@owasp-aghast/aghast 0.8.4 → 0.9.0-rc.1

package/dist/formatters/markdown-formatter.js

@@ -0,0 +1,557 @@
+/**
+ * Markdown output formatter — produces a human-readable security report.
+ * See SPECIFICATION.md Appendix E.3.1.
+ *
+ * Sections (in order):
+ *   1. Header                — Title, date, AI provider/model, repository info
+ *   2. Executive Summary     — One-paragraph overview of the scan outcome
+ *   3. Summary Table         — All checks with PASS/FAIL/FLAG/ERROR status
+ *   4. Detailed Findings     — Failed checks with descriptions, snippets, recs
+ *   5. Flagged Items         — Checks needing human review (only when present)
+ *   6. Errors                — Checks with ERROR status (only when present)
+ *   7. Statistics            — Totals for the scan
+ *   8. CI Metadata           — Job URL / branch / pipeline info (only when set)
+ */
+/** File-extension to fenced-code-block language tag. Default is `text`. */
+const EXTENSION_LANGUAGE_MAP = {
+    ts: 'ts',
+    tsx: 'tsx',
+    js: 'js',
+    jsx: 'jsx',
+    mjs: 'js',
+    cjs: 'js',
+    py: 'python',
+    rb: 'ruby',
+    go: 'go',
+    rs: 'rust',
+    java: 'java',
+    kt: 'kotlin',
+    scala: 'scala',
+    cs: 'csharp',
+    c: 'c',
+    h: 'c',
+    cpp: 'cpp',
+    cc: 'cpp',
+    hpp: 'cpp',
+    php: 'php',
+    swift: 'swift',
+    sh: 'bash',
+    bash: 'bash',
+    zsh: 'bash',
+    ps1: 'powershell',
+    yml: 'yaml',
+    yaml: 'yaml',
+    json: 'json',
+    toml: 'toml',
+    xml: 'xml',
+    html: 'html',
+    htm: 'html',
+    css: 'css',
+    scss: 'scss',
+    sql: 'sql',
+    md: 'markdown',
+};
+/** Resolves the fenced-code-block language tag from a file path. */
+export function languageForFile(filePath) {
+    const lastDot = filePath.lastIndexOf('.');
+    if (lastDot < 0 || lastDot === filePath.length - 1)
+        return 'text';
+    const ext = filePath.slice(lastDot + 1).toLowerCase();
+    return EXTENSION_LANGUAGE_MAP[ext] ?? 'text';
+}
+/** Returns the longest backtick run in `code` so we can pick a longer fence. */
+function chooseFence(code) {
+    // Fast path: no backticks in body → standard 3-backtick fence.
+    if (code.indexOf('`') === -1)
+        return '```';
+    let longest = 0;
+    const re = /`+/g;
+    let match;
+    while ((match = re.exec(code)) !== null) {
+        if (match[0].length > longest)
+            longest = match[0].length;
+    }
+    return '`'.repeat(Math.max(3, longest + 1));
+}
+/** Wraps code in a fenced block with a language tag, escaping nested fences safely. */
+export function fencedCode(code, language) {
+    const fence = chooseFence(code);
+    // Strip a single trailing newline (LF or CRLF) so we control spacing inside
+    // the block. Without CRLF handling, Windows-line-ending snippets would leave
+    // a stray \r before the closing fence.
+    const body = code.replace(/\r?\n$/, '');
+    return `${fence}${language}\n${body}\n${fence}`;
+}
+/**
+ * Wraps `value` in a backtick fence long enough to survive any backticks
+ * already inside `value`. Per CommonMark, an inline-code span uses a backtick
+ * run of length N around a body that contains no run of length N — minimum
+ * length 1 (unlike fenced code blocks, which require minimum 3). Pad with a
+ * leading/trailing space if the body itself starts or ends with a backtick.
+ * Newlines are collapsed to spaces because inline-code spans must be
+ * single-line (and table cells must not contain raw newlines).
+ */
+export function inlineCode(value) {
+    // CommonMark/GFM treat a bare CR (not just CRLF/LF) as a line ending — see
+    // escapeMarkdownText/escapeInlineText/escapeTableCell's identical fix — so
+    // collapse it here too. `value` is often AI-response-controlled (e.g.
+    // `issue.file`); an uncollapsed bare `\r` would split the surrounding
+    // Markdown into two physical lines before the backtick span can close,
+    // letting a leading `#` on the second line render as a real heading.
+    const flat = value.replace(/\r\n?|\n/g, ' ');
+    // Compute longest backtick run inline (don't reuse chooseFence — its
+    // minimum is 3 for block fences, but inline-code minimum is 1).
+    let longest = 0;
+    const re = /`+/g;
+    let match;
+    while ((match = re.exec(flat)) !== null) {
+        if (match[0].length > longest)
+            longest = match[0].length;
+    }
+    const fence = '`'.repeat(longest + 1);
+    const padStart = flat.startsWith('`') ? ' ' : '';
+    const padEnd = flat.endsWith('`') ? ' ' : '';
+    return `${fence}${padStart}${flat}${padEnd}${fence}`;
+}
+/**
+ * Escapes characters so a string is safe inside a Markdown table cell.
+ *
+ * Order matters:
+ *   1. Backslashes first, so subsequent `\|` insertions aren't mis-parsed
+ *      (input `a\|b` would otherwise become `a\\|b`, which renders as a
+ *      literal `\` followed by an UNESCAPED `|` — splitting the cell).
+ *   2. Pipes next.
+ *   3. Backticks (escape so they don't open inline-code spans inside the
+ *      cell — a single backtick in a `checkName` would otherwise bleed
+ *      across columns).
+ *   4. Collapse newlines to spaces — table cells must be single-line.
+ */
+function escapeTableCell(value) {
+    return value
+        .replace(/\\/g, '\\\\')
+        .replace(/\|/g, '\\|')
+        .replace(/`/g, '\\`')
+        // CommonMark/GFM treat a bare CR (not just CRLF/LF) as a line ending — see
+        // escapeMarkdownText's identical fix — so collapse it here too, not just
+        // `\r?\n`, or a lone `\r` would survive uncollapsed into a multi-line cell.
+        .replace(/\r\n?|\n/g, ' ');
+}
+/**
+ * Escapes AI-authored free text (issue `description` / `recommendation`) for
+ * safe rendering as a Markdown *block*.
+ *
+ * Threat model: these fields come from the LLM's analysis of the scanned
+ * repository, whose source can contain attacker-crafted strings. Rendered raw
+ * they can inject active HTML that executes when the report is viewed on GitHub,
+ * a wiki, or any Markdown viewer permitting inline HTML (`<script>`,
+ * `<img onerror=...>`), and can break the report's own structure (table cells,
+ * headings, code fences, lists, blockquotes). The HTML formatter already defends
+ * the same fields via `escapeHtml`; this is the Markdown-side equivalent.
+ *
+ * Unlike {@link escapeInlineText}, newlines are *preserved* — these are prose
+ * paragraphs, not single-line bullets — so the escaping is applied per line:
+ *   1. Inline pass: backslash-escape every character that can open inline
+ *      formatting or a raw HTML tag (`\` first so we don't re-escape our own
+ *      escapes). Escaping `<` is what neutralises the inline-HTML vector — per
+ *      CommonMark/GFM, `\<script>` renders as literal text.
+ *   2. Block pass: backslash-escape a leading marker (after optional
+ *      indentation) that would open a block construct — ATX heading (`#`),
+ *      list/thematic-break (`-`/`+`), setext underline (`=`), or an ordered-list
+ *      marker (`1.` / `1)`). Blockquote (`>`) and fences (`` ` ``/`~`) are
+ *      already handled by the inline pass.
+ */
+export function escapeMarkdownText(value) {
+    return value
+        // CommonMark/GFM treat CRLF, LF, *and a bare CR* as line endings — fold
+        // all three to `\n` before splitting, or a lone `\r` would slip through
+        // unsplit and its trailing content would bypass the block-marker escapes
+        // below despite a compliant renderer treating it as a new line.
+        .replace(/\r\n?/g, '\n')
+        .split('\n')
+        .map((line) => {
+        const inline = line
+            .replace(/\\/g, '\\\\')
+            .replace(/[`*_[\]<>|~]/g, (m) => `\\${m}`);
+        return inline
+            .replace(/^(\s*)([#=+-])/, '$1\\$2')
+            .replace(/^(\s*)(\d+)([.)])/, '$1$2\\$3');
+    })
+        .join('\n');
+}
+/** Sentence-case label for a status (e.g. `PASS` → `Passed`). */
+function statusLabel(status) {
+    switch (status) {
+        case 'PASS': return 'Passed';
+        case 'FAIL': return 'Failed';
+        case 'FLAG': return 'Flagged';
+        case 'ERROR': return 'Error';
+    }
+}
+function renderHeader(results) {
+    const lines = [];
+    lines.push('# Security Scan Report');
+    lines.push('');
+    lines.push(`- **Scan ID:** ${inlineCode(results.scanId)}`);
+    lines.push(`- **Date:** ${results.timestamp}`);
+    lines.push(`- **aghast version:** ${results.version}`);
+    const models = results.agentProvider.models.length > 0
+        ? results.agentProvider.models.join(', ')
+        : '(none)';
+    lines.push(`- **Agent provider:** ${results.agentProvider.name} (model: ${models})`);
+    lines.push('');
+    lines.push(...renderRepository(results.repository));
+    return lines.join('\n');
+}
+function renderRepository(repo) {
+    const lines = [];
+    lines.push('## Repository');
+    lines.push('');
+    lines.push(`- **Path:** ${inlineCode(repo.path)}`);
+    // Wrap the remote URL in `<...>` (CommonMark autolink syntax) so it
+    // remains clickable while the angle-bracket form prevents underscores or
+    // other markdown-special characters in the URL from being interpreted as
+    // formatting. If the URL itself contains `<` or `>` (illegal per RFC 3986
+    // but possible in pathological inputs) we fall back to inline-code so the
+    // angle-bracket pair stays balanced.
+    if (repo.remoteUrl) {
+        const url = repo.remoteUrl;
+        const safeAutoLink = !url.includes('<') && !url.includes('>') && !/\s/.test(url);
+        lines.push(`- **Remote URL:** ${safeAutoLink ? `<${url}>` : inlineCode(url)}`);
+    }
+    if (repo.branch)
+        lines.push(`- **Branch:** ${inlineCode(repo.branch)}`);
+    if (repo.commit)
+        lines.push(`- **Commit:** ${inlineCode(repo.commit)}`);
+    lines.push(`- **Git repository:** ${repo.isGitRepository ? 'yes' : 'no'}`);
+    return lines;
+}
+function renderExecutiveSummary(results) {
+    const { summary } = results;
+    let outcome;
+    if (summary.totalChecks === 0) {
+        outcome = 'No checks were applicable to this repository.';
+    }
+    else if (summary.failedChecks > 0 && summary.errorChecks > 0) {
+        outcome = `The scan found **${summary.failedChecks} failing** check(s) with a total of **${summary.totalIssues} issue(s)**, and **${summary.errorChecks}** check(s) errored before completing.`;
+    }
+    else if (summary.failedChecks > 0) {
+        outcome = `The scan found **${summary.failedChecks} failing** check(s) with a total of **${summary.totalIssues} issue(s)** that require attention.`;
+    }
+    else if (summary.errorChecks > 0) {
+        outcome = `The scan completed with **${summary.errorChecks}** check(s) in an error state and no failing checks.`;
+    }
+    else if (summary.flaggedChecks > 0) {
+        outcome = `The scan completed with **${summary.flaggedChecks}** check(s) flagged for human review and no failing checks.`;
+    }
+    else {
+        outcome = `All ${summary.totalChecks} check(s) passed with no issues detected.`;
+    }
+    return `## Executive Summary\n\n${outcome}`;
+}
+function renderSummaryTable(results) {
+    const lines = [];
+    lines.push('## Summary Table');
+    lines.push('');
+    if (results.checks.length === 0) {
+        lines.push('_No checks were executed._');
+        return lines.join('\n');
+    }
+    lines.push('| Check ID | Name | Status | Issues | Time (ms) |');
+    lines.push('| --- | --- | --- | --- | --- |');
+    for (const check of results.checks) {
+        lines.push(`| ${inlineCode(check.checkId)} `
+            + `| ${escapeTableCell(check.checkName)} `
+            + `| ${check.status} `
+            + `| ${check.issuesFound} `
+            + `| ${check.executionTime} |`);
+    }
+    return lines.join('\n');
+}
+function renderDetailedFindings(results) {
+    const failingChecks = results.checks.filter((c) => c.status === 'FAIL');
+    const lines = [];
+    lines.push('## Detailed Findings');
+    lines.push('');
+    if (failingChecks.length === 0) {
+        lines.push('_No failing checks._');
+        return lines.join('\n');
+    }
+    for (const check of failingChecks) {
+        lines.push(`### ${check.checkName} (${inlineCode(check.checkId)})`);
+        lines.push('');
+        lines.push(`- **Status:** ${statusLabel(check.status)}`);
+        lines.push(`- **Issues found:** ${check.issuesFound}`);
+        if (typeof check.targetsAnalyzed === 'number') {
+            lines.push(`- **Targets analyzed:** ${check.targetsAnalyzed}`);
+        }
+        lines.push('');
+        const issues = results.issues.filter((i) => i.checkId === check.checkId);
+        if (issues.length === 0) {
+            lines.push('_No issue details were attached to this check._');
+            lines.push('');
+            continue;
+        }
+        issues.forEach((issue, idx) => {
+            lines.push(...renderIssue(issue, idx + 1));
+            lines.push('');
+        });
+    }
+    // Trim trailing blank line so section terminates cleanly.
+    while (lines.length > 0 && lines[lines.length - 1] === '')
+        lines.pop();
+    return lines.join('\n');
+}
+function renderIssue(issue, ordinal) {
+    const lines = [];
+    // Note: issue ordinal restarts at 1 inside each failing check. The H4
+    // headings are scoped under their check's H3 parent so the structure is
+    // clear when reading top-to-bottom; consumers that flatten H4s (e.g. TOC
+    // generators) will see duplicate "Issue 1" anchors and should disambiguate
+    // by including the parent H3 in the anchor.
+    lines.push(`#### Issue ${ordinal}: ${inlineCode(issue.file)} lines ${issue.startLine}-${issue.endLine}`);
+    lines.push('');
+    if (issue.severity)
+        lines.push(`- **Severity:** ${issue.severity}`);
+    if (issue.confidence)
+        lines.push(`- **Confidence:** ${issue.confidence}`);
+    lines.push(`- **Location:** ${inlineCode(issue.file)}:${issue.startLine}-${issue.endLine}`);
+    lines.push('');
+    lines.push('**Description:**');
+    lines.push('');
+    // AI-authored free text — escape so crafted repo content can't inject active
+    // HTML or break the report's Markdown structure (see escapeMarkdownText).
+    lines.push(escapeMarkdownText(issue.description));
+    if (issue.codeSnippet) {
+        lines.push('');
+        lines.push('**Code:**');
+        lines.push('');
+        lines.push(fencedCode(issue.codeSnippet, languageForFile(issue.file)));
+    }
+    if (issue.dataFlow && issue.dataFlow.length > 0) {
+        lines.push('');
+        lines.push('**Data flow:**');
+        lines.push('');
+        issue.dataFlow.forEach((step, i) => {
+            lines.push(`${i + 1}. ${inlineCode(step.file)}:${step.lineNumber} - ${step.label}`);
+        });
+    }
+    if (issue.recommendation) {
+        lines.push('');
+        lines.push('**Recommendation:**');
+        lines.push('');
+        // Same AI-authored free text as description — escape it identically.
+        lines.push(escapeMarkdownText(issue.recommendation));
+    }
+    if (issue.judge) {
+        lines.push('');
+        lines.push('**Judge verdict:**');
+        lines.push('');
+        const confidence = `${Math.round(issue.judge.confidence * 100)}% confidence`;
+        lines.push(`- **Verdict:** ${issue.judge.verdict} (${confidence})`);
+        lines.push(`- **Model:** ${inlineCode(issue.judge.model)}`);
+        if (issue.judge.rationale) {
+            // Rationale is model-authored free text; escape it so a stray backtick or
+            // pipe cannot break out of the bullet and corrupt the rest of the report.
+            lines.push(`- **Rationale:** ${escapeInlineText(issue.judge.rationale)}`);
+        }
+    }
+    return lines;
+}
+function renderFlaggedItems(results) {
+    const flagged = results.checks.filter((c) => c.status === 'FLAG');
+    if (flagged.length === 0)
+        return null;
+    const lines = [];
+    lines.push('## Flagged Items');
+    lines.push('');
+    lines.push('The following checks completed but have been flagged for human review.');
+    lines.push('');
+    lines.push('| Check ID | Name | Issues |');
+    lines.push('| --- | --- | --- |');
+    for (const check of flagged) {
+        lines.push(`| ${inlineCode(check.checkId)} `
+            + `| ${escapeTableCell(check.checkName)} `
+            + `| ${check.issuesFound} |`);
+    }
+    return lines.join('\n');
+}
+function renderErrors(results) {
+    const errored = results.checks.filter((c) => c.status === 'ERROR');
+    if (errored.length === 0)
+        return null;
+    const lines = [];
+    lines.push('## Errors');
+    lines.push('');
+    lines.push('The following checks failed to execute and produced no findings.');
+    lines.push('');
+    // Use the same H3 shape as Detailed Findings (`### Name (id)`) — no leading
+    // ordinal — so the report's heading style is consistent across sections.
+    errored.forEach((check) => {
+        lines.push(`### ${check.checkName} (${inlineCode(check.checkId)})`);
+        lines.push('');
+        if (check.error) {
+            lines.push('**Error message:**');
+            lines.push('');
+            lines.push(fencedCode(check.error, 'text'));
+        }
+        else {
+            lines.push('_No error message was captured._');
+        }
+        if (check.rawAiResponse) {
+            lines.push('');
+            lines.push('**Raw agent response:**');
+            lines.push('');
+            lines.push(fencedCode(check.rawAiResponse, 'text'));
+        }
+        lines.push('');
+    });
+    while (lines.length > 0 && lines[lines.length - 1] === '')
+        lines.pop();
+    return lines.join('\n');
+}
+function renderStatistics(results) {
+    const { summary } = results;
+    const lines = [];
+    lines.push('## Statistics');
+    lines.push('');
+    lines.push(`- **Total checks:** ${summary.totalChecks}`);
+    lines.push(`- **Passed:** ${summary.passedChecks}`);
+    lines.push(`- **Failed:** ${summary.failedChecks}`);
+    lines.push(`- **Flagged:** ${summary.flaggedChecks}`);
+    lines.push(`- **Errors:** ${summary.errorChecks}`);
+    lines.push(`- **Total issues:** ${summary.totalIssues}`);
+    lines.push(`- **Execution time (ms):** ${results.executionTime}`);
+    lines.push(`- **Start:** ${results.startTime}`);
+    lines.push(`- **End:** ${results.endTime}`);
+    if (results.tokenUsage) {
+        lines.push(`- **Tokens:** total ${results.tokenUsage.totalTokens.toLocaleString('en-US')} `
+            + `(input ${results.tokenUsage.inputTokens.toLocaleString('en-US')}, `
+            + `output ${results.tokenUsage.outputTokens.toLocaleString('en-US')})`);
+    }
+    // Cost sits with tokens rather than under its own heading: it is the same
+    // question ("what did this run consume?") and the reader is already here.
+    const cost = results.metadata?.cost;
+    if (cost) {
+        lines.push(`- **Estimated cost:** ${formatCost(cost.totalCostUsd, cost.currency)}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Format a cost for display. Sub-cent runs are common with cheap models, and
+ * rounding them to "$0.00" reads as "free" rather than "very small", so those
+ * get four decimal places instead of two.
+ */
+function formatCost(amount, currency) {
+    const decimals = amount > 0 && amount < 0.01 ? 4 : 2;
+    const value = amount.toFixed(decimals);
+    return currency === 'USD' ? `$${value}` : `${value} ${escapeInlineText(currency)}`;
+}
+/**
+ * Judge verdict counts. Rendered only when the judge stage ran — `judgedIssues`
+ * is the marker, since every other counter is legitimately zero on a clean scan
+ * and cannot distinguish "judge ran and found nothing" from "judge never ran".
+ */
+function renderJudgeSummary(results) {
+    const { summary } = results;
+    if (summary.judgedIssues === undefined)
+        return null;
+    const lines = [];
+    lines.push('## Judge Verdicts');
+    lines.push('');
+    lines.push(`- **Issues judged:** ${summary.judgedIssues}`);
+    if (summary.falsePositives !== undefined) {
+        lines.push(`- **Judged false positive:** ${summary.falsePositives}`);
+    }
+    if (summary.uncertainJudgements !== undefined) {
+        lines.push(`- **Uncertain:** ${summary.uncertainJudgements}`);
+    }
+    if (summary.flaggedByCheck !== undefined) {
+        lines.push(`- **Flagged by check:** ${summary.flaggedByCheck}`);
+    }
+    if (summary.flaggedByJudge !== undefined) {
+        lines.push(`- **Flagged by judge:** ${summary.flaggedByJudge}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Escape characters that would otherwise be interpreted as Markdown formatting
+ * when interpolating arbitrary user/CI strings into bullet content. Conservative
+ * — only escapes the syntactic characters that change rendering: `\`, `*`, `_`,
+ * `` ` ``, `<`, `[`, `]`, `|`. Newlines collapsed to spaces (bullets are
+ * single-line). Keep this scoped to the CI-metadata path where keys/values come
+ * from arbitrary `Record<string, unknown>` input.
+ */
+function escapeInlineText(value) {
+    return value
+        .replace(/\\/g, '\\\\')
+        .replace(/[*_`<[\]|]/g, (m) => `\\${m}`)
+        // Collapse CRLF, bare LF, *and* a bare CR to a space — CommonMark/GFM
+        // treats a lone `\r` as a line ending too (see escapeMarkdownText's
+        // identical fix), and an uncollapsed bare CR here would let a renderer
+        // split this "single-line" bullet into two lines, letting a leading
+        // block marker on the second line escape the bullet.
+        .replace(/\r\n?|\n/g, ' ');
+}
+/** Human-readable labels for CIMetadata fields, in display order. */
+const CI_METADATA_LABELS = [
+    ['jobUrl', 'Job URL'],
+    ['branch', 'Ref'],
+    ['pipelineSource', 'Trigger'],
+    ['jobStartedAt', 'Started'],
+];
+/**
+ * Renders `metadata.ciMetadata` as a labelled bullet list.
+ *
+ * This was originally written when `ScanResults.metadata` was an untyped
+ * `Record<string, unknown>` and iterated its top-level keys. #260 replaced that
+ * with the closed `ScanMetadata` type, whose members (`ciMetadata`, `cost`) are
+ * nested objects — so the generic iteration would have emitted a JSON blob per
+ * key, and would also have folded `cost` under a heading titled "CI Metadata".
+ *
+ * Values are still escaped: they originate from CI environment variables, which
+ * are attacker-influenceable on forked-PR builds.
+ */
+function renderCIMetadata(results) {
+    const ci = results.metadata?.ciMetadata;
+    if (!ci)
+        return null;
+    const lines = [];
+    for (const [key, label] of CI_METADATA_LABELS) {
+        const value = ci[key];
+        if (value == null || value === '')
+            continue;
+        lines.push(`- **${label}:** ${escapeInlineText(value)}`);
+    }
+    // Every field is optional, so a present-but-empty object yields no rows —
+    // emit nothing rather than a bare heading.
+    if (lines.length === 0)
+        return null;
+    return ['## CI Metadata', '', ...lines].join('\n');
+}
+export class MarkdownFormatter {
+    id = 'markdown';
+    fileExtension = '.md';
+    format(results) {
+        const sections = [
+            renderHeader(results),
+            renderExecutiveSummary(results),
+            renderSummaryTable(results),
+            renderDetailedFindings(results),
+        ];
+        const flagged = renderFlaggedItems(results);
+        if (flagged)
+            sections.push(flagged);
+        const errors = renderErrors(results);
+        if (errors)
+            sections.push(errors);
+        const judge = renderJudgeSummary(results);
+        if (judge)
+            sections.push(judge);
+        sections.push(renderStatistics(results));
+        const ci = renderCIMetadata(results);
+        if (ci)
+            sections.push(ci);
+        return sections.join('\n\n') + '\n';
+    }
+}
+//# sourceMappingURL=markdown-formatter.js.map

package/dist/formatters/markdown-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-formatter.js","sourceRoot":"","sources":["../../src/formatters/markdown-formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,2EAA2E;AAC3E,MAAM,sBAAsB,GAA2B;IACrD,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,IAAI;IACT,EAAE,EAAE,QAAQ;IACZ,EAAE,EAAE,MAAM;IACV,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,OAAO;IACd,EAAE,EAAE,QAAQ;IACZ,CAAC,EAAE,GAAG;IACN,CAAC,EAAE,GAAG;IACN,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,KAAK;IACT,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,UAAU;CACf,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,IAAY;IAC/B,+DAA+D;IAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,EAAE,GAAG,KAAK,CAAC;IACjB,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO;YAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,QAAgB;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,4EAA4E;IAC5E,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,GAAG,KAAK,GAAG,QAAQ,KAAK,IAAI,KAAK,KAAK,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7C,qEAAqE;IACrE,gEAAgE;IAChE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,EAAE,GAAG,KAAK,CAAC;IACjB,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO;YAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK;SACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;SAC3E,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,KAAK;QACV,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,gEAAgE;SAC/D,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI;aAChB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7C,OAAO,MAAM;aACV,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC;aACnC,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,iEAAiE;AACjE,SAAS,WAAW,CAAC,MAAuC;IAC1D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,OAAO,SAAS,CAAC;QAC9B,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAoB;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACpD,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,QAAQ,CAAC;IACb,KAAK,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,aAAa,CAAC,IAAI,YAAY,MAAM,GAAG,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAoB;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnD,oEAAoE;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,KAAK,CAAC,IAAI,CAAC,qBAAqB,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAoB;IAClD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,IAAI,OAAe,CAAC;IACpB,IAAI,OAAO,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,+CAA+C,CAAC;IAC5D,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,GAAG,oBAAoB,OAAO,CAAC,YAAY,yCAAyC,OAAO,CAAC,WAAW,sBAAsB,OAAO,CAAC,WAAW,wCAAwC,CAAC;IAClM,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,GAAG,oBAAoB,OAAO,CAAC,YAAY,yCAAyC,OAAO,CAAC,WAAW,qCAAqC,CAAC;IACtJ,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,6BAA6B,OAAO,CAAC,WAAW,sDAAsD,CAAC;IACnH,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,6BAA6B,OAAO,CAAC,aAAa,6DAA6D,CAAC;IAC5H,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,OAAO,OAAO,CAAC,WAAW,2CAA2C,CAAC;IAClF,CAAC;IACD,OAAO,2BAA2B,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoB;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG;cAC/B,KAAK,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG;cACxC,KAAK,KAAK,CAAC,MAAM,GAAG;cACpB,KAAK,KAAK,CAAC,WAAW,GAAG;cACzB,KAAK,KAAK,CAAC,aAAa,IAAI,CAC/B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAoB;IAClD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,0DAA0D;IAC1D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB,EAAE,OAAe;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,KAAK,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,mBAAmB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,6EAA6E;IAC7E,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACjC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,qEAAqE;QACrE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,cAAc,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,GAAG,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,gBAAgB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1B,0EAA0E;YAC1E,0EAA0E;YAC1E,KAAK,CAAC,IAAI,CAAC,oBAAoB,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG;cAC/B,KAAK,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG;cACxC,KAAK,KAAK,CAAC,WAAW,IAAI,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAoB;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,4EAA4E;IAC5E,yEAAyE;IACzE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,8BAA8B,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,uBAAuB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG;cAC9E,UAAU,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;cACpE,UAAU,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CACvE,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;IACpC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,yBAAyB,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc,EAAE,QAAgB;IAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAoB;IAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,gCAAgC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,qDAAqD;SACpD,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,qEAAqE;AACrE,MAAM,kBAAkB,GAAuD;IAC7E,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,QAAQ,EAAE,KAAK,CAAC;IACjB,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,cAAc,EAAE,SAAS,CAAC;CAC5B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;IACxC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAErB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QAC5C,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO,CAAC,gBAAgB,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,iBAAiB;IACnB,EAAE,GAAG,UAAU,CAAC;IAChB,aAAa,GAAG,KAAK,CAAC;IAE/B,MAAM,CAAC,OAAoB;QACzB,MAAM,QAAQ,GAAa;YACzB,YAAY,CAAC,OAAO,CAAC;YACrB,sBAAsB,CAAC,OAAO,CAAC;YAC/B,kBAAkB,CAAC,OAAO,CAAC;YAC3B,sBAAsB,CAAC,OAAO,CAAC;SAChC,CAAC;QACF,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACtC,CAAC;CACF"}

package/dist/formatters/sarif-formatter.d.ts

@@ -11,6 +11,13 @@ export declare class SarifFormatter implements OutputFormatter {
     readonly id = "sarif";
     readonly fileExtension = ".sarif";
     format(results: ScanResults): string;
+    /**
+     * Map CI/CD metadata (spec E.4) to a single SARIF invocation entry. The
+     * `properties` bag is the conventional location for non-standard run
+     * context in SARIF; we use stable, namespaced keys (`aghast.<field>`) so
+     * downstream consumers can rely on the shape.
+     */
+    private buildInvocations;
     private buildRules;
     private buildResults;
     private buildValidationResults;

package/dist/formatters/sarif-formatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sarif-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/sarif-formatter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAiD,MAAM,aAAa,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAY7F;AAiED,qBAAa,cAAe,YAAW,eAAe;IACpD,QAAQ,CAAC,EAAE,WAAW;IACtB,QAAQ,CAAC,aAAa,YAAY;IAElC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;IA8BpC,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,YAAY;IAgCpB,OAAO,CAAC,sBAAsB;IAoC9B,OAAO,CAAC,aAAa;CAiBtB"}
+{"version":3,"file":"sarif-formatter.d.ts","sourceRoot":"","sources":["../../src/formatters/sarif-formatter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAA2E,MAAM,aAAa,CAAC;AACxH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAY7F;AAqGD,qBAAa,cAAe,YAAW,eAAe;IACpD,QAAQ,CAAC,EAAE,WAAW;IACtB,QAAQ,CAAC,aAAa,YAAY;IAElC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM;IAgCpC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,YAAY;IAqEpB,OAAO,CAAC,sBAAsB;IAoC9B,OAAO,CAAC,aAAa;CAiBtB"}