@vyuhlabs/dxkit 2.7.1 → 2.9.0

package/dist/ingest/snyk-api.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snykIssueToFinding = snykIssueToFinding;
+exports.fetchSnykCodeFindings = fetchSnykCodeFindings;
+const DEFAULT_API_BASE = 'https://api.snyk.io';
+const DEFAULT_VERSION = '2024-10-15';
+/** Snyk's five-level severity → dxkit's four-tier. `info` folds to
+ *  `low` (dxkit has no info tier). */
+function mapSeverity(level) {
+    switch (level) {
+        case 'critical':
+            return 'critical';
+        case 'high':
+            return 'high';
+        case 'medium':
+            return 'medium';
+        case 'low':
+        case 'info':
+            return 'low';
+        default:
+            return 'medium';
+    }
+}
+/** Extract the first CWE id from an issue's `classes`. */
+function cweFromClasses(classes) {
+    if (!classes)
+        return '';
+    for (const c of classes) {
+        if ((c.source || '').toUpperCase() === 'CWE' && c.id) {
+            const m = /(\d+)/.exec(c.id);
+            if (m)
+                return `CWE-${parseInt(m[1], 10)}`;
+        }
+    }
+    return '';
+}
+/** First resolvable source location (file + line) in an issue. */
+function locationFrom(coords) {
+    for (const c of coords || []) {
+        for (const r of c.representations || []) {
+            const file = r.sourceLocation?.file;
+            const line = r.sourceLocation?.region?.start?.line;
+            if (file && line)
+                return { file, line };
+        }
+    }
+    return null;
+}
+/** Map one Snyk issue → `ExternalFinding`, or null when it has no
+ *  usable source location (can't be fingerprinted/fixed). */
+function snykIssueToFinding(issue) {
+    const a = issue.attributes;
+    if (!a)
+        return null;
+    const loc = locationFrom(a.coordinates);
+    if (!loc)
+        return null;
+    return {
+        engine: 'snyk-code',
+        severity: mapSeverity(a.effective_severity_level),
+        category: 'code',
+        cwe: cweFromClasses(a.classes),
+        rule: issue.id || a.title || 'snyk-code',
+        title: a.title || 'Snyk Code finding',
+        file: loc.file,
+        line: loc.line,
+    };
+}
+/**
+ * Fetch all Snyk Code findings for a project, following pagination.
+ * Pure-ish: the only side effect is the network read. Throws on auth /
+ * network failure so the CLI can surface a clear message; a successful
+ * call with zero issues returns `[]`.
+ */
+async function fetchSnykCodeFindings(opts) {
+    const base = opts.apiBase || DEFAULT_API_BASE;
+    const version = opts.version || DEFAULT_VERSION;
+    const params = new URLSearchParams({
+        version,
+        type: 'code',
+        'scan_item.type': 'project',
+        'scan_item.id': opts.projectId,
+        limit: '100',
+    });
+    let url = `${base}/rest/orgs/${opts.orgId}/issues?${params.toString()}`;
+    const out = [];
+    let guard = 0;
+    while (url && guard < 1000) {
+        guard++;
+        const res = await fetch(url, {
+            headers: {
+                // Snyk REST API convention. If a live token rejects this,
+                // switch to `Bearer ${opts.token}` (see VALIDATION NOTE).
+                Authorization: `token ${opts.token}`,
+                Accept: 'application/vnd.api+json',
+            },
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            throw new Error(`Snyk API ${res.status} ${res.statusText}: ${body.slice(0, 200)}`);
+        }
+        const json = (await res.json());
+        for (const issue of json.data || []) {
+            const f = snykIssueToFinding(issue);
+            if (f)
+                out.push(f);
+        }
+        const next = json.links?.next;
+        // `next` is a relative REST path; resolve against the base.
+        url = next ? (next.startsWith('http') ? next : `${base}${next}`) : null;
+    }
+    return out;
+}
+//# sourceMappingURL=snyk-api.js.map

package/dist/ingest/snyk-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snyk-api.js","sourceRoot":"","sources":["../../src/ingest/snyk-api.ts"],"names":[],"mappings":";;AAyHA,gDAeC;AAQD,sDAsCC;AAxID,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;sCACsC;AACtC,SAAS,WAAW,CAAC,KAAyB;IAC5C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AA8BD,0DAA0D;AAC1D,SAAS,cAAc,CAAC,OAAgC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC;gBAAE,OAAO,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,MAAoC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC;YACpC,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC;YACnD,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;6DAC6D;AAC7D,SAAgB,kBAAkB,CAAC,KAAgB;IACjD,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IAC3B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC;QACjD,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9B,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,WAAW;QACxC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,mBAAmB;QACrC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CAAC,IAAqB;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,OAAO;QACP,IAAI,EAAE,MAAM;QACZ,gBAAgB,EAAE,SAAS;QAC3B,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,IAAI,GAAG,GAAkB,GAAG,IAAI,cAAc,IAAI,CAAC,KAAK,WAAW,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,GAAG,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;QAC3B,KAAK,EAAE,CAAC;QACR,MAAM,GAAG,GAAa,MAAM,KAAK,CAAC,GAAG,EAAE;YACrC,OAAO,EAAE;gBACP,0DAA0D;gBAC1D,0DAA0D;gBAC1D,aAAa,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE;gBACpC,MAAM,EAAE,0BAA0B;aACnC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QAC9B,4DAA4D;QAC5D,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ingest/snyk-cli.d.ts

@@ -0,0 +1,22 @@
+import type { ExternalFinding } from './types';
+/** Env flag that opts the guarded `snyk` registry entry in. */
+export declare const SNYK_OPTIN_ENV = "DXKIT_SNYK_CLI";
+/** `snyk code test` argv (no shell). Org scopes the entitlement; omit
+ *  to use the token's default org. */
+export declare function snykCodeTestArgs(org: string | undefined, sarifPath: string): string[];
+export interface RunSnykCodeOptions {
+    cwd: string;
+    /** Snyk org id — scopes which org's Code entitlement/quota is used. */
+    org?: string;
+    /** Snyk Code tests can take a few minutes; default 10 min. */
+    timeoutMs?: number;
+    onLog?: (msg: string) => void;
+}
+/**
+ * Run `snyk code test` and return normalized findings. Installs the
+ * Snyk CLI on demand if missing. Throws when no SARIF is produced (a
+ * real failure); a non-zero exit with a written SARIF (findings present,
+ * or the cosmetic platform-report 403) is treated as success.
+ */
+export declare function runSnykCodeTest(opts: RunSnykCodeOptions): Promise<ExternalFinding[]>;
+//# sourceMappingURL=snyk-cli.d.ts.map

package/dist/ingest/snyk-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snyk-cli.d.ts","sourceRoot":"","sources":["../../src/ingest/snyk-cli.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,+DAA+D;AAC/D,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;sCACsC;AACtC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAID;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAmD1F"}

package/dist/ingest/snyk-cli.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SNYK_OPTIN_ENV = void 0;
+exports.snykCodeTestArgs = snykCodeTestArgs;
+exports.runSnykCodeTest = runSnykCodeTest;
+/**
+ * Snyk Code (SAST) via the Snyk CLI — the free-tier path.
+ *
+ * Reading findings over the Snyk REST API needs Snyk's API-access
+ * entitlement, which is an Enterprise-tier feature. On Free/Team plans
+ * that read returns `403 … not entitled for api access`. But running a
+ * Snyk Code TEST via the CLI uses the Snyk Code *product* entitlement
+ * (which Free includes, with a per-period test quota), and writes the
+ * full results to a local SARIF file — which we then ingest through the
+ * same `parseSarif` path as every other engine.
+ *
+ * So this is the path most customers actually use. It costs one Snyk
+ * Code test per run (vs the quota-free API read on Enterprise).
+ *
+ * Detection + install go through the canonical registry (Rule 1): the
+ * runner opts into the guarded `snyk` entry, and installs it on demand
+ * (it's a small npm package) if missing. The CLI emits a non-fatal
+ * platform-reporting error on plans without API access, but still writes
+ * the SARIF — so we read the file regardless of exit code.
+ */
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const tool_registry_1 = require("../analyzers/tools/tool-registry");
+const runner_1 = require("../analyzers/tools/runner");
+const sarif_1 = require("./sarif");
+/** Env flag that opts the guarded `snyk` registry entry in. */
+exports.SNYK_OPTIN_ENV = 'DXKIT_SNYK_CLI';
+/** `snyk code test` argv (no shell). Org scopes the entitlement; omit
+ *  to use the token's default org. */
+function snykCodeTestArgs(org, sarifPath) {
+    const args = ['code', 'test', `--sarif-file-output=${sarifPath}`];
+    if (org)
+        args.push(`--org=${org}`);
+    return args;
+}
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+/**
+ * Run `snyk code test` and return normalized findings. Installs the
+ * Snyk CLI on demand if missing. Throws when no SARIF is produced (a
+ * real failure); a non-zero exit with a written SARIF (findings present,
+ * or the cosmetic platform-report 403) is treated as success.
+ */
+async function runSnykCodeTest(opts) {
+    process.env[exports.SNYK_OPTIN_ENV] = '1';
+    const log = opts.onLog ?? (() => { });
+    let status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.snyk, opts.cwd);
+    if (!status.available || !status.path) {
+        log('Snyk CLI not found — installing it on demand…');
+        try {
+            (0, child_process_1.execSync)((0, tool_registry_1.getInstallCommand)(tool_registry_1.TOOL_DEFS.snyk), { stdio: 'ignore' });
+        }
+        catch {
+            /* fall through to the availability check below */
+        }
+        status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.snyk, opts.cwd);
+    }
+    if (!status.available || !status.path) {
+        throw new Error('Snyk CLI is not available. Install it with `vyuh-dxkit tools install snyk`.');
+    }
+    const workDir = fs.mkdtempSync(path.join(os.tmpdir(), 'dxkit-snyk-'));
+    const sarifPath = path.join(workDir, 'snyk-code.sarif');
+    try {
+        log('Running `snyk code test` (uses one Snyk Code test from your quota)…');
+        const outcome = await (0, runner_1.runDetached)(status.path, snykCodeTestArgs(opts.org, sarifPath), {
+            cwd: opts.cwd,
+            timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        });
+        let raw = '';
+        try {
+            raw = fs.readFileSync(sarifPath, 'utf-8');
+        }
+        catch {
+            raw = '';
+        }
+        if (!raw) {
+            // No SARIF means the test genuinely failed (auth, network, no Code
+            // entitlement) — surface the CLI's first stderr line.
+            const firstErr = outcome.stderr
+                .split('\n')
+                .map((l) => l.trim())
+                .find((l) => l.length > 0);
+            throw new Error(`Snyk CLI produced no SARIF (exit ${outcome.code})${firstErr ? `: ${firstErr}` : ''}`);
+        }
+        return (0, sarif_1.parseSarif)(raw, 'snyk-code');
+    }
+    finally {
+        try {
+            fs.rmSync(workDir, { recursive: true, force: true });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+    }
+}
+//# sourceMappingURL=snyk-cli.js.map

package/dist/ingest/snyk-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snyk-cli.js","sourceRoot":"","sources":["../../src/ingest/snyk-cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,4CAIC;AAmBD,0CAmDC;AA5GD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,iDAAyC;AACzC,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,oEAA0F;AAC1F,sDAAwD;AACxD,mCAAqC;AAGrC,+DAA+D;AAClD,QAAA,cAAc,GAAG,gBAAgB,CAAC;AAE/C;sCACsC;AACtC,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,SAAiB;IACzE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,uBAAuB,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,IAAwB;IAC5D,OAAO,CAAC,GAAG,CAAC,sBAAc,CAAC,GAAG,GAAG,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAErC,IAAI,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,IAAA,wBAAQ,EAAC,IAAA,iCAAiB,EAAC,yBAAS,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,GAAG,CAAC,qEAAqE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAW,EAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE;YACpF,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;SAChD,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,mEAAmE;YACnE,sDAAsD;YACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;iBAC5B,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,oCAAoC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtF,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,kBAAU,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/ingest/types.d.ts

@@ -0,0 +1,68 @@
+/**
+ * External-findings ingestion types.
+ *
+ * dxkit's own scanners (semgrep, gitleaks, osv-scanner, npm-audit) are
+ * intraprocedural / dependency-level. Interprocedural taint SAST —
+ * the class of finding a proprietary engine like Snyk Code or an
+ * interprocedural engine like CodeQL produces — lives outside dxkit's
+ * bundled toolchain. Rather than try to out-detect those engines,
+ * dxkit *ingests* their output and makes it first-class: fingerprinted
+ * (Rule 9), aggregated (Rule 8), baselined (Rule 10), graph-linked
+ * (Rule 12), and fixable through the agent loop.
+ *
+ * Every supported engine funnels into the SAME normalized shape
+ * (`ExternalFinding`) so the rest of the pipeline is engine-agnostic.
+ * Adding an engine is a new *producer* (a function that returns
+ * `ExternalFinding[]`); the normalize → aggregate → graph → fix path
+ * never grows an engine-specific branch.
+ */
+import type { Severity, FindingCategory } from '../analyzers/security/types';
+/**
+ * The engines dxkit can ingest from. Each is a *producer* of
+ * `ExternalFinding[]`:
+ *
+ *   - `snyk-code`   — Snyk Code (SAST), read from the Snyk REST API
+ *                     (quota-free; reads stored results) or a SARIF
+ *                     export from `snyk code test --sarif`.
+ *   - `codeql`      — CodeQL, run on-demand where licensing permits
+ *                     (OSS / GitHub Advanced Security), emitting SARIF.
+ *   - `semgrep-pro` — Semgrep Pro engine (interprocedural), if a
+ *                     customer has it; SARIF.
+ *   - `sarif`       — a generic SARIF file from any other tool. The
+ *                     producer-of-last-resort; keeps dxkit open.
+ *
+ * The string also becomes the finding's `tool` provenance so reports
+ * and the aggregator can attribute each finding to its origin.
+ */
+export type SourceEngine = 'snyk-code' | 'codeql' | 'semgrep-pro' | 'sarif';
+/**
+ * One normalized finding from an external engine. Deliberately a
+ * superset-mappable shape: it carries exactly the fields the security
+ * aggregator's `SecurityFinding` needs, plus the provenance the report
+ * surfaces. Identity (`fingerprint`) is NOT computed here — it is
+ * assigned by the normalize layer through the canonical helpers so
+ * there is one fingerprint scheme across native + ingested findings
+ * (Rule 9).
+ */
+export interface ExternalFinding {
+    /** Engine that produced this finding; becomes the `tool` field. */
+    engine: SourceEngine;
+    /** Four-tier severity, already mapped from the engine's vocabulary. */
+    severity: Severity;
+    /** `code` for SAST taint findings; `secret`/`config` reserved for
+     *  engines that also emit those kinds. Dependency advisories are NOT
+     *  ingested here — dxkit's own dep-vuln gather is at parity. */
+    category: FindingCategory;
+    /** CWE identifier (e.g. `CWE-23`), or `''` when the engine gives none. */
+    cwe: string;
+    /** Engine-native rule id (e.g. `javascript/path-injection`,
+     *  `SNYK-JS-...`). Combined with `engine` to form the canonical rule. */
+    rule: string;
+    /** Human-readable one-line title. */
+    title: string;
+    /** Repo-relative source path. */
+    file: string;
+    /** 1-based line number of the primary location. */
+    line: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/ingest/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ingest/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,MAAM,EAAE,YAAY,CAAC;IACrB,uEAAuE;IACvE,QAAQ,EAAE,QAAQ,CAAC;IACnB;;oEAEgE;IAChE,QAAQ,EAAE,eAAe,CAAC;IAC1B,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ;6EACyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/ingest/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/ingest/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ingest/types.ts"],"names":[],"mappings":""}

package/dist/ingest-cli.d.ts

@@ -0,0 +1,21 @@
+export interface IngestOptions {
+    sarif?: string;
+    fromSnyk?: boolean;
+    codeql?: boolean;
+    /** Force the `snyk code test` CLI path, skipping the REST attempt. The
+     *  REST API is an Enterprise-only entitlement; free/team plans must use
+     *  the CLI (which costs one Snyk Code test from the quota). */
+    snykCli?: boolean;
+    /** Override engine label for `--sarif` (else inferred from the file). */
+    engine?: string;
+    /** Snyk identifiers (CLI flags override config / env). */
+    org?: string;
+    project?: string;
+    generatedAt: string;
+    commitSha?: string;
+}
+export declare function runIngest(cwd: string, opts: IngestOptions): Promise<void>;
+/** A REST failure that means "this plan can't read the API" — Enterprise-
+ *  only entitlement. We fall back to the CLI (Snyk Code product) path. */
+export declare function isNotEntitled(message: string): boolean;
+//# sourceMappingURL=ingest-cli.d.ts.map

package/dist/ingest-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-cli.d.ts","sourceRoot":"","sources":["../src/ingest-cli.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;mEAE+D;IAC/D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB/E;AAmDD;0EAC0E;AAC1E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/ingest-cli.js

@@ -0,0 +1,232 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runIngest = runIngest;
+exports.isNotEntitled = isNotEntitled;
+/**
+ * `vyuh-dxkit ingest` — bring an external SAST engine's findings into
+ * dxkit's pipeline.
+ *
+ * Two sources today:
+ *   --sarif <file>   parse a SARIF 2.1.0 file from ANY engine (CodeQL,
+ *                    Snyk Code export, Semgrep Pro, Bearer, …)
+ *   --from-snyk      read a project's Code findings from the Snyk REST
+ *                    API (quota-free) using SNYK_TOKEN + org/project.
+ *                    On plans without REST API access (Enterprise-only)
+ *                    this auto-falls-back to `snyk code test`; pass
+ *                    --snyk-cli to force that path and skip the REST try.
+ *
+ * Either way the result is written to `.dxkit/external/<engine>.json`,
+ * a committed snapshot every later scan reads — so the token is needed
+ * only by whoever runs `ingest` (ideally one CI refresh job), not by
+ * every developer.
+ */
+const fs = __importStar(require("fs"));
+const logger = __importStar(require("./logger"));
+const sarif_1 = require("./ingest/sarif");
+const snyk_api_1 = require("./ingest/snyk-api");
+const snyk_cli_1 = require("./ingest/snyk-cli");
+const codeql_1 = require("./ingest/codeql");
+const config_1 = require("./ingest/config");
+const snapshot_1 = require("./ingest/snapshot");
+const index_1 = require("./languages/index");
+function isSourceEngine(s) {
+    return s === 'snyk-code' || s === 'codeql' || s === 'semgrep-pro' || s === 'sarif';
+}
+async function runIngest(cwd, opts) {
+    if (opts.fromSnyk) {
+        await ingestFromSnyk(cwd, opts);
+        return;
+    }
+    if (opts.codeql) {
+        await ingestFromCodeql(cwd, opts);
+        return;
+    }
+    if (opts.sarif) {
+        ingestFromSarif(cwd, opts);
+        return;
+    }
+    logger.warn('Nothing to ingest. Pass --sarif <file>, --from-snyk, or --codeql.');
+    logger.dim('  Examples:');
+    logger.dim('    vyuh-dxkit ingest --sarif results.sarif');
+    logger.dim('    SNYK_TOKEN=… vyuh-dxkit ingest --from-snyk --org <id> --project <id>');
+    logger.dim('    SNYK_TOKEN=… vyuh-dxkit ingest --from-snyk --snyk-cli  # free/team plans');
+    logger.dim('    vyuh-dxkit ingest --codeql        # OSS / GitHub Advanced Security only');
+    process.exitCode = 1;
+}
+async function ingestFromCodeql(cwd, opts) {
+    // CodeQL languages come from the active packs' recipe (Rule 6), so a
+    // new pack auto-extends what gets scanned. JS+TS collapse to one
+    // `javascript` DB.
+    const targets = [];
+    const seen = new Set();
+    for (const pack of (0, index_1.detectActiveLanguages)(cwd)) {
+        const lang = pack.deepSast?.codeqlLanguage;
+        if (lang && !seen.has(lang)) {
+            seen.add(lang);
+            targets.push({ language: lang, querySuite: pack.deepSast?.codeqlQuerySuite });
+        }
+    }
+    if (targets.length === 0) {
+        logger.warn('No active language pack has a CodeQL extractor for this repo.');
+        process.exitCode = 1;
+        return;
+    }
+    logger.info(`Running CodeQL for: ${targets.map((t) => t.language).join(', ')} (this can take many minutes)…`);
+    let findings;
+    try {
+        findings = await (0, codeql_1.runCodeql)({ cwd, targets, onLog: (m) => logger.dim(`  ${m}`) });
+    }
+    catch (err) {
+        logger.warn(`CodeQL run failed: ${err.message}`);
+        process.exitCode = 1;
+        return;
+    }
+    writeAndReport(cwd, 'codeql', findings, opts);
+}
+function ingestFromSarif(cwd, opts) {
+    let raw;
+    try {
+        raw = fs.readFileSync(opts.sarif, 'utf-8');
+    }
+    catch (err) {
+        logger.warn(`Cannot read SARIF file ${opts.sarif}: ${err.message}`);
+        process.exitCode = 1;
+        return;
+    }
+    const engineOverride = isSourceEngine(opts.engine) ? opts.engine : undefined;
+    const findings = (0, sarif_1.parseSarif)(raw, engineOverride);
+    // All findings from one SARIF share an engine; use the first (or the
+    // override / generic `sarif`) as the snapshot's engine label.
+    const engine = engineOverride ?? findings[0]?.engine ?? 'sarif';
+    writeAndReport(cwd, engine, findings, opts);
+}
+/** A REST failure that means "this plan can't read the API" — Enterprise-
+ *  only entitlement. We fall back to the CLI (Snyk Code product) path. */
+function isNotEntitled(message) {
+    return /\b403\b/.test(message) || /not entitled/i.test(message) || /api access/i.test(message);
+}
+async function ingestFromSnyk(cwd, opts) {
+    const token = process.env.SNYK_TOKEN;
+    if (!token) {
+        logger.warn('SNYK_TOKEN is not set.');
+        logger.dim('  dxkit reads SNYK_TOKEN from the environment — it does NOT auto-load a .env file.');
+        logger.dim('  Export it (`export SNYK_TOKEN=…`) or add it as a CI secret, then retry.');
+        process.exitCode = 1;
+        return;
+    }
+    // Org/project resolve flag → persisted config (`.vyuh-dxkit.json:
+    // deepSast.snyk`) → environment, so a sourced shell or configured repo
+    // can run `ingest --from-snyk` with no flags. (dxkit does not read .env;
+    // export the vars or set CI secrets.)
+    const cfg = (0, config_1.readDeepSastConfig)(cwd);
+    const orgId = opts.org ?? cfg.snyk?.orgId ?? process.env.SNYK_ORG_ID;
+    const projectId = opts.project ?? cfg.snyk?.projectId ?? process.env.SNYK_PROJECT_ID;
+    // Forced CLI path (free/team plans): skip the REST attempt entirely. The
+    // CLI tests the local checkout, so it needs only the org (to scope the
+    // entitlement), not a project id.
+    if (opts.snykCli) {
+        await ingestViaSnykCli(cwd, opts, orgId);
+        return;
+    }
+    if (!orgId || !projectId) {
+        logger.warn('Snyk org + project are required to read findings via the REST API.');
+        logger.dim('  Pass --org <id> --project <id>, set them once in .vyuh-dxkit.json:');
+        logger.dim('    { "deepSast": { "snyk": { "orgId": "…", "projectId": "…" } } }');
+        logger.dim('  or export SNYK_ORG_ID / SNYK_PROJECT_ID in your environment.');
+        logger.dim('  Find them in the Snyk UI (Settings → Org ID; the project page URL → project ID).');
+        logger.dim('  On free/team plans (no REST API access) use --snyk-cli to run a Snyk Code test.');
+        process.exitCode = 1;
+        return;
+    }
+    logger.info('Reading Snyk Code findings via the REST API (no test quota consumed)…');
+    let findings;
+    try {
+        findings = await (0, snyk_api_1.fetchSnykCodeFindings)({
+            token,
+            orgId,
+            projectId,
+            apiBase: process.env.SNYK_API,
+        });
+    }
+    catch (err) {
+        const message = err.message;
+        // REST API access is an Enterprise feature; on other plans the read
+        // 403s. Fall back to `snyk code test` (Snyk Code product entitlement,
+        // which free includes) so one command works on every plan.
+        if (isNotEntitled(message)) {
+            logger.warn('Snyk REST API access is not available on this plan (an Enterprise feature).');
+            logger.dim('  Falling back to `snyk code test` (Snyk Code product, uses one test quota)…');
+            await ingestViaSnykCli(cwd, opts, orgId);
+            return;
+        }
+        logger.warn(`Snyk read failed: ${message}`);
+        process.exitCode = 1;
+        return;
+    }
+    writeAndReport(cwd, 'snyk-code', findings, opts);
+}
+/** Run `snyk code test` on the local checkout and snapshot the findings.
+ *  Used both as the explicit `--snyk-cli` path and as the REST fallback. */
+async function ingestViaSnykCli(cwd, opts, orgId) {
+    let findings;
+    try {
+        findings = await (0, snyk_cli_1.runSnykCodeTest)({ cwd, org: orgId, onLog: (m) => logger.dim(`  ${m}`) });
+    }
+    catch (err) {
+        logger.warn(`Snyk Code test failed: ${err.message}`);
+        process.exitCode = 1;
+        return;
+    }
+    writeAndReport(cwd, 'snyk-code', findings, opts);
+}
+function writeAndReport(cwd, engine, findings, opts) {
+    const file = (0, snapshot_1.writeSnapshot)(cwd, {
+        schemaVersion: 1,
+        engine,
+        generatedAt: opts.generatedAt,
+        ...(opts.commitSha ? { commitSha: opts.commitSha } : {}),
+        findings,
+    });
+    const bySev = findings.reduce((acc, f) => {
+        acc[f.severity] = (acc[f.severity] || 0) + 1;
+        return acc;
+    }, {});
+    logger.success(`Ingested ${findings.length} ${engine} finding(s) → ${file}`);
+    logger.dim(`  critical:${bySev.critical || 0} high:${bySev.high || 0} medium:${bySev.medium || 0} low:${bySev.low || 0}`);
+    logger.dim('  Commit .dxkit/external/ so every scan + CI run sees these without a token.');
+    logger.dim('  Next: `vyuh-dxkit vulnerabilities --graph-context` to see them graph-linked.');
+}
+//# sourceMappingURL=ingest-cli.js.map

package/dist/ingest-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-cli.js","sourceRoot":"","sources":["../src/ingest-cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,8BAoBC;AAqDD,sCAEC;AA7HD;;;;;;;;;;;;;;;;;GAiBG;AACH,uCAAyB;AACzB,iDAAmC;AACnC,0CAA4C;AAC5C,gDAA0D;AAC1D,gDAAoD;AACpD,4CAA+D;AAC/D,4CAAqD;AACrD,gDAAkD;AAClD,6CAA0D;AAoB1D,SAAS,cAAc,CAAC,CAAqB;IAC3C,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,OAAO,CAAC;AACrF,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAmB;IAC9D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACjF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC3F,MAAM,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAC1F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAmB;IAC9D,qEAAqE;IACrE,iEAAiE;IACjE,mBAAmB;IACnB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAA,6BAAqB,EAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;QAC3C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CACT,uBAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CACjG,CAAC;IACF,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,kBAAS,EAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,IAAmB;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAe,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAA,kBAAU,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,qEAAqE;IACrE,8DAA8D;IAC9D,MAAM,MAAM,GAAiB,cAAc,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,OAAO,CAAC;IAC9E,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;0EAC0E;AAC1E,SAAgB,aAAa,CAAC,OAAe;IAC3C,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,IAAmB;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CACR,oFAAoF,CACrF,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QACxF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,kEAAkE;IAClE,uEAAuE;IACvE,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,GAAG,GAAG,IAAA,2BAAkB,EAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAErF,yEAAyE;IACzE,uEAAuE;IACvE,kCAAkC;IAClC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QACjF,MAAM,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,CACR,oFAAoF,CACrF,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;QAChG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACrF,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,gCAAqB,EAAC;YACrC,KAAK;YACL,KAAK;YACL,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;QACvC,oEAAoE;QACpE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;YAC3F,MAAM,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC3F,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;4EAC4E;AAC5E,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,IAAmB,EACnB,KAAyB;IAEzB,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,0BAAe,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CACrB,GAAW,EACX,MAAoB,EACpB,QAA2B,EAC3B,IAAmB;IAEnB,MAAM,IAAI,GAAG,IAAA,wBAAa,EAAC,GAAG,EAAE;QAC9B,aAAa,EAAE,CAAC;QAChB,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAyB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC/D,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,MAAM,CAAC,OAAO,CAAC,YAAY,QAAQ,CAAC,MAAM,IAAI,MAAM,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,CACR,cAAc,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAC9G,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC3F,MAAM,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;AAC/F,CAAC"}