@sverka/playground 0.2.10 → 0.2.12

package/dist/index.d.mts

@@ -123,5 +123,73 @@ export declare class Entry {
  */
 export declare function runPipeline(project: Project): Promise<PipelineResult>;
 //#endregion
-export type { Construct, Finding, FindingSource, PipelineResult, PlaygroundFinding, Severity, Step, StepResult };
+//#region src/share.d.ts
+interface ShareableRun {
+  readonly schema: "sverka.playground/v1";
+  readonly code: string;
+  readonly findings?: readonly Finding[];
+}
+type PlaygroundErrorCode = "TRANSPILE_FAILED" | "DECODE_FAILED" | "PAYLOAD_TOO_LARGE";
+export declare class PlaygroundError extends Error {
+  readonly code: PlaygroundErrorCode;
+  constructor(code: PlaygroundErrorCode, message: string);
+}
+/** Fragment lengths are browser-dependent; warn past 32 KB of payload. */
+export declare const SHARE_PAYLOAD_WARN_BYTES: number;
+/** Encode a run into a share link. `base` is the page URL the link targets
+ *  (`location.origin + location.pathname` at runtime). */
+export declare function encodeShareLink(run: ShareableRun, base?: string): string;
+/** Decode a `#c=` fragment back into a ShareableRun. Corrupt, oversized, or
+ *  shape-invalid payloads throw PlaygroundError — callers fall back to the
+ *  default template. */
+export declare function decodeShareLink(hash: string): ShareableRun;
+//#endregion
+//#region src/embed.d.ts
+interface MountRunnerOptions {
+  /** Initial editor source. Defaults to the playground template. */
+  readonly code?: string;
+  /** Render the source as a fixed listing instead of an editable field. */
+  readonly readonly?: boolean;
+  /** Run `code` immediately on mount. Defaults to false — embed code may
+   *  come from a share link or CMS, so mounting never executes it unless
+   *  the embedder opts in or the user clicks Run. */
+  readonly autoRun?: boolean;
+  /** Called once per completed run. */
+  readonly onRun?: (result: PipelineResult) => void;
+}
+interface MountedRunner {
+  /** Remove the runner's DOM and listeners. */
+  dispose(): void;
+}
+/**
+ * Mount a self-contained runner inside `el`. `dispose()` tears the mount
+ * down. With `autoRun: true` the runner executes `code` once on mount;
+ * otherwise it waits for the Run button — embeds never auto-execute code
+ * the embedder didn't explicitly allow.
+ */
+export declare function mountRunner(el: HTMLElement, opts?: MountRunnerOptions): MountedRunner;
+//#endregion
+//#region src/engine.d.ts
+/** Default template shown in the editor. */
+export declare const DEFAULT_CODE: string;
+/**
+ * Evaluate user code and return the Project.
+ *
+ * SECURITY: This uses `new Function()` to execute user-provided code.
+ * This is intentional — the playground is a local development tool where
+ * the user writes and runs their own pipeline code. The code runs in the
+ * browser's main page context (not a sandboxed iframe or worker) because
+ * the playground needs to support synchronous FunctionStep execution and
+ * direct access to the pipeline constructs. This is the same trust model
+ * as a local REPL or `node -e`.
+ */
+export declare function evaluateUserCode(code: string): Project;
+/**
+ * Run a pipeline with a timeout. If a step returns a never-resolving
+ * promise, the timeout ensures the UI recovers instead of staying
+ * stuck in "Running" state forever.
+ */
+export declare function runPipelineWithTimeout(project: Project, timeoutMs: number): Promise<Awaited<ReturnType<typeof runPipeline>>>;
+//#endregion
+export type { Construct, Finding, FindingSource, MountRunnerOptions, MountedRunner, PipelineResult, PlaygroundErrorCode, PlaygroundFinding, Severity, ShareableRun, Step, StepResult };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/pipeline.ts","../src/runner.ts"],"mappings":";;KAGY;;UAGK;EACf;EACA;EACA;EACA;EACA;;;UAIe;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;;;;UAKe;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;;;UAIe;EACf;EACA;EACA,UAAU;EACV;EACA;;;UAIe;EACf,OAAO;EACP,UAAU;EACV;EACA;;;;;uBCrDoB;WACX;WACA,OAAO;EAEJ,YAAA,OAAO,kBAAkB;;MAMjC;;;qBASO,gBAAgB;WAClB,WAAW;EAER,YAAA;;EAKZ,YAAY,UAAU;;;qBAMX,iBAAiB;WACnB,OAAO;WACP,SAAS;EAEN,YAAA,SAAS,SAAS;;EAM9B,QAAQ,MAAM;;EAKd,SAAS,OAAO;;;uBAMI,aAAa;WACxB;EAEG,YAAA,UAAU,UAAU,YAAY;;WAOnC,WAAW,QAAQ,uBAAuB;;;qBAIxC,qBAAqB;WACvB,UAAU,QAAQ,uBAAuB;EAGhD,YAAA,UAAU,UACV,YACA;IACE,UAAU,QAAQ,uBAAuB;IACzC;;EAOJ,WAAW,QAAQ,uBAAuB;;;qBAM/B;WACF,UAAU;WACV;WACA;IAAW;;WACX;EAGP,YAAA,UAAU,UACV,YACA;IAAW;MAAW;;IAAgB;;;;;;;;;;;;;wBCtBpB,YAAY,SAAS,UAAU,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/pipeline.ts","../src/runner.ts","../src/share.ts","../src/embed.ts","../src/engine.ts"],"mappings":";;KAGY;;UAGK;EACf;EACA;EACA;EACA;EACA;;;UAIe;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;;;;UAKe;EACf;EACA;EACA;EACA,UAAU;EACV;EACA;EACA;;;UAIe;EACf;EACA;EACA,UAAU;EACV;EACA;;;UAIe;EACf,OAAO;EACP,UAAU;EACV;EACA;;;;;uBCrDoB;WACX;WACA,OAAO;EAEJ,YAAA,OAAO,kBAAkB;;MAMjC;;;qBASO,gBAAgB;WAClB,WAAW;EAER,YAAA;;EAKZ,YAAY,UAAU;;;qBAMX,iBAAiB;WACnB,OAAO;WACP,SAAS;EAEN,YAAA,SAAS,SAAS;;EAM9B,QAAQ,MAAM;;EAKd,SAAS,OAAO;;;uBAMI,aAAa;WACxB;EAEG,YAAA,UAAU,UAAU,YAAY;;WAOnC,WAAW,QAAQ,uBAAuB;;;qBAIxC,qBAAqB;WACvB,UAAU,QAAQ,uBAAuB;EAGhD,YAAA,UAAU,UACV,YACA;IACE,UAAU,QAAQ,uBAAuB;IACzC;;EAOJ,WAAW,QAAQ,uBAAuB;;;qBAM/B;WACF,UAAU;WACV;WACA;IAAW;;WACX;EAGP,YAAA,UAAU,UACV,YACA;IAAW;MAAW;;IAAgB;;;;;;;;;;;;;wBCtBpB,YAAY,SAAS,UAAU,QAAQ;;;UC3E5C;WACN;WACA;WACA,oBAAoB;;KAGnB;qBAGC,wBAAwB;WAC1B,MAAM;EACH,YAAA,MAAM,qBAAqB;;;qBAQ5B;;;wBAkFG,gBAAgB,KAAK,cAAc;;;;wBAkCnC,gBAAgB,eAAe;;;UC/H9B;;WAEN;;WAEA;;;;WAIA;;WAEA,SAAS,QAAQ;;UAGX;;EAEf;;;;;;;;wBAkKc,YACd,IAAI,aACJ,OAAM,qBACL;;;;qBC9KU;;;;;;;;;;;;wBAmWG,iBAAiB,eAAe;;;;;;wBAqB1B,uBACpB,SAAS,SACT,oBACC,QAAQ,QAAQ,kBAAkB"}

package/dist/index.mjs

@@ -1,3 +1,5 @@
+import { Inflate, deflateSync } from "fflate";
+import { generateSarifHtml } from "@sverka/sarif-viewer-web/html-generator";
 //#region src/pipeline.ts
 /** Base class for all constructs. */
 var Construct = class {
@@ -162,6 +164,868 @@ async function runPipeline(project) {
 	};
 }
 //#endregion
-export { Entry, FunctionStep, Pipeline, Project, runPipeline };
+//#region src/share.ts
+var PlaygroundError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "PlaygroundError";
+		this.code = code;
+	}
+};
+/** Fragment lengths are browser-dependent; warn past 32 KB of payload. */
+const SHARE_PAYLOAD_WARN_BYTES = 32768;
+/** Hard cap on inflated share payloads — a compressed fragment is cheap to
+*  craft into a deflate bomb, so decoding refuses past 1 MB of JSON. */
+const SHARE_MAX_INFLATED_BYTES = 1048576;
+const SHARE_PREFIX = "#c=";
+function toBase64Url(bytes) {
+	let bin = "";
+	for (const b of bytes) bin += String.fromCharCode(b);
+	return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+	const b64 = text.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+	const bin = atob(padded);
+	const bytes = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+	return bytes;
+}
+/** Inflate with a hard output cap — bounded memory on hostile payloads. */
+function inflateBounded(bytes) {
+	const chunks = [];
+	let total = 0;
+	let overflow = false;
+	new Inflate((chunk) => {
+		total += chunk.length;
+		if (total > SHARE_MAX_INFLATED_BYTES) {
+			overflow = true;
+			return;
+		}
+		chunks.push(chunk);
+	}).push(bytes, true);
+	if (overflow) throw new PlaygroundError("PAYLOAD_TOO_LARGE", `share link inflates past ${SHARE_MAX_INFLATED_BYTES} bytes`);
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return out;
+}
+const SEVERITIES = [
+	"info",
+	"low",
+	"medium",
+	"high",
+	"critical"
+];
+const FINDING_STRING_FIELDS = [
+	"rule",
+	"file",
+	"message"
+];
+const FINDING_NUMBER_FIELDS = ["startLine", "endLine"];
+/** Structural check — a shared finding reaches the HTML report, so every
+*  field that gets rendered must be the expected scalar. */
+function isFindingShape(v) {
+	if (typeof v !== "object" || v === null) return false;
+	const f = v;
+	if (!FINDING_STRING_FIELDS.every((k) => typeof f[k] === "string")) return false;
+	if (!SEVERITIES.includes(f.severity)) return false;
+	return FINDING_NUMBER_FIELDS.every((k) => typeof f[k] === "number" && Number.isFinite(f[k]));
+}
+/** Encode a run into a share link. `base` is the page URL the link targets
+*  (`location.origin + location.pathname` at runtime). */
+function encodeShareLink(run, base = "") {
+	const payload = toBase64Url(deflateSync(new TextEncoder().encode(JSON.stringify(run))));
+	return `${base}${SHARE_PREFIX}${payload}`;
+}
+/** Extract the payload tail from a `#c=` fragment or a bare payload. */
+function shareFragment(hash) {
+	const marker = hash.indexOf(SHARE_PREFIX);
+	if (marker >= 0) return hash.slice(marker + 3);
+	return hash.startsWith("#") ? hash.slice(1) : hash;
+}
+/** Shape assertion — anything else is a corrupt or hostile payload. */
+function assertRunShape(parsed) {
+	if (typeof parsed !== "object" || parsed === null || parsed.schema !== "sverka.playground/v1" || typeof parsed.code !== "string") throw new Error("payload is not a sverka.playground/v1 run");
+	const findings = parsed.findings;
+	if (findings === void 0) return;
+	if (!Array.isArray(findings) || !findings.every(isFindingShape)) throw new Error("payload findings failed shape validation");
+}
+/** Decode a `#c=` fragment back into a ShareableRun. Corrupt, oversized, or
+*  shape-invalid payloads throw PlaygroundError — callers fall back to the
+*  default template. */
+function decodeShareLink(hash) {
+	try {
+		const json = new TextDecoder().decode(inflateBounded(fromBase64Url(shareFragment(hash))));
+		const parsed = JSON.parse(json);
+		assertRunShape(parsed);
+		return parsed;
+	} catch (e) {
+		if (e instanceof PlaygroundError) throw e;
+		throw new PlaygroundError("DECODE_FAILED", `share link could not be decoded: ${e instanceof Error ? e.message : String(e)}`);
+	}
+}
+//#endregion
+//#region src/scanner.ts
+/** Non-ASCII whitespace code points beyond the Latin-1 range. */
+const WS_POINTS = /* @__PURE__ */ new Set([
+	160,
+	5760,
+	8232,
+	8233,
+	8239,
+	8287,
+	12288,
+	65279
+]);
+/** Whitespace per the JS grammar: \t \n \v \f \r space, NBSP, the unicode
+*  space separators (0x2000–0x200a), and ZWNBSP. */
+function isWsChar(c) {
+	if (c === void 0) return false;
+	const n = c.codePointAt(0) ?? 0;
+	if (n >= 9 && n <= 13 || n === 32) return true;
+	return n >= 8192 && n <= 8202 || WS_POINTS.has(n);
+}
+/** ASCII letter-or-digit — digits and both letter cases. */
+function isAsciiLetterOrDigit(n) {
+	return n >= 48 && n <= 57 || n >= 65 && n <= 90 || n >= 97 && n <= 122;
+}
+/** Identifier-part chars, approximated: ASCII ident chars plus any
+*  non-ASCII char that isn't JS whitespace — `export` + a non-ASCII
+*  letter keeps its boundary. Over-approximation only ever suppresses
+*  a false keyword match — it never corrupts code. */
+function isIdentChar(c) {
+	if (c === void 0) return false;
+	const n = c.codePointAt(0) ?? 0;
+	if (n >= 128) return !isWsChar(c);
+	return isAsciiLetterOrDigit(n) || c === "_" || c === "$";
+}
+function isQuote(c) {
+	return c === "\"" || c === "'" || c === "`";
+}
+function skipIdent(code, i) {
+	while (i < code.length && isIdentChar(code[i])) i++;
+	return i;
+}
+/** Index of the `\n` ending the `//` comment at `at` (code.length if none). */
+function lineCommentEnd(code, at) {
+	const end = code.indexOf("\n", at + 2);
+	return end === -1 ? code.length : end;
+}
+/** Index just past the closing star-slash ending the block comment at
+*  `at` — the literal marker is never written inside this doc comment
+*  or it would terminate the comment itself. */
+function blockCommentEnd(code, at) {
+	const end = code.indexOf("*/", at + 2);
+	return end === -1 ? code.length : end + 2;
+}
+/** True when `at` starts a `//` or `/*` comment. */
+function commentAt(code, at) {
+	return code[at] === "/" && (code[at + 1] === "/" || code[at + 1] === "*");
+}
+/** End index of the string literal starting at `at` (quote char).
+*  Template literals may nest `${}` expressions — tracked by brace depth. */
+function scanString(code, at) {
+	const quote = code[at];
+	let i = at + 1;
+	while (i < code.length) {
+		const c = code[i];
+		if (c === "\\") {
+			i += 2;
+			continue;
+		}
+		if (c === quote) return i + 1;
+		if (quote === "`" && c === "$" && code[i + 1] === "{") {
+			i = scanTemplateExpr(code, i + 1);
+			continue;
+		}
+		i++;
+	}
+	return i;
+}
+/** End index of a regex literal starting at `at` (`/`): closes at the
+*  first unescaped `/` outside a `[]` class, then consumes flags. Stops at
+*  a newline or EOF when unterminated — the evaluator reports the syntax. */
+function scanRegex(code, at) {
+	let i = at + 1;
+	let inClass = false;
+	while (i < code.length) {
+		const c = code[i];
+		if (c === "\\") {
+			i += 2;
+			continue;
+		}
+		if (c === "[") inClass = true;
+		else if (c === "]") inClass = false;
+		else if (c === "/" && !inClass) return skipIdent(code, i + 1);
+		else if (c === "\n") return i;
+		i++;
+	}
+	return i;
+}
+/** End index of the opaque region at `i`, or i+1 for ordinary chars —
+*  plus whether the region was a string literal (an operand). */
+function scanOpaqueEnd(code, i) {
+	const c = code[i];
+	if (isQuote(c)) return {
+		end: scanString(code, i),
+		isString: true
+	};
+	if (c === "/" && code[i + 1] === "/") return {
+		end: lineCommentEnd(code, i),
+		isString: false
+	};
+	if (c === "/" && code[i + 1] === "*") return {
+		end: blockCommentEnd(code, i),
+		isString: false
+	};
+	return {
+		end: i + 1,
+		isString: false
+	};
+}
+/** Keywords and contextual keywords after which `/` opens a regex rather
+*  than divides. Everything else — plain identifiers plus literals such
+*  as `this`/`true` — ends an operand, making `/` a division. */
+const NON_OPERAND_WORDS = /* @__PURE__ */ new Set([
+	"await",
+	"break",
+	"case",
+	"catch",
+	"class",
+	"const",
+	"continue",
+	"debugger",
+	"default",
+	"delete",
+	"do",
+	"else",
+	"enum",
+	"export",
+	"extends",
+	"finally",
+	"for",
+	"function",
+	"if",
+	"implements",
+	"import",
+	"in",
+	"instanceof",
+	"interface",
+	"let",
+	"new",
+	"package",
+	"private",
+	"protected",
+	"public",
+	"return",
+	"static",
+	"switch",
+	"throw",
+	"try",
+	"typeof",
+	"var",
+	"void",
+	"while",
+	"with",
+	"yield",
+	"as",
+	"async",
+	"from",
+	"get",
+	"of",
+	"set",
+	"type",
+	"declare"
+]);
+/** True when `word` ends an operand — a following `/` is division. */
+function operandAfterWord(word) {
+	return !NON_OPERAND_WORDS.has(word);
+}
+/** Consume one token at `i` for the brace-matching scans: opaque regions
+*  and regex literals advance wholesale, identifiers update operand
+*  state from the keyword table, braces report a depth delta. */
+function scanToken(code, i, operandEnd) {
+	const opaque = scanOpaqueEnd(code, i);
+	if (opaque.end > i + 1) return {
+		end: opaque.end,
+		operandEnd: opaque.isString || operandEnd,
+		brace: 0
+	};
+	const ch = code[i];
+	if (ch === "/" && !operandEnd) return {
+		end: scanRegex(code, i),
+		operandEnd: true,
+		brace: 0
+	};
+	if (isWsChar(ch)) return {
+		end: i + 1,
+		operandEnd,
+		brace: 0
+	};
+	if (isIdentChar(ch)) {
+		const wend = skipIdent(code, i);
+		return {
+			end: wend,
+			operandEnd: operandAfterWord(code.slice(i, wend)),
+			brace: 0
+		};
+	}
+	if (ch === "{") return {
+		end: i + 1,
+		operandEnd: false,
+		brace: 1
+	};
+	if (ch === "}") return {
+		end: i + 1,
+		operandEnd: true,
+		brace: -1
+	};
+	return {
+		end: i + 1,
+		operandEnd: false,
+		brace: 0
+	};
+}
+/**
+* End index of the `${` expression whose `{` is at `at`. Strings,
+*  comments, nested templates, and regex literals inside the expression
+*  are all skipped correctly: `` `${ x["`"] }` `` and `` `${ /"/ }` ``
+*  must not treat literal text as syntax.
+*/
+function scanTemplateExpr(code, at) {
+	let depth = 1;
+	let i = at + 1;
+	let operandEnd = false;
+	while (i < code.length && depth > 0) {
+		const step = scanToken(code, i, operandEnd);
+		depth += step.brace;
+		operandEnd = step.operandEnd;
+		i = step.end;
+	}
+	return i;
+}
+/**
+* Index of the `}` matching the `{` at `open`; -1 when unbalanced.
+*  Operand tracking decides whether a `/` divides or opens a regex —
+*  braces inside `/[{]/` never reach the depth counter.
+*/
+function matchBrace(code, open) {
+	let depth = 0;
+	let i = open;
+	let operandEnd = false;
+	while (i < code.length) {
+		const step = scanToken(code, i, operandEnd);
+		depth += step.brace;
+		operandEnd = step.operandEnd;
+		i = step.end;
+		if (step.brace === -1 && depth === 0) return i - 1;
+	}
+	return -1;
+}
+/** `word` starting at `at` with an identifier boundary on the right. */
+function keywordAt(code, at, word) {
+	return code.startsWith(word, at) && !isIdentChar(code[at + word.length]);
+}
+/** Skip whitespace and comments (including newlines). */
+function skipTrivia(code, at) {
+	let i = at;
+	for (;;) {
+		const c = code[i];
+		if (isWsChar(c)) {
+			i++;
+			continue;
+		}
+		if (c === "/" && code[i + 1] === "/") {
+			i = lineCommentEnd(code, i);
+			continue;
+		}
+		if (c === "/" && code[i + 1] === "*") {
+			i = blockCommentEnd(code, i);
+			continue;
+		}
+		return i;
+	}
+}
+//#endregion
+//#region src/engine.ts
+/** Default template shown in the editor. */
+const DEFAULT_CODE = [
+	"import { Project, Pipeline, FunctionStep, Entry } from \"@sverka/playground\";",
+	"",
+	"const proj = new Project(\"demo\");",
+	"const checks = new Pipeline(proj, \"checks\");",
+	"",
+	"new FunctionStep(checks, \"lint\", {",
+	"  fn: () => [",
+	"    { rule: \"no-unused-vars\", file: \"src/index.ts\", line: 5, severity: \"high\", message: \"Variable 'x' is declared but never used\" },",
+	"    { rule: \"no-console\", file: \"src/utils.ts\", line: 12, severity: \"medium\", message: \"Unexpected console.log statement\" },",
+	"  ],",
+	"});",
+	"",
+	"new FunctionStep(checks, \"typecheck\", {",
+	"  fn: () => [",
+	"    { rule: \"ts2322\", file: \"src/types.ts\", line: 8, severity: \"critical\", message: \"Type 'string' is not assignable to type 'number'\" },",
+	"  ],",
+	"});",
+	"",
+	"new FunctionStep(checks, \"test\", {",
+	"  fn: () => [",
+	"    { rule: \"assertion-failed\", file: \"test/index.test.ts\", line: 23, severity: \"high\", message: \"Expected 5 but got 3\" },",
+	"    { rule: \"assertion-failed\", file: \"test/index.test.ts\", line: 45, severity: \"low\", message: \"Expected 'hello' but got 'world'\" },",
+	"  ],",
+	"});",
+	"",
+	"new Entry(checks, \"on-push\", { trigger: { kind: \"push\" }, roots: [\"test\"] });",
+	"",
+	"export default proj;",
+	""
+].join("\n");
+/** Escape HTML special characters to prevent XSS. */
+function escapeHtml(text) {
+	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+/** +1/−1 for bracket chars, 0 otherwise. */
+function bracketDelta(c) {
+	if (c === "{" || c === "(" || c === "[") return 1;
+	if (c === "}" || c === ")" || c === "]") return -1;
+	return 0;
+}
+/** Chars that end an import statement at depth ≤0: `;` (consumed) or a
+*  newline after the module-specifier string (left in place). */
+function stmtTerminator(c, depth, specSeen) {
+	if (c === ";" && depth <= 0) return "past";
+	if (c === "\n" && depth <= 0 && specSeen) return "at";
+	return null;
+}
+/** End index of the statement starting at `at`: first top-level `;`, or
+*  the first newline after the module-specifier string (covers multiline
+*  `import {…}\n from "x"` and `import "x"` without a semicolon). */
+function scanStatementEnd(code, at) {
+	let i = at;
+	let depth = 0;
+	let specSeen = false;
+	while (i < code.length) {
+		const opaque = scanOpaqueEnd(code, i);
+		if (opaque.end > i + 1) {
+			specSeen = specSeen || opaque.isString;
+			i = opaque.end;
+			continue;
+		}
+		const term = stmtTerminator(code[i], depth, specSeen);
+		if (term === "past") return i + 1;
+		if (term === "at") return i;
+		depth += bracketDelta(code[i]);
+		i++;
+	}
+	return i;
+}
+/** Same-line statement tail: horizontal whitespace then an optional `;`.
+*  Never eats the newline — the following line is the next statement. */
+function scanStmtTail(code, at) {
+	let i = at;
+	while (i < code.length && (code[i] === " " || code[i] === "	")) i++;
+	if (code[i] === ";") i++;
+	return i;
+}
+/** End index of the `from "…"` clause starting after `from`, or `at` when
+*  the clause is malformed — let the evaluator complain. */
+function scanFromClause(code, next) {
+	const specAt = skipTrivia(code, next + 4);
+	const q = code[specAt];
+	if (q === "\"" || q === "'") return scanStmtTail(code, scanString(code, specAt));
+	return next;
+}
+/** End index of `export * [as ns] [from "…"]` — the `*` is at `at`. */
+function scanExportStar(code, at) {
+	let i = skipTrivia(code, at + 1);
+	if (keywordAt(code, i, "as")) {
+		i = skipTrivia(code, i + 2);
+		i = skipIdent(code, i);
+	}
+	const next = skipTrivia(code, i);
+	if (keywordAt(code, next, "from")) return scanFromClause(code, next);
+	return scanStmtTail(code, i);
+}
+/**
+* End index of `export {…}` / `export * [as ns] [from "…"]` starting at
+* the `{` or `*`. A bare list ends at its `;` or newline — unlike an
+* import, a newline after the closing brace must end the statement or
+* the next line would be eaten with it.
+*/
+function scanExportListEnd(code, at) {
+	if (code[at] === "*") return scanExportStar(code, at);
+	const close = matchBrace(code, at);
+	const i = close < 0 ? code.length : close + 1;
+	const next = skipTrivia(code, i);
+	if (keywordAt(code, next, "from")) return scanFromClause(code, next);
+	return scanStmtTail(code, i);
+}
+function atStmtLevel(st) {
+	return st.stack.length === 0 || st.stack.at(-1) === "block";
+}
+/** Copy a string literal or comment verbatim into `out`. */
+function copyOpaque(code, st, out) {
+	const opaque = scanOpaqueEnd(code, st.i);
+	if (opaque.end <= st.i + 1) return false;
+	out.push(code.slice(st.i, opaque.end));
+	if (opaque.isString) {
+		st.stmtStart = false;
+		st.operandEnd = true;
+	}
+	st.i = opaque.end;
+	return true;
+}
+/** Handle `{}`/`()`/`[]` — pushes onto the block/expr stack and sets the
+*  operand context: `}` closing an object literal ends a value, `}`
+*  closing a block ends a statement. */
+function applyBracket(code, st, out) {
+	const c = code[st.i];
+	if (c === "{") {
+		st.stack.push(st.stmtStart ? "block" : "expr");
+		st.operandEnd = false;
+	} else if (c === "}") {
+		const popped = st.stack.pop();
+		st.stmtStart = popped === "block";
+		st.operandEnd = popped === "expr";
+	} else if (c === "(" || c === "[") {
+		st.stack.push("expr");
+		st.stmtStart = false;
+		st.operandEnd = false;
+	} else if (c === ")" || c === "]") {
+		st.stack.pop();
+		st.stmtStart = false;
+		st.operandEnd = true;
+	} else return false;
+	out.push(c ?? "");
+	st.i++;
+	return true;
+}
+/** Handle `\n`, `;`, and whitespace — statement boundaries at statement
+*  level only (a `;` inside `for (;;)` doesn't count). A newline never
+*  resets operand context: `foo\n/bar/` divides, per ASI rules. */
+function applyTerminator(code, st, out) {
+	const c = code[st.i];
+	if (c !== ";" && c !== "\n" && !isWsChar(c)) return false;
+	if (c === ";") {
+		if (atStmtLevel(st)) st.stmtStart = true;
+		st.operandEnd = false;
+	} else if (c === "\n" && atStmtLevel(st)) st.stmtStart = true;
+	out.push(c ?? "");
+	st.i++;
+	return true;
+}
+/** Handle `/` — a regex literal when an operand is expected, a division
+*  operator when one just ended. Comments never reach here (copyOpaque
+*  already consumed them). */
+function applySlash(code, st, out) {
+	if (code[st.i] !== "/" || commentAt(code, st.i)) return false;
+	if (st.operandEnd) {
+		out.push("/");
+		st.i++;
+		st.operandEnd = false;
+	} else {
+		const end = scanRegex(code, st.i);
+		out.push(code.slice(st.i, end));
+		st.i = end;
+		st.operandEnd = true;
+	}
+	st.stmtStart = false;
+	return true;
+}
+/** Handle an `import` keyword at statement start. Dynamic `import (…)`
+*  and `import.meta` pass through verbatim — whitespace and comments may
+*  sit between the keyword and the paren. */
+function tryImport(code, st, out) {
+	if (!st.stmtStart || !keywordAt(code, st.i, "import")) return false;
+	const nc = code[skipTrivia(code, st.i + 6)];
+	if (nc === "(" || nc === ".") {
+		out.push("import");
+		st.i += 6;
+		st.stmtStart = false;
+		st.operandEnd = true;
+		return true;
+	}
+	st.i = scanStatementEnd(code, st.i + 6);
+	st.stmtStart = false;
+	st.operandEnd = false;
+	return true;
+}
+/** Handle `export default` (→ `return`), `export {…}`/`export *` (removed)
+*  and `export <decl>` (keyword dropped — the eval context is a function
+*  body, where `export const` would be a syntax error). */
+function tryExport(code, st, out) {
+	if (!st.stmtStart || !keywordAt(code, st.i, "export")) return false;
+	const j = skipTrivia(code, st.i + 6);
+	if (!st.exportDefaultDone && code.startsWith("default", j) && !isIdentChar(code[j + 7])) {
+		out.push("return ");
+		st.exportDefaultDone = true;
+		st.i = skipTrivia(code, j + 7);
+		st.stmtStart = false;
+		st.operandEnd = false;
+		return true;
+	}
+	if (code[j] === "{" || code[j] === "*") {
+		st.i = scanExportListEnd(code, j);
+		st.stmtStart = false;
+		st.operandEnd = false;
+		return true;
+	}
+	st.i = j;
+	st.stmtStart = false;
+	st.operandEnd = false;
+	return true;
+}
+/** Emit an identifier run — keyword table decides whether `/` after it
+*  divides (`foo /x/`) or opens a regex (`return /x/`). */
+function tryWord(code, st, out) {
+	if (!isIdentChar(code[st.i])) return false;
+	const wend = skipIdent(code, st.i);
+	out.push(code.slice(st.i, wend));
+	st.operandEnd = operandAfterWord(code.slice(st.i, wend));
+	st.stmtStart = false;
+	st.i = wend;
+	return true;
+}
+/** Char handlers tried in order — first true wins. Any char left over is
+*  copied verbatim as a non-operand punctuation token. */
+const HANDLERS = [
+	copyOpaque,
+	applyBracket,
+	applyTerminator,
+	applySlash,
+	tryImport,
+	tryExport,
+	tryWord
+];
+function advanceScan(code, st, out) {
+	for (const handle of HANDLERS) if (handle(code, st, out)) return;
+	st.stmtStart = false;
+	st.operandEnd = false;
+	out.push(code[st.i] ?? "");
+	st.i++;
+}
+/**
+* Strip import/export statements from user code for eval — a linear
+* single-pass scan, so multiline imports and comments/strings are handled
+* and pathological spacing cannot cause quadratic backtracking.
+*
+* `import …` statements are removed whole. `export default` becomes
+* `return`, `export {…}`/`export *` are removed, and `export` before a
+* declaration is dropped (the eval context is a function body, where
+* `export const` would be a syntax error).
+*
+* Note: TypeScript-specific syntax (type annotations, interfaces, enums)
+* is not stripped — the playground uses Monaco's TypeScript language mode
+* for editing, but evaluation is plain JavaScript. Users should write
+* JS-compatible code or use the `as any` escape hatch sparingly.
+*/
+function preprocessCode(code) {
+	const out = [];
+	const st = {
+		i: 0,
+		stmtStart: true,
+		exportDefaultDone: false,
+		stack: [],
+		operandEnd: false
+	};
+	while (st.i < code.length) {
+		if (code[st.i] === void 0) break;
+		advanceScan(code, st, out);
+	}
+	return out.join("");
+}
+/**
+* Evaluate user code and return the Project.
+*
+* SECURITY: This uses `new Function()` to execute user-provided code.
+* This is intentional — the playground is a local development tool where
+* the user writes and runs their own pipeline code. The code runs in the
+* browser's main page context (not a sandboxed iframe or worker) because
+* the playground needs to support synchronous FunctionStep execution and
+* direct access to the pipeline constructs. This is the same trust model
+* as a local REPL or `node -e`.
+*/
+function evaluateUserCode(code) {
+	const params = [
+		"Project",
+		"Pipeline",
+		"FunctionStep",
+		"Entry",
+		preprocessCode(code)
+	];
+	const result = new Function(...params)(Project, Pipeline, FunctionStep, Entry);
+	if (!(result instanceof Project)) throw new TypeError("Code must export a Project instance");
+	return result;
+}
+/**
+* Run a pipeline with a timeout. If a step returns a never-resolving
+* promise, the timeout ensures the UI recovers instead of staying
+* stuck in "Running" state forever.
+*/
+async function runPipelineWithTimeout(project, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([runPipeline(project), new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Pipeline timed out after ${timeoutMs}ms`)), timeoutMs);
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+//#endregion
+//#region src/embed.ts
+const STYLE = `
+  font-family: monospace; font-size: 12px;
+  background: #0d1117; color: #c9d1d9;
+  border: 1px solid #30363d; border-radius: 6px;
+  display: flex; flex-direction: column; overflow: hidden;
+`;
+function createHeader(doc) {
+	const header = doc.createElement("div");
+	header.setAttribute("style", "display:flex;align-items:center;gap:0.5rem;padding:0.4rem 0.6rem;background:#161b22;border-bottom:1px solid #30363d;");
+	const runBtn = doc.createElement("button");
+	runBtn.textContent = "Run";
+	runBtn.setAttribute("style", "padding:0.2rem 0.8rem;border:1px solid #30363d;border-radius:6px;background:#1f6feb;color:#fff;cursor:pointer;font-size:0.8rem;");
+	const status = doc.createElement("span");
+	status.setAttribute("style", "font-size:0.75rem;color:#8b949e;");
+	status.textContent = "Ready";
+	header.append(runBtn, status);
+	return {
+		header,
+		runBtn,
+		status
+	};
+}
+function createCodeEl(doc, code, readonly) {
+	if (readonly) {
+		const pre = doc.createElement("pre");
+		pre.setAttribute("style", "margin:0;padding:0.75rem;overflow:auto;max-height:16rem;white-space:pre;");
+		pre.textContent = code;
+		return pre;
+	}
+	const textarea = doc.createElement("textarea");
+	textarea.value = code;
+	textarea.setAttribute("style", "flex:0 0 12rem;width:100%;background:#0d1117;color:#c9d1d9;border:none;border-bottom:1px solid #30363d;padding:0.75rem;resize:vertical;outline:none;font:inherit;");
+	return textarea;
+}
+function createFrame(doc) {
+	const frame = doc.createElement("iframe");
+	frame.setAttribute("sandbox", "allow-scripts");
+	frame.setAttribute("style", "flex:1;min-height:10rem;width:100%;border:none;background:#0d1117;");
+	return frame;
+}
+const BODY_DARK = "<body style=\"background:#0d1117;font-family:monospace;padding:1rem;";
+/** Failure banner HTML — string concat keeps user data flowing through
+*  escapeHtml explicitly, never through template interpolation. */
+function failureBanner(result) {
+	return [
+		"<div style=\"background:#3d1d1f;color:#f85149;padding:0.6rem 1rem;font-family:monospace;border-bottom:1px solid #30363d;\">",
+		"<strong>Run failed</strong>",
+		"<pre style=\"margin:0.4rem 0 0;white-space:pre-wrap;\">",
+		escapeHtml(result.steps.filter((s) => s.status === "failure").map((s) => `${s.stepId}: ${s.error ?? "failed"}`).join("\n") || `${result.steps.length} steps failed`),
+		"</pre></div>"
+	].join("");
+}
+/** Document shown when the run failed — partial findings still render
+*  underneath the banner so finished steps aren't hidden by the error. */
+function failureDoc(result, banner) {
+	if (result.findings.length === 0) return "<!DOCTYPE html><html>" + BODY_DARK + "color:#f85149;\">" + banner + "</body></html>";
+	const sarif = generateSarifHtml(result.findings);
+	return sarif.includes("<body>") ? sarif.replace("<body>", "<body>" + banner) : banner + sarif;
+}
+/** Document shown for a clean run with zero findings. */
+function successDoc(result) {
+	return [
+		"<!DOCTYPE html><html>",
+		BODY_DARK,
+		"color:#3fb950;\">",
+		"<h3>No findings — all checks passed</h3><p>",
+		escapeHtml(String(result.steps.length)),
+		" steps in ",
+		escapeHtml(String(result.totalDurationMs)),
+		"ms</p></body></html>"
+	].join("");
+}
+/** Document shown when the runner itself threw (eval or pipeline error). */
+function errorDoc(e) {
+	const msg = e instanceof Error ? e.message : String(e);
+	return [
+		"<!DOCTYPE html><html>",
+		BODY_DARK,
+		"color:#f85149;\">",
+		"<h3>Error</h3><pre>",
+		escapeHtml(msg),
+		"</pre></body></html>"
+	].join("");
+}
+function statusLine(result) {
+	if (result.success) return `${result.findings.length} findings · ${result.totalDurationMs}ms`;
+	return `${result.steps.filter((s) => s.status === "failure").length} step(s) failed · ${result.findings.length} findings`;
+}
+/** Render a completed run into the findings frame. */
+function renderResult(result, showFindings) {
+	if (!result.success) {
+		showFindings(failureDoc(result, failureBanner(result)));
+		return;
+	}
+	if (result.findings.length === 0) {
+		showFindings(successDoc(result));
+		return;
+	}
+	showFindings(generateSarifHtml(result.findings));
+}
+/**
+* Mount a self-contained runner inside `el`. `dispose()` tears the mount
+* down. With `autoRun: true` the runner executes `code` once on mount;
+* otherwise it waits for the Run button — embeds never auto-execute code
+* the embedder didn't explicitly allow.
+*/
+function mountRunner(el, opts = {}) {
+	const doc = el.ownerDocument;
+	const code = opts.code ?? DEFAULT_CODE;
+	const root = doc.createElement("div");
+	root.setAttribute("style", STYLE);
+	const { header, runBtn, status } = createHeader(doc);
+	const codeEl = createCodeEl(doc, code, opts.readonly === true);
+	const frame = createFrame(doc);
+	root.append(header, codeEl, frame);
+	el.appendChild(root);
+	const getCode = () => opts.readonly === true ? code : codeEl.value;
+	const run = async () => {
+		runBtn.disabled = true;
+		status.textContent = "Running...";
+		let result;
+		try {
+			result = await runPipelineWithTimeout(evaluateUserCode(getCode()), 3e4);
+			renderResult(result, (html) => {
+				frame.srcdoc = html;
+			});
+			status.textContent = statusLine(result);
+		} catch (e) {
+			frame.srcdoc = errorDoc(e);
+			status.textContent = "Error";
+			runBtn.disabled = false;
+			return;
+		}
+		runBtn.disabled = false;
+		opts.onRun?.(result);
+	};
+	const onClick = () => {
+		run();
+	};
+	runBtn.addEventListener("click", onClick);
+	if (opts.autoRun === true) run();
+	return { dispose() {
+		runBtn.removeEventListener("click", onClick);
+		root.remove();
+	} };
+}
+//#endregion
+export { DEFAULT_CODE, Entry, FunctionStep, Pipeline, PlaygroundError, Project, SHARE_PAYLOAD_WARN_BYTES, decodeShareLink, encodeShareLink, evaluateUserCode, mountRunner, runPipeline, runPipelineWithTimeout };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/pipeline.ts","../src/runner.ts"],"sourcesContent":["// @sverka/playground — minimal pipeline model. Browser-safe.\n// Mirrors @sverka/workflow Construct API but simplified for browser use.\n\nimport type { PlaygroundFinding } from \"./types.js\";\n\n/** Base class for all constructs. */\nexport abstract class Construct {\n  readonly id: string;\n  readonly scope: Construct | null;\n\n  constructor(scope: Construct | null, id: string) {\n    this.id = id;\n    this.scope = scope;\n  }\n\n  /** Full path from root to this construct. */\n  get path(): string {\n    if (this.scope && this.scope.id !== \"root\") {\n      return `${this.scope.path}/${this.id}`;\n    }\n    return this.id;\n  }\n}\n\n/** Root construct representing a project. */\nexport class Project extends Construct {\n  readonly pipelines: Pipeline[] = [];\n\n  constructor(id: string) {\n    super(null, id);\n  }\n\n  /** Add a pipeline to this project. */\n  addPipeline(pipeline: Pipeline): void {\n    this.pipelines.push(pipeline);\n  }\n}\n\n/** A pipeline containing steps. */\nexport class Pipeline extends Construct {\n  readonly steps: Step[] = [];\n  readonly entries: Entry[] = [];\n\n  constructor(project: Project, id: string) {\n    super(project, id);\n    project.addPipeline(this);\n  }\n\n  /** Add a step to this pipeline. */\n  addStep(step: Step): void {\n    this.steps.push(step);\n  }\n\n  /** Add an entry to this pipeline. */\n  addEntry(entry: Entry): void {\n    this.entries.push(entry);\n  }\n}\n\n/** Base class for all step types. */\nexport abstract class Step extends Construct {\n  readonly dependencies: string[];\n\n  constructor(pipeline: Pipeline, id: string, dependencies: string[] = []) {\n    super(pipeline, id);\n    this.dependencies = dependencies;\n    pipeline.addStep(this);\n  }\n\n  /** Execute this step and return findings. */\n  abstract execute(): Promise<PlaygroundFinding[]> | PlaygroundFinding[];\n}\n\n/** A step that runs a JavaScript function in the browser. */\nexport class FunctionStep extends Step {\n  readonly fn: () => Promise<PlaygroundFinding[]> | PlaygroundFinding[];\n\n  constructor(\n    pipeline: Pipeline,\n    id: string,\n    options: {\n      fn: () => Promise<PlaygroundFinding[]> | PlaygroundFinding[];\n      dependencies?: string[];\n    },\n  ) {\n    super(pipeline, id, options.dependencies ?? []);\n    this.fn = options.fn;\n  }\n\n  execute(): Promise<PlaygroundFinding[]> | PlaygroundFinding[] {\n    return this.fn();\n  }\n}\n\n/** An entry point that triggers a pipeline. */\nexport class Entry {\n  readonly pipeline: Pipeline;\n  readonly id: string;\n  readonly trigger: { kind: string };\n  readonly roots: string[];\n\n  constructor(\n    pipeline: Pipeline,\n    id: string,\n    options: { trigger: { kind: string }; roots: string[] },\n  ) {\n    this.pipeline = pipeline;\n    this.id = id;\n    this.trigger = options.trigger;\n    this.roots = options.roots;\n    pipeline.addEntry(this);\n  }\n}\n","// @sverka/playground — pipeline runner. Browser-safe.\n// Executes FunctionSteps and collects findings.\n\nimport type { Project } from \"./pipeline.js\";\nimport type { Pipeline } from \"./pipeline.js\";\nimport type { Step } from \"./pipeline.js\";\nimport type {\n  Finding,\n  PlaygroundFinding,\n  PipelineResult,\n  StepResult,\n} from \"./types.js\";\n\n/** Simple deterministic hash for fingerprint generation. Browser-safe. */\nfunction simpleHash(input: string): string {\n  let hash = 5381;\n  for (let i = 0; i < input.length; i++) {\n    hash = ((hash << 5) + hash + input.charCodeAt(i)) | 0;\n  }\n  return (hash >>> 0).toString(16).padStart(8, \"0\");\n}\n\n/** Convert a PlaygroundFinding to a full Finding with fingerprint and id. */\nfunction toFinding(pf: PlaygroundFinding, stepId: string): Finding {\n  // Include checkId (stepId) in fingerprint so identical findings from\n  // different checks get distinct fingerprints.\n  const fingerprintInput = `${stepId}:${pf.rule}:${pf.file}:${pf.line}`;\n  const fingerprint = simpleHash(fingerprintInput);\n  const id = `${stepId}:${fingerprint}`;\n  return {\n    id,\n    fingerprint,\n    checkId: stepId,\n    severity: pf.severity,\n    confidence: 0.8,\n    message: pf.message,\n    rule: pf.rule,\n    file: pf.file,\n    startLine: pf.line,\n    endLine: pf.line,\n    source: {\n      tool: pf.tool ?? stepId,\n      version: null,\n      format: \"custom\",\n      originalRuleId: pf.rule,\n      originalSeverity: null,\n    },\n    ...(pf.snippet ? { snippet: pf.snippet } : {}),\n  };\n}\n\n/** Execute a single step and return its result. */\nasync function executeStep(step: Step): Promise<StepResult> {\n  const start = Date.now();\n  try {\n    const playgroundFindings = await step.execute();\n    const findings = playgroundFindings.map((pf) => toFinding(pf, step.id));\n    return {\n      stepId: step.id,\n      status: \"success\",\n      findings,\n      durationMs: Date.now() - start,\n    };\n  } catch (e) {\n    return {\n      stepId: step.id,\n      status: \"failure\",\n      findings: [],\n      durationMs: Date.now() - start,\n      error: e instanceof Error ? e.message : String(e),\n    };\n  }\n}\n\n/**\n * Run all FunctionSteps in a project's pipelines and collect findings.\n * Browser-safe — no Node.js APIs, no child_process, no fs.\n *\n * If a pipeline has entries with `roots`, only steps whose id matches a\n * root are executed. If no entries exist or all entries have empty roots,\n * all steps run.\n */\nexport async function runPipeline(project: Project): Promise<PipelineResult> {\n  const start = Date.now();\n  const stepResults: StepResult[] = [];\n  const allFindings: Finding[] = [];\n\n  for (const pipeline of project.pipelines) {\n    // Determine which steps to run based on entry roots.\n    let stepsToRun = pipeline.steps;\n    const entriesWithRoots = pipeline.entries.filter((e) => e.roots.length > 0);\n    if (entriesWithRoots.length > 0) {\n      const rootSet = new Set<string>();\n      for (const entry of entriesWithRoots) {\n        for (const root of entry.roots) rootSet.add(root);\n      }\n      stepsToRun = pipeline.steps.filter((s) => rootSet.has(s.id));\n    }\n\n    // Execute all selected steps in parallel — dependencies are for\n    // ordering, not data flow in the playground.\n    const results = await Promise.all(\n      stepsToRun.map((step) => executeStep(step)),\n    );\n\n    for (const result of results) {\n      stepResults.push(result);\n      allFindings.push(...result.findings);\n    }\n  }\n\n  return {\n    steps: stepResults,\n    findings: allFindings,\n    totalDurationMs: Date.now() - start,\n    success: stepResults.every((s) => s.status === \"success\"),\n  };\n}\n"],"mappings":";;AAMA,IAAsB,YAAtB,MAAgC;CAC9B;CACA;CAEA,YAAY,OAAyB,IAAY;EAC/C,KAAK,KAAK;EACV,KAAK,QAAQ;CACf;;CAGA,IAAI,OAAe;EACjB,IAAI,KAAK,SAAS,KAAK,MAAM,OAAO,QAClC,OAAO,GAAG,KAAK,MAAM,KAAK,GAAG,KAAK;EAEpC,OAAO,KAAK;CACd;AACF;;AAGA,IAAa,UAAb,cAA6B,UAAU;CACrC,YAAiC,CAAC;CAElC,YAAY,IAAY;EACtB,MAAM,MAAM,EAAE;CAChB;;CAGA,YAAY,UAA0B;EACpC,KAAK,UAAU,KAAK,QAAQ;CAC9B;AACF;;AAGA,IAAa,WAAb,cAA8B,UAAU;CACtC,QAAyB,CAAC;CAC1B,UAA4B,CAAC;CAE7B,YAAY,SAAkB,IAAY;EACxC,MAAM,SAAS,EAAE;EACjB,QAAQ,YAAY,IAAI;CAC1B;;CAGA,QAAQ,MAAkB;EACxB,KAAK,MAAM,KAAK,IAAI;CACtB;;CAGA,SAAS,OAAoB;EAC3B,KAAK,QAAQ,KAAK,KAAK;CACzB;AACF;;AAGA,IAAsB,OAAtB,cAAmC,UAAU;CAC3C;CAEA,YAAY,UAAoB,IAAY,eAAyB,CAAC,GAAG;EACvE,MAAM,UAAU,EAAE;EAClB,KAAK,eAAe;EACpB,SAAS,QAAQ,IAAI;CACvB;AAIF;;AAGA,IAAa,eAAb,cAAkC,KAAK;CACrC;CAEA,YACE,UACA,IACA,SAIA;EACA,MAAM,UAAU,IAAI,QAAQ,gBAAgB,CAAC,CAAC;EAC9C,KAAK,KAAK,QAAQ;CACpB;CAEA,UAA8D;EAC5D,OAAO,KAAK,GAAG;CACjB;AACF;;AAGA,IAAa,QAAb,MAAmB;CACjB;CACA;CACA;CACA;CAEA,YACE,UACA,IACA,SACA;EACA,KAAK,WAAW;EAChB,KAAK,KAAK;EACV,KAAK,UAAU,QAAQ;EACvB,KAAK,QAAQ,QAAQ;EACrB,SAAS,SAAS,IAAI;CACxB;AACF;;;;AClGA,SAAS,WAAW,OAAuB;CACzC,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,QAAS,QAAQ,KAAK,OAAO,MAAM,WAAW,CAAC,IAAK;CAEtD,QAAQ,SAAS,EAAA,CAAG,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;AAClD;;AAGA,SAAS,UAAU,IAAuB,QAAyB;CAIjE,MAAM,cAAc,WAAW,GADH,OAAO,GAAG,GAAG,KAAK,GAAG,GAAG,KAAK,GAAG,GAAG,MAChB;CAE/C,OAAO;EACL,IAAA,GAFY,OAAO,GAAG;EAGtB;EACA,SAAS;EACT,UAAU,GAAG;EACb,YAAY;EACZ,SAAS,GAAG;EACZ,MAAM,GAAG;EACT,MAAM,GAAG;EACT,WAAW,GAAG;EACd,SAAS,GAAG;EACZ,QAAQ;GACN,MAAM,GAAG,QAAQ;GACjB,SAAS;GACT,QAAQ;GACR,gBAAgB,GAAG;GACnB,kBAAkB;EACpB;EACA,GAAI,GAAG,UAAU,EAAE,SAAS,GAAG,QAAQ,IAAI,CAAC;CAC9C;AACF;;AAGA,eAAe,YAAY,MAAiC;CAC1D,MAAM,QAAQ,KAAK,IAAI;CACvB,IAAI;EAEF,MAAM,YAAW,MADgB,KAAK,QAAQ,EAAA,CACV,KAAK,OAAO,UAAU,IAAI,KAAK,EAAE,CAAC;EACtE,OAAO;GACL,QAAQ,KAAK;GACb,QAAQ;GACR;GACA,YAAY,KAAK,IAAI,IAAI;EAC3B;CACF,SAAS,GAAG;EACV,OAAO;GACL,QAAQ,KAAK;GACb,QAAQ;GACR,UAAU,CAAC;GACX,YAAY,KAAK,IAAI,IAAI;GACzB,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;EAClD;CACF;AACF;;;;;;;;;AAUA,eAAsB,YAAY,SAA2C;CAC3E,MAAM,QAAQ,KAAK,IAAI;CACvB,MAAM,cAA4B,CAAC;CACnC,MAAM,cAAyB,CAAC;CAEhC,KAAK,MAAM,YAAY,QAAQ,WAAW;EAExC,IAAI,aAAa,SAAS;EAC1B,MAAM,mBAAmB,SAAS,QAAQ,QAAQ,MAAM,EAAE,MAAM,SAAS,CAAC;EAC1E,IAAI,iBAAiB,SAAS,GAAG;GAC/B,MAAM,0BAAU,IAAI,IAAY;GAChC,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,QAAQ,MAAM,OAAO,QAAQ,IAAI,IAAI;GAElD,aAAa,SAAS,MAAM,QAAQ,MAAM,QAAQ,IAAI,EAAE,EAAE,CAAC;EAC7D;EAIA,MAAM,UAAU,MAAM,QAAQ,IAC5B,WAAW,KAAK,SAAS,YAAY,IAAI,CAAC,CAC5C;EAEA,KAAK,MAAM,UAAU,SAAS;GAC5B,YAAY,KAAK,MAAM;GACvB,YAAY,KAAK,GAAG,OAAO,QAAQ;EACrC;CACF;CAEA,OAAO;EACL,OAAO;EACP,UAAU;EACV,iBAAiB,KAAK,IAAI,IAAI;EAC9B,SAAS,YAAY,OAAO,MAAM,EAAE,WAAW,SAAS;CAC1D;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/pipeline.ts","../src/runner.ts","../src/share.ts","../src/scanner.ts","../src/engine.ts","../src/embed.ts"],"sourcesContent":["// @sverka/playground — minimal pipeline model. Browser-safe.\n// Mirrors @sverka/workflow Construct API but simplified for browser use.\n\nimport type { PlaygroundFinding } from \"./types.js\";\n\n/** Base class for all constructs. */\nexport abstract class Construct {\n  readonly id: string;\n  readonly scope: Construct | null;\n\n  constructor(scope: Construct | null, id: string) {\n    this.id = id;\n    this.scope = scope;\n  }\n\n  /** Full path from root to this construct. */\n  get path(): string {\n    if (this.scope && this.scope.id !== \"root\") {\n      return `${this.scope.path}/${this.id}`;\n    }\n    return this.id;\n  }\n}\n\n/** Root construct representing a project. */\nexport class Project extends Construct {\n  readonly pipelines: Pipeline[] = [];\n\n  constructor(id: string) {\n    super(null, id);\n  }\n\n  /** Add a pipeline to this project. */\n  addPipeline(pipeline: Pipeline): void {\n    this.pipelines.push(pipeline);\n  }\n}\n\n/** A pipeline containing steps. */\nexport class Pipeline extends Construct {\n  readonly steps: Step[] = [];\n  readonly entries: Entry[] = [];\n\n  constructor(project: Project, id: string) {\n    super(project, id);\n    project.addPipeline(this);\n  }\n\n  /** Add a step to this pipeline. */\n  addStep(step: Step): void {\n    this.steps.push(step);\n  }\n\n  /** Add an entry to this pipeline. */\n  addEntry(entry: Entry): void {\n    this.entries.push(entry);\n  }\n}\n\n/** Base class for all step types. */\nexport abstract class Step extends Construct {\n  readonly dependencies: string[];\n\n  constructor(pipeline: Pipeline, id: string, dependencies: string[] = []) {\n    super(pipeline, id);\n    this.dependencies = dependencies;\n    pipeline.addStep(this);\n  }\n\n  /** Execute this step and return findings. */\n  abstract execute(): Promise<PlaygroundFinding[]> | PlaygroundFinding[];\n}\n\n/** A step that runs a JavaScript function in the browser. */\nexport class FunctionStep extends Step {\n  readonly fn: () => Promise<PlaygroundFinding[]> | PlaygroundFinding[];\n\n  constructor(\n    pipeline: Pipeline,\n    id: string,\n    options: {\n      fn: () => Promise<PlaygroundFinding[]> | PlaygroundFinding[];\n      dependencies?: string[];\n    },\n  ) {\n    super(pipeline, id, options.dependencies ?? []);\n    this.fn = options.fn;\n  }\n\n  execute(): Promise<PlaygroundFinding[]> | PlaygroundFinding[] {\n    return this.fn();\n  }\n}\n\n/** An entry point that triggers a pipeline. */\nexport class Entry {\n  readonly pipeline: Pipeline;\n  readonly id: string;\n  readonly trigger: { kind: string };\n  readonly roots: string[];\n\n  constructor(\n    pipeline: Pipeline,\n    id: string,\n    options: { trigger: { kind: string }; roots: string[] },\n  ) {\n    this.pipeline = pipeline;\n    this.id = id;\n    this.trigger = options.trigger;\n    this.roots = options.roots;\n    pipeline.addEntry(this);\n  }\n}\n","// @sverka/playground — pipeline runner. Browser-safe.\n// Executes FunctionSteps and collects findings.\n\nimport type { Project } from \"./pipeline.js\";\nimport type { Pipeline } from \"./pipeline.js\";\nimport type { Step } from \"./pipeline.js\";\nimport type {\n  Finding,\n  PlaygroundFinding,\n  PipelineResult,\n  StepResult,\n} from \"./types.js\";\n\n/** Simple deterministic hash for fingerprint generation. Browser-safe. */\nfunction simpleHash(input: string): string {\n  let hash = 5381;\n  for (let i = 0; i < input.length; i++) {\n    hash = ((hash << 5) + hash + input.charCodeAt(i)) | 0;\n  }\n  return (hash >>> 0).toString(16).padStart(8, \"0\");\n}\n\n/** Convert a PlaygroundFinding to a full Finding with fingerprint and id. */\nfunction toFinding(pf: PlaygroundFinding, stepId: string): Finding {\n  // Include checkId (stepId) in fingerprint so identical findings from\n  // different checks get distinct fingerprints.\n  const fingerprintInput = `${stepId}:${pf.rule}:${pf.file}:${pf.line}`;\n  const fingerprint = simpleHash(fingerprintInput);\n  const id = `${stepId}:${fingerprint}`;\n  return {\n    id,\n    fingerprint,\n    checkId: stepId,\n    severity: pf.severity,\n    confidence: 0.8,\n    message: pf.message,\n    rule: pf.rule,\n    file: pf.file,\n    startLine: pf.line,\n    endLine: pf.line,\n    source: {\n      tool: pf.tool ?? stepId,\n      version: null,\n      format: \"custom\",\n      originalRuleId: pf.rule,\n      originalSeverity: null,\n    },\n    ...(pf.snippet ? { snippet: pf.snippet } : {}),\n  };\n}\n\n/** Execute a single step and return its result. */\nasync function executeStep(step: Step): Promise<StepResult> {\n  const start = Date.now();\n  try {\n    const playgroundFindings = await step.execute();\n    const findings = playgroundFindings.map((pf) => toFinding(pf, step.id));\n    return {\n      stepId: step.id,\n      status: \"success\",\n      findings,\n      durationMs: Date.now() - start,\n    };\n  } catch (e) {\n    return {\n      stepId: step.id,\n      status: \"failure\",\n      findings: [],\n      durationMs: Date.now() - start,\n      error: e instanceof Error ? e.message : String(e),\n    };\n  }\n}\n\n/**\n * Run all FunctionSteps in a project's pipelines and collect findings.\n * Browser-safe — no Node.js APIs, no child_process, no fs.\n *\n * If a pipeline has entries with `roots`, only steps whose id matches a\n * root are executed. If no entries exist or all entries have empty roots,\n * all steps run.\n */\nexport async function runPipeline(project: Project): Promise<PipelineResult> {\n  const start = Date.now();\n  const stepResults: StepResult[] = [];\n  const allFindings: Finding[] = [];\n\n  for (const pipeline of project.pipelines) {\n    // Determine which steps to run based on entry roots.\n    let stepsToRun = pipeline.steps;\n    const entriesWithRoots = pipeline.entries.filter((e) => e.roots.length > 0);\n    if (entriesWithRoots.length > 0) {\n      const rootSet = new Set<string>();\n      for (const entry of entriesWithRoots) {\n        for (const root of entry.roots) rootSet.add(root);\n      }\n      stepsToRun = pipeline.steps.filter((s) => rootSet.has(s.id));\n    }\n\n    // Execute all selected steps in parallel — dependencies are for\n    // ordering, not data flow in the playground.\n    const results = await Promise.all(\n      stepsToRun.map((step) => executeStep(step)),\n    );\n\n    for (const result of results) {\n      stepResults.push(result);\n      allFindings.push(...result.findings);\n    }\n  }\n\n  return {\n    steps: stepResults,\n    findings: allFindings,\n    totalDurationMs: Date.now() - start,\n    success: stepResults.every((s) => s.status === \"success\"),\n  };\n}\n","// Share links (Spec 53): a ShareableRun serializes into the URL fragment —\n// `#c=` keeps payloads out of server logs and needs zero backend.\n// Encoding: JSON → deflate-raw → base64url.\n\nimport { deflateSync, Inflate } from \"fflate\";\nimport type { Finding, Severity } from \"./types.js\";\n\nexport interface ShareableRun {\n  readonly schema: \"sverka.playground/v1\";\n  readonly code: string;\n  readonly findings?: readonly Finding[];\n}\n\nexport type PlaygroundErrorCode =\n  \"TRANSPILE_FAILED\" | \"DECODE_FAILED\" | \"PAYLOAD_TOO_LARGE\";\n\nexport class PlaygroundError extends Error {\n  readonly code: PlaygroundErrorCode;\n  constructor(code: PlaygroundErrorCode, message: string) {\n    super(message);\n    this.name = \"PlaygroundError\";\n    this.code = code;\n  }\n}\n\n/** Fragment lengths are browser-dependent; warn past 32 KB of payload. */\nexport const SHARE_PAYLOAD_WARN_BYTES = 32 * 1024;\n\n/** Hard cap on inflated share payloads — a compressed fragment is cheap to\n *  craft into a deflate bomb, so decoding refuses past 1 MB of JSON. */\nconst SHARE_MAX_INFLATED_BYTES = 1024 * 1024;\n\nconst SHARE_PREFIX = \"#c=\";\n\nfunction toBase64Url(bytes: Uint8Array): string {\n  let bin = \"\";\n  for (const b of bytes) bin += String.fromCharCode(b);\n  return btoa(bin).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction fromBase64Url(text: string): Uint8Array {\n  const b64 = text.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  // Browser atob() is strict about padding — restore what the encoder\n  // stripped. (Node's atob tolerates missing padding, which is why the\n  // round-trip test alone did not catch this.)\n  const padded = b64 + \"=\".repeat((4 - (b64.length % 4)) % 4);\n  const bin = atob(padded);\n  const bytes = new Uint8Array(bin.length);\n  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);\n  return bytes;\n}\n\n/** Inflate with a hard output cap — bounded memory on hostile payloads. */\nfunction inflateBounded(bytes: Uint8Array): Uint8Array {\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  let overflow = false;\n  const inflate = new Inflate((chunk) => {\n    total += chunk.length;\n    if (total > SHARE_MAX_INFLATED_BYTES) {\n      overflow = true;\n      return;\n    }\n    chunks.push(chunk);\n  });\n  inflate.push(bytes, true);\n  if (overflow) {\n    throw new PlaygroundError(\n      \"PAYLOAD_TOO_LARGE\",\n      `share link inflates past ${SHARE_MAX_INFLATED_BYTES} bytes`,\n    );\n  }\n  const out = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    out.set(chunk, offset);\n    offset += chunk.length;\n  }\n  return out;\n}\n\nconst SEVERITIES: readonly string[] = [\n  \"info\",\n  \"low\",\n  \"medium\",\n  \"high\",\n  \"critical\",\n];\n\nconst FINDING_STRING_FIELDS = [\"rule\", \"file\", \"message\"] as const;\nconst FINDING_NUMBER_FIELDS = [\"startLine\", \"endLine\"] as const;\n\n/** Structural check — a shared finding reaches the HTML report, so every\n *  field that gets rendered must be the expected scalar. */\nfunction isFindingShape(v: unknown): v is Finding {\n  if (typeof v !== \"object\" || v === null) return false;\n  const f = v as Record<string, unknown>;\n  if (!FINDING_STRING_FIELDS.every((k) => typeof f[k] === \"string\")) {\n    return false;\n  }\n  if (!SEVERITIES.includes(f.severity as Severity)) return false;\n  return FINDING_NUMBER_FIELDS.every(\n    (k) => typeof f[k] === \"number\" && Number.isFinite(f[k]),\n  );\n}\n\n/** Encode a run into a share link. `base` is the page URL the link targets\n *  (`location.origin + location.pathname` at runtime). */\nexport function encodeShareLink(run: ShareableRun, base = \"\"): string {\n  const payload = toBase64Url(\n    deflateSync(new TextEncoder().encode(JSON.stringify(run))),\n  );\n  return `${base}${SHARE_PREFIX}${payload}`;\n}\n\n/** Extract the payload tail from a `#c=` fragment or a bare payload. */\nfunction shareFragment(hash: string): string {\n  const marker = hash.indexOf(SHARE_PREFIX);\n  if (marker >= 0) return hash.slice(marker + SHARE_PREFIX.length);\n  return hash.startsWith(\"#\") ? hash.slice(1) : hash;\n}\n\n/** Shape assertion — anything else is a corrupt or hostile payload. */\nfunction assertRunShape(parsed: unknown): asserts parsed is ShareableRun {\n  if (\n    typeof parsed !== \"object\" ||\n    parsed === null ||\n    (parsed as ShareableRun).schema !== \"sverka.playground/v1\" ||\n    typeof (parsed as ShareableRun).code !== \"string\"\n  ) {\n    throw new Error(\"payload is not a sverka.playground/v1 run\");\n  }\n  const findings = (parsed as ShareableRun).findings;\n  if (findings === undefined) return;\n  if (!Array.isArray(findings) || !findings.every(isFindingShape)) {\n    throw new Error(\"payload findings failed shape validation\");\n  }\n}\n\n/** Decode a `#c=` fragment back into a ShareableRun. Corrupt, oversized, or\n *  shape-invalid payloads throw PlaygroundError — callers fall back to the\n *  default template. */\nexport function decodeShareLink(hash: string): ShareableRun {\n  try {\n    const json = new TextDecoder().decode(\n      inflateBounded(fromBase64Url(shareFragment(hash))),\n    );\n    const parsed: unknown = JSON.parse(json);\n    assertRunShape(parsed);\n    return parsed;\n  } catch (e) {\n    if (e instanceof PlaygroundError) throw e;\n    throw new PlaygroundError(\n      \"DECODE_FAILED\",\n      `share link could not be decoded: ${e instanceof Error ? e.message : String(e)}`,\n    );\n  }\n}\n","// @sverka/playground — shared mini-scanner primitives.\n// Char-class checks instead of regexes (a pattern evaluated against user\n// source is ReDoS surface); every helper is string/comment/regex aware so\n// quoted or literal braces never count as syntax. All scans are linear.\n\n// --- char classes --------------------------------------------------------\n\n/** Non-ASCII whitespace code points beyond the Latin-1 range. */\nconst WS_POINTS = new Set([\n  0xa0, 0x1680, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000, 0xfeff,\n]);\n\n/** Whitespace per the JS grammar: \\t \\n \\v \\f \\r space, NBSP, the unicode\n *  space separators (0x2000–0x200a), and ZWNBSP. */\nexport function isWsChar(c: string | undefined): boolean {\n  if (c === undefined) return false;\n  const n = c.codePointAt(0) ?? 0;\n  if ((n >= 9 && n <= 13) || n === 32) return true;\n  return (n >= 0x2000 && n <= 0x200a) || WS_POINTS.has(n);\n}\n\n/** ASCII letter-or-digit — digits and both letter cases. */\nfunction isAsciiLetterOrDigit(n: number): boolean {\n  return (n >= 48 && n <= 57) || (n >= 65 && n <= 90) || (n >= 97 && n <= 122);\n}\n\n/** Identifier-part chars, approximated: ASCII ident chars plus any\n *  non-ASCII char that isn't JS whitespace — `export` + a non-ASCII\n *  letter keeps its boundary. Over-approximation only ever suppresses\n *  a false keyword match — it never corrupts code. */\nexport function isIdentChar(c: string | undefined): boolean {\n  if (c === undefined) return false;\n  const n = c.codePointAt(0) ?? 0;\n  if (n >= 0x80) return !isWsChar(c);\n  return isAsciiLetterOrDigit(n) || c === \"_\" || c === \"$\";\n}\n\nexport function isQuote(c: string | undefined): boolean {\n  return c === '\"' || c === \"'\" || c === \"`\";\n}\n\n// --- skips ---------------------------------------------------------------\n\nexport function skipIdent(code: string, i: number): number {\n  while (i < code.length && isIdentChar(code[i])) i++;\n  return i;\n}\n\n/** Index of the `\\n` ending the `//` comment at `at` (code.length if none). */\nexport function lineCommentEnd(code: string, at: number): number {\n  const end = code.indexOf(\"\\n\", at + 2);\n  return end === -1 ? code.length : end;\n}\n\n/** Index just past the closing star-slash ending the block comment at\n *  `at` — the literal marker is never written inside this doc comment\n *  or it would terminate the comment itself. */\nexport function blockCommentEnd(code: string, at: number): number {\n  const end = code.indexOf(\"*/\", at + 2);\n  return end === -1 ? code.length : end + 2;\n}\n\n/** True when `at` starts a `//` or `/*` comment. */\nexport function commentAt(code: string, at: number): boolean {\n  return code[at] === \"/\" && (code[at + 1] === \"/\" || code[at + 1] === \"*\");\n}\n\n/** End index of the string literal starting at `at` (quote char).\n *  Template literals may nest `${}` expressions — tracked by brace depth. */\nexport function scanString(code: string, at: number): number {\n  const quote = code[at];\n  let i = at + 1;\n  while (i < code.length) {\n    const c = code[i];\n    if (c === \"\\\\\") {\n      i += 2;\n      continue;\n    }\n    if (c === quote) return i + 1;\n    if (quote === \"`\" && c === \"$\" && code[i + 1] === \"{\") {\n      i = scanTemplateExpr(code, i + 1);\n      continue;\n    }\n    i++;\n  }\n  return i;\n}\n\n/** End index of a regex literal starting at `at` (`/`): closes at the\n *  first unescaped `/` outside a `[]` class, then consumes flags. Stops at\n *  a newline or EOF when unterminated — the evaluator reports the syntax. */\nexport function scanRegex(code: string, at: number): number {\n  let i = at + 1;\n  let inClass = false;\n  while (i < code.length) {\n    const c = code[i];\n    if (c === \"\\\\\") {\n      i += 2;\n      continue;\n    }\n    if (c === \"[\") inClass = true;\n    else if (c === \"]\") inClass = false;\n    else if (c === \"/\" && !inClass) return skipIdent(code, i + 1);\n    else if (c === \"\\n\") return i;\n    i++;\n  }\n  return i;\n}\n\n/** End index of the opaque region at `i`, or i+1 for ordinary chars —\n *  plus whether the region was a string literal (an operand). */\nexport function scanOpaqueEnd(\n  code: string,\n  i: number,\n): { end: number; isString: boolean } {\n  const c = code[i];\n  if (isQuote(c)) return { end: scanString(code, i), isString: true };\n  if (c === \"/\" && code[i + 1] === \"/\")\n    return { end: lineCommentEnd(code, i), isString: false };\n  if (c === \"/\" && code[i + 1] === \"*\")\n    return { end: blockCommentEnd(code, i), isString: false };\n  return { end: i + 1, isString: false };\n}\n\n/** Keywords and contextual keywords after which `/` opens a regex rather\n *  than divides. Everything else — plain identifiers plus literals such\n *  as `this`/`true` — ends an operand, making `/` a division. */\nconst NON_OPERAND_WORDS = new Set([\n  \"await\",\n  \"break\",\n  \"case\",\n  \"catch\",\n  \"class\",\n  \"const\",\n  \"continue\",\n  \"debugger\",\n  \"default\",\n  \"delete\",\n  \"do\",\n  \"else\",\n  \"enum\",\n  \"export\",\n  \"extends\",\n  \"finally\",\n  \"for\",\n  \"function\",\n  \"if\",\n  \"implements\",\n  \"import\",\n  \"in\",\n  \"instanceof\",\n  \"interface\",\n  \"let\",\n  \"new\",\n  \"package\",\n  \"private\",\n  \"protected\",\n  \"public\",\n  \"return\",\n  \"static\",\n  \"switch\",\n  \"throw\",\n  \"try\",\n  \"typeof\",\n  \"var\",\n  \"void\",\n  \"while\",\n  \"with\",\n  \"yield\",\n  \"as\",\n  \"async\",\n  \"from\",\n  \"get\",\n  \"of\",\n  \"set\",\n  \"type\",\n  \"declare\",\n]);\n\n/** True when `word` ends an operand — a following `/` is division. */\nexport function operandAfterWord(word: string): boolean {\n  return !NON_OPERAND_WORDS.has(word);\n}\n\ninterface TokenStep {\n  /** Index just past the consumed token. */\n  end: number;\n  /** Whether the token ends an operand — a following `/` divides. */\n  operandEnd: boolean;\n  /** +1 for `{`, −1 for `}`, 0 otherwise. */\n  brace: -1 | 0 | 1;\n}\n\n/** Consume one token at `i` for the brace-matching scans: opaque regions\n *  and regex literals advance wholesale, identifiers update operand\n *  state from the keyword table, braces report a depth delta. */\nfunction scanToken(code: string, i: number, operandEnd: boolean): TokenStep {\n  const opaque = scanOpaqueEnd(code, i);\n  if (opaque.end > i + 1) {\n    return {\n      end: opaque.end,\n      operandEnd: opaque.isString || operandEnd,\n      brace: 0,\n    };\n  }\n  const ch = code[i];\n  if (ch === \"/\" && !operandEnd) {\n    return { end: scanRegex(code, i), operandEnd: true, brace: 0 };\n  }\n  if (isWsChar(ch)) return { end: i + 1, operandEnd, brace: 0 };\n  if (isIdentChar(ch)) {\n    const wend = skipIdent(code, i);\n    return {\n      end: wend,\n      operandEnd: operandAfterWord(code.slice(i, wend)),\n      brace: 0,\n    };\n  }\n  if (ch === \"{\") return { end: i + 1, operandEnd: false, brace: 1 };\n  if (ch === \"}\") return { end: i + 1, operandEnd: true, brace: -1 };\n  return { end: i + 1, operandEnd: false, brace: 0 };\n}\n\n/**\n * End index of the `${` expression whose `{` is at `at`. Strings,\n *  comments, nested templates, and regex literals inside the expression\n *  are all skipped correctly: `` `${ x[\"`\"] }` `` and `` `${ /\"/ }` ``\n *  must not treat literal text as syntax.\n */\nexport function scanTemplateExpr(code: string, at: number): number {\n  let depth = 1;\n  let i = at + 1;\n  let operandEnd = false;\n  while (i < code.length && depth > 0) {\n    const step = scanToken(code, i, operandEnd);\n    depth += step.brace;\n    operandEnd = step.operandEnd;\n    i = step.end;\n  }\n  return i;\n}\n\n/**\n * Index of the `}` matching the `{` at `open`; -1 when unbalanced.\n *  Operand tracking decides whether a `/` divides or opens a regex —\n *  braces inside `/[{]/` never reach the depth counter.\n */\nexport function matchBrace(code: string, open: number): number {\n  let depth = 0;\n  let i = open;\n  let operandEnd = false;\n  while (i < code.length) {\n    const step = scanToken(code, i, operandEnd);\n    depth += step.brace;\n    operandEnd = step.operandEnd;\n    i = step.end;\n    if (step.brace === -1 && depth === 0) return i - 1;\n  }\n  return -1;\n}\n\n/** `word` starting at `at` with an identifier boundary on the right. */\nexport function keywordAt(code: string, at: number, word: string): boolean {\n  return code.startsWith(word, at) && !isIdentChar(code[at + word.length]);\n}\n\n/** Skip whitespace and comments (including newlines). */\nexport function skipTrivia(code: string, at: number): number {\n  let i = at;\n  for (;;) {\n    const c = code[i];\n    if (isWsChar(c)) {\n      i++;\n      continue;\n    }\n    if (c === \"/\" && code[i + 1] === \"/\") {\n      i = lineCommentEnd(code, i);\n      continue;\n    }\n    if (c === \"/\" && code[i + 1] === \"*\") {\n      i = blockCommentEnd(code, i);\n      continue;\n    }\n    return i;\n  }\n}\n","// @sverka/playground — shared engine plumbing. Browser-safe.\n// Code template, user-code evaluation, and a timeout-wrapped run used by\n// both the full playground app and the embeddable mountRunner.\n\nimport { Project, Pipeline, FunctionStep, Entry } from \"./pipeline.js\";\nimport { runPipeline } from \"./runner.js\";\nimport {\n  commentAt,\n  isIdentChar,\n  isWsChar,\n  keywordAt,\n  matchBrace,\n  operandAfterWord,\n  scanOpaqueEnd,\n  scanRegex,\n  scanString,\n  skipIdent,\n  skipTrivia,\n} from \"./scanner.js\";\n\n/** Default template shown in the editor. */\nexport const DEFAULT_CODE = [\n  'import { Project, Pipeline, FunctionStep, Entry } from \"@sverka/playground\";',\n  \"\",\n  'const proj = new Project(\"demo\");',\n  'const checks = new Pipeline(proj, \"checks\");',\n  \"\",\n  'new FunctionStep(checks, \"lint\", {',\n  \"  fn: () => [\",\n  '    { rule: \"no-unused-vars\", file: \"src/index.ts\", line: 5, severity: \"high\", message: \"Variable \\'x\\' is declared but never used\" },',\n  '    { rule: \"no-console\", file: \"src/utils.ts\", line: 12, severity: \"medium\", message: \"Unexpected console.log statement\" },',\n  \"  ],\",\n  \"});\",\n  \"\",\n  'new FunctionStep(checks, \"typecheck\", {',\n  \"  fn: () => [\",\n  '    { rule: \"ts2322\", file: \"src/types.ts\", line: 8, severity: \"critical\", message: \"Type \\'string\\' is not assignable to type \\'number\\'\" },',\n  \"  ],\",\n  \"});\",\n  \"\",\n  'new FunctionStep(checks, \"test\", {',\n  \"  fn: () => [\",\n  '    { rule: \"assertion-failed\", file: \"test/index.test.ts\", line: 23, severity: \"high\", message: \"Expected 5 but got 3\" },',\n  '    { rule: \"assertion-failed\", file: \"test/index.test.ts\", line: 45, severity: \"low\", message: \"Expected \\'hello\\' but got \\'world\\'\" },',\n  \"  ],\",\n  \"});\",\n  \"\",\n  'new Entry(checks, \"on-push\", { trigger: { kind: \"push\" }, roots: [\"test\"] });',\n  \"\",\n  \"export default proj;\",\n  \"\",\n].join(\"\\n\");\n\n/** Escape HTML special characters to prevent XSS. */\nexport function escapeHtml(text: string): string {\n  return text\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/** +1/−1 for bracket chars, 0 otherwise. */\nfunction bracketDelta(c: string | undefined): number {\n  if (c === \"{\" || c === \"(\" || c === \"[\") return 1;\n  if (c === \"}\" || c === \")\" || c === \"]\") return -1;\n  return 0;\n}\n\n/** Chars that end an import statement at depth ≤0: `;` (consumed) or a\n *  newline after the module-specifier string (left in place). */\nfunction stmtTerminator(\n  c: string | undefined,\n  depth: number,\n  specSeen: boolean,\n): \"past\" | \"at\" | null {\n  if (c === \";\" && depth <= 0) return \"past\";\n  if (c === \"\\n\" && depth <= 0 && specSeen) return \"at\";\n  return null;\n}\n\n/** End index of the statement starting at `at`: first top-level `;`, or\n *  the first newline after the module-specifier string (covers multiline\n *  `import {…}\\n from \"x\"` and `import \"x\"` without a semicolon). */\nfunction scanStatementEnd(code: string, at: number): number {\n  let i = at;\n  let depth = 0;\n  let specSeen = false;\n  while (i < code.length) {\n    const opaque = scanOpaqueEnd(code, i);\n    if (opaque.end > i + 1) {\n      specSeen = specSeen || opaque.isString;\n      i = opaque.end;\n      continue;\n    }\n    const term = stmtTerminator(code[i], depth, specSeen);\n    if (term === \"past\") return i + 1;\n    if (term === \"at\") return i;\n    depth += bracketDelta(code[i]);\n    i++;\n  }\n  return i;\n}\n\n/** Same-line statement tail: horizontal whitespace then an optional `;`.\n *  Never eats the newline — the following line is the next statement. */\nfunction scanStmtTail(code: string, at: number): number {\n  let i = at;\n  while (i < code.length && (code[i] === \" \" || code[i] === \"\\t\")) i++;\n  if (code[i] === \";\") i++;\n  return i;\n}\n\n/** End index of the `from \"…\"` clause starting after `from`, or `at` when\n *  the clause is malformed — let the evaluator complain. */\nfunction scanFromClause(code: string, next: number): number {\n  const specAt = skipTrivia(code, next + 4);\n  const q = code[specAt];\n  if (q === '\"' || q === \"'\") {\n    return scanStmtTail(code, scanString(code, specAt));\n  }\n  return next;\n}\n\n/** End index of `export * [as ns] [from \"…\"]` — the `*` is at `at`. */\nfunction scanExportStar(code: string, at: number): number {\n  let i = skipTrivia(code, at + 1);\n  if (keywordAt(code, i, \"as\")) {\n    i = skipTrivia(code, i + 2);\n    i = skipIdent(code, i);\n  }\n  const next = skipTrivia(code, i);\n  if (keywordAt(code, next, \"from\")) return scanFromClause(code, next);\n  return scanStmtTail(code, i);\n}\n\n/**\n * End index of `export {…}` / `export * [as ns] [from \"…\"]` starting at\n * the `{` or `*`. A bare list ends at its `;` or newline — unlike an\n * import, a newline after the closing brace must end the statement or\n * the next line would be eaten with it.\n */\nfunction scanExportListEnd(code: string, at: number): number {\n  if (code[at] === \"*\") return scanExportStar(code, at);\n  const close = matchBrace(code, at);\n  const i = close < 0 ? code.length : close + 1;\n  const next = skipTrivia(code, i);\n  if (keywordAt(code, next, \"from\")) return scanFromClause(code, next);\n  return scanStmtTail(code, i);\n}\n\ninterface ScanState {\n  i: number;\n  stmtStart: boolean;\n  exportDefaultDone: boolean;\n  /** `block` vs `expr` — separates block braces from object literals, so\n   *  `{ export: 1 }` is a key, not a statement. */\n  stack: (\"block\" | \"expr\")[];\n  /** True when the previous token ended an operand — `/` then divides.\n   *  Regex literals never update the delimiter stack, so `/[{]/` can't\n   *  leave an unclosed `{` that keeps `export default` alive to eval. */\n  operandEnd: boolean;\n}\n\nfunction atStmtLevel(st: ScanState): boolean {\n  return st.stack.length === 0 || st.stack.at(-1) === \"block\";\n}\n\n/** Copy a string literal or comment verbatim into `out`. */\nfunction copyOpaque(code: string, st: ScanState, out: string[]): boolean {\n  const opaque = scanOpaqueEnd(code, st.i);\n  if (opaque.end <= st.i + 1) return false;\n  out.push(code.slice(st.i, opaque.end));\n  if (opaque.isString) {\n    st.stmtStart = false;\n    st.operandEnd = true;\n  }\n  st.i = opaque.end;\n  return true;\n}\n\n/** Handle `{}`/`()`/`[]` — pushes onto the block/expr stack and sets the\n *  operand context: `}` closing an object literal ends a value, `}`\n *  closing a block ends a statement. */\nfunction applyBracket(code: string, st: ScanState, out: string[]): boolean {\n  const c = code[st.i];\n  if (c === \"{\") {\n    // A `{` at statement position opens a block; anywhere else it's an\n    // object literal. Inside a block the next token is a statement;\n    // inside an object it's a key — `export:` there is not a keyword.\n    st.stack.push(st.stmtStart ? \"block\" : \"expr\");\n    st.operandEnd = false;\n  } else if (c === \"}\") {\n    const popped = st.stack.pop();\n    st.stmtStart = popped === \"block\";\n    st.operandEnd = popped === \"expr\";\n  } else if (c === \"(\" || c === \"[\") {\n    st.stack.push(\"expr\");\n    st.stmtStart = false;\n    st.operandEnd = false;\n  } else if (c === \")\" || c === \"]\") {\n    st.stack.pop();\n    st.stmtStart = false;\n    st.operandEnd = true;\n  } else {\n    return false;\n  }\n  out.push(c ?? \"\");\n  st.i++;\n  return true;\n}\n\n/** Handle `\\n`, `;`, and whitespace — statement boundaries at statement\n *  level only (a `;` inside `for (;;)` doesn't count). A newline never\n *  resets operand context: `foo\\n/bar/` divides, per ASI rules. */\nfunction applyTerminator(code: string, st: ScanState, out: string[]): boolean {\n  const c = code[st.i];\n  if (c !== \";\" && c !== \"\\n\" && !isWsChar(c)) return false;\n  if (c === \";\") {\n    if (atStmtLevel(st)) st.stmtStart = true;\n    st.operandEnd = false;\n  } else if (c === \"\\n\" && atStmtLevel(st)) {\n    st.stmtStart = true;\n  }\n  out.push(c ?? \"\");\n  st.i++;\n  return true;\n}\n\n/** Handle `/` — a regex literal when an operand is expected, a division\n *  operator when one just ended. Comments never reach here (copyOpaque\n *  already consumed them). */\nfunction applySlash(code: string, st: ScanState, out: string[]): boolean {\n  if (code[st.i] !== \"/\" || commentAt(code, st.i)) return false;\n  if (st.operandEnd) {\n    out.push(\"/\");\n    st.i++;\n    st.operandEnd = false;\n  } else {\n    const end = scanRegex(code, st.i);\n    out.push(code.slice(st.i, end));\n    st.i = end;\n    st.operandEnd = true;\n  }\n  st.stmtStart = false;\n  return true;\n}\n\n/** Handle an `import` keyword at statement start. Dynamic `import (…)`\n *  and `import.meta` pass through verbatim — whitespace and comments may\n *  sit between the keyword and the paren. */\nfunction tryImport(code: string, st: ScanState, out: string[]): boolean {\n  if (!st.stmtStart || !keywordAt(code, st.i, \"import\")) return false;\n  const nc = code[skipTrivia(code, st.i + 6)];\n  if (nc === \"(\" || nc === \".\") {\n    out.push(\"import\");\n    st.i += 6;\n    st.stmtStart = false;\n    st.operandEnd = true;\n    return true;\n  }\n  st.i = scanStatementEnd(code, st.i + 6);\n  st.stmtStart = false;\n  st.operandEnd = false;\n  return true;\n}\n\n/** Handle `export default` (→ `return`), `export {…}`/`export *` (removed)\n *  and `export <decl>` (keyword dropped — the eval context is a function\n *  body, where `export const` would be a syntax error). */\nfunction tryExport(code: string, st: ScanState, out: string[]): boolean {\n  if (!st.stmtStart || !keywordAt(code, st.i, \"export\")) return false;\n  const j = skipTrivia(code, st.i + 6);\n  if (\n    !st.exportDefaultDone &&\n    code.startsWith(\"default\", j) &&\n    !isIdentChar(code[j + 7])\n  ) {\n    // `return` must touch the expression — a newline between `default`\n    // and the value would trigger ASI and return undefined.\n    out.push(\"return \");\n    st.exportDefaultDone = true;\n    st.i = skipTrivia(code, j + 7);\n    st.stmtStart = false;\n    st.operandEnd = false;\n    return true;\n  }\n  if (code[j] === \"{\" || code[j] === \"*\") {\n    st.i = scanExportListEnd(code, j);\n    st.stmtStart = false;\n    st.operandEnd = false;\n    return true;\n  }\n  st.i = j;\n  st.stmtStart = false;\n  st.operandEnd = false;\n  return true;\n}\n\n/** Emit an identifier run — keyword table decides whether `/` after it\n *  divides (`foo /x/`) or opens a regex (`return /x/`). */\nfunction tryWord(code: string, st: ScanState, out: string[]): boolean {\n  if (!isIdentChar(code[st.i])) return false;\n  const wend = skipIdent(code, st.i);\n  out.push(code.slice(st.i, wend));\n  st.operandEnd = operandAfterWord(code.slice(st.i, wend));\n  st.stmtStart = false;\n  st.i = wend;\n  return true;\n}\n\n/** Char handlers tried in order — first true wins. Any char left over is\n *  copied verbatim as a non-operand punctuation token. */\nconst HANDLERS: ((code: string, st: ScanState, out: string[]) => boolean)[] = [\n  copyOpaque,\n  applyBracket,\n  applyTerminator,\n  applySlash,\n  tryImport,\n  tryExport,\n  tryWord,\n];\n\nfunction advanceScan(code: string, st: ScanState, out: string[]): void {\n  for (const handle of HANDLERS) {\n    if (handle(code, st, out)) return;\n  }\n  st.stmtStart = false;\n  st.operandEnd = false;\n  out.push(code[st.i] ?? \"\");\n  st.i++;\n}\n\n/**\n * Strip import/export statements from user code for eval — a linear\n * single-pass scan, so multiline imports and comments/strings are handled\n * and pathological spacing cannot cause quadratic backtracking.\n *\n * `import …` statements are removed whole. `export default` becomes\n * `return`, `export {…}`/`export *` are removed, and `export` before a\n * declaration is dropped (the eval context is a function body, where\n * `export const` would be a syntax error).\n *\n * Note: TypeScript-specific syntax (type annotations, interfaces, enums)\n * is not stripped — the playground uses Monaco's TypeScript language mode\n * for editing, but evaluation is plain JavaScript. Users should write\n * JS-compatible code or use the `as any` escape hatch sparingly.\n */\nexport function preprocessCode(code: string): string {\n  const out: string[] = [];\n  const st: ScanState = {\n    i: 0,\n    stmtStart: true,\n    exportDefaultDone: false,\n    stack: [],\n    operandEnd: false,\n  };\n  while (st.i < code.length) {\n    if (code[st.i] === undefined) break;\n    advanceScan(code, st, out);\n  }\n  return out.join(\"\");\n}\n\n/**\n * Evaluate user code and return the Project.\n *\n * SECURITY: This uses `new Function()` to execute user-provided code.\n * This is intentional — the playground is a local development tool where\n * the user writes and runs their own pipeline code. The code runs in the\n * browser's main page context (not a sandboxed iframe or worker) because\n * the playground needs to support synchronous FunctionStep execution and\n * direct access to the pipeline constructs. This is the same trust model\n * as a local REPL or `node -e`.\n */\nexport function evaluateUserCode(code: string): Project {\n  const processed = preprocessCode(code);\n  // Dynamic code execution is intentional for the playground sandbox.\n  // SonarCloud S1523: safe — user code runs in the browser sandbox with the\n  // same trust model as a local REPL or `node -e` (see comment above).\n  const params = [\"Project\", \"Pipeline\", \"FunctionStep\", \"Entry\", processed];\n  // NOSONAR suppresses only issues on the marker's own line — it must\n  // trail the `new Function` callee, not sit inside the argument list.\n  const fn = new Function(...params); // NOSONAR — intentional dynamic evaluation in sandbox\n  const result = fn(Project, Pipeline, FunctionStep, Entry); // NOSONAR\n  if (!(result instanceof Project)) {\n    throw new TypeError(\"Code must export a Project instance\");\n  }\n  return result as Project;\n}\n\n/**\n * Run a pipeline with a timeout. If a step returns a never-resolving\n * promise, the timeout ensures the UI recovers instead of staying\n * stuck in \"Running\" state forever.\n */\nexport async function runPipelineWithTimeout(\n  project: Project,\n  timeoutMs: number,\n): Promise<Awaited<ReturnType<typeof runPipeline>>> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      runPipeline(project),\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(\n          () => reject(new Error(`Pipeline timed out after ${timeoutMs}ms`)),\n          timeoutMs,\n        );\n      }),\n    ]);\n  } finally {\n    // Without this, every completed run leaves a live timer that rejects\n    // into an unhandled rejection timeoutMs later.\n    if (timer !== undefined) clearTimeout(timer);\n  }\n}\n","// @sverka/playground — mountRunner embed API (Spec 53).\n// Docs pages mount a self-contained runner: code (editable or readonly),\n// a Run button, status line, and a findings iframe. Zero backend — the\n// runner evaluates pipeline code in-page under the same trust model as\n// the full playground (see engine.ts).\n\nimport { generateSarifHtml } from \"@sverka/sarif-viewer-web/html-generator\";\nimport type { PipelineResult } from \"./types.js\";\nimport {\n  DEFAULT_CODE,\n  escapeHtml,\n  evaluateUserCode,\n  runPipelineWithTimeout,\n} from \"./engine.js\";\n\nexport interface MountRunnerOptions {\n  /** Initial editor source. Defaults to the playground template. */\n  readonly code?: string;\n  /** Render the source as a fixed listing instead of an editable field. */\n  readonly readonly?: boolean;\n  /** Run `code` immediately on mount. Defaults to false — embed code may\n   *  come from a share link or CMS, so mounting never executes it unless\n   *  the embedder opts in or the user clicks Run. */\n  readonly autoRun?: boolean;\n  /** Called once per completed run. */\n  readonly onRun?: (result: PipelineResult) => void;\n}\n\nexport interface MountedRunner {\n  /** Remove the runner's DOM and listeners. */\n  dispose(): void;\n}\n\nconst STYLE = `\n  font-family: monospace; font-size: 12px;\n  background: #0d1117; color: #c9d1d9;\n  border: 1px solid #30363d; border-radius: 6px;\n  display: flex; flex-direction: column; overflow: hidden;\n`;\n\nfunction createHeader(doc: Document): {\n  header: HTMLElement;\n  runBtn: HTMLButtonElement;\n  status: HTMLSpanElement;\n} {\n  const header = doc.createElement(\"div\");\n  header.setAttribute(\n    \"style\",\n    \"display:flex;align-items:center;gap:0.5rem;padding:0.4rem 0.6rem;background:#161b22;border-bottom:1px solid #30363d;\",\n  );\n  const runBtn = doc.createElement(\"button\");\n  runBtn.textContent = \"Run\";\n  runBtn.setAttribute(\n    \"style\",\n    \"padding:0.2rem 0.8rem;border:1px solid #30363d;border-radius:6px;background:#1f6feb;color:#fff;cursor:pointer;font-size:0.8rem;\",\n  );\n  const status = doc.createElement(\"span\");\n  status.setAttribute(\"style\", \"font-size:0.75rem;color:#8b949e;\");\n  status.textContent = \"Ready\";\n  header.append(runBtn, status);\n  return { header, runBtn, status };\n}\n\nfunction createCodeEl(\n  doc: Document,\n  code: string,\n  readonly: boolean,\n): HTMLTextAreaElement | HTMLElement {\n  if (readonly) {\n    const pre = doc.createElement(\"pre\");\n    pre.setAttribute(\n      \"style\",\n      \"margin:0;padding:0.75rem;overflow:auto;max-height:16rem;white-space:pre;\",\n    );\n    pre.textContent = code;\n    return pre;\n  }\n  const textarea = doc.createElement(\"textarea\");\n  textarea.value = code;\n  textarea.setAttribute(\n    \"style\",\n    \"flex:0 0 12rem;width:100%;background:#0d1117;color:#c9d1d9;border:none;border-bottom:1px solid #30363d;padding:0.75rem;resize:vertical;outline:none;font:inherit;\",\n  );\n  return textarea;\n}\n\nfunction createFrame(doc: Document): HTMLIFrameElement {\n  const frame = doc.createElement(\"iframe\");\n  // Shared findings render via srcdoc — sandboxed onto an opaque origin so a\n  // crafted payload can never touch the host page; allow-scripts keeps the\n  // report's own viewer interactivity (search/filter/sort) working.\n  frame.setAttribute(\"sandbox\", \"allow-scripts\");\n  frame.setAttribute(\n    \"style\",\n    \"flex:1;min-height:10rem;width:100%;border:none;background:#0d1117;\",\n  );\n  return frame;\n}\n\nconst BODY_DARK =\n  '<body style=\"background:#0d1117;font-family:monospace;padding:1rem;';\n\n/** Failure banner HTML — string concat keeps user data flowing through\n *  escapeHtml explicitly, never through template interpolation. */\nfunction failureBanner(result: PipelineResult): string {\n  const failed = result.steps.filter((s) => s.status === \"failure\");\n  const lines =\n    failed.map((s) => `${s.stepId}: ${s.error ?? \"failed\"}`).join(\"\\n\") ||\n    `${result.steps.length} steps failed`;\n  return [\n    '<div style=\"background:#3d1d1f;color:#f85149;padding:0.6rem 1rem;font-family:monospace;border-bottom:1px solid #30363d;\">',\n    \"<strong>Run failed</strong>\",\n    '<pre style=\"margin:0.4rem 0 0;white-space:pre-wrap;\">',\n    escapeHtml(lines),\n    \"</pre></div>\",\n  ].join(\"\");\n}\n\n/** Document shown when the run failed — partial findings still render\n *  underneath the banner so finished steps aren't hidden by the error. */\nfunction failureDoc(result: PipelineResult, banner: string): string {\n  if (result.findings.length === 0) {\n    return (\n      \"<!DOCTYPE html><html>\" +\n      BODY_DARK +\n      'color:#f85149;\">' +\n      banner +\n      \"</body></html>\"\n    );\n  }\n  const sarif = generateSarifHtml(result.findings);\n  return sarif.includes(\"<body>\")\n    ? sarif.replace(\"<body>\", \"<body>\" + banner)\n    : banner + sarif;\n}\n\n/** Document shown for a clean run with zero findings. */\nfunction successDoc(result: PipelineResult): string {\n  return [\n    \"<!DOCTYPE html><html>\",\n    BODY_DARK,\n    'color:#3fb950;\">',\n    \"<h3>No findings — all checks passed</h3><p>\",\n    escapeHtml(String(result.steps.length)),\n    \" steps in \",\n    escapeHtml(String(result.totalDurationMs)),\n    \"ms</p></body></html>\",\n  ].join(\"\");\n}\n\n/** Document shown when the runner itself threw (eval or pipeline error). */\nfunction errorDoc(e: unknown): string {\n  const msg = e instanceof Error ? e.message : String(e);\n  return [\n    \"<!DOCTYPE html><html>\",\n    BODY_DARK,\n    'color:#f85149;\">',\n    \"<h3>Error</h3><pre>\",\n    escapeHtml(msg),\n    \"</pre></body></html>\",\n  ].join(\"\");\n}\n\nfunction statusLine(result: PipelineResult): string {\n  if (result.success)\n    return `${result.findings.length} findings · ${result.totalDurationMs}ms`;\n  const failures = result.steps.filter((s) => s.status === \"failure\").length;\n  return `${failures} step(s) failed · ${result.findings.length} findings`;\n}\n\n/** Render a completed run into the findings frame. */\nfunction renderResult(\n  result: PipelineResult,\n  showFindings: (html: string) => void,\n): void {\n  if (!result.success) {\n    showFindings(failureDoc(result, failureBanner(result)));\n    return;\n  }\n  if (result.findings.length === 0) {\n    showFindings(successDoc(result));\n    return;\n  }\n  showFindings(generateSarifHtml(result.findings));\n}\n\n/**\n * Mount a self-contained runner inside `el`. `dispose()` tears the mount\n * down. With `autoRun: true` the runner executes `code` once on mount;\n * otherwise it waits for the Run button — embeds never auto-execute code\n * the embedder didn't explicitly allow.\n */\nexport function mountRunner(\n  el: HTMLElement,\n  opts: MountRunnerOptions = {},\n): MountedRunner {\n  const doc = el.ownerDocument;\n  const code = opts.code ?? DEFAULT_CODE;\n\n  const root = doc.createElement(\"div\");\n  root.setAttribute(\"style\", STYLE);\n  const { header, runBtn, status } = createHeader(doc);\n  const codeEl = createCodeEl(doc, code, opts.readonly === true);\n  const frame = createFrame(doc);\n  root.append(header, codeEl, frame);\n  el.appendChild(root);\n\n  // Branch on the option, not instanceof — a container owned by another\n  // window would produce a cross-realm textarea that fails the check.\n  const getCode = (): string =>\n    opts.readonly === true ? code : (codeEl as HTMLTextAreaElement).value;\n\n  const run = async (): Promise<void> => {\n    runBtn.disabled = true;\n    status.textContent = \"Running...\";\n    let result: PipelineResult;\n    try {\n      const project = evaluateUserCode(getCode());\n      result = await runPipelineWithTimeout(project, 30_000);\n      renderResult(result, (html) => {\n        frame.srcdoc = html;\n      });\n      status.textContent = statusLine(result);\n    } catch (e) {\n      frame.srcdoc = errorDoc(e);\n      status.textContent = \"Error\";\n      runBtn.disabled = false;\n      return;\n    }\n    runBtn.disabled = false;\n    // Outside the try — a throwing callback must not corrupt the findings\n    // view or get misreported as a runner failure.\n    opts.onRun?.(result);\n  };\n\n  const onClick = (): void => {\n    void run();\n  };\n  runBtn.addEventListener(\"click\", onClick);\n  if (opts.autoRun === true) void run();\n\n  return {\n    dispose() {\n      runBtn.removeEventListener(\"click\", onClick);\n      root.remove();\n    },\n  };\n}\n"],"mappings":";;;;AAMA,IAAsB,YAAtB,MAAgC;CAC9B;CACA;CAEA,YAAY,OAAyB,IAAY;EAC/C,KAAK,KAAK;EACV,KAAK,QAAQ;CACf;;CAGA,IAAI,OAAe;EACjB,IAAI,KAAK,SAAS,KAAK,MAAM,OAAO,QAClC,OAAO,GAAG,KAAK,MAAM,KAAK,GAAG,KAAK;EAEpC,OAAO,KAAK;CACd;AACF;;AAGA,IAAa,UAAb,cAA6B,UAAU;CACrC,YAAiC,CAAC;CAElC,YAAY,IAAY;EACtB,MAAM,MAAM,EAAE;CAChB;;CAGA,YAAY,UAA0B;EACpC,KAAK,UAAU,KAAK,QAAQ;CAC9B;AACF;;AAGA,IAAa,WAAb,cAA8B,UAAU;CACtC,QAAyB,CAAC;CAC1B,UAA4B,CAAC;CAE7B,YAAY,SAAkB,IAAY;EACxC,MAAM,SAAS,EAAE;EACjB,QAAQ,YAAY,IAAI;CAC1B;;CAGA,QAAQ,MAAkB;EACxB,KAAK,MAAM,KAAK,IAAI;CACtB;;CAGA,SAAS,OAAoB;EAC3B,KAAK,QAAQ,KAAK,KAAK;CACzB;AACF;;AAGA,IAAsB,OAAtB,cAAmC,UAAU;CAC3C;CAEA,YAAY,UAAoB,IAAY,eAAyB,CAAC,GAAG;EACvE,MAAM,UAAU,EAAE;EAClB,KAAK,eAAe;EACpB,SAAS,QAAQ,IAAI;CACvB;AAIF;;AAGA,IAAa,eAAb,cAAkC,KAAK;CACrC;CAEA,YACE,UACA,IACA,SAIA;EACA,MAAM,UAAU,IAAI,QAAQ,gBAAgB,CAAC,CAAC;EAC9C,KAAK,KAAK,QAAQ;CACpB;CAEA,UAA8D;EAC5D,OAAO,KAAK,GAAG;CACjB;AACF;;AAGA,IAAa,QAAb,MAAmB;CACjB;CACA;CACA;CACA;CAEA,YACE,UACA,IACA,SACA;EACA,KAAK,WAAW;EAChB,KAAK,KAAK;EACV,KAAK,UAAU,QAAQ;EACvB,KAAK,QAAQ,QAAQ;EACrB,SAAS,SAAS,IAAI;CACxB;AACF;;;;AClGA,SAAS,WAAW,OAAuB;CACzC,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,QAAS,QAAQ,KAAK,OAAO,MAAM,WAAW,CAAC,IAAK;CAEtD,QAAQ,SAAS,EAAA,CAAG,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;AAClD;;AAGA,SAAS,UAAU,IAAuB,QAAyB;CAIjE,MAAM,cAAc,WAAW,GADH,OAAO,GAAG,GAAG,KAAK,GAAG,GAAG,KAAK,GAAG,GAAG,MAChB;CAE/C,OAAO;EACL,IAAA,GAFY,OAAO,GAAG;EAGtB;EACA,SAAS;EACT,UAAU,GAAG;EACb,YAAY;EACZ,SAAS,GAAG;EACZ,MAAM,GAAG;EACT,MAAM,GAAG;EACT,WAAW,GAAG;EACd,SAAS,GAAG;EACZ,QAAQ;GACN,MAAM,GAAG,QAAQ;GACjB,SAAS;GACT,QAAQ;GACR,gBAAgB,GAAG;GACnB,kBAAkB;EACpB;EACA,GAAI,GAAG,UAAU,EAAE,SAAS,GAAG,QAAQ,IAAI,CAAC;CAC9C;AACF;;AAGA,eAAe,YAAY,MAAiC;CAC1D,MAAM,QAAQ,KAAK,IAAI;CACvB,IAAI;EAEF,MAAM,YAAW,MADgB,KAAK,QAAQ,EAAA,CACV,KAAK,OAAO,UAAU,IAAI,KAAK,EAAE,CAAC;EACtE,OAAO;GACL,QAAQ,KAAK;GACb,QAAQ;GACR;GACA,YAAY,KAAK,IAAI,IAAI;EAC3B;CACF,SAAS,GAAG;EACV,OAAO;GACL,QAAQ,KAAK;GACb,QAAQ;GACR,UAAU,CAAC;GACX,YAAY,KAAK,IAAI,IAAI;GACzB,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;EAClD;CACF;AACF;;;;;;;;;AAUA,eAAsB,YAAY,SAA2C;CAC3E,MAAM,QAAQ,KAAK,IAAI;CACvB,MAAM,cAA4B,CAAC;CACnC,MAAM,cAAyB,CAAC;CAEhC,KAAK,MAAM,YAAY,QAAQ,WAAW;EAExC,IAAI,aAAa,SAAS;EAC1B,MAAM,mBAAmB,SAAS,QAAQ,QAAQ,MAAM,EAAE,MAAM,SAAS,CAAC;EAC1E,IAAI,iBAAiB,SAAS,GAAG;GAC/B,MAAM,0BAAU,IAAI,IAAY;GAChC,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,QAAQ,MAAM,OAAO,QAAQ,IAAI,IAAI;GAElD,aAAa,SAAS,MAAM,QAAQ,MAAM,QAAQ,IAAI,EAAE,EAAE,CAAC;EAC7D;EAIA,MAAM,UAAU,MAAM,QAAQ,IAC5B,WAAW,KAAK,SAAS,YAAY,IAAI,CAAC,CAC5C;EAEA,KAAK,MAAM,UAAU,SAAS;GAC5B,YAAY,KAAK,MAAM;GACvB,YAAY,KAAK,GAAG,OAAO,QAAQ;EACrC;CACF;CAEA,OAAO;EACL,OAAO;EACP,UAAU;EACV,iBAAiB,KAAK,IAAI,IAAI;EAC9B,SAAS,YAAY,OAAO,MAAM,EAAE,WAAW,SAAS;CAC1D;AACF;;;ACrGA,IAAa,kBAAb,cAAqC,MAAM;CACzC;CACA,YAAY,MAA2B,SAAiB;EACtD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;AAGA,MAAa,2BAA2B;;;AAIxC,MAAM,2BAA2B;AAEjC,MAAM,eAAe;AAErB,SAAS,YAAY,OAA2B;CAC9C,IAAI,MAAM;CACV,KAAK,MAAM,KAAK,OAAO,OAAO,OAAO,aAAa,CAAC;CACnD,OAAO,KAAK,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC5E;AAEA,SAAS,cAAc,MAA0B;CAC/C,MAAM,MAAM,KAAK,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CAIrD,MAAM,SAAS,MAAM,IAAI,QAAQ,IAAK,IAAI,SAAS,KAAM,CAAC;CAC1D,MAAM,MAAM,KAAK,MAAM;CACvB,MAAM,QAAQ,IAAI,WAAW,IAAI,MAAM;CACvC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC;CAChE,OAAO;AACT;;AAGA,SAAS,eAAe,OAA+B;CACrD,MAAM,SAAuB,CAAC;CAC9B,IAAI,QAAQ;CACZ,IAAI,WAAW;CASf,IARoB,SAAS,UAAU;EACrC,SAAS,MAAM;EACf,IAAI,QAAQ,0BAA0B;GACpC,WAAW;GACX;EACF;EACA,OAAO,KAAK,KAAK;CACnB,CACM,CAAC,CAAC,KAAK,OAAO,IAAI;CACxB,IAAI,UACF,MAAM,IAAI,gBACR,qBACA,4BAA4B,yBAAyB,OACvD;CAEF,MAAM,MAAM,IAAI,WAAW,KAAK;CAChC,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,IAAI,OAAO,MAAM;EACrB,UAAU,MAAM;CAClB;CACA,OAAO;AACT;AAEA,MAAM,aAAgC;CACpC;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,wBAAwB;CAAC;CAAQ;CAAQ;AAAS;AACxD,MAAM,wBAAwB,CAAC,aAAa,SAAS;;;AAIrD,SAAS,eAAe,GAA0B;CAChD,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,OAAO;CAChD,MAAM,IAAI;CACV,IAAI,CAAC,sBAAsB,OAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,GAC9D,OAAO;CAET,IAAI,CAAC,WAAW,SAAS,EAAE,QAAoB,GAAG,OAAO;CACzD,OAAO,sBAAsB,OAC1B,MAAM,OAAO,EAAE,OAAO,YAAY,OAAO,SAAS,EAAE,EAAE,CACzD;AACF;;;AAIA,SAAgB,gBAAgB,KAAmB,OAAO,IAAY;CACpE,MAAM,UAAU,YACd,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,GAAG,CAAC,CAAC,CAC3D;CACA,OAAO,GAAG,OAAO,eAAe;AAClC;;AAGA,SAAS,cAAc,MAAsB;CAC3C,MAAM,SAAS,KAAK,QAAQ,YAAY;CACxC,IAAI,UAAU,GAAG,OAAO,KAAK,MAAM,SAAS,CAAmB;CAC/D,OAAO,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AAChD;;AAGA,SAAS,eAAe,QAAiD;CACvE,IACE,OAAO,WAAW,YAClB,WAAW,QACV,OAAwB,WAAW,0BACpC,OAAQ,OAAwB,SAAS,UAEzC,MAAM,IAAI,MAAM,2CAA2C;CAE7D,MAAM,WAAY,OAAwB;CAC1C,IAAI,aAAa,KAAA,GAAW;CAC5B,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,CAAC,SAAS,MAAM,cAAc,GAC5D,MAAM,IAAI,MAAM,0CAA0C;AAE9D;;;;AAKA,SAAgB,gBAAgB,MAA4B;CAC1D,IAAI;EACF,MAAM,OAAO,IAAI,YAAY,CAAC,CAAC,OAC7B,eAAe,cAAc,cAAc,IAAI,CAAC,CAAC,CACnD;EACA,MAAM,SAAkB,KAAK,MAAM,IAAI;EACvC,eAAe,MAAM;EACrB,OAAO;CACT,SAAS,GAAG;EACV,IAAI,aAAa,iBAAiB,MAAM;EACxC,MAAM,IAAI,gBACR,iBACA,oCAAoC,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,GAC/E;CACF;AACF;;;;ACrJA,MAAM,4BAAY,IAAI,IAAI;CACxB;CAAM;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;AACxD,CAAC;;;AAID,SAAgB,SAAS,GAAgC;CACvD,IAAI,MAAM,KAAA,GAAW,OAAO;CAC5B,MAAM,IAAI,EAAE,YAAY,CAAC,KAAK;CAC9B,IAAK,KAAK,KAAK,KAAK,MAAO,MAAM,IAAI,OAAO;CAC5C,OAAQ,KAAK,QAAU,KAAK,QAAW,UAAU,IAAI,CAAC;AACxD;;AAGA,SAAS,qBAAqB,GAAoB;CAChD,OAAQ,KAAK,MAAM,KAAK,MAAQ,KAAK,MAAM,KAAK,MAAQ,KAAK,MAAM,KAAK;AAC1E;;;;;AAMA,SAAgB,YAAY,GAAgC;CAC1D,IAAI,MAAM,KAAA,GAAW,OAAO;CAC5B,MAAM,IAAI,EAAE,YAAY,CAAC,KAAK;CAC9B,IAAI,KAAK,KAAM,OAAO,CAAC,SAAS,CAAC;CACjC,OAAO,qBAAqB,CAAC,KAAK,MAAM,OAAO,MAAM;AACvD;AAEA,SAAgB,QAAQ,GAAgC;CACtD,OAAO,MAAM,QAAO,MAAM,OAAO,MAAM;AACzC;AAIA,SAAgB,UAAU,MAAc,GAAmB;CACzD,OAAO,IAAI,KAAK,UAAU,YAAY,KAAK,EAAE,GAAG;CAChD,OAAO;AACT;;AAGA,SAAgB,eAAe,MAAc,IAAoB;CAC/D,MAAM,MAAM,KAAK,QAAQ,MAAM,KAAK,CAAC;CACrC,OAAO,QAAQ,KAAK,KAAK,SAAS;AACpC;;;;AAKA,SAAgB,gBAAgB,MAAc,IAAoB;CAChE,MAAM,MAAM,KAAK,QAAQ,MAAM,KAAK,CAAC;CACrC,OAAO,QAAQ,KAAK,KAAK,SAAS,MAAM;AAC1C;;AAGA,SAAgB,UAAU,MAAc,IAAqB;CAC3D,OAAO,KAAK,QAAQ,QAAQ,KAAK,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO;AACvE;;;AAIA,SAAgB,WAAW,MAAc,IAAoB;CAC3D,MAAM,QAAQ,KAAK;CACnB,IAAI,IAAI,KAAK;CACb,OAAO,IAAI,KAAK,QAAQ;EACtB,MAAM,IAAI,KAAK;EACf,IAAI,MAAM,MAAM;GACd,KAAK;GACL;EACF;EACA,IAAI,MAAM,OAAO,OAAO,IAAI;EAC5B,IAAI,UAAU,OAAO,MAAM,OAAO,KAAK,IAAI,OAAO,KAAK;GACrD,IAAI,iBAAiB,MAAM,IAAI,CAAC;GAChC;EACF;EACA;CACF;CACA,OAAO;AACT;;;;AAKA,SAAgB,UAAU,MAAc,IAAoB;CAC1D,IAAI,IAAI,KAAK;CACb,IAAI,UAAU;CACd,OAAO,IAAI,KAAK,QAAQ;EACtB,MAAM,IAAI,KAAK;EACf,IAAI,MAAM,MAAM;GACd,KAAK;GACL;EACF;EACA,IAAI,MAAM,KAAK,UAAU;OACpB,IAAI,MAAM,KAAK,UAAU;OACzB,IAAI,MAAM,OAAO,CAAC,SAAS,OAAO,UAAU,MAAM,IAAI,CAAC;OACvD,IAAI,MAAM,MAAM,OAAO;EAC5B;CACF;CACA,OAAO;AACT;;;AAIA,SAAgB,cACd,MACA,GACoC;CACpC,MAAM,IAAI,KAAK;CACf,IAAI,QAAQ,CAAC,GAAG,OAAO;EAAE,KAAK,WAAW,MAAM,CAAC;EAAG,UAAU;CAAK;CAClE,IAAI,MAAM,OAAO,KAAK,IAAI,OAAO,KAC/B,OAAO;EAAE,KAAK,eAAe,MAAM,CAAC;EAAG,UAAU;CAAM;CACzD,IAAI,MAAM,OAAO,KAAK,IAAI,OAAO,KAC/B,OAAO;EAAE,KAAK,gBAAgB,MAAM,CAAC;EAAG,UAAU;CAAM;CAC1D,OAAO;EAAE,KAAK,IAAI;EAAG,UAAU;CAAM;AACvC;;;;AAKA,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,SAAgB,iBAAiB,MAAuB;CACtD,OAAO,CAAC,kBAAkB,IAAI,IAAI;AACpC;;;;AAcA,SAAS,UAAU,MAAc,GAAW,YAAgC;CAC1E,MAAM,SAAS,cAAc,MAAM,CAAC;CACpC,IAAI,OAAO,MAAM,IAAI,GACnB,OAAO;EACL,KAAK,OAAO;EACZ,YAAY,OAAO,YAAY;EAC/B,OAAO;CACT;CAEF,MAAM,KAAK,KAAK;CAChB,IAAI,OAAO,OAAO,CAAC,YACjB,OAAO;EAAE,KAAK,UAAU,MAAM,CAAC;EAAG,YAAY;EAAM,OAAO;CAAE;CAE/D,IAAI,SAAS,EAAE,GAAG,OAAO;EAAE,KAAK,IAAI;EAAG;EAAY,OAAO;CAAE;CAC5D,IAAI,YAAY,EAAE,GAAG;EACnB,MAAM,OAAO,UAAU,MAAM,CAAC;EAC9B,OAAO;GACL,KAAK;GACL,YAAY,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;GAChD,OAAO;EACT;CACF;CACA,IAAI,OAAO,KAAK,OAAO;EAAE,KAAK,IAAI;EAAG,YAAY;EAAO,OAAO;CAAE;CACjE,IAAI,OAAO,KAAK,OAAO;EAAE,KAAK,IAAI;EAAG,YAAY;EAAM,OAAO;CAAG;CACjE,OAAO;EAAE,KAAK,IAAI;EAAG,YAAY;EAAO,OAAO;CAAE;AACnD;;;;;;;AAQA,SAAgB,iBAAiB,MAAc,IAAoB;CACjE,IAAI,QAAQ;CACZ,IAAI,IAAI,KAAK;CACb,IAAI,aAAa;CACjB,OAAO,IAAI,KAAK,UAAU,QAAQ,GAAG;EACnC,MAAM,OAAO,UAAU,MAAM,GAAG,UAAU;EAC1C,SAAS,KAAK;EACd,aAAa,KAAK;EAClB,IAAI,KAAK;CACX;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,WAAW,MAAc,MAAsB;CAC7D,IAAI,QAAQ;CACZ,IAAI,IAAI;CACR,IAAI,aAAa;CACjB,OAAO,IAAI,KAAK,QAAQ;EACtB,MAAM,OAAO,UAAU,MAAM,GAAG,UAAU;EAC1C,SAAS,KAAK;EACd,aAAa,KAAK;EAClB,IAAI,KAAK;EACT,IAAI,KAAK,UAAU,MAAM,UAAU,GAAG,OAAO,IAAI;CACnD;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,MAAc,IAAY,MAAuB;CACzE,OAAO,KAAK,WAAW,MAAM,EAAE,KAAK,CAAC,YAAY,KAAK,KAAK,KAAK,OAAO;AACzE;;AAGA,SAAgB,WAAW,MAAc,IAAoB;CAC3D,IAAI,IAAI;CACR,SAAS;EACP,MAAM,IAAI,KAAK;EACf,IAAI,SAAS,CAAC,GAAG;GACf;GACA;EACF;EACA,IAAI,MAAM,OAAO,KAAK,IAAI,OAAO,KAAK;GACpC,IAAI,eAAe,MAAM,CAAC;GAC1B;EACF;EACA,IAAI,MAAM,OAAO,KAAK,IAAI,OAAO,KAAK;GACpC,IAAI,gBAAgB,MAAM,CAAC;GAC3B;EACF;EACA,OAAO;CACT;AACF;;;;ACxQA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,IAAI;;AAGX,SAAgB,WAAW,MAAsB;CAC/C,OAAO,KACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ,CAAC,CACvB,QAAQ,MAAM,OAAO;AAC1B;;AAGA,SAAS,aAAa,GAA+B;CACnD,IAAI,MAAM,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO;CAChD,IAAI,MAAM,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO;CAChD,OAAO;AACT;;;AAIA,SAAS,eACP,GACA,OACA,UACsB;CACtB,IAAI,MAAM,OAAO,SAAS,GAAG,OAAO;CACpC,IAAI,MAAM,QAAQ,SAAS,KAAK,UAAU,OAAO;CACjD,OAAO;AACT;;;;AAKA,SAAS,iBAAiB,MAAc,IAAoB;CAC1D,IAAI,IAAI;CACR,IAAI,QAAQ;CACZ,IAAI,WAAW;CACf,OAAO,IAAI,KAAK,QAAQ;EACtB,MAAM,SAAS,cAAc,MAAM,CAAC;EACpC,IAAI,OAAO,MAAM,IAAI,GAAG;GACtB,WAAW,YAAY,OAAO;GAC9B,IAAI,OAAO;GACX;EACF;EACA,MAAM,OAAO,eAAe,KAAK,IAAI,OAAO,QAAQ;EACpD,IAAI,SAAS,QAAQ,OAAO,IAAI;EAChC,IAAI,SAAS,MAAM,OAAO;EAC1B,SAAS,aAAa,KAAK,EAAE;EAC7B;CACF;CACA,OAAO;AACT;;;AAIA,SAAS,aAAa,MAAc,IAAoB;CACtD,IAAI,IAAI;CACR,OAAO,IAAI,KAAK,WAAW,KAAK,OAAO,OAAO,KAAK,OAAO,MAAO;CACjE,IAAI,KAAK,OAAO,KAAK;CACrB,OAAO;AACT;;;AAIA,SAAS,eAAe,MAAc,MAAsB;CAC1D,MAAM,SAAS,WAAW,MAAM,OAAO,CAAC;CACxC,MAAM,IAAI,KAAK;CACf,IAAI,MAAM,QAAO,MAAM,KACrB,OAAO,aAAa,MAAM,WAAW,MAAM,MAAM,CAAC;CAEpD,OAAO;AACT;;AAGA,SAAS,eAAe,MAAc,IAAoB;CACxD,IAAI,IAAI,WAAW,MAAM,KAAK,CAAC;CAC/B,IAAI,UAAU,MAAM,GAAG,IAAI,GAAG;EAC5B,IAAI,WAAW,MAAM,IAAI,CAAC;EAC1B,IAAI,UAAU,MAAM,CAAC;CACvB;CACA,MAAM,OAAO,WAAW,MAAM,CAAC;CAC/B,IAAI,UAAU,MAAM,MAAM,MAAM,GAAG,OAAO,eAAe,MAAM,IAAI;CACnE,OAAO,aAAa,MAAM,CAAC;AAC7B;;;;;;;AAQA,SAAS,kBAAkB,MAAc,IAAoB;CAC3D,IAAI,KAAK,QAAQ,KAAK,OAAO,eAAe,MAAM,EAAE;CACpD,MAAM,QAAQ,WAAW,MAAM,EAAE;CACjC,MAAM,IAAI,QAAQ,IAAI,KAAK,SAAS,QAAQ;CAC5C,MAAM,OAAO,WAAW,MAAM,CAAC;CAC/B,IAAI,UAAU,MAAM,MAAM,MAAM,GAAG,OAAO,eAAe,MAAM,IAAI;CACnE,OAAO,aAAa,MAAM,CAAC;AAC7B;AAeA,SAAS,YAAY,IAAwB;CAC3C,OAAO,GAAG,MAAM,WAAW,KAAK,GAAG,MAAM,GAAG,EAAE,MAAM;AACtD;;AAGA,SAAS,WAAW,MAAc,IAAe,KAAwB;CACvE,MAAM,SAAS,cAAc,MAAM,GAAG,CAAC;CACvC,IAAI,OAAO,OAAO,GAAG,IAAI,GAAG,OAAO;CACnC,IAAI,KAAK,KAAK,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC;CACrC,IAAI,OAAO,UAAU;EACnB,GAAG,YAAY;EACf,GAAG,aAAa;CAClB;CACA,GAAG,IAAI,OAAO;CACd,OAAO;AACT;;;;AAKA,SAAS,aAAa,MAAc,IAAe,KAAwB;CACzE,MAAM,IAAI,KAAK,GAAG;CAClB,IAAI,MAAM,KAAK;EAIb,GAAG,MAAM,KAAK,GAAG,YAAY,UAAU,MAAM;EAC7C,GAAG,aAAa;CAClB,OAAO,IAAI,MAAM,KAAK;EACpB,MAAM,SAAS,GAAG,MAAM,IAAI;EAC5B,GAAG,YAAY,WAAW;EAC1B,GAAG,aAAa,WAAW;CAC7B,OAAO,IAAI,MAAM,OAAO,MAAM,KAAK;EACjC,GAAG,MAAM,KAAK,MAAM;EACpB,GAAG,YAAY;EACf,GAAG,aAAa;CAClB,OAAO,IAAI,MAAM,OAAO,MAAM,KAAK;EACjC,GAAG,MAAM,IAAI;EACb,GAAG,YAAY;EACf,GAAG,aAAa;CAClB,OACE,OAAO;CAET,IAAI,KAAK,KAAK,EAAE;CAChB,GAAG;CACH,OAAO;AACT;;;;AAKA,SAAS,gBAAgB,MAAc,IAAe,KAAwB;CAC5E,MAAM,IAAI,KAAK,GAAG;CAClB,IAAI,MAAM,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,OAAO;CACpD,IAAI,MAAM,KAAK;EACb,IAAI,YAAY,EAAE,GAAG,GAAG,YAAY;EACpC,GAAG,aAAa;CAClB,OAAO,IAAI,MAAM,QAAQ,YAAY,EAAE,GACrC,GAAG,YAAY;CAEjB,IAAI,KAAK,KAAK,EAAE;CAChB,GAAG;CACH,OAAO;AACT;;;;AAKA,SAAS,WAAW,MAAc,IAAe,KAAwB;CACvE,IAAI,KAAK,GAAG,OAAO,OAAO,UAAU,MAAM,GAAG,CAAC,GAAG,OAAO;CACxD,IAAI,GAAG,YAAY;EACjB,IAAI,KAAK,GAAG;EACZ,GAAG;EACH,GAAG,aAAa;CAClB,OAAO;EACL,MAAM,MAAM,UAAU,MAAM,GAAG,CAAC;EAChC,IAAI,KAAK,KAAK,MAAM,GAAG,GAAG,GAAG,CAAC;EAC9B,GAAG,IAAI;EACP,GAAG,aAAa;CAClB;CACA,GAAG,YAAY;CACf,OAAO;AACT;;;;AAKA,SAAS,UAAU,MAAc,IAAe,KAAwB;CACtE,IAAI,CAAC,GAAG,aAAa,CAAC,UAAU,MAAM,GAAG,GAAG,QAAQ,GAAG,OAAO;CAC9D,MAAM,KAAK,KAAK,WAAW,MAAM,GAAG,IAAI,CAAC;CACzC,IAAI,OAAO,OAAO,OAAO,KAAK;EAC5B,IAAI,KAAK,QAAQ;EACjB,GAAG,KAAK;EACR,GAAG,YAAY;EACf,GAAG,aAAa;EAChB,OAAO;CACT;CACA,GAAG,IAAI,iBAAiB,MAAM,GAAG,IAAI,CAAC;CACtC,GAAG,YAAY;CACf,GAAG,aAAa;CAChB,OAAO;AACT;;;;AAKA,SAAS,UAAU,MAAc,IAAe,KAAwB;CACtE,IAAI,CAAC,GAAG,aAAa,CAAC,UAAU,MAAM,GAAG,GAAG,QAAQ,GAAG,OAAO;CAC9D,MAAM,IAAI,WAAW,MAAM,GAAG,IAAI,CAAC;CACnC,IACE,CAAC,GAAG,qBACJ,KAAK,WAAW,WAAW,CAAC,KAC5B,CAAC,YAAY,KAAK,IAAI,EAAE,GACxB;EAGA,IAAI,KAAK,SAAS;EAClB,GAAG,oBAAoB;EACvB,GAAG,IAAI,WAAW,MAAM,IAAI,CAAC;EAC7B,GAAG,YAAY;EACf,GAAG,aAAa;EAChB,OAAO;CACT;CACA,IAAI,KAAK,OAAO,OAAO,KAAK,OAAO,KAAK;EACtC,GAAG,IAAI,kBAAkB,MAAM,CAAC;EAChC,GAAG,YAAY;EACf,GAAG,aAAa;EAChB,OAAO;CACT;CACA,GAAG,IAAI;CACP,GAAG,YAAY;CACf,GAAG,aAAa;CAChB,OAAO;AACT;;;AAIA,SAAS,QAAQ,MAAc,IAAe,KAAwB;CACpE,IAAI,CAAC,YAAY,KAAK,GAAG,EAAE,GAAG,OAAO;CACrC,MAAM,OAAO,UAAU,MAAM,GAAG,CAAC;CACjC,IAAI,KAAK,KAAK,MAAM,GAAG,GAAG,IAAI,CAAC;CAC/B,GAAG,aAAa,iBAAiB,KAAK,MAAM,GAAG,GAAG,IAAI,CAAC;CACvD,GAAG,YAAY;CACf,GAAG,IAAI;CACP,OAAO;AACT;;;AAIA,MAAM,WAAwE;CAC5E;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAS,YAAY,MAAc,IAAe,KAAqB;CACrE,KAAK,MAAM,UAAU,UACnB,IAAI,OAAO,MAAM,IAAI,GAAG,GAAG;CAE7B,GAAG,YAAY;CACf,GAAG,aAAa;CAChB,IAAI,KAAK,KAAK,GAAG,MAAM,EAAE;CACzB,GAAG;AACL;;;;;;;;;;;;;;;;AAiBA,SAAgB,eAAe,MAAsB;CACnD,MAAM,MAAgB,CAAC;CACvB,MAAM,KAAgB;EACpB,GAAG;EACH,WAAW;EACX,mBAAmB;EACnB,OAAO,CAAC;EACR,YAAY;CACd;CACA,OAAO,GAAG,IAAI,KAAK,QAAQ;EACzB,IAAI,KAAK,GAAG,OAAO,KAAA,GAAW;EAC9B,YAAY,MAAM,IAAI,GAAG;CAC3B;CACA,OAAO,IAAI,KAAK,EAAE;AACpB;;;;;;;;;;;;AAaA,SAAgB,iBAAiB,MAAuB;CAKtD,MAAM,SAAS;EAAC;EAAW;EAAY;EAAgB;EAJrC,eAAe,IAIuC;CAAC;CAIzE,MAAM,SAAS,IADA,SAAS,GAAG,MACX,CAAC,CAAC,SAAS,UAAU,cAAc,KAAK;CACxD,IAAI,EAAE,kBAAkB,UACtB,MAAM,IAAI,UAAU,qCAAqC;CAE3D,OAAO;AACT;;;;;;AAOA,eAAsB,uBACpB,SACA,WACkD;CAClD,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,YAAY,OAAO,GACnB,IAAI,SAAgB,GAAG,WAAW;GAChC,QAAQ,iBACA,uBAAO,IAAI,MAAM,4BAA4B,UAAU,GAAG,CAAC,GACjE,SACF;EACF,CAAC,CACH,CAAC;CACH,UAAU;EAGR,IAAI,UAAU,KAAA,GAAW,aAAa,KAAK;CAC7C;AACF;;;AChYA,MAAM,QAAQ;;;;;;AAOd,SAAS,aAAa,KAIpB;CACA,MAAM,SAAS,IAAI,cAAc,KAAK;CACtC,OAAO,aACL,SACA,sHACF;CACA,MAAM,SAAS,IAAI,cAAc,QAAQ;CACzC,OAAO,cAAc;CACrB,OAAO,aACL,SACA,iIACF;CACA,MAAM,SAAS,IAAI,cAAc,MAAM;CACvC,OAAO,aAAa,SAAS,kCAAkC;CAC/D,OAAO,cAAc;CACrB,OAAO,OAAO,QAAQ,MAAM;CAC5B,OAAO;EAAE;EAAQ;EAAQ;CAAO;AAClC;AAEA,SAAS,aACP,KACA,MACA,UACmC;CACnC,IAAI,UAAU;EACZ,MAAM,MAAM,IAAI,cAAc,KAAK;EACnC,IAAI,aACF,SACA,0EACF;EACA,IAAI,cAAc;EAClB,OAAO;CACT;CACA,MAAM,WAAW,IAAI,cAAc,UAAU;CAC7C,SAAS,QAAQ;CACjB,SAAS,aACP,SACA,mKACF;CACA,OAAO;AACT;AAEA,SAAS,YAAY,KAAkC;CACrD,MAAM,QAAQ,IAAI,cAAc,QAAQ;CAIxC,MAAM,aAAa,WAAW,eAAe;CAC7C,MAAM,aACJ,SACA,oEACF;CACA,OAAO;AACT;AAEA,MAAM,YACJ;;;AAIF,SAAS,cAAc,QAAgC;CAKrD,OAAO;EACL;EACA;EACA;EACA,WARa,OAAO,MAAM,QAAQ,MAAM,EAAE,WAAW,SAEhD,CAAC,CAAC,KAAK,MAAM,GAAG,EAAE,OAAO,IAAI,EAAE,SAAS,UAAU,CAAC,CAAC,KAAK,IAAI,KAClE,GAAG,OAAO,MAAM,OAAO,cAKP;EAChB;CACF,CAAC,CAAC,KAAK,EAAE;AACX;;;AAIA,SAAS,WAAW,QAAwB,QAAwB;CAClE,IAAI,OAAO,SAAS,WAAW,GAC7B,OACE,0BACA,YACA,sBACA,SACA;CAGJ,MAAM,QAAQ,kBAAkB,OAAO,QAAQ;CAC/C,OAAO,MAAM,SAAS,QAAQ,IAC1B,MAAM,QAAQ,UAAU,WAAW,MAAM,IACzC,SAAS;AACf;;AAGA,SAAS,WAAW,QAAgC;CAClD,OAAO;EACL;EACA;EACA;EACA;EACA,WAAW,OAAO,OAAO,MAAM,MAAM,CAAC;EACtC;EACA,WAAW,OAAO,OAAO,eAAe,CAAC;EACzC;CACF,CAAC,CAAC,KAAK,EAAE;AACX;;AAGA,SAAS,SAAS,GAAoB;CACpC,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;CACrD,OAAO;EACL;EACA;EACA;EACA;EACA,WAAW,GAAG;EACd;CACF,CAAC,CAAC,KAAK,EAAE;AACX;AAEA,SAAS,WAAW,QAAgC;CAClD,IAAI,OAAO,SACT,OAAO,GAAG,OAAO,SAAS,OAAO,cAAc,OAAO,gBAAgB;CAExE,OAAO,GADU,OAAO,MAAM,QAAQ,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC,OACjD,oBAAoB,OAAO,SAAS,OAAO;AAChE;;AAGA,SAAS,aACP,QACA,cACM;CACN,IAAI,CAAC,OAAO,SAAS;EACnB,aAAa,WAAW,QAAQ,cAAc,MAAM,CAAC,CAAC;EACtD;CACF;CACA,IAAI,OAAO,SAAS,WAAW,GAAG;EAChC,aAAa,WAAW,MAAM,CAAC;EAC/B;CACF;CACA,aAAa,kBAAkB,OAAO,QAAQ,CAAC;AACjD;;;;;;;AAQA,SAAgB,YACd,IACA,OAA2B,CAAC,GACb;CACf,MAAM,MAAM,GAAG;CACf,MAAM,OAAO,KAAK,QAAQ;CAE1B,MAAM,OAAO,IAAI,cAAc,KAAK;CACpC,KAAK,aAAa,SAAS,KAAK;CAChC,MAAM,EAAE,QAAQ,QAAQ,WAAW,aAAa,GAAG;CACnD,MAAM,SAAS,aAAa,KAAK,MAAM,KAAK,aAAa,IAAI;CAC7D,MAAM,QAAQ,YAAY,GAAG;CAC7B,KAAK,OAAO,QAAQ,QAAQ,KAAK;CACjC,GAAG,YAAY,IAAI;CAInB,MAAM,gBACJ,KAAK,aAAa,OAAO,OAAQ,OAA+B;CAElE,MAAM,MAAM,YAA2B;EACrC,OAAO,WAAW;EAClB,OAAO,cAAc;EACrB,IAAI;EACJ,IAAI;GAEF,SAAS,MAAM,uBADC,iBAAiB,QAAQ,CACH,GAAS,GAAM;GACrD,aAAa,SAAS,SAAS;IAC7B,MAAM,SAAS;GACjB,CAAC;GACD,OAAO,cAAc,WAAW,MAAM;EACxC,SAAS,GAAG;GACV,MAAM,SAAS,SAAS,CAAC;GACzB,OAAO,cAAc;GACrB,OAAO,WAAW;GAClB;EACF;EACA,OAAO,WAAW;EAGlB,KAAK,QAAQ,MAAM;CACrB;CAEA,MAAM,gBAAsB;EAC1B,IAAS;CACX;CACA,OAAO,iBAAiB,SAAS,OAAO;CACxC,IAAI,KAAK,YAAY,MAAM,IAAS;CAEpC,OAAO,EACL,UAAU;EACR,OAAO,oBAAoB,SAAS,OAAO;EAC3C,KAAK,OAAO;CACd,EACF;AACF"}

package/index.html

@@ -124,6 +124,7 @@
       <h1>Sverka Playground</h1>
       <div class="actions">
         <span class="status" id="status">Ready</span>
+        <button id="share-btn" title="Copy share link">Share</button>
         <button id="run-btn">Run</button>
       </div>
     </header>
@@ -135,7 +136,11 @@
       <div class="splitter" id="splitter"></div>
       <div class="findings-panel">
         <div class="panel-header">Findings</div>
-        <iframe id="findings-frame" title="Findings"></iframe>
+        <iframe
+          id="findings-frame"
+          title="Findings"
+          sandbox="allow-scripts"
+        ></iframe>
       </div>
     </div>
     <!-- Monaco editor loaded from CDN at runtime (see app.ts).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sverka/playground",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Sverka Playground — browser sandbox for building and running check pipelines",
   "license": "MIT",
   "repository": {
@@ -37,12 +37,14 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@sverka/sarif-viewer-web": "^0.2.10"
+    "@sverka/sarif-viewer-web": "^0.2.12",
+    "fflate": "0.8.3"
   },
   "devDependencies": {
+    "jsdom": "^30.1.2",
     "tsdown": "^0.23.0",
     "typescript": "^5.8.0",
-    "vitest": "^5.0.0",
-    "vite": "^8.3.1"
+    "vite": "^8.3.1",
+    "vitest": "^5.0.0"
   }
 }