@untangle-code/cli 0.0.0-stage → 0.1.0

package/dist/commands/extensions/provision.js

@@ -0,0 +1,137 @@
+/**
+ * Bereitstellung eines Container-Dienstes aus dem Manifest (extensions.md §6.2).
+ *
+ * Der Ablauf ist bewusst kurz und ohne Werkzeugwissen:
+ *
+ *   Manifest  →  Compose-Datei rendern  →  up  →  Healthcheck des Manifests
+ *
+ * Die Compose-Datei entsteht bei jedem Lauf neu aus dem validierten Manifest.
+ * Damit gilt der gepinnte Digest wirklich, die Ports binden wirklich an
+ * Loopback und die Labels sind wirklich gesetzt — statt in einer mitgebrachten
+ * YAML behauptet zu werden, die Untangle nicht geprueft hat.
+ *
+ * Auf die Gesundheit wartet Untangle SELBST, ueber den Healthcheck aus dem
+ * Manifest, statt einen in den Container zu rendern. Ein Healthcheck im
+ * Container muesste voraussetzen, welches Programm darin liegt, um eine URL
+ * abzufragen — genau das Werkzeugwissen, das X9 aus dem Quelltext heraushaelt.
+ */
+import { dirname, join } from "node:path";
+import { renderComposeFile, } from "@untangle-code/extension-runtime";
+/** Ort der gerenderten Datei: im Nutzer-Datenverzeichnis, nie im Projekt. */
+export function composeFilePath(userDataDirectory, extensionId) {
+    return join(userDataDirectory, "extensions", extensionId, "compose.yaml");
+}
+/** Der erste Hostport des Manifests, mit optionaler Ueberschreibung. */
+export function primaryHostPort(manifest, overrides = {}) {
+    const port = manifest.container?.ports[0];
+    if (port === undefined) {
+        return undefined;
+    }
+    return overrides[port.name] ?? port.hostPortDefault;
+}
+/**
+ * Startet den Dienst, falls noetig, und wartet auf seine Gesundheit.
+ *
+ * Ein bereits laufender, Untangle gehoerender Container wird NICHT neu
+ * gestartet: der Lauf soll den Dienst benutzen, nicht bewirtschaften.
+ */
+export async function provisionContainer(deps, input) {
+    const steps = [];
+    const manifest = input.manifest;
+    const container = manifest.container;
+    if (container === undefined) {
+        const state = {
+            exists: false,
+            running: false,
+            ownedByUntangle: false,
+            detail: "the manifest declares no container block",
+        };
+        return { healthy: false, steps, state, detail: state.detail };
+    }
+    const runtime = await deps.container.available(input.signal === undefined ? {} : { signal: input.signal });
+    steps.push(runtime.detail);
+    if (!runtime.available) {
+        return {
+            healthy: false,
+            steps,
+            state: {
+                exists: false,
+                running: false,
+                ownedByUntangle: false,
+                detail: runtime.detail,
+            },
+            detail: runtime.detail,
+        };
+    }
+    const path = composeFilePath(input.userDataDirectory, manifest.id);
+    const yaml = renderComposeFile({
+        manifest,
+        ...(input.hostPorts === undefined ? {} : { hostPorts: input.hostPorts }),
+        ...(input.workspacePath === undefined ? {} : { workspacePath: input.workspacePath }),
+    });
+    await deps.fs.mkdir(dirname(path), { recursive: true });
+    await deps.fs.writeFile(path, new TextEncoder().encode(yaml));
+    steps.push(`rendered ${path} from the manifest (image pinned to ${container.digest})`);
+    let state = await deps.container.inspect(manifest, input.signal === undefined ? {} : { signal: input.signal });
+    if (state.exists && !state.ownedByUntangle) {
+        steps.push(state.detail);
+        return { healthy: false, steps, state, detail: state.detail };
+    }
+    if (state.running) {
+        steps.push("the container was already running; Untangle did not restart it");
+    }
+    else {
+        const up = await deps.container.up({ manifest, composeFilePath: path }, input.signal === undefined ? {} : { signal: input.signal });
+        steps.push(up.detail);
+        if (!up.ok) {
+            return { healthy: false, steps, state, detail: up.detail };
+        }
+        state = await deps.container.inspect(manifest, input.signal === undefined ? {} : { signal: input.signal });
+    }
+    const health = await waitForHealth(deps, {
+        manifest,
+        ...(input.hostPorts === undefined ? {} : { hostPorts: input.hostPorts }),
+        ...(input.signal === undefined ? {} : { signal: input.signal }),
+    });
+    steps.push(health.detail);
+    return { healthy: health.healthy, steps, state, detail: health.detail };
+}
+/**
+ * Fragt den Healthcheck des Manifests ab, bis er antwortet oder die erklaerten
+ * Versuche erschoepft sind. Ein Dienst, der lange startet, ist kein Fehler —
+ * ein Dienst, der nie antwortet, schon, und dann steht der Grund da.
+ */
+async function waitForHealth(deps, input) {
+    const check = input.manifest.container?.healthcheck;
+    if (check === undefined || check.kind !== "http" || check.httpPath === undefined) {
+        return {
+            healthy: true,
+            detail: "the manifest declares no http healthcheck; Untangle treats the container as ready " +
+                "without probing and says so rather than implying it checked",
+        };
+    }
+    const port = primaryHostPort(input.manifest, input.hostPorts ?? {});
+    if (port === undefined) {
+        return { healthy: false, detail: "the manifest declares a healthcheck but no port" };
+    }
+    const url = `http://127.0.0.1:${String(port)}${check.httpPath}`;
+    let lastDetail = "no probe was made";
+    for (let attempt = 1; attempt <= check.retries; attempt += 1) {
+        const response = await deps.httpRunner.request({ url, method: "GET" }, { ...deps.limits, timeoutMs: check.timeoutMs }, input.signal === undefined ? {} : { signal: input.signal });
+        if (response.outcome === "completed" && (response.status ?? 500) < 400) {
+            return {
+                healthy: true,
+                detail: `healthcheck ${url} answered ${String(response.status)} after ${String(attempt)} attempt(s)`,
+            };
+        }
+        lastDetail = `attempt ${String(attempt)}: ${response.outcome}${response.status === undefined ? "" : ` (status ${String(response.status)})`}`;
+        if (attempt < check.retries) {
+            await deps.wait(check.intervalMs, input.signal);
+        }
+    }
+    return {
+        healthy: false,
+        detail: `healthcheck ${url} did not answer within ${String(check.retries)} attempts — ${lastDetail}`,
+    };
+}
+//# sourceMappingURL=provision.js.map

package/dist/commands/extensions/provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../../src/commands/extensions/provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EACL,iBAAiB,GAKlB,MAAM,kCAAkC,CAAC;AAE1C,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,iBAAyB,EAAE,WAAmB;IAC5E,OAAO,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,QAA6B,EAC7B,YAA8C,EAAE;IAEhD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC;AACtD,CAAC;AAoBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmB,EACnB,KAMC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAqB;YAC9B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,0CAA0C;SACnD,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAC5C,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAC3D,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK;YACL,KAAK,EAAE;gBACL,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,KAAK;gBACd,eAAe,EAAE,KAAK;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,iBAAiB,CAAC;QAC7B,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,uCAAuC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvF,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CACtC,QAAQ,EACR,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAC3D,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAChC,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,EACnC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAC3D,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC7D,CAAC;QACD,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAClC,QAAQ,EACR,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE;QACvC,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAmB,EACnB,KAIC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EACJ,oFAAoF;gBACpF,6DAA6D;SAChE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,oBAAoB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAChE,IAAI,UAAU,GAAG,mBAAmB,CAAC;IACrC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAC5C,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EACtB,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAC9C,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAC3D,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;YACvE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,eAAe,GAAG,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,aAAa;aACrG,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,WAAW,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,OAAO,GAC1D,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAC1E,EAAE,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,eAAe,GAAG,0BAA0B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,UAAU,EAAE;KACrG,CAAC;AACJ,CAAC"}

package/dist/commands/extensions/remove.d.ts

@@ -0,0 +1,5 @@
+import { type ParsedArgs } from "../../cli/args.js";
+import { type Io } from "../../cli/io.js";
+import { type ExtensionEnvironmentV1 } from "./environment.js";
+export declare function runRemove(environment: ExtensionEnvironmentV1, args: ParsedArgs, io: Io, format: "text" | "json"): Promise<number>;
+//# sourceMappingURL=remove.d.ts.map

package/dist/commands/extensions/remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.d.ts","sourceRoot":"","sources":["../../../src/commands/extensions/remove.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAY,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAc,KAAK,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAIhF,wBAAsB,SAAS,CAC7B,WAAW,EAAE,sBAAsB,EACnC,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CA6EjB"}

package/dist/commands/extensions/remove.js

@@ -0,0 +1,77 @@
+/**
+ * `untangle extensions remove <id>`
+ *
+ * Deletes one installed extension directory from the user's extension root.
+ *
+ * Two guards. The directory must lie inside a resolved extension root — the
+ * command deletes recursively, and a recursive delete driven by an id from
+ * the command line has to prove where it is pointing. And it must not lie
+ * inside a project directory, which would mean the boundary was crossed
+ * earlier and deleting is not the right repair.
+ *
+ * The license acknowledgment is kept by default. It is a personal declaration
+ * about a tool's terms, not a property of the installed file, and
+ * re-installing the same tool should not quietly need a fresh one. Dropping
+ * it is `--revoke-license`, what extensions.md §9.3 calls revocation.
+ */
+import { dirname } from "node:path";
+import { boolFlag } from "../../cli/args.js";
+import { EXIT, OperationalError, UsageError } from "../../cli/exit.js";
+import { line, note } from "../../cli/io.js";
+import { explainMissing, findExtension, loadExtensionContext } from "./context.js";
+import { isInsideAnyRoot } from "./environment.js";
+import { emitJson } from "./render.js";
+import { removeAcknowledgments, saveAcknowledgments, saveCliState } from "./state.js";
+export async function runRemove(environment, args, io, format) {
+    const extensionId = args.positionals[1];
+    if (extensionId === undefined) {
+        throw new UsageError("`untangle extensions remove` needs an extension id.", "Run `untangle extensions list` to see the installed ids.");
+    }
+    const context = await loadExtensionContext(environment);
+    const extension = findExtension(context, extensionId);
+    if (extension === null) {
+        throw new OperationalError(explainMissing(context, extensionId), "Run `untangle extensions list` to see what is installed and why something was rejected.");
+    }
+    const directory = dirname(extension.manifestPath);
+    if (!isInsideAnyRoot(directory, environment.roots)) {
+        throw new OperationalError(`Refusing to delete "${directory}": it is not inside a resolved extension root ` +
+            `(${environment.roots.join(", ")}).`, "Delete the directory yourself if that is really what you want.");
+    }
+    if (isInsideAnyRoot(directory, environment.projectRoots)) {
+        throw new OperationalError(`Refusing to delete "${directory}": it lies inside a project directory.`, "Extensions are user-profile artifacts; remove this one with your own tools.");
+    }
+    await environment.fs.remove(directory, { recursive: true });
+    const statePath = await saveCliState(environment.fs, environment.userDataDir, {
+        ...context.state,
+        enabled: context.state.enabled.filter((id) => id !== extensionId),
+        lastRuns: Object.fromEntries(Object.entries(context.state.lastRuns).filter(([id]) => id !== extensionId)),
+    });
+    let acknowledgmentFile;
+    const revoked = boolFlag(args, "revoke-license");
+    if (revoked) {
+        acknowledgmentFile = await saveAcknowledgments(environment.fs, environment.userDataDir, removeAcknowledgments(context.acknowledgments, extensionId));
+    }
+    if (format === "json") {
+        emitJson(io, {
+            command: "extensions remove",
+            extensionId,
+            removedDirectory: directory,
+            stateFile: statePath,
+            licenseAcknowledgment: revoked ? "revoked" : "kept",
+            acknowledgmentFile,
+            warnings: context.warnings,
+        });
+    }
+    else {
+        line(io, `removed "${extensionId}"`);
+        line(io, `  directory   ${directory}`);
+        line(io, revoked
+            ? `  license     acknowledgment revoked in ${String(acknowledgmentFile)}`
+            : "  license     acknowledgment kept (use --revoke-license to drop it)");
+    }
+    for (const warning of context.warnings) {
+        note(io, `warning: ${warning}`);
+    }
+    return EXIT.ok;
+}
+//# sourceMappingURL=remove.js.map

package/dist/commands/extensions/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../src/commands/extensions/remove.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAmB,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAW,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,eAAe,EAA+B,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAmC,EACnC,IAAgB,EAChB,EAAM,EACN,MAAuB;IAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAClB,qDAAqD,EACrD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CACxB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,EACpC,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,gBAAgB,CACxB,uBAAuB,SAAS,gDAAgD;YAC9E,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EACtC,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,gBAAgB,CACxB,uBAAuB,SAAS,wCAAwC,EACxE,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,WAAW,EAAE;QAC5E,GAAG,OAAO,CAAC,KAAK;QAChB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,CAC5E;KACF,CAAC,CAAC;IAEH,IAAI,kBAAsC,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,GAAG,MAAM,mBAAmB,CAC5C,WAAW,CAAC,EAAE,EACd,WAAW,CAAC,WAAW,EACvB,qBAAqB,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,EAAE,EAAE;YACX,OAAO,EAAE,mBAAmB;YAC5B,WAAW;YACX,gBAAgB,EAAE,SAAS;YAC3B,SAAS,EAAE,SAAS;YACpB,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACnD,kBAAkB;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,EAAE,EAAE,YAAY,WAAW,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,EAAE,iBAAiB,SAAS,EAAE,CAAC,CAAC;QACvC,IAAI,CACF,EAAE,EACF,OAAO;YACL,CAAC,CAAC,2CAA2C,MAAM,CAAC,kBAAkB,CAAC,EAAE;YACzE,CAAC,CAAC,qEAAqE,CAC1E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}

package/dist/commands/extensions/render.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The two output shapes the extension commands share.
+ *
+ * Payload goes to stdout, everything else to stderr (see `cli/io.ts`), so
+ * `--format=json | jq` stays usable while warnings remain visible.
+ */
+import { type Io } from "../../cli/io.js";
+/** Writes one JSON document to stdout. */
+export declare function emitJson(io: Io, value: unknown): void;
+/**
+ * Renders a table padded to the widest cell per column. Padding counts code
+ * units, which is what a fixed-width terminal measures for the ASCII
+ * identifiers, SPDX ids and paths shown here.
+ */
+export declare function renderTable(header: readonly string[], rows: readonly (readonly string[])[]): string[];
+//# sourceMappingURL=render.d.ts.map

package/dist/commands/extensions/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../src/commands/extensions/render.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAQ,KAAK,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAEhD,0CAA0C;AAC1C,wBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAErD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,IAAI,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GACnC,MAAM,EAAE,CAUV"}

package/dist/commands/extensions/render.js

@@ -0,0 +1,25 @@
+/**
+ * The two output shapes the extension commands share.
+ *
+ * Payload goes to stdout, everything else to stderr (see `cli/io.ts`), so
+ * `--format=json | jq` stays usable while warnings remain visible.
+ */
+import { line } from "../../cli/io.js";
+/** Writes one JSON document to stdout. */
+export function emitJson(io, value) {
+    line(io, JSON.stringify(value, null, 2));
+}
+/**
+ * Renders a table padded to the widest cell per column. Padding counts code
+ * units, which is what a fixed-width terminal measures for the ASCII
+ * identifiers, SPDX ids and paths shown here.
+ */
+export function renderTable(header, rows) {
+    const widths = header.map((cell, column) => rows.reduce((widest, row) => Math.max(widest, (row[column] ?? "").length), cell.length));
+    const render = (cells) => cells
+        .map((cell, column) => cell.padEnd(widths[column] ?? 0))
+        .join("  ")
+        .trimEnd();
+    return [render(header), render(widths.map((width) => "-".repeat(width))), ...rows.map(render)];
+}
+//# sourceMappingURL=render.js.map

package/dist/commands/extensions/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../../src/commands/extensions/render.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAW,MAAM,iBAAiB,CAAC;AAEhD,0CAA0C;AAC1C,MAAM,UAAU,QAAQ,CAAC,EAAM,EAAE,KAAc;IAC7C,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,MAAyB,EACzB,IAAoC;IAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CACzC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CACxF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAwB,EAAU,EAAE,CAClD,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SACvD,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,EAAE,CAAC;IACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACjG,CAAC"}

package/dist/commands/extensions/run.d.ts

@@ -0,0 +1,30 @@
+import { type FileResolutionV1 } from "@untangle-code/extension-runtime";
+import { type ParsedArgs } from "../../cli/args.js";
+import { type Io } from "../../cli/io.js";
+import { type ExtensionEnvironmentV1 } from "./environment.js";
+export interface RunDeps {
+    /** Injected in tests so no unit test opens a socket. */
+    fetchImpl?: typeof fetch;
+    signal?: AbortSignal;
+}
+export declare function runRun(environment: ExtensionEnvironmentV1, args: ParsedArgs, io: Io, format: "text" | "json", deps?: RunDeps): Promise<number>;
+/**
+ * Maps a tool-reported path onto workspace-relative form.
+ *
+ * `fileId` is deliberately absent with a stated reason: this command runs
+ * against the working tree, not an index generation, so there is no file
+ * identity to attach. Inventing one would make a finding look joined to an
+ * index that never saw it.
+ */
+export declare function workspaceFileResolver(workspacePath: string): (toolPath: string) => FileResolutionV1;
+/**
+ * A `ReadonlyMap` view over the working tree that reads a file the first time
+ * a position inside it must be resolved.
+ *
+ * Reading the whole workspace eagerly to translate a handful of line numbers
+ * would be the wrong trade. A failed read is cached as "absent", which makes
+ * the position unresolvable — and therefore a ledger entry rather than a
+ * guess (E4).
+ */
+export declare function lazyWorkspaceContents(workspacePath: string): ReadonlyMap<string, string>;
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/extensions/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/extensions/run.ts"],"names":[],"mappings":"AAwBA,OAAO,EAML,KAAK,gBAAgB,EAEtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAc,KAAK,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAKhF,MAAM,WAAW,OAAO;IACtB,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,wBAAsB,MAAM,CAC1B,WAAW,EAAE,sBAAsB,EACnC,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,IAAI,GAAE,OAAY,GACjB,OAAO,CAAC,MAAM,CAAC,CA+GjB;AAqBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,GACpB,CAAC,QAAQ,EAAE,MAAM,KAAK,gBAAgB,CAuBxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBxF"}

package/dist/commands/extensions/run.js

@@ -0,0 +1,292 @@
+/**
+ * `untangle extensions run <id>`
+ *
+ * Runs one installed extension and normalizes whatever it prints into
+ * `ExternalFindingV1` (X3). The order of the checks is the load-bearing part:
+ *
+ *   license gate  →  availability probe  →  run  →  parse  →  normalize
+ *
+ * The gate comes first because a version probe is already a process start,
+ * and X5 forbids starting or pulling anything for a tool whose terms have not
+ * been acknowledged. Checking availability first and the license second would
+ * produce the same refusal — after having run the tool once.
+ *
+ * What comes out is evidence, never an Untangle metric: findings do not
+ * change the exit code, and no number here is ever folded into a complexity
+ * or risk value (X3). Everything the run could not resolve — a file outside
+ * the workspace, a position that does not exist, a severity that hit the
+ * mapping fallback — is reported with its reason rather than dropped (E4).
+ */
+import { readFileSync } from "node:fs";
+import { relative, resolve } from "node:path";
+import { compareCodepoints } from "@untangle-code/domain";
+import { createLineOffsetResolver, defaultProcessLimits, normalizeToolPath, } from "@untangle-code/extension-runtime";
+import { boolFlag, integerFlag, stringFlag } from "../../cli/args.js";
+import { EXIT, EnvironmentError, OperationalError, UsageError } from "../../cli/exit.js";
+import { line, note } from "../../cli/io.js";
+import { explainMissing, findExtension, gateFor, loadExtensionContext } from "./context.js";
+import { resolveUserPath } from "./environment.js";
+import { invokeExtension } from "./invoke.js";
+import { emitJson, renderTable } from "./render.js";
+import { saveCliState, summarizeRun } from "./state.js";
+export async function runRun(environment, args, io, format, deps = {}) {
+    const command = args.positionals[0] === "setup" ? "extensions setup" : "extensions run";
+    const extensionId = args.positionals[1];
+    if (extensionId === undefined) {
+        throw new UsageError(`\`untangle ${command}\` needs an extension id.`, "Run `untangle extensions list` to see the installed ids.");
+    }
+    const context = await loadExtensionContext(environment);
+    const extension = findExtension(context, extensionId);
+    if (extension === null) {
+        throw new OperationalError(explainMissing(context, extensionId), "Install it first: untangle extensions add --from=<path-or-url>");
+    }
+    const manifest = extension.manifest;
+    const workspacePath = resolveUserPath(environment.cwd, stringFlag(args, "workspace") ?? ".");
+    const target = resolveUserPath(environment.cwd, stringFlag(args, "target") ?? workspacePath);
+    const ruleset = stringFlag(args, "ruleset") ?? manifest.defaultRuleset;
+    // --- license gate BEFORE any process start (X5) -------------------------
+    const gate = gateFor(context, extension, ruleset);
+    if (!gate.allowed) {
+        note(io, `EXTENSION_LICENSE_UNACKNOWLEDGED: ${extensionId} did not start.`);
+        note(io, `  ${gate.tool.reason}`);
+        for (const entry of gate.rulesets) {
+            if (entry.status !== "acknowledged" && entry.status !== "not_required") {
+                note(io, `  ruleset ${entry.ruleset}: ${entry.reason}`);
+            }
+        }
+        throw new EnvironmentError(`The license gate for "${extensionId}" is not satisfied; nothing was started and nothing was pulled.`, gate.acknowledgeCommands.join(" && "));
+    }
+    // Der eigentliche Lauf liegt in `invoke.ts` — als Daten hinein, als Ergebnis
+    // heraus. `runRun` ist die MENSCHLICHE Fassung davon: es uebersetzt einen
+    // nicht stattgefundenen Lauf in die Ausnahme, die ein einzelner Aufruf
+    // erwartet, und berichtet danach. Ein Sammelbericht ruft dieselbe Funktion
+    // auf und uebersetzt eben NICHT in eine Ausnahme.
+    const limits = readLimits(args);
+    const httpUrl = stringFlag(args, "url") ?? manifest.http?.defaultUrl;
+    const outcome = await invokeExtension({
+        environment,
+        context,
+        extension,
+        workspacePath,
+        target,
+        limits,
+        provisionConsent: boolFlag(args, "yes"),
+        ...(ruleset === undefined ? {} : { ruleset }),
+        ...(httpUrl === undefined ? {} : { httpUrl }),
+        ...(deps.fetchImpl === undefined ? {} : { fetchImpl: deps.fetchImpl }),
+        ...(deps.signal === undefined ? {} : { signal: deps.signal }),
+        onProvisionStep: (step) => {
+            note(io, `  ${step}`);
+        },
+        onProvisionPlanned: (detail) => {
+            note(io, `  ${detail}`);
+        },
+        resolveFile: workspaceFileResolver(workspacePath),
+        resolvePosition: createLineOffsetResolver(lazyWorkspaceContents(workspacePath)),
+    });
+    if (outcome.status === "not_run") {
+        note(io, `${extensionId} did not run: ${outcome.detail}`);
+        if (outcome.reason === "license_gate_open") {
+            throw new EnvironmentError(`The license gate for "${extensionId}" is not satisfied; nothing was started and nothing was pulled.`, outcome.nextStep ?? "acknowledge the licence first");
+        }
+        throw new EnvironmentError(`"${extensionId}" did not run (${outcome.reason}).`, outcome.nextStep ?? "see the reason above");
+    }
+    const { health, result } = outcome;
+    await saveCliState(environment.fs, environment.userDataDir, {
+        ...context.state,
+        lastRuns: {
+            ...context.state.lastRuns,
+            [extensionId]: summarizeRun(result.run),
+        },
+    });
+    report(io, format, {
+        command,
+        extensionId,
+        workspacePath,
+        target,
+        health,
+        result,
+        warnings: context.warnings,
+    });
+    if (result.run.exitStatus === "completed") {
+        return EXIT.ok;
+    }
+    throw new OperationalError(`"${extensionId}" ended with status ${result.run.exitStatus}` +
+        `${result.run.errorCode === undefined ? "" : ` (${result.run.errorCode})`}.`, describeNextStep(health, result));
+}
+function readLimits(args) {
+    const limits = defaultProcessLimits();
+    const timeout = integerFlag(args, "timeout", limits.timeoutMs);
+    const maxOutput = integerFlag(args, "max-output-bytes", limits.maxOutputBytes);
+    if (timeout <= 0) {
+        throw new UsageError("--timeout expects a positive number of milliseconds.", "Example: --timeout=60000");
+    }
+    if (maxOutput <= 0) {
+        throw new UsageError("--max-output-bytes expects a positive byte count.", "Example: --max-output-bytes=1048576");
+    }
+    return { ...limits, timeoutMs: timeout, maxOutputBytes: maxOutput };
+}
+/**
+ * Maps a tool-reported path onto workspace-relative form.
+ *
+ * `fileId` is deliberately absent with a stated reason: this command runs
+ * against the working tree, not an index generation, so there is no file
+ * identity to attach. Inventing one would make a finding look joined to an
+ * index that never saw it.
+ */
+export function workspaceFileResolver(workspacePath) {
+    return (toolPath) => {
+        const normalized = normalizeToolPath(toolPath);
+        if (normalized === "") {
+            return { fileIdMissingReason: "the tool reported an empty path" };
+        }
+        const absolute = /^([a-zA-Z]:\/|\/)/.test(normalized)
+            ? normalized
+            : resolve(workspacePath, normalized);
+        const relativePath = relative(workspacePath, absolute).split("\\").join("/");
+        if (relativePath === "" || relativePath.startsWith("../")) {
+            return {
+                fileIdMissingReason: `the tool reported "${toolPath}", which is outside the analyzed workspace ` +
+                    `"${workspacePath}"`,
+            };
+        }
+        return {
+            relativePath,
+            fileIdMissingReason: "no index generation is loaded; this run resolves paths against the working tree only",
+        };
+    };
+}
+/**
+ * A `ReadonlyMap` view over the working tree that reads a file the first time
+ * a position inside it must be resolved.
+ *
+ * Reading the whole workspace eagerly to translate a handful of line numbers
+ * would be the wrong trade. A failed read is cached as "absent", which makes
+ * the position unresolvable — and therefore a ledger entry rather than a
+ * guess (E4).
+ */
+export function lazyWorkspaceContents(workspacePath) {
+    const cache = new Map();
+    const load = (relativePath) => {
+        if (cache.has(relativePath)) {
+            return cache.get(relativePath) ?? null;
+        }
+        let content;
+        try {
+            content = readFileSync(resolve(workspacePath, relativePath), "utf8");
+        }
+        catch {
+            content = null;
+        }
+        cache.set(relativePath, content);
+        return content;
+    };
+    return Object.assign(new Map(), {
+        get(key) {
+            return load(key) ?? undefined;
+        },
+        has(key) {
+            return load(key) !== null;
+        },
+    });
+}
+function report(io, format, input) {
+    const { result } = input;
+    if (format === "json") {
+        emitJson(io, {
+            command: input.command,
+            extensionId: input.extensionId,
+            workspace: input.workspacePath,
+            target: input.target,
+            evidenceOnly: true,
+            health: input.health,
+            run: result.run,
+            findings: result.findings,
+            measurements: result.measurements,
+            skipped: result.skipped,
+            error: result.error === undefined ? undefined : { message: result.error.message },
+            warnings: input.warnings,
+        });
+    }
+    else {
+        line(io, `run ${result.run.runId} — ${input.extensionId} (${result.run.exitStatus})`);
+        line(io, `  invocation  ${result.run.invocation ?? "(none)"}`);
+        line(io, `  tool        ${result.run.toolVersion}`);
+        line(io, `  format      ${result.run.outputFormat} via ${result.run.formatParserVersion}`);
+        line(io, `  target      ${input.target}`);
+        line(io, `  wall time   ${String(result.run.resources.wallTimeMs)} ms`);
+        line(io, `  findings    ${String(result.run.findingsTotal)} (${describeCounts(result.run.findingCounts)})`);
+        if (result.findings.length > 0) {
+            line(io, "");
+            const rows = [...result.findings]
+                .sort((left, right) => compareCodepoints(left.filePath, right.filePath) ||
+                left.sourceRange.startByte - right.sourceRange.startByte ||
+                compareCodepoints(left.ruleId, right.ruleId))
+                .map((finding) => [
+                finding.severity.normalized,
+                `${finding.filePath}:${String(finding.sourceRange.startLine ?? 0)}`,
+                finding.ruleId,
+                firstLine(finding.message),
+            ]);
+            for (const rendered of renderTable(["SEVERITY", "LOCATION", "RULE", "MESSAGE"], rows)) {
+                line(io, rendered);
+            }
+            line(io, "");
+            line(io, "These are external findings — evidence from a third-party tool. They are never folded " +
+                "into Untangle complexity or risk numbers (X3).");
+        }
+    }
+    reportUnmappedSeverities(io, result.findings);
+    for (const entry of result.skipped) {
+        note(io, `skipped ${describeSkip(entry)}`);
+    }
+    for (const warning of result.run.warnings) {
+        note(io, `warning: ${warning}`);
+    }
+    for (const warning of input.warnings) {
+        note(io, `warning: ${warning}`);
+    }
+    for (const error of result.run.errors) {
+        note(io, `${error.code}: ${error.message}`);
+    }
+    if (result.run.exitStatus !== "completed") {
+        for (const reason of input.health.unavailableReasons) {
+            note(io, `  ${reason.invocation}: ${reason.detail}`);
+        }
+    }
+}
+function describeNextStep(health, result) {
+    if (!health.available) {
+        const first = health.unavailableReasons[0];
+        return first === undefined
+            ? "Check the manifest's invocation section against what is installed on this machine."
+            : `Make the ${first.invocation} invocation work: ${first.detail}`;
+    }
+    return result.error === undefined
+        ? "Re-run with --format=json to see the full run record."
+        : result.error.message;
+}
+function reportUnmappedSeverities(io, findings) {
+    const unmapped = findings.filter((finding) => !finding.severity.mappingMatched);
+    if (unmapped.length === 0) {
+        return;
+    }
+    const originals = [...new Set(unmapped.map((finding) => finding.severity.original))].sort(compareCodepoints);
+    note(io, `warning: ${String(unmapped.length)} finding(s) hit the severity fallback; the manifest maps ` +
+        `no rule for: ${originals.join(", ")}`);
+}
+function describeCounts(counts) {
+    const parts = Object.entries(counts)
+        .filter(([, value]) => value > 0)
+        .map(([key, value]) => `${key} ${String(value)}`);
+    return parts.length === 0 ? "none" : parts.join(", ");
+}
+function describeSkip(entry) {
+    const where = entry.path === undefined ? entry.subjectKind : `${entry.subjectKind} ${entry.path}`;
+    return `${where}: ${entry.reason} — ${entry.detail}`;
+}
+function firstLine(message) {
+    const text = message.split("\n")[0] ?? "";
+    return text.length > 96 ? `${text.slice(0, 93)}...` : text;
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/extensions/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/commands/extensions/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,GAKlB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAmB,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAW,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,eAAe,EAA+B,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQxD,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,WAAmC,EACnC,IAAgB,EAChB,EAAM,EACN,MAAuB,EACvB,OAAgB,EAAE;IAElB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACxF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAClB,cAAc,OAAO,2BAA2B,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CACxB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,EACpC,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IAEpC,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,aAAa,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,QAAQ,CAAC,cAAc,CAAC;IAEvE,2EAA2E;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,EAAE,qCAAqC,WAAW,iBAAiB,CAAC,CAAC;QAC5E,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACvE,IAAI,CAAC,EAAE,EAAE,aAAa,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,yBAAyB,WAAW,iEAAiE,EACrG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CACtC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,WAAW;QACX,OAAO;QACP,SAAS;QACT,aAAa;QACb,MAAM;QACN,MAAM;QACN,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACvC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7D,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACxB,CAAC;QACD,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE;YAC7B,IAAI,CAAC,EAAE,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,WAAW,EAAE,qBAAqB,CAAC,aAAa,CAAC;QACjD,eAAe,EAAE,wBAAwB,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;KAChF,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,EAAE,EAAE,GAAG,WAAW,iBAAiB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,yBAAyB,WAAW,iEAAiE,EACrG,OAAO,CAAC,QAAQ,IAAI,+BAA+B,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,IAAI,WAAW,kBAAkB,OAAO,CAAC,MAAM,IAAI,EACnD,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAEnC,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,WAAW,EAAE;QAC1D,GAAG,OAAO,CAAC,KAAK;QAChB,QAAQ,EAAE;YACR,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ;YACzB,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC;SACxC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE;QACjB,OAAO;QACP,WAAW;QACX,aAAa;QACb,MAAM;QACN,MAAM;QACN,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,gBAAgB,CACxB,IAAI,WAAW,uBAAuB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE;QAC3D,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,EAC9E,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB;IAClC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/E,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,UAAU,CAClB,sDAAsD,EACtD,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqB;IAErB,OAAO,CAAC,QAAgB,EAAoB,EAAE;QAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACtB,OAAO,EAAE,mBAAmB,EAAE,iCAAiC,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;YACnD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7E,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,mBAAmB,EACjB,sBAAsB,QAAQ,6CAA6C;oBAC3E,IAAI,aAAa,GAAG;aACvB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,YAAY;YACZ,mBAAmB,EACjB,sFAAsF;SACzF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,YAAoB,EAAiB,EAAE;QACnD,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QACzC,CAAC;QACD,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,EAAkB,EAAE;QAC9C,GAAG,CAAC,GAAW;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QAChC,CAAC;QACD,GAAG,CAAC,GAAW;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;QAC5B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAYD,SAAS,MAAM,CAAC,EAAM,EAAE,MAAuB,EAAE,KAAkB;IACjE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,EAAE,EAAE;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;YACjF,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,EAAE,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;QACtF,IAAI,CAAC,EAAE,EAAE,iBAAiB,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE,EAAE,iBAAiB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,EAAE,iBAAiB,MAAM,CAAC,GAAG,CAAC,YAAY,QAAQ,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,EAAE,EAAE,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,EAAE,iBAAiB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CACF,EAAE,EACF,iBAAiB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAClG,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;iBAC9B,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;gBAChD,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS;gBACxD,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAC/C;iBACA,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAC3B,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE;gBACnE,OAAO,CAAC,MAAM;gBACd,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;aAC3B,CAAC,CAAC;YACL,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;gBACtF,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACrB,CAAC;YACD,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACb,IAAI,CACF,EAAE,EACF,wFAAwF;gBACtF,gDAAgD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,EAAE,WAAW,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,CAAC,EAAE,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACrD,IAAI,CAAC,EAAE,EAAE,KAAK,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB,EAAE,MAA4B;IAC/E,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,YAAY,KAAK,CAAC,UAAU,qBAAqB,KAAK,CAAC,MAAM,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS;QAC/B,CAAC,CAAC,uDAAuD;QACzD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3B,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAM,EAAE,QAAsC;IAC9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CACvF,iBAAiB,CAClB,CAAC;IACF,IAAI,CACF,EAAE,EACF,YAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,2DAA2D;QAC5F,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAwC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;IAClG,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC"}