────────────────────────────────────────
+export { resolveScannerArtifactPath } from './artifact-path.js';
+export { deriveAdapterManifestCommands } from './manifest-commands.js';
+export { adapterConfigManifestOf, adapterNetworkOf, deriveAdapterConfigManifest, deriveAdapterManifestRequires, } from './adapter-manifest.js';
+// ── Config namespace claim (binary pin + verdict keys) ───────────────────────
+export { defaultAdapterConfig, defaultAdapterConfigManifest, defaultAdapterConfigSchema, } from './adapter-config.js';
+// ── doctor / version reports ────────────────────────────────────────────────
+export { compareVersion } from './doctor-command.js';
+// ── Acceptance harness ──────────────────────────────────────────────────────
+export { normalizedSignalShape, runAcceptanceCase } from './acceptance-harness.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,+EAA+E;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAiB9E,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAahD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEpG,OAAO,EACL,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,+EAA+E;AAC/E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGpE,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1E,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEvD,gFAAgF;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAQlE,+EAA+E;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAG/B,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD,+EAA+E;AAC/E,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/ingest-json.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @fileoverview Small reusable, defensive JSON navigation helpers (ADR-0091).
+ *
+ * The per-scanner JSON `parse` lives in each adapter (each scanner's JSON shape
+ * differs); these are the shared, total accessors a parser uses to walk a
+ * foreign, possibly-malformed document without throwing. All pure.
+ */
+/** The result of a defensive JSON parse — never throws. */
+export type JsonParseResult = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/** Parse JSON, returning a Result instead of throwing on malformed input. */
+export declare function safeParseJson(raw: string): JsonParseResult;
+/** Narrow to a plain object (not an array, not null), else `undefined`. */
+export declare function asObject(value: unknown): Record<string, unknown> | undefined;
+/** Narrow to an array, else `undefined`. */
+export declare function asArray(value: unknown): readonly unknown[] | undefined;
+/** Read a string property, else `undefined`. */
+export declare function getString(obj: unknown, key: string): string | undefined;
+/** Read a finite-number property (coercing a numeric string), else `undefined`. */
+export declare function getNumber(obj: unknown, key: string): number | undefined;
+/**
+ * Walk a dotted-ish path of object keys (`navigate(doc, ['results', '0', 'id'])`),
+ * descending objects and arrays (numeric segments index arrays). Returns
+ * `undefined` on the first missing/typed-wrong step — never throws.
+ */
+export declare function navigate(root: unknown, path: readonly string[]): unknown;
+//# sourceMappingURL=ingest-json.d.ts.map

package/dist/ingest-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-json.d.ts","sourceRoot":"","sources":["../src/ingest-json.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAM1D;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAI5E;AAED,4CAA4C;AAC5C,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,OAAO,EAAE,GAAG,SAAS,CAEtE;AAED,gDAAgD;AAChD,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvE;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASvE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAaxE"}

package/dist/ingest-json.js

@@ -0,0 +1,66 @@
+/**
+ * @fileoverview Small reusable, defensive JSON navigation helpers (ADR-0091).
+ *
+ * The per-scanner JSON `parse` lives in each adapter (each scanner's JSON shape
+ * differs); these are the shared, total accessors a parser uses to walk a
+ * foreign, possibly-malformed document without throwing. All pure.
+ */
+/** Parse JSON, returning a Result instead of throwing on malformed input. */
+export function safeParseJson(raw) {
+    try {
+        return { ok: true, value: JSON.parse(raw) };
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+/** Narrow to a plain object (not an array, not null), else `undefined`. */
+export function asObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** Narrow to an array, else `undefined`. */
+export function asArray(value) {
+    return Array.isArray(value) ? value : undefined;
+}
+/** Read a string property, else `undefined`. */
+export function getString(obj, key) {
+    const record = asObject(obj);
+    const value = record?.[key];
+    return typeof value === 'string' ? value : undefined;
+}
+/** Read a finite-number property (coercing a numeric string), else `undefined`. */
+export function getNumber(obj, key) {
+    const record = asObject(obj);
+    const value = record?.[key];
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : undefined;
+    if (typeof value === 'string') {
+        const parsed = Number.parseFloat(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    return undefined;
+}
+/**
+ * Walk a dotted-ish path of object keys (`navigate(doc, ['results', '0', 'id'])`),
+ * descending objects and arrays (numeric segments index arrays). Returns
+ * `undefined` on the first missing/typed-wrong step — never throws.
+ */
+export function navigate(root, path) {
+    let current = root;
+    for (const segment of path) {
+        if (current === null || current === undefined)
+            return undefined;
+        if (Array.isArray(current)) {
+            const index = Number.parseInt(segment, 10);
+            current = Number.isInteger(index) ? current[index] : undefined;
+        }
+        else {
+            const record = asObject(current);
+            current = record?.[segment];
+        }
+    }
+    return current;
+}
+//# sourceMappingURL=ingest-json.js.map

package/dist/ingest-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-json.js","sourceRoot":"","sources":["../src/ingest-json.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,SAAS,CAAC,GAAY,EAAE,GAAW;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,GAAY,EAAE,GAAW;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,IAAuB;IAC7D,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/ingest-sarif.d.ts

@@ -0,0 +1,113 @@
+/**
+ * @fileoverview The single, substrate-LOCAL SARIF ingest (ADR-0091).
+ *
+ * This is the ONLY SARIF read/parse path in the workspace (enforced by the
+ * `single-sarif-ingest` dependency-cruiser rule). The OpenSIP SARIF *writer*'s
+ * shape types are file-private to `@opensip-cli/output` (a layer-3 peer the
+ * substrate may not import) and deliberately minimal — so a foreign-scanner
+ * ingest defines its OWN defensive INPUT types here: it must read
+ * `result.fingerprints`/`partialFingerprints`/`guid`, `properties`, multiple
+ * `runs`/`locations`, `ruleIndex`→`rules` joins, and
+ * `properties["security-severity"]`.
+ *
+ * Severity recovery is the core job: the writer collapses BOTH `critical` and
+ * `high` → SARIF `error`, so a level-only inverse is ambiguous. `ingestSarif`
+ * reads the CVSS `security-severity` number (off the rule descriptor, falling
+ * back to the result) and applies the FIRST/NVD v3 bands BEFORE falling back to
+ * `level`. The native level/severity are preserved on `Signal.metadata`.
+ *
+ * Message stability is the second job: real scanners (Trivy) put a VERBOSE,
+ * version-volatile block in `result.message.text` (e.g. a `Package:/Installed
+ * Version:/Severity:/Fixed Version:/Link:` listing). Surfacing that as
+ * `Signal.message` would also feed it into the `message-hash` fingerprint, so the
+ * baseline would churn on every dependency bump — defeating the whole point of a
+ * line-shift-tolerant hash. So `ingestSarif` prefers the STABLE rule title
+ * (`driver.rules[ruleIndex].shortDescription.text`) for `Signal.message` when
+ * present and stashes the verbose `result.message.text` on `metadata.detail`. It
+ * falls back to `result.message.text` only when no rule/shortDescription exists.
+ */
+import type { Signal } from '@opensip-cli/core';
+/** A SARIF 2.1.0 log: the top-level document a foreign scanner emits (one or more runs). */
+export interface SarifLog {
+    readonly version?: string;
+    readonly $schema?: string;
+    readonly runs?: readonly SarifRun[];
+}
+/** One analysis run within a {@link SarifLog} — a tool plus its results. */
+export interface SarifRun {
+    readonly tool?: SarifTool;
+    readonly results?: readonly SarifResult[];
+}
+/** The tool component of a {@link SarifRun}; carries the `driver` (the scanner). */
+export interface SarifTool {
+    readonly driver?: SarifDriver;
+}
+/** The scanner driver: its identity and the rule catalog `result.ruleIndex` joins against. */
+export interface SarifDriver {
+    readonly name?: string;
+    readonly version?: string;
+    readonly informationUri?: string;
+    readonly rules?: readonly SarifReportingDescriptor[];
+}
+/** A rule descriptor in `driver.rules[]` — `properties["security-severity"]` carries the CVSS. */
+export interface SarifReportingDescriptor {
+    readonly id?: string;
+    readonly name?: string;
+    readonly shortDescription?: SarifMessage;
+    readonly fullDescription?: SarifMessage;
+    readonly helpUri?: string;
+    readonly defaultConfiguration?: {
+        readonly level?: string;
+    };
+    readonly properties?: Readonly<Record<string, unknown>>;
+}
+/** A single finding: rule id/index, coarse `level`, message, locations, and native fingerprints. */
+export interface SarifResult {
+    readonly ruleId?: string;
+    readonly ruleIndex?: number;
+    readonly level?: string;
+    readonly message?: SarifMessage;
+    readonly locations?: readonly SarifLocation[];
+    readonly fingerprints?: Readonly<Record<string, unknown>>;
+    readonly partialFingerprints?: Readonly<Record<string, unknown>>;
+    readonly guid?: string;
+    readonly helpUri?: string;
+    readonly properties?: Readonly<Record<string, unknown>>;
+}
+/** A result location — wraps the {@link SarifPhysicalLocation} (file + region). */
+export interface SarifLocation {
+    readonly physicalLocation?: SarifPhysicalLocation;
+}
+/** The physical location of a finding: an artifact (file) URI and an optional source region. */
+export interface SarifPhysicalLocation {
+    readonly artifactLocation?: {
+        readonly uri?: string;
+        readonly uriBaseId?: string;
+    };
+    readonly region?: {
+        readonly startLine?: number;
+        readonly startColumn?: number;
+        readonly endLine?: number;
+    };
+}
+/** A SARIF message object — the `text` is the human-readable finding description. */
+export interface SarifMessage {
+    readonly text?: string;
+}
+/** Options for {@link ingestSarif}. */
+export interface IngestSarifOptions {
+    /** `Signal.source` for every produced signal (defaults to the driver name, lowercased, or `'sarif'`). */
+    readonly source?: string;
+    /** `Signal.category` (defaults to `'security'` — these are security scanners). */
+    readonly category?: string;
+}
+/**
+ * Ingest a SARIF 2.1.0 log into normalized {@link Signal}s. Defensive over
+ * foreign output: tolerates multiple runs, missing rules/locations, and
+ * `ruleIndex` joins. Severity is recovered from CVSS `security-severity` before
+ * `level` (ADR-0091); native fingerprints/level/severity are preserved on
+ * `metadata`. `Signal.fingerprint` is left unstamped — the host ratchet's
+ * `message-hash` strategy stamps it worker-side at envelope construction.
+ */
+export declare function ingestSarif(sarif: SarifLog, options?: IngestSarifOptions): readonly Signal[];
+//# sourceMappingURL=ingest-sarif.d.ts.map

package/dist/ingest-sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-sarif.d.ts","sourceRoot":"","sources":["../src/ingest-sarif.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAkB,MAAM,mBAAmB,CAAC;AAIhE,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED,4EAA4E;AAC5E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACtD;AAED,kGAAkG;AAClG,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,YAAY,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED,oGAAoG;AACpG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CACnD;AAED,gGAAgG;AAChG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,yGAAyG;IACzG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAqJD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,MAAM,EAAE,CAY5F"}