@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/report/pricing.js

@@ -0,0 +1,343 @@
+import { ALL_RULES } from '../rules/registry.js';
+import { LANGUAGES } from '../parse/languages.js';
+import { BASE_CSS, FOOTER_CSS, NAV_CSS, esc, siteFooter, siteNav } from './site.js';
+/**
+ * THE PRICING PAGE
+ * ================
+ *
+ * Generated like the landing page, and held to the same rule: it may not say
+ * more than is true today.
+ *
+ *   - Every feature listed under a plan EXISTS. Nothing planned is listed as
+ *     if it were built; a plan that is not built yet is shown as "coming soon"
+ *     with no price and no feature list.
+ *   - Numbers come from the registry and the measurement files, not from the
+ *     prose, so `npm test` fails if the page and the engine disagree.
+ *   - No "most popular" badge. There is nothing to be popular among yet, and a
+ *     badge that says otherwise is the kind of claim this project exists to
+ *     refuse. The cards do carry a badge, because the design has a place for
+ *     one - and it holds a FACT about the plan ("Open source", "5+ developers"),
+ *     never a ranking.
+ *   - How buying works is said plainly: there is no checkout. A plan is set up
+ *     by hand after someone asks.
+ *
+ * The paid tools are Defuse Team, a separate private program that reads the
+ * scanner's JSON. They organise findings; they never re-decide one. That is
+ * stated on the page, because it is the promise a buyer most needs.
+ */
+/** Where a plan enquiry goes: a public GitHub issue form, .github/ISSUE_TEMPLATE/plan-enquiry.yml. */
+const ENQUIRY_URL = 'https://github.com/Sikkuumi/Defuse/issues/new?template=plan-enquiry.yml';
+const enquiry = (plan) => `${ENQUIRY_URL}&title=${encodeURIComponent(`Plan enquiry: ${plan}`)}`;
+/** Team is priced per developer with a floor of this many. */
+export const TEAM_MIN_SEATS = 5;
+const TEAM_PRICE = 49;
+/** Rule/language pairs the engine declares it does not implement - counted, never typed in. */
+function countNotImplemented() {
+    let n = 0;
+    for (const rule of ALL_RULES) {
+        for (const language of LANGUAGES) {
+            if (rule.support[language.id]?.status === 'not-implemented')
+                n++;
+        }
+    }
+    return n;
+}
+export function plans() {
+    const notImplemented = countNotImplemented();
+    return [
+        {
+            name: 'Community',
+            status: 'available',
+            price: { amount: 'Free', unit: 'for everyone, for good', note: 'Open source, AGPL-3.0' },
+            forWhom: 'Anyone scanning their own code, on their own machine or in their own CI.',
+            badge: 'Open source',
+            builds: 'Included:',
+            features: [
+                {
+                    name: 'The scanner',
+                    detail: `${LANGUAGES.length} languages and ${ALL_RULES.length} rules. Data flow is traced in every language, into other functions, and into other files in every language but PHP.`,
+                },
+                {
+                    name: 'Two labels on every finding',
+                    detail: 'Proven, with the path from source to sink printed; or to review, a matched pattern that was not traced. Never blended into one score.',
+                },
+                {
+                    name: 'What it did not check',
+                    detail: `Every run lists the rule and language pairs it does not cover - ${notImplemented} today - each with its reason.`,
+                },
+                {
+                    name: 'Terminal, browser and CI',
+                    detail: 'A terminal command, a browser page that scans on your own machine and uploads nothing, JSON output, and SARIF for GitHub code scanning.',
+                },
+                {
+                    name: 'Client report',
+                    detail: 'One HTML file for a client or a manager, with the proven problems, what to review and what was not checked. Prints to PDF.',
+                },
+            ],
+            cta: { label: 'Run it now', href: 'https://github.com/Sikkuumi/Defuse#readme' },
+        },
+        {
+            name: 'Pro',
+            status: 'available',
+            price: { amount: '$19', unit: 'per developer / month' },
+            forWhom: 'One developer working through findings over time, on their own machine.',
+            badge: 'One developer',
+            builds: 'Everything in Community, and:',
+            features: [
+                {
+                    name: 'New problems only',
+                    detail: 'Compare two scans and see only what a change added. A line that moved is matched, not called new; what disappeared is "no longer reported", never "fixed".',
+                },
+                {
+                    name: 'Trend dashboard',
+                    detail: 'Proven and to-review counts across your scans, in one file that opens offline. Where the scanner itself changed, the point is marked with the reason.',
+                },
+            ],
+            cta: { label: 'Ask for Pro', href: enquiry('Pro') },
+        },
+        {
+            name: 'Team',
+            status: 'available',
+            price: {
+                amount: `$${TEAM_PRICE}`,
+                unit: 'per developer / month',
+                note: `From ${TEAM_MIN_SEATS} developers ($${TEAM_PRICE * TEAM_MIN_SEATS} a month).`,
+            },
+            forWhom: 'A team that wants every pull request checked, and one shared record of what was decided.',
+            badge: `${TEAM_MIN_SEATS}+ developers`,
+            builds: 'Everything in Pro, and:',
+            features: [
+                {
+                    name: 'Pull-request check',
+                    detail: 'Each pull request is scanned against its base. One comment, updated on every push, lists only what it adds, and the check fails only on new problems at the level you set.',
+                },
+                {
+                    name: 'Shared triage',
+                    detail: 'False alarms and accepted risks are marked in the repository with a reason and a name. A mark never hides a finding, ends when the code changes, and a pull request cannot approve its own.',
+                },
+                {
+                    name: 'Automatic history',
+                    detail: 'One scan a day kept on its own branch, and the trend dashboard rebuilt on every push to main. On private repositories, unless you choose otherwise.',
+                },
+            ],
+            cta: { label: 'Ask for Team', href: enquiry('Team'), primary: true },
+        },
+        /*
+         * Business and Enterprise were listed here as "coming soon", each with a
+         * "Tell us you need it" button. Removed: a button for a plan that does not
+         * exist only brings requests nobody can fill. A plan is added back when it
+         * is built - and if one is listed before then, it is drawn as "coming
+         * soon", with no price and no features (planCard).
+         */
+    ];
+}
+/** Lucide's "check" icon (ISC licence), inline so the page still calls nobody. */
+const CHECK_ICON = '<svg class="tick" viewBox="0 0 24 24" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2.25" ' +
+    'stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>';
+function planCard(p) {
+    if (p.status === 'coming-soon') {
+        return `      <div class="plan soon">
+        <h3 class="pname">${esc(p.name)}</h3>
+        <div class="tag">Coming soon</div>
+        <p class="who">${esc(p.forWhom)}</p>
+        <p class="who">Not available yet. If you need it, say so - it will be shaped around real requests rather than guessed at.</p>
+        <a class="pbtn" href="${esc(p.cta.href)}">${esc(p.cta.label)}</a>
+      </div>`;
+    }
+    const price = p.price;
+    // One card: a header (name, who it is for, a fact in the corner), the price
+    // on one line, the features as a checked list, and one full-width button.
+    // The plan whose button is the primary one gets a brand-coloured ring.
+    return `      <div class="plan glass${p.cta.primary ? ' featured' : ''}">
+        <div class="phead">
+          <h3 class="pname">${esc(p.name)}</h3>
+          ${p.badge ? `<span class="badge">${esc(p.badge)}</span>` : ''}
+          <p class="who">${esc(p.forWhom)}</p>
+        </div>
+        <div class="pricebox">
+          <div class="priceline"><span class="amount">${esc(price.amount)}</span><span class="unit">${esc(price.unit)}</span></div>
+          ${price.note ? `<div class="pnote">${esc(price.note)}</div>` : ''}
+        </div>
+        ${p.builds ? `<div class="builds">${esc(p.builds)}</div>` : ''}
+        <ul class="feats">
+${p.features.map((f) => `          <li>${CHECK_ICON}<div><b>${esc(f.name)}</b><span>${esc(f.detail)}</span></div></li>`).join('\n')}
+        </ul>
+        <a class="pbtn${p.cta.primary ? ' primary' : ''}" href="${esc(p.cta.href)}">${esc(p.cta.label)}</a>
+      </div>`;
+}
+export function renderPricing(benchmark) {
+    // The precision figures stay on the main page, beside the footnote that says what they do and do not
+    // promise. Quoted alone on a page that sells, a 100% would read as a promise about your code.
+    const all = plans();
+    const available = all.filter((p) => p.status === 'available');
+    const soon = all.filter((p) => p.status === 'coming-soon');
+    const notImplemented = countNotImplemented();
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Defuse — plans and pricing</title>
+<meta name="description" content="Defuse is free and open source. Paid plans add tools for working through findings over time and across a team - and never change what the scanner finds.">
+<meta property="og:title" content="Defuse — plans and pricing">
+<meta property="og:description" content="The scanner is free. Paid plans organise findings; they never re-decide one.">
+<meta property="og:type" content="website">
+<meta name="theme-color" content="#262626">
+<link rel="icon" href="defuse-mark.png">
+<style>
+${BASE_CSS}
+  header{position:relative;padding:0 0 clamp(40px,6vw,72px)}
+${NAV_CSS}
+  h1{font-size:clamp(38px,6.4vw,72px);letter-spacing:-2px;margin:22px 0 0;max-width:17ch}
+  .lede{margin-top:22px;font-size:clamp(16px,1.9vw,19px);font-weight:300;max-width:62ch}
+
+  /* ---------- the plans ----------
+     Card layout after shadcn's pricing card: a header with a fact badge in the
+     corner, the price on one line, a checked feature list, one full-width
+     button, and a ring on the plan whose button is the primary one. Drawn
+     with this site's own colours, fonts and glass surface - no framework. */
+  .plans{display:grid;grid-template-columns:1fr;gap:20px;margin-top:8px;max-width:420px;margin-left:auto;margin-right:auto}
+  @media(min-width:960px){.plans{grid-template-columns:repeat(3,minmax(0,1fr));gap:22px;max-width:none}}
+  .plan{position:relative;display:flex;flex-direction:column;border-radius:12px;box-shadow:0 1px 2px rgba(0,0,0,.25)}
+  .plan.featured{border-color:var(--brand);box-shadow:0 0 0 1px var(--brand),0 18px 50px -24px rgba(121,44,247,.55)}
+  .phead{position:relative;padding:24px 24px 0}
+  .pname{font-size:24px;font-weight:600;letter-spacing:-.4px;line-height:1.1;color:var(--white);padding-right:120px}
+  .badge{position:absolute;top:24px;right:24px;font-family:"IBM Plex Mono",monospace;font-size:11.5px;font-weight:500;letter-spacing:.3px;
+    color:var(--brand-soft);background:rgba(121,44,247,.14);border:1px solid rgba(121,44,247,.35);border-radius:999px;padding:3px 10px;white-space:nowrap}
+  .plan.featured .badge{color:var(--white);background:var(--brand);border-color:var(--brand)}
+  .who{margin-top:8px;font-size:14px;line-height:1.55;color:var(--mute)}
+  .pricebox{padding:22px 24px 0}
+  .priceline{display:flex;align-items:baseline;flex-wrap:wrap;gap:4px 8px}
+  .amount{font-weight:600;font-size:clamp(32px,3.2vw,38px);letter-spacing:-1.2px;line-height:1;color:var(--white);font-variant-numeric:tabular-nums}
+  .unit{font-size:14px;color:var(--mute)}
+  .pnote{margin-top:8px;font-size:13px;color:var(--faint)}
+  /* Side by side, the headers and price blocks are given the same height, so
+     the feature lists start on one line across the three cards. */
+  @media(min-width:960px){.plan .phead{min-height:130px}.plan .pricebox{min-height:92px}}
+  .builds{margin:20px 24px 0;padding-top:16px;border-top:1px solid var(--hair);font-family:"IBM Plex Mono",monospace;font-size:12px;letter-spacing:1px;color:var(--faint)}
+  .feats{list-style:none;margin:12px 24px 24px;flex-grow:1;display:flex;flex-direction:column;gap:14px}
+  .feats li{display:flex;gap:10px;align-items:flex-start}
+  .feats .tick{flex-shrink:0;margin-top:3px;color:var(--brand-soft)}
+  .feats b{display:block;font-weight:500;font-size:14.5px;color:var(--white)}
+  .feats span{display:block;margin-top:3px;font-size:13.5px;line-height:1.55;color:var(--mute)}
+  .pbtn{display:flex;align-items:center;justify-content:center;height:42px;margin:0 24px 24px;font-size:14px;font-weight:500;color:var(--white);
+    background:var(--glass);border:1px solid var(--line);border-radius:8px;padding:0 16px;transition:background 200ms ease,border-color 200ms ease}
+  .pbtn:hover{background:rgba(245,245,245,.07);border-color:var(--brand-lift);color:var(--white)}
+  .pbtn.primary{background:var(--brand);border-color:var(--brand)}
+  .pbtn.primary:hover{background:var(--brand-lift);border-color:var(--brand-lift)}
+  .pbtn:focus-visible{outline:2px solid var(--brand-soft);outline-offset:3px}
+
+  /* Not built yet: drawn as an outline with no price, so it cannot be mistaken
+     for something on sale. None are listed today - see plans(). */
+  .soonrow{display:grid;grid-template-columns:1fr;gap:18px;margin-top:18px}
+  @media(min-width:760px){.soonrow{grid-template-columns:1fr 1fr;gap:20px}}
+  .plan.soon{border:1px solid var(--hair);border-radius:12px;background:transparent;padding:24px;box-shadow:none}
+  .plan.soon .pname{color:var(--mute);font-size:20px;padding-right:0}
+  .plan.soon .who{margin-top:10px}
+  .plan.soon .pbtn{margin:20px 0 0;align-self:flex-start;color:var(--mute)}
+  .tag{margin-top:12px;align-self:flex-start;font-family:"IBM Plex Mono",monospace;font-size:11.5px;letter-spacing:1.4px;text-transform:uppercase;color:var(--mute);border:1px solid var(--line);border-radius:6px;padding:4px 9px}
+
+  /* ---------- promises, effort, buying ---------- */
+  .three{display:grid;grid-template-columns:1fr;gap:18px;margin-top:40px}
+  @media(min-width:900px){.three{grid-template-columns:repeat(3,1fr);gap:20px}}
+  .three .glass{padding:26px 24px}
+  .three h3{font-size:19px;font-weight:500;letter-spacing:-.3px;color:var(--white)}
+  .three p{margin-top:10px;font-size:14.5px}
+  .stats{display:grid;grid-template-columns:repeat(2,1fr);gap:14px;margin-top:40px}
+  @media(min-width:760px){.stats{grid-template-columns:repeat(4,1fr);gap:18px}}
+  .stat{padding:24px 22px;border-radius:14px}
+  .stat b{display:block;font-weight:700;font-size:clamp(26px,3.2vw,34px);letter-spacing:-1px}
+  .stat span{display:block;margin-top:5px;font-family:"IBM Plex Mono",monospace;font-size:11.5px;letter-spacing:1.4px;text-transform:uppercase;color:var(--faint)}
+  .steps{margin:26px 0 0 20px;color:var(--mute);max-width:70ch}
+  .steps li{margin:10px 0}
+  .steps strong{color:var(--white);font-weight:500}
+${FOOTER_CSS}
+</style>
+</head>
+<body>
+
+<header>
+  <div class="wrap">
+${siteNav('pricing')}
+    <div class="kicker" style="margin-top:clamp(30px,5vw,64px)">Plans and pricing</div>
+    <h1>The scanner is free. Teams pay for the tools around it.</h1>
+    <p class="lede">Community is the whole scanner, open source, with nothing held back. The paid plans add
+      tools for working through findings over time and across a team. They read what the scanner found;
+      they never change what it found or how it is labelled.</p>
+  </div>
+</header>
+
+<section id="plans" style="padding-top:clamp(36px,5vw,56px)">
+  <div class="wrap">
+    <div class="plans">
+${available.map(planCard).join('\n')}
+    </div>
+${soon.length > 0 ? `    <div class="soonrow">\n${soon.map(planCard).join('\n')}\n    </div>\n` : ''}    <p class="mono" style="margin-top:22px;font-size:12.5px;color:var(--faint);max-width:none">Prices in US dollars.
+      There is no checkout yet - see how buying works below.</p>
+  </div>
+</section>
+
+<section id="promise">
+  <div class="wrap">
+    <div class="kicker">The same in every plan</div>
+    <h2>Paying never makes<br>a guess look like a proof.</h2>
+    <div class="three">
+      <div class="glass">
+        <h3>The scanner decides</h3>
+        <p>The paid tools read the scanner's own output. They organise findings - compare them, mark them,
+          chart them - and never re-decide or relabel one.</p>
+      </div>
+      <div class="glass">
+        <h3>Nothing is hidden</h3>
+        <p>A finding your team marks is still listed, with the reason beside it. A comparison never calls a
+          finding fixed; it says "no longer reported", because that is all it can know.</p>
+      </div>
+      <div class="glass">
+        <h3>Your code stays with you</h3>
+        <p>Everything runs on your machine or in your own CI. There is no account to make and nothing is
+          uploaded anywhere.</p>
+      </div>
+    </div>
+  </div>
+</section>
+
+<section id="work">
+  <div class="wrap">
+    <div class="kicker">The work behind it</div>
+    <h2>Measured, and<br>published whole.</h2>
+    <p style="margin-top:20px">The engine is scored against OWASP BenchmarkJava, with the two labels scored
+      separately. Safety rules are switched off one at a time to prove a test notices. And the scanner
+      is run on large real projects - Django, WordPress and VS Code among them - to find what synthetic tests
+      miss. <a href="index.html#numbers">The measurements, and what they do not promise, are on the main page.</a></p>
+    <div class="stats">
+      <div class="stat glass"><b>${benchmark.scored.toLocaleString('en-US')}</b><span>benchmark cases scored</span></div>
+      <div class="stat glass"><b>${ALL_RULES.length}</b><span>rules</span></div>
+      <div class="stat glass"><b>${LANGUAGES.length}</b><span>languages traced</span></div>
+      <div class="stat glass"><b>${notImplemented}</b><span>gaps listed by name</span></div>
+    </div>
+  </div>
+</section>
+
+<section id="buying">
+  <div class="wrap">
+    <div class="kicker">How buying works, today</div>
+    <h2>Set up by hand,<br>for now.</h2>
+    <ol class="steps">
+      <li><strong>Ask</strong> using the button on the plan you want. It opens a short request form on GitHub.</li>
+      <li><strong>Hear back</strong> privately, with the licence terms and an invoice.</li>
+      <li><strong>Get the package</strong> - a file your machine or your CI installs next to the scanner.</li>
+    </ol>
+    <p style="margin-top:20px">The request form is public. Write only the plan, the number of developers and
+      how to reach you privately - never code, keys or company details.</p>
+  </div>
+</section>
+
+<div class="wrap">
+${siteFooter()}
+</div>
+
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=pricing.js.map

package/dist/src/report/pricing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricing.js","sourceRoot":"","sources":["../../../src/report/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,sGAAsG;AACtG,MAAM,WAAW,GAAG,yEAAyE,CAAC;AAC9F,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,WAAW,UAAU,kBAAkB,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;AAwBhH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,+FAA+F;AAC/F,SAAS,mBAAmB;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,iBAAiB;gBAAE,CAAC,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,KAAK;IACnB,MAAM,cAAc,GAAG,mBAAmB,EAAE,CAAC;IAC7C,OAAO;QACL;YACE,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,uBAAuB,EAAE;YACxF,OAAO,EAAE,0EAA0E;YACnF,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,kBAAkB,SAAS,CAAC,MAAM,sHAAsH;iBACpL;gBACD;oBACE,IAAI,EAAE,6BAA6B;oBACnC,MAAM,EAAE,uIAAuI;iBAChJ;gBACD;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,MAAM,EAAE,mEAAmE,cAAc,gCAAgC;iBAC1H;gBACD;oBACE,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,yIAAyI;iBAClJ;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,4HAA4H;iBACrI;aACF;YACD,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,2CAA2C,EAAE;SAChF;QACD;YACE,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE;YACvD,OAAO,EAAE,yEAAyE;YAClF,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,+BAA+B;YACvC,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,mBAAmB;oBACzB,MAAM,EAAE,4JAA4J;iBACrK;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,uJAAuJ;iBAChK;aACF;YACD,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;SACpD;QACD;YACE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,UAAU,EAAE;gBACxB,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,QAAQ,cAAc,iBAAiB,UAAU,GAAG,cAAc,YAAY;aACrF;YACD,OAAO,EAAE,0FAA0F;YACnG,KAAK,EAAE,GAAG,cAAc,cAAc;YACtC,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,4KAA4K;iBACrL;gBACD;oBACE,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,6LAA6L;iBACtM;gBACD;oBACE,IAAI,EAAE,mBAAmB;oBACzB,MAAM,EAAE,qJAAqJ;iBAC9J;aACF;YACD,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;SACrE;QACD;;;;;;WAMG;KACJ,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,GACd,qHAAqH;IACrH,qGAAqG,CAAC;AAExG,SAAS,QAAQ,CAAC,CAAO;IACvB,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO;4BACiB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;;yBAEd,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;gCAEP,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;aACvD,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAM,CAAC;IACvB,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,OAAO,+BAA+B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;;8BAE1C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;2BAC5C,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;;wDAGe,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6BAA6B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACzG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;;UAEjE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;;EAEpE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,UAAU,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;wBAE3G,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;aACzF,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA0B;IACtD,qGAAqG;IACrG,8FAA8F;IAC9F,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,mBAAmB,EAAE,CAAC;IAE7C,OAAO;;;;;;;;;;;;;EAaP,QAAQ;;EAER,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgEP,UAAU;;;;;;;EAOV,OAAO,CAAC,SAAS,CAAC;;;;;;;;;;;;EAYlB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;EAElC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAsCjE,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC;mCACxC,SAAS,CAAC,MAAM;mCAChB,SAAS,CAAC,MAAM;mCAChB,cAAc;;;;;;;;;;;;;;;;;;;;EAoB/C,UAAU,EAAE;;;;;CAKb,CAAC;AACF,CAAC"}

package/dist/src/report/sarif.d.ts

@@ -0,0 +1,39 @@
+/**
+ * SARIF 2.1.0 EXPORT
+ *
+ * SARIF is the OASIS format GitHub, GitLab and Azure DevOps read. Emitting it
+ * is what turns this from "a thing you run" into "a thing a pull request runs",
+ * and it is the single cheapest step on the roadmap.
+ *
+ * THE PROBLEM SARIF CREATES FOR THIS PROJECT, and how it is solved here.
+ *
+ * Every finding this tool emits is labelled signature-based (pattern matched,
+ * data flow NOT traced) or flow-verified (a source-to-sink path was followed
+ * and is printed). That distinction is the whole product. SARIF has no field
+ * for it: `level` carries severity, and there is nowhere that means "we did not
+ * check this one".
+ *
+ * So a naive export loses the differentiator at exactly the moment it matters -
+ * in CI, where nobody reads a terminal and a red annotation looks equally
+ * certain either way. Three things carry it across instead, deliberately
+ * redundant, because a consumer that ignores one should still meet the others:
+ *
+ *   1. `message.text` OPENS with the label. It is the one string every SARIF
+ *      consumer displays, so the label cannot be dropped by a viewer that
+ *      ignores everything else.
+ *   2. `properties.confidence` holds the machine-readable value, alongside
+ *      `properties.limitations` - the rule's own statement of what it did not
+ *      check.
+ *   3. `codeFlows` is populated for flow-verified findings ONLY. SARIF has a
+ *      first-class representation for a traced path, and GitHub renders it as a
+ *      clickable sequence of steps. A finding with a codeFlow is one we proved;
+ *      a finding without one is one we guessed. That asymmetry is visible in
+ *      the UI without reading any of our text.
+ *
+ * WHAT IS DELIBERATELY NOT CLAIMED: `securitySeverity` is emitted because
+ * GitHub sorts by it, but it is derived from our severity rather than from CVSS,
+ * and the property block says so. Inventing a CVSS vector we never computed
+ * would be the same class of lie the confidence labels exist to prevent.
+ */
+import type { ScanResult } from '../engine/scan.js';
+export declare function renderSarif(result: ScanResult, pretty?: boolean): string;

package/dist/src/report/sarif.js

@@ -0,0 +1,219 @@
+/**
+ * SARIF 2.1.0 EXPORT
+ *
+ * SARIF is the OASIS format GitHub, GitLab and Azure DevOps read. Emitting it
+ * is what turns this from "a thing you run" into "a thing a pull request runs",
+ * and it is the single cheapest step on the roadmap.
+ *
+ * THE PROBLEM SARIF CREATES FOR THIS PROJECT, and how it is solved here.
+ *
+ * Every finding this tool emits is labelled signature-based (pattern matched,
+ * data flow NOT traced) or flow-verified (a source-to-sink path was followed
+ * and is printed). That distinction is the whole product. SARIF has no field
+ * for it: `level` carries severity, and there is nowhere that means "we did not
+ * check this one".
+ *
+ * So a naive export loses the differentiator at exactly the moment it matters -
+ * in CI, where nobody reads a terminal and a red annotation looks equally
+ * certain either way. Three things carry it across instead, deliberately
+ * redundant, because a consumer that ignores one should still meet the others:
+ *
+ *   1. `message.text` OPENS with the label. It is the one string every SARIF
+ *      consumer displays, so the label cannot be dropped by a viewer that
+ *      ignores everything else.
+ *   2. `properties.confidence` holds the machine-readable value, alongside
+ *      `properties.limitations` - the rule's own statement of what it did not
+ *      check.
+ *   3. `codeFlows` is populated for flow-verified findings ONLY. SARIF has a
+ *      first-class representation for a traced path, and GitHub renders it as a
+ *      clickable sequence of steps. A finding with a codeFlow is one we proved;
+ *      a finding without one is one we guessed. That asymmetry is visible in
+ *      the UI without reading any of our text.
+ *
+ * WHAT IS DELIBERATELY NOT CLAIMED: `securitySeverity` is emitted because
+ * GitHub sorts by it, but it is derived from our severity rather than from CVSS,
+ * and the property block says so. Inventing a CVSS vector we never computed
+ * would be the same class of lie the confidence labels exist to prevent.
+ */
+/**
+ * SARIF has four levels; we have five severities.
+ *
+ * `low` maps to note rather than warning on purpose: a note does not fail a
+ * default GitHub check, and after the test-file ranking work most `low`
+ * findings are exactly the "unescaped, but no source traced" class that should
+ * be visible without blocking anyone's merge.
+ */
+const SARIF_LEVEL = {
+    critical: 'error',
+    high: 'error',
+    medium: 'warning',
+    low: 'note',
+    info: 'none',
+};
+/** GitHub buckets these: >=9 critical, >=7 high, >=4 medium, >0 low. */
+const SECURITY_SEVERITY = {
+    critical: '9.3',
+    high: '7.5',
+    medium: '5.0',
+    low: '3.0',
+    info: '0.0',
+};
+/** SARIF wants a URI, and a Windows path is not one. */
+function toUri(filePath) {
+    return filePath.replace(/\\/g, '/').replace(/^\.\//, '');
+}
+function regionOf(location) {
+    return {
+        startLine: Math.max(1, location.startLine),
+        startColumn: Math.max(1, location.startColumn + 1), // SARIF columns are 1-based
+        endLine: Math.max(1, location.endLine),
+        endColumn: Math.max(1, location.endColumn + 1),
+        ...(location.snippet ? { snippet: { text: location.snippet } } : {}),
+    };
+}
+function physicalLocation(location) {
+    return {
+        physicalLocation: {
+            artifactLocation: { uri: toUri(location.file) },
+            region: regionOf(location),
+        },
+    };
+}
+export function renderSarif(result, pretty = true) {
+    // One rule descriptor per rule that actually fired. Emitting the whole
+    // catalogue would list rules this run never applied, which reads as coverage.
+    const seen = new Map();
+    for (const finding of result.findings) {
+        if (!seen.has(finding.ruleId))
+            seen.set(finding.ruleId, finding);
+    }
+    const rules = [...seen.values()].map((finding) => ({
+        id: finding.ruleId,
+        name: finding.ruleName,
+        shortDescription: { text: finding.ruleName },
+        fullDescription: {
+            // The limitations text travels with the rule, so a consumer reading the
+            // rule metadata meets the caveats without opening our JSON report.
+            text: finding.limitations,
+        },
+        help: {
+            text: `${finding.ruleName}\n\n${finding.limitations}`,
+            markdown: `**${finding.ruleName}**\n\n${finding.limitations}`,
+        },
+        properties: {
+            tags: ['security', finding.cwe, finding.owasp].filter(Boolean),
+            'security-severity': SECURITY_SEVERITY[finding.severity],
+            precision: 'medium',
+        },
+    }));
+    const results = result.findings.map((finding) => {
+        const label = finding.verified ? 'flow-verified' : 'signature-based, UNVERIFIED';
+        const base = {
+            ruleId: finding.ruleId,
+            level: SARIF_LEVEL[finding.severity],
+            message: { text: `[${label}] ${finding.message}\n\n${finding.reasoning}` },
+            locations: [physicalLocation(finding.location)],
+            properties: {
+                confidence: finding.confidence,
+                severity: finding.severity,
+                cwe: finding.cwe,
+                owasp: finding.owasp,
+                limitations: finding.limitations,
+                'security-severity': SECURITY_SEVERITY[finding.severity],
+                securitySeverityIsDerived: 'Derived from our own severity, not from a CVSS vector. No CVSS score was computed.',
+            },
+        };
+        // A traced path becomes a real SARIF codeFlow. Signature findings get none,
+        // which is the honest shape: there is no flow to show.
+        if (!finding.verified || !finding.flowPath || finding.flowPath.length === 0)
+            return base;
+        return {
+            ...base,
+            codeFlows: [
+                {
+                    message: { text: `Traced ${finding.flowPath.length} steps from source to sink.` },
+                    threadFlows: [
+                        {
+                            locations: finding.flowPath.map((step) => ({
+                                location: {
+                                    ...physicalLocation(step.location),
+                                    message: { text: `${step.kind}: ${step.description}` },
+                                },
+                                // SARIF's own vocabulary for taint. A consumer that understands
+                                // it can render source and sink differently without parsing our
+                                // prose.
+                                kinds: step.kind === 'source'
+                                    ? ['taint', 'source']
+                                    : step.kind === 'sink'
+                                        ? ['taint', 'sink']
+                                        : ['taint'],
+                            })),
+                        },
+                    ],
+                },
+            ],
+        };
+    });
+    /*
+     * TYPED AS `Sarif.Log`, WHICH IS THE POINT.
+     *
+     * The JSON report's own comment says emitting invalid SARIF and calling it
+     * SARIF would be its own small lie. A hand-rolled object literal that merely
+     * LOOKS like SARIF is exactly that lie waiting to happen, so the shape is
+     * checked by the compiler against the official 2.1.0 type definitions
+     * (@types/sarif, a devDependency). A misspelled property or a wrong nesting
+     * level fails `npm run build` rather than failing silently inside somebody's
+     * CI three months from now.
+     *
+     * This validates STRUCTURE, not semantics: the compiler confirms this is a
+     * well-formed SARIF log, not that GitHub will render it the way intended.
+     */
+    const document = {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'Defuse',
+                        version: result.coverage.engine.version,
+                        informationUri: 'https://github.com/',
+                        rules,
+                    },
+                },
+                results,
+                invocations: [
+                    {
+                        executionSuccessful: true,
+                        // Files we could not parse are stated, not swallowed - a green CI
+                        // run over a file nobody read is the quietest kind of false clean.
+                        ...(result.parseProblems.length > 0
+                            ? {
+                                toolExecutionNotifications: result.parseProblems.map((problem) => ({
+                                    level: 'warning',
+                                    message: {
+                                        text: `${problem.file} did not parse cleanly (${problem.issues.length} issue(s)). ` +
+                                            `Findings in this file may be incomplete.`,
+                                    },
+                                })),
+                            }
+                            : {}),
+                    },
+                ],
+                properties: {
+                    // The same honesty block the JSON report leads with. A CI consumer
+                    // that only ever reads SARIF still gets the engine's own account of
+                    // what it does not do.
+                    signatureBasedFindings: result.findings.filter((f) => !f.verified).length,
+                    flowVerifiedFindings: result.findings.filter((f) => f.verified).length,
+                    notImplemented: result.coverage.engine.notImplemented,
+                    meaningOfConfidence: result.coverage.engine.meaningOfConfidence,
+                    filesParsed: result.stats.filesParsed,
+                    filesSkipped: result.stats.filesSkipped,
+                },
+            },
+        ],
+    };
+    return pretty ? JSON.stringify(document, null, 2) : JSON.stringify(document);
+}
+//# sourceMappingURL=sarif.js.map

package/dist/src/report/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../../src/report/sarif.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH;;;;;;;GAOG;AACH,MAAM,WAAW,GAA4D;IAC3E,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,wEAAwE;AACxE,MAAM,iBAAiB,GAA6B;IAClD,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF,wDAAwD;AACxD,SAAS,KAAK,CAAC,QAAgB;IAC7B,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,QAA6B;IAC7C,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC1C,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,4BAA4B;QAChF,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC;QACtC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA6B;IACrD,OAAO;QACL,gBAAgB,EAAE;YAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YAC/C,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAkB,EAAE,MAAM,GAAG,IAAI;IAC3D,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjD,EAAE,EAAE,OAAO,CAAC,MAAM;QAClB,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC5C,eAAe,EAAE;YACf,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,EAAE,OAAO,CAAC,WAAW;SAC1B;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,GAAG,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,WAAW,EAAE;YACrD,QAAQ,EAAE,KAAK,OAAO,CAAC,QAAQ,SAAS,OAAO,CAAC,WAAW,EAAE;SAC9D;QACD,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC9D,mBAAmB,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxD,SAAS,EAAE,QAAQ;SACpB;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,6BAA6B,CAAC;QACjF,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,KAAK,OAAO,CAAC,OAAO,OAAO,OAAO,CAAC,SAAS,EAAE,EAAE;YAC1E,SAAS,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/C,UAAU,EAAE;gBACV,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,mBAAmB,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACxD,yBAAyB,EACvB,oFAAoF;aACvF;SACF,CAAC;QAEF,4EAA4E;QAC5E,uDAAuD;QACvD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzF,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,OAAO,CAAC,QAAQ,CAAC,MAAM,6BAA6B,EAAE;oBACjF,WAAW,EAAE;wBACX;4BACE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gCACzC,QAAQ,EAAE;oCACR,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;oCAClC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE;iCACvD;gCACD,gEAAgE;gCAChE,gEAAgE;gCAChE,SAAS;gCACT,KAAK,EACH,IAAI,CAAC,IAAI,KAAK,QAAQ;oCACpB,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC;oCACrB,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM;wCACpB,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;wCACnB,CAAC,CAAC,CAAC,OAAO,CAAC;6BAClB,CAAC,CAAC;yBACJ;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;OAaG;IACH,MAAM,QAAQ,GAAc;QAC1B,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;wBACvC,cAAc,EAAE,qBAAqB;wBACrC,KAAK;qBACN;iBACF;gBACD,OAAO;gBACP,WAAW,EAAE;oBACX;wBACE,mBAAmB,EAAE,IAAI;wBACzB,kEAAkE;wBAClE,mEAAmE;wBACnE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;4BACjC,CAAC,CAAC;gCACE,0BAA0B,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oCACjE,KAAK,EAAE,SAAkB;oCACzB,OAAO,EAAE;wCACP,IAAI,EACF,GAAG,OAAO,CAAC,IAAI,2BAA2B,OAAO,CAAC,MAAM,CAAC,MAAM,cAAc;4CAC7E,0CAA0C;qCAC7C;iCACF,CAAC,CAAC;6BACJ;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACD,UAAU,EAAE;oBACV,mEAAmE;oBACnE,oEAAoE;oBACpE,uBAAuB;oBACvB,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM;oBACzE,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM;oBACtE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc;oBACrD,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB;oBAC/D,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;oBACrC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;iBACxC;aACF;SACF;KACF,CAAC;IAEF,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC/E,CAAC"}