@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/report/html-report.js

@@ -0,0 +1,489 @@
+/**
+ * THE CLIENT REPORT
+ * =================
+ *
+ * The terminal report is for the person who ran the scan. This one is for the
+ * person who did not: a project owner who will read it once, possibly printed,
+ * and decide what to do. It is one self-contained HTML file - no script, no
+ * stylesheet or font fetched from anywhere, the mark drawn inline - so it can
+ * be emailed, opened offline and printed to PDF from any browser.
+ *
+ * It says the same things the terminal does, in the same order of trust:
+ *
+ *   1. what was PROVEN, each with the path that proves it;
+ *   2. what was only MATCHED, said plainly to be unproven;
+ *   3. what was checked and CLEARED, with the reason;
+ *   4. what was NOT CHECKED at all.
+ *
+ * The fourth section is not an appendix to skip. A report that lists problems
+ * and stays silent about what it never looked at invites the reader to treat
+ * "not listed" as "fine" - the exact failure this tool exists to avoid - and a
+ * client report is where that misreading costs the most.
+ *
+ * Two labels, never blended: a proven finding is a filled dot, a guess a
+ * hollow ring, so the difference survives a black-and-white printer. The
+ * mark's purple is used on the mark and the name only.
+ *
+ * PLATFORM-FREE ON PURPOSE: string in, string out, no Node imports, so the
+ * browser UI can produce the same file from the same engine.
+ *
+ * EVERY PIECE OF TEXT FROM THE SCANNED CODE IS ESCAPED. A snippet is whatever
+ * the scanned project contains, and a report that rendered it as markup would
+ * be an XSS vector aimed at the person reading a security report. The test
+ * suite feeds it a hostile snippet to make sure.
+ */
+import { LICENCE_SPDX } from '../core/licence.js';
+import { LANGUAGES } from '../parse/languages.js';
+import { ALL_RULES } from '../rules/registry.js';
+import { readableDate, RUNTIME_VERSION_RULE } from '../platform/runtime-version.js';
+import { DEPENDENCY_RULE } from '../platform/dependency-rule.js';
+import { isTestPath } from '../rules/lib/strings.js';
+import { markSvg } from './mark.js';
+const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+const SEVERITY_LABEL = {
+    critical: 'Critical',
+    high: 'High',
+    medium: 'Medium',
+    low: 'Low',
+    info: 'Info',
+};
+/** Escape for HTML text and attribute values. Everything from the scan goes through this. */
+export function escapeHtml(text) {
+    return text
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+const e = escapeHtml;
+/** A receipt starts lower-case so it reads inside a sentence; a table cell starts a sentence. */
+function capitalise(text) {
+    return text.charAt(0).toUpperCase() + text.slice(1);
+}
+function plural(n, one, many = `${one}s`) {
+    return `${n.toLocaleString('en-US')} ${n === 1 ? one : many}`;
+}
+/** The path as the reader knows it: relative to the scanned folder, forward slashes. */
+function relativeTo(...roots) {
+    const norm = (p) => p.replace(/\\/g, '/');
+    const bases = roots
+        .map((r) => norm(r).replace(/^\.\//, '').replace(/\/+$/, ''))
+        .filter((b) => b && b !== '.');
+    return (file) => {
+        const f = norm(file).replace(/^\.\//, '');
+        for (const base of bases)
+            if (f.startsWith(`${base}/`))
+                return f.slice(base.length + 1);
+        return f;
+    };
+}
+function lastSegment(path) {
+    const parts = path.replace(/\\/g, '/').replace(/\/+$/, '').split('/');
+    return parts[parts.length - 1] || path;
+}
+/*
+ * A REPORT IS NOT A SAFE PLACE FOR A SECRET. The terminal and --json show a
+ * hardcoded credential in full, because the person running the scan already
+ * has the code. This file is made to be sent to someone, so the value of a
+ * reported secret is cut to at most its first three characters (fewer for a
+ * short one) and its length - enough to find it in the code, not to use it.
+ */
+export function maskSecretLiterals(snippet) {
+    return snippet.replace(/(["'`])((?:\\.|(?!\1)[^\\])*)\1/g, (whole, quote, inner) => inner.length < 4
+        ? whole
+        : `${quote}${inner.slice(0, Math.min(3, Math.floor(inner.length / 4)))}…${quote} [${inner.length} characters, hidden in this report]`);
+}
+function bySeverityThenPlace(a, b) {
+    const s = SEVERITIES.indexOf(a.severity) - SEVERITIES.indexOf(b.severity);
+    if (s !== 0)
+        return s;
+    const f = a.location.file.localeCompare(b.location.file);
+    return f !== 0 ? f : a.location.startLine - b.location.startLine;
+}
+function countBySeverity(findings) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings)
+        counts[f.severity]++;
+    return counts;
+}
+export function renderHtmlReport(result, options) {
+    const rel = relativeTo(result.target, options.root ?? '');
+    const rules = new Map(ALL_RULES.map((r) => [r.id, r]));
+    const proven = result.findings.filter((f) => f.confidence === 'flow-verified').sort(bySeverityThenPlace);
+    const guessed = result.findings.filter((f) => f.confidence === 'signature-based').sort(bySeverityThenPlace);
+    const cleared = [...result.verifiedClean].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+    const guessedInTests = guessed.filter((f) => isTestPath(f.location.file));
+    const project = options.projectName?.trim() || lastSegment(result.target);
+    const date = options.generatedAt.toISOString().slice(0, 10);
+    const version = result.coverage.engine.version;
+    const languagesSeen = Object.entries(result.byLanguage)
+        .filter(([, n]) => n > 0)
+        .sort((a, b) => b[1] - a[1])
+        .map(([id, n]) => `${LANGUAGES.find((l) => l.id === id)?.displayName ?? id} (${n.toLocaleString('en-US')})`);
+    /* ------------------------------------------------------------ pieces -- */
+    const severityPill = (s) => `<span class="sev sev-${s}">${SEVERITY_LABEL[s]}</span>`;
+    const where = (file, line) => `<span class="where">${e(rel(file))}:${line}</span>`;
+    const code = (text) => `<code class="snippet">${e(text)}</code>`;
+    const stepLabel = {
+        source: 'Enters',
+        propagation: 'Passes',
+        sanitizer: 'Cleaned',
+        sink: 'Lands',
+    };
+    const provenCard = (f, index) => {
+        const rule = rules.get(f.ruleId);
+        const steps = (f.flowPath ?? [])
+            .map((s) => `<li class="step step-${s.kind}"><span class="step-kind">${stepLabel[s.kind]}</span>` +
+            `<span class="step-body">${where(s.location.file, s.location.startLine)} ${code(s.location.snippet)}` +
+            `<span class="step-why">${e(s.description)}</span></span></li>`)
+            .join('');
+        return (`<article class="finding card proven" data-rule="${e(f.ruleId)}">` +
+            `<header><span class="dot dot-proven" aria-hidden="true"></span>` +
+            `<span class="num">P${index + 1}</span>${severityPill(f.severity)}` +
+            `<h3>${e(f.ruleName)}</h3></header>` +
+            `<p class="loc">${where(f.location.file, f.location.startLine)}</p>` +
+            `<p class="what">${e(f.message)}</p>` +
+            `<h4>The path Defuse followed</h4><ol class="path">${steps}</ol>` +
+            (rule ? `<h4>What this is, and how to fix it</h4><p>${e(rule.explanation)}</p>` : '') +
+            `<p class="ref">${e(f.cwe)} · ${e(f.owasp)}</p>` +
+            `</article>`);
+    };
+    const shown = (f) => f.ruleId === 'hardcoded-secret' ? maskSecretLiterals(f.location.snippet) : f.location.snippet;
+    const guessRow = (f, ruleLimitations) => `<tr class="finding guess"><td>${severityPill(f.severity)}</td>` +
+        `<td>${where(f.location.file, f.location.startLine)}</td>` +
+        `<td><div>${e(f.message)}</div>${code(shown(f))}` +
+        (f.limitations && f.limitations !== ruleLimitations
+            ? `<div class="hitnote">${e(f.limitations)}</div>`
+            : '') +
+        `</td></tr>`;
+    const guessTable = (rows, ruleLimitations) => `<table class="rows"><thead><tr><th>Severity</th><th>Where</th><th>What was matched</th></tr></thead>` +
+        `<tbody>${rows.map((f) => guessRow(f, ruleLimitations)).join('')}</tbody></table>`;
+    /* ----------------------------------------------------------- sections -- */
+    const provenCounts = countBySeverity(proven);
+    const guessedCounts = countBySeverity(guessed);
+    const severityTable = `<table class="sevtable"><thead><tr><th></th>${SEVERITIES.filter((s) => s !== 'info')
+        .map((s) => `<th>${SEVERITY_LABEL[s]}</th>`)
+        .join('')}</tr></thead><tbody>` +
+        `<tr><th><span class="dot dot-proven" aria-hidden="true"></span>Proven</th>${SEVERITIES.filter((s) => s !== 'info')
+            .map((s) => `<td>${provenCounts[s]}</td>`)
+            .join('')}</tr>` +
+        `<tr><th><span class="dot dot-guess" aria-hidden="true"></span>To review</th>${SEVERITIES.filter((s) => s !== 'info')
+            .map((s) => `<td>${guessedCounts[s]}</td>`)
+            .join('')}</tr></tbody></table>`;
+    const verdict = (proven.length > 0
+        ? `Defuse proved ${plural(proven.length, 'problem')} by following attacker-controlled input to the place it does harm. `
+        : 'Defuse did not prove any problem in this code. That is not the same as finding none - see section 4 for what it does not check. ') +
+        (guessed.length > 0
+            ? `It also found ${plural(guessed.length, 'place')} that match a known risky pattern and need a person to check them` +
+                (guessedInTests.length > 0 ? ` (${guessedInTests.length.toLocaleString('en-US')} of them in test or example files)` : '') +
+                '. '
+            : 'Nothing else matched a risky pattern. ') +
+        (cleared.length > 0
+            ? `${plural(cleared.length, 'line')} that looked risky ${cleared.length === 1 ? 'was' : 'were'} checked and cleared, each with the reason.`
+            : '');
+    const provenSection = `<section id="proven"><h2><span class="secnum">1</span>Proven problems</h2>` +
+        `<p class="lead">Each of these comes with the path Defuse followed: where outside input enters, every step it passes through, and where it lands. ` +
+        `Read the path - it is the evidence, and it can be checked line by line. A step marked as passing through a function Defuse does not know is an assumption, and says so.</p>` +
+        (proven.length > 0
+            ? proven.map(provenCard).join('')
+            : `<p class="empty">No problem was proven. Section 2 lists what still needs a person to look at it, and section 4 what was not checked.</p>`) +
+        `</section>`;
+    const guessGroups = [...new Set(guessed.map((f) => f.ruleId))]
+        .map((id) => ({ id, rows: guessed.filter((f) => f.ruleId === id) }))
+        .sort((a, b) => {
+        const top = (rows) => Math.min(...rows.map((f) => SEVERITIES.indexOf(f.severity)));
+        return top(a.rows) - top(b.rows) || b.rows.length - a.rows.length;
+    });
+    const guessSection = `<section id="review"><h2><span class="secnum">2</span>To review: matched, not proven</h2>` +
+        `<p class="lead">These lines match the shape of a known problem, but Defuse could not follow the data to prove it. ` +
+        `Some will be real and some will be false alarms. Under each heading is what the check cannot tell - that is the question a reviewer has to answer for each line. ` +
+        `Lines in test and example files are listed separately: they rarely run in production, but they are still in the code.</p>` +
+        (guessGroups.length > 0
+            ? guessGroups
+                .map(({ id, rows }) => {
+                const rule = rules.get(id);
+                const name = rule?.name ?? rows[0]?.ruleName ?? id;
+                const limits = rule?.limitations ?? rows[0]?.limitations ?? '';
+                const main = rows.filter((f) => !isTestPath(f.location.file));
+                const tests = rows.filter((f) => isTestPath(f.location.file));
+                return (`<div class="group" data-rule="${e(id)}"><h3><span class="dot dot-guess" aria-hidden="true"></span>${e(name)} <span class="count">${rows.length}</span></h3>` +
+                    ((explain) => (explain ? `<p class="explain">${e(explain)}</p>` : ''))(rule?.explanation ?? [RUNTIME_VERSION_RULE, DEPENDENCY_RULE].find((r) => r.id === id)?.explanation) +
+                    `<p class="limits"><strong>What this check cannot tell:</strong> ${e(limits)}</p>` +
+                    (id === 'hardcoded-secret'
+                        ? `<p class="hitnote">The values below are cut to their first three characters, so this report does not pass the secrets on. The full values are in the code, and in the scan's own output.</p>`
+                        : '') +
+                    (main.length > 0 ? `<h4>In the application code (${main.length})</h4>${guessTable(main, limits)}` : '') +
+                    (tests.length > 0 ? `<h4>In test and example files (${tests.length})</h4>${guessTable(tests, limits)}` : '') +
+                    `</div>`);
+            })
+                .join('')
+            : `<p class="empty">Nothing matched a risky pattern.</p>`) +
+        `</section>`;
+    const clearedSection = `<section id="cleared"><h2><span class="secnum">3</span>Checked and cleared</h2>` +
+        `<p class="lead">These lines looked like a problem, and Defuse proved they are not - a value that is fixed on every path, a sanitiser that is shown to run, or the code's own statement of purpose. ` +
+        `Each reason is the claim it rests on. A row marked <strong>assumes</strong> also rests on a function Defuse does not model, ` +
+        `which the value went through after it was cleaned and which was taken to hand back what it was given - if that function undoes the cleaning, the row is wrong.` +
+        (result.stats.regionsProvedUnreachable > 0
+            ? ` Separately, ${plural(result.stats.regionsProvedUnreachable, 'branch', 'branches')} were skipped because a fixed condition means they cannot run.`
+            : '') +
+        `</p>` +
+        (cleared.length > 0
+            ? `<table class="rows"><thead><tr><th>Where</th><th>Check</th><th>Why it is clear</th></tr></thead><tbody>` +
+                cleared
+                    .map((c) => `<tr class="cleared"><td>${where(c.file, c.line)}</td><td>${e(rules.get(c.ruleId)?.name ?? c.ruleId)}</td>` +
+                    `<td>${e(capitalise(c.reason ?? 'no reason was recorded for this line'))}` +
+                    (c.assumes && c.assumes.length > 0
+                        ? `<br><strong>Assumes</strong> ${e(c.assumes.map((n) => `${n}()`).join(', '))} ` +
+                            `${c.assumes.length === 1 ? 'hands' : 'hand'} back what ${c.assumes.length === 1 ? 'it was' : 'they were'} given.`
+                        : '') +
+                    `</td></tr>`)
+                    .join('') +
+                `</tbody></table>`
+            : `<p class="empty">No line needed clearing.</p>`) +
+        `</section>`;
+    /* ---- 4. what was not checked ---- */
+    const presentLanguages = new Set(Object.entries(result.byLanguage).filter(([, n]) => n > 0).map(([id]) => id));
+    const gapsHere = result.coverage.gaps.filter((g) => presentLanguages.has(g.language));
+    const noRule = result.coverage.owaspCoverage.filter((c) => c.state === 'none');
+    const partial = result.coverage.owaspCoverage.filter((c) => c.state === 'partial');
+    const limits = result.traceLimits;
+    const notCheckedItems = [];
+    /*
+     * Always present, because it is always true: the walker skips dependency
+     * and build folders, and Defuse does not check which package versions are
+     * known to be vulnerable. A client asking "is this app secure?" needs to
+     * know that half of the question is a different tool.
+     */
+    notCheckedItems.push(`<li><strong>Other people's code.</strong> Dependency and build folders (node_modules, vendor, dist, build, ` +
+        `virtual environments and the like) are not scanned. ` +
+        (result.dependencies
+            ? `The library versions pinned in ${result.dependencies.read.length} lockfile(s) were checked against osv.dev on ` +
+                `${e(readableDate(result.dependencies.checkedAt.slice(0, 10)))} - that says a vulnerable version is installed, not that it is called.` +
+                (result.dependencies.notRead.length
+                    ? ` Not read: ${result.dependencies.notRead.map((f) => `<code>${e(f)}</code>`).join(', ')}.`
+                    : '') +
+                `</li>`
+            : `Defuse did not check whether the libraries the project uses have known vulnerabilities - ` +
+                `that runs only when the scan is given <code>--deps</code>.</li>`));
+    /*
+     * The PHP version check reads declarations, which can differ from the server.
+     * Say what was read, and say it when nothing could be - a client must not
+     * take a missing runtime finding as "the PHP version is fine".
+     */
+    const runtime = result.runtimeVersions;
+    if (runtime && (runtime.declared.length > 0 || runtime.notes.length > 0)) {
+        notCheckedItems.push(`<li><strong>The PHP version, as declared, not as running.</strong> Defuse compared the PHP versions this ` +
+            `project declares with php.net's support dates and critical advisories, checked ${e(readableDate(runtime.factsChecked))}. ` +
+            `What the server actually runs was not seen - confirm with <code>php -v</code> there.` +
+            (runtime.declared.length > 0
+                ? `<ul>${runtime.declared.map((d) => `<li>${where(d.file, d.line)} <code>${e(d.declared)}</code>: ${e(d.status)}</li>`).join('')}</ul>`
+                : '') +
+            (runtime.notes.length > 0 ? `<ul>${runtime.notes.map((n) => `<li>${e(n)}</li>`).join('')}</ul>` : '') +
+            `</li>`);
+    }
+    if (options.intake?.trim()) {
+        notCheckedItems.push(`<li><strong>How the files were gathered.</strong> ${e(options.intake.trim())}</li>`);
+    }
+    if (noRule.length > 0) {
+        notCheckedItems.push(`<li><strong>Whole kinds of problem Defuse has no check for.</strong> Silence here means nothing either way:<ul>` +
+            noRule.map((c) => `<li>${e(c.id)} ${e(c.title)} - for example ${e(c.examples)}</li>`).join('') +
+            `</ul></li>`);
+    }
+    if (partial.length > 0) {
+        notCheckedItems.push(`<li><strong>Kinds of problem checked only in part.</strong><ul>` +
+            partial.map((c) => `<li>${e(c.id)} ${e(c.title)}: Defuse checks ${e(c.weCheck ?? '')}</li>`).join('') +
+            `</ul></li>`);
+    }
+    if (gapsHere.length > 0) {
+        notCheckedItems.push(`<li><strong>Checks that are partial or missing for the languages in this project.</strong><ul>` +
+            gapsHere
+                .map((g) => `<li>${e(g.ruleName)} in ${e(LANGUAGES.find((l) => l.id === g.language)?.displayName ?? g.language)}: ${e(g.note)}</li>`)
+                .join('') +
+            `</ul></li>`);
+    }
+    if (result.coverage.unscannedExtensions.length > 0) {
+        notCheckedItems.push(`<li><strong>Files Defuse cannot read</strong> were present and were not scanned: ${e(result.coverage.unscannedExtensions.join(', '))}.</li>`);
+    }
+    if (result.excluded.fileCount > 0) {
+        notCheckedItems.push(`<li><strong>Left out on request:</strong> ${plural(result.excluded.fileCount, 'file')} matching ${e(result.excluded.patterns.join(', '))}.</li>`);
+    }
+    if (result.oversizedFiles.length > 0) {
+        notCheckedItems.push(`<li><strong>Too large to read:</strong> ${result.oversizedFiles.map((f) => e(rel(f))).join(', ')}.</li>`);
+    }
+    if (result.parseProblems.length > 0) {
+        notCheckedItems.push(`<li><strong>Files that did not parse cleanly</strong> (the readable parts were checked; findings near the damage may be missing): ` +
+            result.parseProblems.map((p) => e(rel(p.file))).join(', ') +
+            `.</li>`);
+    }
+    if (limits.depthTruncations + limits.recursionStops + limits.unmodelledHops > 0) {
+        notCheckedItems.push(`<li><strong>Where the data-flow trace stopped or assumed.</strong> ` +
+            `${plural(limits.depthTruncations, 'trace')} reached the depth limit, ` +
+            `${plural(limits.recursionStops, 'call')} ${limits.recursionStops === 1 ? 'was' : 'were'} not re-entered because the function was already being followed, and ` +
+            `${plural(limits.unmodelledHops, 'step')} passed through a function Defuse has no entry for, where the value was assumed to carry through. ` +
+            `A sanitiser hidden past such a point is missed, and the line is reported rather than cleared.</li>`);
+    }
+    if (result.suppressions.length > 0) {
+        notCheckedItems.push(`<li><strong>Silenced in the code itself</strong> with a defuse:ignore comment: ` +
+            result.suppressions.map((s) => `${e(rel(s.file))}:${s.line} (${e(s.ruleId)})`).join(', ') +
+            `.</li>`);
+    }
+    /*
+     * The engine's own list of what it does not do, word for word. Long, and
+     * written for engineers - so it is an appendix rather than the body of
+     * section 4, but it is printed in full: shortening it would be choosing which
+     * limits a client gets to see.
+     */
+    const engineLimits = `<section id="engine-limits" class="appendix"><h2><span class="secnum">A</span>Appendix: the engine's known limits, in full</h2>` +
+        `<p class="lead">Defuse's own statement of what its analysis does not do, as printed by every scan.</p><ul>` +
+        result.coverage.engine.notImplemented.map((n) => `<li>${e(n)}</li>`).join('') +
+        `</ul></section>`;
+    const notCheckedSection = `<section id="not-checked"><h2><span class="secnum">4</span>What this scan did not check</h2>` +
+        `<p class="lead">A problem of a kind listed here would not appear in this report even if it is in the code. ` +
+        `"Not listed above" must not be read as "safe".</p>` +
+        `<ul class="notchecked">${notCheckedItems.join('')}</ul>` +
+        `<p class="lead">The appendix lists the engine's own limits in full.</p>` +
+        `</section>`;
+    const aboutSection = `<section id="about"><h2><span class="secnum">5</span>About this report</h2>` +
+        `<p>Produced by Defuse ${e(version)}, a static analysis tool: it reads the source code and does not run the application. ` +
+        `So neither label proves a problem can be exploited in production - that depends on how the code is deployed and called. ` +
+        `What the labels do say is how much was checked: <span class="dot dot-proven" aria-hidden="true"></span><strong>proven</strong> means a complete path was followed and is printed; ` +
+        `<span class="dot dot-guess" aria-hidden="true"></span><strong>to review</strong> means a pattern matched and nothing more.</p>` +
+        `<p>${plural(result.stats.filesParsed, 'file')} read, ${plural(result.stats.shapesExamined, 'code shape')} examined, ` +
+        `${plural(result.traceLimits.sourcesFound, 'input source')} recognised. ` +
+        `Defuse is open source under ${e(LICENCE_SPDX)}: github.com/Sikkuumi/Defuse.</p>` +
+        `</section>`;
+    /* ------------------------------------------------------------- page -- */
+    const meta = [
+        ['Project', project],
+        ['Scanned', date],
+        ['Files read', `${result.stats.filesParsed.toLocaleString('en-US')}${languagesSeen.length ? ` - ${languagesSeen.join(', ')}` : ''}`],
+        ['Engine', `Defuse ${version} · ${result.coverage.engine.analysisLabel.toLowerCase()}`],
+    ];
+    if (options.preparedBy?.trim())
+        meta.push(['Prepared by', options.preparedBy.trim()]);
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="generator" content="Defuse ${e(version)}">
+<title>${e(project)} - Defuse security scan report</title>
+<style>${STYLES}</style>
+</head>
+<body>
+<main class="report" data-count-proven="${proven.length}" data-count-review="${guessed.length}" data-count-cleared="${cleared.length}">
+<header class="top">
+  <div class="brand">${markSvg(34)}<span class="brand-name">Defuse</span></div>
+  <div class="doc">Security scan report</div>
+</header>
+<h1>${e(project)}</h1>
+<table class="meta"><tbody>${meta.map(([k, v]) => `<tr><th>${e(k)}</th><td>${e(v)}</td></tr>`).join('')}</tbody></table>
+${options.note?.trim() ? `<p class="note">${e(options.note.trim())}</p>` : ''}
+
+<section id="glance">
+<div class="stats">
+  <div class="stat"><div class="stat-n"><span class="dot dot-proven big" aria-hidden="true"></span>${proven.length.toLocaleString('en-US')}</div><div class="stat-l">Proven</div><div class="stat-d">A path from outside input to harm was followed and is printed.</div></div>
+  <div class="stat"><div class="stat-n"><span class="dot dot-guess big" aria-hidden="true"></span>${guessed.length.toLocaleString('en-US')}</div><div class="stat-l">To review</div><div class="stat-d">Matches a risky pattern. Not proven; some will be false alarms.</div></div>
+  <div class="stat"><div class="stat-n"><span class="tick" aria-hidden="true">✓</span>${cleared.length.toLocaleString('en-US')}</div><div class="stat-l">Cleared</div><div class="stat-d">Looked risky, and was shown not to be, with the reason.</div></div>
+</div>
+<p class="verdict">${e(verdict)}</p>
+${severityTable}
+</section>
+
+${provenSection}
+${guessSection}
+${clearedSection}
+${notCheckedSection}
+${aboutSection}
+${engineLimits}
+<footer>Defuse ${e(version)} · ${e(date)} · every finding is labelled proven or to review, and nothing in between.</footer>
+</main>
+</body>
+</html>
+`;
+}
+/*
+ * One stylesheet, light, built for paper first. System fonts only - a report
+ * that fetched a web font would be a report that phones home when opened.
+ */
+const STYLES = `
+:root{--ink:#1d1c18;--muted:#5d5c56;--line:#dcdad3;--soft:#f4f3ef;--paper:#fff;--brand:#792CF7;
+--crit:#a3122f;--high:#b4441b;--med:#7a5a00;--low:#4b5563}
+*{box-sizing:border-box}
+html{background:var(--paper)}
+body{margin:0;background:var(--paper);color:var(--ink);font:14px/1.55 system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;-webkit-print-color-adjust:exact;print-color-adjust:exact}
+.report{max-width:860px;margin:0 auto;padding:32px 24px 48px}
+.top{display:flex;align-items:center;justify-content:space-between;border-bottom:2px solid var(--ink);padding-bottom:12px}
+.brand{display:flex;align-items:center;gap:10px}
+.brand-name{font-weight:700;font-size:20px;letter-spacing:-.01em;color:var(--brand)}
+.doc{font-size:12px;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}
+h1{font-size:28px;line-height:1.2;margin:22px 0 10px;letter-spacing:-.01em;overflow-wrap:anywhere}
+h2{font-size:19px;margin:36px 0 8px;padding-top:14px;border-top:1px solid var(--line);display:flex;align-items:baseline;gap:10px}
+.secnum{font:600 12px/1 ui-monospace,"SF Mono",Menlo,Consolas,monospace;color:var(--muted);border:1px solid var(--line);border-radius:3px;padding:3px 6px}
+h3{font-size:15.5px;margin:0}
+h4{font-size:12px;letter-spacing:.06em;text-transform:uppercase;color:var(--muted);margin:16px 0 6px}
+p{margin:6px 0}
+.lead{color:var(--muted);max-width:72ch}
+.meta{border-collapse:collapse;margin:0 0 8px}
+.note{border-left:3px solid var(--brand);background:var(--soft);padding:9px 14px;margin:14px 0 6px;max-width:72ch}
+.meta th{text-align:left;font-weight:500;color:var(--muted);padding:2px 18px 2px 0;vertical-align:top;white-space:nowrap}
+.meta td{padding:2px 0;overflow-wrap:anywhere}
+.stats{display:grid;grid-template-columns:repeat(3,1fr);gap:10px;margin:20px 0 12px}
+.stat{border:1px solid var(--line);border-radius:6px;padding:12px 14px}
+.stat-n{font-size:30px;font-weight:700;display:flex;align-items:center;gap:10px;line-height:1.1}
+.stat-l{font-weight:600;margin-top:2px}
+.stat-d{color:var(--muted);font-size:12.5px}
+.tick{font-size:22px;color:var(--ink)}
+.verdict{font-size:15px;max-width:72ch}
+.dot{display:inline-block;width:9px;height:9px;border-radius:50%;margin-right:7px;vertical-align:1px;flex:none}
+.dot.big{width:14px;height:14px;margin-right:0}
+.dot-proven{background:var(--ink);border:2px solid var(--ink)}
+.dot-guess{background:transparent;border:2px solid var(--ink)}
+.sevtable{border-collapse:collapse;margin:12px 0 0;font-variant-numeric:tabular-nums}
+.sevtable th,.sevtable td{border:1px solid var(--line);padding:5px 12px;text-align:right}
+.sevtable thead th{font-weight:600;font-size:12px;color:var(--muted)}
+.sevtable tbody th{text-align:left;font-weight:500;white-space:nowrap}
+.sev{display:inline-block;font:600 11px/1 ui-monospace,"SF Mono",Menlo,Consolas,monospace;letter-spacing:.04em;text-transform:uppercase;border:1px solid currentColor;border-radius:3px;padding:3px 5px;white-space:nowrap}
+.sev-critical{color:var(--crit)}.sev-high{color:var(--high)}.sev-medium{color:var(--med)}.sev-low,.sev-info{color:var(--low)}
+.where{font:12.5px/1.4 ui-monospace,"SF Mono",Menlo,Consolas,monospace;overflow-wrap:anywhere}
+.snippet{display:block;font:12px/1.45 ui-monospace,"SF Mono",Menlo,Consolas,monospace;background:var(--soft);border-radius:4px;padding:5px 8px;margin:4px 0;white-space:pre-wrap;overflow-wrap:anywhere}
+.card{border:1px solid var(--line);border-left:4px solid var(--ink);border-radius:6px;padding:14px 16px;margin:14px 0;break-inside:avoid}
+.card header{display:flex;align-items:center;gap:8px;flex-wrap:wrap}
+.num{font:600 12px/1 ui-monospace,"SF Mono",Menlo,Consolas,monospace;color:var(--muted)}
+.loc{margin:6px 0 2px}
+.what{font-weight:500}
+.path{list-style:none;padding:0;margin:0;counter-reset:s}
+.step{display:flex;gap:10px;padding:6px 0;border-top:1px dashed var(--line)}
+.step:first-child{border-top:0}
+.step-kind{flex:none;width:58px;font:600 11px/1.9 ui-monospace,"SF Mono",Menlo,Consolas,monospace;text-transform:uppercase;letter-spacing:.04em;color:var(--muted)}
+.step-source .step-kind,.step-sink .step-kind{color:var(--ink)}
+.step-body{flex:1;min-width:0}
+.step-why{display:block;color:var(--muted);font-size:13px}
+.ref{color:var(--muted);font-size:12.5px;margin-top:10px}
+.group{margin:18px 0 26px}
+.group h3{display:flex;align-items:center}
+.count{font:600 12px/1 ui-monospace,"SF Mono",Menlo,Consolas,monospace;color:var(--muted);margin-left:8px}
+.explain{max-width:72ch}
+.limits{background:var(--soft);border-radius:4px;padding:8px 10px;font-size:13px;max-width:none}
+.rows{width:100%;border-collapse:collapse;table-layout:fixed;margin:4px 0}
+.rows th{text-align:left;font-size:12px;font-weight:600;color:var(--muted);border-bottom:1px solid var(--line);padding:5px 8px}
+.rows td{border-bottom:1px solid var(--line);padding:7px 8px;vertical-align:top;overflow-wrap:anywhere}
+.rows tr{break-inside:avoid}
+.rows th:nth-child(1){width:96px}.rows th:nth-child(2){width:32%}
+#cleared .rows th:nth-child(1){width:34%}#cleared .rows th:nth-child(2){width:22%}
+.hitnote{color:var(--muted);font-size:12.5px;margin-top:4px}
+.empty{border:1px dashed var(--line);border-radius:6px;padding:12px 14px;color:var(--muted)}
+.notchecked{padding-left:18px}
+.notchecked>li{margin:8px 0}
+.notchecked ul{margin:4px 0;padding-left:18px;color:var(--muted)}
+.appendix ul{font-size:12.5px;color:var(--muted);padding-left:18px}
+.appendix li{margin:5px 0}
+footer{margin-top:40px;padding-top:10px;border-top:1px solid var(--line);color:var(--muted);font-size:12px}
+@media (max-width:640px){.stats{grid-template-columns:1fr}.report{padding:20px 16px 40px}h1{font-size:23px}
+.rows,.rows tbody,.rows tr,.rows td{display:block;width:auto}.rows thead{display:none}
+.rows tr{border-bottom:1px solid var(--line);padding:8px 0}.rows td{border:0;padding:2px 0}}
+@page{size:A4;margin:16mm 14mm}
+@media print{.report{max-width:none;padding:0}.appendix{break-before:page}h2{break-after:avoid}.group h3,.group h4{break-after:avoid}a{color:inherit}}
+`;
+//# sourceMappingURL=html-report.js.map

package/dist/src/report/html-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-report.js","sourceRoot":"","sources":["../../../src/report/html-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8BpC,MAAM,UAAU,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEtF,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,GAAG,UAAU,CAAC;AAErB,iGAAiG;AACjG,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,EAAE,GAAW,EAAE,IAAI,GAAG,GAAG,GAAG,GAAG;IACtD,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAChE,CAAC;AAED,wFAAwF;AACxF,SAAS,UAAU,CAAC,GAAG,KAAwB;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,KAAK;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,IAAY,EAAU,EAAE;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,OAAO,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,KAAK,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE,CACjG,KAAK,CAAC,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,qCAAqC,CACxI,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAU,EAAE,CAAU;IACjD,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAA8B,CAAC;IAChG,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,OAA0B;IAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAC1D,CAAC;IACF,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;IAE/C,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;SACpD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACxB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,IAAI,EAAE,KAAK,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE/G,4EAA4E;IAE5E,MAAM,YAAY,GAAG,CAAC,CAAW,EAAU,EAAE,CAAC,wBAAwB,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC;IAC3G,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IAEjF,MAAM,SAAS,GAAqC;QAClD,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,QAAQ;QACrB,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,OAAO;KACd,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAU,EAAE,KAAa,EAAU,EAAE;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;aAC7B,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,wBAAwB,CAAC,CAAC,IAAI,6BAA6B,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;YACrF,2BAA2B,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE;YACrG,0BAA0B,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAClE;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,CACL,mDAAmD,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;YAClE,iEAAiE;YACjE,sBAAsB,KAAK,GAAG,CAAC,UAAU,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;YACnE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB;YACpC,kBAAkB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;YACpE,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YACrC,qDAAqD,KAAK,OAAO;YACjE,CAAC,IAAI,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM;YAChD,YAAY,CACb,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CACnC,CAAC,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IAEhG,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,eAAuB,EAAU,EAAE,CAC/D,iCAAiC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO;QAChE,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO;QAC1D,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACjD,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,eAAe;YACjD,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,CAAC;IAEf,MAAM,UAAU,GAAG,CAAC,IAAwB,EAAE,eAAuB,EAAU,EAAE,CAC/E,sGAAsG;QACtG,UAAU,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC;IAErF,6EAA6E;IAE7E,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE/C,MAAM,aAAa,GACjB,+CAA+C,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SAClF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,sBAAsB;QACjC,6EAA6E,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;aAChH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;aACzC,IAAI,CAAC,EAAE,CAAC,OAAO;QAClB,+EAA+E,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;aAClH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;aAC1C,IAAI,CAAC,EAAE,CAAC,uBAAuB,CAAC;IAErC,MAAM,OAAO,GACX,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,qEAAqE;QACxH,CAAC,CAAC,kIAAkI,CAAC;QACvI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,mEAAmE;gBACnH,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzH,IAAI;YACN,CAAC,CAAC,wCAAwC,CAAC;QAC7C,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,sBAAsB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,6CAA6C;YAC3I,CAAC,CAAC,EAAE,CAAC,CAAC;IAEV,MAAM,aAAa,GACjB,4EAA4E;QAC5E,mJAAmJ;QACnJ,6KAA6K;QAC7K,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,CAAC,CAAC,0IAA0I,CAAC;QAC/I,YAAY,CAAC;IAEf,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAC3D,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;SACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,GAAG,GAAG,CAAC,IAAwB,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/G,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACpE,CAAC,CAAC,CAAC;IAEL,MAAM,YAAY,GAChB,2FAA2F;QAC3F,oHAAoH;QACpH,mKAAmK;QACnK,2HAA2H;QAC3H,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,WAAW;iBACR,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;gBACpB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9D,OAAO,CACL,iCAAiC,CAAC,CAAC,EAAE,CAAC,+DAA+D,CAAC,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,MAAM,cAAc;oBAC7J,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACpE,IAAI,EAAE,WAAW,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,CACnG;oBACD,mEAAmE,CAAC,CAAC,MAAM,CAAC,MAAM;oBAClF,CAAC,EAAE,KAAK,kBAAkB;wBACxB,CAAC,CAAC,8LAA8L;wBAChM,CAAC,CAAC,EAAE,CAAC;oBACP,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,IAAI,CAAC,MAAM,SAAS,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAkC,KAAK,CAAC,MAAM,SAAS,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5G,QAAQ,CACT,CAAC;YACJ,CAAC,CAAC;iBACD,IAAI,CAAC,EAAE,CAAC;YACb,CAAC,CAAC,uDAAuD,CAAC;QAC5D,YAAY,CAAC;IAEf,MAAM,cAAc,GAClB,iFAAiF;QACjF,qMAAqM;QACrM,8HAA8H;QAC9H,gKAAgK;QAChK,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC;YACxC,CAAC,CAAC,gBAAgB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,QAAQ,EAAE,UAAU,CAAC,gEAAgE;YACrJ,CAAC,CAAC,EAAE,CAAC;QACP,MAAM;QACN,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,yGAAyG;gBACzG,OAAO;qBACJ,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,2BAA2B,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO;oBAC3G,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,sCAAsC,CAAC,CAAC,EAAE;oBAC1E,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;wBAChC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG;4BAC/E,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,SAAS;wBACpH,CAAC,CAAC,EAAE,CAAC;oBACP,YAAY,CACf;qBACA,IAAI,CAAC,EAAE,CAAC;gBACX,kBAAkB;YACpB,CAAC,CAAC,+CAA+C,CAAC;QACpD,YAAY,CAAC;IAEf,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;IAClC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC;;;;;OAKG;IACH,eAAe,CAAC,IAAI,CAClB,6GAA6G;QAC3G,sDAAsD;QACtD,CAAC,MAAM,CAAC,YAAY;YAClB,CAAC,CAAC,kCAAkC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,+CAA+C;gBAChH,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wEAAwE;gBACtI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;oBACjC,CAAC,CAAC,cAAc,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC5F,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO;YACT,CAAC,CAAC,2FAA2F;gBAC3F,iEAAiE,CAAC,CACzE,CAAC;IACF;;;;OAIG;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC;IACvC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACzE,eAAe,CAAC,IAAI,CAClB,2GAA2G;YACzG,kFAAkF,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI;YAC3H,sFAAsF;YACtF,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC1B,CAAC,CAAC,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO;gBACvI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,OAAO,CACV,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,eAAe,CAAC,IAAI,CAClB,iHAAiH;YAC/G,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9F,YAAY,CACf,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,eAAe,CAAC,IAAI,CAClB,iEAAiE;YAC/D,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrG,YAAY,CACf,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,eAAe,CAAC,IAAI,CAClB,gGAAgG;YAC9F,QAAQ;iBACL,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAC3H;iBACA,IAAI,CAAC,EAAE,CAAC;YACX,YAAY,CACf,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,eAAe,CAAC,IAAI,CAClB,oFAAoF,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAC9I,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAClC,eAAe,CAAC,IAAI,CAClB,6CAA6C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAClJ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAClB,2CAA2C,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,eAAe,CAAC,IAAI,CAClB,oIAAoI;YAClI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,QAAQ,CACX,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;QAChF,eAAe,CAAC,IAAI,CAClB,qEAAqE;YACnE,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,4BAA4B;YACvE,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,uEAAuE;YAC/J,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,oGAAoG;YAC5I,oGAAoG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAClB,iFAAiF;YAC/E,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACzF,QAAQ,CACX,CAAC;IACJ,CAAC;IACD;;;;;OAKG;IACH,MAAM,YAAY,GAChB,iIAAiI;QACjI,4GAA4G;QAC5G,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,iBAAiB,CAAC;IAEpB,MAAM,iBAAiB,GACrB,8FAA8F;QAC9F,6GAA6G;QAC7G,oDAAoD;QACpD,0BAA0B,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO;QACzD,yEAAyE;QACzE,YAAY,CAAC;IAEf,MAAM,YAAY,GAChB,6EAA6E;QAC7E,yBAAyB,CAAC,CAAC,OAAO,CAAC,uFAAuF;QAC1H,0HAA0H;QAC1H,oLAAoL;QACpL,gIAAgI;QAChI,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,YAAY,CAAC,aAAa;QACtH,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,cAAc,CAAC,eAAe;QACzE,+BAA+B,CAAC,CAAC,YAAY,CAAC,mCAAmC;QACjF,YAAY,CAAC;IAEf,2EAA2E;IAE3E,MAAM,IAAI,GAA4B;QACpC,CAAC,SAAS,EAAE,OAAO,CAAC;QACpB,CAAC,SAAS,EAAE,IAAI,CAAC;QACjB,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpI,CAAC,QAAQ,EAAE,UAAU,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;KACxF,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtF,OAAO;;;;;yCAKgC,CAAC,CAAC,OAAO,CAAC;SAC1C,CAAC,CAAC,OAAO,CAAC;SACV,MAAM;;;0CAG2B,MAAM,CAAC,MAAM,wBAAwB,OAAO,CAAC,MAAM,yBAAyB,OAAO,CAAC,MAAM;;uBAE7G,OAAO,CAAC,EAAE,CAAC;;;MAG5B,CAAC,CAAC,OAAO,CAAC;6BACa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;EACrG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;;;;qGAIwB,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC;oGACtC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC;wFAClD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC;;qBAEzG,CAAC,CAAC,OAAO,CAAC;EAC7B,aAAa;;;EAGb,aAAa;EACb,YAAY;EACZ,cAAc;EACd,iBAAiB;EACjB,YAAY;EACZ,YAAY;iBACG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;;;;CAIvC,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8Ed,CAAC"}

package/dist/src/report/human.d.ts

@@ -0,0 +1,44 @@
+/**
+ * HUMAN-READABLE REPORT
+ *
+ * Design brief: someone should be able to skim this in a terminal and know
+ * three things without reading carefully -
+ *   1. where the problem is,
+ *   2. how bad it would be,
+ *   3. HOW SURE WE ARE.
+ *
+ * Point 3 is the one other tools bury. It gets its own column here, on every
+ * single line, and it gets a summary block that states the count of unverified
+ * findings in plain words. If this report ever looks more confident than the
+ * engine is, the report is wrong.
+ */
+import { type Severity } from '../core/finding.js';
+import type { ScanResult } from '../engine/scan.js';
+export interface HumanReportOptions {
+    readonly showSuppressed?: boolean;
+    readonly showCoverageMatrix?: boolean;
+    readonly minSeverity?: Severity;
+    /**
+     * Print everything: the gauge arithmetic, each finding's reasoning and
+     * limits, OWASP and the full "not checked" list. Off by default because a
+     * first-time tester read 200 lines for one finding and called it
+     * overwhelming. Nothing is dropped - the short report names every gap in a
+     * line and points here, and --json and --report always carry all of it.
+     */
+    readonly full?: boolean;
+    /**
+     * What the scan was actually pointed at, as resolved from the command line.
+     *
+     * This is here because of a real misread. `npm run scan --exclude tests`
+     * looks like "scan everything except tests"; npm swallows `--exclude` as one
+     * of its own config flags and forwards only `tests`, so the tool scanned the
+     * fixture folder and NOTHING else. The report was correct - 75 findings in
+     * files written to be vulnerable - and completely misleading, because the one
+     * fact that would have explained it was the one fact not printed.
+     *
+     * A report that says how much it examined but never says WHAT is describing a
+     * measurement without its units.
+     */
+    readonly target?: string;
+}
+export declare function renderHuman(result: ScanResult, options?: HumanReportOptions): string;