@xenos1996/usat 1.2.0 → 1.3.0

package/dist/bootstrap/catalog.d.ts

@@ -0,0 +1,41 @@
+import type { RuleClass, Severity } from '../types.js';
+/**
+ * Bootstrap knowledge: starter checks for languages USAT detects but ships
+ * no stack pack for. Every entry is a *proposal*, never a verdict — the
+ * generator emits packs for human review, and nothing it writes is
+ * registered or trusted until reviewed (see ADR-0012).
+ *
+ * Curation bar for inclusion here: the pattern must be dangerous wherever
+ * it appears (not merely smelly), with a false-positive rate low enough
+ * that a first run does not teach the user to ignore the tool. Presence
+ * checks ("is X used?") are excluded on purpose — without applicability
+ * facts they punish projects that simply have no passwords/sessions.
+ */
+export interface BootstrapCheck {
+    id: string;
+    title: string;
+    severity: Severity;
+    ruleClass: RuleClass;
+    kind: 'grep_wrong' | 'grep_absent' | 'grep_present' | 'grep_deprecated' | 'file_exists' | 'manual';
+    pattern?: string;
+    include?: string[];
+    exclude?: string[];
+    files?: string[];
+    why: string;
+    remediation: string;
+    evidence?: string;
+    references?: string[];
+}
+export interface BootstrapLang {
+    /** e.g. 'php' — matches the `lang:` fact suffix. */
+    lang: string;
+    /** e.g. 'stacks/php' — the pack id the generated file will carry. */
+    packId: string;
+    title: string;
+    description: string;
+    /** Framework facts worth adding detectors for next (printed, not applied). */
+    frameworkHints: string[];
+    checks: BootstrapCheck[];
+}
+export declare const BOOTSTRAP_CATALOG: BootstrapLang[];
+//# sourceMappingURL=catalog.d.ts.map

package/dist/bootstrap/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/bootstrap/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvD;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EACF,YAAY,GAAG,aAAa,GAAG,cAAc,GAAG,iBAAiB,GAAG,aAAa,GAAG,QAAQ,CAAC;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAID,eAAO,MAAM,iBAAiB,EAAE,aAAa,EAuY5C,CAAC"}

package/dist/bootstrap/catalog.js

@@ -0,0 +1,366 @@
+const TEST_EXCLUDES = ['**/*.test.*', '**/*.spec.*', '**/test/**', '**/tests/**'];
+export const BOOTSTRAP_CATALOG = [
+    {
+        lang: 'php',
+        packId: 'stacks/php',
+        title: 'PHP',
+        description: 'Starter checks for PHP projects. Generated — review every pattern before trusting.',
+        frameworkHints: [
+            'laravel (composer.json: laravel/framework), symfony (symfony/http-kernel), wordpress (wp-load.php)',
+        ],
+        checks: [
+            {
+                id: 'PHP-001',
+                title: 'No dynamic code execution',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: '(eval\\s*\\(|assert\\s*\\(\\s*["\']|create_function\\s*\\()',
+                include: ['**/*.php'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'eval() and string assert() execute arbitrary code; create_function() is removed in PHP 8 and fatal when called.',
+                remediation: 'Use closures or a dispatch table instead of eval; replace create_function with anonymous functions.',
+                references: ['CWE-95'],
+            },
+            {
+                id: 'PHP-002',
+                title: 'No shell execution from application code',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: '(shell_exec\\s*\\(|passthru\\s*\\(|popen\\s*\\(|proc_open\\s*\\()',
+                include: ['**/*.php'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'Shelling out with composed strings is command injection waiting for input.',
+                remediation: 'Use PHP-native APIs (filesystem, process control with argument arrays). If unavoidable, escapeshellarg every argument.',
+                references: ['CWE-78'],
+            },
+            {
+                id: 'PHP-003',
+                title: 'No unsafe unserialize()',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: 'unserialize\\s*\\(',
+                include: ['**/*.php'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'unserialize() on untrusted data is PHP object injection. Verify the source is never user-controlled.',
+                remediation: 'Prefer json_decode with assoc arrays; pass allowed_classes: false where unserialize is unavoidable.',
+                references: ['CWE-502'],
+            },
+            {
+                id: 'PHP-004',
+                title: 'No extract() over superglobals',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: 'extract\\s*\\(\\s*\\$_(GET|POST|REQUEST|COOKIE)',
+                include: ['**/*.php'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'extract() over request data lets callers overwrite any in-scope variable, including guards.',
+                remediation: 'Read explicit keys from the superglobal instead of importing the whole array.',
+                references: ['CWE-915'],
+            },
+            {
+                id: 'PHP-005',
+                title: 'Dependencies are locked',
+                severity: 'MEDIUM',
+                ruleClass: 'supply-chain',
+                kind: 'file_exists',
+                files: ['composer.lock'],
+                why: 'An unlocked composer.json installs whatever is newest at deploy time — unreviewed code in production.',
+                remediation: 'Commit composer.lock and install with --no-dev --optimize-autoloader in CI.',
+                references: ['CWE-829'],
+            },
+            {
+                id: 'PHP-006',
+                title: 'Authentication and session handling reviewed',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'manual',
+                why: 'No pattern can confirm passwords are hashed, sessions rotate, and cookies are HttpOnly + Secure + SameSite.',
+                remediation: 'Verify password_hash/password_verify, session_regenerate_id on login, and cookie flags.',
+                evidence: 'Login handler file:line, hashing call, session cookie attributes.',
+                references: ['ASVS-2.4.1', 'ASVS-3.2.2'],
+            },
+        ],
+    },
+    {
+        lang: 'ruby',
+        packId: 'stacks/ruby',
+        title: 'Ruby',
+        description: 'Starter checks for Ruby projects. Generated — review every pattern before trusting.',
+        frameworkHints: ['rails (Gemfile: rails, config/application.rb)', 'sinatra (sinatra gem)'],
+        checks: [
+            {
+                id: 'RB-001',
+                title: 'No dynamic code or shell execution',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: '(`|eval\\s*\\(|exec\\s*\\(|system\\s*\\()',
+                include: ['**/*.rb'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'Backticks, eval, exec, and system with composed strings are code and command injection.',
+                remediation: 'Use Open3 with argument arrays; replace eval with data-driven dispatch.',
+                references: ['CWE-95', 'CWE-78'],
+            },
+            {
+                id: 'RB-002',
+                title: 'No unsafe deserialization',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: '(YAML\\.load\\s*\\(|Marshal\\.load\\s*\\(|Oj\\.load\\s*\\()',
+                include: ['**/*.rb'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'YAML.load/Marshal.load instantiate arbitraryRuby objects. Verify trusted source or switch to safe_load with permitted classes.',
+                remediation: 'Use YAML.safe_load (allowlisted classes) and Oj.strict / Oj.safe modes.',
+                references: ['CWE-502'],
+            },
+            {
+                id: 'RB-003',
+                title: 'No interpolated SQL',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: '(execute\\s*\\(.*#\\{|find_by_sql\\s*\\(.*#\\{|where\\s*\\(["\'].*#\\{)',
+                include: ['**/*.rb'],
+                exclude: [...TEST_EXCLUDES, '**/db/migrate/**', '**/db/schema.rb'],
+                why: '#{} inside a SQL string interpolates before the driver sees it — parameterisation never happens.',
+                remediation: 'Use bound parameters (where(id: x), exec_query with binds) or sanitized arrays.',
+                references: ['CWE-89'],
+            },
+            {
+                id: 'RB-004',
+                title: 'Dependencies are locked',
+                severity: 'MEDIUM',
+                ruleClass: 'supply-chain',
+                kind: 'file_exists',
+                files: ['Gemfile.lock'],
+                why: 'An unlocked Gemfile installs whatever is newest at deploy time.',
+                remediation: 'Commit Gemfile.lock and install with --deployment --without development test in CI.',
+                references: ['CWE-829'],
+            },
+            {
+                id: 'RB-005',
+                title: 'Mass assignment and auth reviewed',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'manual',
+                why: 'Strong parameters, auth scoping, and CSRF coverage cannot be confirmed by grep.',
+                remediation: 'Verify permit() lists, before_action scoping, and protect_from_forgery on state-changing endpoints.',
+                evidence: 'Controller file:line of the permit list, auth filter, and CSRF configuration.',
+                references: ['ASVS-4.2.1', 'ASVS-5.1.2'],
+            },
+        ],
+    },
+    {
+        lang: 'cpp',
+        packId: 'stacks/cpp',
+        title: 'C / C++',
+        description: 'Starter checks for C and C++ projects. Generated — review every pattern before trusting.',
+        frameworkHints: [
+            'cmake (CMakeLists.txt), meson (meson.build), bazel (BUILD/WORKSPACE), autotools (configure.ac)',
+        ],
+        checks: [
+            {
+                id: 'CPP-001',
+                title: 'No banned string/memory functions',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: '\\b(strcpy|strcat|sprintf|gets)\\s*\\(',
+                include: ['**/*.{c,h,cc,cpp,cxx,hpp}'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'Unbounded copies into fixed buffers are the classic overflow primitive; gets() cannot be used safely at all.',
+                remediation: 'Use strncpy/strncat/snprintf (C) or std::string/absl/span (C++); delete every gets call.',
+                references: ['CWE-120', 'CWE-787'],
+            },
+            {
+                id: 'CPP-002',
+                title: 'No shell execution from application code',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: '\\b(system|popen)\\s*\\(',
+                include: ['**/*.{c,h,cc,cpp,cxx,hpp}'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'system()/popen() invoke a shell; composed commands are command injection.',
+                remediation: 'Use exec-family calls with argument vectors (fork+execve, posix_spawn) and no shell.',
+                references: ['CWE-78'],
+            },
+            {
+                id: 'CPP-003',
+                title: 'No unbounded scanf input',
+                severity: 'MEDIUM',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: 'scanf\\s*\\(\\s*"%s"',
+                include: ['**/*.{c,h,cc,cpp,cxx,hpp}'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'scanf("%s") writes unbounded input into the target buffer.',
+                remediation: 'Give every %s a field width ("%255s") or read lines with getline/fgets and parse.',
+                references: ['CWE-120'],
+            },
+            {
+                id: 'CPP-004',
+                title: 'Build is described in a manifest',
+                severity: 'MEDIUM',
+                ruleClass: 'operations',
+                kind: 'file_exists',
+                files: [
+                    'CMakeLists.txt',
+                    'Makefile',
+                    'meson.build',
+                    'configure.ac',
+                    'BUILD',
+                    'BUILD.bazel',
+                ],
+                why: 'An undocumented build means flags, defines, and warnings differ per machine.',
+                remediation: 'Check in a manifest with warnings enabled (-Wall -Wextra -Werror where feasible) and sanitizer presets.',
+            },
+            {
+                id: 'CPP-005',
+                title: 'Memory ownership reviewed',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'manual',
+                why: 'Use-after-free, double-free, and lifetime escapes need ownership reasoning no pattern provides.',
+                remediation: 'Prefer RAII/smart pointers; document ownership at every raw new/malloc boundary; run ASan+UBSan in CI.',
+                evidence: 'Ownership notes for new modules, sanitizer CI job, suppression-free sanitizer log.',
+                references: ['CWE-416', 'CWE-415'],
+            },
+        ],
+    },
+    {
+        lang: 'csharp',
+        packId: 'stacks/csharp',
+        title: 'C# / .NET',
+        description: 'Starter checks for C# projects. Generated — review every pattern before trusting.',
+        frameworkHints: [
+            'aspnet (*.csproj referencing Microsoft.AspNetCore), efcore (EntityFrameworkCore)',
+        ],
+        checks: [
+            {
+                id: 'CS-001',
+                title: 'No insecure deserializers',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_deprecated',
+                pattern: '(BinaryFormatter|LosFormatter|ObjectStateFormatter|SoapFormatter)',
+                include: ['**/*.cs'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'These deserializers execute attacker-controlled type graphs on.NET Framework and are discouraged everywhere.',
+                remediation: 'Use System.Text.Json or XmlSerializer with a restricted reader; treat any BinaryFormatter hit as a finding.',
+                references: ['CWE-502'],
+            },
+            {
+                id: 'CS-002',
+                title: 'No concatenated process arguments',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: 'Process\\.Start\\s*\\([^)]*\\+',
+                include: ['**/*.cs'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'A Process.Start argument string built with + passes through shell parsing on part of the input.',
+                remediation: 'Set ProcessStartInfo.ArgumentList entries individually with UseShellExecute = false.',
+                references: ['CWE-78'],
+            },
+            {
+                id: 'CS-003',
+                title: 'Dependencies are locked',
+                severity: 'MEDIUM',
+                ruleClass: 'supply-chain',
+                kind: 'file_exists',
+                files: ['packages.lock.json'],
+                why: 'Without lock files, restores float to newest compatible packages at build time.',
+                remediation: 'Enable lock files (RestorePackagesWithLockFile / Continuous) and commit them.',
+                references: ['CWE-829'],
+            },
+            {
+                id: 'CS-004',
+                title: 'Hash algorithm choices inventoried',
+                severity: 'MEDIUM',
+                ruleClass: 'security',
+                kind: 'manual',
+                why: 'MD5/SHA1 appear legitimately for checksums and illegitimately for passwords — only a human can classify each use.',
+                remediation: 'List every hash call site; passwords go to PBKDF2/bcrypt/Argon2 via ASP.NET Identity or equivalent.',
+                evidence: 'File:line per hash use with password-vs-checksum classification.',
+                references: ['CWE-327', 'CWE-916'],
+            },
+            {
+                id: 'CS-005',
+                title: 'Authorization reviewed per endpoint',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'manual',
+                why: '[Authorize] placement and policy names cannot be verified by pattern.',
+                remediation: 'Default-deny with FallbackPolicy or explicit [Authorize] everywhere; verify resource-level checks, not just authentication.',
+                evidence: 'Fallback policy or endpoint audit file:line, plus one ownership check.',
+                references: ['ASVS-4.2.1'],
+            },
+        ],
+    },
+    {
+        lang: 'swift',
+        packId: 'stacks/swift',
+        title: 'Swift',
+        description: 'Starter checks for Swift projects. Generated — review every pattern before trusting.',
+        frameworkHints: [
+            'vapor (Package.swift: .package(url: ...vapor...)), swiftui (import SwiftUI), combine',
+        ],
+        checks: [
+            {
+                id: 'SW-001',
+                title: 'No force-unwrap or force-try in application code',
+                severity: 'MEDIUM',
+                ruleClass: 'correctness',
+                kind: 'grep_wrong',
+                pattern: '(try!\\s|as!\\s)',
+                include: ['**/*.swift'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'try!/as! turn recoverable failures into crashes. Tests may keep them; shipped code should not.',
+                remediation: 'Handle errors with do/catch or propagate with try; replace as! with as? plus a guard.',
+                references: ['CWE-754'],
+            },
+            {
+                id: 'SW-002',
+                title: 'App Transport Security is not disabled',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'grep_wrong',
+                pattern: '(NSAllowsArbitraryLoads|NSExceptionAllowsInsecureHTTPLoads)',
+                include: ['**/*.plist', '**/*.swift'],
+                exclude: [...TEST_EXCLUDES],
+                why: 'Disabling ATS reopens plaintext HTTP for the whole app or exception domains.',
+                remediation: 'Remove the exception keys; pin exception domains narrowly with justification if truly required.',
+                references: ['CWE-319'],
+            },
+            {
+                id: 'SW-003',
+                title: 'Dependencies are pinned',
+                severity: 'MEDIUM',
+                ruleClass: 'supply-chain',
+                kind: 'file_exists',
+                files: ['Package.resolved'],
+                why: 'An unpinned Package.swift resolves newest compatibles at build time.',
+                remediation: 'Commit Package.resolved so every build resolves identically.',
+                references: ['CWE-829'],
+            },
+            {
+                id: 'SW-004',
+                title: 'Secrets live in the Keychain with data protection',
+                severity: 'HIGH',
+                ruleClass: 'security',
+                kind: 'manual',
+                why: 'UserDefaults/plist storage of tokens and missing file-protection classes need a human to confirm.',
+                remediation: 'Store credentials via SecItem with kSecAttrAccessibleWhenUnlockedThisDeviceOnly or stronger; set NSFileProtectionComplete.',
+                evidence: 'SecItem call sites file:line, UserDefaults keys inventory, file-protection settings.',
+                references: ['ASVS-2.10.1', 'MASVS-STORAGE'],
+            },
+        ],
+    },
+];
+//# sourceMappingURL=catalog.js.map

package/dist/bootstrap/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/bootstrap/catalog.ts"],"names":[],"mappings":"AA4CA,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD;QACE,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,KAAK;QACZ,WAAW,EACT,oFAAoF;QACtF,cAAc,EAAE;YACd,oGAAoG;SACrG;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,2BAA2B;gBAClC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,6DAA6D;gBACtE,OAAO,EAAE,CAAC,UAAU,CAAC;gBACrB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,iHAAiH;gBACtH,WAAW,EACT,qGAAqG;gBACvG,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,0CAA0C;gBACjD,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,mEAAmE;gBAC5E,OAAO,EAAE,CAAC,UAAU,CAAC;gBACrB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,4EAA4E;gBACjF,WAAW,EACT,wHAAwH;gBAC1H,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,yBAAyB;gBAChC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,oBAAoB;gBAC7B,OAAO,EAAE,CAAC,UAAU,CAAC;gBACrB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,sGAAsG;gBAC3G,WAAW,EACT,qGAAqG;gBACvG,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,gCAAgC;gBACvC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,iDAAiD;gBAC1D,OAAO,EAAE,CAAC,UAAU,CAAC;gBACrB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,6FAA6F;gBAClG,WAAW,EACT,+EAA+E;gBACjF,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,yBAAyB;gBAChC,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,CAAC,eAAe,CAAC;gBACxB,GAAG,EAAE,uGAAuG;gBAC5G,WAAW,EAAE,6EAA6E;gBAC1F,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,8CAA8C;gBACrD,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,6GAA6G;gBAClH,WAAW,EACT,yFAAyF;gBAC3F,QAAQ,EAAE,mEAAmE;gBAC7E,UAAU,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;aACzC;SACF;KACF;IACD;QACE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,MAAM;QACb,WAAW,EACT,qFAAqF;QACvF,cAAc,EAAE,CAAC,+CAA+C,EAAE,uBAAuB,CAAC;QAC1F,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,oCAAoC;gBAC3C,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,2CAA2C;gBACpD,OAAO,EAAE,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,yFAAyF;gBAC9F,WAAW,EAAE,yEAAyE;gBACtF,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACjC;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,2BAA2B;gBAClC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,6DAA6D;gBACtE,OAAO,EAAE,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,gIAAgI;gBACrI,WAAW,EAAE,yEAAyE;gBACtF,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,qBAAqB;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,yEAAyE;gBAClF,OAAO,EAAE,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,CAAC,GAAG,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;gBAClE,GAAG,EAAE,kGAAkG;gBACvG,WAAW,EACT,iFAAiF;gBACnF,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,CAAC,cAAc,CAAC;gBACvB,GAAG,EAAE,iEAAiE;gBACtE,WAAW,EACT,qFAAqF;gBACvF,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,mCAAmC;gBAC1C,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,iFAAiF;gBACtF,WAAW,EACT,qGAAqG;gBACvG,QAAQ,EAAE,+EAA+E;gBACzF,UAAU,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;aACzC;SACF;KACF;IACD;QACE,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,0FAA0F;QAC5F,cAAc,EAAE;YACd,gGAAgG;SACjG;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,mCAAmC;gBAC1C,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,wCAAwC;gBACjD,OAAO,EAAE,CAAC,2BAA2B,CAAC;gBACtC,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,8GAA8G;gBACnH,WAAW,EACT,0FAA0F;gBAC5F,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aACnC;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,0CAA0C;gBACjD,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,0BAA0B;gBACnC,OAAO,EAAE,CAAC,2BAA2B,CAAC;gBACtC,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,2EAA2E;gBAChF,WAAW,EACT,sFAAsF;gBACxF,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,0BAA0B;gBACjC,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,sBAAsB;gBAC/B,OAAO,EAAE,CAAC,2BAA2B,CAAC;gBACtC,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,4DAA4D;gBACjE,WAAW,EACT,mFAAmF;gBACrF,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,kCAAkC;gBACzC,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,YAAY;gBACvB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE;oBACL,gBAAgB;oBAChB,UAAU;oBACV,aAAa;oBACb,cAAc;oBACd,OAAO;oBACP,aAAa;iBACd;gBACD,GAAG,EAAE,8EAA8E;gBACnF,WAAW,EACT,yGAAyG;aAC5G;YACD;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,2BAA2B;gBAClC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,iGAAiG;gBACtG,WAAW,EACT,wGAAwG;gBAC1G,QAAQ,EACN,oFAAoF;gBACtF,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aACnC;SACF;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE,WAAW;QAClB,WAAW,EACT,mFAAmF;QACrF,cAAc,EAAE;YACd,kFAAkF;SACnF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,2BAA2B;gBAClC,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,mEAAmE;gBAC5E,OAAO,EAAE,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,8GAA8G;gBACnH,WAAW,EACT,6GAA6G;gBAC/G,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,mCAAmC;gBAC1C,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,gCAAgC;gBACzC,OAAO,EAAE,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,iGAAiG;gBACtG,WAAW,EACT,sFAAsF;gBACxF,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,CAAC,oBAAoB,CAAC;gBAC7B,GAAG,EAAE,iFAAiF;gBACtF,WAAW,EACT,+EAA+E;gBACjF,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,oCAAoC;gBAC3C,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,mHAAmH;gBACxH,WAAW,EACT,qGAAqG;gBACvG,QAAQ,EAAE,kEAAkE;gBAC5E,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aACnC;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,qCAAqC;gBAC5C,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,uEAAuE;gBAC5E,WAAW,EACT,6HAA6H;gBAC/H,QAAQ,EAAE,wEAAwE;gBAClF,UAAU,EAAE,CAAC,YAAY,CAAC;aAC3B;SACF;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,OAAO;QACd,WAAW,EACT,sFAAsF;QACxF,cAAc,EAAE;YACd,sFAAsF;SACvF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,kDAAkD;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,aAAa;gBACxB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,kBAAkB;gBAC3B,OAAO,EAAE,CAAC,YAAY,CAAC;gBACvB,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,gGAAgG;gBACrG,WAAW,EACT,uFAAuF;gBACzF,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,wCAAwC;gBAC/C,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,6DAA6D;gBACtE,OAAO,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;gBACrC,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC3B,GAAG,EAAE,8EAA8E;gBACnF,WAAW,EACT,iGAAiG;gBACnG,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,cAAc;gBACzB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,CAAC,kBAAkB,CAAC;gBAC3B,GAAG,EAAE,sEAAsE;gBAC3E,WAAW,EAAE,8DAA8D;gBAC3E,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,mDAAmD;gBAC1D,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,UAAU;gBACrB,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,mGAAmG;gBACxG,WAAW,EACT,4HAA4H;gBAC9H,QAAQ,EACN,sFAAsF;gBACxF,UAAU,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;aAC7C;SACF;KACF;CACF,CAAC"}

package/dist/bootstrap/index.d.ts

@@ -0,0 +1,36 @@
+import type { Facts } from '../types.js';
+/**
+ * Self-extension: USAT auditing stacks it ships no pack for.
+ *
+ * Detection already names the language (`lang:php`); what is missing is the
+ * *rules*. `bootstrapPacks` turns that gap into a starter pack per
+ * uncovered language: curated high-signal checks from the catalog, or a
+ * clearly-marked generic fallback when the language is unknown even here.
+ *
+ * Fail-closed by design (see ADR-0012):
+ * - Nothing is registered in `rules/index.yaml` automatically.
+ * - Every emitted file carries a REVIEW-REQUIRED header.
+ * - The CLI prints; it only writes with an explicit `--out`.
+ */
+export interface BootstrapPack {
+    /** e.g. 'stacks/php' — the id the file will carry. */
+    packId: string;
+    /** e.g. 'stacks/php.yaml' — relative filename for `--out <dir>`. */
+    filename: string;
+    yaml: string;
+}
+export interface BootstrapOutcome {
+    packs: BootstrapPack[];
+    /** Languages already covered by a shipped pack (nothing to do). */
+    coveredLangs: string[];
+    /** Languages generated from curated catalog entries. */
+    generatedLangs: string[];
+    /** Languages generated from the generic fallback (extra review needed). */
+    fallbackLangs: string[];
+    /** Human next-steps, printed after the packs. */
+    notes: string[];
+}
+export declare function bootstrapPacks(facts: Facts): BootstrapOutcome;
+/** Write generated packs: `--out <dir>` for any count, `--out <file>` for one. */
+export declare function writeBootstrapPacks(outcome: BootstrapOutcome, out: string): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/bootstrap/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bootstrap/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,mEAAmE;IACnE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wDAAwD;IACxD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAeD,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,CAuB7D;AAuID,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAehF"}

package/dist/bootstrap/index.js

@@ -0,0 +1,174 @@
+import { stringify as stringifyYaml } from 'yaml';
+import fs from 'node:fs';
+import path from 'node:path';
+import { BOOTSTRAP_CATALOG } from './catalog.js';
+/** Detected languages with a shipped stack pack — no bootstrap needed. */
+const COVERED_LANGS = {
+    typescript: 'stacks/node-typescript',
+    javascript: 'stacks/node-typescript',
+    python: 'stacks/python',
+    go: 'stacks/go',
+    rust: 'stacks/rust',
+    java: 'stacks/jvm',
+    kotlin: 'stacks/jvm',
+    scala: 'stacks/jvm',
+    solidity: 'stacks/solidity',
+};
+export function bootstrapPacks(facts) {
+    const langs = [...facts.flags]
+        .filter((f) => f.startsWith('lang:'))
+        .map((f) => f.slice('lang:'.length))
+        .sort();
+    const outcome = {
+        packs: [],
+        coveredLangs: [],
+        generatedLangs: [],
+        fallbackLangs: [],
+        notes: [],
+    };
+    for (const lang of langs) {
+        if (COVERED_LANGS[lang]) {
+            outcome.coveredLangs.push(lang);
+            continue;
+        }
+        const entry = BOOTSTRAP_CATALOG.find((e) => e.lang === lang);
+        outcome.packs.push(entry ? renderCatalogPack(entry) : renderFallbackPack(lang));
+        (entry ? outcome.generatedLangs : outcome.fallbackLangs).push(lang);
+    }
+    outcome.notes = buildNotes(outcome);
+    return outcome;
+}
+const REVIEW_HEADER = `# =============================================================================
+# GENERATED by \`usat bootstrap\` — REVIEW REQUIRED before use.
+# This pack is a starting proposal, not an audit verdict. Before trusting it:
+#   1. Read every pattern. Delete any that misfires on your codebase.
+#   2. Audit one project WITH the problem and one WITHOUT it (see
+#      CONTRIBUTING.md "Testing a rule"); both runs must behave.
+#   3. Add FP/FN regression tests to tests/rules.test.ts.
+#   4. Register the reviewed file in rules/index.yaml.
+# Until then it stays out of the index and out of every score.
+# =============================================================================
+`;
+function renderCatalogPack(entry) {
+    const doc = {
+        id: entry.packId,
+        title: entry.title,
+        section: 'S15',
+        section_title: 'Platform-Specific',
+        description: `${entry.description} (bootstrap v0.1 — unreviewed)`,
+        version: '0.1.0-bootstrap',
+        skip_when: { all: [{ fact: `lang:${entry.lang}`, op: 'absent' }] },
+        rules: entry.checks.map(renderCheck),
+    };
+    return {
+        packId: entry.packId,
+        filename: `${entry.packId}.yaml`,
+        yaml: `${REVIEW_HEADER}${stringifyYaml(doc)}`,
+    };
+}
+/** Last resort for languages with no curated knowledge: judgement prompts. */
+function renderFallbackPack(lang) {
+    const prefix = lang.slice(0, 3).toUpperCase();
+    const packId = `stacks/${lang}`;
+    const doc = {
+        id: packId,
+        title: lang,
+        section: 'S15',
+        section_title: 'Platform-Specific',
+        description: `Fallback prompts for ${lang} — USAT has no curated checks for this language yet. Human review carries this pack. (bootstrap v0.1 — unreviewed)`,
+        version: '0.1.0-bootstrap',
+        skip_when: { all: [{ fact: `lang:${lang}`, op: 'absent' }] },
+        rules: [
+            {
+                id: `${prefix}-001`,
+                title: 'Security-sensitive operations reviewed',
+                section: 'S15',
+                section_title: 'Platform-Specific',
+                severity: 'HIGH',
+                class: 'security',
+                check: { kind: 'manual' },
+                why: `No automated ${lang} checks exist yet; dangerous operations need human review.`,
+                remediation: `Review ${lang} entry points for injection, auth gaps, and secret handling.`,
+                evidence: `File:line of each reviewed sink plus the verdict.`,
+            },
+            {
+                id: `${prefix}-002`,
+                title: 'Dependencies and build reviewed',
+                section: 'S15',
+                section_title: 'Platform-Specific',
+                severity: 'MEDIUM',
+                class: 'supply-chain',
+                check: { kind: 'manual' },
+                why: `Dependency pinning and build provenance for ${lang} are unverified.`,
+                remediation: 'Pin and lock dependencies; verify the lockfile is committed.',
+                evidence: 'Lockfile path, or the decision that none applies.',
+            },
+        ],
+    };
+    return { packId, filename: `${packId}.yaml`, yaml: `${REVIEW_HEADER}${stringifyYaml(doc)}` };
+}
+const BOOTSTRAP_CHECK_BUILDERS = {
+    grep_wrong: (c) => grepCheck('grep_wrong', c),
+    grep_absent: (c) => grepCheck('grep_absent', c),
+    grep_present: (c) => grepCheck('grep_present', c),
+    grep_deprecated: (c) => grepCheck('grep_deprecated', c),
+    file_exists: (c) => ({ kind: 'file_exists', files: c.files ?? [] }),
+    manual: () => ({ kind: 'manual' }),
+};
+function grepCheck(kind, c) {
+    return {
+        kind,
+        pattern: c.pattern ?? '',
+        include: c.include ?? [],
+        ...(c.exclude ? { exclude: c.exclude } : {}),
+        flags: 'i',
+    };
+}
+function renderCheck(c) {
+    return {
+        id: c.id,
+        title: c.title,
+        section: 'S15',
+        section_title: 'Platform-Specific',
+        severity: c.severity,
+        class: c.ruleClass,
+        check: BOOTSTRAP_CHECK_BUILDERS[c.kind](c),
+        why: c.why,
+        remediation: c.remediation,
+        ...(c.evidence ? { evidence: c.evidence } : {}),
+        ...(c.references ? { references: c.references } : {}),
+    };
+}
+function buildNotes(outcome) {
+    const notes = [];
+    if (outcome.coveredLangs.length > 0) {
+        notes.push(`already covered (no action): ${outcome.coveredLangs.join(', ')}`);
+    }
+    for (const lang of outcome.generatedLangs) {
+        const entry = BOOTSTRAP_CATALOG.find((e) => e.lang === lang);
+        notes.push(`${lang}: curated starter pack generated (${entry.checks.length} checks). ` +
+            `Suggested framework detectors next: ${entry.frameworkHints.join('; ')}.`);
+    }
+    for (const lang of outcome.fallbackLangs) {
+        notes.push(`${lang}: no curated knowledge — generic judgement prompts generated. ` +
+            'Author real checks from this codebase before trusting any score.');
+    }
+    notes.push('Next: review each file, test against good/bad fixtures, register in rules/index.yaml.');
+    return notes;
+}
+/** Write generated packs: `--out <dir>` for any count, `--out <file>` for one. */
+export function writeBootstrapPacks(outcome, out) {
+    if (!out.endsWith('.yaml') && !out.endsWith('.yml')) {
+        fs.mkdirSync(out, { recursive: true });
+        for (const pack of outcome.packs) {
+            fs.writeFileSync(path.join(out, path.basename(pack.filename)), pack.yaml, 'utf8');
+        }
+        return;
+    }
+    if (outcome.packs.length !== 1) {
+        throw new Error(`--out points at a file but ${outcome.packs.length} packs were generated — point --out at a directory instead.`);
+    }
+    fs.mkdirSync(path.dirname(path.resolve(out)), { recursive: true });
+    fs.writeFileSync(out, outcome.packs[0].yaml, 'utf8');
+}
+//# sourceMappingURL=index.js.map

package/dist/bootstrap/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bootstrap/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAA2C,MAAM,cAAc,CAAC;AAoC1F,0EAA0E;AAC1E,MAAM,aAAa,GAA2B;IAC5C,UAAU,EAAE,wBAAwB;IACpC,UAAU,EAAE,wBAAwB;IACpC,MAAM,EAAE,eAAe;IACvB,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,iBAAiB;CAC5B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,KAAY;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SACnC,IAAI,EAAE,CAAC;IACV,MAAM,OAAO,GAAqB;QAChC,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,aAAa,EAAE,EAAE;QACjB,KAAK,EAAE,EAAE;KACV,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,aAAa,GAAG;;;;;;;;;;CAUrB,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAoB;IAC7C,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,KAAK,CAAC,MAAM;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,mBAAmB;QAClC,WAAW,EAAE,GAAG,KAAK,CAAC,WAAW,gCAAgC;QACjE,OAAO,EAAE,iBAAiB;QAC1B,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAClE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;KACrC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,GAAG,KAAK,CAAC,MAAM,OAAO;QAChC,IAAI,EAAE,GAAG,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,UAAU,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,mBAAmB;QAClC,WAAW,EAAE,wBAAwB,IAAI,oHAAoH;QAC7J,OAAO,EAAE,iBAAiB;QAC1B,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC5D,KAAK,EAAE;YACL;gBACE,EAAE,EAAE,GAAG,MAAM,MAAM;gBACnB,KAAK,EAAE,wCAAwC;gBAC/C,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,mBAAmB;gBAClC,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,GAAG,EAAE,gBAAgB,IAAI,4DAA4D;gBACrF,WAAW,EAAE,UAAU,IAAI,8DAA8D;gBACzF,QAAQ,EAAE,mDAAmD;aAC9D;YACD;gBACE,EAAE,EAAE,GAAG,MAAM,MAAM;gBACnB,KAAK,EAAE,iCAAiC;gBACxC,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,mBAAmB;gBAClC,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,cAAc;gBACrB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,GAAG,EAAE,+CAA+C,IAAI,kBAAkB;gBAC1E,WAAW,EAAE,8DAA8D;gBAC3E,QAAQ,EAAE,mDAAmD;aAC9D;SACF;KACF,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;AAC/F,CAAC;AAID,MAAM,wBAAwB,GAA0D;IACtF,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;IACnE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;CACnC,CAAC;AAEF,SAAS,SAAS,CAAC,IAAY,EAAE,CAAiB;IAChD,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;QACxB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,KAAK,EAAE,GAAG;KACX,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAiB;IACpC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,mBAAmB;QAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,SAAS;QAClB,KAAK,EAAE,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAyB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,gCAAgC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,qCAAqC,KAAK,CAAC,MAAM,CAAC,MAAM,YAAY;YACzE,uCAAuC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,gEAAgE;YACrE,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,uFAAuF,CACxF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,OAAyB,EAAE,GAAW;IACxE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpF,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,CAAC,KAAK,CAAC,MAAM,6DAA6D,CAChH,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC"}