circle-ir-ai 2.32.0 → 2.33.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +137 -0
- package/dist/agents/mastra/agents.d.ts +8 -8
- package/dist/agents/mastra/agents.d.ts.map +1 -1
- package/dist/agents/mastra/instance.d.ts +9 -9
- package/dist/agents/mastra/steps.d.ts +5 -5
- package/dist/agents/mastra/workflow.d.ts +12 -0
- package/dist/agents/mastra/workflow.d.ts.map +1 -1
- package/dist/agents/mastra/workflow.js +16 -1
- package/dist/agents/mastra/workflow.js.map +1 -1
- package/dist/cache/backend.d.ts +5 -1
- package/dist/cache/backend.d.ts.map +1 -1
- package/dist/cache/backends/layout.js +1 -1
- package/dist/cache/backends/layout.js.map +1 -1
- package/dist/cache/cluster-cache.d.ts +113 -0
- package/dist/cache/cluster-cache.d.ts.map +1 -0
- package/dist/cache/cluster-cache.js +195 -0
- package/dist/cache/cluster-cache.js.map +1 -0
- package/dist/cache/tree-cache.d.ts +11 -0
- package/dist/cache/tree-cache.d.ts.map +1 -1
- package/dist/cache/tree-cache.js.map +1 -1
- package/dist/security-scan/scanner.d.ts +141 -0
- package/dist/security-scan/scanner.d.ts.map +1 -1
- package/dist/security-scan/scanner.js +231 -2
- package/dist/security-scan/scanner.js.map +1 -1
- package/package.json +2 -2
|
@@ -0,0 +1,113 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Cluster Cache
|
|
3
|
+
*
|
|
4
|
+
* Persistent on-disk cache for `clusterFiles()` output (cognium-ai#154,
|
|
5
|
+
* P4 of epic #155 wiring — Sprint L5c).
|
|
6
|
+
*
|
|
7
|
+
* K-medoids assignments are a pure function of:
|
|
8
|
+
* - the set of file paths in the scan
|
|
9
|
+
* - each file's CK vector + imports + annotations (structural
|
|
10
|
+
* fingerprint from `extractClusterVector`)
|
|
11
|
+
* - the algorithm version sentinel `PROMPT_VER = 'cluster-v1'`
|
|
12
|
+
* - the rule-set fingerprint + normalized project profile
|
|
13
|
+
* (rules/profile don't affect the clustering *result*, but do
|
|
14
|
+
* affect downstream policy application, so we key on them anyway
|
|
15
|
+
* for cross-runner replay safety)
|
|
16
|
+
*
|
|
17
|
+
* Caching this eliminates the O(n²) distance-matrix pass + k-medoids
|
|
18
|
+
* swap phase on warm re-scans of the same repo, which is the hot path
|
|
19
|
+
* during iterative development.
|
|
20
|
+
*
|
|
21
|
+
* **Scope:** caches whole-repo `ClusterResult` only. Never per-file.
|
|
22
|
+
*
|
|
23
|
+
* **Key composition:**
|
|
24
|
+
*
|
|
25
|
+
* content = ckVectorSig + '\0' + circleIrVersion + '\0' +
|
|
26
|
+
* circleIrAiVersion + '\0' + ruleSetFingerprint + '\0' +
|
|
27
|
+
* PROMPT_VER + '\0' + k
|
|
28
|
+
* classifier = 'cluster-kmedoids'
|
|
29
|
+
*
|
|
30
|
+
* `ckVectorSig` folds the sorted (filePath, vector-signature) pairs —
|
|
31
|
+
* matches the shape `deriveSeed()` uses in cluster.ts:316-326 so the
|
|
32
|
+
* cache key changes exactly when the cluster assignments would.
|
|
33
|
+
*
|
|
34
|
+
* Any of: file add/remove, file structural edit, circle-ir bump,
|
|
35
|
+
* circle-ir-ai bump, rule-set change, k change, PROMPT_VER bump →
|
|
36
|
+
* cache miss.
|
|
37
|
+
*
|
|
38
|
+
* **Env toggles:**
|
|
39
|
+
* LLM_CLUSTER_CACHE=0 → disable persistent cluster cache.
|
|
40
|
+
*/
|
|
41
|
+
import { ClassificationCache } from './classification-cache.js';
|
|
42
|
+
import type { ClusterInput, ClusterResult } from '../cluster/cluster.js';
|
|
43
|
+
/**
|
|
44
|
+
* On-disk envelope. Mirrors `ClusterResult` from cluster.ts but adds a
|
|
45
|
+
* schema tag + captured versions so a future format change is
|
|
46
|
+
* self-describing at read time. Kept separate from `ClusterResult`
|
|
47
|
+
* itself so downstream consumers of the runtime API don't drag the
|
|
48
|
+
* cache envelope into their surface.
|
|
49
|
+
*/
|
|
50
|
+
export interface ClusterCacheEntry {
|
|
51
|
+
schema: 'cluster:v1';
|
|
52
|
+
k: number;
|
|
53
|
+
assignments: Array<{
|
|
54
|
+
filePath: string;
|
|
55
|
+
clusterId: number;
|
|
56
|
+
}>;
|
|
57
|
+
medoids: string[];
|
|
58
|
+
iterations: number;
|
|
59
|
+
/** SHA256 of the input CK-vector signature (for debugging cache hits). */
|
|
60
|
+
ckVectorSig: string;
|
|
61
|
+
/** Wall-clock timestamp at write. Diagnostic only; TTL comes from ClassificationCache. */
|
|
62
|
+
computedAt: number;
|
|
63
|
+
}
|
|
64
|
+
/**
|
|
65
|
+
* Get the cluster-cache singleton. When `LLM_CLUSTER_CACHE=0` returns
|
|
66
|
+
* a disabled cache that no-ops on get/set.
|
|
67
|
+
*/
|
|
68
|
+
export declare function getClusterCache(): ClassificationCache<ClusterCacheEntry>;
|
|
69
|
+
/** Reset the module-scoped singleton — test-only. */
|
|
70
|
+
export declare function resetClusterCache(): void;
|
|
71
|
+
/**
|
|
72
|
+
* Fold the sorted (filePath, per-file vector signature) pairs into a
|
|
73
|
+
* single stable string. Mirrors the shape used by `deriveSeed()` in
|
|
74
|
+
* cluster.ts:316-326 so the cache key changes exactly when the cluster
|
|
75
|
+
* result would.
|
|
76
|
+
*/
|
|
77
|
+
export declare function ckVectorSignature(inputs: ClusterInput[]): string;
|
|
78
|
+
/**
|
|
79
|
+
* Compute the `(content, classifier)` tuple for the underlying
|
|
80
|
+
* ClassificationCache. `ruleSetFingerprint` is threaded through so
|
|
81
|
+
* two runners on the same repo but different rule sets don't share
|
|
82
|
+
* (they'd apply different policies downstream even on identical
|
|
83
|
+
* cluster assignments).
|
|
84
|
+
*/
|
|
85
|
+
export declare function computeClusterCacheKey(input: {
|
|
86
|
+
inputs: ClusterInput[];
|
|
87
|
+
k: number;
|
|
88
|
+
ruleSetFingerprint?: string;
|
|
89
|
+
}): {
|
|
90
|
+
content: string;
|
|
91
|
+
classifier: string;
|
|
92
|
+
ckVectorSig: string;
|
|
93
|
+
};
|
|
94
|
+
/** Test-only: expose the captured engine versions for assertions. */
|
|
95
|
+
export declare function getClusterCacheVersions(): {
|
|
96
|
+
circleIrVersion: string;
|
|
97
|
+
circleIrAiVersion: string;
|
|
98
|
+
};
|
|
99
|
+
/** Test-only: expose the prompt-version sentinel. */
|
|
100
|
+
export declare function getClusterCachePromptVersion(): string;
|
|
101
|
+
/**
|
|
102
|
+
* Convert a runtime `ClusterResult` into the persisted envelope shape.
|
|
103
|
+
* Split out so the scanner call site doesn't have to know about the
|
|
104
|
+
* envelope; test suite uses it as a factory too.
|
|
105
|
+
*/
|
|
106
|
+
export declare function toCacheEntry(result: ClusterResult, ckVectorSig: string): ClusterCacheEntry;
|
|
107
|
+
/**
|
|
108
|
+
* Rehydrate a `ClusterResult` from a persisted envelope. Envelope
|
|
109
|
+
* shape validation is best-effort — a mismatched schema returns null
|
|
110
|
+
* so the caller treats it as a miss and recomputes.
|
|
111
|
+
*/
|
|
112
|
+
export declare function fromCacheEntry(entry: ClusterCacheEntry): ClusterResult | null;
|
|
113
|
+
//# sourceMappingURL=cluster-cache.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cluster-cache.d.ts","sourceRoot":"","sources":["../../src/cache/cluster-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAezE;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;CACpB;AAkCD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAYxE;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAShE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,CAAC,EAAE,MAAM,CAAC;IACV,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAe/D;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,IAAI;IACzC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAKA;AAED,qDAAqD;AACrD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAanB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG,aAAa,GAAG,IAAI,CAY7E"}
|
|
@@ -0,0 +1,195 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Cluster Cache
|
|
3
|
+
*
|
|
4
|
+
* Persistent on-disk cache for `clusterFiles()` output (cognium-ai#154,
|
|
5
|
+
* P4 of epic #155 wiring — Sprint L5c).
|
|
6
|
+
*
|
|
7
|
+
* K-medoids assignments are a pure function of:
|
|
8
|
+
* - the set of file paths in the scan
|
|
9
|
+
* - each file's CK vector + imports + annotations (structural
|
|
10
|
+
* fingerprint from `extractClusterVector`)
|
|
11
|
+
* - the algorithm version sentinel `PROMPT_VER = 'cluster-v1'`
|
|
12
|
+
* - the rule-set fingerprint + normalized project profile
|
|
13
|
+
* (rules/profile don't affect the clustering *result*, but do
|
|
14
|
+
* affect downstream policy application, so we key on them anyway
|
|
15
|
+
* for cross-runner replay safety)
|
|
16
|
+
*
|
|
17
|
+
* Caching this eliminates the O(n²) distance-matrix pass + k-medoids
|
|
18
|
+
* swap phase on warm re-scans of the same repo, which is the hot path
|
|
19
|
+
* during iterative development.
|
|
20
|
+
*
|
|
21
|
+
* **Scope:** caches whole-repo `ClusterResult` only. Never per-file.
|
|
22
|
+
*
|
|
23
|
+
* **Key composition:**
|
|
24
|
+
*
|
|
25
|
+
* content = ckVectorSig + '\0' + circleIrVersion + '\0' +
|
|
26
|
+
* circleIrAiVersion + '\0' + ruleSetFingerprint + '\0' +
|
|
27
|
+
* PROMPT_VER + '\0' + k
|
|
28
|
+
* classifier = 'cluster-kmedoids'
|
|
29
|
+
*
|
|
30
|
+
* `ckVectorSig` folds the sorted (filePath, vector-signature) pairs —
|
|
31
|
+
* matches the shape `deriveSeed()` uses in cluster.ts:316-326 so the
|
|
32
|
+
* cache key changes exactly when the cluster assignments would.
|
|
33
|
+
*
|
|
34
|
+
* Any of: file add/remove, file structural edit, circle-ir bump,
|
|
35
|
+
* circle-ir-ai bump, rule-set change, k change, PROMPT_VER bump →
|
|
36
|
+
* cache miss.
|
|
37
|
+
*
|
|
38
|
+
* **Env toggles:**
|
|
39
|
+
* LLM_CLUSTER_CACHE=0 → disable persistent cluster cache.
|
|
40
|
+
*/
|
|
41
|
+
import * as crypto from 'crypto';
|
|
42
|
+
import * as fs from 'fs';
|
|
43
|
+
import * as path from 'path';
|
|
44
|
+
import { createRequire } from 'module';
|
|
45
|
+
import { ClassificationCache } from './classification-cache.js';
|
|
46
|
+
const CLUSTER_CACHE_SUBDIR = path.join('.cognium', 'cache');
|
|
47
|
+
const CLUSTER_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days — structural, stable
|
|
48
|
+
/**
|
|
49
|
+
* Algorithm-version sentinel. Bump on any change to k-selection,
|
|
50
|
+
* distance weights, seed derivation, or the swap-phase loop in
|
|
51
|
+
* `cluster.ts`. Keeps the key composition structurally identical to
|
|
52
|
+
* the three LLM caches (tree/verify/discovery) even though clustering
|
|
53
|
+
* doesn't call an LLM — the sentinel gives us a single dial to
|
|
54
|
+
* invalidate all cluster entries if the algorithm ever changes.
|
|
55
|
+
*/
|
|
56
|
+
const PROMPT_VER = 'cluster-v1';
|
|
57
|
+
let _instance = null;
|
|
58
|
+
function safeReadVersion(spec, baseUrl) {
|
|
59
|
+
try {
|
|
60
|
+
const require = createRequire(baseUrl);
|
|
61
|
+
return require(spec).version || 'unknown';
|
|
62
|
+
}
|
|
63
|
+
catch {
|
|
64
|
+
return 'unknown';
|
|
65
|
+
}
|
|
66
|
+
}
|
|
67
|
+
const _circleIrVersion = safeReadVersion('circle-ir/package.json', import.meta.url);
|
|
68
|
+
const _circleIrAiVersion = (() => {
|
|
69
|
+
try {
|
|
70
|
+
const candidates = [
|
|
71
|
+
path.resolve(new URL(import.meta.url).pathname, '../../../package.json'),
|
|
72
|
+
path.resolve(new URL(import.meta.url).pathname, '../../package.json'),
|
|
73
|
+
];
|
|
74
|
+
for (const p of candidates) {
|
|
75
|
+
if (fs.existsSync(p)) {
|
|
76
|
+
const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
|
|
77
|
+
if (pkg.name === 'circle-ir-ai' && pkg.version) {
|
|
78
|
+
return pkg.version;
|
|
79
|
+
}
|
|
80
|
+
}
|
|
81
|
+
}
|
|
82
|
+
}
|
|
83
|
+
catch {
|
|
84
|
+
/* fallthrough */
|
|
85
|
+
}
|
|
86
|
+
return 'unknown';
|
|
87
|
+
})();
|
|
88
|
+
/**
|
|
89
|
+
* Get the cluster-cache singleton. When `LLM_CLUSTER_CACHE=0` returns
|
|
90
|
+
* a disabled cache that no-ops on get/set.
|
|
91
|
+
*/
|
|
92
|
+
export function getClusterCache() {
|
|
93
|
+
const enabled = process.env.LLM_CLUSTER_CACHE !== '0';
|
|
94
|
+
if (!_instance) {
|
|
95
|
+
_instance = new ClassificationCache({
|
|
96
|
+
namespace: 'cluster',
|
|
97
|
+
cacheDir: path.join(process.cwd(), CLUSTER_CACHE_SUBDIR),
|
|
98
|
+
maxAge: CLUSTER_CACHE_TTL_MS,
|
|
99
|
+
enabled,
|
|
100
|
+
// modelFingerprint deliberately omitted — clustering is static.
|
|
101
|
+
});
|
|
102
|
+
}
|
|
103
|
+
return _instance;
|
|
104
|
+
}
|
|
105
|
+
/** Reset the module-scoped singleton — test-only. */
|
|
106
|
+
export function resetClusterCache() {
|
|
107
|
+
_instance = null;
|
|
108
|
+
}
|
|
109
|
+
/**
|
|
110
|
+
* Fold the sorted (filePath, per-file vector signature) pairs into a
|
|
111
|
+
* single stable string. Mirrors the shape used by `deriveSeed()` in
|
|
112
|
+
* cluster.ts:316-326 so the cache key changes exactly when the cluster
|
|
113
|
+
* result would.
|
|
114
|
+
*/
|
|
115
|
+
export function ckVectorSignature(inputs) {
|
|
116
|
+
const sig = inputs
|
|
117
|
+
.map((i) => `${i.filePath}\0${i.vector.cbo},${i.vector.rfc},${i.vector.lcom},${i.vector.dit},${i.vector.noc},${i.vector.wmc},${i.vector.publicSurface}\0${[...i.vector.imports].sort().join(',')}\0${[...i.vector.annotations].sort().join(',')}`)
|
|
118
|
+
.sort()
|
|
119
|
+
.join('|');
|
|
120
|
+
return crypto.createHash('sha256').update(sig).digest('hex');
|
|
121
|
+
}
|
|
122
|
+
/**
|
|
123
|
+
* Compute the `(content, classifier)` tuple for the underlying
|
|
124
|
+
* ClassificationCache. `ruleSetFingerprint` is threaded through so
|
|
125
|
+
* two runners on the same repo but different rule sets don't share
|
|
126
|
+
* (they'd apply different policies downstream even on identical
|
|
127
|
+
* cluster assignments).
|
|
128
|
+
*/
|
|
129
|
+
export function computeClusterCacheKey(input) {
|
|
130
|
+
const ckVectorSig = ckVectorSignature(input.inputs);
|
|
131
|
+
const ruleSet = input.ruleSetFingerprint ?? '';
|
|
132
|
+
return {
|
|
133
|
+
content: [
|
|
134
|
+
ckVectorSig,
|
|
135
|
+
_circleIrVersion,
|
|
136
|
+
_circleIrAiVersion,
|
|
137
|
+
ruleSet,
|
|
138
|
+
PROMPT_VER,
|
|
139
|
+
String(input.k),
|
|
140
|
+
].join('\0'),
|
|
141
|
+
classifier: 'cluster-kmedoids',
|
|
142
|
+
ckVectorSig,
|
|
143
|
+
};
|
|
144
|
+
}
|
|
145
|
+
/** Test-only: expose the captured engine versions for assertions. */
|
|
146
|
+
export function getClusterCacheVersions() {
|
|
147
|
+
return {
|
|
148
|
+
circleIrVersion: _circleIrVersion,
|
|
149
|
+
circleIrAiVersion: _circleIrAiVersion,
|
|
150
|
+
};
|
|
151
|
+
}
|
|
152
|
+
/** Test-only: expose the prompt-version sentinel. */
|
|
153
|
+
export function getClusterCachePromptVersion() {
|
|
154
|
+
return PROMPT_VER;
|
|
155
|
+
}
|
|
156
|
+
/**
|
|
157
|
+
* Convert a runtime `ClusterResult` into the persisted envelope shape.
|
|
158
|
+
* Split out so the scanner call site doesn't have to know about the
|
|
159
|
+
* envelope; test suite uses it as a factory too.
|
|
160
|
+
*/
|
|
161
|
+
export function toCacheEntry(result, ckVectorSig) {
|
|
162
|
+
return {
|
|
163
|
+
schema: 'cluster:v1',
|
|
164
|
+
k: result.k,
|
|
165
|
+
assignments: result.assignments.map((a) => ({
|
|
166
|
+
filePath: a.filePath,
|
|
167
|
+
clusterId: a.clusterId,
|
|
168
|
+
})),
|
|
169
|
+
medoids: [...result.medoids],
|
|
170
|
+
iterations: result.iterations,
|
|
171
|
+
ckVectorSig,
|
|
172
|
+
computedAt: Date.now(),
|
|
173
|
+
};
|
|
174
|
+
}
|
|
175
|
+
/**
|
|
176
|
+
* Rehydrate a `ClusterResult` from a persisted envelope. Envelope
|
|
177
|
+
* shape validation is best-effort — a mismatched schema returns null
|
|
178
|
+
* so the caller treats it as a miss and recomputes.
|
|
179
|
+
*/
|
|
180
|
+
export function fromCacheEntry(entry) {
|
|
181
|
+
if (entry.schema !== 'cluster:v1')
|
|
182
|
+
return null;
|
|
183
|
+
if (!Array.isArray(entry.assignments) || !Array.isArray(entry.medoids))
|
|
184
|
+
return null;
|
|
185
|
+
return {
|
|
186
|
+
k: entry.k,
|
|
187
|
+
assignments: entry.assignments.map((a) => ({
|
|
188
|
+
filePath: a.filePath,
|
|
189
|
+
clusterId: a.clusterId,
|
|
190
|
+
})),
|
|
191
|
+
medoids: entry.medoids,
|
|
192
|
+
iterations: entry.iterations,
|
|
193
|
+
};
|
|
194
|
+
}
|
|
195
|
+
//# sourceMappingURL=cluster-cache.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cluster-cache.js","sourceRoot":"","sources":["../../src/cache/cluster-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC5D,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,8BAA8B;AAEpF;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,YAAY,CAAC;AAqBhC,IAAI,SAAS,GAAkD,IAAI,CAAC;AAEpE,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpF,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtE,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAC/C,OAAO,GAAG,CAAC,OAAiB,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,EAAE,CAAC;AAEL;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,CAAC;IACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,mBAAmB,CAAoB;YACrD,SAAS,EAAE,SAAS;YACpB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC;YACxD,MAAM,EAAE,oBAAoB;YAC5B,OAAO;YACP,gEAAgE;SACjE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB;IAC/B,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAsB;IACtD,MAAM,GAAG,GAAG,MAAM;SACf,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACxO;SACA,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE;YACP,WAAW;YACX,gBAAgB;YAChB,kBAAkB;YAClB,OAAO;YACP,UAAU;YACV,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;SAChB,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE,kBAAkB;QAC9B,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB;IAIrC,OAAO;QACL,eAAe,EAAE,gBAAgB;QACjC,iBAAiB,EAAE,kBAAkB;KACtC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,4BAA4B;IAC1C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAqB,EACrB,WAAmB;IAEnB,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QAC5B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW;QACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAwB;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO;QACL,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC"}
|
|
@@ -38,6 +38,7 @@
|
|
|
38
38
|
*/
|
|
39
39
|
import { ClassificationCache } from './classification-cache.js';
|
|
40
40
|
import type { TaintSource, TaintSink, TypeInfo, DFG, SastFinding } from 'circle-ir';
|
|
41
|
+
import type { ClusterVector } from '../cluster/cluster.js';
|
|
41
42
|
/**
|
|
42
43
|
* Shape persisted to disk. Mirrors the return of `runPatternMatch` in
|
|
43
44
|
* `src/agents/mastra/workflow.ts`. All fields are plain JSON-serializable.
|
|
@@ -49,6 +50,16 @@ export interface PatternMatchResult {
|
|
|
49
50
|
imports: string[];
|
|
50
51
|
sastFindings: SastFinding[];
|
|
51
52
|
dfg: DFG;
|
|
53
|
+
/**
|
|
54
|
+
* cognium-ai#154 (L5c) — CK + import/annotation fingerprint used by
|
|
55
|
+
* the top-level cluster pass. Extracted from `CircleIR` inside
|
|
56
|
+
* `runPatternMatch` while the IR is live so downstream cluster
|
|
57
|
+
* wiring doesn't need to re-invoke `analyze()`. Optional so older
|
|
58
|
+
* cached entries (written before 2.33.0) deserialize cleanly — the
|
|
59
|
+
* scanner treats an absent vector as "skip this file from
|
|
60
|
+
* clustering" rather than as a hard error.
|
|
61
|
+
*/
|
|
62
|
+
clusterVector?: ClusterVector;
|
|
52
63
|
}
|
|
53
64
|
/**
|
|
54
65
|
* Get the tree-cache singleton. When `LLM_TREE_CACHE=0` returns a
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tree-cache.d.ts","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAMH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"tree-cache.d.ts","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAMH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAc3D;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,GAAG,EAAE,GAAG,CAAC;IACT;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAkCD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAYtE;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAc1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAKT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAsBnF;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,IAAI;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAKA;AAED,qDAAqD;AACrD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tree-cache.js","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"tree-cache.js","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACzD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,8BAA8B;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,SAAS,CAAC;AAyB7B,IAAI,SAAS,GAAmD,IAAI,CAAC;AAErE,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpF,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtE,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAC/C,OAAO,GAAG,CAAC,OAAiB,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,EAAE,CAAC;AAEL;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,mBAAmB,CAAqB;YACtD,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC;YACrD,MAAM,EAAE,iBAAiB;YACzB,OAAO;YACP,gEAAgE;SACjE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE;YACP,SAAS;YACT,gBAAgB;YAChB,kBAAkB;YAClB,KAAK,CAAC,QAAQ;YACd,OAAO;YACP,UAAU;SACX,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE,oBAAoB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB,EAAE,QAAiB;IACzE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEzD,4DAA4D;IAC5D,gEAAgE;IAChE,8BAA8B;IAC9B,IAAI,OAAO,YAAY,GAAG,EAAE,CAAC;QAC3B,MAAM,OAAO,GAA6B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,QAAQ;gBAClB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,oEAAoE;QACpE,kEAAkE;QAClE,kCAAkC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB;IAIlC,OAAO;QACL,eAAe,EAAE,gBAAgB;QACjC,iBAAiB,EAAE,kBAAkB;KACtC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,yBAAyB;IACvC,OAAO,UAAU,CAAC;AACpB,CAAC"}
|
|
@@ -8,6 +8,7 @@
|
|
|
8
8
|
* - Trend tracking (store results, compare across runs)
|
|
9
9
|
*/
|
|
10
10
|
import { type Finding, type ProjectProfile, type SupportedLanguage } from 'circle-ir';
|
|
11
|
+
import { type ClusterPolicy, type ClusterResult, type ClusterVector, type ContextProfile } from '../cluster/cluster.js';
|
|
11
12
|
import { type OWASPMapping } from './owasp-mapping.js';
|
|
12
13
|
import { type ParseFailure } from './parse-failure.js';
|
|
13
14
|
export type { ParseFailure, ParseFailureReason } from './parse-failure.js';
|
|
@@ -75,6 +76,37 @@ export interface ScanOptions {
|
|
|
75
76
|
* preserved on each `SastFinding`). C-Yes-Yes policy per ADR-008.
|
|
76
77
|
*/
|
|
77
78
|
projectProfile?: ProjectProfile | Map<string, ProjectProfile>;
|
|
79
|
+
/**
|
|
80
|
+
* cognium-ai#154 (L5c) — per-cluster policy overrides. When provided,
|
|
81
|
+
* `applyClusterPolicies()` filters each `FileResult`'s findings using
|
|
82
|
+
* the policy assigned to that file's cluster (by `FileResult.clusterId`).
|
|
83
|
+
*
|
|
84
|
+
* Interaction with `contextProfile`:
|
|
85
|
+
* - `clusterPolicies` set → per-cluster policy takes precedence for
|
|
86
|
+
* any cluster id present in the map;
|
|
87
|
+
* - `contextProfile` set → applied uniformly to every cluster whose
|
|
88
|
+
* id is NOT covered by `clusterPolicies`;
|
|
89
|
+
* - neither set → `DEFAULT_CLUSTER_POLICY` applied uniformly (byte-
|
|
90
|
+
* identical to pre-2.33.0 behavior, no filter fires).
|
|
91
|
+
*
|
|
92
|
+
* Absent-`clusterId` files (parse failures, pre-flight skips) are
|
|
93
|
+
* never filtered — the policy layer only sees files that made it
|
|
94
|
+
* through `runClusterPass()`.
|
|
95
|
+
*/
|
|
96
|
+
clusterPolicies?: Map<number, ClusterPolicy>;
|
|
97
|
+
/**
|
|
98
|
+
* cognium-ai#154 (L5c) — uniform cluster policy resolved from the
|
|
99
|
+
* cognium-ai `--cluster-policy <profile>` CLI flag. Applied to every
|
|
100
|
+
* cluster whose id is not overridden by `clusterPolicies`. Also
|
|
101
|
+
* echoed into `ScanMeta.contextProfile` for downstream observability
|
|
102
|
+
* (top-100 sweep operating principles P2: track which profile fired
|
|
103
|
+
* per repo).
|
|
104
|
+
*
|
|
105
|
+
* Undefined ≡ `application` for policy resolution, but is preserved
|
|
106
|
+
* as `undefined` in `ScanMeta` so consumers can distinguish "no flag
|
|
107
|
+
* passed" from "explicit --cluster-policy application".
|
|
108
|
+
*/
|
|
109
|
+
contextProfile?: ContextProfile;
|
|
78
110
|
}
|
|
79
111
|
export interface ScanProgress {
|
|
80
112
|
phase: 'clone' | 'discover' | 'analyze' | 'report';
|
|
@@ -100,6 +132,24 @@ export interface ScanResult {
|
|
|
100
132
|
* error). Always present, may be empty. JSON-stable.
|
|
101
133
|
*/
|
|
102
134
|
parseFailures: ParseFailure[];
|
|
135
|
+
/**
|
|
136
|
+
* cognium-ai#154 (L5c) — top-level cluster assignments computed once
|
|
137
|
+
* per scan by `runClusterPass()`. The k-medoids result is a pure
|
|
138
|
+
* function of each file's CK + import/annotation fingerprint;
|
|
139
|
+
* downstream consumers (health, action-queue, cognium-ai formatters)
|
|
140
|
+
* can read `medoids[]` for representative files without re-running
|
|
141
|
+
* the pass.
|
|
142
|
+
*
|
|
143
|
+
* Absent when:
|
|
144
|
+
* - no successful file results (all parse-failed or pre-flight-skipped);
|
|
145
|
+
* - `LLM_CLUSTER_CACHE=0` AND fewer than 2 files (k-medoids requires
|
|
146
|
+
* at least 2 inputs to be meaningful).
|
|
147
|
+
*
|
|
148
|
+
* Per-file `clusterId` is threaded onto `FileResult.clusterId` so
|
|
149
|
+
* callers that only care about a single file's cluster don't need to
|
|
150
|
+
* index into this array.
|
|
151
|
+
*/
|
|
152
|
+
clusters?: ClusterResult;
|
|
103
153
|
}
|
|
104
154
|
export interface ScanMeta {
|
|
105
155
|
/** Target repository or path */
|
|
@@ -114,6 +164,14 @@ export interface ScanMeta {
|
|
|
114
164
|
durationMs: number;
|
|
115
165
|
/** Circle-IR version */
|
|
116
166
|
version: string;
|
|
167
|
+
/**
|
|
168
|
+
* cognium-ai#154 (L5c) — resolved context profile for the scan.
|
|
169
|
+
* Mirrors the caller's `ScanOptions.contextProfile` verbatim (undefined
|
|
170
|
+
* when the caller didn't pass `--cluster-policy`, distinguishing "no
|
|
171
|
+
* flag" from "explicit --cluster-policy application"). Consumed by
|
|
172
|
+
* top-100 sweep telemetry per operating principle P2.
|
|
173
|
+
*/
|
|
174
|
+
contextProfile?: ContextProfile;
|
|
117
175
|
}
|
|
118
176
|
export interface ScanFinding extends Finding {
|
|
119
177
|
/** OWASP Top 10 mapping */
|
|
@@ -188,6 +246,24 @@ export interface FileResult {
|
|
|
188
246
|
skipped?: {
|
|
189
247
|
reason: string;
|
|
190
248
|
};
|
|
249
|
+
/**
|
|
250
|
+
* cognium-ai#154 (L5c) — k-medoids cluster id assigned by
|
|
251
|
+
* `runClusterPass()`. Absent on parseFailure / preFlightSkip rows
|
|
252
|
+
* (they never produced a ClusterVector), and absent when
|
|
253
|
+
* `ScanResult.clusters` itself is absent (see that field for the
|
|
254
|
+
* fallback conditions).
|
|
255
|
+
*/
|
|
256
|
+
clusterId?: number;
|
|
257
|
+
/**
|
|
258
|
+
* cognium-ai#154 (L5c) — internal transport for the CK +
|
|
259
|
+
* import/annotation fingerprint from `analyzeFile()` / `analyzeFileWithLLM()`
|
|
260
|
+
* up to `runClusterPass()`. Stripped in `generateReport()` before
|
|
261
|
+
* emit; downstream JSON consumers should never see it. Kept optional
|
|
262
|
+
* so parse-failure rows deserialize cleanly.
|
|
263
|
+
*
|
|
264
|
+
* @internal
|
|
265
|
+
*/
|
|
266
|
+
clusterVector?: ClusterVector;
|
|
191
267
|
}
|
|
192
268
|
export declare class SecurityScanner {
|
|
193
269
|
private workDir;
|
|
@@ -222,6 +298,19 @@ export declare class SecurityScanner {
|
|
|
222
298
|
* `undefined` is permitted — the cache falls through to `_unowned`.
|
|
223
299
|
*/
|
|
224
300
|
private scanCoordinate?;
|
|
301
|
+
/**
|
|
302
|
+
* cognium-ai#154 (L5c) — per-cluster policy overrides. Populated in
|
|
303
|
+
* `scan()` from `ScanOptions.clusterPolicies`; consumed by
|
|
304
|
+
* `applyClusterPolicies()` after `runClusterPass()`.
|
|
305
|
+
*/
|
|
306
|
+
private clusterPolicies?;
|
|
307
|
+
/**
|
|
308
|
+
* cognium-ai#154 (L5c) — resolved uniform context profile. Populated
|
|
309
|
+
* in `scan()` from `ScanOptions.contextProfile`; consumed by
|
|
310
|
+
* `applyClusterPolicies()` as the fallback when no per-cluster policy
|
|
311
|
+
* is set. Also echoed into `ScanMeta.contextProfile`.
|
|
312
|
+
*/
|
|
313
|
+
private contextProfile?;
|
|
225
314
|
constructor();
|
|
226
315
|
/**
|
|
227
316
|
* Run a security scan on a repository or local path.
|
|
@@ -269,6 +358,58 @@ export declare class SecurityScanner {
|
|
|
269
358
|
* Check if severity meets minimum threshold.
|
|
270
359
|
*/
|
|
271
360
|
private meetsMinSeverity;
|
|
361
|
+
/**
|
|
362
|
+
* cognium-ai#154 (L5c) — top-level k-medoids cluster pass.
|
|
363
|
+
*
|
|
364
|
+
* Runs once per scan, after all per-file `analyze()` calls have
|
|
365
|
+
* populated `fileResults[*].clusterVector`. Never throws — a failure
|
|
366
|
+
* anywhere in this method leaves `clusterId` unset on every row and
|
|
367
|
+
* returns `undefined` so `ScanResult.clusters` is absent. That's the
|
|
368
|
+
* "no cluster policy applied" state, which is byte-identical to
|
|
369
|
+
* pre-2.33.0 behaviour.
|
|
370
|
+
*
|
|
371
|
+
* Cache: keys on the CK-vector signature + rule-set fingerprint + k;
|
|
372
|
+
* warm re-scans on the same repo (7-day TTL) skip the O(n²) distance
|
|
373
|
+
* matrix + swap phase entirely. Miss cost is dominated by the k-medoids
|
|
374
|
+
* pass itself which is <2s at 5000 files per `cluster.ts:355-359`.
|
|
375
|
+
*
|
|
376
|
+
* k-selection: `min(8, ceil(sqrt(n)))` — sqrt-heuristic is standard
|
|
377
|
+
* for k-medoids without ground truth; cap 8 keeps per-cluster policy
|
|
378
|
+
* manageable and avoids over-partitioning small repos. n<2 returns
|
|
379
|
+
* `undefined` (k-medoids requires at least 2 inputs).
|
|
380
|
+
*/
|
|
381
|
+
private runClusterPass;
|
|
382
|
+
/**
|
|
383
|
+
* cognium-ai#154 (L5c) — post-hoc cluster-policy filter.
|
|
384
|
+
*
|
|
385
|
+
* Iterates every `FileResult` with a resolved `clusterId` and applies
|
|
386
|
+
* the policy attached to that cluster:
|
|
387
|
+
*
|
|
388
|
+
* 1. Per-cluster override in `this.clusterPolicies` wins;
|
|
389
|
+
* 2. Uniform profile in `this.contextProfile` fires when no
|
|
390
|
+
* per-cluster override exists;
|
|
391
|
+
* 3. Otherwise `DEFAULT_CLUSTER_POLICY` (no-op filter).
|
|
392
|
+
*
|
|
393
|
+
* **What the filter does today (L5c):** applies
|
|
394
|
+
* `policy.sinkWhitelist` post-hoc. When the whitelist is non-empty,
|
|
395
|
+
* only findings whose vulnerability `type` matches one of the
|
|
396
|
+
* whitelisted sink classes survive. Empty whitelist ≡ pass-through.
|
|
397
|
+
*
|
|
398
|
+
* **What is deferred to L5d (documented no-ops today):**
|
|
399
|
+
* - `policy.sourceWhitelist` — requires a discovery-source tag on
|
|
400
|
+
* `Finding` we don't currently carry through the workflow. Wiring
|
|
401
|
+
* the tag needs a signature change in `runEnrich` / `runVerify`
|
|
402
|
+
* that L5c deliberately avoids.
|
|
403
|
+
* - `policy.llmEnabled === false` — post-hoc, LLM findings have
|
|
404
|
+
* already been produced (and paid for). Dropping them here saves
|
|
405
|
+
* no LLM calls; the intent-signal version belongs in a pre-LLM
|
|
406
|
+
* pass in `analyzeFiles()` (L5d).
|
|
407
|
+
*
|
|
408
|
+
* Never throws — the same never-throw contract as `runClusterPass()`.
|
|
409
|
+
* Files with `clusterId === undefined` (parse failures, pre-flight
|
|
410
|
+
* skips, or `ScanResult.clusters` absent) are untouched.
|
|
411
|
+
*/
|
|
412
|
+
private applyClusterPolicies;
|
|
272
413
|
/**
|
|
273
414
|
* Generate scan report.
|
|
274
415
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/security-scan/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,cAAc,EAEnB,KAAK,iBAAiB,EACvB,MAAM,WAAW,CAAC;AAOnB,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE5F,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7E,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAM3E,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gDAAgD;IAChD,WAAW,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACrD,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wBAAwB;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/security-scan/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,cAAc,EAEnB,KAAK,iBAAiB,EACvB,MAAM,WAAW,CAAC;AAOnB,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE5F,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7E,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAM3E,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gDAAgD;IAChD,WAAW,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACrD,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wBAAwB;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9D;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,oBAAoB;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,mBAAmB;IACnB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IACtB,yBAAyB;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,uBAAuB;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB;;;;OAIG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,WAAY,SAAQ,OAAO;IAC1C,2BAA2B;IAC3B,KAAK,EAAE,YAAY,CAAC;IACpB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,QAAQ,EAAE,MAAM,GAAG;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,WAAW,EAAE,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,uBAAuB;IACvB,MAAM,EAAE;QAAE,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACnC,kCAAkC;IAClC,kBAAkB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAMD,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,SAAS,CAAU;IAC3B;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,UAAU,CAAC,CAAmC;IACtD,OAAO,CAAC,aAAa,CAAS;IAC9B;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAC,CAA+C;IACtE;;;;;OAKG;IACH,OAAO,CAAC,YAAY,CAAc;IAClC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAC,CAAoB;IAC3C;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAC,CAA6B;IACrD;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAC,CAAiB;;IAUxC;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAsFrD;;OAEG;YACW,iBAAiB;IAgB/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAoCvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAiJrB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAKtB;;OAEG;YACW,YAAY;IAqE1B;;OAEG;YACW,WAAW;IAwMzB;;OAEG;YACW,kBAAkB;IAqPhC;;OAEG;IACH,OAAO,CAAC,cAAc;IA4CtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,cAAc;IA4E5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,OAAO,CAAC,oBAAoB;IAsC5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA2HtB;;OAEG;YACW,UAAU;IAuBxB;;OAEG;IACH,OAAO,CAAC,aAAa;IA4DrB;;OAEG;IACH,OAAO,CAAC,cAAc;IAetB;;OAEG;IACH,OAAO,IAAI,IAAI;CAMhB;AAMD;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAO9E;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC7B,OAAO,CAAC,UAAU,CAAC,CAErB;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOnE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA+C5D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA4F3D"}
|