@vyuhlabs/dxkit 2.4.4 → 2.4.5

package/CHANGELOG.md

@@ -7,6 +7,208 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.5] - 2026-04-29
+
+### Fixed (high-severity, discovered during 2.4.5 pre-ship regression)
+
+- **`osv-scanner fix` was THREE bugs in one** (5-month-old bug shipped
+  since 2.4.0 / Phase 10h.6). osv-scanner v2's `fix` subcommand invokes
+  `npm install` internally to compute upgrade patches. dxkit was
+  invoking it in the user's project cwd, which caused all three of the
+  following:
+
+  1. **Data mutation** — `npm install` wipes / reinstalls the cwd's
+     `node_modules` (often with `--legacy-peer-deps` fallback when
+     peer-deps don't resolve cleanly). Visible to users running
+     back-to-back commands: `dxkit vulnerabilities` followed by `npm
+     test` or any other step depending on stable `node_modules` would
+     fail cryptically. Discovered when dxkit-on-dxkit crashed mid-run
+     with `Cannot find module 'hosted-git-info'`.
+
+  2. **Process orphan leak** — osv-scanner's `npm install` grandchildren
+     outlived dxkit's 120s `execSync` budget. `execSync(..., {timeout})`
+     SIGTERMs only the immediate child; npm install + its node-package
+     subprocesses orphaned to PID 1 and kept eating CPU/memory until
+     they finished or the shell exited. Each `dxkit vulnerabilities`
+     invocation could leak 1-3 orphans; in CI this polluted subsequent
+     steps.
+
+  3. **Silent BoM under-reporting** — when osv-scanner's npm install
+     left a partially-broken `node_modules` (peer-dep mismatches that
+     `--legacy-peer-deps` couldn't fully resolve), dxkit's BoM
+     aggregator subsequently couldn't enumerate the affected
+     dependencies. Root-project deps got silently dropped from the
+     BoM. On dxkit-on-dxkit comparison, 2.4.4 reported only 7 BoM
+     entries (sub-fixture deps) vs 2.4.5's 24 (sub-fixtures + dxkit's
+     own 17 root deps including `hosted-git-info`, `eslint`,
+     `typescript`, etc.). `unfilteredTotalPackages` 22 → 353. The
+     analyzed project's own deps were missing from BoM whenever the
+     bug hit. Most repos that resolve peer-deps cleanly under
+     `--legacy-peer-deps` weren't affected (vyuhlabs-platform's BoM
+     stayed correct at 145 packages); repos with subtle peer-dep
+     issues silently lost root-dep enumeration.
+
+  **Fix** (split across 10k.1.5b and 10k.1.5c):
+
+  - **Temp-dir isolation (10k.1.5b)**: stage `package.json` +
+    `package-lock.json` in a fresh temp dir before invoking osv-scanner,
+    discard the temp dir after parsing JSON output. Project's tree is
+    now read-only treatment (the contract dxkit's analyzers always
+    claimed). Stops bug #1 (mutation) and #3 (BoM under-reporting,
+    since `node_modules` no longer gets clobbered).
+
+  - **Process-group SIGKILL on timeout (10k.1.5c)**: new
+    `runDetached(cmd, args, opts)` helper in `src/analyzers/tools/runner.ts`
+    spawns the child in its own process group via
+    `spawn({ detached: true })` and `process.kill(-pid, 'SIGKILL')` on
+    timeout — kills grandchildren atomically. Stops bug #2 (orphan
+    leak). Reusable for any future tool that may fork grandchildren
+    (PMD's JVM, mvn, gradle).
+
+  Regression tests added: `test/osv-scanner-fix.test.ts` for the
+  isolation contract; `test/runner.test.ts` for the process-group
+  group-kill semantics (sleep-30-grandchild + 200ms timeout asserts
+  elapsed < 2s — would block 30s if process-group regressed). Caught
+  by the discipline the user pushed for: "never ship broken;
+  understand the root cause and fix properly". The discipline was
+  validated end-to-end — the same scan that found bug #1 also
+  surfaced #2 and #3 once we knew where to look.
+
+  **Forensic evidence preserved** at
+  `tmp/regression/2.4.4/dxkit/bom.json` (gitignored — 2.4.4 baseline
+  with under-reported BoM) vs `tmp/regression/2.4.5-fixed/dxkit/bom.json`
+  (full enumeration after the fix).
+
+
+
+Phase 10k.1 — Java language pack (recipe stress test #1, JVM-cousin
+shape). 7th language pack lands the cross-ecosystem matrix at
+**8 active language packs** including Java with full capability
+coverage. Recipe v3 makes substantial progress (G2 + G5 + G9
+delivered; G1 partial; G4/G6/G7 deferred). D008 + D011 + a vitest
+hookTimeout flake closed in pre-flight commits.
+
+No breaking changes for end users. New depVulns/lint/coverage/
+imports/testFramework data on Java/Maven projects; existing analyzer
+commands produce identical output for non-Java projects.
+
+### Added
+
+- **Java language pack** (Phase 10k.1) with five capability providers:
+  - **depVulns** via `osv-scanner` against `pom.xml` /
+    `gradle.lockfile` / `gradle/verification-metadata.xml`.
+    Implementation lives in the new shared
+    `src/analyzers/tools/osv-scanner-maven.ts` module that both
+    kotlin and java packs delegate to (CLAUDE.md rule #2 SSOT).
+  - **lint** via PMD 7.x with `rulesets/java/quickstart.xml`.
+    `parsePmdOutput` tiers PMD's 1-5 priority into dxkit's
+    critical/high/medium/low scheme via `mapPmdRuleSeverity`.
+    Real-fixture-driven parser tests against captured PMD 7.24.0
+    output at `test/fixtures/raw/java/pmd-output.json`.
+  - **coverage** via JaCoCo XML — reuses the kotlin pack's parser
+    unchanged (the parser was source-language-agnostic from day 1
+    and is now hosted in `src/analyzers/tools/jacoco.ts`). Path
+    candidates extended for Maven (`target/site/jacoco/jacoco.xml`,
+    `target/site/jacoco-aggregate/jacoco.xml`) alongside the existing
+    Gradle paths.
+  - **imports** via regex extraction over `import [static]
+    <fqn>(.<Class>|.*)?;` after stripping line + block comments.
+    Best-effort resolution (matches kotlin/rust pack semantics —
+    Java package paths don't 1:1 map to filesystem paths in all
+    build layouts).
+  - **testFramework** via build-file substring scan of pom.xml +
+    build.gradle{,.kts} for canonical artifact names. Order honors
+    mixed-state migration: junit-jupiter > spock > testng > junit4.
+- **PMD (`pmd`) in TOOL_DEFS**. PMD 7.x as the canonical Java linter,
+  with brew on macOS / GitHub releases zip on Linux / scoop on
+  Windows. CI install step added.
+- **Java cross-ecosystem benchmark fixture**
+  (`test/fixtures/benchmarks/java/`) — five files (Secrets.java with
+  fake AWS key, BadLint.java with PMD violations, Duplications.java
+  with jscpd clone pair, UntestedModule.java for filename-match
+  test-gap, pom.xml with `commons-collections:3.2.1` for the original
+  "Mad Gadget" CVE-2015-7501 deserialization advisory + log4j-core
+  for Log4Shell). Matrix wins on all four dimensions (secret/dup/
+  test-gaps run unconditionally; lint matrix activates with
+  `requires: 'pmd'`).
+- **`scripts/check-docs-coverage.sh` (Recipe v3 / G5).** Pre-commit +
+  CI gate that asserts every `LanguageId` in `src/languages/index.ts`
+  appears in canonical doc anchors (CLAUDE.md path glob; README.md
+  ecosystem coverage table row count + ID substring mention). Closes
+  the kotlin-PR-#23 follow-up class of failure where a pack ships in
+  main but docs go stale because nobody remembered to update them.
+- **`vyuh-dxkit tools install <name>` and `--all` (D011).** Single-tool
+  install for cross-stack development (e.g. installing `spotbugs` /
+  `pmd` on a Node-only repo); `--all` enumerates every TOOL_DEFS
+  entry. Unknown names fail loudly with an "Unknown tool" message +
+  pointer to `tools list`. Used during this phase's PMD harvest.
+- **CLAUDE.md merge-strategy guidance**. Codifies when PRs should
+  squash-merge (single logical unit) vs rebase-merge (multiple
+  independently-meaningful commits with prose-quality messages —
+  what this PR did to preserve D008/D011/G2/G5/G9 + 5 capability
+  commits as discrete history).
+
+### Refactored (architectural improvement)
+
+- **`src/analyzers/tools/jacoco.ts`** — extracted from kotlin pack
+  in 10k.1.2. Owns `parseJaCoCoXml`, `findJaCoCoReport`,
+  `gatherJaCoCoCoverageResult`. Both JVM packs delegate. Parser was
+  always source-language-agnostic; just relocating to the right home.
+- **`src/analyzers/tools/osv-scanner-maven.ts`** — extracted from
+  kotlin pack in 10k.1.4. Same pattern. Owns
+  `parseOsvScannerMavenFindings` + `gatherOsvScannerMavenDepVulnsResult`.
+  Both JVM packs delegate. Parser was already ecosystem-filtered to
+  Maven (not Kotlin-coupled); just relocating.
+- **Capabilities contract is genuinely optional (Recipe v3 / G2).**
+  `capabilities-contract.test.ts:117` previously asserted
+  `providers.length === LANGUAGES.length` for the depVulns capability,
+  forcing packs without depVulns to register null-stub providers.
+  Now: `expect(providers.length).toBe(LANGUAGES.filter((l) =>
+  l.capabilities?.depVulns).length)` — precise contract, packs can
+  omit. Unblocks Swift's eventual graceful-degradation pattern.
+  Java's null-stub from intermediate commits retired.
+- **`detectJava` is source-presence-driven, not manifest-driven
+  (Recipe v3 / G9).** Initial detection activated on bare `pom.xml`,
+  which broke kotlin's matrix lint test because kotlin's fixture has
+  pom.xml (for osv-scanner Maven). Both packs activated → lintTool
+  came back as `'detekt, pmd'`. Fix: require either `src/main/java/`
+  directory OR actual `.java` source within depth 5. Mixed Kotlin +
+  Java projects still activate both packs (correct). G9 noted as a
+  scaffolder-template fix candidate — the scaffolded `detect()` stub
+  currently suggests "manifest signals" which is the bug we just hit.
+
+### Fixed
+
+- **D008 — stale test-fixture types + missing contract test.** 21 type
+  errors surfaced when `tsc --noEmit` runs against `src + test`
+  together (`DimensionScore.details` / `DuplicationStats.totalLines`
+  field drift; `DepVulnFinding.source` → renamed to `.tool`;
+  `mapLintSeverity` contract was narrower than every impl reality;
+  spread-duplication cleanups). Adds `tsconfig.test.json` +
+  `npm run typecheck:test` + wires into `.husky/pre-push` and
+  `.github/workflows/ci.yml`. The contract test paid for itself in the
+  same session — caught a `Record<LanguageId, boolean>` literal
+  regression introduced 30 minutes earlier.
+- **`scripts/check-cross-ecosystem-coverage.sh` Prettier robustness
+  (Recipe v3 / G1, partial).** Auto-derive parser assumed single-line
+  `LANGUAGES = [...]`. Prettier reformatted to multi-line at the 7th
+  entry (line-length budget) and the gate parsed 0 entries silently.
+  Switched to awk block extract — robust to both shapes. One
+  instance fixed; class-wide audit of similar parsers deferred.
+- **Vitest `hookTimeout` default of 10s caused C# `beforeAll` flakes.**
+  `dotnet restore` against a cold NuGet cache routinely takes 18-44s
+  on WSL2. Now matches `testTimeout` at 180s.
+
+### Phase 10k roadmap
+
+After 10k.1 (Java) ships in 2.4.5, **10k.2 (Ruby) ships in 2.4.6** as
+recipe stress test #2 — fully dynamic language outside the JVM family.
+Then **2.5.0 (Phase 10i — fingerprints + exec summary across 8-language
+matrix)**. Phase 10j.2 (Swift/iOS) is **deferred to post-10rr / pre-3.0.0
+opportunistic slot** because Linux/WSL2 development can't validate the
+xcodeproj-shape majority without macOS access. See
+`tmp/phase-10k-backend-langs-roadmap.md` for the full phase plan.
+
 ## [2.4.4] - 2026-04-27
 
 Phase 10j.1 — first mobile language pack (Kotlin/Android), Recipe v2

package/README.md

@@ -45,7 +45,7 @@ Seven deterministic analyzers. Each emits a markdown report to `.dxkit/reports/`
 | `test-gaps`       | Coverage artifact → import-graph → filename (strongest wins)                                                                                                                                                                                                                                                          | <1s     | `.dxkit/reports/test-gaps-<date>.md`          |
 | `quality`         | Slop score + jscpd duplication + eslint/ruff + hygiene                                                                                                                                                                                                                                                                | 5–15s   | `.dxkit/reports/quality-review-<date>.md`     |
 | `dev-report`      | Commits, contributors, hot files, velocity, conventional %                                                                                                                                                                                                                                                            | <1s     | `.dxkit/reports/developer-report-<date>.md`   |
-| `licenses`        | Dependency license inventory across every active pack (TS/Python/Go/Rust/C#)                                                                                                                                                                                                                                          | 5–20s   | `.dxkit/reports/licenses-<date>.md`           |
+| `licenses`        | Dependency license inventory across every active pack (TS, Python, Go, Rust, C#; Kotlin + Java omitted — no canonical CLI license tool for Maven/Gradle ecosystems)                                                                                                                                                   | 5–20s   | `.dxkit/reports/licenses-<date>.md`           |
 | `bom`             | **Bill of Materials** — joins licenses + vulns per package, groups by top-level manifest dep (Snyk-style), enriches with CISA KEV + EPSS + reachability, ranks by composite risk score with "This Week's Triage" summary, aggregates nested sub-projects, `--filter=top-level` collapses transitive rows, 15-col XLSX | 10–40s  | `.dxkit/reports/bom-<date>.{md,xlsx}`         |
 
 Plus a converter: `vyuh-dxkit to-xlsx <json-file>` renders any `licenses` or `bom` detailed JSON as the canonical 15-column XLSX.
@@ -77,7 +77,7 @@ Plus a converter: `vyuh-dxkit to-xlsx <json-file>` renders any `licenses` or `bo
 
 Three signals, strongest wins for files it covers:
 
-1. **Coverage artifact** — Istanbul JSON (TS/JS), `coverage.json` (Python), `coverage.out` (Go), cobertura XML (C#/Rust), `lcov.info` (Rust). If the tool measured a file, that decision is authoritative.
+1. **Coverage artifact** — Istanbul JSON (TS/JS), `coverage.json` (Python), `coverage.out` (Go), cobertura XML (C#/Rust), `lcov.info` (Rust), JaCoCo XML (Kotlin). If the tool measured a file, that decision is authoritative.
 2. **Import-graph reachability** — files transitively imported from an active test file (up to 3 hops). Rescues integration tests + behavior-named tests the filename matcher misses.
 3. **Filename match** — last-resort basename similarity.
 
@@ -105,6 +105,8 @@ vyuh-dxkit tools install                      # interactive: prompts per tool
 | Go        | `golangci-lint`, `govulncheck`                                            |
 | Rust      | `clippy`, `cargo-audit`, `cargo-llvm-cov`                                 |
 | C#        | `dotnet-format` (via SDK — formatter, not a linter)                       |
+| Kotlin    | `detekt` (Checkstyle XML), `osv-scanner` (Maven), JaCoCo XML              |
+| Java      | `pmd` (PMD 7.x JSON), `osv-scanner` (Maven), JaCoCo XML reuse             |
 
 Install commands are platform-aware (brew on macOS, user-local install on Linux, winget/scoop on Windows). Tools install into `~/.local/bin` or similar user paths — no `sudo` required.
 
@@ -167,15 +169,17 @@ npm run new-lang kotlin "Kotlin (Android)"
 
 This scaffolds the 7 recipe files (pack module, test stub, fixture skeleton, Claude rule file, template-config dir, plus `LanguageId` union extension and `LANGUAGES` registration). See [CONTRIBUTING.md](./CONTRIBUTING.md) for the full walkthrough. Recipe enforcement (architecture greps + contract tests + synthetic 6th-pack playbook) runs in pre-commit so packs that miss required metadata fail CI.
 
-| Language | Detection                            | Coverage import     | Import-graph                           | Native tools                        | Lint severity tiers    | Vuln severity tiers                 |
-| -------- | ------------------------------------ | ------------------- | -------------------------------------- | ----------------------------------- | ---------------------- | ----------------------------------- |
-| TS / JS  | `package.json`                       | ✅ Istanbul         | ✅ import/require/re-export            | eslint, npm audit, vitest-coverage  | ✅ ESLint rule ID      | ✅ npm audit native                 |
-| Python   | `pyproject.toml`, `setup.py`, `*.py` | ✅ coverage.py      | ✅ import/from                         | ruff, pip-audit, coverage           | ✅ ruff code prefix    | ✅ pip-audit + OSV.dev (CVSS v3+v4) |
-| Go       | `go.mod`                             | ✅ coverprofile     | ✅ import blocks                       | golangci-lint, govulncheck          | ✅ `FromLinter` family | ✅ govulncheck embedded + OSV.dev   |
-| Rust     | `Cargo.toml`                         | ✅ lcov + cobertura | ⚠️ use statements, extracted only¹     | clippy, cargo-audit, cargo-llvm-cov | ✅ clippy group        | ✅ cargo-audit native               |
-| C#       | `*.csproj`, `*.sln`                  | ✅ cobertura XML    | ⚠️ using declarations, extracted only¹ | dotnet-format (formatter)           | ❌ (no linter yet)     | ✅ dotnet list --vulnerable         |
-
-¹ Rust + C# packs populate `imports.extracted` but the file-level resolver is a no-op — Rust's `use` paths and C#'s `using` namespaces don't map 1:1 to source files. Downstream analyses that need an edge graph (reachability for dep-vulns, import-graph credit for test-gaps) degrade to conservative defaults for these two languages. Resolvers are planned; see Phase 10i-L.2 in the roadmap.
+| Language | Detection                             | Coverage import     | Import-graph                           | Native tools                        | Lint severity tiers    | Vuln severity tiers                 |
+| -------- | ------------------------------------- | ------------------- | -------------------------------------- | ----------------------------------- | ---------------------- | ----------------------------------- |
+| TS / JS  | `package.json`                        | ✅ Istanbul         | ✅ import/require/re-export            | eslint, npm audit, vitest-coverage  | ✅ ESLint rule ID      | ✅ npm audit native                 |
+| Python   | `pyproject.toml`, `setup.py`, `*.py`  | ✅ coverage.py      | ✅ import/from                         | ruff, pip-audit, coverage           | ✅ ruff code prefix    | ✅ pip-audit + OSV.dev (CVSS v3+v4) |
+| Go       | `go.mod`                              | ✅ coverprofile     | ✅ import blocks                       | golangci-lint, govulncheck          | ✅ `FromLinter` family | ✅ govulncheck embedded + OSV.dev   |
+| Rust     | `Cargo.toml`                          | ✅ lcov + cobertura | ⚠️ use statements, extracted only¹     | clippy, cargo-audit, cargo-llvm-cov | ✅ clippy group        | ✅ cargo-audit native               |
+| C#       | `*.csproj`, `*.sln`                   | ✅ cobertura XML    | ⚠️ using declarations, extracted only¹ | dotnet-format (formatter)           | ❌ (no linter yet)     | ✅ dotnet list --vulnerable         |
+| Kotlin   | gradle/`*.gradle{.kts,}`, `*.kt`      | ✅ JaCoCo XML       | ⚠️ import statements, extracted only¹  | detekt, osv-scanner (Maven)         | ✅ detekt severity     | ✅ osv-scanner + OSV.dev (Maven)    |
+| Java     | `pom.xml`, `src/main/java/`, `*.java` | ✅ JaCoCo XML       | ⚠️ import statements, extracted only¹  | PMD, osv-scanner (Maven)            | ✅ PMD priority tiers  | ✅ osv-scanner + OSV.dev (Maven)    |
+
+¹ Rust, C#, Kotlin, and Java packs populate `imports.extracted` but the file-level resolver is a no-op — Rust's `use` paths, C#'s `using` namespaces, Kotlin's and Java's `import` package paths don't map 1:1 to source files. Downstream analyses that need an edge graph (reachability for dep-vulns, import-graph credit for test-gaps) degrade to conservative defaults for these four languages. Resolvers are planned; see Phase 10i-L.2 in the roadmap.
 
 ✅ full support. Multi-language repos fully supported — every detected language's tools run, and dep-vuln counts aggregate across all language packs via the `depVulns` capability (pip-audit findings don't silently replace npm-audit ones).
 

package/dist/analyzers/tools/jacoco.d.ts

@@ -0,0 +1,76 @@
+import { type Coverage } from './coverage';
+import type { CoverageResult } from '../../languages/capabilities/types';
+/**
+ * Pure parser for JaCoCo's XML report (DTD: `report.dtd`). The structure:
+ *
+ *   <report name="...">
+ *     <package name="com/example">
+ *       <class name="com/example/Foo" sourcefilename="Foo.kt">...</class>
+ *       <sourcefile name="Foo.kt">
+ *         <line nr="N" mi="..." ci="..." mb="..." cb="..."/>
+ *         <counter type="LINE" missed="X" covered="Y"/>
+ *       </sourcefile>
+ *       <counter type="LINE" missed="X" covered="Y"/>
+ *     </package>
+ *     <counter type="LINE" missed="X" covered="Y"/>
+ *   </report>
+ *
+ * Per-file coverage comes from `<sourcefile>` blocks: their LINE counter
+ * holds the file's missed/covered totals. Project-level total comes from
+ * the top-level `<counter type="LINE">` (last in the document).
+ *
+ * Path attribution joins `<package name>` (forward-slashed, JVM-style)
+ * with `<sourcefile name>` to produce the canonical relative path the
+ * downstream consumers expect (`com/example/Foo.kt` or
+ * `com/example/Foo.java`). JVM bytecode namespacing isn't 1:1 with
+ * on-disk source paths in multi-module projects — accepted limitation
+ * (matches C#'s cobertura attribution).
+ *
+ * Returns null when no `<counter type="LINE">` exists at the top level
+ * — that's JaCoCo's "no coverage data" signal, distinct from "0%
+ * coverage" (where the counter exists with covered=0).
+ *
+ * Language-agnostic: works for Kotlin (.kt), Java (.java), and any
+ * other JVM language whose JaCoCo output respects the `<package>` /
+ * `<sourcefile>` shape — `<sourcefile name>` carries the on-disk
+ * filename verbatim so the parser doesn't need to know the language.
+ */
+export declare function parseJaCoCoXml(raw: string, sourceFile: string, _cwd: string): Coverage | null;
+/**
+ * Standard JaCoCo report locations across JVM build tools and project
+ * layouts:
+ *
+ *   GRADLE (kotlin + java):
+ *   - app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
+ *     (Android default — `app` module, `jacocoTestReport` task)
+ *   - build/reports/jacoco/test/jacocoTestReport.xml
+ *     (plain JVM via the `jacoco` plugin's default `test` task)
+ *   - build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
+ *     (multi-module aggregate; many builds rename the task)
+ *
+ *   MAVEN (java):
+ *   - target/site/jacoco/jacoco.xml
+ *     (default Maven JaCoCo plugin — single-module Java)
+ *   - target/site/jacoco-aggregate/jacoco.xml
+ *     (Maven multi-module aggregate via jacoco-maven-plugin's
+ *     `report-aggregate` goal)
+ *
+ *   FALLBACKS:
+ *   - jacocoTestReport.xml (top-level — fixture / direct path)
+ *   - jacoco.xml (top-level — Maven fixture / direct path)
+ *
+ * Returns the first existing path, relative to cwd. Conservative
+ * priority: most specific build-tool conventions first, root
+ * fallbacks last.
+ */
+export declare function findJaCoCoReport(cwd: string): string | null;
+/**
+ * Locate + parse the JaCoCo XML report under cwd, wrap the result in a
+ * `CoverageResult` envelope. Identical glue across JVM packs (kotlin,
+ * java) — no language-specific dispatch needed because JaCoCo's
+ * `<sourcefile name>` carries the on-disk filename verbatim and the
+ * file extension survives intact through the parser. Both packs'
+ * `coverageProvider.gather` should delegate here.
+ */
+export declare function gatherJaCoCoCoverageResult(cwd: string): CoverageResult | null;
+//# sourceMappingURL=jacoco.d.ts.map

package/dist/analyzers/tools/jacoco.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jacoco.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/jacoco.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,QAAQ,EAA6B,MAAM,YAAY,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAmE7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAY7E"}

package/dist/analyzers/tools/jacoco.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseJaCoCoXml = parseJaCoCoXml;
+exports.findJaCoCoReport = findJaCoCoReport;
+exports.gatherJaCoCoCoverageResult = gatherJaCoCoCoverageResult;
+/**
+ * JaCoCo XML report parser + standard-location finder. Shared across
+ * JVM-language packs (kotlin, java) — single source of truth per
+ * CLAUDE.md rule #2 ("Each tool has ONE gather function … if another
+ * module needs that tool's output, it MUST call the existing
+ * function").
+ *
+ * Extracted from `src/languages/kotlin.ts` in 10k.1.2 (Phase 10k.1
+ * SSOT validation) — when the Java pack needed JaCoCo coverage, the
+ * parser was already generic (kotlin's own tests cover it against
+ * Java source, see test/languages-kotlin.test.ts). Forking would
+ * have been the architectural violation; relocating to a shared
+ * tool module is the correct outcome.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const coverage_1 = require("./coverage");
+/**
+ * Pure parser for JaCoCo's XML report (DTD: `report.dtd`). The structure:
+ *
+ *   <report name="...">
+ *     <package name="com/example">
+ *       <class name="com/example/Foo" sourcefilename="Foo.kt">...</class>
+ *       <sourcefile name="Foo.kt">
+ *         <line nr="N" mi="..." ci="..." mb="..." cb="..."/>
+ *         <counter type="LINE" missed="X" covered="Y"/>
+ *       </sourcefile>
+ *       <counter type="LINE" missed="X" covered="Y"/>
+ *     </package>
+ *     <counter type="LINE" missed="X" covered="Y"/>
+ *   </report>
+ *
+ * Per-file coverage comes from `<sourcefile>` blocks: their LINE counter
+ * holds the file's missed/covered totals. Project-level total comes from
+ * the top-level `<counter type="LINE">` (last in the document).
+ *
+ * Path attribution joins `<package name>` (forward-slashed, JVM-style)
+ * with `<sourcefile name>` to produce the canonical relative path the
+ * downstream consumers expect (`com/example/Foo.kt` or
+ * `com/example/Foo.java`). JVM bytecode namespacing isn't 1:1 with
+ * on-disk source paths in multi-module projects — accepted limitation
+ * (matches C#'s cobertura attribution).
+ *
+ * Returns null when no `<counter type="LINE">` exists at the top level
+ * — that's JaCoCo's "no coverage data" signal, distinct from "0%
+ * coverage" (where the counter exists with covered=0).
+ *
+ * Language-agnostic: works for Kotlin (.kt), Java (.java), and any
+ * other JVM language whose JaCoCo output respects the `<package>` /
+ * `<sourcefile>` shape — `<sourcefile name>` carries the on-disk
+ * filename verbatim so the parser doesn't need to know the language.
+ */
+function parseJaCoCoXml(raw, sourceFile, _cwd) {
+    const files = new Map();
+    // Iterate <package> blocks. Each block contains <sourcefile> children
+    // we tally and aggregate counters we can ignore (they're sums of the
+    // children, redundant given we sum the children ourselves).
+    const packageRe = /<package\s+name="([^"]+)">([\s\S]*?)<\/package>/g;
+    let pm;
+    while ((pm = packageRe.exec(raw)) !== null) {
+        const pkgPath = pm[1].replace(/\\/g, '/'); // JVM uses forward-slashes already; defensive
+        const pkgInner = pm[2];
+        // Within a <package>, <sourcefile> blocks own per-file counters.
+        const sourceFileRe = /<sourcefile\s+name="([^"]+)">([\s\S]*?)<\/sourcefile>/g;
+        let sm;
+        while ((sm = sourceFileRe.exec(pkgInner)) !== null) {
+            const fileName = sm[1];
+            const sourceInner = sm[2];
+            // The LAST <counter type="LINE"> in <sourcefile> is the
+            // file-level aggregate; earlier ones are per-method. We pick the
+            // last to get the full-file roll-up.
+            const counterRe = /<counter\s+type="LINE"\s+missed="(\d+)"\s+covered="(\d+)"\s*\/>/g;
+            let lastMissed = 0;
+            let lastCovered = 0;
+            let cm;
+            while ((cm = counterRe.exec(sourceInner)) !== null) {
+                lastMissed = parseInt(cm[1], 10);
+                lastCovered = parseInt(cm[2], 10);
+            }
+            const total = lastMissed + lastCovered;
+            const rel = pkgPath ? `${pkgPath}/${fileName}` : fileName;
+            files.set(rel, {
+                path: rel,
+                covered: lastCovered,
+                total,
+                pct: (0, coverage_1.round1)(total > 0 ? (lastCovered / total) * 100 : 0),
+            });
+        }
+    }
+    // Top-level project-wide LINE counter — JaCoCo emits it after the
+    // last </package>. Use a non-greedy match against the document tail
+    // to avoid grabbing per-package counters as project-level.
+    const tailMatch = raw.match(/<\/package>\s*<counter\s+type="LINE"\s+missed="(\d+)"\s+covered="(\d+)"\s*\/>\s*<\/report>/);
+    let totalMissed = 0;
+    let totalCovered = 0;
+    if (tailMatch) {
+        totalMissed = parseInt(tailMatch[1], 10);
+        totalCovered = parseInt(tailMatch[2], 10);
+    }
+    else {
+        // No project-level counter (degenerate report — single package, no
+        // explicit roll-up). Sum the per-file totals as the linePercent
+        // basis.
+        for (const f of files.values()) {
+            totalCovered += f.covered;
+            totalMissed += f.total - f.covered;
+        }
+    }
+    const grandTotal = totalCovered + totalMissed;
+    if (grandTotal === 0 && files.size === 0)
+        return null;
+    return {
+        source: 'jacoco',
+        sourceFile,
+        linePercent: (0, coverage_1.round1)(grandTotal > 0 ? (totalCovered / grandTotal) * 100 : 0),
+        files,
+    };
+}
+/**
+ * Standard JaCoCo report locations across JVM build tools and project
+ * layouts:
+ *
+ *   GRADLE (kotlin + java):
+ *   - app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
+ *     (Android default — `app` module, `jacocoTestReport` task)
+ *   - build/reports/jacoco/test/jacocoTestReport.xml
+ *     (plain JVM via the `jacoco` plugin's default `test` task)
+ *   - build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
+ *     (multi-module aggregate; many builds rename the task)
+ *
+ *   MAVEN (java):
+ *   - target/site/jacoco/jacoco.xml
+ *     (default Maven JaCoCo plugin — single-module Java)
+ *   - target/site/jacoco-aggregate/jacoco.xml
+ *     (Maven multi-module aggregate via jacoco-maven-plugin's
+ *     `report-aggregate` goal)
+ *
+ *   FALLBACKS:
+ *   - jacocoTestReport.xml (top-level — fixture / direct path)
+ *   - jacoco.xml (top-level — Maven fixture / direct path)
+ *
+ * Returns the first existing path, relative to cwd. Conservative
+ * priority: most specific build-tool conventions first, root
+ * fallbacks last.
+ */
+function findJaCoCoReport(cwd) {
+    const candidates = [
+        // Gradle (Android + plain JVM)
+        'app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml',
+        'build/reports/jacoco/test/jacocoTestReport.xml',
+        'build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml',
+        // Maven (single-module + multi-module aggregate)
+        'target/site/jacoco/jacoco.xml',
+        'target/site/jacoco-aggregate/jacoco.xml',
+        // Direct-path fallbacks (fixture / hand-placed)
+        'jacocoTestReport.xml',
+        'jacoco.xml',
+    ];
+    for (const rel of candidates) {
+        const abs = path.join(cwd, rel);
+        if (fs.existsSync(abs))
+            return rel;
+    }
+    return null;
+}
+/**
+ * Locate + parse the JaCoCo XML report under cwd, wrap the result in a
+ * `CoverageResult` envelope. Identical glue across JVM packs (kotlin,
+ * java) — no language-specific dispatch needed because JaCoCo's
+ * `<sourcefile name>` carries the on-disk filename verbatim and the
+ * file extension survives intact through the parser. Both packs'
+ * `coverageProvider.gather` should delegate here.
+ */
+function gatherJaCoCoCoverageResult(cwd) {
+    const reportRel = findJaCoCoReport(cwd);
+    if (!reportRel)
+        return null;
+    let raw;
+    try {
+        raw = fs.readFileSync(path.join(cwd, reportRel), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const coverage = parseJaCoCoXml(raw, reportRel, cwd);
+    if (!coverage)
+        return null;
+    return { schemaVersion: 1, tool: `coverage:${coverage.source}`, coverage };
+}
+//# sourceMappingURL=jacoco.js.map

package/dist/analyzers/tools/jacoco.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jacoco.js","sourceRoot":"","sources":["../../../src/analyzers/tools/jacoco.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,wCAmEC;AA6BD,4CAkBC;AAUD,gEAYC;AA/LD;;;;;;;;;;;;;GAaG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,yCAAsE;AAGtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,SAAgB,cAAc,CAAC,GAAW,EAAE,UAAkB,EAAE,IAAY;IAC1E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,sEAAsE;IACtE,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,kDAAkD,CAAC;IACrE,IAAI,EAA0B,CAAC;IAC/B,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,8CAA8C;QACzF,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACvB,iEAAiE;QACjE,MAAM,YAAY,GAAG,wDAAwD,CAAC;QAC9E,IAAI,EAA0B,CAAC;QAC/B,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1B,wDAAwD;YACxD,iEAAiE;YACjE,qCAAqC;YACrC,MAAM,SAAS,GAAG,kEAAkE,CAAC;YACrF,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,EAA0B,CAAC;YAC/B,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjC,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,GAAG,WAAW,CAAC;YACvC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBACb,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,WAAW;gBACpB,KAAK;gBACL,GAAG,EAAE,IAAA,iBAAM,EAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CACzB,4FAA4F,CAC7F,CAAC;IACF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,SAAS,EAAE,CAAC;QACd,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,gEAAgE;QAChE,SAAS;QACT,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/B,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC;YAC1B,WAAW,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,UAAU;QACV,WAAW,EAAE,IAAA,iBAAM,EAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG;QACjB,+BAA+B;QAC/B,gEAAgE;QAChE,gDAAgD;QAChD,4DAA4D;QAC5D,iDAAiD;QACjD,+BAA+B;QAC/B,yCAAyC;QACzC,gDAAgD;QAChD,sBAAsB;QACtB,YAAY;KACb,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,0BAA0B,CAAC,GAAW;IACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC7E,CAAC"}

package/dist/analyzers/tools/osv-scanner-fix.d.ts

@@ -32,6 +32,26 @@ import type { DepVulnFinding, DepVulnUpgradePlan } from '../../languages/capabil
  *
  * Never throws. `gatherTsDepVulnsResult` calls this unconditionally and
  * treats the empty map as "no enrichment available".
+ *
+ * **TEMP-DIR ISOLATION (10k.1.5b fix — discovered during 2.4.5 pre-ship
+ * regression):** osv-scanner v2's `fix` subcommand invokes `npm install`
+ * internally to compute upgrade patches. That `npm install` MUTATES the
+ * cwd's node_modules — wipes it then reinstalls (often with
+ * `--legacy-peer-deps` fallback if the project's deps don't resolve
+ * cleanly). On dxkit's own repo this caused subsequent dxkit subcommand
+ * invocations to crash with `Cannot find module 'hosted-git-info'`
+ * because osv-scanner's reinstall left an incomplete tree. On
+ * vyuhlabs-platform (835MB node_modules) the reinstall happened to
+ * succeed but still mutated state silently — a 5-month-old data-mutation
+ * bug shipped since 2.4.0 / Phase 10h.6 and only caught now because
+ * 2.4.5 pre-ship regression ran reports back-to-back on dxkit's own repo
+ * and tripped the chain.
+ *
+ * Mitigation: we copy `package.json` + `package-lock.json` to a fresh
+ * temp dir, run osv-scanner there, and discard the temp dir afterward.
+ * Output JSON identifies advisories by `(package, version, id)` tuples
+ * which are independent of cwd, so the upgrade-plan map we return is
+ * unchanged. The caller's project gets read-only treatment.
  */
 export declare function gatherOsvScannerFixPlans(cwd: string): Promise<Map<string, DepVulnUpgradePlan>>;
 /**

package/dist/analyzers/tools/osv-scanner-fix.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osv-scanner-fix.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAqC7F;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CA+B1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwCrF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACrC,MAAM,CAaR;AAED;;;;;;;4BAO4B;AAC5B,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF"}
+{"version":3,"file":"osv-scanner-fix.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAsC7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAwC1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwCrF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACrC,MAAM,CAaR;AAED;;;;;;;4BAO4B;AAC5B,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF"}