@tractorcow/beefup 0.0.0 → 1.0.0

package/dist/rewrite/workspace.d.ts

@@ -0,0 +1,14 @@
+import type { UpgradeMode } from "../config/types.js";
+import type { PackageManager } from "../project/types.js";
+/**
+ * Rewrites dependency ranges in every workspace package.json according to upgrade mode.
+ */
+export declare function rewriteWorkspace(root: string, mode: UpgradeMode): Promise<void>;
+/**
+ * Re-pins every workspace package.json to exact versions from the given lockfile.
+ */
+export declare function repinWorkspace(root: string, lockfilePath: string, packageManager: PackageManager): Promise<void>;
+/**
+ * Joins a project root with its lockfile basename.
+ */
+export declare function lockfilePathFor(root: string, lockfileName: string): string;

package/dist/rewrite/workspace.js

@@ -0,0 +1,40 @@
+import path from "node:path";
+import { readJsonFile, writeJsonFile } from "../fsutil.js";
+import { lockedVersionsForImporter } from "../lockfile/locked.js";
+import { listWorkspacePackages } from "../project/workspace.js";
+import { rewritePackageJson } from "./constraints.js";
+import { rePinPackageJson } from "./repin.js";
+/**
+ * Rewrites dependency ranges in every workspace package.json according to upgrade mode.
+ */
+export async function rewriteWorkspace(root, mode) {
+    const workspaces = await listWorkspacePackages(root);
+    for (const ws of workspaces) {
+        const pkg = await readJsonFile(ws.packageJsonPath);
+        const next = rewritePackageJson(pkg, mode);
+        await writeJsonFile(ws.packageJsonPath, next);
+    }
+}
+/**
+ * Re-pins every workspace package.json to exact versions from the given lockfile.
+ */
+export async function repinWorkspace(root, lockfilePath, packageManager) {
+    const workspaces = await listWorkspacePackages(root);
+    for (const ws of workspaces) {
+        const locked = await lockedVersionsForImporter({
+            lockfilePath,
+            packageManager,
+            importerDir: ws.relativeDir,
+        });
+        const pkg = await readJsonFile(ws.packageJsonPath);
+        const next = rePinPackageJson(pkg, locked);
+        await writeJsonFile(ws.packageJsonPath, next);
+    }
+}
+/**
+ * Joins a project root with its lockfile basename.
+ */
+export function lockfilePathFor(root, lockfileName) {
+    return path.join(root, lockfileName);
+}
+//# sourceMappingURL=workspace.js.map

package/dist/rewrite/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/rewrite/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,IAAiB;IAEjB,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,YAAoB,EACpB,cAA8B;IAE9B,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,YAAY;YACZ,cAAc;YACd,WAAW,EAAE,EAAE,CAAC,WAAW;SAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,YAAoB;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AACvC,CAAC"}

package/dist/security/classify.d.ts

@@ -0,0 +1,48 @@
+import type { AdvisoryRef } from "./refs.js";
+/** Closed set of vulnerability severities used in security reports. */
+export declare const FindingSeverities: {
+    readonly Critical: "critical";
+    readonly High: "high";
+    readonly Moderate: "moderate";
+    readonly Low: "low";
+    readonly Info: "info";
+};
+/** Severity level for a security finding. */
+export type FindingSeverity = (typeof FindingSeverities)[keyof typeof FindingSeverities];
+/** Closed set of scanners that can produce a security finding. */
+export declare const SecuritySources: {
+    readonly NpmAudit: "npm-audit";
+    readonly CveLite: "cve-lite";
+};
+/** Scanner that produced a security finding. */
+export type SecuritySource = (typeof SecuritySources)[keyof typeof SecuritySources];
+export interface SecurityFinding {
+    /** Primary identity for classification (prefer GHSA, then CVE, then OSV). */
+    id: string;
+    /** Public CVE / GHSA / OSV references for this vulnerability. */
+    refs: AdvisoryRef[];
+    /**
+     * Parent package names when this row is an npm meta-vuln (via strings only).
+     * Empty/undefined for findings with real advisory objects.
+     */
+    viaPackages?: string[];
+    packageName: string;
+    version?: string;
+    severity: FindingSeverity;
+    source: SecuritySource;
+    title?: string;
+}
+export interface ClassifiedFindings {
+    fixed: SecurityFinding[];
+    introduced: SecurityFinding[];
+    /** Present before and after the upgrade — still open / unfixed. */
+    unresolved: SecurityFinding[];
+}
+/**
+ * Maps a raw severity string from a scanner into a normalized FindingSeverity.
+ */
+export declare function normalizeSeverity(raw: string | undefined): FindingSeverity;
+/**
+ * Classifies findings as fixed, introduced, or unresolved by comparing before/after scans.
+ */
+export declare function classifyFindings(before: SecurityFinding[], after: SecurityFinding[]): ClassifiedFindings;

package/dist/security/classify.js

@@ -0,0 +1,86 @@
+/** Closed set of vulnerability severities used in security reports. */
+export const FindingSeverities = {
+    Critical: "critical",
+    High: "high",
+    Moderate: "moderate",
+    Low: "low",
+    Info: "info",
+};
+/** Closed set of scanners that can produce a security finding. */
+export const SecuritySources = {
+    NpmAudit: "npm-audit",
+    CveLite: "cve-lite",
+};
+const SEVERITY_ORDER = [
+    FindingSeverities.Critical,
+    FindingSeverities.High,
+    FindingSeverities.Moderate,
+    FindingSeverities.Low,
+    FindingSeverities.Info,
+];
+/**
+ * Maps a raw severity string from a scanner into a normalized FindingSeverity.
+ */
+export function normalizeSeverity(raw) {
+    const value = (raw ?? FindingSeverities.Info).toLowerCase();
+    if (value === FindingSeverities.Critical) {
+        return FindingSeverities.Critical;
+    }
+    if (value === FindingSeverities.High) {
+        return FindingSeverities.High;
+    }
+    if (value === FindingSeverities.Moderate || value === "medium") {
+        return FindingSeverities.Moderate;
+    }
+    if (value === FindingSeverities.Low) {
+        return FindingSeverities.Low;
+    }
+    return FindingSeverities.Info;
+}
+/**
+ * Builds a stable identity key for a finding (id + package name).
+ */
+function findingKey(finding) {
+    return `${finding.id}::${finding.packageName}`;
+}
+/**
+ * Sorts findings by severity (highest first), then by identity key.
+ */
+function sortFindings(findings) {
+    return [...findings].sort((a, b) => {
+        const severity = SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity);
+        if (severity !== 0) {
+            return severity;
+        }
+        return findingKey(a).localeCompare(findingKey(b));
+    });
+}
+/**
+ * Classifies findings as fixed, introduced, or unresolved by comparing before/after scans.
+ */
+export function classifyFindings(before, after) {
+    const beforeMap = new Map(before.map((item) => [findingKey(item), item]));
+    const afterMap = new Map(after.map((item) => [findingKey(item), item]));
+    const fixed = [];
+    const introduced = [];
+    const unresolved = [];
+    for (const [key, finding] of beforeMap) {
+        if (afterMap.has(key)) {
+            unresolved.push(afterMap.get(key) ?? finding);
+        }
+        else {
+            fixed.push(finding);
+        }
+    }
+    for (const [key, finding] of afterMap) {
+        if (!beforeMap.has(key)) {
+            introduced.push(finding);
+        }
+    }
+    return {
+        fixed: sortFindings(fixed),
+        introduced: sortFindings(introduced),
+        unresolved: sortFindings(unresolved),
+    };
+}
+//# sourceMappingURL=classify.js.map

package/dist/security/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/security/classify.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACJ,CAAC;AAMX,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,UAAU;CACX,CAAC;AA8BX,MAAM,cAAc,GAAsB;IACxC,iBAAiB,CAAC,QAAQ;IAC1B,iBAAiB,CAAC,IAAI;IACtB,iBAAiB,CAAC,QAAQ;IAC1B,iBAAiB,CAAC,GAAG;IACrB,iBAAiB,CAAC,IAAI;CACvB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,KAAK,KAAK,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QACzC,OAAO,iBAAiB,CAAC,QAAQ,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,iBAAiB,CAAC,IAAI,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,iBAAiB,CAAC,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,iBAAiB,CAAC,QAAQ,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,KAAK,iBAAiB,CAAC,GAAG,EAAE,CAAC;QACpC,OAAO,iBAAiB,CAAC,GAAG,CAAC;IAC/B,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,OAAwB;IAC1C,OAAO,GAAG,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,QAA2B;IAC/C,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GACZ,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,EACzB,KAAwB;IAExB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAsB,EAAE,CAAC;IAEzC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;QAC1B,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC;QACpC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC;KACrC,CAAC;AACJ,CAAC"}

package/dist/security/cve-lite.d.ts

@@ -0,0 +1,7 @@
+import { type SecurityFinding } from "./classify.js";
+/**
+ * Parses cve-lite JSON output into normalized SecurityFinding entries.
+ * Collects CVE / GHSA / OSV refs from common field names and aliases.
+ * Returns an empty list when the payload is not valid JSON.
+ */
+export declare function parseCveLiteJson(raw: string): SecurityFinding[];

package/dist/security/cve-lite.js

@@ -0,0 +1,78 @@
+import { normalizeSeverity, SecuritySources, } from "./classify.js";
+import { primaryFindingId, refsFromScannerFields } from "./refs.js";
+/**
+ * Narrows an unknown value to a plain object record, or undefined.
+ */
+function asRecord(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return undefined;
+}
+/**
+ * Extracts a findings array from cve-lite JSON (top-level array or known keys).
+ */
+function collectArray(value) {
+    if (Array.isArray(value)) {
+        return value;
+    }
+    const rec = asRecord(value);
+    if (!rec) {
+        return [];
+    }
+    for (const key of ["findings", "vulnerabilities", "issues", "results"]) {
+        if (Array.isArray(rec[key])) {
+            return rec[key];
+        }
+    }
+    return [];
+}
+/**
+ * Parses cve-lite JSON output into normalized SecurityFinding entries.
+ * Collects CVE / GHSA / OSV refs from common field names and aliases.
+ * Returns an empty list when the payload is not valid JSON.
+ */
+export function parseCveLiteJson(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    const items = collectArray(parsed);
+    const findings = [];
+    for (const item of items) {
+        const rec = asRecord(item);
+        if (!rec) {
+            continue;
+        }
+        const packageName = (typeof rec.package === "string" && rec.package) ||
+            (typeof rec.packageName === "string" && rec.packageName) ||
+            (typeof rec.name === "string" && rec.name) ||
+            undefined;
+        if (!packageName) {
+            continue;
+        }
+        const refs = refsFromScannerFields({
+            id: rec.id,
+            cve: rec.cve,
+            ghsa: rec.ghsa,
+            osvId: rec.osvId,
+            aliases: rec.aliases,
+            url: rec.url,
+        });
+        const fallback = `${packageName}:${String(rec.version ?? "")}`;
+        findings.push({
+            id: primaryFindingId(refs, fallback),
+            refs,
+            packageName,
+            version: typeof rec.version === "string" ? rec.version : undefined,
+            severity: normalizeSeverity(typeof rec.severity === "string" ? rec.severity : undefined),
+            source: SecuritySources.CveLite,
+            title: typeof rec.title === "string" ? rec.title : undefined,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=cve-lite.js.map

package/dist/security/cve-lite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-lite.js","sourceRoot":"","sources":["../../src/security/cve-lite.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,eAAe,GAEhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEpE;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC,GAAG,CAAc,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GACf,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;YAChD,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC;YACxD,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC;YAC1C,SAAS,CAAC;QACZ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,qBAAqB,CAAC;YACjC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpC,IAAI;YACJ,WAAW;YACX,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAClE,QAAQ,EAAE,iBAAiB,CACzB,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAC5D;YACD,MAAM,EAAE,eAAe,CAAC,OAAO;YAC/B,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/security/npm-audit.d.ts

@@ -0,0 +1,10 @@
+import { type SecurityFinding } from "./classify.js";
+/** Title used for npm meta-vulns that only depend on other vulnerable packages. */
+export declare const META_VULN_TITLE = "Depends on vulnerable package(s)";
+/**
+ * Parses `npm audit --json` output into normalized SecurityFinding entries.
+ * Prefers GHSA/CVE refs extracted from advisory URLs over numeric npm advisory ids.
+ * Meta-vulns (via package-name strings only) are kept with viaPackages labels.
+ * Returns an empty list when the payload is not valid JSON.
+ */
+export declare function parseNpmAuditJson(raw: string): SecurityFinding[];

package/dist/security/npm-audit.js

@@ -0,0 +1,65 @@
+import { normalizeSeverity, SecuritySources, } from "./classify.js";
+import { primaryFindingId, dedupeRefs, refsFromText } from "./refs.js";
+/** Title used for npm meta-vulns that only depend on other vulnerable packages. */
+export const META_VULN_TITLE = "Depends on vulnerable package(s)";
+/**
+ * Parses `npm audit --json` output into normalized SecurityFinding entries.
+ * Prefers GHSA/CVE refs extracted from advisory URLs over numeric npm advisory ids.
+ * Meta-vulns (via package-name strings only) are kept with viaPackages labels.
+ * Returns an empty list when the payload is not valid JSON.
+ */
+export function parseNpmAuditJson(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    const findings = [];
+    for (const [packageName, vuln] of Object.entries(parsed.vulnerabilities ?? {})) {
+        const vias = Array.isArray(vuln.via) ? vuln.via : [];
+        const advisoryVias = vias.filter((item) => typeof item === "object" && item !== null);
+        const viaPackages = vias
+            .filter((item) => typeof item === "string")
+            .map((item) => item.trim())
+            .filter((item) => item.length > 0)
+            .sort((a, b) => a.localeCompare(b));
+        if (advisoryVias.length === 0) {
+            const fallback = `npm:${packageName}`;
+            findings.push({
+                id: fallback,
+                refs: [],
+                viaPackages: viaPackages.length > 0 ? viaPackages : undefined,
+                packageName: vuln.name ?? packageName,
+                severity: normalizeSeverity(vuln.severity),
+                source: SecuritySources.NpmAudit,
+                title: META_VULN_TITLE,
+            });
+            continue;
+        }
+        for (const via of advisoryVias) {
+            const refs = dedupeRefs([
+                ...refsFromText(via.url),
+                ...refsFromText(typeof via.cve === "string" ? via.cve : undefined),
+                ...(Array.isArray(via.cve)
+                    ? via.cve.flatMap((item) => refsFromText(item))
+                    : []),
+                ...refsFromText(via.title),
+            ]);
+            const fallback = via.source !== undefined
+                ? `npm:${via.source}`
+                : via.url ?? via.title ?? packageName;
+            findings.push({
+                id: primaryFindingId(refs, fallback),
+                refs,
+                packageName: via.name ?? vuln.name ?? packageName,
+                severity: normalizeSeverity(via.severity ?? vuln.severity),
+                source: SecuritySources.NpmAudit,
+                title: via.title,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=npm-audit.js.map

package/dist/security/npm-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-audit.js","sourceRoot":"","sources":["../../src/security/npm-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,eAAe,GAEhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAsBvE,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAC9B,CAAC,IAAI,EAAuB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CACzE,CAAC;QACF,MAAM,WAAW,GAAG,IAAI;aACrB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;aAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,OAAO,WAAW,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,EAAE;gBACR,WAAW,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBAC7D,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW;gBACrC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,eAAe,CAAC,QAAQ;gBAChC,KAAK,EAAE,eAAe;aACvB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,UAAU,CAAC;gBACtB,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;gBACxB,GAAG,YAAY,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAClE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBACxB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;YACH,MAAM,QAAQ,GACZ,GAAG,CAAC,MAAM,KAAK,SAAS;gBACtB,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,EAAE;gBACrB,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,WAAW,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACpC,IAAI;gBACJ,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,WAAW;gBACjD,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC1D,MAAM,EAAE,eAAe,CAAC,QAAQ;gBAChC,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/security/refs.d.ts

@@ -0,0 +1,63 @@
+/** Closed set of public vulnerability reference kinds. */
+export declare const AdvisoryRefKinds: {
+    readonly Cve: "cve";
+    readonly Ghsa: "ghsa";
+    readonly Osv: "osv";
+};
+/** Kind of public advisory identifier (CVE, GHSA, or OSV). */
+export type AdvisoryRefKind = (typeof AdvisoryRefKinds)[keyof typeof AdvisoryRefKinds];
+/** A lookup-able vulnerability reference with a stable public URL. */
+export interface AdvisoryRef {
+    id: string;
+    kind: AdvisoryRefKind;
+    url: string;
+}
+/**
+ * Builds the canonical GitHub Advisory Database URL for a GHSA id.
+ */
+export declare function urlForGhsa(id: string): string;
+/**
+ * Builds the NVD detail URL for a CVE id.
+ */
+export declare function urlForCve(id: string): string;
+/**
+ * Builds the OSV.dev vulnerability URL for an OSV id.
+ * Path-encodes the id so punctuation cannot break markdown links.
+ */
+export declare function urlForOsv(id: string): string;
+/**
+ * Creates an AdvisoryRef for a known id string, or undefined when unrecognized.
+ * Only validated id shapes become refs (avoids markdown / URL injection via ids).
+ */
+export declare function refFromId(raw: string): AdvisoryRef | undefined;
+/**
+ * Extracts GHSA/CVE/OSV ids mentioned in free text or a URL.
+ */
+export declare function refsFromText(text: string | undefined): AdvisoryRef[];
+/**
+ * Collects refs from common scanner field shapes (string, string[], or nested).
+ */
+export declare function refsFromScannerFields(fields: {
+    id?: unknown;
+    cve?: unknown;
+    ghsa?: unknown;
+    osvId?: unknown;
+    aliases?: unknown;
+    url?: unknown;
+}): AdvisoryRef[];
+/**
+ * Dedupes refs by id, preserving first-seen order (GHSA/CVE/OSV as discovered).
+ */
+export declare function dedupeRefs(refs: AdvisoryRef[]): AdvisoryRef[];
+/**
+ * Picks a stable primary finding id from refs, or a provided fallback.
+ */
+export declare function primaryFindingId(refs: AdvisoryRef[], fallback: string): string;
+/**
+ * Renders refs as markdown hyperlinks, comma-separated.
+ */
+export declare function formatRefsMarkdown(refs: AdvisoryRef[]): string;
+/**
+ * Renders refs as plain text ids, comma-separated (URLs omitted for terminal density).
+ */
+export declare function formatRefsText(refs: AdvisoryRef[]): string;

package/dist/security/refs.js

@@ -0,0 +1,218 @@
+/** Closed set of public vulnerability reference kinds. */
+export const AdvisoryRefKinds = {
+    Cve: "cve",
+    Ghsa: "ghsa",
+    Osv: "osv",
+};
+const GHSA_RE = /\bGHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}\b/i;
+const CVE_RE = /\bCVE-\d{4}-\d+\b/i;
+/** OSV ids mentioned inside free text (word-bounded). */
+const OSV_RE = /\bOSV-[A-Za-z0-9._-]+\b/;
+/** Full-string OSV id used for refs / URL path segments. */
+const OSV_ID_RE = /^OSV-[A-Za-z0-9._-]+$/;
+/**
+ * Encodes a single URL path segment so attacker-controlled ids cannot break
+ * out of the path or inject markdown / HTML into report links.
+ * Extends encodeURIComponent to also percent-encode `()` (not encoded by default,
+ * but they break markdown `[text](url)` links).
+ */
+function encodePathSegment(segment) {
+    return encodeURIComponent(segment)
+        .replace(/\(/g, "%28")
+        .replace(/\)/g, "%29");
+}
+/**
+ * Builds the canonical GitHub Advisory Database URL for a GHSA id.
+ */
+export function urlForGhsa(id) {
+    return `https://github.com/advisories/${encodePathSegment(normalizeGhsa(id))}`;
+}
+/**
+ * Builds the NVD detail URL for a CVE id.
+ */
+export function urlForCve(id) {
+    return `https://nvd.nist.gov/vuln/detail/${encodePathSegment(normalizeCve(id))}`;
+}
+/**
+ * Builds the OSV.dev vulnerability URL for an OSV id.
+ * Path-encodes the id so punctuation cannot break markdown links.
+ */
+export function urlForOsv(id) {
+    return `https://osv.dev/vulnerability/${encodePathSegment(id)}`;
+}
+/**
+ * Normalizes a GHSA id to GHSA-… with lowercase suffix (GitHub canonical form).
+ * Returns the original string when it does not contain a GHSA match.
+ */
+function normalizeGhsa(id) {
+    const match = id.match(GHSA_RE);
+    if (!match) {
+        return id;
+    }
+    return `GHSA-${match[0].slice(5).toLowerCase()}`;
+}
+/**
+ * Normalizes a CVE id to CVE-YYYY-NNNN uppercase form.
+ * Returns the original string when it does not contain a CVE match.
+ */
+function normalizeCve(id) {
+    const match = id.match(CVE_RE);
+    if (!match) {
+        return id;
+    }
+    return match[0].toUpperCase();
+}
+/**
+ * True when the whole string is a canonical GHSA id.
+ */
+function isGhsaId(value) {
+    return /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/i.test(value);
+}
+/**
+ * True when the whole string is a canonical CVE id.
+ */
+function isCveId(value) {
+    return /^CVE-\d{4}-\d+$/i.test(value);
+}
+/**
+ * Creates an AdvisoryRef for a known id string, or undefined when unrecognized.
+ * Only validated id shapes become refs (avoids markdown / URL injection via ids).
+ */
+export function refFromId(raw) {
+    const value = raw.trim();
+    if (!value) {
+        return undefined;
+    }
+    if (isGhsaId(value)) {
+        const id = normalizeGhsa(value);
+        return { id, kind: AdvisoryRefKinds.Ghsa, url: urlForGhsa(id) };
+    }
+    if (isCveId(value)) {
+        const id = normalizeCve(value);
+        return { id, kind: AdvisoryRefKinds.Cve, url: urlForCve(id) };
+    }
+    if (OSV_ID_RE.test(value)) {
+        return { id: value, kind: AdvisoryRefKinds.Osv, url: urlForOsv(value) };
+    }
+    return undefined;
+}
+/**
+ * Extracts GHSA/CVE/OSV ids mentioned in free text or a URL.
+ */
+export function refsFromText(text) {
+    if (!text) {
+        return [];
+    }
+    const found = [];
+    for (const match of text.matchAll(new RegExp(GHSA_RE, "gi"))) {
+        const ref = refFromId(match[0]);
+        if (ref) {
+            found.push(ref);
+        }
+    }
+    for (const match of text.matchAll(new RegExp(CVE_RE, "gi"))) {
+        const ref = refFromId(match[0]);
+        if (ref) {
+            found.push(ref);
+        }
+    }
+    for (const match of text.matchAll(new RegExp(OSV_RE, "g"))) {
+        const ref = refFromId(match[0]);
+        if (ref) {
+            found.push(ref);
+        }
+    }
+    return dedupeRefs(found);
+}
+/**
+ * Collects refs from common scanner field shapes (string, string[], or nested).
+ */
+export function refsFromScannerFields(fields) {
+    const collected = [];
+    for (const value of [
+        fields.id,
+        fields.cve,
+        fields.ghsa,
+        fields.osvId,
+        fields.aliases,
+        fields.url,
+    ]) {
+        for (const item of asStringList(value)) {
+            const direct = refFromId(item);
+            if (direct) {
+                collected.push(direct);
+            }
+            else {
+                collected.push(...refsFromText(item));
+            }
+        }
+    }
+    return dedupeRefs(collected);
+}
+/**
+ * Dedupes refs by id, preserving first-seen order (GHSA/CVE/OSV as discovered).
+ */
+export function dedupeRefs(refs) {
+    const seen = new Set();
+    const out = [];
+    for (const ref of refs) {
+        const key = ref.id.toUpperCase();
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        out.push(ref);
+    }
+    return out;
+}
+/**
+ * Picks a stable primary finding id from refs, or a provided fallback.
+ */
+export function primaryFindingId(refs, fallback) {
+    if (refs.length === 0) {
+        return fallback;
+    }
+    const ghsa = refs.find((ref) => ref.kind === AdvisoryRefKinds.Ghsa);
+    if (ghsa) {
+        return ghsa.id;
+    }
+    const cve = refs.find((ref) => ref.kind === AdvisoryRefKinds.Cve);
+    if (cve) {
+        return cve.id;
+    }
+    return refs[0]?.id ?? fallback;
+}
+/**
+ * Renders refs as markdown hyperlinks, comma-separated.
+ */
+export function formatRefsMarkdown(refs) {
+    if (refs.length === 0) {
+        return "—";
+    }
+    return refs.map((ref) => `[${ref.id}](${ref.url})`).join(", ");
+}
+/**
+ * Renders refs as plain text ids, comma-separated (URLs omitted for terminal density).
+ */
+export function formatRefsText(refs) {
+    if (refs.length === 0) {
+        return "—";
+    }
+    return refs.map((ref) => ref.id).join(", ");
+}
+/**
+ * Flattens unknown scanner values into a list of strings.
+ */
+function asStringList(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (typeof value === "number") {
+        return [String(value)];
+    }
+    if (Array.isArray(value)) {
+        return value.flatMap((item) => asStringList(item));
+    }
+    return [];
+}
+//# sourceMappingURL=refs.js.map

package/dist/security/refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.js","sourceRoot":"","sources":["../../src/security/refs.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;CACF,CAAC;AAaX,MAAM,OAAO,GAAG,+CAA+C,CAAC;AAChE,MAAM,MAAM,GAAG,oBAAoB,CAAC;AACpC,yDAAyD;AACzD,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,4DAA4D;AAC5D,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAE1C;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,kBAAkB,CAAC,OAAO,CAAC;SAC/B,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,OAAO,iCAAiC,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,oCAAoC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,iCAAiC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAwB;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAOrC;IACC,MAAM,SAAS,GAAkB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI;QAClB,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,GAAG;QACV,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,GAAG;KACX,EAAE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAmB,EACnB,QAAgB;IAEhB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,QAAQ,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}