@secureport/core 0.2.1 → 0.4.0

package/dist/import/zap.js

@@ -0,0 +1,119 @@
+import { fingerprint, vulnKey, FINGERPRINT_VERSION } from '../fingerprint.js';
+/**
+ * ZAP's `riskcode` mapped onto {@link Severity}.
+ *
+ * **ZAP has no "critical".** Its scale tops out at High (`3`), so nothing this
+ * importer produces is ever `critical` — a `critical` issue in a report that
+ * ZAP also detected got there from another engine, a CVSS score or a human.
+ * Worth knowing before wondering why a ZAP-only target has none.
+ */
+const ZAP_RISK = Object.freeze({
+    '3': 'high',
+    '2': 'medium',
+    '1': 'low',
+    '0': 'advisory',
+});
+const str = (v) => {
+    if (typeof v === 'number')
+        return String(v);
+    return typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined;
+};
+/** ZAP embeds HTML in its description and solution fields. */
+const stripHtml = (v) => v
+    .replace(/<[^>]*>/gu, ' ')
+    .replace(/\s+/gu, ' ')
+    .trim();
+/** ZAP's reference field is one string of newline-separated URLs. */
+const splitReferences = (v) => {
+    const text = str(v);
+    if (text === undefined)
+        return undefined;
+    const urls = stripHtml(text)
+        .split(/\s+/u)
+        .filter((token) => token.startsWith('http'));
+    return urls.length > 0 ? urls : undefined;
+};
+/**
+ * Turns a ZAP JSON report into {@link Finding}s.
+ *
+ * **One finding per instance, not per alert.** ZAP groups every occurrence of a
+ * weakness under a single alert with an `instances` array, so an alert is a
+ * class and an instance is a detection. Flattening is what lets two URLs
+ * affected by the same rule become two issues, and lets one of them be fixed
+ * without closing the other.
+ *
+ * An alert with no instances still produces one finding, against the site — a
+ * detection with no location is still a detection.
+ *
+ * Severity comes from ZAP's `riskcode`; see `ZAP_RISK` below for why nothing
+ * here is ever `critical`.
+ *
+ * @param json - The contents of a ZAP JSON report.
+ * @param options - Ownership, and the injected clock and id source.
+ * @returns One finding per instance, in report order.
+ * @throws SyntaxError If the report is not valid JSON. Unlike Nuclei's JSONL,
+ * where one bad line costs one record, a ZAP report is a single document: if it
+ * will not parse there is nothing to salvage and silence would be a lie.
+ */
+export function importZap(json, options) {
+    const report = JSON.parse(json);
+    const sites = Array.isArray(report.site) ? report.site : [];
+    const findings = [];
+    for (const site of sites) {
+        const siteName = str(site['@name']);
+        const alerts = Array.isArray(site.alerts) ? site.alerts : [];
+        for (const alert of alerts) {
+            const pluginId = str(alert.pluginid);
+            const title = str(alert.alert) ?? str(alert.name);
+            if (pluginId === undefined || title === undefined)
+                continue;
+            // ZAP writes `0` for "no CWE", which is not a CWE.
+            const rawCwe = str(alert.cweid);
+            const cwe = rawCwe !== undefined && rawCwe !== '0' && rawCwe !== '-1' ? `CWE-${rawCwe}` : undefined;
+            const key = vulnKey({
+                sourceEngine: 'zap',
+                sourceRuleId: pluginId,
+                ...(cwe === undefined ? {} : { cwe }),
+            });
+            const instances = Array.isArray(alert.instances) ? alert.instances : [];
+            const targets = instances.length > 0 ? instances : [{ uri: siteName }];
+            for (const instance of targets) {
+                const location = str(instance.uri) ?? siteName;
+                if (location === undefined)
+                    continue;
+                const parameter = str(instance.param);
+                findings.push({
+                    id: options.newId(),
+                    orgId: options.orgId,
+                    runId: options.runId,
+                    fingerprint: fingerprint({
+                        targetId: options.targetId,
+                        vulnKey: key,
+                        location,
+                        ...(parameter === undefined ? {} : { parameter }),
+                    }),
+                    fingerprintVersion: FINGERPRINT_VERSION,
+                    title,
+                    ...(str(alert.desc) === undefined ? {} : { description: stripHtml(str(alert.desc)) }),
+                    detectedSeverity: ZAP_RISK[str(alert.riskcode) ?? ''] ?? 'advisory',
+                    severitySource: 'engine_default',
+                    ...(cwe === undefined ? {} : { cwe }),
+                    vulnKey: key,
+                    location,
+                    ...(parameter === undefined ? {} : { parameter }),
+                    ...(str(alert.solution) === undefined
+                        ? {}
+                        : { recommendation: stripHtml(str(alert.solution)) }),
+                    ...(splitReferences(alert.reference) === undefined
+                        ? {}
+                        : { references: splitReferences(alert.reference) }),
+                    sourceEngine: 'zap',
+                    sourceRuleId: pluginId,
+                    createdAt: options.now,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=zap.js.map

package/dist/import/zap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zap.js","sourceRoot":"","sources":["../../src/import/zap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAG9E;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAuC,MAAM,CAAC,MAAM,CAAC;IACjE,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,UAAU;CAChB,CAAC,CAAC;AA+BH,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CACtC,CAAC;KACE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;KACzB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;KACrB,IAAI,EAAE,CAAC;AAEZ,qEAAqE;AACrE,MAAM,eAAe,GAAG,CAAC,CAAU,EAAwB,EAAE;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;SACzB,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,OAAsB;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAE5D,mDAAmD;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,GAAG,GACP,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAE1F,MAAM,GAAG,GAAG,OAAO,CAAC;gBAClB,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,QAAQ;gBACtB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;aACtC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,SAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,OAAO,GAAkB,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEtF,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;gBAC/C,IAAI,QAAQ,KAAK,SAAS;oBAAE,SAAS;gBACrC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAEtC,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE;oBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,WAAW,CAAC;wBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,OAAO,EAAE,GAAG;wBACZ,QAAQ;wBACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;qBAClD,CAAC;oBACF,kBAAkB,EAAE,mBAAmB;oBACvC,KAAK;oBACL,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,EAAE,CAAC;oBACtF,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,UAAU;oBACnE,cAAc,EAAE,gBAAgB;oBAChC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;oBACrC,OAAO,EAAE,GAAG;oBACZ,QAAQ;oBACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS;wBACnC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS;wBAChD,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,CAAE,EAAE,CAAC;oBACtD,YAAY,EAAE,KAAK;oBACnB,YAAY,EAAE,QAAQ;oBACtB,SAAS,EAAE,OAAO,CAAC,GAAG;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,42 @@
-export * from './issue.js';
-export * from './reconcile.js';
+/**
+ * The Secureport domain model.
+ *
+ * The tracked entity is the **issue**, not the finding. A {@link Run} produces
+ * {@link Finding}s, which are immutable evidence. Findings are fingerprinted
+ * and reconciled into {@link Issue}s, which persist across runs and carry
+ * status, severity, age and history. A {@link Snapshot} is issue state as of a
+ * run, and is the only thing a report ever reads.
+ *
+ * Zero runtime dependencies, by design: this package is imported by the hosted
+ * API and by third parties on equal terms, and a domain model should not drag
+ * anything in with it.
+ *
+ * @packageDocumentation
+ */
+export type { Finding } from './finding.js';
+export type { FingerprintInput, VulnKeyInput } from './fingerprint.js';
+export { FINGERPRINT_VERSION, PATH_PLACEHOLDER, VULN_KEY_MAP, fingerprint, normaliseLocation, vulnKey, } from './fingerprint.js';
+export type { IgnoreReason, IgnoreScope, Issue, IssueEvent, IssueEventType, IssueOrigin, IssueStatus, } from './issue.js';
+export { coversLocation } from './coverage.js';
+export type { ImportOptions } from './import/nuclei.js';
+export { importNuclei } from './import/nuclei.js';
+export { importZap } from './import/zap.js';
+export { importBurp } from './import/burp.js';
+export { importNessus } from './import/nessus.js';
+export type { GenericDocument, GenericFinding } from './import/generic.js';
+export { importGeneric } from './import/generic.js';
+export type { BuildSnapshotInput } from './snapshot-builder.js';
+export { buildSnapshot, parseSnapshot } from './snapshot-builder.js';
+export type { ReportKind, ReportModel, ReportOptions, ReportSection, RetestEntry, RetestOutcome, RetestVerdict, TestingBasis, } from './report/model.js';
+export { buildReportModel } from './report/model.js';
+export { renderMarkdown } from './report/markdown.js';
+export { renderHtml } from './report/html.js';
+export type { JsonReport } from './report/json.js';
+export { renderJson } from './report/json.js';
+export type { ReconcileInput, ReconcileResult } from './reconcile.js';
+export { reconcile } from './reconcile.js';
+export type { Coverage, Run, RunKind, RunSummary, RunTrigger, SeverityCounts } from './run.js';
+export type { IssueChange, Snapshot, SnapshotIssue, SuppressedIssue, Target } from './snapshot.js';
+export type { Severity, SeveritySource, SlaPolicy, SlaStatus } from './severity.js';
+export { DEFAULT_SLA_POLICY, SEVERITY_ORDER, SEVERITY_SOURCE_PRECEDENCE, SEVERITY_WEIGHTS, severityFromCvss, severityRank, slaDueAt, slaStatus, } from './severity.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,OAAO,GACR,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,KAAK,EACL,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,EACb,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/F,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnG,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,SAAS,GACV,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,3 +1,30 @@
-export * from './issue.js';
-export * from './reconcile.js';
+/**
+ * The Secureport domain model.
+ *
+ * The tracked entity is the **issue**, not the finding. A {@link Run} produces
+ * {@link Finding}s, which are immutable evidence. Findings are fingerprinted
+ * and reconciled into {@link Issue}s, which persist across runs and carry
+ * status, severity, age and history. A {@link Snapshot} is issue state as of a
+ * run, and is the only thing a report ever reads.
+ *
+ * Zero runtime dependencies, by design: this package is imported by the hosted
+ * API and by third parties on equal terms, and a domain model should not drag
+ * anything in with it.
+ *
+ * @packageDocumentation
+ */
+export { FINGERPRINT_VERSION, PATH_PLACEHOLDER, VULN_KEY_MAP, fingerprint, normaliseLocation, vulnKey, } from './fingerprint.js';
+export { coversLocation } from './coverage.js';
+export { importNuclei } from './import/nuclei.js';
+export { importZap } from './import/zap.js';
+export { importBurp } from './import/burp.js';
+export { importNessus } from './import/nessus.js';
+export { importGeneric } from './import/generic.js';
+export { buildSnapshot, parseSnapshot } from './snapshot-builder.js';
+export { buildReportModel } from './report/model.js';
+export { renderMarkdown } from './report/markdown.js';
+export { renderHtml } from './report/html.js';
+export { renderJson } from './report/json.js';
+export { reconcile } from './reconcile.js';
+export { DEFAULT_SLA_POLICY, SEVERITY_ORDER, SEVERITY_SOURCE_PRECEDENCE, SEVERITY_WEIGHTS, severityFromCvss, severityRank, slaDueAt, slaStatus, } from './severity.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,OAAO,GACR,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAWrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI3C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,SAAS,GACV,MAAM,eAAe,CAAC"}

package/dist/issue.d.ts

@@ -1,16 +1,195 @@
-/** Severity of an {@link Issue}, ordered from most to least urgent by convention. */
-export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
-/** Lifecycle state of an {@link Issue}. */
-export type IssueStatus = 'open' | 'triaging' | 'accepted' | 'resolved';
+import type { Severity } from './severity.js';
+import type { RunKind } from './run.js';
 /**
- * A tracked issue — the entity Secureport reports on. One or more findings
- * from one or more scanners can be merged into a single issue; the issue,
- * not the finding, is what carries status and severity through review.
+ * Where an issue is in its lifecycle.
+ *
+ * - `open` — currently detected, or detected recently enough not to be resolved.
+ * - `resolved` — no longer detected by runs that covered it.
+ * - `regressed` — was resolved, and has come back. Distinct from `open` because
+ *   a returning issue is a different and more interesting event than a new one.
+ * - `ignored` — deliberately suppressed, with a reason and an author.
+ *
+ * There is no `triaging` state. Triage is a person's activity, not an issue's
+ * condition, and a status nobody can define precisely is a status nobody
+ * filters on correctly.
+ */
+export type IssueStatus = 'open' | 'resolved' | 'regressed' | 'ignored';
+/**
+ * How an issue came into existence.
+ *
+ * Matters because **manual-origin issues never auto-resolve** (invariant 6): a
+ * human closes what a human opened.
+ */
+export type IssueOrigin = RunKind;
+/**
+ * Why an issue was suppressed.
+ *
+ * A fixed set rather than free text because this list is what a
+ * suppressed-findings appendix is grouped by, and an auditor reading it needs
+ * categories that mean the same thing every time.
+ */
+export type IgnoreReason = 'false_positive' | 'accepted_risk' | 'out_of_scope' | 'duplicate';
+/**
+ * How widely an ignore applies.
+ *
+ * - `target` — this issue on this target only. The default.
+ * - `org` — the same weakness anywhere in the organisation, matched on
+ *   `vulnKey` and normalised location, ignoring the parameter.
+ */
+export type IgnoreScope = 'target' | 'org';
+/**
+ * The tracked record that findings reconcile into, and the entity the product
+ * is actually about.
+ *
+ * An issue persists across runs. It carries status, severity, age, ownership
+ * and history; findings are the evidence beneath it. The distinction is the
+ * whole point of the model: two scanners reporting the same weakness produce
+ * one issue with two sources, not two rows, and an issue that comes back after
+ * being fixed is the same issue regressing rather than a new discovery.
+ *
+ * Unique on `(orgId, targetId, fingerprint)`.
+ *
+ * **Issue state changes only through reconciliation or an issue-service
+ * method, and every change emits an {@link IssueEvent}** (invariant 2).
  */
 export interface Issue {
-    id: string;
-    title: string;
-    severity: Severity;
-    status: IssueStatus;
+    /** Unique id. */
+    readonly id: string;
+    /** Organisation this issue belongs to. */
+    readonly orgId: string;
+    /**
+     * Target this issue is on.
+     *
+     * Part of the identity, and deliberately so: because the fingerprint includes
+     * the target, **the same weakness in staging and in production is two
+     * issues**. They are two systems, fixed separately, and verifying one must
+     * never authorise the other.
+     */
+    readonly targetId: string;
+    /** Content address of the weakness. Stable across runs and engines. */
+    readonly fingerprint: string;
+    /** Which algorithm produced {@link Issue.fingerprint}. */
+    readonly fingerprintVersion: string;
+    /** Human-readable name. Seeded from the first finding; editable afterwards. */
+    readonly title: string;
+    /** Engine-independent key for the weakness class. */
+    readonly vulnKey: string;
+    /** CWE identifier, where one applies. */
+    readonly cwe?: string;
+    /** Where the weakness is. */
+    readonly location: string;
+    /** The specific parameter implicated, where there is one. */
+    readonly parameter?: string;
+    /** Lifecycle state. */
+    readonly status: IssueStatus;
+    /**
+     * Severity as most recently detected.
+     *
+     * Follows the evidence. Changing it emits `severity_detected_changed`.
+     */
+    readonly detectedSeverity: Severity;
+    /**
+     * Severity that reports show, and that the SLA deadline derives from.
+     *
+     * Follows {@link Issue.detectedSeverity} unless a human has overridden it. A
+     * null override means the two move together.
+     */
+    readonly effectiveSeverity: Severity;
+    /** Why the severity was overridden. Present only when it was. */
+    readonly severityOverrideReason?: string;
+    /** Who overrode it. */
+    readonly severityOverriddenBy?: string;
+    /** When it was overridden. */
+    readonly severityOverriddenAt?: Date;
+    /**
+     * When this issue was first seen.
+     *
+     * **Never reset** (invariant 4) — not by a regression, not by a severity
+     * change, not by anything. It is what "how long has this been open" means,
+     * and resetting it would quietly erase the age of the oldest problems.
+     */
+    readonly firstSeen: Date;
+    /** When it was most recently detected. Keeps updating even while ignored. */
+    readonly lastSeen: Date;
+    /** When it was resolved, if it has been. */
+    readonly resolvedAt?: Date;
+    /** When it most recently regressed, if it has. */
+    readonly reopenedAt?: Date;
+    /**
+     * Consecutive covering runs that did not detect this issue.
+     *
+     * The auto-resolve counter, and the flapping guard: a single missed
+     * detection from a timeout or a rate limit should not close an issue. Reset
+     * to zero the moment the issue is seen again.
+     */
+    readonly consecutiveMisses: number;
+    /** How the issue came into existence. */
+    readonly origin: IssueOrigin;
+    /** Who it is assigned to, if anyone. */
+    readonly assignee?: string;
+    /** Key in an external tracker, set by the export. */
+    readonly externalRef?: string;
+    /** Why it is suppressed. Present only while `status` is `ignored`. */
+    readonly ignoreReason?: IgnoreReason;
+    /** Free-text justification for the suppression. Required when ignoring. */
+    readonly ignoreComment?: string;
+    /** How widely the suppression applies. */
+    readonly ignoreScope?: IgnoreScope;
+    /** When the suppression lapses, after which the issue re-surfaces. */
+    readonly ignoreExpiresAt?: Date;
+    /** Who suppressed it. */
+    readonly ignoredBy?: string;
+    /**
+     * Detected severity at the moment it was ignored.
+     *
+     * Recorded so that a *detected increase* re-surfaces the issue
+     * automatically: accepting the risk of a medium is not accepting the risk of
+     * the critical it later turns out to be.
+     */
+    readonly severityAtIgnore?: Severity;
+    /**
+     * When remediation is due, derived from {@link Issue.effectiveSeverity}.
+     *
+     * Recomputed whenever the effective severity changes. `null` where the
+     * severity carries no deadline.
+     */
+    readonly slaDueAt?: Date | null;
+}
+/**
+ * Something that happened to an issue.
+ *
+ * The audit trail and the source of every analytic. Nothing scans findings at
+ * request time: "issues resolved this quarter" and "regressions caught" are
+ * both counts over this log.
+ */
+export type IssueEventType = 'created' | 'seen' | 'severity_detected_changed' | 'severity_overridden' | 'resolved' | 'reopened' | 'ignored' | 'unignored' | 'commented' | 'assigned' | 'merged' | 'exported';
+/**
+ * An append-only record of a single change to an issue.
+ *
+ * Append-only is load-bearing rather than stylistic: it is what makes the
+ * history trustworthy as evidence, and what lets analytics be a query rather
+ * than a recomputation.
+ */
+export interface IssueEvent {
+    /** Unique id. */
+    readonly id: string;
+    /** Organisation this event belongs to. */
+    readonly orgId: string;
+    /** The issue it happened to. */
+    readonly issueId: string;
+    /** The run that caused it, where a run did. Absent for human actions. */
+    readonly runId?: string;
+    /** What happened. */
+    readonly type: IssueEventType;
+    /**
+     * Who or what did it — a user id, an API key id, or the reconciler.
+     *
+     * Never optional: an audit trail that cannot say who is not one.
+     */
+    readonly actor: string;
+    /** Type-specific detail, e.g. the old and new severity. */
+    readonly payload?: Readonly<Record<string, unknown>>;
+    /** When it happened. */
+    readonly createdAt: Date;
 }
 //# sourceMappingURL=issue.d.ts.map

package/dist/issue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB"}
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,eAAe,GAAG,cAAc,GAAG,WAAW,CAAC;AAE7F;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,KAAK;IACpB,iBAAiB;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,yCAAyC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,uBAAuB;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC;IAEpC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC;IAErC,iEAAiE;IACjE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEzC,uBAAuB;IACvB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAEvC,8BAA8B;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAErC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAExB,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAE3B,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAE3B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAErC,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC,sEAAsE;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;IAEhC,yBAAyB;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC;IAErC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,MAAM,GACN,2BAA2B,GAC3B,qBAAqB,GACrB,UAAU,GACV,UAAU,GACV,SAAS,GACT,WAAW,GACX,WAAW,GACX,UAAU,GACV,QAAQ,GACR,UAAU,CAAC;AAEf;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,iBAAiB;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,qBAAqB;IACrB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAErD,wBAAwB;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B"}

package/dist/reconcile.d.ts

@@ -1,15 +1,120 @@
-import type { Issue } from './issue.js';
-/** A raw scanner result, not yet folded into the tracked issue set. */
-export interface Finding {
-    title: string;
-    severity: Issue['severity'];
+import type { Finding } from './finding.js';
+import type { Issue, IssueEvent } from './issue.js';
+import type { Run, RunSummary } from './run.js';
+import { type SlaPolicy } from './severity.js';
+/**
+ * Everything reconciliation needs, and nothing it could get for itself.
+ *
+ * The clock and the id generator are arguments because the function is pure:
+ * no `Date.now()`, no `randomUUID()`, no I/O. The same inputs give the same
+ * issues and the same events, on any machine, which is what makes golden-file
+ * testing possible and what lets a run be replayed.
+ */
+export interface ReconcileInput {
+    /**
+     * Every known issue for this run's target.
+     *
+     * Issues for other targets must not be passed in: the fingerprint already
+     * includes the target, so they could never match, and including them would
+     * return them as untouched output and invite a caller to write them back.
+     */
+    readonly issues: readonly Issue[];
+    /** The findings this run produced. */
+    readonly findings: readonly Finding[];
+    /** The run itself, which supplies the target, the kind and the coverage. */
+    readonly run: Run;
+    /** The moment the run is being reconciled at. */
+    readonly now: Date;
+    /**
+     * Supplies ids for issues and events.
+     *
+     * Injected rather than generated so the function stays deterministic. A
+     * caller in production passes `randomUUID`; a test passes a counter.
+     */
+    readonly newId: () => string;
+    /**
+     * Who to record as having made these changes.
+     *
+     * Defaults to `reconciler`. An audit trail that cannot say who is not one.
+     */
+    readonly actor?: string;
+    /** Remediation windows, for recomputing `slaDueAt`. */
+    readonly slaPolicy?: SlaPolicy;
+    /**
+     * How many consecutive covering runs may miss an issue before it resolves.
+     *
+     * **The flapping guard.** Defaults to **1 for uploads** — the person
+     * uploading is asserting a complete result — and **2 for scans**, where a
+     * timeout or a rate limit causes a miss that means nothing. Between the first
+     * miss and resolution the issue stays open, and reports can say "not seen in
+     * last run".
+     *
+     * Per organisation in the hosted product; an argument here, because this
+     * function has nowhere to read configuration from.
+     */
+    readonly autoResolveThreshold?: number;
+    /** How long the run took, for the summary. */
+    readonly durationMs?: number;
+}
+/**
+ * What reconciliation decided.
+ *
+ * Returns **every** issue for the target, changed or not, so a caller can write
+ * the set back without working out which ones moved. Events are returned rather
+ * than applied: persisting them is the caller's transaction, and reconciliation
+ * has no I/O.
+ */
+export interface ReconcileResult {
+    /** Every issue for the target, after reconciliation. */
+    readonly issues: readonly Issue[];
+    /** What changed, in the order it was decided. */
+    readonly events: readonly IssueEvent[];
+    /** What the run did, in the terms a report opens with. */
+    readonly summary: RunSummary;
 }
 /**
- * Merges incoming findings into the tracked issue set. A finding whose title
- * matches an open issue is folded into it; anything new opens an issue.
+ * Turns a run's findings into issue state.
+ *
+ * **The only writer of issue state, and a pure function.** Given the same
+ * issues, findings, run and clock it produces the same result every time. It
+ * performs no I/O, reads no clock and generates no randomness; the caller
+ * supplies `now` and `newId` and persists what comes back.
+ *
+ * This half handles everything a **present** finding causes:
+ *
+ * - a fingerprint that matches nothing opens an issue (`created`);
+ * - a fingerprint that matches attaches evidence and refreshes `lastSeen`,
+ *   clearing the miss counter (`seen`);
+ * - a `resolved` issue seen again becomes `regressed` (`reopened`) — a returning
+ *   problem is a different and more interesting event than a new one;
+ * - a changed detected severity updates the issue, and updates the *effective*
+ *   severity and the SLA deadline only where nobody has overridden it
+ *   (`severity_detected_changed`);
+ * - an `ignored` issue whose detected severity has risen above what was
+ *   accepted comes back (`unignored`) — accepting the risk of a medium is not
+ *   accepting the risk of the critical it turned out to be.
+ *
+ * And everything an **absent** finding causes:
+ *
+ * - an issue the run covered but did not see takes a miss, and resolves once it
+ *   has missed enough consecutive covering runs (`resolved`);
+ * - an issue **outside** the run's coverage is untouched — not resolved, and not
+ *   even counted as a miss, so a sequence of narrow scans cannot accumulate
+ *   misses against a path none of them looked at (invariant 5);
+ * - a **manual-origin** issue never auto-resolves; a human closes what a human
+ *   opened (invariant 6);
+ * - a suppression whose expiry has passed lapses (`unignored`), regardless of
+ *   coverage — an ignore expiring is a decision timing out, not an observation.
+ *
+ * Finally it computes the {@link RunSummary}: counts by severity for new, still
+ * open, resolved, regressed and ignored, plus the exposure score. Ignored issues
+ * are excluded from every count but their own, and from exposure, and never from
+ * the suppressed appendix (invariant 7).
+ *
+ * `firstSeen` is never reset, by anything here (invariant 4).
  *
- * Pure: no I/O, no clock, no randomness. Callers supply the id for any issue
- * this opens via `nextId`.
+ * @param input - Issues, findings, the run, the clock and an id source.
+ * @returns Every issue for the target, plus the events that explain the changes.
  */
-export declare function reconcile(findings: Finding[], openIssues: Issue[], nextId: () => string): Issue[];
+export declare function reconcile(input: ReconcileInput): ReconcileResult;
 //# sourceMappingURL=reconcile.d.ts.map

package/dist/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,uEAAuE;AACvE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,KAAK,EAAE,CAgBjG"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,GAAG,EAAW,UAAU,EAAkB,MAAM,UAAU,CAAC;AACzE,OAAO,EAML,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AAGvB;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAElC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAEtC,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAElB,iDAAiD;IACjD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAEnB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,uDAAuD;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAE/B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAEvC,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAElC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IAEvC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B;AAgED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CA0OhE"}