@skillsmith/core 0.5.5 → 0.5.6

package/dist/scripts/skill-scanner/allowlist.d.ts

@@ -0,0 +1,38 @@
+/**
+ * SMI-4396: Imported-skills security allowlist.
+ *
+ * Loads data/skills-security-allowlist.json and produces an AllowlistMatcher
+ * that shouldQuarantine + scanSkill consult to drop known false-positive
+ * findings from the quarantine predicate.
+ *
+ * Design invariants:
+ * - Per-(skillId, findingType, messagePattern, matchField) scope — never whole-skill bypass.
+ * - 90-day expiry enforced at match time; expired entries behave as absent.
+ * - ReDoS-hardened: load-time regex validation rejects nested quantifiers and
+ *   unbounded wildcards; runtime uses safeRegexTest with length cap.
+ * - Fail-safe toward quarantine: malformed entries throw at load; unknown
+ *   matchField rejects.
+ */
+import type { AllowlistEntry, AllowlistFile, AllowlistMatcher } from './types.js';
+/**
+ * Parse a raw allowlist file object. Throws on malformed shape, invalid
+ * dates, unsafe regex, or missing required fields.
+ */
+export declare function parseAllowlistFile(raw: unknown): AllowlistFile;
+/** Reset expiry-warning dedupe cache. Exposed for tests. */
+export declare function _resetExpiryWarningCache(): void;
+/**
+ * Empty matcher — returns false for every check. Used when the allowlist file
+ * is absent and for callers that want to opt out without conditional plumbing.
+ */
+export declare const EMPTY_ALLOWLIST: AllowlistMatcher;
+/**
+ * Load + validate an allowlist JSON file and return a matcher.
+ *
+ * If `path` does not exist, returns EMPTY_ALLOWLIST. A malformed file throws
+ * (fail-safe toward quarantine — never silently skip validation).
+ */
+export declare function loadAllowlist(path: string): AllowlistMatcher;
+/** Build a matcher from an in-memory entry list (test + inline use). */
+export declare function buildMatcher(entries: AllowlistEntry[]): AllowlistMatcher;
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/scripts/skill-scanner/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAA;AA0ElG;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAgB9D;AAsDD,4DAA4D;AAC5D,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,gBAI7B,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAa5D;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAIxE"}

package/dist/scripts/skill-scanner/allowlist.js

@@ -0,0 +1,178 @@
+/**
+ * SMI-4396: Imported-skills security allowlist.
+ *
+ * Loads data/skills-security-allowlist.json and produces an AllowlistMatcher
+ * that shouldQuarantine + scanSkill consult to drop known false-positive
+ * findings from the quarantine predicate.
+ *
+ * Design invariants:
+ * - Per-(skillId, findingType, messagePattern, matchField) scope — never whole-skill bypass.
+ * - 90-day expiry enforced at match time; expired entries behave as absent.
+ * - ReDoS-hardened: load-time regex validation rejects nested quantifiers and
+ *   unbounded wildcards; runtime uses safeRegexTest with length cap.
+ * - Fail-safe toward quarantine: malformed entries throw at load; unknown
+ *   matchField rejects.
+ */
+import * as fs from 'fs';
+import { safeRegexCheck } from '../../security/scanner/regex-utils.js';
+const REQUIRED_ENTRY_FIELDS = [
+    'skillId',
+    'findingType',
+    'messagePattern',
+    'reason',
+    'reviewedBy',
+    'reviewedAt',
+    'expiresAt',
+];
+const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+/**
+ * Reject regex patterns known to cause catastrophic backtracking.
+ * Callers must catch; signals a bad allowlist file at load time.
+ */
+function validateRegexSafety(pattern, entryIndex) {
+    // Nested quantifier: (x+)+, (x*)*, (x+)*, etc.
+    if (/\([^)]*[*+?][^)]*\)[*+?]/.test(pattern)) {
+        throw new Error(`Allowlist entry #${entryIndex} messagePattern has nested quantifier (ReDoS risk): ${pattern}`);
+    }
+    // Unbounded greedy wildcard outside a character class: .* or .+ without upper bound.
+    // Character-class forms like [^x]* are allowed since they bound the repeated set.
+    if (/(?<!\[[^\]]*)\.[*+](?!\?)/.test(pattern)) {
+        throw new Error(`Allowlist entry #${entryIndex} messagePattern has unbounded .*/.+ (ReDoS risk). ` +
+            `Use bounded form like .{0,100}? or a character class instead: ${pattern}`);
+    }
+    // Compile to surface any other regex syntax errors up-front.
+    try {
+        new RegExp(pattern);
+    }
+    catch (err) {
+        throw new Error(`Allowlist entry #${entryIndex} messagePattern is invalid regex: ${err.message}`);
+    }
+}
+function validateEntryShape(entry, entryIndex) {
+    if (typeof entry !== 'object' || entry === null) {
+        throw new Error(`Allowlist entry #${entryIndex} is not an object`);
+    }
+    const e = entry;
+    for (const field of REQUIRED_ENTRY_FIELDS) {
+        if (typeof e[field] !== 'string' || e[field].length === 0) {
+            throw new Error(`Allowlist entry #${entryIndex} missing or empty required field: ${String(field)}`);
+        }
+    }
+    if (e.matchField !== undefined && e.matchField !== 'message' && e.matchField !== 'location') {
+        throw new Error(`Allowlist entry #${entryIndex} matchField must be 'message' or 'location', got: ${String(e.matchField)}`);
+    }
+    if (!DATE_PATTERN.test(e.reviewedAt)) {
+        throw new Error(`Allowlist entry #${entryIndex} reviewedAt must be YYYY-MM-DD, got: ${String(e.reviewedAt)}`);
+    }
+    if (!DATE_PATTERN.test(e.expiresAt)) {
+        throw new Error(`Allowlist entry #${entryIndex} expiresAt must be YYYY-MM-DD, got: ${String(e.expiresAt)}`);
+    }
+    validateRegexSafety(e.messagePattern, entryIndex);
+    return e;
+}
+/**
+ * Parse a raw allowlist file object. Throws on malformed shape, invalid
+ * dates, unsafe regex, or missing required fields.
+ */
+export function parseAllowlistFile(raw) {
+    if (typeof raw !== 'object' || raw === null) {
+        throw new Error('Allowlist file root must be an object');
+    }
+    const r = raw;
+    if (r.version !== 1) {
+        throw new Error(`Unsupported allowlist file version: ${String(r.version)} (expected 1)`);
+    }
+    if (typeof r.generatedAt !== 'string') {
+        throw new Error('Allowlist file missing generatedAt (ISO-8601 string)');
+    }
+    if (!Array.isArray(r.allowlist)) {
+        throw new Error('Allowlist file .allowlist must be an array');
+    }
+    const entries = r.allowlist.map((entry, i) => validateEntryShape(entry, i));
+    return { version: 1, generatedAt: r.generatedAt, allowlist: entries };
+}
+/**
+ * Matcher implementation backed by a pre-validated entry list.
+ */
+class EntryListMatcher {
+    compiledEntries;
+    constructor(entries) {
+        this.compiledEntries = entries.map((entry) => ({
+            entry,
+            regex: new RegExp(entry.messagePattern),
+            expiresAt: new Date(`${entry.expiresAt}T23:59:59Z`),
+        }));
+    }
+    isAllowed(skillId, finding, today = new Date()) {
+        for (const compiled of this.compiledEntries) {
+            const { entry, regex, expiresAt } = compiled;
+            if (entry.skillId !== skillId)
+                continue;
+            if (entry.findingType !== finding.type)
+                continue;
+            if (today > expiresAt) {
+                // Expired entry: log once per (skillId, findingType) and fall through to next.
+                logExpiryWarning(entry);
+                continue;
+            }
+            const field = entry.matchField ?? 'message';
+            const target = field === 'location' ? (finding.location ?? '') : finding.message;
+            if (safeRegexCheck(regex, target)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
+/** Tracks already-logged expiry warnings so we don't spam on every finding. */
+const loggedExpirySet = new Set();
+function logExpiryWarning(entry) {
+    const key = `${entry.skillId}::${entry.findingType}::${entry.expiresAt}`;
+    if (loggedExpirySet.has(key))
+        return;
+    loggedExpirySet.add(key);
+    console.warn(`allowlist:expired skillId=${entry.skillId} findingType=${entry.findingType} ` +
+        `expiredAt=${entry.expiresAt} — entry behaving as absent (fail-safe). ` +
+        `Refresh reviewedAt/expiresAt in data/skills-security-allowlist.json or remove.`);
+}
+/** Reset expiry-warning dedupe cache. Exposed for tests. */
+export function _resetExpiryWarningCache() {
+    loggedExpirySet.clear();
+}
+/**
+ * Empty matcher — returns false for every check. Used when the allowlist file
+ * is absent and for callers that want to opt out without conditional plumbing.
+ */
+export const EMPTY_ALLOWLIST = {
+    isAllowed() {
+        return false;
+    },
+};
+/**
+ * Load + validate an allowlist JSON file and return a matcher.
+ *
+ * If `path` does not exist, returns EMPTY_ALLOWLIST. A malformed file throws
+ * (fail-safe toward quarantine — never silently skip validation).
+ */
+export function loadAllowlist(path) {
+    if (!fs.existsSync(path)) {
+        return EMPTY_ALLOWLIST;
+    }
+    const raw = fs.readFileSync(path, 'utf-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Allowlist file ${path} is not valid JSON: ${err.message}`);
+    }
+    const file = parseAllowlistFile(parsed);
+    return new EntryListMatcher(file.allowlist);
+}
+/** Build a matcher from an in-memory entry list (test + inline use). */
+export function buildMatcher(entries) {
+    // Run the same validation pass as file load to catch unsafe patterns.
+    entries.forEach((entry, i) => validateEntryShape(entry, i));
+    return new EntryListMatcher(entries);
+}
+//# sourceMappingURL=allowlist.js.map

package/dist/scripts/skill-scanner/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAGtE,MAAM,qBAAqB,GAAgC;IACzD,SAAS;IACT,aAAa;IACb,gBAAgB;IAChB,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,WAAW;CACZ,CAAA;AAED,MAAM,YAAY,GAAG,qBAAqB,CAAA;AAE1C;;;GAGG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,UAAkB;IAC9D,+CAA+C;IAC/C,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,uDAAuD,OAAO,EAAE,CAC/F,CAAA;IACH,CAAC;IACD,qFAAqF;IACrF,kFAAkF;IAClF,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,oDAAoD;YAChF,iEAAiE,OAAO,EAAE,CAC7E,CAAA;IACH,CAAC;IACD,6DAA6D;IAC7D,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,qCAAsC,GAAa,CAAC,OAAO,EAAE,CAC5F,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,UAAkB;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,mBAAmB,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,qCAAqC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,qDAAqD,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAC1G,CAAA;IACH,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,UAAoB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,wCAAwC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAC7F,CAAA;IACH,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAmB,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,uCAAuC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAC3F,CAAA;IACH,CAAC;IACD,mBAAmB,CAAC,CAAC,CAAC,cAAwB,EAAE,UAAU,CAAC,CAAA;IAC3D,OAAO,CAA8B,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAA;IACxC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,gBAAgB;IACH,eAAe,CAI9B;IAEF,YAAY,OAAyB;QACnC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,KAAK;YACL,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;YACvC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,YAAY,CAAC;SACpD,CAAC,CAAC,CAAA;IACL,CAAC;IAED,SAAS,CAAC,OAAe,EAAE,OAAwB,EAAE,QAAc,IAAI,IAAI,EAAE;QAC3E,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAA;YAC5C,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAQ;YACvC,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI;gBAAE,SAAQ;YAChD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;gBACtB,+EAA+E;gBAC/E,gBAAgB,CAAC,KAAK,CAAC,CAAA;gBACvB,SAAQ;YACV,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,IAAI,SAAS,CAAA;YAC3C,MAAM,MAAM,GAAG,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;YAChF,IAAI,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;AAEzC,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,EAAE,CAAA;IACxE,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAM;IACpC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,CAAC,IAAI,CACV,6BAA6B,KAAK,CAAC,OAAO,gBAAgB,KAAK,CAAC,WAAW,GAAG;QAC5E,aAAa,KAAK,CAAC,SAAS,2CAA2C;QACvE,gFAAgF,CACnF,CAAA;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,wBAAwB;IACtC,eAAe,CAAC,KAAK,EAAE,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqB;IAC/C,SAAS;QACP,OAAO,KAAK,CAAA;IACd,CAAC;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,eAAe,CAAA;IACxB,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC1C,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACvC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC7C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,OAAyB;IACpD,sEAAsE;IACtE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3D,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;AACtC,CAAC"}

package/dist/scripts/skill-scanner/categorizer.d.ts

@@ -0,0 +1,43 @@
+/**
+ * SMI-1189: Skill Categorizer
+ *
+ * Skill categorization and severity determination logic.
+ */
+import type { SecurityFinding } from '../../security/index.js';
+import type { SeverityCategory } from './types.js';
+export type { SeverityCategory };
+/**
+ * Determines the severity category based on the highest severity finding
+ *
+ * @param findings - Array of security findings
+ * @returns The highest severity category found
+ */
+export declare function determineSeverityCategory(findings: SecurityFinding[]): SeverityCategory;
+/**
+ * Initialize empty severity counts
+ *
+ * @returns Record with all severity categories set to 0
+ */
+export declare function initializeSeverityCounts(): Record<SeverityCategory, number>;
+/**
+ * Count skills by severity category
+ *
+ * @param results - Array of scan results with severity categories
+ * @returns Record mapping severity categories to counts
+ */
+export declare function countBySeverity(results: Array<{
+    severityCategory: SeverityCategory;
+}>): Record<SeverityCategory, number>;
+/**
+ * Sort severity categories by priority (most severe first)
+ */
+export declare const SEVERITY_PRIORITY: SeverityCategory[];
+/**
+ * Compare two severity categories
+ *
+ * @param a - First severity category
+ * @param b - Second severity category
+ * @returns Negative if a is more severe, positive if b is more severe
+ */
+export declare function compareSeverity(a: SeverityCategory, b: SeverityCategory): number;
+//# sourceMappingURL=categorizer.d.ts.map

package/dist/scripts/skill-scanner/categorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"categorizer.d.ts","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/categorizer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGlD,YAAY,EAAE,gBAAgB,EAAE,CAAA;AAEhC;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,gBAAgB,CAKvF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAO3E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,KAAK,CAAC;IAAE,gBAAgB,EAAE,gBAAgB,CAAA;CAAE,CAAC,GACrD,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAQlC;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,gBAAgB,EAA0C,CAAA;AAE1F;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAEhF"}

package/dist/scripts/skill-scanner/categorizer.js

@@ -0,0 +1,61 @@
+/**
+ * SMI-1189: Skill Categorizer
+ *
+ * Skill categorization and severity determination logic.
+ */
+/**
+ * Determines the severity category based on the highest severity finding
+ *
+ * @param findings - Array of security findings
+ * @returns The highest severity category found
+ */
+export function determineSeverityCategory(findings) {
+    if (findings.some((f) => f.severity === 'critical'))
+        return 'CRITICAL';
+    if (findings.some((f) => f.severity === 'high'))
+        return 'HIGH';
+    if (findings.some((f) => f.severity === 'medium'))
+        return 'MEDIUM';
+    return 'LOW';
+}
+/**
+ * Initialize empty severity counts
+ *
+ * @returns Record with all severity categories set to 0
+ */
+export function initializeSeverityCounts() {
+    return {
+        CRITICAL: 0,
+        HIGH: 0,
+        MEDIUM: 0,
+        LOW: 0,
+    };
+}
+/**
+ * Count skills by severity category
+ *
+ * @param results - Array of scan results with severity categories
+ * @returns Record mapping severity categories to counts
+ */
+export function countBySeverity(results) {
+    const counts = initializeSeverityCounts();
+    for (const result of results) {
+        counts[result.severityCategory]++;
+    }
+    return counts;
+}
+/**
+ * Sort severity categories by priority (most severe first)
+ */
+export const SEVERITY_PRIORITY = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'];
+/**
+ * Compare two severity categories
+ *
+ * @param a - First severity category
+ * @param b - Second severity category
+ * @returns Negative if a is more severe, positive if b is more severe
+ */
+export function compareSeverity(a, b) {
+    return SEVERITY_PRIORITY.indexOf(a) - SEVERITY_PRIORITY.indexOf(b);
+}
+//# sourceMappingURL=categorizer.js.map

package/dist/scripts/skill-scanner/categorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"categorizer.js","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/categorizer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,UAAU,CAAA;IACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;KACP,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsD;IAEtD,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAA;IAEzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAA;IACnC,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,CAAmB,EAAE,CAAmB;IACtE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACpE,CAAC"}

package/dist/scripts/skill-scanner/file-scanner.d.ts

@@ -0,0 +1,43 @@
+/**
+ * SMI-1189: File Scanner
+ *
+ * File system scanning and content extraction.
+ */
+import type { ImportedSkill } from './types.js';
+/**
+ * Extracts scannable content from an imported skill
+ * Combines all text fields that should be scanned
+ *
+ * @param skill - The imported skill to extract content from
+ * @returns Combined text content for scanning
+ */
+export declare function extractScannableContent(skill: ImportedSkill): string;
+/**
+ * Read and parse imported skills from a JSON file
+ *
+ * @param inputPath - Path to the imported skills JSON file
+ * @returns Array of imported skills
+ * @throws Error if file cannot be read or parsed
+ */
+export declare function readImportedSkills(inputPath: string): Promise<ImportedSkill[]>;
+/**
+ * Ensure a directory exists, creating it if necessary
+ *
+ * @param dirPath - Path to the directory
+ */
+export declare function ensureDirectoryExists(dirPath: string): void;
+/**
+ * Check if a file exists
+ *
+ * @param filePath - Path to the file
+ * @returns true if file exists
+ */
+export declare function fileExists(filePath: string): boolean;
+/**
+ * Write JSON data to a file
+ *
+ * @param filePath - Path to the output file
+ * @param data - Data to write
+ */
+export declare function writeJsonFile(filePath: string, data: unknown): Promise<void>;
+//# sourceMappingURL=file-scanner.d.ts.map

package/dist/scripts/skill-scanner/file-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-scanner.d.ts","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/file-scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoBpE;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAmBpF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAI3D;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF"}

package/dist/scripts/skill-scanner/file-scanner.js

@@ -0,0 +1,90 @@
+/**
+ * SMI-1189: File Scanner
+ *
+ * File system scanning and content extraction.
+ */
+import * as fs from 'fs/promises';
+import { existsSync, mkdirSync } from 'fs';
+/**
+ * Extracts scannable content from an imported skill
+ * Combines all text fields that should be scanned
+ *
+ * @param skill - The imported skill to extract content from
+ * @returns Combined text content for scanning
+ */
+export function extractScannableContent(skill) {
+    const parts = [];
+    if (skill.name)
+        parts.push(`# ${skill.name}`);
+    if (skill.description)
+        parts.push(skill.description);
+    if (skill.content)
+        parts.push(skill.content);
+    if (skill.instructions)
+        parts.push(skill.instructions);
+    if (skill.trigger)
+        parts.push(skill.trigger);
+    if (skill.tags?.length)
+        parts.push(`Tags: ${skill.tags.join(', ')}`);
+    // Include metadata if present
+    if (skill.metadata) {
+        try {
+            parts.push(JSON.stringify(skill.metadata));
+        }
+        catch {
+            // Ignore serialization errors
+        }
+    }
+    return parts.join('\n\n');
+}
+/**
+ * Read and parse imported skills from a JSON file
+ *
+ * @param inputPath - Path to the imported skills JSON file
+ * @returns Array of imported skills
+ * @throws Error if file cannot be read or parsed
+ */
+export async function readImportedSkills(inputPath) {
+    const content = await fs.readFile(inputPath, 'utf-8');
+    const parsed = JSON.parse(content);
+    // Handle both array format and object with skills property
+    if (Array.isArray(parsed)) {
+        return parsed;
+    }
+    if (typeof parsed === 'object' &&
+        parsed !== null &&
+        'skills' in parsed &&
+        Array.isArray(parsed.skills)) {
+        return parsed.skills;
+    }
+    throw new Error('Invalid format: expected array or object with skills array');
+}
+/**
+ * Ensure a directory exists, creating it if necessary
+ *
+ * @param dirPath - Path to the directory
+ */
+export function ensureDirectoryExists(dirPath) {
+    if (!existsSync(dirPath)) {
+        mkdirSync(dirPath, { recursive: true });
+    }
+}
+/**
+ * Check if a file exists
+ *
+ * @param filePath - Path to the file
+ * @returns true if file exists
+ */
+export function fileExists(filePath) {
+    return existsSync(filePath);
+}
+/**
+ * Write JSON data to a file
+ *
+ * @param filePath - Path to the output file
+ * @param data - Data to write
+ */
+export async function writeJsonFile(filePath, data) {
+    await fs.writeFile(filePath, JSON.stringify(data, null, 2));
+}
+//# sourceMappingURL=file-scanner.js.map

package/dist/scripts/skill-scanner/file-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-scanner.js","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/file-scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AAG1C;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAoB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACpD,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,KAAK,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACtD,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEpE,8BAA8B;IAC9B,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACxD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAA;IAE7C,2DAA2D;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAyB,CAAA;IAClC,CAAC;IAED,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,QAAQ,IAAI,MAAM;QAClB,KAAK,CAAC,OAAO,CAAE,MAA8B,CAAC,MAAM,CAAC,EACrD,CAAC;QACD,OAAQ,MAAsC,CAAC,MAAM,CAAA;IACvD,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAa;IACjE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC"}

package/dist/scripts/skill-scanner/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SMI-864: Security Scanner for Imported Skills
+ * SMI-1189: Refactored into modular structure
+ * SMI-XXX: Improved output format with progress bars, tables, and JSON support
+ *
+ * Scans all skills from imported-skills.json for security vulnerabilities
+ * and categorizes them by severity level.
+ *
+ * Usage: npx tsx packages/core/src/scripts/skill-scanner/index.ts [options] [path-to-imported-skills.json]
+ *
+ * Options:
+ *   --json      Output results in JSON format (machine-readable, CI-friendly)
+ *   --verbose   Show detailed output including all findings
+ *   --quiet     Minimal output (only errors and final summary)
+ *   --help      Show this help message
+ *
+ * Output Files:
+ * - data/security-report.json: Full security report with all findings
+ * - data/quarantine-skills.json: Skills with HIGH/CRITICAL findings (blocked)
+ * - data/safe-skills.json: Skills approved for import (passed security scan)
+ */
+export * from './types.js';
+export * from './categorizer.js';
+export * from './trust-scorer.js';
+export * from './file-scanner.js';
+export * from './logger.js';
+export * from './reporter.js';
+export { scanImportedSkills, DEFAULT_CONFIG, DEFAULT_CLI_OPTIONS } from './scanner.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/scripts/skill-scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA"}

package/dist/scripts/skill-scanner/index.js

@@ -0,0 +1,134 @@
+/**
+ * SMI-864: Security Scanner for Imported Skills
+ * SMI-1189: Refactored into modular structure
+ * SMI-XXX: Improved output format with progress bars, tables, and JSON support
+ *
+ * Scans all skills from imported-skills.json for security vulnerabilities
+ * and categorizes them by severity level.
+ *
+ * Usage: npx tsx packages/core/src/scripts/skill-scanner/index.ts [options] [path-to-imported-skills.json]
+ *
+ * Options:
+ *   --json      Output results in JSON format (machine-readable, CI-friendly)
+ *   --verbose   Show detailed output including all findings
+ *   --quiet     Minimal output (only errors and final summary)
+ *   --help      Show this help message
+ *
+ * Output Files:
+ * - data/security-report.json: Full security report with all findings
+ * - data/quarantine-skills.json: Skills with HIGH/CRITICAL findings (blocked)
+ * - data/safe-skills.json: Skills approved for import (passed security scan)
+ */
+import { scanImportedSkills, DEFAULT_CONFIG } from './scanner.js';
+// Re-export all public types and functions
+export * from './types.js';
+export * from './categorizer.js';
+export * from './trust-scorer.js';
+export * from './file-scanner.js';
+export * from './logger.js';
+export * from './reporter.js';
+export { scanImportedSkills, DEFAULT_CONFIG, DEFAULT_CLI_OPTIONS } from './scanner.js';
+/**
+ * Parse command line arguments
+ *
+ * @param args - Command line arguments (process.argv.slice(2))
+ * @returns Parsed CLI options and input path
+ */
+function parseArgs(args) {
+    const options = {};
+    let inputPath = DEFAULT_CONFIG.defaultInput;
+    for (const arg of args) {
+        if (arg === '--json') {
+            options.json = true;
+        }
+        else if (arg === '--verbose' || arg === '-v') {
+            options.verbose = true;
+        }
+        else if (arg === '--quiet' || arg === '-q') {
+            options.quiet = true;
+        }
+        else if (arg === '--help' || arg === '-h') {
+            printHelp();
+            process.exit(0);
+        }
+        else if (!arg.startsWith('-')) {
+            inputPath = arg;
+        }
+        else {
+            console.error(`Unknown option: ${arg}`);
+            console.error('Use --help for usage information');
+            process.exit(1);
+        }
+    }
+    // Validate conflicting options
+    if (options.verbose && options.quiet) {
+        console.error('Error: --verbose and --quiet cannot be used together');
+        process.exit(1);
+    }
+    return { options, inputPath };
+}
+/**
+ * Print help message
+ */
+function printHelp() {
+    console.log(`
+Skillsmith Security Scanner
+
+Usage: npx tsx packages/core/src/scripts/scan-imported-skills.ts [options] [input-file]
+
+Options:
+  --json      Output results in JSON format (machine-readable, CI-friendly)
+  --verbose   Show detailed output including all findings
+  --quiet     Minimal output (only errors and final summary)
+  --help, -h  Show this help message
+
+Arguments:
+  input-file  Path to imported-skills.json (default: ./data/imported-skills.json)
+
+Examples:
+  # Basic scan with human-readable output
+  npx tsx packages/core/src/scripts/scan-imported-skills.ts
+
+  # JSON output for CI pipelines
+  npx tsx packages/core/src/scripts/scan-imported-skills.ts --json
+
+  # Scan specific file
+  npx tsx packages/core/src/scripts/scan-imported-skills.ts ./custom-skills.json
+
+  # JSON output to file
+  npx tsx packages/core/src/scripts/scan-imported-skills.ts --json > results.json
+
+Output Files:
+  - data/security-report.json     Full security report with all findings
+  - data/quarantine-skills.json   Skills with HIGH/CRITICAL findings (blocked)
+  - data/safe-skills.json         Skills approved for import (passed security scan)
+`);
+}
+/**
+ * CLI entry point
+ */
+async function main() {
+    const args = process.argv.slice(2);
+    const { options, inputPath } = parseArgs(args);
+    try {
+        await scanImportedSkills(inputPath, DEFAULT_CONFIG, options);
+    }
+    catch (error) {
+        if (options.json) {
+            console.log(JSON.stringify({
+                success: false,
+                error: error.message,
+            }));
+        }
+        else {
+            console.error('Fatal error:', error.message);
+            console.error(error.stack);
+        }
+        process.exit(1);
+    }
+}
+main().catch((error) => {
+    console.error('Unhandled error:', error);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/scripts/skill-scanner/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scripts/skill-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAGjE,2CAA2C;AAC3C,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAEtF;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAA+B,EAAE,CAAA;IAC9C,IAAI,SAAS,GAAG,cAAc,CAAC,YAAY,CAAA;IAE3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC/C,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;QACxB,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAA;QACtB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAA;YACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,SAAS,GAAG,GAAG,CAAA;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAA;YACvC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Bb,CAAC,CAAA;AACF,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAG,KAAe,CAAC,OAAO;aAChC,CAAC,CACH,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,cAAc,EAAG,KAAe,CAAC,OAAO,CAAC,CAAA;YACvD,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;IACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}