@secureport/core 0.2.0 → 0.3.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,OAAO,GACR,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI3C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,SAAS,GACV,MAAM,eAAe,CAAC"}

package/dist/issue.d.ts

@@ -1,16 +1,195 @@
-/** Severity of an {@link Issue}, ordered from most to least urgent by convention. */
-export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
-/** Lifecycle state of an {@link Issue}. */
-export type IssueStatus = 'open' | 'triaging' | 'accepted' | 'resolved';
+import type { Severity } from './severity.js';
+import type { RunKind } from './run.js';
 /**
- * A tracked issue — the entity Secureport reports on. One or more findings
- * from one or more scanners can be merged into a single issue; the issue,
- * not the finding, is what carries status and severity through review.
+ * Where an issue is in its lifecycle.
+ *
+ * - `open` — currently detected, or detected recently enough not to be resolved.
+ * - `resolved` — no longer detected by runs that covered it.
+ * - `regressed` — was resolved, and has come back. Distinct from `open` because
+ *   a returning issue is a different and more interesting event than a new one.
+ * - `ignored` — deliberately suppressed, with a reason and an author.
+ *
+ * There is no `triaging` state. Triage is a person's activity, not an issue's
+ * condition, and a status nobody can define precisely is a status nobody
+ * filters on correctly.
+ */
+export type IssueStatus = 'open' | 'resolved' | 'regressed' | 'ignored';
+/**
+ * How an issue came into existence.
+ *
+ * Matters because **manual-origin issues never auto-resolve** (invariant 6): a
+ * human closes what a human opened.
+ */
+export type IssueOrigin = RunKind;
+/**
+ * Why an issue was suppressed.
+ *
+ * A fixed set rather than free text because this list is what a
+ * suppressed-findings appendix is grouped by, and an auditor reading it needs
+ * categories that mean the same thing every time.
+ */
+export type IgnoreReason = 'false_positive' | 'accepted_risk' | 'out_of_scope' | 'duplicate';
+/**
+ * How widely an ignore applies.
+ *
+ * - `target` — this issue on this target only. The default.
+ * - `org` — the same weakness anywhere in the organisation, matched on
+ *   `vulnKey` and normalised location, ignoring the parameter.
+ */
+export type IgnoreScope = 'target' | 'org';
+/**
+ * The tracked record that findings reconcile into, and the entity the product
+ * is actually about.
+ *
+ * An issue persists across runs. It carries status, severity, age, ownership
+ * and history; findings are the evidence beneath it. The distinction is the
+ * whole point of the model: two scanners reporting the same weakness produce
+ * one issue with two sources, not two rows, and an issue that comes back after
+ * being fixed is the same issue regressing rather than a new discovery.
+ *
+ * Unique on `(orgId, targetId, fingerprint)`.
+ *
+ * **Issue state changes only through reconciliation or an issue-service
+ * method, and every change emits an {@link IssueEvent}** (invariant 2).
  */
 export interface Issue {
-    id: string;
-    title: string;
-    severity: Severity;
-    status: IssueStatus;
+    /** Unique id. */
+    readonly id: string;
+    /** Organisation this issue belongs to. */
+    readonly orgId: string;
+    /**
+     * Target this issue is on.
+     *
+     * Part of the identity, and deliberately so: because the fingerprint includes
+     * the target, **the same weakness in staging and in production is two
+     * issues**. They are two systems, fixed separately, and verifying one must
+     * never authorise the other.
+     */
+    readonly targetId: string;
+    /** Content address of the weakness. Stable across runs and engines. */
+    readonly fingerprint: string;
+    /** Which algorithm produced {@link Issue.fingerprint}. */
+    readonly fingerprintVersion: string;
+    /** Human-readable name. Seeded from the first finding; editable afterwards. */
+    readonly title: string;
+    /** Engine-independent key for the weakness class. */
+    readonly vulnKey: string;
+    /** CWE identifier, where one applies. */
+    readonly cwe?: string;
+    /** Where the weakness is. */
+    readonly location: string;
+    /** The specific parameter implicated, where there is one. */
+    readonly parameter?: string;
+    /** Lifecycle state. */
+    readonly status: IssueStatus;
+    /**
+     * Severity as most recently detected.
+     *
+     * Follows the evidence. Changing it emits `severity_detected_changed`.
+     */
+    readonly detectedSeverity: Severity;
+    /**
+     * Severity that reports show, and that the SLA deadline derives from.
+     *
+     * Follows {@link Issue.detectedSeverity} unless a human has overridden it. A
+     * null override means the two move together.
+     */
+    readonly effectiveSeverity: Severity;
+    /** Why the severity was overridden. Present only when it was. */
+    readonly severityOverrideReason?: string;
+    /** Who overrode it. */
+    readonly severityOverriddenBy?: string;
+    /** When it was overridden. */
+    readonly severityOverriddenAt?: Date;
+    /**
+     * When this issue was first seen.
+     *
+     * **Never reset** (invariant 4) — not by a regression, not by a severity
+     * change, not by anything. It is what "how long has this been open" means,
+     * and resetting it would quietly erase the age of the oldest problems.
+     */
+    readonly firstSeen: Date;
+    /** When it was most recently detected. Keeps updating even while ignored. */
+    readonly lastSeen: Date;
+    /** When it was resolved, if it has been. */
+    readonly resolvedAt?: Date;
+    /** When it most recently regressed, if it has. */
+    readonly reopenedAt?: Date;
+    /**
+     * Consecutive covering runs that did not detect this issue.
+     *
+     * The auto-resolve counter, and the flapping guard: a single missed
+     * detection from a timeout or a rate limit should not close an issue. Reset
+     * to zero the moment the issue is seen again.
+     */
+    readonly consecutiveMisses: number;
+    /** How the issue came into existence. */
+    readonly origin: IssueOrigin;
+    /** Who it is assigned to, if anyone. */
+    readonly assignee?: string;
+    /** Key in an external tracker, set by the export. */
+    readonly externalRef?: string;
+    /** Why it is suppressed. Present only while `status` is `ignored`. */
+    readonly ignoreReason?: IgnoreReason;
+    /** Free-text justification for the suppression. Required when ignoring. */
+    readonly ignoreComment?: string;
+    /** How widely the suppression applies. */
+    readonly ignoreScope?: IgnoreScope;
+    /** When the suppression lapses, after which the issue re-surfaces. */
+    readonly ignoreExpiresAt?: Date;
+    /** Who suppressed it. */
+    readonly ignoredBy?: string;
+    /**
+     * Detected severity at the moment it was ignored.
+     *
+     * Recorded so that a *detected increase* re-surfaces the issue
+     * automatically: accepting the risk of a medium is not accepting the risk of
+     * the critical it later turns out to be.
+     */
+    readonly severityAtIgnore?: Severity;
+    /**
+     * When remediation is due, derived from {@link Issue.effectiveSeverity}.
+     *
+     * Recomputed whenever the effective severity changes. `null` where the
+     * severity carries no deadline.
+     */
+    readonly slaDueAt?: Date | null;
+}
+/**
+ * Something that happened to an issue.
+ *
+ * The audit trail and the source of every analytic. Nothing scans findings at
+ * request time: "issues resolved this quarter" and "regressions caught" are
+ * both counts over this log.
+ */
+export type IssueEventType = 'created' | 'seen' | 'severity_detected_changed' | 'severity_overridden' | 'resolved' | 'reopened' | 'ignored' | 'unignored' | 'commented' | 'assigned' | 'merged' | 'exported';
+/**
+ * An append-only record of a single change to an issue.
+ *
+ * Append-only is load-bearing rather than stylistic: it is what makes the
+ * history trustworthy as evidence, and what lets analytics be a query rather
+ * than a recomputation.
+ */
+export interface IssueEvent {
+    /** Unique id. */
+    readonly id: string;
+    /** Organisation this event belongs to. */
+    readonly orgId: string;
+    /** The issue it happened to. */
+    readonly issueId: string;
+    /** The run that caused it, where a run did. Absent for human actions. */
+    readonly runId?: string;
+    /** What happened. */
+    readonly type: IssueEventType;
+    /**
+     * Who or what did it — a user id, an API key id, or the reconciler.
+     *
+     * Never optional: an audit trail that cannot say who is not one.
+     */
+    readonly actor: string;
+    /** Type-specific detail, e.g. the old and new severity. */
+    readonly payload?: Readonly<Record<string, unknown>>;
+    /** When it happened. */
+    readonly createdAt: Date;
 }
 //# sourceMappingURL=issue.d.ts.map

package/dist/issue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB"}
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,eAAe,GAAG,cAAc,GAAG,WAAW,CAAC;AAE7F;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,KAAK;IACpB,iBAAiB;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,yCAAyC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,uBAAuB;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC;IAEpC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC;IAErC,iEAAiE;IACjE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEzC,uBAAuB;IACvB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAEvC,8BAA8B;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAErC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAExB,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAE3B,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAE3B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAErC,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC,sEAAsE;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;IAEhC,yBAAyB;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC;IAErC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,MAAM,GACN,2BAA2B,GAC3B,qBAAqB,GACrB,UAAU,GACV,UAAU,GACV,SAAS,GACT,WAAW,GACX,WAAW,GACX,UAAU,GACV,QAAQ,GACR,UAAU,CAAC;AAEf;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,iBAAiB;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,qBAAqB;IACrB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAErD,wBAAwB;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B"}

package/dist/reconcile.d.ts

@@ -1,15 +1,120 @@
-import type { Issue } from './issue.js';
-/** A raw scanner result, not yet folded into the tracked issue set. */
-export interface Finding {
-    title: string;
-    severity: Issue['severity'];
+import type { Finding } from './finding.js';
+import type { Issue, IssueEvent } from './issue.js';
+import type { Run, RunSummary } from './run.js';
+import { type SlaPolicy } from './severity.js';
+/**
+ * Everything reconciliation needs, and nothing it could get for itself.
+ *
+ * The clock and the id generator are arguments because the function is pure:
+ * no `Date.now()`, no `randomUUID()`, no I/O. The same inputs give the same
+ * issues and the same events, on any machine, which is what makes golden-file
+ * testing possible and what lets a run be replayed.
+ */
+export interface ReconcileInput {
+    /**
+     * Every known issue for this run's target.
+     *
+     * Issues for other targets must not be passed in: the fingerprint already
+     * includes the target, so they could never match, and including them would
+     * return them as untouched output and invite a caller to write them back.
+     */
+    readonly issues: readonly Issue[];
+    /** The findings this run produced. */
+    readonly findings: readonly Finding[];
+    /** The run itself, which supplies the target, the kind and the coverage. */
+    readonly run: Run;
+    /** The moment the run is being reconciled at. */
+    readonly now: Date;
+    /**
+     * Supplies ids for issues and events.
+     *
+     * Injected rather than generated so the function stays deterministic. A
+     * caller in production passes `randomUUID`; a test passes a counter.
+     */
+    readonly newId: () => string;
+    /**
+     * Who to record as having made these changes.
+     *
+     * Defaults to `reconciler`. An audit trail that cannot say who is not one.
+     */
+    readonly actor?: string;
+    /** Remediation windows, for recomputing `slaDueAt`. */
+    readonly slaPolicy?: SlaPolicy;
+    /**
+     * How many consecutive covering runs may miss an issue before it resolves.
+     *
+     * **The flapping guard.** Defaults to **1 for uploads** — the person
+     * uploading is asserting a complete result — and **2 for scans**, where a
+     * timeout or a rate limit causes a miss that means nothing. Between the first
+     * miss and resolution the issue stays open, and reports can say "not seen in
+     * last run".
+     *
+     * Per organisation in the hosted product; an argument here, because this
+     * function has nowhere to read configuration from.
+     */
+    readonly autoResolveThreshold?: number;
+    /** How long the run took, for the summary. */
+    readonly durationMs?: number;
+}
+/**
+ * What reconciliation decided.
+ *
+ * Returns **every** issue for the target, changed or not, so a caller can write
+ * the set back without working out which ones moved. Events are returned rather
+ * than applied: persisting them is the caller's transaction, and reconciliation
+ * has no I/O.
+ */
+export interface ReconcileResult {
+    /** Every issue for the target, after reconciliation. */
+    readonly issues: readonly Issue[];
+    /** What changed, in the order it was decided. */
+    readonly events: readonly IssueEvent[];
+    /** What the run did, in the terms a report opens with. */
+    readonly summary: RunSummary;
 }
 /**
- * Merges incoming findings into the tracked issue set. A finding whose title
- * matches an open issue is folded into it; anything new opens an issue.
+ * Turns a run's findings into issue state.
+ *
+ * **The only writer of issue state, and a pure function.** Given the same
+ * issues, findings, run and clock it produces the same result every time. It
+ * performs no I/O, reads no clock and generates no randomness; the caller
+ * supplies `now` and `newId` and persists what comes back.
+ *
+ * This half handles everything a **present** finding causes:
+ *
+ * - a fingerprint that matches nothing opens an issue (`created`);
+ * - a fingerprint that matches attaches evidence and refreshes `lastSeen`,
+ *   clearing the miss counter (`seen`);
+ * - a `resolved` issue seen again becomes `regressed` (`reopened`) — a returning
+ *   problem is a different and more interesting event than a new one;
+ * - a changed detected severity updates the issue, and updates the *effective*
+ *   severity and the SLA deadline only where nobody has overridden it
+ *   (`severity_detected_changed`);
+ * - an `ignored` issue whose detected severity has risen above what was
+ *   accepted comes back (`unignored`) — accepting the risk of a medium is not
+ *   accepting the risk of the critical it turned out to be.
+ *
+ * And everything an **absent** finding causes:
+ *
+ * - an issue the run covered but did not see takes a miss, and resolves once it
+ *   has missed enough consecutive covering runs (`resolved`);
+ * - an issue **outside** the run's coverage is untouched — not resolved, and not
+ *   even counted as a miss, so a sequence of narrow scans cannot accumulate
+ *   misses against a path none of them looked at (invariant 5);
+ * - a **manual-origin** issue never auto-resolves; a human closes what a human
+ *   opened (invariant 6);
+ * - a suppression whose expiry has passed lapses (`unignored`), regardless of
+ *   coverage — an ignore expiring is a decision timing out, not an observation.
+ *
+ * Finally it computes the {@link RunSummary}: counts by severity for new, still
+ * open, resolved, regressed and ignored, plus the exposure score. Ignored issues
+ * are excluded from every count but their own, and from exposure, and never from
+ * the suppressed appendix (invariant 7).
+ *
+ * `firstSeen` is never reset, by anything here (invariant 4).
  *
- * Pure: no I/O, no clock, no randomness. Callers supply the id for any issue
- * this opens via `nextId`.
+ * @param input - Issues, findings, the run, the clock and an id source.
+ * @returns Every issue for the target, plus the events that explain the changes.
  */
-export declare function reconcile(findings: Finding[], openIssues: Issue[], nextId: () => string): Issue[];
+export declare function reconcile(input: ReconcileInput): ReconcileResult;
 //# sourceMappingURL=reconcile.d.ts.map

package/dist/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,uEAAuE;AACvE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,KAAK,EAAE,CAgBjG"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,GAAG,EAAW,UAAU,EAAkB,MAAM,UAAU,CAAC;AACzE,OAAO,EAML,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AAGvB;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAElC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAEtC,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAElB,iDAAiD;IACjD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAEnB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,uDAAuD;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAE/B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAEvC,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAElC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IAEvC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B;AAgED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CA0OhE"}