@panguard-ai/panguard 1.7.0 → 1.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@panguard-ai/panguard",
|
|
3
|
-
"version": "1.7.
|
|
3
|
+
"version": "1.7.1",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -42,20 +42,20 @@
|
|
|
42
42
|
"js-yaml": "^4.1.0",
|
|
43
43
|
"pdfkit": "^0.15.0",
|
|
44
44
|
"zod": "^3.24.0",
|
|
45
|
-
"@panguard-ai/atr": "1.7.
|
|
46
|
-
"@panguard-ai/core": "1.7.
|
|
47
|
-
"@panguard-ai/panguard-
|
|
48
|
-
"@panguard-ai/
|
|
49
|
-
"@panguard-ai/security-hardening": "1.7.
|
|
50
|
-
"@panguard-ai/
|
|
51
|
-
"@panguard-ai/panguard-
|
|
52
|
-
"@panguard-ai/panguard-mcp": "1.7.
|
|
53
|
-
"@panguard-ai/panguard-mcp-proxy": "1.7.
|
|
54
|
-
"@panguard-ai/panguard-
|
|
45
|
+
"@panguard-ai/atr": "1.7.1",
|
|
46
|
+
"@panguard-ai/core": "1.7.1",
|
|
47
|
+
"@panguard-ai/panguard-scan": "1.7.1",
|
|
48
|
+
"@panguard-ai/scan-core": "1.7.1",
|
|
49
|
+
"@panguard-ai/security-hardening": "1.7.1",
|
|
50
|
+
"@panguard-ai/panguard-guard": "1.7.1",
|
|
51
|
+
"@panguard-ai/panguard-skill-auditor": "1.7.1",
|
|
52
|
+
"@panguard-ai/panguard-mcp": "1.7.1",
|
|
53
|
+
"@panguard-ai/panguard-mcp-proxy": "1.7.1",
|
|
54
|
+
"@panguard-ai/panguard-chat": "1.7.1"
|
|
55
55
|
},
|
|
56
56
|
"optionalDependencies": {
|
|
57
57
|
"agent-threat-rules": "^3.5.0",
|
|
58
|
-
"@panguard-ai/panguard-trap": "1.7.
|
|
58
|
+
"@panguard-ai/panguard-trap": "1.7.1"
|
|
59
59
|
},
|
|
60
60
|
"devDependencies": {
|
|
61
61
|
"@types/js-yaml": "^4.0.9",
|
|
@@ -1,32 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* panguard report — AI Compliance Audit Evidence report generator
|
|
3
|
-
*
|
|
4
|
-
* Reads ATR rule YAML (from @panguard-ai/agent-threat-rules node_modules) and
|
|
5
|
-
* produces auditor-readable reports mapping each rule to compliance framework
|
|
6
|
-
* articles / clauses / subcategories. This is the Enterprise tier's core
|
|
7
|
-
* differentiator (product "D1").
|
|
8
|
-
*
|
|
9
|
-
* Usage:
|
|
10
|
-
* pga report list-frameworks
|
|
11
|
-
* pga report summary --framework <name>
|
|
12
|
-
* pga report generate --framework <name> [--format md|json|pdf] [--output <path>] [--sign <key>]
|
|
13
|
-
*
|
|
14
|
-
* Every report includes a SHA-256 integrity hash computed over the
|
|
15
|
-
* canonical JSON representation, and optionally an HMAC-SHA256
|
|
16
|
-
* signature (via --sign or PANGUARD_REPORT_SIGNING_KEY env var).
|
|
17
|
-
* PDFs additionally write a sidecar <output>.hash file for auditor
|
|
18
|
-
* verification.
|
|
19
|
-
*
|
|
20
|
-
* Supported framework ids:
|
|
21
|
-
* owasp-agentic — OWASP Agentic Top 10 (2026)
|
|
22
|
-
* owasp-llm — OWASP LLM Top 10 (2025)
|
|
23
|
-
* eu-ai-act — EU AI Act (Regulation 2024/1689)
|
|
24
|
-
* colorado-ai-act — Colorado SB24-205
|
|
25
|
-
* nist-ai-rmf — NIST AI RMF 1.0
|
|
26
|
-
* iso-42001 — ISO/IEC 42001:2023
|
|
27
|
-
*
|
|
28
|
-
* @module @panguard-ai/panguard/cli/commands/report
|
|
29
|
-
*/
|
|
30
|
-
import { Command } from 'commander';
|
|
31
|
-
export declare function reportCommand(): Command;
|
|
32
|
-
//# sourceMappingURL=report.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgyBpC,wBAAgB,aAAa,IAAI,OAAO,CAkDvC"}
|
|
@@ -1,712 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* panguard report — AI Compliance Audit Evidence report generator
|
|
3
|
-
*
|
|
4
|
-
* Reads ATR rule YAML (from @panguard-ai/agent-threat-rules node_modules) and
|
|
5
|
-
* produces auditor-readable reports mapping each rule to compliance framework
|
|
6
|
-
* articles / clauses / subcategories. This is the Enterprise tier's core
|
|
7
|
-
* differentiator (product "D1").
|
|
8
|
-
*
|
|
9
|
-
* Usage:
|
|
10
|
-
* pga report list-frameworks
|
|
11
|
-
* pga report summary --framework <name>
|
|
12
|
-
* pga report generate --framework <name> [--format md|json|pdf] [--output <path>] [--sign <key>]
|
|
13
|
-
*
|
|
14
|
-
* Every report includes a SHA-256 integrity hash computed over the
|
|
15
|
-
* canonical JSON representation, and optionally an HMAC-SHA256
|
|
16
|
-
* signature (via --sign or PANGUARD_REPORT_SIGNING_KEY env var).
|
|
17
|
-
* PDFs additionally write a sidecar <output>.hash file for auditor
|
|
18
|
-
* verification.
|
|
19
|
-
*
|
|
20
|
-
* Supported framework ids:
|
|
21
|
-
* owasp-agentic — OWASP Agentic Top 10 (2026)
|
|
22
|
-
* owasp-llm — OWASP LLM Top 10 (2025)
|
|
23
|
-
* eu-ai-act — EU AI Act (Regulation 2024/1689)
|
|
24
|
-
* colorado-ai-act — Colorado SB24-205
|
|
25
|
-
* nist-ai-rmf — NIST AI RMF 1.0
|
|
26
|
-
* iso-42001 — ISO/IEC 42001:2023
|
|
27
|
-
*
|
|
28
|
-
* @module @panguard-ai/panguard/cli/commands/report
|
|
29
|
-
*/
|
|
30
|
-
import { Command } from 'commander';
|
|
31
|
-
import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
|
|
32
|
-
import { dirname, join, resolve, sep } from 'node:path';
|
|
33
|
-
import { fileURLToPath } from 'node:url';
|
|
34
|
-
import { createRequire } from 'node:module';
|
|
35
|
-
import { createHash, createHmac } from 'node:crypto';
|
|
36
|
-
import { c, symbols } from '@panguard-ai/core';
|
|
37
|
-
const require = createRequire(import.meta.url);
|
|
38
|
-
const FRAMEWORKS = [
|
|
39
|
-
{
|
|
40
|
-
id: 'owasp-agentic',
|
|
41
|
-
yamlKey: 'owasp_agentic',
|
|
42
|
-
name: 'OWASP Agentic Top 10 (2026)',
|
|
43
|
-
authority: 'OWASP Foundation',
|
|
44
|
-
identifierField: 'id',
|
|
45
|
-
coverageStatus: 'partial',
|
|
46
|
-
},
|
|
47
|
-
{
|
|
48
|
-
id: 'owasp-llm',
|
|
49
|
-
yamlKey: 'owasp_llm',
|
|
50
|
-
name: 'OWASP LLM Top 10 (2025)',
|
|
51
|
-
authority: 'OWASP Foundation',
|
|
52
|
-
identifierField: 'id',
|
|
53
|
-
coverageStatus: 'partial',
|
|
54
|
-
},
|
|
55
|
-
{
|
|
56
|
-
id: 'eu-ai-act',
|
|
57
|
-
yamlKey: 'eu_ai_act',
|
|
58
|
-
name: 'EU AI Act (Regulation 2024/1689)',
|
|
59
|
-
authority: 'European Union',
|
|
60
|
-
enforcementDate: '2026-08-02',
|
|
61
|
-
identifierField: 'article',
|
|
62
|
-
coverageStatus: 'planned',
|
|
63
|
-
},
|
|
64
|
-
{
|
|
65
|
-
id: 'colorado-ai-act',
|
|
66
|
-
yamlKey: 'colorado_ai_act',
|
|
67
|
-
name: 'Colorado AI Act (SB24-205)',
|
|
68
|
-
authority: 'State of Colorado',
|
|
69
|
-
enforcementDate: '2026-06-30',
|
|
70
|
-
identifierField: 'section',
|
|
71
|
-
coverageStatus: 'planned',
|
|
72
|
-
},
|
|
73
|
-
{
|
|
74
|
-
id: 'nist-ai-rmf',
|
|
75
|
-
yamlKey: 'nist_ai_rmf',
|
|
76
|
-
name: 'NIST AI Risk Management Framework 1.0',
|
|
77
|
-
authority: 'NIST (US Dept of Commerce)',
|
|
78
|
-
identifierField: 'clause',
|
|
79
|
-
coverageStatus: 'planned',
|
|
80
|
-
},
|
|
81
|
-
{
|
|
82
|
-
id: 'iso-42001',
|
|
83
|
-
yamlKey: 'iso_42001',
|
|
84
|
-
name: 'ISO/IEC 42001:2023 AIMS',
|
|
85
|
-
authority: 'ISO / IEC',
|
|
86
|
-
identifierField: 'clause',
|
|
87
|
-
coverageStatus: 'planned',
|
|
88
|
-
},
|
|
89
|
-
];
|
|
90
|
-
/**
|
|
91
|
-
* Locate the agent-threat-rules rule directory.
|
|
92
|
-
*
|
|
93
|
-
* Precedence:
|
|
94
|
-
* 1. $PANGUARD_ATR_RULES_DIR env var — for local development against an
|
|
95
|
-
* ATR repo checkout (useful when hacking on new compliance metadata
|
|
96
|
-
* before npm publish).
|
|
97
|
-
* 2. Resolve the agent-threat-rules package via Node module resolution.
|
|
98
|
-
* Works for global installs (`npm install -g @panguard-ai/panguard`)
|
|
99
|
-
* because `require.resolve` finds the bundled dep from the panguard
|
|
100
|
-
* package's own location, NOT from the user's pwd.
|
|
101
|
-
* 3. Cwd-relative fallbacks (monorepo dev / customer project with ATR
|
|
102
|
-
* installed locally).
|
|
103
|
-
*/
|
|
104
|
-
function findRulesDir() {
|
|
105
|
-
const envDir = process.env['PANGUARD_ATR_RULES_DIR'];
|
|
106
|
-
if (envDir && existsSync(envDir) && statSync(envDir).isDirectory()) {
|
|
107
|
-
return envDir;
|
|
108
|
-
}
|
|
109
|
-
// Walk up from THIS module's own directory looking for
|
|
110
|
-
// node_modules/agent-threat-rules/rules. Mirrors Node's standard module
|
|
111
|
-
// resolution but works on a directory subpath that ESM `import` can't
|
|
112
|
-
// resolve directly (the agent-threat-rules package has an `exports` field
|
|
113
|
-
// that hides ./package.json). This is the path that makes
|
|
114
|
-
// `npm install -g @panguard-ai/panguard` work regardless of customer cwd.
|
|
115
|
-
try {
|
|
116
|
-
let dir = dirname(fileURLToPath(import.meta.url));
|
|
117
|
-
while (dir !== sep && dir.length > 0) {
|
|
118
|
-
const candidate = join(dir, 'node_modules', 'agent-threat-rules', 'rules');
|
|
119
|
-
if (existsSync(candidate) && statSync(candidate).isDirectory()) {
|
|
120
|
-
return candidate;
|
|
121
|
-
}
|
|
122
|
-
const parent = dirname(dir);
|
|
123
|
-
if (parent === dir)
|
|
124
|
-
break;
|
|
125
|
-
dir = parent;
|
|
126
|
-
}
|
|
127
|
-
}
|
|
128
|
-
catch {
|
|
129
|
-
// Fall through to cwd-relative candidates.
|
|
130
|
-
}
|
|
131
|
-
const candidates = [
|
|
132
|
-
resolve(process.cwd(), 'node_modules', 'agent-threat-rules', 'rules'),
|
|
133
|
-
resolve(process.cwd(), 'node_modules', '.pnpm', 'node_modules', 'agent-threat-rules', 'rules'),
|
|
134
|
-
resolve(process.cwd(), '..', '..', 'node_modules', 'agent-threat-rules', 'rules'),
|
|
135
|
-
];
|
|
136
|
-
for (const p of candidates) {
|
|
137
|
-
if (existsSync(p) && statSync(p).isDirectory())
|
|
138
|
-
return p;
|
|
139
|
-
}
|
|
140
|
-
return null;
|
|
141
|
-
}
|
|
142
|
-
function collectYamlFiles(dir) {
|
|
143
|
-
const results = [];
|
|
144
|
-
for (const entry of readdirSync(dir)) {
|
|
145
|
-
const full = join(dir, entry);
|
|
146
|
-
const st = statSync(full);
|
|
147
|
-
if (st.isDirectory()) {
|
|
148
|
-
results.push(...collectYamlFiles(full));
|
|
149
|
-
}
|
|
150
|
-
else if (entry.endsWith('.yaml') || entry.endsWith('.yml')) {
|
|
151
|
-
results.push(full);
|
|
152
|
-
}
|
|
153
|
-
}
|
|
154
|
-
return results;
|
|
155
|
-
}
|
|
156
|
-
function parseRule(filePath) {
|
|
157
|
-
// Load js-yaml lazily — only needed when report runs
|
|
158
|
-
let yaml;
|
|
159
|
-
try {
|
|
160
|
-
yaml = require('js-yaml');
|
|
161
|
-
}
|
|
162
|
-
catch {
|
|
163
|
-
return null;
|
|
164
|
-
}
|
|
165
|
-
let doc;
|
|
166
|
-
try {
|
|
167
|
-
const raw = readFileSync(filePath, 'utf-8');
|
|
168
|
-
doc = yaml.load(raw);
|
|
169
|
-
}
|
|
170
|
-
catch {
|
|
171
|
-
return null;
|
|
172
|
-
}
|
|
173
|
-
if (!doc || typeof doc !== 'object' || !doc['id'])
|
|
174
|
-
return null;
|
|
175
|
-
const tags = doc['tags'] ?? {};
|
|
176
|
-
const compliance = doc['compliance'] ?? {};
|
|
177
|
-
// Normalise compliance entries per framework into uniform shape
|
|
178
|
-
const normalisedCompliance = {};
|
|
179
|
-
for (const fw of FRAMEWORKS) {
|
|
180
|
-
const raw = compliance[fw.yamlKey];
|
|
181
|
-
if (!Array.isArray(raw))
|
|
182
|
-
continue;
|
|
183
|
-
normalisedCompliance[fw.yamlKey] = raw
|
|
184
|
-
.filter((e) => typeof e === 'object' && e !== null)
|
|
185
|
-
.map((e) => {
|
|
186
|
-
const identifierField = fw.identifierField;
|
|
187
|
-
const rawId = identifierField === 'clause' && fw.id === 'nist-ai-rmf'
|
|
188
|
-
? `${String(e['function'] ?? '')}.${String(e['subcategory'] ?? '')}`
|
|
189
|
-
: String(e[identifierField] ?? '');
|
|
190
|
-
return {
|
|
191
|
-
identifier: rawId,
|
|
192
|
-
clause: typeof e['clause'] === 'string' ? e['clause'] : undefined,
|
|
193
|
-
clauseName: typeof e['clause_name'] === 'string' ? e['clause_name'] : undefined,
|
|
194
|
-
context: String(e['context'] ?? ''),
|
|
195
|
-
strength: e['strength'] ?? 'primary',
|
|
196
|
-
};
|
|
197
|
-
})
|
|
198
|
-
.filter((e) => e.identifier && e.context);
|
|
199
|
-
}
|
|
200
|
-
return {
|
|
201
|
-
id: String(doc['id']),
|
|
202
|
-
title: String(doc['title'] ?? ''),
|
|
203
|
-
severity: String(doc['severity'] ?? 'unknown'),
|
|
204
|
-
status: String(doc['status'] ?? 'unknown'),
|
|
205
|
-
maturity: String(doc['maturity'] ?? 'unknown'),
|
|
206
|
-
category: String(tags['category'] ?? 'uncategorised'),
|
|
207
|
-
filePath,
|
|
208
|
-
compliance: normalisedCompliance,
|
|
209
|
-
};
|
|
210
|
-
}
|
|
211
|
-
function loadAllRules() {
|
|
212
|
-
const rulesDir = findRulesDir();
|
|
213
|
-
if (!rulesDir)
|
|
214
|
-
return { rules: [], rulesDir: null };
|
|
215
|
-
const files = collectYamlFiles(rulesDir).sort();
|
|
216
|
-
const rules = [];
|
|
217
|
-
for (const f of files) {
|
|
218
|
-
const r = parseRule(f);
|
|
219
|
-
if (r)
|
|
220
|
-
rules.push(r);
|
|
221
|
-
}
|
|
222
|
-
return { rules, rulesDir };
|
|
223
|
-
}
|
|
224
|
-
function buildCoverage(rules, fw) {
|
|
225
|
-
const byIdentifier = new Map();
|
|
226
|
-
let mappedRules = 0;
|
|
227
|
-
let totalMappings = 0;
|
|
228
|
-
for (const r of rules) {
|
|
229
|
-
const entries = r.compliance[fw.yamlKey];
|
|
230
|
-
if (!entries || entries.length === 0)
|
|
231
|
-
continue;
|
|
232
|
-
mappedRules++;
|
|
233
|
-
for (const e of entries) {
|
|
234
|
-
totalMappings++;
|
|
235
|
-
const key = e.identifier;
|
|
236
|
-
const existing = byIdentifier.get(key) ?? { count: 0, context: [] };
|
|
237
|
-
existing.count++;
|
|
238
|
-
existing.context.push(`${r.id}: ${e.context}`);
|
|
239
|
-
byIdentifier.set(key, existing);
|
|
240
|
-
}
|
|
241
|
-
}
|
|
242
|
-
return {
|
|
243
|
-
framework: fw,
|
|
244
|
-
totalRules: rules.length,
|
|
245
|
-
mappedRules,
|
|
246
|
-
totalMappings,
|
|
247
|
-
byIdentifier,
|
|
248
|
-
};
|
|
249
|
-
}
|
|
250
|
-
function renderMarkdown(coverage, orgName) {
|
|
251
|
-
const fw = coverage.framework;
|
|
252
|
-
const today = new Date().toISOString().slice(0, 10);
|
|
253
|
-
const sortedIds = Array.from(coverage.byIdentifier.keys()).sort();
|
|
254
|
-
const coveragePercent = coverage.totalRules > 0
|
|
255
|
-
? ((coverage.mappedRules / coverage.totalRules) * 100).toFixed(1)
|
|
256
|
-
: '0.0';
|
|
257
|
-
const lines = [];
|
|
258
|
-
lines.push(`# AI Compliance Audit Evidence Report`);
|
|
259
|
-
lines.push('');
|
|
260
|
-
lines.push(`- **Framework**: ${fw.name}`);
|
|
261
|
-
lines.push(`- **Authority**: ${fw.authority}`);
|
|
262
|
-
if (fw.enforcementDate) {
|
|
263
|
-
lines.push(`- **Enforcement date**: ${fw.enforcementDate}`);
|
|
264
|
-
}
|
|
265
|
-
lines.push(`- **Organisation**: ${orgName}`);
|
|
266
|
-
lines.push(`- **Report date**: ${today}`);
|
|
267
|
-
lines.push(`- **ATR rules in set**: ${coverage.totalRules}`);
|
|
268
|
-
lines.push(`- **Rules mapped to this framework**: ${coverage.mappedRules} (${coveragePercent}%)`);
|
|
269
|
-
lines.push(`- **Total mappings (rule × article)**: ${coverage.totalMappings}`);
|
|
270
|
-
lines.push('');
|
|
271
|
-
lines.push(`---`);
|
|
272
|
-
lines.push('');
|
|
273
|
-
if (coverage.mappedRules === 0) {
|
|
274
|
-
lines.push(`> **Status: Mapping in progress.** The \`compliance.${fw.yamlKey}\` metadata block`);
|
|
275
|
-
lines.push(`> has not yet been authored for any rules in this ATR release. See`);
|
|
276
|
-
lines.push(`> [compliance-metadata.md](https://github.com/Agent-Threat-Rule/agent-threat-rules/blob/main/spec/compliance-metadata.md)`);
|
|
277
|
-
lines.push(`> for the target schema and the roll-out plan.`);
|
|
278
|
-
lines.push('');
|
|
279
|
-
return lines.join('\n');
|
|
280
|
-
}
|
|
281
|
-
lines.push(`## Mapping by ${fw.identifierField}`);
|
|
282
|
-
lines.push('');
|
|
283
|
-
for (const id of sortedIds) {
|
|
284
|
-
const detail = coverage.byIdentifier.get(id);
|
|
285
|
-
if (!detail)
|
|
286
|
-
continue;
|
|
287
|
-
lines.push(`### ${id}`);
|
|
288
|
-
lines.push(`*${detail.count} rule${detail.count === 1 ? '' : 's'} address this control*`);
|
|
289
|
-
lines.push('');
|
|
290
|
-
for (const line of detail.context) {
|
|
291
|
-
lines.push(`- ${line}`);
|
|
292
|
-
}
|
|
293
|
-
lines.push('');
|
|
294
|
-
}
|
|
295
|
-
lines.push(`---`);
|
|
296
|
-
lines.push('');
|
|
297
|
-
lines.push(`## Provenance`);
|
|
298
|
-
lines.push('');
|
|
299
|
-
lines.push(`Every mapping in this report originates from an ATR rule YAML file in the public MIT-licensed repository.`);
|
|
300
|
-
lines.push(`Each \`compliance:\` entry is a human-authored statement reviewed against the spec in \`spec/compliance-metadata.md\`.`);
|
|
301
|
-
lines.push('');
|
|
302
|
-
lines.push(`For traceability chain: ATR rule ID → \`compliance.${fw.yamlKey}\` block → identifier → rule file in the repo.`);
|
|
303
|
-
lines.push('');
|
|
304
|
-
lines.push(`**Limitations**: this is a *rule-coverage* report — which ATR rules claim to address which framework controls. A full audit also requires *event evidence* (which detections your deployment actually triggered during the audit period). See \`pga sensor status\` and the PanGuard Enterprise audit-log export for event-level evidence.`);
|
|
305
|
-
return lines.join('\n');
|
|
306
|
-
}
|
|
307
|
-
function renderJson(coverage, orgName) {
|
|
308
|
-
const fw = coverage.framework;
|
|
309
|
-
const byIdentifier = {};
|
|
310
|
-
for (const [k, v] of coverage.byIdentifier.entries()) {
|
|
311
|
-
byIdentifier[k] = v;
|
|
312
|
-
}
|
|
313
|
-
return JSON.stringify({
|
|
314
|
-
framework: fw,
|
|
315
|
-
organisation: orgName,
|
|
316
|
-
reportDate: new Date().toISOString(),
|
|
317
|
-
totalRules: coverage.totalRules,
|
|
318
|
-
mappedRules: coverage.mappedRules,
|
|
319
|
-
totalMappings: coverage.totalMappings,
|
|
320
|
-
byIdentifier,
|
|
321
|
-
}, null, 2);
|
|
322
|
-
}
|
|
323
|
-
// ─── PDF rendering (D1 Sprint 5) ─────────────────────────────────────
|
|
324
|
-
/**
|
|
325
|
-
* Render the coverage report as a PDF binary.
|
|
326
|
-
*
|
|
327
|
-
* Uses pdfkit (already in dependencies). The PDF mirrors the Markdown
|
|
328
|
-
* structure — header metadata, per-identifier rule mappings, provenance
|
|
329
|
-
* footer — and includes the report integrity hash on the cover page so
|
|
330
|
-
* auditors can verify the document hasn't been tampered with.
|
|
331
|
-
*
|
|
332
|
-
* Returns a Promise<Buffer> so async PDF streams finish before writing.
|
|
333
|
-
*/
|
|
334
|
-
async function renderPdf(coverage, orgName, integrityHash, signature) {
|
|
335
|
-
// Lazy-load pdfkit so CLI startup stays fast when PDF isn't needed.
|
|
336
|
-
// Use dynamic import so the pdfkit types come through properly even
|
|
337
|
-
// when the module is optional at runtime.
|
|
338
|
-
const pdfkitMod = (await import('pdfkit'));
|
|
339
|
-
const PDFDocument = pdfkitMod.default;
|
|
340
|
-
const doc = new PDFDocument({
|
|
341
|
-
size: 'A4',
|
|
342
|
-
margin: 50,
|
|
343
|
-
info: {
|
|
344
|
-
Title: `AI Compliance Audit Evidence — ${coverage.framework.name}`,
|
|
345
|
-
Author: `PanGuard AI · AI Compliance Audit Evidence Module`,
|
|
346
|
-
Subject: `${orgName} — ${coverage.framework.name}`,
|
|
347
|
-
Keywords: `ATR, compliance, ${coverage.framework.yamlKey}, agent security`,
|
|
348
|
-
CreationDate: new Date(),
|
|
349
|
-
},
|
|
350
|
-
});
|
|
351
|
-
const chunks = [];
|
|
352
|
-
const done = new Promise((resolvePromise, rejectPromise) => {
|
|
353
|
-
doc.on('data', (chunk) => chunks.push(chunk));
|
|
354
|
-
doc.on('end', () => resolvePromise(Buffer.concat(chunks)));
|
|
355
|
-
doc.on('error', (e) => rejectPromise(e));
|
|
356
|
-
});
|
|
357
|
-
const fw = coverage.framework;
|
|
358
|
-
const today = new Date().toISOString().slice(0, 10);
|
|
359
|
-
const coveragePercent = coverage.totalRules > 0
|
|
360
|
-
? ((coverage.mappedRules / coverage.totalRules) * 100).toFixed(1)
|
|
361
|
-
: '0.0';
|
|
362
|
-
// Cover page
|
|
363
|
-
doc.fontSize(20).font('Helvetica-Bold');
|
|
364
|
-
doc.text('AI Compliance Audit Evidence Report');
|
|
365
|
-
doc.moveDown(0.5);
|
|
366
|
-
doc.fontSize(12).font('Helvetica');
|
|
367
|
-
doc.text(`${fw.name}`);
|
|
368
|
-
doc.moveDown(1);
|
|
369
|
-
doc.fontSize(10).font('Helvetica');
|
|
370
|
-
const meta = [
|
|
371
|
-
['Framework', fw.name],
|
|
372
|
-
['Authority', fw.authority],
|
|
373
|
-
...(fw.enforcementDate
|
|
374
|
-
? [['Enforcement date', fw.enforcementDate]]
|
|
375
|
-
: []),
|
|
376
|
-
['Organisation', orgName],
|
|
377
|
-
['Report date', today],
|
|
378
|
-
['ATR rules in set', String(coverage.totalRules)],
|
|
379
|
-
['Rules mapped', `${coverage.mappedRules} (${coveragePercent}%)`],
|
|
380
|
-
['Total mappings', String(coverage.totalMappings)],
|
|
381
|
-
];
|
|
382
|
-
for (const [k, v] of meta) {
|
|
383
|
-
doc.font('Helvetica-Bold').text(`${k}: `, { continued: true });
|
|
384
|
-
doc.font('Helvetica').text(v);
|
|
385
|
-
}
|
|
386
|
-
doc.moveDown(1);
|
|
387
|
-
doc.font('Helvetica-Bold').text('Report integrity');
|
|
388
|
-
doc.moveDown(0.3);
|
|
389
|
-
doc.font('Courier').fontSize(8).text(`sha256: ${integrityHash}`);
|
|
390
|
-
if (signature) {
|
|
391
|
-
doc.text(`hmac: ${signature}`);
|
|
392
|
-
}
|
|
393
|
-
doc.font('Helvetica').fontSize(10).moveDown(1);
|
|
394
|
-
if (coverage.mappedRules === 0) {
|
|
395
|
-
doc
|
|
396
|
-
.font('Helvetica-Oblique')
|
|
397
|
-
.text(`Status: Mapping in progress. The compliance.${fw.yamlKey} metadata block has not yet been authored for any rules in this ATR release. See spec/compliance-metadata.md for the target schema and the roll-out plan.`);
|
|
398
|
-
doc.end();
|
|
399
|
-
return done;
|
|
400
|
-
}
|
|
401
|
-
// Mapping by identifier
|
|
402
|
-
doc.addPage();
|
|
403
|
-
doc.fontSize(14).font('Helvetica-Bold').text(`Mapping by ${fw.identifierField}`);
|
|
404
|
-
doc.moveDown(0.5);
|
|
405
|
-
const sortedIds = Array.from(coverage.byIdentifier.keys()).sort();
|
|
406
|
-
for (const id of sortedIds) {
|
|
407
|
-
const detail = coverage.byIdentifier.get(id);
|
|
408
|
-
if (!detail)
|
|
409
|
-
continue;
|
|
410
|
-
doc.fontSize(12).font('Helvetica-Bold').text(id);
|
|
411
|
-
doc
|
|
412
|
-
.fontSize(9)
|
|
413
|
-
.font('Helvetica-Oblique')
|
|
414
|
-
.text(`${detail.count} rule${detail.count === 1 ? '' : 's'} address this control`);
|
|
415
|
-
doc.moveDown(0.3);
|
|
416
|
-
doc.fontSize(10).font('Helvetica');
|
|
417
|
-
for (const line of detail.context) {
|
|
418
|
-
doc.text(` • ${line}`, { paragraphGap: 3 });
|
|
419
|
-
}
|
|
420
|
-
doc.moveDown(0.5);
|
|
421
|
-
}
|
|
422
|
-
// Provenance footer
|
|
423
|
-
doc.addPage();
|
|
424
|
-
doc.fontSize(14).font('Helvetica-Bold').text('Provenance');
|
|
425
|
-
doc.moveDown(0.5);
|
|
426
|
-
doc.fontSize(10).font('Helvetica');
|
|
427
|
-
doc.text('Every mapping in this report originates from an ATR rule YAML file in the public MIT-licensed repository.');
|
|
428
|
-
doc.moveDown(0.3);
|
|
429
|
-
doc.text(`Each compliance: entry is a human-authored statement reviewed against the spec in spec/compliance-metadata.md.`);
|
|
430
|
-
doc.moveDown(0.3);
|
|
431
|
-
doc.text(`For traceability chain: ATR rule ID → compliance.${fw.yamlKey} block → identifier → rule file in the repo.`);
|
|
432
|
-
doc.moveDown(1);
|
|
433
|
-
doc.font('Helvetica-Bold').text('Limitations');
|
|
434
|
-
doc.moveDown(0.3);
|
|
435
|
-
doc
|
|
436
|
-
.font('Helvetica')
|
|
437
|
-
.text('This is a rule-coverage report — which ATR rules claim to address which framework controls. A full audit also requires event evidence (which detections your deployment actually triggered during the audit period). See pga sensor status and the PanGuard Enterprise audit-log export for event-level evidence.');
|
|
438
|
-
doc.moveDown(1);
|
|
439
|
-
doc.font('Helvetica-Bold').fontSize(9).text('Integrity chain');
|
|
440
|
-
doc.font('Courier').fontSize(7);
|
|
441
|
-
doc.text(`sha256(report-canonical-json): ${integrityHash}`);
|
|
442
|
-
if (signature) {
|
|
443
|
-
doc.text(`hmac-sha256(report): ${signature}`);
|
|
444
|
-
}
|
|
445
|
-
doc.end();
|
|
446
|
-
return done;
|
|
447
|
-
}
|
|
448
|
-
// ─── Integrity hashing (D1 Sprint 5) ─────────────────────────────────
|
|
449
|
-
/**
|
|
450
|
-
* Compute a deterministic SHA-256 hash of the canonical report payload.
|
|
451
|
-
*
|
|
452
|
-
* The hash is computed over the JSON representation (which is
|
|
453
|
-
* deterministic for our controlled data shape) so the same inputs
|
|
454
|
-
* always produce the same hash regardless of format. This gives
|
|
455
|
-
* auditors a single identifier that binds the Markdown, JSON, and
|
|
456
|
-
* PDF outputs of the same report together.
|
|
457
|
-
*/
|
|
458
|
-
function computeReportHash(coverage, orgName, reportDate) {
|
|
459
|
-
const byIdentifier = {};
|
|
460
|
-
const sorted = Array.from(coverage.byIdentifier.keys()).sort();
|
|
461
|
-
for (const k of sorted) {
|
|
462
|
-
const v = coverage.byIdentifier.get(k);
|
|
463
|
-
if (v)
|
|
464
|
-
byIdentifier[k] = { count: v.count, context: [...v.context].sort() };
|
|
465
|
-
}
|
|
466
|
-
const canonical = JSON.stringify({
|
|
467
|
-
framework: coverage.framework.id,
|
|
468
|
-
yamlKey: coverage.framework.yamlKey,
|
|
469
|
-
organisation: orgName,
|
|
470
|
-
reportDate,
|
|
471
|
-
totalRules: coverage.totalRules,
|
|
472
|
-
mappedRules: coverage.mappedRules,
|
|
473
|
-
totalMappings: coverage.totalMappings,
|
|
474
|
-
byIdentifier,
|
|
475
|
-
});
|
|
476
|
-
return createHash('sha256').update(canonical).digest('hex');
|
|
477
|
-
}
|
|
478
|
-
/**
|
|
479
|
-
* Sign the report hash with an HMAC-SHA256 key.
|
|
480
|
-
*
|
|
481
|
-
* The key comes from either --sign <key> or the
|
|
482
|
-
* PANGUARD_REPORT_SIGNING_KEY env var. Enterprise customers receive a
|
|
483
|
-
* dedicated signing key so an auditor can verify that a report PDF
|
|
484
|
-
* actually originated from their PanGuard deployment and wasn't tampered
|
|
485
|
-
* with in transit or during review.
|
|
486
|
-
*/
|
|
487
|
-
function signReport(hash, key) {
|
|
488
|
-
return createHmac('sha256', key).update(hash).digest('hex');
|
|
489
|
-
}
|
|
490
|
-
// ─── CLI wiring ──────────────────────────────────────────────────────
|
|
491
|
-
function resolveFramework(id) {
|
|
492
|
-
return FRAMEWORKS.find((f) => f.id === id) ?? null;
|
|
493
|
-
}
|
|
494
|
-
function listFrameworksAction() {
|
|
495
|
-
const { rules, rulesDir } = loadAllRules();
|
|
496
|
-
console.log('');
|
|
497
|
-
console.log(` ${c.bold('AI COMPLIANCE FRAMEWORKS')}`);
|
|
498
|
-
console.log(` ${c.dim('─'.repeat(68))}`);
|
|
499
|
-
if (!rulesDir) {
|
|
500
|
-
console.log(` ${c.caution(symbols.warn)} Could not locate the agent-threat-rules package.`);
|
|
501
|
-
console.log(` ${c.dim('Install it or run from a monorepo with ATR rules available.')}`);
|
|
502
|
-
console.log('');
|
|
503
|
-
return;
|
|
504
|
-
}
|
|
505
|
-
console.log(` ${c.dim(`Loaded ${rules.length} ATR rules from`)} ${c.dim(rulesDir)}`);
|
|
506
|
-
console.log('');
|
|
507
|
-
for (const fw of FRAMEWORKS) {
|
|
508
|
-
const coverage = buildCoverage(rules, fw);
|
|
509
|
-
const pct = rules.length > 0 ? ((coverage.mappedRules / rules.length) * 100).toFixed(1) : '0.0';
|
|
510
|
-
const state = coverage.mappedRules === 0
|
|
511
|
-
? c.caution(`planned`)
|
|
512
|
-
: coverage.mappedRules < rules.length / 2
|
|
513
|
-
? c.caution(`partial`)
|
|
514
|
-
: c.safe(`shipped`);
|
|
515
|
-
console.log(` ${c.sage(fw.id.padEnd(18))} ${fw.name}`);
|
|
516
|
-
console.log(` ${' '.repeat(18)} ${c.dim(`${coverage.mappedRules}/${rules.length} rules mapped (${pct}%)`)} · ${state}`);
|
|
517
|
-
if (fw.enforcementDate) {
|
|
518
|
-
console.log(` ${' '.repeat(18)} ${c.dim('Enforcement:')} ${fw.enforcementDate}`);
|
|
519
|
-
}
|
|
520
|
-
console.log('');
|
|
521
|
-
}
|
|
522
|
-
console.log(` ${c.dim('Generate a report:')} ${c.sage('pga report generate --framework <id>')}`);
|
|
523
|
-
console.log('');
|
|
524
|
-
}
|
|
525
|
-
function summaryAction(opts) {
|
|
526
|
-
const fw = opts.framework ? resolveFramework(opts.framework) : null;
|
|
527
|
-
if (!fw) {
|
|
528
|
-
console.log(` ${c.caution(symbols.warn)} --framework <id> required. Run ${c.sage('pga report list-frameworks')} to see options.`);
|
|
529
|
-
return;
|
|
530
|
-
}
|
|
531
|
-
const { rules } = loadAllRules();
|
|
532
|
-
const coverage = buildCoverage(rules, fw);
|
|
533
|
-
const pct = rules.length > 0 ? ((coverage.mappedRules / rules.length) * 100).toFixed(1) : '0.0';
|
|
534
|
-
console.log('');
|
|
535
|
-
console.log(` ${c.bold(fw.name)}`);
|
|
536
|
-
console.log(` ${c.dim('─'.repeat(68))}`);
|
|
537
|
-
console.log(` ${c.dim('Authority:')} ${fw.authority}`);
|
|
538
|
-
if (fw.enforcementDate) {
|
|
539
|
-
console.log(` ${c.dim('Enforcement date:')} ${fw.enforcementDate}`);
|
|
540
|
-
}
|
|
541
|
-
console.log(` ${c.dim('ATR rules in set:')} ${rules.length}`);
|
|
542
|
-
console.log(` ${c.dim('Rules mapped:')} ${coverage.mappedRules} (${pct}%)`);
|
|
543
|
-
console.log(` ${c.dim('Total mappings:')} ${coverage.totalMappings}`);
|
|
544
|
-
console.log('');
|
|
545
|
-
if (coverage.byIdentifier.size > 0) {
|
|
546
|
-
console.log(` ${c.bold(`Coverage by ${fw.identifierField}`)}`);
|
|
547
|
-
const sorted = Array.from(coverage.byIdentifier.entries()).sort((a, b) => b[1].count - a[1].count);
|
|
548
|
-
for (const [id, detail] of sorted.slice(0, 10)) {
|
|
549
|
-
console.log(` ${c.sage(id.padEnd(18))} ${c.dim(`${detail.count} rule${detail.count === 1 ? '' : 's'}`)}`);
|
|
550
|
-
}
|
|
551
|
-
if (sorted.length > 10) {
|
|
552
|
-
console.log(` ${c.dim(`… and ${sorted.length - 10} more`)}`);
|
|
553
|
-
}
|
|
554
|
-
}
|
|
555
|
-
else {
|
|
556
|
-
console.log(` ${c.caution('No mappings authored yet for this framework. See spec/compliance-metadata.md.')}`);
|
|
557
|
-
}
|
|
558
|
-
console.log('');
|
|
559
|
-
}
|
|
560
|
-
async function generateAction(opts) {
|
|
561
|
-
const fw = opts.framework ? resolveFramework(opts.framework) : null;
|
|
562
|
-
if (!fw) {
|
|
563
|
-
console.log(` ${c.caution(symbols.warn)} --framework <id> required. Run ${c.sage('pga report list-frameworks')} to see options.`);
|
|
564
|
-
return;
|
|
565
|
-
}
|
|
566
|
-
const rawFormat = (opts.format ?? 'md').toLowerCase();
|
|
567
|
-
const format = rawFormat === 'json' ? 'json' : rawFormat === 'pdf' ? 'pdf' : 'md';
|
|
568
|
-
if (format === 'pdf' && !opts.output) {
|
|
569
|
-
console.log(` ${c.caution(symbols.warn)} --output <path.pdf> is required when --format=pdf (PDFs are binary — cannot stream to stdout).`);
|
|
570
|
-
return;
|
|
571
|
-
}
|
|
572
|
-
const orgName = opts.org ?? 'Your Organisation';
|
|
573
|
-
const { rules } = loadAllRules();
|
|
574
|
-
const coverage = buildCoverage(rules, fw);
|
|
575
|
-
const reportDate = new Date().toISOString();
|
|
576
|
-
const hash = computeReportHash(coverage, orgName, reportDate);
|
|
577
|
-
const signingKey = opts.sign ?? process.env['PANGUARD_REPORT_SIGNING_KEY'];
|
|
578
|
-
const signature = signingKey ? signReport(hash, signingKey) : null;
|
|
579
|
-
if (format === 'pdf') {
|
|
580
|
-
// PDF is binary — must go to a file, never stdout. Validated above.
|
|
581
|
-
const buf = await renderPdf(coverage, orgName, hash, signature);
|
|
582
|
-
const pdfPath = opts.output;
|
|
583
|
-
// eslint-disable-next-line security/detect-non-literal-fs-filename
|
|
584
|
-
writeFileSync(pdfPath, buf);
|
|
585
|
-
// Write sidecar .hash file with integrity metadata — auditors verify against this
|
|
586
|
-
const hashSidecar = `${pdfPath}.hash`;
|
|
587
|
-
const sidecarContent = [
|
|
588
|
-
`# PanGuard AI Compliance Report — integrity sidecar`,
|
|
589
|
-
`framework: ${fw.id}`,
|
|
590
|
-
`organisation: ${orgName}`,
|
|
591
|
-
`report_date: ${reportDate}`,
|
|
592
|
-
`sha256: ${hash}`,
|
|
593
|
-
...(signature ? [`hmac_sha256: ${signature}`] : []),
|
|
594
|
-
`pdf_bytes: ${buf.length}`,
|
|
595
|
-
].join('\n');
|
|
596
|
-
// eslint-disable-next-line security/detect-non-literal-fs-filename
|
|
597
|
-
writeFileSync(hashSidecar, sidecarContent + '\n', 'utf-8');
|
|
598
|
-
console.log(` ${c.safe(symbols.pass)} Wrote PDF report to ${pdfPath} (${buf.length} bytes)`);
|
|
599
|
-
console.log(` ${c.safe(symbols.pass)} Wrote integrity sidecar to ${hashSidecar}`);
|
|
600
|
-
console.log(` ${c.dim('sha256:')} ${hash}`);
|
|
601
|
-
if (signature)
|
|
602
|
-
console.log(` ${c.dim('hmac-sha256:')} ${signature}`);
|
|
603
|
-
return;
|
|
604
|
-
}
|
|
605
|
-
const baseContent = format === 'json' ? renderJson(coverage, orgName) : renderMarkdown(coverage, orgName);
|
|
606
|
-
const footer = format === 'json'
|
|
607
|
-
? ''
|
|
608
|
-
: [
|
|
609
|
-
'',
|
|
610
|
-
'---',
|
|
611
|
-
'',
|
|
612
|
-
'## Report integrity',
|
|
613
|
-
'',
|
|
614
|
-
`- \`sha256(report-canonical-json)\`: \`${hash}\``,
|
|
615
|
-
...(signature ? [`- \`hmac-sha256(report)\`: \`${signature}\``] : []),
|
|
616
|
-
'',
|
|
617
|
-
`Recompute locally with \`pga report generate --framework ${fw.id}\` and compare the hash — any drift means the evidence was modified after export.`,
|
|
618
|
-
'',
|
|
619
|
-
].join('\n');
|
|
620
|
-
const content = format === 'json'
|
|
621
|
-
? JSON.stringify({
|
|
622
|
-
...JSON.parse(baseContent),
|
|
623
|
-
integrity: { sha256: hash, ...(signature ? { hmac_sha256: signature } : {}) },
|
|
624
|
-
}, null, 2)
|
|
625
|
-
: baseContent + footer;
|
|
626
|
-
if (opts.output) {
|
|
627
|
-
// opts.output is a user-provided absolute or relative path we write to
|
|
628
|
-
writeFileSync(opts.output, content, 'utf-8'); // eslint-disable-line security/detect-non-literal-fs-filename
|
|
629
|
-
console.log(` ${c.safe(symbols.pass)} Wrote ${format.toUpperCase()} report to ${opts.output}`);
|
|
630
|
-
console.log(` ${c.dim('sha256:')} ${hash}`);
|
|
631
|
-
if (signature)
|
|
632
|
-
console.log(` ${c.dim('hmac-sha256:')} ${signature}`);
|
|
633
|
-
}
|
|
634
|
-
else {
|
|
635
|
-
process.stdout.write(content + '\n');
|
|
636
|
-
}
|
|
637
|
-
}
|
|
638
|
-
function validateAction() {
|
|
639
|
-
const { rules, rulesDir } = loadAllRules();
|
|
640
|
-
if (!rulesDir) {
|
|
641
|
-
console.log(` ${c.caution(symbols.warn)} Could not locate ATR rules.`);
|
|
642
|
-
return;
|
|
643
|
-
}
|
|
644
|
-
let errors = 0;
|
|
645
|
-
let mapped = 0;
|
|
646
|
-
let unmapped = 0;
|
|
647
|
-
for (const r of rules) {
|
|
648
|
-
const hasAny = Object.values(r.compliance).some((v) => v.length > 0);
|
|
649
|
-
if (hasAny)
|
|
650
|
-
mapped++;
|
|
651
|
-
else
|
|
652
|
-
unmapped++;
|
|
653
|
-
for (const fw of FRAMEWORKS) {
|
|
654
|
-
const entries = r.compliance[fw.yamlKey];
|
|
655
|
-
if (!entries)
|
|
656
|
-
continue;
|
|
657
|
-
for (const e of entries) {
|
|
658
|
-
if (!e.identifier) {
|
|
659
|
-
console.log(` ${c.critical(symbols.fail)} ${r.id}: missing ${fw.identifierField} in ${fw.yamlKey} entry`);
|
|
660
|
-
errors++;
|
|
661
|
-
}
|
|
662
|
-
if (!e.context || e.context.length < 20) {
|
|
663
|
-
console.log(` ${c.caution(symbols.warn)} ${r.id}: ${fw.yamlKey} entry for ${e.identifier} has no / short context (<20 chars)`);
|
|
664
|
-
}
|
|
665
|
-
}
|
|
666
|
-
}
|
|
667
|
-
}
|
|
668
|
-
console.log('');
|
|
669
|
-
console.log(` ${c.bold('VALIDATION SUMMARY')}`);
|
|
670
|
-
console.log(` ${c.dim('Rules total:')} ${rules.length}`);
|
|
671
|
-
console.log(` ${c.sage('Rules mapped:')} ${mapped}`);
|
|
672
|
-
console.log(` ${c.caution('Rules unmapped:')} ${unmapped}`);
|
|
673
|
-
console.log(errors > 0
|
|
674
|
-
? ` ${c.critical('Errors:')} ${errors}`
|
|
675
|
-
: ` ${c.safe('Errors:')} 0`);
|
|
676
|
-
console.log('');
|
|
677
|
-
}
|
|
678
|
-
export function reportCommand() {
|
|
679
|
-
const cmd = new Command('report').description('AI Compliance Audit Evidence report generator');
|
|
680
|
-
cmd
|
|
681
|
-
.command('list-frameworks')
|
|
682
|
-
.description('List supported compliance frameworks + coverage status')
|
|
683
|
-
.action(() => listFrameworksAction());
|
|
684
|
-
cmd
|
|
685
|
-
.command('summary')
|
|
686
|
-
.description('Show compliance coverage summary for one framework')
|
|
687
|
-
.option('--framework <id>', 'Framework id — see: pga report list-frameworks')
|
|
688
|
-
.action((opts) => summaryAction(opts));
|
|
689
|
-
cmd
|
|
690
|
-
.command('generate')
|
|
691
|
-
.description('Generate a Markdown, JSON, or PDF compliance evidence report')
|
|
692
|
-
.option('--framework <id>', 'Framework id')
|
|
693
|
-
.option('--format <fmt>', 'Output format: md (default) | json | pdf')
|
|
694
|
-
.option('--output <path>', 'Write report to file instead of stdout (required for pdf)')
|
|
695
|
-
.option('--org <name>', 'Organisation name for the report header')
|
|
696
|
-
.option('--sign <key>', 'HMAC-SHA256 key for report signing (or set PANGUARD_REPORT_SIGNING_KEY env var)')
|
|
697
|
-
.action(async (opts) => {
|
|
698
|
-
try {
|
|
699
|
-
await generateAction(opts);
|
|
700
|
-
}
|
|
701
|
-
catch (err) {
|
|
702
|
-
console.error(` ${c.critical(symbols.fail)} ${err instanceof Error ? err.message : err}`);
|
|
703
|
-
process.exitCode = 1;
|
|
704
|
-
}
|
|
705
|
-
});
|
|
706
|
-
cmd
|
|
707
|
-
.command('validate')
|
|
708
|
-
.description('Validate all compliance: blocks in the ATR rule set')
|
|
709
|
-
.action(() => validateAction());
|
|
710
|
-
return cmd;
|
|
711
|
-
}
|
|
712
|
-
//# sourceMappingURL=report.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/cli/commands/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAyB/C,MAAM,UAAU,GAA6B;IAC3C;QACE,EAAE,EAAE,eAAe;QACnB,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,6BAA6B;QACnC,SAAS,EAAE,kBAAkB;QAC7B,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,SAAS;KAC1B;IACD;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,kBAAkB;QAC7B,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,SAAS;KAC1B;IACD;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,kCAAkC;QACxC,SAAS,EAAE,gBAAgB;QAC3B,eAAe,EAAE,YAAY;QAC7B,eAAe,EAAE,SAAS;QAC1B,cAAc,EAAE,SAAS;KAC1B;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,4BAA4B;QAClC,SAAS,EAAE,mBAAmB;QAC9B,eAAe,EAAE,YAAY;QAC7B,eAAe,EAAE,SAAS;QAC1B,cAAc,EAAE,SAAS;KAC1B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,uCAAuC;QAC7C,SAAS,EAAE,4BAA4B;QACvC,eAAe,EAAE,QAAQ;QACzB,cAAc,EAAE,SAAS;KAC1B;IACD;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,WAAW;QACtB,eAAe,EAAE,QAAQ;QACzB,cAAc,EAAE,SAAS;KAC1B;CACF,CAAC;AAwBF;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACrD,IAAI,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,uDAAuD;IACvD,wEAAwE;IACxE,sEAAsE;IACtE,0EAA0E;IAC1E,0DAA0D;IAC1D,0EAA0E;IAC1E,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;YAC3E,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM;YAC1B,GAAG,GAAG,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,CAAC;QACrE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,CAAC;QAC9F,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,CAAC;KAClF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,qDAAqD;IACrD,IAAI,IAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,OAAO,CAAC,SAAS,CAAqC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAA4B,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAA6B,IAAI,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAI,GAAG,CAAC,YAAY,CAA6B,IAAI,EAAE,CAAC;IAExE,gEAAgE;IAChE,MAAM,oBAAoB,GAAsC,EAAE,CAAC;IACnE,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,oBAAoB,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,GAAG;aACnC,MAAM,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;aAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,eAAe,GAAG,EAAE,CAAC,eAAe,CAAC;YAC3C,MAAM,KAAK,GACT,eAAe,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,aAAa;gBACrD,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE;gBACpE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;YACvC,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,SAAS;gBAC7E,UAAU,EACR,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,aAAa,CAAY,CAAC,CAAC,CAAC,SAAS;gBACjF,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACnC,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAqD,IAAI,SAAS;aAC1F,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QAC1C,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC;QACrD,QAAQ;QACR,UAAU,EAAE,oBAAoB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAYD,SAAS,aAAa,CAAC,KAAgB,EAAE,EAAiB;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IAC7E,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/C,WAAW,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,aAAa,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC;YACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACpE,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,WAAW;QACX,aAAa;QACb,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAyB,EAAE,OAAe;IAChE,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,eAAe,GACnB,QAAQ,CAAC,UAAU,GAAG,CAAC;QACrB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,KAAK,CAAC;IAEZ,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,yCAAyC,QAAQ,CAAC,WAAW,KAAK,eAAe,IAAI,CAAC,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,0CAA0C,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,QAAQ,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,uDAAuD,EAAE,CAAC,OAAO,mBAAmB,CACrF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QACjF,KAAK,CAAC,IAAI,CACR,2HAA2H,CAC5H,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;QAC1F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,2GAA2G,CAC5G,CAAC;IACF,KAAK,CAAC,IAAI,CACR,wHAAwH,CACzH,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,sDAAsD,EAAE,CAAC,OAAO,gDAAgD,CACjH,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,4UAA4U,CAC7U,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,QAAyB,EAAE,OAAe;IAC5D,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC9B,MAAM,YAAY,GAAyD,EAAE,CAAC;IAC9E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,SAAS,EAAE,EAAE;QACb,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,YAAY;KACb,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;GASG;AACH,KAAK,UAAU,SAAS,CACtB,QAAyB,EACzB,OAAe,EACf,aAAqB,EACrB,SAAwB;IAExB,oEAAoE;IACpE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAExC,CAAC;IACF,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC;QAC1B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,EAAE;QACV,IAAI,EAAE;YACJ,KAAK,EAAE,kCAAkC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE;YAClE,MAAM,EAAE,mDAAmD;YAC3D,OAAO,EAAE,GAAG,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE;YAClD,QAAQ,EAAE,oBAAoB,QAAQ,CAAC,SAAS,CAAC,OAAO,kBAAkB;YAC1E,YAAY,EAAE,IAAI,IAAI,EAAE;SACzB;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACjE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,eAAe,GACnB,QAAQ,CAAC,UAAU,GAAG,CAAC;QACrB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,KAAK,CAAC;IAEZ,aAAa;IACb,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAChD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEhB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,IAAI,GAAuB;QAC/B,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC;QACtB,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS,CAAC;QAC3B,GAAG,CAAC,EAAE,CAAC,eAAe;YACpB,CAAC,CAAE,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAAC,eAAe,CAAC,CAAwB;YACpE,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,cAAc,EAAE,OAAO,CAAC;QACzB,CAAC,aAAa,EAAE,KAAK,CAAC;QACtB,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjD,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,WAAW,KAAK,eAAe,IAAI,CAAC;QACjE,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;KACnD,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACpD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,aAAa,EAAE,CAAC,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE/C,IAAI,QAAQ,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAC/B,GAAG;aACA,IAAI,CAAC,mBAAmB,CAAC;aACzB,IAAI,CACH,+CAA+C,EAAE,CAAC,OAAO,2JAA2J,CACrN,CAAC;QACJ,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IACxB,GAAG,CAAC,OAAO,EAAE,CAAC;IACd,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAElB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,GAAG;aACA,QAAQ,CAAC,CAAC,CAAC;aACX,IAAI,CAAC,mBAAmB,CAAC;aACzB,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC;QACrF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,oBAAoB;IACpB,GAAG,CAAC,OAAO,EAAE,CAAC;IACd,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,GAAG,CAAC,IAAI,CACN,2GAA2G,CAC5G,CAAC;IACF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,IAAI,CACN,gHAAgH,CACjH,CAAC;IACF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,IAAI,CACN,oDAAoD,EAAE,CAAC,OAAO,8CAA8C,CAC7G,CAAC;IACF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/C,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG;SACA,IAAI,CAAC,WAAW,CAAC;SACjB,IAAI,CACH,mTAAmT,CACpT,CAAC;IAEJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChC,GAAG,CAAC,IAAI,CAAC,mCAAmC,aAAa,EAAE,CAAC,CAAC;IAC7D,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,GAAG,CAAC,GAAG,EAAE,CAAC;IACV,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AAExE;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,QAAyB,EAAE,OAAe,EAAE,UAAkB;IACvF,MAAM,YAAY,GAAyD,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC;YAAE,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;QAChC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO;QACnC,YAAY,EAAE,OAAO;QACrB,UAAU;QACV,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,YAAY;KACb,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW;IAC3C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,wEAAwE;AAExE,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,6DAA6D,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAChG,MAAM,KAAK,GACT,QAAQ,CAAC,WAAW,KAAK,CAAC;YACxB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YACtB,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;gBACvC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CACT,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,CAC5G,CAAC;QACF,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,IAA4B;IACjD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,kBAAkB,CACtH,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,QAAQ,CAAC,WAAW,KAAK,GAAG,IAAI,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAC7D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAClC,CAAC;QACF,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,OAAO,CAAC,+EAA+E,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAM7B;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,kBAAkB,CACtH,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,MAAM,GACV,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,iGAAiG,CAC9H,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC;IAChD,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,oEAAoE;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAgB,CAAC;QACtC,mEAAmE;QACnE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5B,kFAAkF;QAClF,MAAM,WAAW,GAAG,GAAG,OAAO,OAAO,CAAC;QACtC,MAAM,cAAc,GAAG;YACrB,qDAAqD;YACrD,iBAAiB,EAAE,CAAC,EAAE,EAAE;YACxB,iBAAiB,OAAO,EAAE;YAC1B,iBAAiB,UAAU,EAAE;YAC7B,iBAAiB,IAAI,EAAE;YACvB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,iBAAiB,GAAG,CAAC,MAAM,EAAE;SAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,mEAAmE;QACnE,aAAa,CAAC,WAAW,EAAE,cAAc,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GACf,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxF,MAAM,MAAM,GACV,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,EAAE;YACF,KAAK;YACL,EAAE;YACF,qBAAqB;YACrB,EAAE;YACF,0CAA0C,IAAI,IAAI;YAClD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gCAAgC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,EAAE;YACF,4DAA4D,EAAE,CAAC,EAAE,mFAAmF;YACpJ,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,OAAO,GACX,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,IAAI,CAAC,SAAS,CACZ;YACE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YAC1B,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC9E,EACD,IAAI,EACJ,CAAC,CACF;QACH,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC;IAE3B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,uEAAuE;QACvE,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,8DAA8D;QAC5G,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,WAAW,EAAE,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,IAAI,MAAM;YAAE,MAAM,EAAE,CAAC;;YAChB,QAAQ,EAAE,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;oBAClB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,eAAe,OAAO,EAAE,CAAC,OAAO,QAAQ,CAC9F,CAAC;oBACF,MAAM,EAAE,CAAC;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,cAAc,CAAC,CAAC,UAAU,qCAAqC,CACnH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CACT,MAAM,GAAG,CAAC;QACR,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,MAAM,EAAE;QACnD,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAC1C,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAE/F,GAAG;SACA,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAExC,GAAG;SACA,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,kBAAkB,EAAE,gDAAgD,CAAC;SAC5E,MAAM,CAAC,CAAC,IAA4B,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,GAAG;SACA,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,kBAAkB,EAAE,cAAc,CAAC;SAC1C,MAAM,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;SACpE,MAAM,CAAC,iBAAiB,EAAE,2DAA2D,CAAC;SACtF,MAAM,CAAC,cAAc,EAAE,yCAAyC,CAAC;SACjE,MAAM,CACL,cAAc,EACd,iFAAiF,CAClF;SACA,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC5E,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,GAAG;SACA,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;IAElC,OAAO,GAAG,CAAC;AACb,CAAC"}
|