clawvet 0.7.5 → 0.8.1

package/dist/index.js

@@ -2,14 +2,14 @@
 
 // src/index.ts
 import { Command } from "commander";
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { execFile } from "child_process";
 import { fileURLToPath } from "url";
-import { dirname as dirname4, join as join6 } from "path";
+import { dirname as dirname4, join as join7 } from "path";
 
 // src/commands/scan.ts
-import { readFileSync as readFileSync2, existsSync as existsSync2, statSync } from "fs";
-import { resolve, join as join2, basename, dirname } from "path";
+import { readFileSync as readFileSync3, existsSync as existsSync2, statSync as statSync2 } from "fs";
+import { resolve, join as join3, basename as basename2, dirname } from "path";
 import chalk2 from "chalk";
 
 // ../shared/src/patterns.ts
@@ -1284,6 +1284,83 @@ function post(payload) {
   });
 }
 
+// src/assemble.ts
+import { readFileSync as readFileSync2, readdirSync, statSync } from "fs";
+import { basename, join as join2 } from "path";
+var MAX_REFERENCED_FILE_SIZE = 256 * 1024;
+var SHALLOW_DIRECTORIES = /* @__PURE__ */ new Set(["lib", "scripts"]);
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isReferenced(skillMd, relativePath) {
+  const names = /* @__PURE__ */ new Set([basename(relativePath), relativePath]);
+  return [...names].some(
+    (name) => new RegExp(`\\b${escapeRegExp(name)}\\b`).test(skillMd)
+  );
+}
+function listCandidates(skillDir) {
+  const candidates = [];
+  let entries;
+  try {
+    entries = readdirSync(skillDir, { withFileTypes: true });
+  } catch {
+    return candidates;
+  }
+  for (const entry of entries) {
+    if (entry.isFile()) {
+      if (entry.name !== "SKILL.md") {
+        candidates.push({
+          absolutePath: join2(skillDir, entry.name),
+          relativePath: entry.name
+        });
+      }
+      continue;
+    }
+    if (!entry.isDirectory() || !SHALLOW_DIRECTORIES.has(entry.name)) {
+      continue;
+    }
+    try {
+      for (const child of readdirSync(join2(skillDir, entry.name), {
+        withFileTypes: true
+      })) {
+        if (child.isFile()) {
+          candidates.push({
+            absolutePath: join2(skillDir, entry.name, child.name),
+            relativePath: `${entry.name}/${child.name}`
+          });
+        }
+      }
+    } catch {
+    }
+  }
+  return candidates.sort(
+    (a, b) => a.relativePath.localeCompare(b.relativePath)
+  );
+}
+function assembleSkill(skillDir, skillMd) {
+  let assembled = skillMd;
+  for (const candidate of listCandidates(skillDir)) {
+    if (!isReferenced(skillMd, candidate.relativePath)) {
+      continue;
+    }
+    try {
+      const stat = statSync(candidate.absolutePath);
+      if (stat.size > MAX_REFERENCED_FILE_SIZE) {
+        continue;
+      }
+      const contents = readFileSync2(candidate.absolutePath);
+      if (contents.includes(0)) {
+        continue;
+      }
+      const separator = assembled.endsWith("\n") ? "\n" : "\n\n";
+      assembled += `${separator}# [clawvet] referenced file: ${candidate.relativePath}
+${contents.toString("utf-8")}`;
+    } catch {
+    }
+  }
+  return assembled;
+}
+
 // src/commands/scan.ts
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
 async function fetchRemoteSkill(slug) {
@@ -1293,15 +1370,23 @@ async function fetchRemoteSkill(slug) {
     );
   }
   const encoded = encodeURIComponent(slug);
-  const urls = [
-    `https://raw.githubusercontent.com/openclaw/skills/main/${encoded}/SKILL.md`,
-    `https://clawhub.ai/api/v1/skills/${encoded}/raw`
+  const sources = [
+    { url: `https://clawhub.ai/api/v1/skills/${encoded}`, json: true },
+    { url: `https://clawhub.ai/api/v1/skills/${encoded}/raw`, json: false },
+    {
+      url: `https://raw.githubusercontent.com/openclaw/skills/main/${encoded}/SKILL.md`,
+      json: false
+    }
   ];
-  for (const url of urls) {
+  for (const { url, json } of sources) {
     try {
       const res = await fetch(url, { signal: AbortSignal.timeout(1e4) });
-      if (res.ok) {
-        return await res.text();
+      if (!res.ok) continue;
+      if (!json) return await res.text();
+      const body = await res.json();
+      const content = body?.skill?.description;
+      if (typeof content === "string" && content.includes("---")) {
+        return content;
       }
     } catch {
     }
@@ -1328,20 +1413,23 @@ async function scanCommand(target, options) {
   } else {
     const skillPath = resolve(target);
     let skillFile = skillPath;
-    if (existsSync2(skillPath) && !skillPath.endsWith(".md") && existsSync2(join2(skillPath, "SKILL.md"))) {
-      skillFile = join2(skillPath, "SKILL.md");
+    let skillDir;
+    if (existsSync2(skillPath) && statSync2(skillPath).isDirectory() && existsSync2(join3(skillPath, "SKILL.md"))) {
+      skillDir = skillPath;
+      skillFile = join3(skillPath, "SKILL.md");
     }
-    if (!existsSync2(skillFile) || statSync(skillFile).isDirectory()) {
+    if (!existsSync2(skillFile) || statSync2(skillFile).isDirectory()) {
       console.error(`Error: Cannot find SKILL.md at ${skillFile}`);
       console.error(`Hint: If this is a directory of skills, use 'clawvet audit --dir ${target}' instead.`);
       process.exit(1);
     }
-    content = readFileSync2(skillFile, "utf-8");
-    fallbackName = basename(dirname(skillFile));
+    const skillMd = readFileSync3(skillFile, "utf-8");
+    content = skillDir ? assembleSkill(skillDir, skillMd) : skillMd;
+    fallbackName = basename2(dirname(skillFile));
   }
-  const banFile = join2(process.cwd(), ".clawvetban");
+  const banFile = join3(process.cwd(), ".clawvetban");
   if (existsSync2(banFile)) {
-    const banEntries = readFileSync2(banFile, "utf-8").split("\n").map((l) => l.trim().toLowerCase()).filter((l) => l && !l.startsWith("#"));
+    const banEntries = readFileSync3(banFile, "utf-8").split("\n").map((l) => l.trim().toLowerCase()).filter((l) => l && !l.startsWith("#"));
     const fmMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (fmMatch) {
       const fmText = fmMatch[1].toLowerCase();
@@ -1357,10 +1445,10 @@ async function scanCommand(target, options) {
       }
     }
   }
-  const ignoreFile = join2(process.cwd(), ".clawvetignore");
+  const ignoreFile = join3(process.cwd(), ".clawvetignore");
   const ignorePatterns = [];
   if (existsSync2(ignoreFile)) {
-    const lines = readFileSync2(ignoreFile, "utf-8").split("\n");
+    const lines = readFileSync3(ignoreFile, "utf-8").split("\n");
     for (const line of lines) {
       const trimmed = line.trim();
       if (trimmed && !trimmed.startsWith("#")) {
@@ -1420,13 +1508,13 @@ async function scanCommand(target, options) {
 }
 
 // src/commands/audit.ts
-import { readdirSync, existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join3, basename as basename2 } from "path";
+import { readdirSync as readdirSync2, existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join4, basename as basename3 } from "path";
 import { homedir as homedir2 } from "os";
 import chalk3 from "chalk";
 var DEFAULT_SKILL_DIRS = [
-  join3(homedir2(), ".openclaw", "skills"),
-  join3(homedir2(), ".openclaw", "workspace", "skills")
+  join4(homedir2(), ".openclaw", "skills"),
+  join4(homedir2(), ".openclaw", "workspace", "skills")
 ];
 async function auditCommand(options = {}) {
   const SKILL_DIRS = options.dir ? [options.dir] : DEFAULT_SKILL_DIRS;
@@ -1444,22 +1532,22 @@ async function auditCommand(options = {}) {
       }
       continue;
     }
-    const directSkillFile = join3(dir, "SKILL.md");
+    const directSkillFile = join4(dir, "SKILL.md");
     if (existsSync3(directSkillFile)) {
-      const content = readFileSync3(directSkillFile, "utf-8");
-      const result = await scanSkill(content, { skillName: basename2(dir) });
+      const content = readFileSync4(directSkillFile, "utf-8");
+      const result = await scanSkill(content, { skillName: basename3(dir) });
       totalScanned++;
       totalThreats += result.findings.length;
       grades[result.riskGrade] = (grades[result.riskGrade] ?? 0) + 1;
       printScanResult(result);
       continue;
     }
-    const entries = readdirSync(dir, { withFileTypes: true });
+    const entries = readdirSync2(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const skillFile = join3(dir, entry.name, "SKILL.md");
+      const skillFile = join4(dir, entry.name, "SKILL.md");
       if (!existsSync3(skillFile)) continue;
-      const content = readFileSync3(skillFile, "utf-8");
+      const content = readFileSync4(skillFile, "utf-8");
       const result = await scanSkill(content, { skillName: entry.name });
       totalScanned++;
       totalThreats += result.findings.length;
@@ -1500,13 +1588,13 @@ Audit complete: ${totalScanned} skills scanned, ${totalThreats} findings`
 }
 
 // src/commands/watch.ts
-import { readFileSync as readFileSync4, existsSync as existsSync4, watch } from "fs";
-import { join as join4, dirname as dirname2, basename as basename3 } from "path";
+import { readFileSync as readFileSync5, existsSync as existsSync4, watch } from "fs";
+import { join as join5, dirname as dirname2, basename as basename4 } from "path";
 import { homedir as homedir3 } from "os";
 import chalk4 from "chalk";
 var DEFAULT_SKILL_DIRS2 = [
-  join4(homedir3(), ".openclaw", "skills"),
-  join4(homedir3(), ".openclaw", "workspace", "skills")
+  join5(homedir3(), ".openclaw", "skills"),
+  join5(homedir3(), ".openclaw", "workspace", "skills")
 ];
 async function watchCommand(options) {
   const threshold = options.threshold || 50;
@@ -1545,14 +1633,14 @@ ClawVet Watch \u2014 monitoring skill directories (threshold: ${threshold})
   for (const dir of watchDirs) {
     const watcher = watch(dir, { recursive: true }, async (event, filename) => {
       if (!filename?.endsWith("SKILL.md")) return;
-      const skillFile = join4(dir, filename);
+      const skillFile = join5(dir, filename);
       if (!existsSync4(skillFile)) return;
       console.log(chalk4.dim(`
 Detected change: ${filename}`));
       try {
-        const content = readFileSync4(skillFile, "utf-8");
+        const content = readFileSync5(skillFile, "utf-8");
         const result = await scanSkill(content, {
-          skillName: basename3(dirname2(skillFile))
+          skillName: basename4(dirname2(skillFile))
         });
         if (result.cached) {
           console.log(chalk4.dim("(cached)"));
@@ -1587,8 +1675,8 @@ Detected change: ${filename}`));
 }
 
 // src/commands/badge.ts
-import { readFileSync as readFileSync5, existsSync as existsSync5, statSync as statSync2 } from "fs";
-import { resolve as resolve2, join as join5, dirname as dirname3, basename as basename4 } from "path";
+import { readFileSync as readFileSync6, existsSync as existsSync5, statSync as statSync3 } from "fs";
+import { resolve as resolve2, join as join6, dirname as dirname3, basename as basename5 } from "path";
 import chalk5 from "chalk";
 var GRADE_COLORS2 = {
   A: "brightgreen",
@@ -1607,16 +1695,16 @@ var GRADE_LABELS = {
 async function badgeCommand(target, options) {
   const skillPath = resolve2(target);
   let skillFile = skillPath;
-  if (existsSync5(skillPath) && !skillPath.endsWith(".md") && existsSync5(join5(skillPath, "SKILL.md"))) {
-    skillFile = join5(skillPath, "SKILL.md");
+  if (existsSync5(skillPath) && !skillPath.endsWith(".md") && existsSync5(join6(skillPath, "SKILL.md"))) {
+    skillFile = join6(skillPath, "SKILL.md");
   }
-  if (!existsSync5(skillFile) || statSync2(skillFile).isDirectory()) {
+  if (!existsSync5(skillFile) || statSync3(skillFile).isDirectory()) {
     console.error(`Error: Cannot find SKILL.md at ${skillFile}`);
     process.exit(1);
   }
-  const content = readFileSync5(skillFile, "utf-8");
+  const content = readFileSync6(skillFile, "utf-8");
   const result = await scanSkill(content, {
-    skillName: basename4(dirname3(skillFile))
+    skillName: basename5(dirname3(skillFile))
   });
   const label = GRADE_LABELS[result.riskGrade];
   const color = GRADE_COLORS2[result.riskGrade];
@@ -1652,7 +1740,7 @@ function openUrl(url) {
 function readPackageVersion() {
   try {
     const here = dirname4(fileURLToPath(import.meta.url));
-    const pkg = JSON.parse(readFileSync6(join6(here, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(join7(here, "..", "package.json"), "utf-8"));
     return pkg.version;
   } catch {
     return "0.0.0";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/commands/scan.ts","../../shared/src/patterns.ts","../../shared/src/scanner/skill-parser.ts","../../shared/src/scanner/static-analysis.ts","../../shared/src/scanner/metadata-validator.ts","../../shared/src/scanner/dependency-checker.ts","../../shared/src/scanner/typosquat-detector.ts","../../shared/src/scanner/risk-scorer.ts","../../shared/src/scanner/cache.ts","../../shared/src/scanner/index.ts","../src/output/terminal.ts","../src/output/json.ts","../src/output/sarif.ts","../src/telemetry.ts","../src/commands/audit.ts","../src/commands/watch.ts","../src/commands/badge.ts"],"sourcesContent":["import { Command } from \"commander\";\r\nimport { readFileSync } from \"node:fs\";\r\nimport { execFile } from \"node:child_process\";\r\nimport { fileURLToPath } from \"node:url\";\r\nimport { dirname, join } from \"node:path\";\r\nimport { scanCommand } from \"./commands/scan.js\";\r\nimport { auditCommand } from \"./commands/audit.js\";\r\nimport { watchCommand } from \"./commands/watch.js\";\r\nimport { badgeCommand } from \"./commands/badge.js\";\r\n\r\n// Open a URL in the user's browser without going through a shell. Using\r\n// execFile (not exec) means the URL is passed as an argument, never\r\n// interpolated into a command string a shell would parse — no shell-exec\r\n// surface even though the URL here is a constant.\r\nfunction openUrl(url: string): void {\r\n  const child =\r\n    process.platform === \"win32\"\r\n      ? execFile(\"cmd\", [\"/c\", \"start\", \"\", url])\r\n      : process.platform === \"darwin\"\r\n        ? execFile(\"open\", [url])\r\n        : execFile(\"xdg-open\", [url]);\r\n  // Opening a browser is best-effort — never crash the CLI if the opener is\r\n  // missing (e.g. a headless Linux box without xdg-open).\r\n  child.on(\"error\", () => {});\r\n}\r\n\r\nfunction readPackageVersion(): string {\r\n  try {\r\n    const here = dirname(fileURLToPath(import.meta.url));\r\n    const pkg = JSON.parse(readFileSync(join(here, \"..\", \"package.json\"), \"utf-8\"));\r\n    return pkg.version;\r\n  } catch {\r\n    return \"0.0.0\";\r\n  }\r\n}\r\n\r\nconst program = new Command();\r\n\r\nprogram\r\n  .name(\"clawvet\")\r\n  .description(\"Skill vetting & supply chain security for OpenClaw\")\r\n  .version(readPackageVersion());\r\n\r\nprogram\r\n  .command(\"scan\")\r\n  .description(\"Scan a skill for security threats\")\r\n  .argument(\"<target>\", \"Path to skill folder or SKILL.md file\")\r\n  .option(\"--format <format>\", \"Output format: terminal, json, or sarif\", \"terminal\")\r\n  .option(\"--fail-on <severity>\", \"Exit 1 if findings at this severity or above\")\r\n  .option(\"--semantic\", \"Enable AI semantic analysis (requires ANTHROPIC_API_KEY)\")\r\n  .option(\"--remote\", \"Fetch skill from ClawHub by name instead of local path\")\r\n  .option(\"-q, --quiet\", \"Suppress all output, exit code only (0=pass, 1=fail)\")\r\n  .option(\"--subscribe\", \"Open the ClawVet feedback & alerts form\")\r\n  .action(async (target, opts) => {\r\n    if (opts.subscribe) {\r\n      const url = \"https://tally.so/r/jaMdaa\";\r\n      console.log(`Opening ${url} ...`);\r\n      openUrl(url);\r\n    }\r\n    await scanCommand(target, {\r\n      format: opts.format,\r\n      failOn: opts.failOn,\r\n      semantic: opts.semantic,\r\n      remote: opts.remote,\r\n      quiet: opts.quiet,\r\n    });\r\n  });\r\n\r\nprogram\r\n  .command(\"audit\")\r\n  .description(\"Scan all installed OpenClaw skills\")\r\n  .option(\"--dir <path>\", \"Custom skills directory to scan\")\r\n  .action(async (opts) => {\r\n    await auditCommand({ dir: opts.dir });\r\n  });\r\n\r\nprogram\r\n  .command(\"watch\")\r\n  .description(\"Pre-install hook — blocks risky skill installs\")\r\n  .option(\"--threshold <score>\", \"Risk score threshold (default 50)\", \"50\")\r\n  .option(\"--dir <path>\", \"Custom skills directory to watch\")\r\n  .action(async (opts) => {\r\n    await watchCommand({ threshold: parseInt(opts.threshold), dir: opts.dir });\r\n  });\r\n\r\nprogram\r\n  .command(\"badge\")\r\n  .description(\"Generate a trust badge for a skill's README\")\r\n  .argument(\"<target>\", \"Path to skill folder or SKILL.md file\")\r\n  .option(\"--md\", \"Output only the markdown snippet\")\r\n  .action(async (target, opts) => {\r\n    await badgeCommand(target, { markdown: opts.md });\r\n  });\r\n\r\nprogram\r\n  .command(\"feedback\")\r\n  .description(\"Open the ClawVet feedback & threat alerts form\")\r\n  .action(async () => {\r\n    const url = \"https://tally.so/r/jaMdaa\";\r\n    console.log(`Opening ${url} ...`);\r\n    openUrl(url);\r\n  });\r\n\r\nprogram.parse();\r\n","import { readFileSync, existsSync, statSync } from \"node:fs\";\r\nimport { resolve, join, basename, dirname } from \"node:path\";\r\nimport chalk from \"chalk\";\r\nimport { scanSkill } from \"@clawvet/shared\";\r\nimport { printScanResult } from \"../output/terminal.js\";\r\nimport { printJsonResult } from \"../output/json.js\";\r\nimport { printSarifResult } from \"../output/sarif.js\";\r\nimport { sendTelemetry, hasBeenAsked, setTelemetry, isTelemetryEnabled, getScanCount } from \"../telemetry.js\";\r\n\r\nexport interface ScanOptions {\r\n  format?: \"terminal\" | \"json\" | \"sarif\";\r\n  failOn?: \"critical\" | \"high\" | \"medium\" | \"low\";\r\n  semantic?: boolean;\r\n  remote?: boolean;\r\n  quiet?: boolean;\r\n}\r\n\r\nconst SLUG_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;\r\n\r\nasync function fetchRemoteSkill(slug: string): Promise<string> {\r\n  if (!SLUG_PATTERN.test(slug)) {\r\n    throw new Error(\r\n      `Invalid skill name \"${slug}\". Must be 1-64 chars, alphanumeric + dash/underscore.`\r\n    );\r\n  }\r\n\r\n  const encoded = encodeURIComponent(slug);\r\n  const urls = [\r\n    `https://raw.githubusercontent.com/openclaw/skills/main/${encoded}/SKILL.md`,\r\n    `https://clawhub.ai/api/v1/skills/${encoded}/raw`,\r\n  ];\r\n\r\n  for (const url of urls) {\r\n    try {\r\n      const res = await fetch(url, { signal: AbortSignal.timeout(10000) });\r\n      if (res.ok) {\r\n        return await res.text();\r\n      }\r\n    } catch {\r\n      // try next\r\n    }\r\n  }\r\n\r\n  throw new Error(\r\n    `Could not fetch skill \"${slug}\" from ClawHub. Check the skill name and try again.`\r\n  );\r\n}\r\n\r\nexport async function scanCommand(\r\n  target: string,\r\n  options: ScanOptions\r\n): Promise<void> {\r\n  let content: string;\r\n  let fallbackName: string | undefined;\r\n\r\n  if (options.remote) {\r\n    try {\r\n      process.stderr.write(`Fetching \"${target}\" from ClawHub...\\n`);\r\n      content = await fetchRemoteSkill(target);\r\n      fallbackName = target;\r\n    } catch (err) {\r\n      console.error(\r\n        err instanceof Error ? err.message : \"Failed to fetch remote skill\"\r\n      );\r\n      process.exit(1);\r\n    }\r\n  } else {\r\n    const skillPath = resolve(target);\r\n    let skillFile = skillPath;\r\n\r\n    if (\r\n      existsSync(skillPath) &&\r\n      !skillPath.endsWith(\".md\") &&\r\n      existsSync(join(skillPath, \"SKILL.md\"))\r\n    ) {\r\n      skillFile = join(skillPath, \"SKILL.md\");\r\n    }\r\n\r\n    if (!existsSync(skillFile) || statSync(skillFile).isDirectory()) {\r\n      console.error(`Error: Cannot find SKILL.md at ${skillFile}`);\r\n      console.error(`Hint: If this is a directory of skills, use 'clawvet audit --dir ${target}' instead.`);\r\n      process.exit(1);\r\n    }\r\n\r\n    content = readFileSync(skillFile, \"utf-8\");\r\n    fallbackName = basename(dirname(skillFile));\r\n  }\r\n\r\n  // Load .clawvetban — block skills by name, author, or slug\r\n  const banFile = join(process.cwd(), \".clawvetban\");\r\n  if (existsSync(banFile)) {\r\n    const banEntries = readFileSync(banFile, \"utf-8\")\r\n      .split(\"\\n\")\r\n      .map((l) => l.trim().toLowerCase())\r\n      .filter((l) => l && !l.startsWith(\"#\"));\r\n\r\n    // Quick parse frontmatter to check name/author before full scan\r\n    const fmMatch = content.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/);\r\n    if (fmMatch) {\r\n      const fmText = fmMatch[1].toLowerCase();\r\n      for (const ban of banEntries) {\r\n        const targetLower = target.toLowerCase();\r\n        if (\r\n          targetLower.includes(ban) ||\r\n          fmText.includes(`name: ${ban}`) ||\r\n          fmText.includes(`author: ${ban}`) ||\r\n          fmText.includes(`slug: ${ban}`)\r\n        ) {\r\n          console.error(\r\n            chalk.bgRed.white.bold(` BANNED `) +\r\n            chalk.red(` Skill matches ban list entry: ${ban}`)\r\n          );\r\n          console.error(chalk.dim(`  Source: ${banFile}`));\r\n          process.exit(1);\r\n        }\r\n      }\r\n    }\r\n  }\r\n\r\n  // Load .clawvetignore\r\n  const ignoreFile = join(process.cwd(), \".clawvetignore\");\r\n  const ignorePatterns: string[] = [];\r\n  if (existsSync(ignoreFile)) {\r\n    const lines = readFileSync(ignoreFile, \"utf-8\").split(\"\\n\");\r\n    for (const line of lines) {\r\n      const trimmed = line.trim();\r\n      if (trimmed && !trimmed.startsWith(\"#\")) {\r\n        ignorePatterns.push(trimmed);\r\n      }\r\n    }\r\n  }\r\n\r\n  const result = await scanSkill(content, {\r\n    semantic: options.semantic ?? false,\r\n    ignorePatterns: ignorePatterns.length ? ignorePatterns : undefined,\r\n    skillName: fallbackName,\r\n  });\r\n\r\n  if (!options.quiet) {\r\n    if (options.format === \"sarif\") {\r\n      printSarifResult(result);\r\n    } else if (options.format === \"json\") {\r\n      printJsonResult(result);\r\n    } else {\r\n      printScanResult(result);\r\n    }\r\n  }\r\n\r\n  // Telemetry: first-run opt-in prompt (only in interactive TTY)\r\n  const isInteractive = !options.quiet && options.format !== \"json\" && options.format !== \"sarif\";\r\n  if (isInteractive) {\r\n    if (!hasBeenAsked() && !isTelemetryEnabled() && process.stdin.isTTY) {\r\n      const readline = await import(\"node:readline\");\r\n      const rl = readline.createInterface({ input: process.stdin, output: process.stderr });\r\n      const answer = await new Promise<string>((resolve) => {\r\n        rl.question(\r\n          chalk.dim(\"Help improve ClawVet — send anonymous usage stats? (y/n) \"),\r\n          (a) => { rl.close(); resolve(a.trim().toLowerCase()); }\r\n        );\r\n      });\r\n      setTelemetry(answer === \"y\" || answer === \"yes\");\r\n    }\r\n\r\n  }\r\n\r\n  // Await telemetry so it completes before any process.exit()\r\n  await sendTelemetry(result);\r\n\r\n  // Show Tally CTA every 5th scan (after increment)\r\n  if (isInteractive && getScanCount() % 5 === 0) {\r\n    console.log(\r\n      chalk.dim(\"  \") +\r\n      chalk.cyan(\"Got feedback? Want threat alerts? → \") +\r\n      chalk.underline.cyan(\"https://tally.so/r/jaMdaa\")\r\n    );\r\n    console.log();\r\n  }\r\n\r\n  const failOn = options.failOn || (options.quiet ? \"high\" : undefined);\r\n  if (failOn) {\r\n    const severityOrder = [\"low\", \"medium\", \"high\", \"critical\"];\r\n    const threshold = severityOrder.indexOf(failOn);\r\n    const hasFailure = result.findings.some(\r\n      (f) => severityOrder.indexOf(f.severity) >= threshold\r\n    );\r\n    if (hasFailure) {\r\n      process.exit(1);\r\n    }\r\n  }\r\n}\r\n","import type { ThreatPattern } from \"./types.js\";\r\n\r\n// Build regex from parts at runtime to avoid AV false positives on signature strings\r\nfunction re(parts: string[], flags: string): RegExp {\r\n  return new RegExp(parts.join(\"\"), flags);\r\n}\r\n\r\nexport const THREAT_PATTERNS: ThreatPattern[] = [\r\n  // ═══════════════════════════════════════════════════════\r\n  // CRITICAL: Remote code execution\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"CURL_PIPE_BASH\",\r\n    pattern: re([\"curl\\\\s+.*\\\\|\\\\s*(ba)?\", \"sh\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Curl piped to shell\",\r\n    description: \"Downloads and executes remote code directly — classic supply chain attack vector.\",\r\n    codeOnly: true,\r\n    fix: \"Download the script first, inspect it, then execute: `curl -o setup.sh URL && cat setup.sh && bash setup.sh`\",\r\n  },\r\n  {\r\n    name: \"WGET_EXECUTE\",\r\n    pattern: re([\"wget\\\\s+.*&&\\\\s*(ba)?\", \"sh\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Wget with shell execution\",\r\n    description: \"Downloads and executes remote code via wget.\",\r\n    codeOnly: true,\r\n    fix: \"Download the file first with `wget -O script.sh URL`, review it, then execute.\",\r\n  },\r\n  {\r\n    name: \"EVAL_DYNAMIC\",\r\n    pattern: re([\"ev\", \"al\\\\s*\\\\(\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Dynamic code evaluation\",\r\n    description: \"Uses dynamic code evaluation which can run arbitrary code.\",\r\n    codeOnly: true,\r\n    fix: \"Replace dynamic evaluation with a safer alternative like JSON.parse() or a sandboxed environment.\",\r\n  },\r\n  {\r\n    name: \"BASE64_DECODE\",\r\n    pattern: re([\"base\", \"64\\\\s+(-d|--dec\", \"ode)\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"obfuscation\",\r\n    title: \"Base64 decode execution\",\r\n    description: \"Decodes base64 content, often used to hide malicious payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Decode and include the command directly so users can review it.\",\r\n  },\r\n  {\r\n    name: \"PYTHON_EXEC\",\r\n    pattern: re([\"pyth\", \"on[3]?\\\\s+-c\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Python inline execution\",\r\n    description: \"Executes inline Python code which may contain hidden payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Move inline code to a separate .py file so users can review it before execution.\",\r\n  },\r\n  {\r\n    name: \"REVERSE_SHELL\",\r\n    pattern: re([\"\\\\/dev\\\\/tc\", \"p\\\\/|nc\\\\s+-[elp]|nca\", \"t\\\\s+-|mkfi\", \"fo\\\\s+.*\\\\/tmp\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Reverse shell\",\r\n    description: \"Creates a reverse connection back to an attacker-controlled server.\",\r\n    codeOnly: true,\r\n    fix: \"Remove reverse connection commands — these are almost never legitimate in skills.\",\r\n  },\r\n  {\r\n    name: \"CRON_PERSISTENCE\",\r\n    pattern: re([\"cron\", \"tab\\\\s+-|\\\\/etc\\\\/cro\", \"n|system\", \"ctl\\\\s+enable\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"persistence\",\r\n    title: \"Scheduled task persistence\",\r\n    description: \"Installs a cron job or systemd service for persistent execution after reboot.\",\r\n    codeOnly: true,\r\n    fix: \"Document the scheduled task in the skill description and require explicit user consent before installing.\",\r\n  },\r\n  {\r\n    name: \"PERL_EXEC\",\r\n    pattern: re([\"per\", \"l\\\\s+-e\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Perl inline execution\",\r\n    description: \"Executes inline Perl code which may contain obfuscated payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Move inline code to a separate .pl file so users can review it before execution.\",\r\n  },\r\n  {\r\n    name: \"NODE_EVAL\",\r\n    pattern: re([\"no\", \"de\\\\s+-e\\\\s\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Node.js inline execution\",\r\n    description: \"Executes inline Node.js code, often used to hide malicious logic.\",\r\n    codeOnly: true,\r\n    fix: \"Move inline code to a separate .js file so users can review it before execution.\",\r\n  },\r\n  {\r\n    name: \"RUBY_EXEC\",\r\n    pattern: re([\"rub\", \"y\\\\s+-e\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Ruby inline execution\",\r\n    description: \"Executes inline Ruby code which may contain hidden payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Move inline code to a separate .rb file so users can review it before execution.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // HIGH: Credential theft\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"ENV_FILE_READ\",\r\n    pattern: /\\.env|credentials|\\.aws|\\.ssh|keychain/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Sensitive file access\",\r\n    description: \"Accesses credential files (.env, .aws, .ssh, keychain).\",\r\n    fix: \"Declare required env vars in frontmatter under `metadata.openclaw.requires.env`.\",\r\n  },\r\n  {\r\n    name: \"API_KEY_EXFIL\",\r\n    pattern: /(ANTHROPIC|OPENAI|SLACK|DISCORD|TELEGRAM|STRIPE|GITHUB|GITLAB|AWS_SECRET|GROQ|OPENROUTER).*(_KEY|_TOKEN|_SECRET)/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"API key reference\",\r\n    description: \"References specific API keys/tokens that could be exfiltrated.\",\r\n    fix: \"Use environment variable references ($VAR) instead of hardcoding keys, and declare them in requires.env.\",\r\n  },\r\n  {\r\n    name: \"DOTFILE_ACCESS\",\r\n    pattern: /~\\/\\.(openclaw|clawdbot|moltbot)\\//gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"OpenClaw config access\",\r\n    description: \"Accesses OpenClaw/Clawdbot/Moltbot configuration directories.\",\r\n    fix: \"Use the official OpenClaw SDK/API instead of directly reading config directories.\",\r\n  },\r\n  {\r\n    name: \"SESSION_THEFT\",\r\n    pattern: /sessions\\/\\*\\.jsonl/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Session data access\",\r\n    description: \"Accesses session transcript files which may contain sensitive data.\",\r\n    fix: \"Remove session file access — skills should not read conversation transcripts.\",\r\n  },\r\n  {\r\n    name: \"SSH_KEY_ACCESS\",\r\n    pattern: /~\\/\\.ssh\\/id_|\\.pem\\b|BEGIN\\s+(RSA\\s+)?PRIVATE\\s+KEY/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"SSH/private key access\",\r\n    description: \"Accesses SSH keys or private key files that could be stolen.\",\r\n    fix: \"Use ssh-agent or a credential manager instead of directly reading key files.\",\r\n  },\r\n  {\r\n    name: \"BROWSER_DATA\",\r\n    pattern: /\\.config\\/google-chrome|\\.mozilla\\/firefox|Login\\s*Data|Cookies\\.sqlite/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Browser data access\",\r\n    description: \"Accesses browser profiles which contain saved passwords, cookies, and tokens.\",\r\n    fix: \"Remove browser data access — skills should not read browser profiles.\",\r\n  },\r\n  {\r\n    name: \"GIT_CREDENTIALS\",\r\n    pattern: /\\.git-credentials|\\.gitconfig|git\\s+config.*credential/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Git credential access\",\r\n    description: \"Accesses git credential storage which may contain auth tokens.\",\r\n    fix: \"Use `git` CLI commands instead of directly reading credential files.\",\r\n  },\r\n  {\r\n    name: \"NPM_TOKEN\",\r\n    pattern: /\\.npmrc|npm_token|NPM_AUTH_TOKEN/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"npm token access\",\r\n    description: \"Accesses npm auth tokens which could be used to publish malicious packages.\",\r\n    fix: \"Use `npm whoami` or `npm config get` instead of directly reading .npmrc.\",\r\n  },\r\n  {\r\n    name: \"KUBE_CONFIG\",\r\n    pattern: /~\\/\\.kube\\/config|KUBECONFIG/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Kubernetes config access\",\r\n    description: \"Accesses Kubernetes configuration which contains cluster credentials.\",\r\n    fix: \"Use `kubectl` CLI commands instead of directly reading kubeconfig.\",\r\n  },\r\n  {\r\n    name: \"DOCKER_SOCKET\",\r\n    pattern: /\\/var\\/run\\/docker\\.sock|docker\\s+exec/gi,\r\n    severity: \"high\",\r\n    category: \"container_escape\",\r\n    title: \"Docker socket/exec access\",\r\n    description: \"Accesses Docker socket or runs exec — could enable container escape.\",\r\n    fix: \"Use Docker SDK or CLI with limited permissions instead of direct socket access.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // HIGH: Network exfiltration\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"WEBHOOK_SEND\",\r\n    pattern: /webhook\\.(site|url)|discord\\.com\\/api\\/webhooks|hooks\\.slack\\.com|api\\.telegram\\.org\\/bot/gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Webhook data exfiltration\",\r\n    description: \"Sends data to webhook endpoints (Discord, Slack, Telegram) — common exfiltration channel.\",\r\n    fix: \"If webhook integration is needed, declare it in the skill description and let users configure their own webhook URL.\",\r\n  },\r\n  {\r\n    name: \"BORE_TUNNEL\",\r\n    pattern: /bore\\.pub|ngrok|localtunnel|serveo\\.net|localhost\\.run/gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Tunnel service usage\",\r\n    description: \"Uses tunneling services to expose local services or exfiltrate data.\",\r\n    fix: \"Document tunnel usage in the skill description and require explicit user consent.\",\r\n  },\r\n  {\r\n    name: \"SUSPICIOUS_IP\",\r\n    pattern: /\\b(?:91\\.92\\.242\\.\\d+|45\\.61\\.\\d+\\.\\d+)\\b/g,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Known malicious IP\",\r\n    description: \"Contains IP addresses associated with known ClawHavoc C2 infrastructure.\",\r\n    fix: \"Remove references to known malicious IP addresses.\",\r\n  },\r\n  {\r\n    name: \"DNS_EXFIL\",\r\n    pattern: /dig\\s+.*TXT|nslookup\\s+.*\\$|dns.*exfil|\\.burpcollaborator\\.|\\.oastify\\./gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"DNS exfiltration\",\r\n    description: \"Uses DNS queries to exfiltrate data — bypasses most firewalls.\",\r\n    fix: \"Remove DNS exfiltration patterns — use standard HTTP APIs for data transfer.\",\r\n  },\r\n  {\r\n    name: \"PASTEBIN_FETCH\",\r\n    pattern: /pastebin\\.com|paste\\.ee|hastebin\\.com|ghostbin\\.|dpaste\\./gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Pastebin service usage\",\r\n    description: \"References paste services commonly used to host malicious payloads or receive exfiltrated data.\",\r\n    fix: \"Host code in a version-controlled repository (GitHub, GitLab) instead of paste services.\",\r\n  },\r\n  {\r\n    name: \"SUSPICIOUS_TLD\",\r\n    pattern: /https?:\\/\\/[^\\s\"']*\\.(tk|ml|ga|cf|gq|top|xyz|pw|cc|ws|buzz)\\b/gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Suspicious TLD\",\r\n    description: \"URL uses a top-level domain frequently associated with malicious infrastructure.\",\r\n    fix: \"Use URLs from well-known, reputable domains instead of suspicious TLDs.\",\r\n  },\r\n  {\r\n    name: \"URL_SHORTENER\",\r\n    pattern: /bit\\.ly|tinyurl\\.com|t\\.co\\/|goo\\.gl|is\\.gd|buff\\.ly|ow\\.ly|rb\\.gy/gi,\r\n    severity: \"high\",\r\n    category: \"obfuscation\",\r\n    title: \"URL shortener\",\r\n    description: \"Uses URL shorteners to hide the real destination of links.\",\r\n    fix: \"Use the full, unshortened URL so users can verify the destination.\",\r\n  },\r\n  {\r\n    name: \"RAW_SOCKET\",\r\n    pattern: re([\"new\\\\s+Soc\", \"ket|net\\\\.conn\", \"ect|dgram\\\\.create\", \"Socket\"], \"gi\"),\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Raw socket connection\",\r\n    description: \"Creates raw network sockets which can bypass HTTP monitoring.\",\r\n    codeOnly: true,\r\n    fix: \"Use standard HTTP libraries (fetch, axios) instead of raw sockets for network communication.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // MEDIUM: Social engineering\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"PREREQUISITE_INSTALL\",\r\n    pattern: /prerequisite|install.*first|run.*before|required.*dependency/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Prerequisite install trick\",\r\n    description: \"Instructs users to install prerequisites — common social engineering tactic.\",\r\n    fix: \"Declare dependencies in `metadata.openclaw.requires.bins` instead of instructing manual installs.\",\r\n  },\r\n  {\r\n    name: \"COPY_PASTE_COMMAND\",\r\n    pattern: /copy.*paste.*terminal|run.*this.*command/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Copy-paste command instruction\",\r\n    description: \"Instructs users to copy-paste commands into their terminal.\",\r\n    fix: \"Put commands in code blocks with proper context instead of copy-paste instructions.\",\r\n  },\r\n  {\r\n    name: \"FAKE_DEPENDENCY\",\r\n    pattern: /openclaw-core|moltbot-runtime|clawdbot-helper/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Fake dependency reference\",\r\n    description: \"References fake packages that mimic official OpenClaw components.\",\r\n    fix: \"Use only official OpenClaw packages from the verified registry.\",\r\n  },\r\n  {\r\n    name: \"AUTHORITY_SPOOFING\",\r\n    pattern: /official\\s+(openclaw|clawhub)|endorsed\\s+by|verified\\s+(skill|publisher)|from\\s+the\\s+openclaw\\s+team/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Authority spoofing\",\r\n    description: \"Claims official endorsement or verification to gain trust.\",\r\n    fix: \"Remove false authority claims — let the skill's quality speak for itself.\",\r\n  },\r\n  {\r\n    name: \"URGENCY_MANIPULATION\",\r\n    pattern: /critical\\s+update|security\\s+patch|must\\s+install\\s+immediately|urgent.*update/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Urgency manipulation\",\r\n    description: \"Creates false urgency to pressure users into installing without review.\",\r\n    fix: \"Remove urgency language — let users evaluate the skill at their own pace.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // MEDIUM: Prompt injection\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"IGNORE_INSTRUCTIONS\",\r\n    pattern: /ignore\\s+(all\\s+)?previous\\s+instructions/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"Prompt injection — ignore instructions\",\r\n    description: \"Attempts to override the AI agent's existing instructions.\",\r\n    fix: \"Remove prompt injection attempts — skills should not try to override agent instructions.\",\r\n  },\r\n  {\r\n    name: \"SYSTEM_OVERRIDE\",\r\n    pattern: /you\\s+are\\s+now|new\\s+instructions|forget\\s+everything/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"Prompt injection — system override\",\r\n    description: \"Attempts to redefine the AI agent's identity or instructions.\",\r\n    fix: \"Remove system override attempts — skills should not alter agent identity.\",\r\n  },\r\n  {\r\n    name: \"MEMORY_MANIPULATION\",\r\n    pattern: /SOUL\\.md|MEMORY\\.md|AGENTS\\.md/gi,\r\n    severity: \"medium\",\r\n    category: \"persistence\",\r\n    title: \"Memory/personality file manipulation\",\r\n    description: \"References core personality or memory files, may attempt persistence.\",\r\n    fix: \"Remove references to agent memory/personality files — skills should not modify agent state.\",\r\n  },\r\n  {\r\n    name: \"JAILBREAK_ATTEMPT\",\r\n    pattern: /\\bDAN\\b|do\\s+anything\\s+now|developer\\s+mode|evil\\s+mode|bypass.*safety/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"Jailbreak attempt\",\r\n    description: \"Uses known jailbreak techniques (DAN, developer mode) to bypass safety constraints.\",\r\n    fix: \"Remove jailbreak attempts — skills should work within the agent's safety constraints.\",\r\n  },\r\n  {\r\n    name: \"ROLE_HIJACK\",\r\n    pattern: /(?:pretend|act|behave)\\s+(?:you\\s+are|as\\s+if|to\\s+be)\\s+(?:a\\s+)?(?:different|new|hacker|evil)/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"Role hijacking\",\r\n    description: \"Attempts to change the agent's persona to bypass safety restrictions.\",\r\n    fix: \"Remove role hijacking attempts — skills should not alter the agent's persona.\",\r\n  },\r\n  {\r\n    name: \"PROMPT_EXTRACTION\",\r\n    pattern: /(?:reveal|show|print|output|tell\\s+me)\\s+(?:your\\s+)?(?:system\\s+)?(?:prompt|instructions|rules)/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"System prompt extraction\",\r\n    description: \"Attempts to extract the agent's system prompt or configuration.\",\r\n    fix: \"Remove prompt extraction attempts — skills should not try to access system prompts.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // MEDIUM: Obfuscation\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"HEX_ENCODING\",\r\n    pattern: /\\\\x[0-9a-f]{2}(?:\\\\x[0-9a-f]{2}){3,}/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Hex-encoded payload\",\r\n    description: \"Contains hex-encoded strings commonly used to hide malicious commands.\",\r\n    codeOnly: true,\r\n    fix: \"Replace hex-encoded strings with readable text so users can review the content.\",\r\n  },\r\n  {\r\n    name: \"JS_OBFUSCATOR\",\r\n    pattern: /_0x[a-f0-9]{4,}|var\\s+_0x/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"JavaScript obfuscator output\",\r\n    description: \"Contains patterns from JavaScript obfuscation tools used to hide malicious code.\",\r\n    codeOnly: true,\r\n    fix: \"Provide readable, unobfuscated source code instead of obfuscated JavaScript.\",\r\n  },\r\n  {\r\n    name: \"UNICODE_STEGANOGRAPHY\",\r\n    pattern: /[\\u200B\\u200C\\u200D\\u2060\\uFEFF]{3,}/g,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Hidden zero-width characters\",\r\n    description: \"Contains clusters of invisible zero-width Unicode characters that may hide instructions.\",\r\n    fix: \"Remove zero-width characters — all content should be visible to users.\",\r\n  },\r\n  {\r\n    name: \"RTL_OVERRIDE\",\r\n    pattern: /[\\u202A\\u202B\\u202C\\u202D\\u202E\\u2066\\u2067\\u2068\\u2069]/g,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Bidirectional text override\",\r\n    description: \"Contains Unicode bidi override characters that can reverse displayed text to hide real content.\",\r\n    fix: \"Remove bidirectional text override characters — text direction should be natural.\",\r\n  },\r\n  {\r\n    name: \"HTML_COMMENT_INJECTION\",\r\n    pattern: /<!--[\\s\\S]*?(?:ignore|instructions|system|override|secret)[\\s\\S]*?-->/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Hidden HTML comment instruction\",\r\n    description: \"Embeds instructions inside HTML comments that are invisible to users but read by agents.\",\r\n    fix: \"Move instructions from HTML comments into visible content.\",\r\n  },\r\n  {\r\n    name: \"STRING_CONCAT_OBFUSC\",\r\n    pattern: /[\"'][a-z]{1,3}[\"']\\s*\\+\\s*[\"'][a-z]{1,3}[\"']\\s*\\+\\s*[\"'][a-z]{1,3}[\"']/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"String concatenation obfuscation\",\r\n    description: \"Builds commands via single-character string concatenation to evade pattern detection.\",\r\n    codeOnly: true,\r\n    fix: \"Use complete string literals instead of character-by-character concatenation.\",\r\n  },\r\n  {\r\n    name: \"BUFFER_BASE64_DECODE\",\r\n    pattern: re([\"Buf\", \"fer\\\\.from\\\\s*\\\\(.*['\\\"]base\", \"64['\\\"]\\\\)|at\", \"ob\\\\s*\\\\(\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"obfuscation\",\r\n    title: \"Buffer/atob encoded payload\",\r\n    description: \"Decodes encoded content via Buffer.from() or atob(), often used to hide malicious payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Include the decoded content directly so users can review it.\",\r\n  },\r\n  {\r\n    name: \"STRING_FROMCHARCODE\",\r\n    pattern: re([\"String\\\\.from\", \"CharCode\\\\s*\\\\(\"], \"gi\"),\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"String.fromCharCode usage\",\r\n    description: \"Builds strings from character codes to evade static pattern detection.\",\r\n    codeOnly: true,\r\n    fix: \"Use plain string literals instead of String.fromCharCode().\",\r\n  },\r\n  {\r\n    name: \"DYNAMIC_PROPERTY_ACCESS\",\r\n    pattern: /(?:process|global|window|globalThis)\\s*\\[\\s*['\"`]?\\w*['\"`]?\\s*\\+/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Dynamic property access on globals\",\r\n    description: \"Dynamically accesses global object properties via string concatenation to hide intent.\",\r\n    codeOnly: true,\r\n    fix: \"Use direct property access (e.g., `process.env`) instead of dynamic bracket notation.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // MEDIUM: Privilege escalation & system access\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"SUDO_USAGE\",\r\n    pattern: /sudo\\s+(?!apt|dnf|yum|brew)/gi,\r\n    severity: \"medium\",\r\n    category: \"privilege_escalation\",\r\n    title: \"Sudo usage\",\r\n    description: \"Requests elevated privileges — check if actually required for the task.\",\r\n    codeOnly: true,\r\n    fix: \"Remove sudo if not strictly necessary, or document why elevated privileges are required.\",\r\n  },\r\n  {\r\n    name: \"CHMOD_DANGEROUS\",\r\n    pattern: /chmod\\s+(?:777|a\\+[rwx]|[+]s)/gi,\r\n    severity: \"medium\",\r\n    category: \"privilege_escalation\",\r\n    title: \"Dangerous file permissions\",\r\n    description: \"Sets overly permissive file permissions (777) or setuid/setgid bits.\",\r\n    codeOnly: true,\r\n    fix: \"Use least-privilege permissions (e.g., `chmod 755` or `chmod 644`) instead of 777.\",\r\n  },\r\n  {\r\n    name: \"PATH_TRAVERSAL\",\r\n    pattern: /\\.\\.\\//g,\r\n    severity: \"medium\",\r\n    category: \"file_system\",\r\n    title: \"Path traversal\",\r\n    description: \"Uses relative path traversal (../) which could access files outside expected directories.\",\r\n    fix: \"Use absolute paths or paths relative to the skill's working directory.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // LOW: Suspicious but not necessarily malicious\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"SHELL_EXEC\",\r\n    pattern: re([\"child_\", \"process|ex\", \"ec\\\\(|spa\", \"wn\\\\(\"], \"gi\"),\r\n    severity: \"low\",\r\n    category: \"code_execution\",\r\n    title: \"Shell execution API\",\r\n    description: \"Uses shell execution APIs — legitimate but worth noting.\",\r\n    codeOnly: true,\r\n    fix: \"If shell execution is needed, use execFile() with explicit arguments instead of exec() with string commands.\",\r\n  },\r\n  {\r\n    name: \"NETWORK_REQUEST\",\r\n    pattern: /fetch\\(|axios|node-fetch|got\\(/gi,\r\n    severity: \"low\",\r\n    category: \"network\",\r\n    title: \"Network request API\",\r\n    description: \"Makes network requests — legitimate but worth reviewing targets.\",\r\n    codeOnly: true,\r\n    fix: \"Document all network endpoints in the skill description so users can review them.\",\r\n  },\r\n  {\r\n    name: \"FILE_WRITE\",\r\n    pattern: /fs\\.write|writeFileSync/gi,\r\n    severity: \"low\",\r\n    category: \"file_system\",\r\n    title: \"File write operation\",\r\n    description: \"Writes to the filesystem — check what files are being modified.\",\r\n    codeOnly: true,\r\n    fix: \"Document which files are written and why in the skill description.\",\r\n  },\r\n  {\r\n    name: \"ENV_MODIFICATION\",\r\n    pattern: /process\\.env\\[|export\\s+[A-Z_]+=|setenv/gi,\r\n    severity: \"low\",\r\n    category: \"environment\",\r\n    title: \"Environment variable modification\",\r\n    description: \"Modifies environment variables which could affect other tools or processes.\",\r\n    codeOnly: true,\r\n    fix: \"Document env var modifications in the skill description and declare them in requires.env.\",\r\n  },\r\n  {\r\n    name: \"WILDCARD_FILE_ACCESS\",\r\n    pattern: /\\*\\.(pem|key|p12|pfx|jks|keystore|ovpn|rdp)/gi,\r\n    severity: \"low\",\r\n    category: \"credential_theft\",\r\n    title: \"Sensitive file extension glob\",\r\n    description: \"Globs for files with sensitive extensions (keys, certificates, VPN configs).\",\r\n    fix: \"Reference specific files by name instead of using wildcard patterns on sensitive extensions.\",\r\n  },\r\n  {\r\n    name: \"LARGE_BASE64_LITERAL\",\r\n    pattern: /[A-Za-z0-9+/=]{100,}/g,\r\n    severity: \"low\",\r\n    category: \"obfuscation\",\r\n    title: \"Large base64-like string\",\r\n    description: \"Contains a long base64-like string that may be an encoded payload.\",\r\n    fix: \"Include the decoded content directly or explain what the base64 string contains.\",\r\n  },\r\n];\r\n\r\nexport const POPULAR_SKILLS = [\r\n  \"todoist-cli\",\r\n  \"github-manager\",\r\n  \"slack-assistant\",\r\n  \"email-composer\",\r\n  \"calendar-sync\",\r\n  \"weather-forecast\",\r\n  \"news-reader\",\r\n  \"code-reviewer\",\r\n  \"docker-helper\",\r\n  \"aws-manager\",\r\n  \"notion-sync\",\r\n  \"jira-tracker\",\r\n  \"spotify-controller\",\r\n  \"home-assistant\",\r\n  \"file-organizer\",\r\n  \"pdf-reader\",\r\n  \"translate-text\",\r\n  \"image-generator\",\r\n  \"web-scraper\",\r\n  \"database-query\",\r\n  \"git-assistant\",\r\n  \"linux-admin\",\r\n  \"python-helper\",\r\n  \"react-builder\",\r\n  \"api-tester\",\r\n  \"markdown-editor\",\r\n  \"csv-analyzer\",\r\n  \"ssh-manager\",\r\n  \"cron-scheduler\",\r\n  \"log-analyzer\",\r\n];\r\n","import { parse as parseYaml } from \"yaml\";\r\nimport type { ParsedSkill, SkillFrontmatter, CodeBlock } from \"../types.js\";\r\n\r\nconst FRONTMATTER_RE = /^---\\r?\\n([\\s\\S]*?)\\r?\\n---/;\r\nconst CODE_BLOCK_RE = /```(\\w*)\\r?\\n([\\s\\S]*?)```/g;\r\nconst URL_RE = /https?:\\/\\/[^\\s\"'<>\\])+]+/gi;\r\nconst IP_RE = /\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b/g;\r\nconst DOMAIN_RE = /\\b(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}\\b/gi;\r\n\r\nexport function parseSkill(content: string): ParsedSkill {\r\n  let frontmatter: SkillFrontmatter = {};\r\n  let body = content;\r\n\r\n  const fmMatch = content.match(FRONTMATTER_RE);\r\n  if (fmMatch) {\r\n    try {\r\n      frontmatter = parseYaml(fmMatch[1]) as SkillFrontmatter;\r\n    } catch {\r\n      frontmatter = {};\r\n    }\r\n    body = content.slice(fmMatch[0].length).trim();\r\n  }\r\n\r\n  const codeBlocks: CodeBlock[] = [];\r\n  let match: RegExpExecArray | null;\r\n  const cbRe = new RegExp(CODE_BLOCK_RE.source, CODE_BLOCK_RE.flags);\r\n\r\n  while ((match = cbRe.exec(content)) !== null) {\r\n    const before = content.slice(0, match.index);\r\n    const lineStart = before.split(\"\\n\").length;\r\n    const blockLines = match[0].split(\"\\n\").length;\r\n    codeBlocks.push({\r\n      language: match[1] || \"unknown\",\r\n      content: match[2],\r\n      lineStart,\r\n      lineEnd: lineStart + blockLines - 1,\r\n    });\r\n  }\r\n\r\n  const urls = [...new Set(content.match(URL_RE) || [])];\r\n  const ipAddresses = [...new Set(content.match(IP_RE) || [])];\r\n  const domains = [...new Set(content.match(DOMAIN_RE) || [])];\r\n\r\n  return {\r\n    frontmatter,\r\n    body,\r\n    codeBlocks,\r\n    urls,\r\n    ipAddresses,\r\n    domains,\r\n    rawContent: content,\r\n  };\r\n}\r\n","import { THREAT_PATTERNS } from \"../patterns.js\";\r\nimport type { Finding, ParsedSkill, Severity } from \"../types.js\";\r\n\r\nfunction isInCodeBlock(lineNumber: number, skill: ParsedSkill): boolean {\r\n  return skill.codeBlocks.some(\r\n    (block) => lineNumber >= block.lineStart && lineNumber <= block.lineEnd\r\n  );\r\n}\r\n\r\nfunction isInHeading(lineNumber: number, rawContent: string): boolean {\r\n  const lines = rawContent.split(\"\\n\");\r\n  const line = lines[lineNumber - 1] || \"\";\r\n  return /^\\s*#{1,6}\\s/.test(line);\r\n}\r\n\r\nconst BASE_CONFIDENCE: Record<Severity, number> = {\r\n  critical: 0.9,\r\n  high: 0.8,\r\n  medium: 0.6,\r\n  low: 0.5,\r\n};\r\n\r\nexport function runStaticAnalysis(skill: ParsedSkill): Finding[] {\r\n  const findings: Finding[] = [];\r\n\r\n  for (const threat of THREAT_PATTERNS) {\r\n    const re = new RegExp(threat.pattern.source, threat.pattern.flags);\r\n    let match: RegExpExecArray | null;\r\n\r\n    while ((match = re.exec(skill.rawContent)) !== null) {\r\n      const before = skill.rawContent.slice(0, match.index);\r\n      const lineNumber = before.split(\"\\n\").length;\r\n\r\n      if (threat.codeOnly && !isInCodeBlock(lineNumber, skill)) {\r\n        continue;\r\n      }\r\n\r\n      const inCode = isInCodeBlock(lineNumber, skill);\r\n      const inHeading = isInHeading(lineNumber, skill.rawContent);\r\n\r\n      let contextMultiplier: number;\r\n      if (inCode && threat.codeOnly) {\r\n        contextMultiplier = 1.0;\r\n      } else if (inCode) {\r\n        contextMultiplier = 0.95;\r\n      } else if (inHeading) {\r\n        contextMultiplier = 0.5;\r\n      } else if (threat.codeOnly) {\r\n        // codeOnly pattern somehow in prose (shouldn't happen due to skip above)\r\n        contextMultiplier = 0.4;\r\n      } else {\r\n        // Non-codeOnly patterns are designed to match in prose\r\n        contextMultiplier = 0.9;\r\n      }\r\n\r\n      const baseConfidence = BASE_CONFIDENCE[threat.severity];\r\n      const confidence = Math.min(1.0, baseConfidence * contextMultiplier);\r\n\r\n      findings.push({\r\n        category: threat.category,\r\n        severity: threat.severity,\r\n        title: threat.title,\r\n        description: threat.description,\r\n        evidence: match[0],\r\n        lineNumber,\r\n        analysisPass: \"static-analysis\",\r\n        confidence: Math.round(confidence * 100) / 100,\r\n        fix: threat.fix,\r\n      });\r\n    }\r\n  }\r\n\r\n  return findings;\r\n}\r\n","import type { Finding, ParsedSkill } from \"../types.js\";\r\n\r\nconst SEMVER_RE = /^\\d+\\.\\d+\\.\\d+/;\r\n\r\nconst KNOWN_BINS = [\r\n  \"curl\", \"wget\", \"git\", \"python\", \"python3\", \"node\", \"npm\", \"npx\",\r\n  \"brew\", \"apt\", \"pip\", \"docker\", \"kubectl\", \"ssh\", \"scp\", \"rsync\",\r\n  \"ffmpeg\", \"jq\", \"sed\", \"awk\", \"grep\", \"find\",\r\n];\r\n\r\nexport function validateMetadata(skill: ParsedSkill): Finding[] {\r\n  const findings: Finding[] = [];\r\n  const fm = skill.frontmatter;\r\n  const pass = \"metadata-validator\";\r\n\r\n  if (!fm.name) {\r\n    findings.push({\r\n      category: \"metadata\",\r\n      severity: \"medium\",\r\n      title: \"Missing skill name\",\r\n      description: \"SKILL.md frontmatter does not declare a name.\",\r\n      analysisPass: pass,\r\n      fix: \"Add `name:` to the YAML frontmatter.\",\r\n    });\r\n  }\r\n\r\n  if (!fm.description) {\r\n    findings.push({\r\n      category: \"metadata\",\r\n      severity: \"medium\",\r\n      title: \"Missing description\",\r\n      description: \"SKILL.md frontmatter does not declare a description.\",\r\n      analysisPass: pass,\r\n      fix: \"Add `description:` to the YAML frontmatter.\",\r\n    });\r\n  } else if (fm.description.length < 10) {\r\n    findings.push({\r\n      category: \"metadata\",\r\n      severity: \"low\",\r\n      title: \"Vague description\",\r\n      description: \"Skill description is suspiciously short.\",\r\n      evidence: fm.description,\r\n      analysisPass: pass,\r\n      fix: \"Write a more detailed description (at least 10 characters).\",\r\n    });\r\n  }\r\n\r\n  if (fm.version && !SEMVER_RE.test(fm.version)) {\r\n    findings.push({\r\n      category: \"metadata\",\r\n      severity: \"low\",\r\n      title: \"Invalid version format\",\r\n      description: \"Version does not follow semver format.\",\r\n      evidence: fm.version,\r\n      analysisPass: pass,\r\n      fix: \"Use semver format: `version: X.Y.Z` (e.g., `1.0.0`).\",\r\n    });\r\n  }\r\n\r\n  const declaredBins = new Set(fm.metadata?.openclaw?.requires?.bins || []);\r\n\r\n  for (const bin of KNOWN_BINS) {\r\n    const binRe = new RegExp(`\\\\b${bin}\\\\b`, \"i\");\r\n    if (binRe.test(skill.rawContent) && !declaredBins.has(bin)) {\r\n      const usedInCode = skill.codeBlocks.some((cb) => binRe.test(cb.content));\r\n      if (usedInCode) {\r\n        findings.push({\r\n          category: \"metadata\",\r\n          severity: \"low\",\r\n          title: `Undeclared binary: ${bin}`,\r\n          description: `Skill uses '${bin}' in code but does not declare it in requires.bins.`,\r\n          analysisPass: pass,\r\n          fix: `Add '${bin}' to \\`metadata.openclaw.requires.bins\\` in frontmatter.`,\r\n        });\r\n      }\r\n    }\r\n  }\r\n\r\n  const declaredEnv = new Set(fm.metadata?.openclaw?.requires?.env || []);\r\n  const envRe = /\\$\\{?([A-Z][A-Z0-9_]+)\\}?/g;\r\n  let match: RegExpExecArray | null;\r\n\r\n  while ((match = envRe.exec(skill.rawContent)) !== null) {\r\n    const envVar = match[1];\r\n    if (!declaredEnv.has(envVar) && envVar.length > 2) {\r\n      findings.push({\r\n        category: \"metadata\",\r\n        severity: \"low\",\r\n        title: `Undeclared env var: ${envVar}`,\r\n        description: `References environment variable $${envVar} but does not declare it in requires.env.`,\r\n        evidence: match[0],\r\n        analysisPass: pass,\r\n        fix: `Add '${envVar}' to \\`metadata.openclaw.requires.env\\` in frontmatter.`,\r\n      });\r\n    }\r\n  }\r\n\r\n  return findings;\r\n}\r\n","import type { Finding, ParsedSkill } from \"../types.js\";\r\n\r\nconst NPX_AUTO_INSTALL_RE = /npx\\s+-y\\s+/gi;\r\nconst NPM_INSTALL_RE = /npm\\s+install\\s+(-g\\s+)?(\\S+)/gi;\r\n\r\nexport function checkDependencies(skill: ParsedSkill): Finding[] {\r\n  const findings: Finding[] = [];\r\n  const pass = \"dependency-checker\";\r\n\r\n  let match: RegExpExecArray | null;\r\n  const npxRe = new RegExp(NPX_AUTO_INSTALL_RE.source, NPX_AUTO_INSTALL_RE.flags);\r\n\r\n  while ((match = npxRe.exec(skill.rawContent)) !== null) {\r\n    const before = skill.rawContent.slice(0, match.index);\r\n    const lineNumber = before.split(\"\\n\").length;\r\n\r\n    findings.push({\r\n      category: \"dependency_risk\",\r\n      severity: \"medium\",\r\n      title: \"npx auto-install (-y flag)\",\r\n      description: \"Uses 'npx -y' which auto-installs packages without user confirmation.\",\r\n      evidence: match[0],\r\n      lineNumber,\r\n      analysisPass: pass,\r\n      fix: \"Remove the `-y` flag from npx to require user confirmation before installing.\",\r\n    });\r\n  }\r\n\r\n  const npmRe = new RegExp(NPM_INSTALL_RE.source, NPM_INSTALL_RE.flags);\r\n  while ((match = npmRe.exec(skill.rawContent)) !== null) {\r\n    if (match[1]) {\r\n      findings.push({\r\n        category: \"dependency_risk\",\r\n        severity: \"medium\",\r\n        title: \"Global npm package install\",\r\n        description: `Installs npm package globally: ${match[2]}`,\r\n        evidence: match[0],\r\n        analysisPass: pass,\r\n        fix: \"Use a local install (`npm install` without `-g`) or declare the dependency in requires.bins.\",\r\n      });\r\n    }\r\n  }\r\n\r\n  return findings;\r\n}\r\n","import { distance } from \"fastest-levenshtein\";\r\nimport { POPULAR_SKILLS } from \"../patterns.js\";\r\nimport type { Finding } from \"../types.js\";\r\n\r\nconst MAX_EDIT_DISTANCE = 2;\r\n\r\nexport function detectTyposquats(skillName: string): Finding[] {\r\n  if (!skillName) return [];\r\n\r\n  const findings: Finding[] = [];\r\n  const normalized = skillName.toLowerCase().trim();\r\n\r\n  for (const popular of POPULAR_SKILLS) {\r\n    if (normalized === popular) continue;\r\n\r\n    const d = distance(normalized, popular);\r\n    if (d > 0 && d <= MAX_EDIT_DISTANCE) {\r\n      findings.push({\r\n        category: \"typosquatting\",\r\n        severity: \"high\",\r\n        title: `Possible typosquat of \"${popular}\"`,\r\n        description: `Skill name \"${skillName}\" is ${d} edit(s) away from popular skill \"${popular}\". This may be an attempt to impersonate a trusted skill.`,\r\n        evidence: `\"${skillName}\" ≈ \"${popular}\" (distance: ${d})`,\r\n        analysisPass: \"typosquat-detector\",\r\n      });\r\n    }\r\n  }\r\n\r\n  const patterns = [\r\n    { re: /-{2,}/, desc: \"extra hyphens\" },\r\n    { re: /(.)\\1{2,}/, desc: \"repeated characters\" },\r\n  ];\r\n\r\n  for (const p of patterns) {\r\n    if (p.re.test(normalized) && !POPULAR_SKILLS.includes(normalized)) {\r\n      findings.push({\r\n        category: \"typosquatting\",\r\n        severity: \"medium\",\r\n        title: `Suspicious naming pattern: ${p.desc}`,\r\n        description: `Skill name \"${skillName}\" has ${p.desc}, which is a common typosquatting technique.`,\r\n        analysisPass: \"typosquat-detector\",\r\n      });\r\n    }\r\n  }\r\n\r\n  return findings;\r\n}\r\n","import type { Finding, FindingsCount, RiskGrade } from \"../types.js\";\r\n\r\nconst SEVERITY_WEIGHTS = {\r\n  critical: 30,\r\n  high: 15,\r\n  medium: 7,\r\n  low: 3,\r\n} as const;\r\n\r\nexport function calculateRiskScore(findings: Finding[]): number {\r\n  let score = 0;\r\n  for (const f of findings) {\r\n    score += SEVERITY_WEIGHTS[f.severity] * (f.confidence ?? 1.0);\r\n  }\r\n  return Math.round(Math.min(score, 100));\r\n}\r\n\r\nexport function getRiskGrade(score: number): RiskGrade {\r\n  if (score <= 10) return \"A\";\r\n  if (score <= 25) return \"B\";\r\n  if (score <= 50) return \"C\";\r\n  if (score <= 75) return \"D\";\r\n  return \"F\";\r\n}\r\n\r\nexport function countFindings(findings: Finding[]): FindingsCount {\r\n  const counts: FindingsCount = { critical: 0, high: 0, medium: 0, low: 0 };\r\n  for (const f of findings) {\r\n    counts[f.severity]++;\r\n  }\r\n  return counts;\r\n}\r\n","import { createHash } from \"node:crypto\";\r\nimport type { ScanResult } from \"../types.js\";\r\n\r\nconst MAX_ENTRIES = 100;\r\nconst cache = new Map<string, ScanResult>();\r\n\r\nfunction hashContent(content: string): string {\r\n  return createHash(\"sha256\").update(content).digest(\"hex\");\r\n}\r\n\r\nexport function getCached(content: string): ScanResult | undefined {\r\n  const key = hashContent(content);\r\n  const result = cache.get(key);\r\n  if (result) {\r\n    // Move to end (most recently used)\r\n    cache.delete(key);\r\n    cache.set(key, result);\r\n  }\r\n  return result;\r\n}\r\n\r\nexport function setCached(content: string, result: ScanResult): void {\r\n  const key = hashContent(content);\r\n  if (cache.has(key)) {\r\n    cache.delete(key);\r\n  } else if (cache.size >= MAX_ENTRIES) {\r\n    // Evict oldest (first entry)\r\n    const oldest = cache.keys().next().value!;\r\n    cache.delete(oldest);\r\n  }\r\n  cache.set(key, result);\r\n}\r\n","import type { Finding, ScanResult } from \"../types.js\";\r\nimport { parseSkill } from \"./skill-parser.js\";\r\nimport { runStaticAnalysis } from \"./static-analysis.js\";\r\nimport { validateMetadata } from \"./metadata-validator.js\";\r\nimport { checkDependencies } from \"./dependency-checker.js\";\r\nimport { detectTyposquats } from \"./typosquat-detector.js\";\r\nimport { calculateRiskScore, getRiskGrade, countFindings } from \"./risk-scorer.js\";\r\nimport { getCached, setCached } from \"./cache.js\";\r\n\r\nexport interface ScanOptions {\r\n  semantic?: boolean;\r\n  semanticAnalyzer?: (content: string) => Promise<Finding[]>;\r\n  ignorePatterns?: string[];\r\n  skipCache?: boolean;\r\n  /** Fallback name when SKILL.md frontmatter is missing `name`. Typically the folder basename. */\r\n  skillName?: string;\r\n}\r\n\r\nexport async function scanSkill(\r\n  content: string,\r\n  options: ScanOptions = {}\r\n): Promise<ScanResult> {\r\n  if (!options.skipCache) {\r\n    const cached = getCached(content);\r\n    if (cached) {\r\n      return { ...cached, cached: true };\r\n    }\r\n  }\r\n\r\n  const skill = parseSkill(content);\r\n  const allFindings: Finding[] = [];\r\n\r\n  allFindings.push(...runStaticAnalysis(skill));\r\n  allFindings.push(...validateMetadata(skill));\r\n\r\n  if (options.semantic && options.semanticAnalyzer) {\r\n    const semanticFindings = await options.semanticAnalyzer(content);\r\n    allFindings.push(...semanticFindings);\r\n  }\r\n\r\n  allFindings.push(...checkDependencies(skill));\r\n\r\n  if (skill.frontmatter.name) {\r\n    allFindings.push(...detectTyposquats(skill.frontmatter.name));\r\n  }\r\n\r\n  // Filter out ignored patterns\r\n  const filteredFindings = options.ignorePatterns?.length\r\n    ? allFindings.filter(\r\n        (f) => !options.ignorePatterns!.some((ig) => f.title === ig || f.category === ig)\r\n      )\r\n    : allFindings;\r\n\r\n  const riskScore = calculateRiskScore(filteredFindings);\r\n  const riskGrade = getRiskGrade(riskScore);\r\n  const findingsCount = countFindings(filteredFindings);\r\n\r\n  const recommendation =\r\n    riskScore >= 76 ? \"block\" : riskScore >= 26 ? \"warn\" : \"approve\";\r\n\r\n  const result: ScanResult = {\r\n    skillName: skill.frontmatter.name || options.skillName || \"unknown\",\r\n    skillVersion: skill.frontmatter.version,\r\n    skillSource: \"local\",\r\n    status: \"complete\",\r\n    riskScore,\r\n    riskGrade,\r\n    findingsCount,\r\n    findings: filteredFindings,\r\n    recommendation,\r\n  };\r\n\r\n  if (!options.skipCache) {\r\n    setCached(content, result);\r\n  }\r\n\r\n  return result;\r\n}\r\n\r\nexport { parseSkill } from \"./skill-parser.js\";\r\nexport { runStaticAnalysis } from \"./static-analysis.js\";\r\nexport { validateMetadata } from \"./metadata-validator.js\";\r\nexport { checkDependencies } from \"./dependency-checker.js\";\r\nexport { detectTyposquats } from \"./typosquat-detector.js\";\r\nexport { calculateRiskScore, getRiskGrade, countFindings } from \"./risk-scorer.js\";\r\n","import chalk from \"chalk\";\r\nimport type { ScanResult, Finding, Severity } from \"@clawvet/shared\";\r\n\r\nconst SEVERITY_COLORS: Record<Severity, (s: string) => string> = {\r\n  critical: chalk.bgRed.white.bold,\r\n  high: chalk.red.bold,\r\n  medium: chalk.yellow,\r\n  low: chalk.blue,\r\n};\r\n\r\nconst GRADE_COLORS: Record<string, (s: string) => string> = {\r\n  A: chalk.green.bold,\r\n  B: chalk.greenBright,\r\n  C: chalk.yellow.bold,\r\n  D: chalk.redBright.bold,\r\n  F: chalk.bgRed.white.bold,\r\n};\r\n\r\nexport function printScanResult(result: ScanResult): void {\r\n  console.log();\r\n  console.log(chalk.bold(\"━\".repeat(60)));\r\n  console.log(chalk.bold(\"  ClawVet Scan Report\"));\r\n  console.log(chalk.bold(\"━\".repeat(60)));\r\n  console.log();\r\n\r\n  console.log(`  Skill:   ${chalk.bold(result.skillName)}`);\r\n  if (result.skillVersion) {\r\n    console.log(`  Version: ${result.skillVersion}`);\r\n  }\r\n  console.log();\r\n\r\n  // Risk score\r\n  const gradeColor = GRADE_COLORS[result.riskGrade] || chalk.white;\r\n  console.log(\r\n    `  Risk Score: ${gradeColor(`${Math.round(result.riskScore)}/100`)}  Grade: ${gradeColor(result.riskGrade)}`\r\n  );\r\n  console.log();\r\n\r\n  // Findings summary\r\n  const fc = result.findingsCount;\r\n  console.log(\"  Findings:\");\r\n  if (fc.critical)\r\n    console.log(\r\n      `    ${SEVERITY_COLORS.critical(` CRITICAL `)} ${fc.critical}`\r\n    );\r\n  if (fc.high)\r\n    console.log(`    ${SEVERITY_COLORS.high(\"HIGH\")}     ${fc.high}`);\r\n  if (fc.medium)\r\n    console.log(`    ${SEVERITY_COLORS.medium(\"MEDIUM\")}   ${fc.medium}`);\r\n  if (fc.low) console.log(`    ${SEVERITY_COLORS.low(\"LOW\")}      ${fc.low}`);\r\n  if (!fc.critical && !fc.high && !fc.medium && !fc.low) {\r\n    console.log(`    ${chalk.green(\"No findings — skill looks clean!\")}`);\r\n  }\r\n  console.log();\r\n\r\n  // Detailed findings\r\n  if (result.findings.length > 0) {\r\n    console.log(chalk.bold(\"  Details:\"));\r\n    console.log();\r\n    for (const f of result.findings) {\r\n      const color = SEVERITY_COLORS[f.severity];\r\n      const confStr = f.confidence != null ? ` ${Math.round(f.confidence * 100)}%` : \"\";\r\n      console.log(`  ${color(`[${f.severity.toUpperCase()}${confStr}]`)} ${f.title}`);\r\n      console.log(`    ${chalk.dim(f.description)}`);\r\n      if (f.evidence) {\r\n        console.log(`    Evidence: ${chalk.italic(f.evidence)}`);\r\n      }\r\n      if (f.lineNumber) {\r\n        console.log(`    Line: ${f.lineNumber}`);\r\n      }\r\n      if (f.fix) {\r\n        console.log(`    Fix: ${chalk.green(f.fix)}`);\r\n      }\r\n      console.log();\r\n    }\r\n  }\r\n\r\n  // Recommendation\r\n  const recColors: Record<string, (s: string) => string> = {\r\n    block: chalk.bgRed.white.bold,\r\n    warn: chalk.bgYellow.black.bold,\r\n    approve: chalk.bgGreen.black.bold,\r\n  };\r\n  const rec = result.recommendation || \"approve\";\r\n  console.log(\r\n    `  Recommendation: ${(recColors[rec] || chalk.white)(` ${rec.toUpperCase()} `)}`\r\n  );\r\n  console.log();\r\n  console.log(chalk.bold(\"━\".repeat(60)));\r\n  console.log();\r\n}\r\n","import type { ScanResult } from \"@clawvet/shared\";\r\n\r\nexport function printJsonResult(result: ScanResult): void {\r\n  console.log(JSON.stringify(result, null, 2));\r\n}\r\n","import type { ScanResult, Finding, Severity } from \"@clawvet/shared\";\r\n\r\nconst SEVERITY_TO_SARIF: Record<Severity, string> = {\r\n  critical: \"error\",\r\n  high: \"error\",\r\n  medium: \"warning\",\r\n  low: \"note\",\r\n};\r\n\r\nconst SEVERITY_TO_LEVEL: Record<Severity, string> = {\r\n  critical: \"9.0\",\r\n  high: \"7.0\",\r\n  medium: \"4.0\",\r\n  low: \"1.0\",\r\n};\r\n\r\nexport function printSarifResult(result: ScanResult): void {\r\n  const rules = new Map<string, { id: string; finding: Finding }>();\r\n\r\n  for (const f of result.findings) {\r\n    const ruleId = f.category + \"/\" + f.title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\r\n    if (!rules.has(ruleId)) {\r\n      rules.set(ruleId, { id: ruleId, finding: f });\r\n    }\r\n  }\r\n\r\n  const sarif = {\r\n    $schema: \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json\",\r\n    version: \"2.1.0\",\r\n    runs: [\r\n      {\r\n        tool: {\r\n          driver: {\r\n            name: \"clawvet\",\r\n            informationUri: \"https://github.com/clawvet/clawvet\",\r\n            rules: [...rules.values()].map((r) => ({\r\n              id: r.id,\r\n              shortDescription: { text: r.finding.title },\r\n              fullDescription: { text: r.finding.description },\r\n              defaultConfiguration: {\r\n                level: SEVERITY_TO_SARIF[r.finding.severity],\r\n              },\r\n              properties: {\r\n                security_severity: SEVERITY_TO_LEVEL[r.finding.severity],\r\n              },\r\n            })),\r\n          },\r\n        },\r\n        results: result.findings.map((f) => {\r\n          const ruleId = f.category + \"/\" + f.title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\r\n          return {\r\n            ruleId,\r\n            level: SEVERITY_TO_SARIF[f.severity],\r\n            message: {\r\n              text: f.description + (f.evidence ? ` Evidence: ${f.evidence}` : \"\"),\r\n              ...(f.fix ? { markdown: `${f.description}\\n\\n**Fix:** ${f.fix}` } : {}),\r\n            },\r\n            locations: [\r\n              {\r\n                physicalLocation: {\r\n                  artifactLocation: { uri: \"SKILL.md\" },\r\n                  region: { startLine: f.lineNumber ?? 1 },\r\n                },\r\n              },\r\n            ],\r\n          };\r\n        }),\r\n      },\r\n    ],\r\n  };\r\n\r\n  console.log(JSON.stringify(sarif, null, 2));\r\n}\r\n","import { readFileSync, writeFileSync, mkdirSync, existsSync } from \"node:fs\";\r\nimport { join } from \"node:path\";\r\nimport { homedir, platform, release } from \"node:os\";\r\nimport { randomUUID, createHash } from \"node:crypto\";\r\nimport type { ScanResult } from \"@clawvet/shared\";\r\n\r\nconst CONFIG_DIR = join(homedir(), \".clawvet\");\r\nconst CONFIG_FILE = join(CONFIG_DIR, \"config.json\");\r\nconst TELEMETRY_ENDPOINT = \"https://bazzzz--0ab7a9301f3911f1ab9942dde27851f2.web.val.run\";\r\n\r\n// Never send raw skill names — that would leak what skills a user has\r\n// installed (including private/internal ones) to the telemetry endpoint.\r\n// A SHA-256 hash still lets us correlate a *known public* skill across devices\r\n// (hash the public name and match), but arbitrary/private names stay\r\n// unrecoverable, so nothing sensitive leaves the machine in cleartext.\r\nfunction hashSkillName(name: string): string {\r\n  return createHash(\"sha256\").update(name).digest(\"hex\").slice(0, 16);\r\n}\r\n\r\n// Tag traffic so dev/CI runs can be excluded from product metrics server-side\r\n// instead of polluting them (the \"dev-local\" rows problem).\r\nfunction detectEnvironment(): \"ci\" | \"development\" | \"production\" {\r\n  if (process.env.CI || process.env.GITHUB_ACTIONS) return \"ci\";\r\n  if (process.env.CLAWVET_ENV === \"development\" || process.env.NODE_ENV === \"development\") {\r\n    return \"development\";\r\n  }\r\n  return \"production\";\r\n}\r\n\r\nfunction readCliVersion(): string {\r\n  try {\r\n    const pkg = JSON.parse(\r\n      readFileSync(new URL(\"../package.json\", import.meta.url), \"utf-8\")\r\n    );\r\n    return pkg.version ?? \"0.0.0\";\r\n  } catch {\r\n    return \"0.0.0\";\r\n  }\r\n}\r\n\r\ninterface Config {\r\n  telemetry?: \"on\" | \"off\" | undefined; // undefined = not yet asked\r\n  deviceId?: string;\r\n  scanCount?: number;\r\n}\r\n\r\nfunction loadConfig(): Config {\r\n  try {\r\n    if (existsSync(CONFIG_FILE)) {\r\n      return JSON.parse(readFileSync(CONFIG_FILE, \"utf-8\"));\r\n    }\r\n  } catch {\r\n    // corrupted config, start fresh\r\n  }\r\n  return {};\r\n}\r\n\r\nfunction saveConfig(config: Config): void {\r\n  try {\r\n    mkdirSync(CONFIG_DIR, { recursive: true });\r\n    writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));\r\n  } catch {\r\n    // non-critical, ignore\r\n  }\r\n}\r\n\r\nexport function isTelemetryEnabled(): boolean {\r\n  const env = process.env.CLAWVET_TELEMETRY;\r\n  if (env === \"0\" || env === \"off\") return false;\r\n  if (env === \"1\" || env === \"on\") return true;\r\n  const config = loadConfig();\r\n  return config.telemetry === \"on\";\r\n}\r\n\r\nexport function setTelemetry(enabled: boolean): void {\r\n  const config = loadConfig();\r\n  config.telemetry = enabled ? \"on\" : \"off\";\r\n  saveConfig(config);\r\n}\r\n\r\nexport function hasBeenAsked(): boolean {\r\n  const config = loadConfig();\r\n  return config.telemetry !== undefined;\r\n}\r\n\r\nfunction getDeviceId(): string {\r\n  const config = loadConfig();\r\n  if (!config.deviceId) {\r\n    config.deviceId = randomUUID();\r\n    saveConfig(config);\r\n  }\r\n  return config.deviceId;\r\n}\r\n\r\nfunction incrementScanCount(): number {\r\n  const config = loadConfig();\r\n  config.scanCount = (config.scanCount || 0) + 1;\r\n  saveConfig(config);\r\n  return config.scanCount;\r\n}\r\n\r\nexport function getScanCount(): number {\r\n  return loadConfig().scanCount || 0;\r\n}\r\n\r\nexport function sendTelemetry(result: ScanResult): Promise<void> {\r\n  if (!isTelemetryEnabled()) return Promise.resolve();\r\n\r\n  const scanCount = incrementScanCount();\r\n\r\n  const payload = {\r\n    event: \"scan_completed\",\r\n    deviceId: getDeviceId(),\r\n    scanCount,\r\n    ts: new Date().toISOString(),\r\n    os: platform(),\r\n    osVersion: release(),\r\n    cliVersion: readCliVersion(),\r\n    environment: detectEnvironment(),\r\n    skillHash: hashSkillName(result.skillName),\r\n    riskScore: result.riskScore,\r\n    riskGrade: result.riskGrade,\r\n    findingsCount: result.findingsCount,\r\n    cached: result.cached ?? false,\r\n  };\r\n\r\n  return post(payload);\r\n}\r\n\r\nexport interface AuditSummary {\r\n  skillsScanned: number;\r\n  findingsTotal: number;\r\n  grades: Record<string, number>;\r\n  durationMs: number;\r\n}\r\n\r\n/**\r\n * One session-level event summarising a whole `clawvet audit` run, instead of\r\n * one event per scanned skill. Lets an audit of N skills register as a single\r\n * data point (the strongest usage signal) without inflating scan counts.\r\n */\r\nexport function sendAuditTelemetry(summary: AuditSummary): Promise<void> {\r\n  if (!isTelemetryEnabled()) return Promise.resolve();\r\n\r\n  const payload = {\r\n    event: \"audit_completed\",\r\n    deviceId: getDeviceId(),\r\n    ts: new Date().toISOString(),\r\n    os: platform(),\r\n    osVersion: release(),\r\n    cliVersion: readCliVersion(),\r\n    environment: detectEnvironment(),\r\n    skillsScanned: summary.skillsScanned,\r\n    findingsTotal: summary.findingsTotal,\r\n    grades: summary.grades,\r\n    durationMs: summary.durationMs,\r\n  };\r\n\r\n  return post(payload);\r\n}\r\n\r\nfunction post(payload: unknown): Promise<void> {\r\n  return fetch(TELEMETRY_ENDPOINT, {\r\n    method: \"POST\",\r\n    headers: { \"Content-Type\": \"application/json\" },\r\n    body: JSON.stringify(payload),\r\n    signal: AbortSignal.timeout(3000),\r\n  })\r\n    .then(() => {})\r\n    .catch(() => {\r\n      // silently ignore — telemetry is best-effort\r\n    });\r\n}\r\n","import { readdirSync, existsSync, readFileSync } from \"node:fs\";\r\nimport { join, basename } from \"node:path\";\r\nimport { homedir } from \"node:os\";\r\nimport { scanSkill } from \"@clawvet/shared\";\r\nimport { printScanResult } from \"../output/terminal.js\";\r\nimport { sendAuditTelemetry } from \"../telemetry.js\";\r\nimport chalk from \"chalk\";\r\n\r\nconst DEFAULT_SKILL_DIRS = [\r\n  join(homedir(), \".openclaw\", \"skills\"),\r\n  join(homedir(), \".openclaw\", \"workspace\", \"skills\"),\r\n];\r\n\r\nexport async function auditCommand(options: { dir?: string } = {}): Promise<void> {\r\n  const SKILL_DIRS = options.dir ? [options.dir] : DEFAULT_SKILL_DIRS;\r\n  console.log(chalk.bold(\"\\nClawVet Audit — Scanning all installed skills\\n\"));\r\n\r\n  const startedAt = Date.now();\r\n  let totalScanned = 0;\r\n  let totalThreats = 0;\r\n  const grades: Record<string, number> = { A: 0, B: 0, C: 0, D: 0, F: 0 };\r\n\r\n  for (const dir of SKILL_DIRS) {\r\n    if (!existsSync(dir)) {\r\n      if (options.dir) {\r\n        console.error(chalk.yellow(`Warning: Directory not found: ${dir}\\n`));\r\n        process.exit(1);\r\n      }\r\n      continue;\r\n    }\r\n\r\n    // If the dir itself contains a SKILL.md, scan it directly\r\n    const directSkillFile = join(dir, \"SKILL.md\");\r\n    if (existsSync(directSkillFile)) {\r\n      const content = readFileSync(directSkillFile, \"utf-8\");\r\n      const result = await scanSkill(content, { skillName: basename(dir) });\r\n      totalScanned++;\r\n      totalThreats += result.findings.length;\r\n      grades[result.riskGrade] = (grades[result.riskGrade] ?? 0) + 1;\r\n      printScanResult(result);\r\n      continue;\r\n    }\r\n\r\n    const entries = readdirSync(dir, { withFileTypes: true });\r\n    for (const entry of entries) {\r\n      if (!entry.isDirectory()) continue;\r\n      const skillFile = join(dir, entry.name, \"SKILL.md\");\r\n      if (!existsSync(skillFile)) continue;\r\n\r\n      const content = readFileSync(skillFile, \"utf-8\");\r\n      const result = await scanSkill(content, { skillName: entry.name });\r\n      totalScanned++;\r\n      totalThreats += result.findings.length;\r\n      grades[result.riskGrade] = (grades[result.riskGrade] ?? 0) + 1;\r\n\r\n      printScanResult(result);\r\n    }\r\n  }\r\n\r\n  const gradeColors: Record<string, (s: string) => string> = {\r\n    A: chalk.green.bold,\r\n    B: chalk.greenBright,\r\n    C: chalk.yellow.bold,\r\n    D: chalk.redBright.bold,\r\n    F: chalk.bgRed.white.bold,\r\n  };\r\n  const gradeSummary = ([\"A\", \"B\", \"C\", \"D\", \"F\"] as const)\r\n    .filter((g) => grades[g] > 0)\r\n    .map((g) => `${gradeColors[g](g)} ${grades[g]}`)\r\n    .join(\"  \");\r\n\r\n  console.log(\r\n    chalk.bold(\r\n      `\\nAudit complete: ${totalScanned} skills scanned, ${totalThreats} findings`\r\n    )\r\n  );\r\n  if (totalScanned > 0) {\r\n    console.log(`  Grades: ${gradeSummary}`);\r\n  }\r\n  const blocked = grades.D + grades.F;\r\n  if (blocked > 0) {\r\n    console.log(\r\n      chalk.red(`  ${blocked} skill${blocked > 1 ? \"s\" : \"\"} graded D or F — review before use`)\r\n    );\r\n  }\r\n  console.log();\r\n\r\n  // One session-level telemetry event for the whole audit (best-effort).\r\n  await sendAuditTelemetry({\r\n    skillsScanned: totalScanned,\r\n    findingsTotal: totalThreats,\r\n    grades,\r\n    durationMs: Date.now() - startedAt,\r\n  });\r\n}\r\n","import { readFileSync, existsSync, watch } from \"node:fs\";\r\nimport { join, dirname, basename } from \"node:path\";\r\nimport { homedir } from \"node:os\";\r\nimport chalk from \"chalk\";\r\nimport { scanSkill } from \"@clawvet/shared\";\r\nimport { printScanResult } from \"../output/terminal.js\";\r\n\r\nconst DEFAULT_SKILL_DIRS = [\r\n  join(homedir(), \".openclaw\", \"skills\"),\r\n  join(homedir(), \".openclaw\", \"workspace\", \"skills\"),\r\n];\r\n\r\nexport async function watchCommand(options: {\r\n  threshold?: number;\r\n  dir?: string;\r\n}): Promise<void> {\r\n  const threshold = options.threshold || 50;\r\n  const SKILL_DIRS = options.dir ? [options.dir] : DEFAULT_SKILL_DIRS;\r\n  console.log(\r\n    chalk.bold(\r\n      `\\nClawVet Watch — monitoring skill directories (threshold: ${threshold})\\n`\r\n    )\r\n  );\r\n\r\n  const watchDirs: string[] = [];\r\n  for (const dir of SKILL_DIRS) {\r\n    if (existsSync(dir)) {\r\n      watchDirs.push(dir);\r\n    }\r\n  }\r\n\r\n  if (watchDirs.length === 0) {\r\n    console.log(\r\n      chalk.yellow(\r\n        \"No OpenClaw skill directories found. Watching will start when directories are created.\\n\"\r\n      )\r\n    );\r\n    console.log(chalk.dim(\"Expected directories:\"));\r\n    for (const dir of SKILL_DIRS) {\r\n      console.log(chalk.dim(`  ${dir}`));\r\n    }\r\n    console.log();\r\n    process.exit(1);\r\n  }\r\n\r\n  console.log(chalk.dim(\"Watching:\"));\r\n  for (const dir of watchDirs) {\r\n    console.log(chalk.dim(`  ${dir}`));\r\n  }\r\n  console.log();\r\n\r\n  for (const dir of watchDirs) {\r\n    const watcher = watch(dir, { recursive: true }, async (event, filename) => {\r\n      if (!filename?.endsWith(\"SKILL.md\")) return;\r\n\r\n      const skillFile = join(dir, filename);\r\n      if (!existsSync(skillFile)) return;\r\n\r\n      console.log(chalk.dim(`\\nDetected change: ${filename}`));\r\n\r\n      try {\r\n        const content = readFileSync(skillFile, \"utf-8\");\r\n        const result = await scanSkill(content, {\r\n          skillName: basename(dirname(skillFile)),\r\n        });\r\n\r\n        if (result.cached) {\r\n          console.log(chalk.dim(\"(cached)\"));\r\n        }\r\n        printScanResult(result);\r\n\r\n        if (result.riskScore > threshold) {\r\n          console.log(\r\n            chalk.bgRed.white.bold(\r\n              ` BLOCKED — Risk score ${result.riskScore} exceeds threshold ${threshold} `\r\n            )\r\n          );\r\n          console.log(\r\n            chalk.red(\r\n              `This skill should not be installed. Run 'clawvet scan ${skillFile}' for details.\\n`\r\n            )\r\n          );\r\n        }\r\n      } catch (err) {\r\n        console.error(chalk.red(`Error scanning ${filename}:`), err);\r\n      }\r\n    });\r\n\r\n    process.on(\"SIGINT\", () => {\r\n      watcher.close();\r\n      console.log(chalk.dim(\"\\nWatch stopped.\"));\r\n      process.exit(0);\r\n    });\r\n  }\r\n\r\n  console.log(chalk.dim(\"Press Ctrl+C to stop watching.\\n\"));\r\n  await new Promise(() => {});\r\n}\r\n","import { readFileSync, existsSync, statSync } from \"node:fs\";\r\nimport { resolve, join, dirname, basename } from \"node:path\";\r\nimport chalk from \"chalk\";\r\nimport { scanSkill } from \"@clawvet/shared\";\r\nimport type { RiskGrade } from \"@clawvet/shared\";\r\n\r\nconst GRADE_COLORS: Record<RiskGrade, string> = {\r\n  A: \"brightgreen\",\r\n  B: \"green\",\r\n  C: \"yellow\",\r\n  D: \"orange\",\r\n  F: \"red\",\r\n};\r\n\r\nconst GRADE_LABELS: Record<RiskGrade, string> = {\r\n  A: \"safe\",\r\n  B: \"safe\",\r\n  C: \"review\",\r\n  D: \"risky\",\r\n  F: \"dangerous\",\r\n};\r\n\r\nexport async function badgeCommand(\r\n  target: string,\r\n  options: { markdown?: boolean }\r\n): Promise<void> {\r\n  const skillPath = resolve(target);\r\n  let skillFile = skillPath;\r\n\r\n  if (\r\n    existsSync(skillPath) &&\r\n    !skillPath.endsWith(\".md\") &&\r\n    existsSync(join(skillPath, \"SKILL.md\"))\r\n  ) {\r\n    skillFile = join(skillPath, \"SKILL.md\");\r\n  }\r\n\r\n  if (!existsSync(skillFile) || statSync(skillFile).isDirectory()) {\r\n    console.error(`Error: Cannot find SKILL.md at ${skillFile}`);\r\n    process.exit(1);\r\n  }\r\n\r\n  const content = readFileSync(skillFile, \"utf-8\");\r\n  const result = await scanSkill(content, {\r\n    skillName: basename(dirname(skillFile)),\r\n  });\r\n\r\n  const label = GRADE_LABELS[result.riskGrade];\r\n  const color = GRADE_COLORS[result.riskGrade];\r\n  const badgeUrl = `https://img.shields.io/badge/clawvet-${result.riskGrade}%20${label}-${color}`;\r\n  const linkUrl = \"https://github.com/MohibShaikh/clawvet\";\r\n\r\n  if (options.markdown) {\r\n    console.log(`[![ClawVet ${result.riskGrade}](${badgeUrl})](${linkUrl})`);\r\n  } else {\r\n    console.log();\r\n    console.log(chalk.bold(\"  ClawVet Trust Badge\"));\r\n    console.log();\r\n    console.log(`  Skill:  ${chalk.bold(result.skillName)}`);\r\n    console.log(`  Grade:  ${result.riskGrade} (${label})`);\r\n    console.log(`  Score:  ${result.riskScore}/100`);\r\n    console.log();\r\n    console.log(chalk.dim(\"  Markdown (paste in README):\"));\r\n    console.log();\r\n    console.log(`  [![ClawVet ${result.riskGrade}](${badgeUrl})](${linkUrl})`);\r\n    console.log();\r\n    console.log(chalk.dim(\"  HTML:\"));\r\n    console.log();\r\n    console.log(`  <a href=\"${linkUrl}\"><img src=\"${badgeUrl}\" alt=\"ClawVet ${result.riskGrade}\"></a>`);\r\n    console.log();\r\n  }\r\n}\r\n"],"mappings":";;;AAAA,SAAS,eAAe;AACxB,SAAS,gBAAAA,qBAAoB;AAC7B,SAAS,gBAAgB;AACzB,SAAS,qBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACJ9B,SAAS,gBAAAC,eAAc,cAAAC,aAAY,gBAAgB;AACnD,SAAS,SAAS,QAAAC,OAAM,UAAU,eAAe;AACjD,OAAOC,YAAW;;;ACClB,SAAS,GAAG,OAAiB,OAAuB;AAClD,SAAO,IAAI,OAAO,MAAM,KAAK,EAAE,GAAG,KAAK;AACzC;AAEO,IAAM,kBAAmC;AAAA;AAAA;AAAA;AAAA,EAI9C;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,0BAA0B,IAAI,GAAG,IAAI;AAAA,IAClD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,yBAAyB,IAAI,GAAG,IAAI;AAAA,IACjD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,MAAM,WAAW,GAAG,IAAI;AAAA,IACrC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,QAAQ,mBAAmB,MAAM,GAAG,IAAI;AAAA,IACrD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,QAAQ,cAAc,GAAG,IAAI;AAAA,IAC1C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,eAAe,yBAAyB,eAAe,gBAAgB,GAAG,IAAI;AAAA,IAC3F,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,QAAQ,yBAAyB,YAAY,eAAe,GAAG,IAAI;AAAA,IAChF,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,OAAO,SAAS,GAAG,IAAI;AAAA,IACpC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,MAAM,aAAa,GAAG,IAAI;AAAA,IACvC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,OAAO,SAAS,GAAG,IAAI;AAAA,IACpC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,cAAc,kBAAkB,sBAAsB,QAAQ,GAAG,IAAI;AAAA,IAClF,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,OAAO,+BAAgC,gBAAiB,WAAW,GAAG,IAAI;AAAA,IACvF,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,iBAAiB,iBAAiB,GAAG,IAAI;AAAA,IACtD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,UAAU,cAAc,aAAa,OAAO,GAAG,IAAI;AAAA,IAChE,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AACF;AAEO,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AChmBA,SAAS,SAAS,iBAAiB;AAGnC,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,SAAS;AACf,IAAM,QAAQ;AACd,IAAM,YAAY;AAEX,SAAS,WAAW,SAA8B;AACvD,MAAI,cAAgC,CAAC;AACrC,MAAI,OAAO;AAEX,QAAM,UAAU,QAAQ,MAAM,cAAc;AAC5C,MAAI,SAAS;AACX,QAAI;AACF,oBAAc,UAAU,QAAQ,CAAC,CAAC;AAAA,IACpC,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AACA,WAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK;AAAA,EAC/C;AAEA,QAAM,aAA0B,CAAC;AACjC,MAAI;AACJ,QAAM,OAAO,IAAI,OAAO,cAAc,QAAQ,cAAc,KAAK;AAEjE,UAAQ,QAAQ,KAAK,KAAK,OAAO,OAAO,MAAM;AAC5C,UAAM,SAAS,QAAQ,MAAM,GAAG,MAAM,KAAK;AAC3C,UAAM,YAAY,OAAO,MAAM,IAAI,EAAE;AACrC,UAAM,aAAa,MAAM,CAAC,EAAE,MAAM,IAAI,EAAE;AACxC,eAAW,KAAK;AAAA,MACd,UAAU,MAAM,CAAC,KAAK;AAAA,MACtB,SAAS,MAAM,CAAC;AAAA,MAChB;AAAA,MACA,SAAS,YAAY,aAAa;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC;AACrD,QAAM,cAAc,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC;AAC3D,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,CAAC;AAE3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd;AACF;;;ACjDA,SAAS,cAAc,YAAoB,OAA6B;AACtE,SAAO,MAAM,WAAW;AAAA,IACtB,CAAC,UAAU,cAAc,MAAM,aAAa,cAAc,MAAM;AAAA,EAClE;AACF;AAEA,SAAS,YAAY,YAAoB,YAA6B;AACpE,QAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,QAAM,OAAO,MAAM,aAAa,CAAC,KAAK;AACtC,SAAO,eAAe,KAAK,IAAI;AACjC;AAEA,IAAM,kBAA4C;AAAA,EAChD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEO,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,WAAsB,CAAC;AAE7B,aAAW,UAAU,iBAAiB;AACpC,UAAMC,MAAK,IAAI,OAAO,OAAO,QAAQ,QAAQ,OAAO,QAAQ,KAAK;AACjE,QAAI;AAEJ,YAAQ,QAAQA,IAAG,KAAK,MAAM,UAAU,OAAO,MAAM;AACnD,YAAM,SAAS,MAAM,WAAW,MAAM,GAAG,MAAM,KAAK;AACpD,YAAM,aAAa,OAAO,MAAM,IAAI,EAAE;AAEtC,UAAI,OAAO,YAAY,CAAC,cAAc,YAAY,KAAK,GAAG;AACxD;AAAA,MACF;AAEA,YAAM,SAAS,cAAc,YAAY,KAAK;AAC9C,YAAM,YAAY,YAAY,YAAY,MAAM,UAAU;AAE1D,UAAI;AACJ,UAAI,UAAU,OAAO,UAAU;AAC7B,4BAAoB;AAAA,MACtB,WAAW,QAAQ;AACjB,4BAAoB;AAAA,MACtB,WAAW,WAAW;AACpB,4BAAoB;AAAA,MACtB,WAAW,OAAO,UAAU;AAE1B,4BAAoB;AAAA,MACtB,OAAO;AAEL,4BAAoB;AAAA,MACtB;AAEA,YAAM,iBAAiB,gBAAgB,OAAO,QAAQ;AACtD,YAAM,aAAa,KAAK,IAAI,GAAK,iBAAiB,iBAAiB;AAEnE,eAAS,KAAK;AAAA,QACZ,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,aAAa,OAAO;AAAA,QACpB,UAAU,MAAM,CAAC;AAAA,QACjB;AAAA,QACA,cAAc;AAAA,QACd,YAAY,KAAK,MAAM,aAAa,GAAG,IAAI;AAAA,QAC3C,KAAK,OAAO;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;ACvEA,IAAM,YAAY;AAElB,IAAM,aAAa;AAAA,EACjB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAU;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAO;AAAA,EAC3D;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAU;AAAA,EAAW;AAAA,EAAO;AAAA,EAAO;AAAA,EACzD;AAAA,EAAU;AAAA,EAAM;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AACxC;AAEO,SAAS,iBAAiB,OAA+B;AAC9D,QAAM,WAAsB,CAAC;AAC7B,QAAM,KAAK,MAAM;AACjB,QAAM,OAAO;AAEb,MAAI,CAAC,GAAG,MAAM;AACZ,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,GAAG,aAAa;AACnB,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH,WAAW,GAAG,YAAY,SAAS,IAAI;AACrC,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,GAAG;AAAA,MACb,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,MAAI,GAAG,WAAW,CAAC,UAAU,KAAK,GAAG,OAAO,GAAG;AAC7C,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,GAAG;AAAA,MACb,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,QAAM,eAAe,IAAI,IAAI,GAAG,UAAU,UAAU,UAAU,QAAQ,CAAC,CAAC;AAExE,aAAW,OAAO,YAAY;AAC5B,UAAM,QAAQ,IAAI,OAAO,MAAM,GAAG,OAAO,GAAG;AAC5C,QAAI,MAAM,KAAK,MAAM,UAAU,KAAK,CAAC,aAAa,IAAI,GAAG,GAAG;AAC1D,YAAM,aAAa,MAAM,WAAW,KAAK,CAAC,OAAO,MAAM,KAAK,GAAG,OAAO,CAAC;AACvE,UAAI,YAAY;AACd,iBAAS,KAAK;AAAA,UACZ,UAAU;AAAA,UACV,UAAU;AAAA,UACV,OAAO,sBAAsB,GAAG;AAAA,UAChC,aAAa,eAAe,GAAG;AAAA,UAC/B,cAAc;AAAA,UACd,KAAK,QAAQ,GAAG;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,IAAI,IAAI,GAAG,UAAU,UAAU,UAAU,OAAO,CAAC,CAAC;AACtE,QAAM,QAAQ;AACd,MAAI;AAEJ,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,UAAM,SAAS,MAAM,CAAC;AACtB,QAAI,CAAC,YAAY,IAAI,MAAM,KAAK,OAAO,SAAS,GAAG;AACjD,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,uBAAuB,MAAM;AAAA,QACpC,aAAa,oCAAoC,MAAM;AAAA,QACvD,UAAU,MAAM,CAAC;AAAA,QACjB,cAAc;AAAA,QACd,KAAK,QAAQ,MAAM;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AChGA,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AAEhB,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,WAAsB,CAAC;AAC7B,QAAM,OAAO;AAEb,MAAI;AACJ,QAAM,QAAQ,IAAI,OAAO,oBAAoB,QAAQ,oBAAoB,KAAK;AAE9E,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,UAAM,SAAS,MAAM,WAAW,MAAM,GAAG,MAAM,KAAK;AACpD,UAAM,aAAa,OAAO,MAAM,IAAI,EAAE;AAEtC,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,MAAM,CAAC;AAAA,MACjB;AAAA,MACA,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,QAAM,QAAQ,IAAI,OAAO,eAAe,QAAQ,eAAe,KAAK;AACpE,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,QAAI,MAAM,CAAC,GAAG;AACZ,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,kCAAkC,MAAM,CAAC,CAAC;AAAA,QACvD,UAAU,MAAM,CAAC;AAAA,QACjB,cAAc;AAAA,QACd,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AC5CA,SAAS,gBAAgB;AAIzB,IAAM,oBAAoB;AAEnB,SAAS,iBAAiB,WAA8B;AAC7D,MAAI,CAAC,UAAW,QAAO,CAAC;AAExB,QAAM,WAAsB,CAAC;AAC7B,QAAM,aAAa,UAAU,YAAY,EAAE,KAAK;AAEhD,aAAW,WAAW,gBAAgB;AACpC,QAAI,eAAe,QAAS;AAE5B,UAAM,IAAI,SAAS,YAAY,OAAO;AACtC,QAAI,IAAI,KAAK,KAAK,mBAAmB;AACnC,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,0BAA0B,OAAO;AAAA,QACxC,aAAa,eAAe,SAAS,QAAQ,CAAC,qCAAqC,OAAO;AAAA,QAC1F,UAAU,IAAI,SAAS,aAAQ,OAAO,gBAAgB,CAAC;AAAA,QACvD,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,WAAW;AAAA,IACf,EAAE,IAAI,SAAS,MAAM,gBAAgB;AAAA,IACrC,EAAE,IAAI,aAAa,MAAM,sBAAsB;AAAA,EACjD;AAEA,aAAW,KAAK,UAAU;AACxB,QAAI,EAAE,GAAG,KAAK,UAAU,KAAK,CAAC,eAAe,SAAS,UAAU,GAAG;AACjE,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,8BAA8B,EAAE,IAAI;AAAA,QAC3C,aAAa,eAAe,SAAS,SAAS,EAAE,IAAI;AAAA,QACpD,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AC5CA,IAAM,mBAAmB;AAAA,EACvB,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEO,SAAS,mBAAmB,UAA6B;AAC9D,MAAI,QAAQ;AACZ,aAAW,KAAK,UAAU;AACxB,aAAS,iBAAiB,EAAE,QAAQ,KAAK,EAAE,cAAc;AAAA,EAC3D;AACA,SAAO,KAAK,MAAM,KAAK,IAAI,OAAO,GAAG,CAAC;AACxC;AAEO,SAAS,aAAa,OAA0B;AACrD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAEO,SAAS,cAAc,UAAoC;AAChE,QAAM,SAAwB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AACxE,aAAW,KAAK,UAAU;AACxB,WAAO,EAAE,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;;;AC/BA,SAAS,kBAAkB;AAG3B,IAAM,cAAc;AACpB,IAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAS,YAAY,SAAyB;AAC5C,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC1D;AAEO,SAAS,UAAU,SAAyC;AACjE,QAAM,MAAM,YAAY,OAAO;AAC/B,QAAM,SAAS,MAAM,IAAI,GAAG;AAC5B,MAAI,QAAQ;AAEV,UAAM,OAAO,GAAG;AAChB,UAAM,IAAI,KAAK,MAAM;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,UAAU,SAAiB,QAA0B;AACnE,QAAM,MAAM,YAAY,OAAO;AAC/B,MAAI,MAAM,IAAI,GAAG,GAAG;AAClB,UAAM,OAAO,GAAG;AAAA,EAClB,WAAW,MAAM,QAAQ,aAAa;AAEpC,UAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,QAAM,IAAI,KAAK,MAAM;AACvB;;;ACbA,eAAsB,UACpB,SACA,UAAuB,CAAC,GACH;AACrB,MAAI,CAAC,QAAQ,WAAW;AACtB,UAAM,SAAS,UAAU,OAAO;AAChC,QAAI,QAAQ;AACV,aAAO,EAAE,GAAG,QAAQ,QAAQ,KAAK;AAAA,IACnC;AAAA,EACF;AAEA,QAAM,QAAQ,WAAW,OAAO;AAChC,QAAM,cAAyB,CAAC;AAEhC,cAAY,KAAK,GAAG,kBAAkB,KAAK,CAAC;AAC5C,cAAY,KAAK,GAAG,iBAAiB,KAAK,CAAC;AAE3C,MAAI,QAAQ,YAAY,QAAQ,kBAAkB;AAChD,UAAM,mBAAmB,MAAM,QAAQ,iBAAiB,OAAO;AAC/D,gBAAY,KAAK,GAAG,gBAAgB;AAAA,EACtC;AAEA,cAAY,KAAK,GAAG,kBAAkB,KAAK,CAAC;AAE5C,MAAI,MAAM,YAAY,MAAM;AAC1B,gBAAY,KAAK,GAAG,iBAAiB,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9D;AAGA,QAAM,mBAAmB,QAAQ,gBAAgB,SAC7C,YAAY;AAAA,IACV,CAAC,MAAM,CAAC,QAAQ,eAAgB,KAAK,CAAC,OAAO,EAAE,UAAU,MAAM,EAAE,aAAa,EAAE;AAAA,EAClF,IACA;AAEJ,QAAM,YAAY,mBAAmB,gBAAgB;AACrD,QAAM,YAAY,aAAa,SAAS;AACxC,QAAM,gBAAgB,cAAc,gBAAgB;AAEpD,QAAM,iBACJ,aAAa,KAAK,UAAU,aAAa,KAAK,SAAS;AAEzD,QAAM,SAAqB;AAAA,IACzB,WAAW,MAAM,YAAY,QAAQ,QAAQ,aAAa;AAAA,IAC1D,cAAc,MAAM,YAAY;AAAA,IAChC,aAAa;AAAA,IACb,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,WAAW;AACtB,cAAU,SAAS,MAAM;AAAA,EAC3B;AAEA,SAAO;AACT;;;AC7EA,OAAO,WAAW;AAGlB,IAAM,kBAA2D;AAAA,EAC/D,UAAU,MAAM,MAAM,MAAM;AAAA,EAC5B,MAAM,MAAM,IAAI;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,KAAK,MAAM;AACb;AAEA,IAAM,eAAsD;AAAA,EAC1D,GAAG,MAAM,MAAM;AAAA,EACf,GAAG,MAAM;AAAA,EACT,GAAG,MAAM,OAAO;AAAA,EAChB,GAAG,MAAM,UAAU;AAAA,EACnB,GAAG,MAAM,MAAM,MAAM;AACvB;AAEO,SAAS,gBAAgB,QAA0B;AACxD,UAAQ,IAAI;AACZ,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI,MAAM,KAAK,uBAAuB,CAAC;AAC/C,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI;AAEZ,UAAQ,IAAI,cAAc,MAAM,KAAK,OAAO,SAAS,CAAC,EAAE;AACxD,MAAI,OAAO,cAAc;AACvB,YAAQ,IAAI,cAAc,OAAO,YAAY,EAAE;AAAA,EACjD;AACA,UAAQ,IAAI;AAGZ,QAAM,aAAa,aAAa,OAAO,SAAS,KAAK,MAAM;AAC3D,UAAQ;AAAA,IACN,iBAAiB,WAAW,GAAG,KAAK,MAAM,OAAO,SAAS,CAAC,MAAM,CAAC,YAAY,WAAW,OAAO,SAAS,CAAC;AAAA,EAC5G;AACA,UAAQ,IAAI;AAGZ,QAAM,KAAK,OAAO;AAClB,UAAQ,IAAI,aAAa;AACzB,MAAI,GAAG;AACL,YAAQ;AAAA,MACN,OAAO,gBAAgB,SAAS,YAAY,CAAC,IAAI,GAAG,QAAQ;AAAA,IAC9D;AACF,MAAI,GAAG;AACL,YAAQ,IAAI,OAAO,gBAAgB,KAAK,MAAM,CAAC,QAAQ,GAAG,IAAI,EAAE;AAClE,MAAI,GAAG;AACL,YAAQ,IAAI,OAAO,gBAAgB,OAAO,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE;AACtE,MAAI,GAAG,IAAK,SAAQ,IAAI,OAAO,gBAAgB,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE;AAC1E,MAAI,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,CAAC,GAAG,UAAU,CAAC,GAAG,KAAK;AACrD,YAAQ,IAAI,OAAO,MAAM,MAAM,uCAAkC,CAAC,EAAE;AAAA,EACtE;AACA,UAAQ,IAAI;AAGZ,MAAI,OAAO,SAAS,SAAS,GAAG;AAC9B,YAAQ,IAAI,MAAM,KAAK,YAAY,CAAC;AACpC,YAAQ,IAAI;AACZ,eAAW,KAAK,OAAO,UAAU;AAC/B,YAAM,QAAQ,gBAAgB,EAAE,QAAQ;AACxC,YAAM,UAAU,EAAE,cAAc,OAAO,IAAI,KAAK,MAAM,EAAE,aAAa,GAAG,CAAC,MAAM;AAC/E,cAAQ,IAAI,KAAK,MAAM,IAAI,EAAE,SAAS,YAAY,CAAC,GAAG,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;AAC9E,cAAQ,IAAI,OAAO,MAAM,IAAI,EAAE,WAAW,CAAC,EAAE;AAC7C,UAAI,EAAE,UAAU;AACd,gBAAQ,IAAI,iBAAiB,MAAM,OAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,MACzD;AACA,UAAI,EAAE,YAAY;AAChB,gBAAQ,IAAI,aAAa,EAAE,UAAU,EAAE;AAAA,MACzC;AACA,UAAI,EAAE,KAAK;AACT,gBAAQ,IAAI,YAAY,MAAM,MAAM,EAAE,GAAG,CAAC,EAAE;AAAA,MAC9C;AACA,cAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAGA,QAAM,YAAmD;AAAA,IACvD,OAAO,MAAM,MAAM,MAAM;AAAA,IACzB,MAAM,MAAM,SAAS,MAAM;AAAA,IAC3B,SAAS,MAAM,QAAQ,MAAM;AAAA,EAC/B;AACA,QAAM,MAAM,OAAO,kBAAkB;AACrC,UAAQ;AAAA,IACN,sBAAsB,UAAU,GAAG,KAAK,MAAM,OAAO,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC;AAAA,EAChF;AACA,UAAQ,IAAI;AACZ,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI;AACd;;;ACxFO,SAAS,gBAAgB,QAA0B;AACxD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;;;ACFA,IAAM,oBAA8C;AAAA,EAClD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEA,IAAM,oBAA8C;AAAA,EAClD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEO,SAAS,iBAAiB,QAA0B;AACzD,QAAM,QAAQ,oBAAI,IAA8C;AAEhE,aAAW,KAAK,OAAO,UAAU;AAC/B,UAAM,SAAS,EAAE,WAAW,MAAM,EAAE,MAAM,YAAY,EAAE,QAAQ,eAAe,GAAG;AAClF,QAAI,CAAC,MAAM,IAAI,MAAM,GAAG;AACtB,YAAM,IAAI,QAAQ,EAAE,IAAI,QAAQ,SAAS,EAAE,CAAC;AAAA,IAC9C;AAAA,EACF;AAEA,QAAM,QAAQ;AAAA,IACZ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,MAAM;AAAA,MACJ;AAAA,QACE,MAAM;AAAA,UACJ,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,gBAAgB;AAAA,YAChB,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,cACrC,IAAI,EAAE;AAAA,cACN,kBAAkB,EAAE,MAAM,EAAE,QAAQ,MAAM;AAAA,cAC1C,iBAAiB,EAAE,MAAM,EAAE,QAAQ,YAAY;AAAA,cAC/C,sBAAsB;AAAA,gBACpB,OAAO,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,cAC7C;AAAA,cACA,YAAY;AAAA,gBACV,mBAAmB,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,cACzD;AAAA,YACF,EAAE;AAAA,UACJ;AAAA,QACF;AAAA,QACA,SAAS,OAAO,SAAS,IAAI,CAAC,MAAM;AAClC,gBAAM,SAAS,EAAE,WAAW,MAAM,EAAE,MAAM,YAAY,EAAE,QAAQ,eAAe,GAAG;AAClF,iBAAO;AAAA,YACL;AAAA,YACA,OAAO,kBAAkB,EAAE,QAAQ;AAAA,YACnC,SAAS;AAAA,cACP,MAAM,EAAE,eAAe,EAAE,WAAW,cAAc,EAAE,QAAQ,KAAK;AAAA,cACjE,GAAI,EAAE,MAAM,EAAE,UAAU,GAAG,EAAE,WAAW;AAAA;AAAA,WAAgB,EAAE,GAAG,GAAG,IAAI,CAAC;AAAA,YACvE;AAAA,YACA,WAAW;AAAA,cACT;AAAA,gBACE,kBAAkB;AAAA,kBAChB,kBAAkB,EAAE,KAAK,WAAW;AAAA,kBACpC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;AAAA,gBACzC;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAC5C;;;ACxEA,SAAS,cAAc,eAAe,WAAW,kBAAkB;AACnE,SAAS,YAAY;AACrB,SAAS,SAAS,UAAU,eAAe;AAC3C,SAAS,YAAY,cAAAC,mBAAkB;AAGvC,IAAM,aAAa,KAAK,QAAQ,GAAG,UAAU;AAC7C,IAAM,cAAc,KAAK,YAAY,aAAa;AAClD,IAAM,qBAAqB;AAO3B,SAAS,cAAc,MAAsB;AAC3C,SAAOA,YAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACpE;AAIA,SAAS,oBAAyD;AAChE,MAAI,QAAQ,IAAI,MAAM,QAAQ,IAAI,eAAgB,QAAO;AACzD,MAAI,QAAQ,IAAI,gBAAgB,iBAAiB,QAAQ,IAAI,aAAa,eAAe;AACvF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,iBAAyB;AAChC,MAAI;AACF,UAAM,MAAM,KAAK;AAAA,MACf,aAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,OAAO;AAAA,IACnE;AACA,WAAO,IAAI,WAAW;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,aAAqB;AAC5B,MAAI;AACF,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO,KAAK,MAAM,aAAa,aAAa,OAAO,CAAC;AAAA,IACtD;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,CAAC;AACV;AAEA,SAAS,WAAW,QAAsB;AACxC,MAAI;AACF,cAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACzC,kBAAc,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,EAC5D,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,qBAA8B;AAC5C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAO,QAAQ,MAAO,QAAO;AACzC,MAAI,QAAQ,OAAO,QAAQ,KAAM,QAAO;AACxC,QAAM,SAAS,WAAW;AAC1B,SAAO,OAAO,cAAc;AAC9B;AAEO,SAAS,aAAa,SAAwB;AACnD,QAAM,SAAS,WAAW;AAC1B,SAAO,YAAY,UAAU,OAAO;AACpC,aAAW,MAAM;AACnB;AAEO,SAAS,eAAwB;AACtC,QAAM,SAAS,WAAW;AAC1B,SAAO,OAAO,cAAc;AAC9B;AAEA,SAAS,cAAsB;AAC7B,QAAM,SAAS,WAAW;AAC1B,MAAI,CAAC,OAAO,UAAU;AACpB,WAAO,WAAW,WAAW;AAC7B,eAAW,MAAM;AAAA,EACnB;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,qBAA6B;AACpC,QAAM,SAAS,WAAW;AAC1B,SAAO,aAAa,OAAO,aAAa,KAAK;AAC7C,aAAW,MAAM;AACjB,SAAO,OAAO;AAChB;AAEO,SAAS,eAAuB;AACrC,SAAO,WAAW,EAAE,aAAa;AACnC;AAEO,SAAS,cAAc,QAAmC;AAC/D,MAAI,CAAC,mBAAmB,EAAG,QAAO,QAAQ,QAAQ;AAElD,QAAM,YAAY,mBAAmB;AAErC,QAAM,UAAU;AAAA,IACd,OAAO;AAAA,IACP,UAAU,YAAY;AAAA,IACtB;AAAA,IACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC3B,IAAI,SAAS;AAAA,IACb,WAAW,QAAQ;AAAA,IACnB,YAAY,eAAe;AAAA,IAC3B,aAAa,kBAAkB;AAAA,IAC/B,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO,UAAU;AAAA,EAC3B;AAEA,SAAO,KAAK,OAAO;AACrB;AAcO,SAAS,mBAAmB,SAAsC;AACvE,MAAI,CAAC,mBAAmB,EAAG,QAAO,QAAQ,QAAQ;AAElD,QAAM,UAAU;AAAA,IACd,OAAO;AAAA,IACP,UAAU,YAAY;AAAA,IACtB,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC3B,IAAI,SAAS;AAAA,IACb,WAAW,QAAQ;AAAA,IACnB,YAAY,eAAe;AAAA,IAC3B,aAAa,kBAAkB;AAAA,IAC/B,eAAe,QAAQ;AAAA,IACvB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ;AAAA,EACtB;AAEA,SAAO,KAAK,OAAO;AACrB;AAEA,SAAS,KAAK,SAAiC;AAC7C,SAAO,MAAM,oBAAoB;AAAA,IAC/B,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,IAC5B,QAAQ,YAAY,QAAQ,GAAI;AAAA,EAClC,CAAC,EACE,KAAK,MAAM;AAAA,EAAC,CAAC,EACb,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;;;Ab3JA,IAAM,eAAe;AAErB,eAAe,iBAAiB,MAA+B;AAC7D,MAAI,CAAC,aAAa,KAAK,IAAI,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR,uBAAuB,IAAI;AAAA,IAC7B;AAAA,EACF;AAEA,QAAM,UAAU,mBAAmB,IAAI;AACvC,QAAM,OAAO;AAAA,IACX,0DAA0D,OAAO;AAAA,IACjE,oCAAoC,OAAO;AAAA,EAC7C;AAEA,aAAW,OAAO,MAAM;AACtB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,GAAK,EAAE,CAAC;AACnE,UAAI,IAAI,IAAI;AACV,eAAO,MAAM,IAAI,KAAK;AAAA,MACxB;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,0BAA0B,IAAI;AAAA,EAChC;AACF;AAEA,eAAsB,YACpB,QACA,SACe;AACf,MAAI;AACJ,MAAI;AAEJ,MAAI,QAAQ,QAAQ;AAClB,QAAI;AACF,cAAQ,OAAO,MAAM,aAAa,MAAM;AAAA,CAAqB;AAC7D,gBAAU,MAAM,iBAAiB,MAAM;AACvC,qBAAe;AAAA,IACjB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,eAAe,QAAQ,IAAI,UAAU;AAAA,MACvC;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,UAAM,YAAY,QAAQ,MAAM;AAChC,QAAI,YAAY;AAEhB,QACEC,YAAW,SAAS,KACpB,CAAC,UAAU,SAAS,KAAK,KACzBA,YAAWC,MAAK,WAAW,UAAU,CAAC,GACtC;AACA,kBAAYA,MAAK,WAAW,UAAU;AAAA,IACxC;AAEA,QAAI,CAACD,YAAW,SAAS,KAAK,SAAS,SAAS,EAAE,YAAY,GAAG;AAC/D,cAAQ,MAAM,kCAAkC,SAAS,EAAE;AAC3D,cAAQ,MAAM,oEAAoE,MAAM,YAAY;AACpG,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,cAAUE,cAAa,WAAW,OAAO;AACzC,mBAAe,SAAS,QAAQ,SAAS,CAAC;AAAA,EAC5C;AAGA,QAAM,UAAUD,MAAK,QAAQ,IAAI,GAAG,aAAa;AACjD,MAAID,YAAW,OAAO,GAAG;AACvB,UAAM,aAAaE,cAAa,SAAS,OAAO,EAC7C,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,WAAW,GAAG,CAAC;AAGxC,UAAM,UAAU,QAAQ,MAAM,6BAA6B;AAC3D,QAAI,SAAS;AACX,YAAM,SAAS,QAAQ,CAAC,EAAE,YAAY;AACtC,iBAAW,OAAO,YAAY;AAC5B,cAAM,cAAc,OAAO,YAAY;AACvC,YACE,YAAY,SAAS,GAAG,KACxB,OAAO,SAAS,SAAS,GAAG,EAAE,KAC9B,OAAO,SAAS,WAAW,GAAG,EAAE,KAChC,OAAO,SAAS,SAAS,GAAG,EAAE,GAC9B;AACA,kBAAQ;AAAA,YACNC,OAAM,MAAM,MAAM,KAAK,UAAU,IACjCA,OAAM,IAAI,kCAAkC,GAAG,EAAE;AAAA,UACnD;AACA,kBAAQ,MAAMA,OAAM,IAAI,aAAa,OAAO,EAAE,CAAC;AAC/C,kBAAQ,KAAK,CAAC;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAaF,MAAK,QAAQ,IAAI,GAAG,gBAAgB;AACvD,QAAM,iBAA2B,CAAC;AAClC,MAAID,YAAW,UAAU,GAAG;AAC1B,UAAM,QAAQE,cAAa,YAAY,OAAO,EAAE,MAAM,IAAI;AAC1D,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,WAAW,CAAC,QAAQ,WAAW,GAAG,GAAG;AACvC,uBAAe,KAAK,OAAO;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,UAAU,SAAS;AAAA,IACtC,UAAU,QAAQ,YAAY;AAAA,IAC9B,gBAAgB,eAAe,SAAS,iBAAiB;AAAA,IACzD,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,QAAQ,OAAO;AAClB,QAAI,QAAQ,WAAW,SAAS;AAC9B,uBAAiB,MAAM;AAAA,IACzB,WAAW,QAAQ,WAAW,QAAQ;AACpC,sBAAgB,MAAM;AAAA,IACxB,OAAO;AACL,sBAAgB,MAAM;AAAA,IACxB;AAAA,EACF;AAGA,QAAM,gBAAgB,CAAC,QAAQ,SAAS,QAAQ,WAAW,UAAU,QAAQ,WAAW;AACxF,MAAI,eAAe;AACjB,QAAI,CAAC,aAAa,KAAK,CAAC,mBAAmB,KAAK,QAAQ,MAAM,OAAO;AACnE,YAAM,WAAW,MAAM,OAAO,UAAe;AAC7C,YAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AACpF,YAAM,SAAS,MAAM,IAAI,QAAgB,CAACE,aAAY;AACpD,WAAG;AAAA,UACDD,OAAM,IAAI,gEAA2D;AAAA,UACrE,CAAC,MAAM;AAAE,eAAG,MAAM;AAAG,YAAAC,SAAQ,EAAE,KAAK,EAAE,YAAY,CAAC;AAAA,UAAG;AAAA,QACxD;AAAA,MACF,CAAC;AACD,mBAAa,WAAW,OAAO,WAAW,KAAK;AAAA,IACjD;AAAA,EAEF;AAGA,QAAM,cAAc,MAAM;AAG1B,MAAI,iBAAiB,aAAa,IAAI,MAAM,GAAG;AAC7C,YAAQ;AAAA,MACND,OAAM,IAAI,IAAI,IACdA,OAAM,KAAK,2CAAsC,IACjDA,OAAM,UAAU,KAAK,2BAA2B;AAAA,IAClD;AACA,YAAQ,IAAI;AAAA,EACd;AAEA,QAAM,SAAS,QAAQ,WAAW,QAAQ,QAAQ,SAAS;AAC3D,MAAI,QAAQ;AACV,UAAM,gBAAgB,CAAC,OAAO,UAAU,QAAQ,UAAU;AAC1D,UAAM,YAAY,cAAc,QAAQ,MAAM;AAC9C,UAAM,aAAa,OAAO,SAAS;AAAA,MACjC,CAAC,MAAM,cAAc,QAAQ,EAAE,QAAQ,KAAK;AAAA,IAC9C;AACA,QAAI,YAAY;AACd,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AACF;;;Ac7LA,SAAS,aAAa,cAAAE,aAAY,gBAAAC,qBAAoB;AACtD,SAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAC/B,SAAS,WAAAC,gBAAe;AAIxB,OAAOC,YAAW;AAElB,IAAM,qBAAqB;AAAA,EACzBC,MAAKC,SAAQ,GAAG,aAAa,QAAQ;AAAA,EACrCD,MAAKC,SAAQ,GAAG,aAAa,aAAa,QAAQ;AACpD;AAEA,eAAsB,aAAa,UAA4B,CAAC,GAAkB;AAChF,QAAM,aAAa,QAAQ,MAAM,CAAC,QAAQ,GAAG,IAAI;AACjD,UAAQ,IAAIF,OAAM,KAAK,wDAAmD,CAAC;AAE3E,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI,eAAe;AACnB,MAAI,eAAe;AACnB,QAAM,SAAiC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE;AAEtE,aAAW,OAAO,YAAY;AAC5B,QAAI,CAACG,YAAW,GAAG,GAAG;AACpB,UAAI,QAAQ,KAAK;AACf,gBAAQ,MAAMH,OAAM,OAAO,iCAAiC,GAAG;AAAA,CAAI,CAAC;AACpE,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA;AAAA,IACF;AAGA,UAAM,kBAAkBC,MAAK,KAAK,UAAU;AAC5C,QAAIE,YAAW,eAAe,GAAG;AAC/B,YAAM,UAAUC,cAAa,iBAAiB,OAAO;AACrD,YAAM,SAAS,MAAM,UAAU,SAAS,EAAE,WAAWC,UAAS,GAAG,EAAE,CAAC;AACpE;AACA,sBAAgB,OAAO,SAAS;AAChC,aAAO,OAAO,SAAS,KAAK,OAAO,OAAO,SAAS,KAAK,KAAK;AAC7D,sBAAgB,MAAM;AACtB;AAAA,IACF;AAEA,UAAM,UAAU,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AACxD,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,YAAYJ,MAAK,KAAK,MAAM,MAAM,UAAU;AAClD,UAAI,CAACE,YAAW,SAAS,EAAG;AAE5B,YAAM,UAAUC,cAAa,WAAW,OAAO;AAC/C,YAAM,SAAS,MAAM,UAAU,SAAS,EAAE,WAAW,MAAM,KAAK,CAAC;AACjE;AACA,sBAAgB,OAAO,SAAS;AAChC,aAAO,OAAO,SAAS,KAAK,OAAO,OAAO,SAAS,KAAK,KAAK;AAE7D,sBAAgB,MAAM;AAAA,IACxB;AAAA,EACF;AAEA,QAAM,cAAqD;AAAA,IACzD,GAAGJ,OAAM,MAAM;AAAA,IACf,GAAGA,OAAM;AAAA,IACT,GAAGA,OAAM,OAAO;AAAA,IAChB,GAAGA,OAAM,UAAU;AAAA,IACnB,GAAGA,OAAM,MAAM,MAAM;AAAA,EACvB;AACA,QAAM,eAAgB,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,EAC3C,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAC9C,KAAK,IAAI;AAEZ,UAAQ;AAAA,IACNA,OAAM;AAAA,MACJ;AAAA,kBAAqB,YAAY,oBAAoB,YAAY;AAAA,IACnE;AAAA,EACF;AACA,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,aAAa,YAAY,EAAE;AAAA,EACzC;AACA,QAAM,UAAU,OAAO,IAAI,OAAO;AAClC,MAAI,UAAU,GAAG;AACf,YAAQ;AAAA,MACNA,OAAM,IAAI,KAAK,OAAO,SAAS,UAAU,IAAI,MAAM,EAAE,yCAAoC;AAAA,IAC3F;AAAA,EACF;AACA,UAAQ,IAAI;AAGZ,QAAM,mBAAmB;AAAA,IACvB,eAAe;AAAA,IACf,eAAe;AAAA,IACf;AAAA,IACA,YAAY,KAAK,IAAI,IAAI;AAAA,EAC3B,CAAC;AACH;;;AC9FA,SAAS,gBAAAM,eAAc,cAAAC,aAAY,aAAa;AAChD,SAAS,QAAAC,OAAM,WAAAC,UAAS,YAAAC,iBAAgB;AACxC,SAAS,WAAAC,gBAAe;AACxB,OAAOC,YAAW;AAIlB,IAAMC,sBAAqB;AAAA,EACzBC,MAAKC,SAAQ,GAAG,aAAa,QAAQ;AAAA,EACrCD,MAAKC,SAAQ,GAAG,aAAa,aAAa,QAAQ;AACpD;AAEA,eAAsB,aAAa,SAGjB;AAChB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,QAAQ,MAAM,CAAC,QAAQ,GAAG,IAAIF;AACjD,UAAQ;AAAA,IACNG,OAAM;AAAA,MACJ;AAAA,gEAA8D,SAAS;AAAA;AAAA,IACzE;AAAA,EACF;AAEA,QAAM,YAAsB,CAAC;AAC7B,aAAW,OAAO,YAAY;AAC5B,QAAIC,YAAW,GAAG,GAAG;AACnB,gBAAU,KAAK,GAAG;AAAA,IACpB;AAAA,EACF;AAEA,MAAI,UAAU,WAAW,GAAG;AAC1B,YAAQ;AAAA,MACND,OAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA,YAAQ,IAAIA,OAAM,IAAI,uBAAuB,CAAC;AAC9C,eAAW,OAAO,YAAY;AAC5B,cAAQ,IAAIA,OAAM,IAAI,KAAK,GAAG,EAAE,CAAC;AAAA,IACnC;AACA,YAAQ,IAAI;AACZ,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,IAAIA,OAAM,IAAI,WAAW,CAAC;AAClC,aAAW,OAAO,WAAW;AAC3B,YAAQ,IAAIA,OAAM,IAAI,KAAK,GAAG,EAAE,CAAC;AAAA,EACnC;AACA,UAAQ,IAAI;AAEZ,aAAW,OAAO,WAAW;AAC3B,UAAM,UAAU,MAAM,KAAK,EAAE,WAAW,KAAK,GAAG,OAAO,OAAO,aAAa;AACzE,UAAI,CAAC,UAAU,SAAS,UAAU,EAAG;AAErC,YAAM,YAAYF,MAAK,KAAK,QAAQ;AACpC,UAAI,CAACG,YAAW,SAAS,EAAG;AAE5B,cAAQ,IAAID,OAAM,IAAI;AAAA,mBAAsB,QAAQ,EAAE,CAAC;AAEvD,UAAI;AACF,cAAM,UAAUE,cAAa,WAAW,OAAO;AAC/C,cAAM,SAAS,MAAM,UAAU,SAAS;AAAA,UACtC,WAAWC,UAASC,SAAQ,SAAS,CAAC;AAAA,QACxC,CAAC;AAED,YAAI,OAAO,QAAQ;AACjB,kBAAQ,IAAIJ,OAAM,IAAI,UAAU,CAAC;AAAA,QACnC;AACA,wBAAgB,MAAM;AAEtB,YAAI,OAAO,YAAY,WAAW;AAChC,kBAAQ;AAAA,YACNA,OAAM,MAAM,MAAM;AAAA,cAChB,8BAAyB,OAAO,SAAS,sBAAsB,SAAS;AAAA,YAC1E;AAAA,UACF;AACA,kBAAQ;AAAA,YACNA,OAAM;AAAA,cACJ,yDAAyD,SAAS;AAAA;AAAA,YACpE;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAMA,OAAM,IAAI,kBAAkB,QAAQ,GAAG,GAAG,GAAG;AAAA,MAC7D;AAAA,IACF,CAAC;AAED,YAAQ,GAAG,UAAU,MAAM;AACzB,cAAQ,MAAM;AACd,cAAQ,IAAIA,OAAM,IAAI,kBAAkB,CAAC;AACzC,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,UAAQ,IAAIA,OAAM,IAAI,kCAAkC,CAAC;AACzD,QAAM,IAAI,QAAQ,MAAM;AAAA,EAAC,CAAC;AAC5B;;;ACjGA,SAAS,gBAAAK,eAAc,cAAAC,aAAY,YAAAC,iBAAgB;AACnD,SAAS,WAAAC,UAAS,QAAAC,OAAM,WAAAC,UAAS,YAAAC,iBAAgB;AACjD,OAAOC,YAAW;AAIlB,IAAMC,gBAA0C;AAAA,EAC9C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAEA,IAAM,eAA0C;AAAA,EAC9C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAEA,eAAsB,aACpB,QACA,SACe;AACf,QAAM,YAAYC,SAAQ,MAAM;AAChC,MAAI,YAAY;AAEhB,MACEC,YAAW,SAAS,KACpB,CAAC,UAAU,SAAS,KAAK,KACzBA,YAAWC,MAAK,WAAW,UAAU,CAAC,GACtC;AACA,gBAAYA,MAAK,WAAW,UAAU;AAAA,EACxC;AAEA,MAAI,CAACD,YAAW,SAAS,KAAKE,UAAS,SAAS,EAAE,YAAY,GAAG;AAC/D,YAAQ,MAAM,kCAAkC,SAAS,EAAE;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,UAAUC,cAAa,WAAW,OAAO;AAC/C,QAAM,SAAS,MAAM,UAAU,SAAS;AAAA,IACtC,WAAWC,UAASC,SAAQ,SAAS,CAAC;AAAA,EACxC,CAAC;AAED,QAAM,QAAQ,aAAa,OAAO,SAAS;AAC3C,QAAM,QAAQP,cAAa,OAAO,SAAS;AAC3C,QAAM,WAAW,wCAAwC,OAAO,SAAS,MAAM,KAAK,IAAI,KAAK;AAC7F,QAAM,UAAU;AAEhB,MAAI,QAAQ,UAAU;AACpB,YAAQ,IAAI,cAAc,OAAO,SAAS,KAAK,QAAQ,MAAM,OAAO,GAAG;AAAA,EACzE,OAAO;AACL,YAAQ,IAAI;AACZ,YAAQ,IAAIQ,OAAM,KAAK,uBAAuB,CAAC;AAC/C,YAAQ,IAAI;AACZ,YAAQ,IAAI,aAAaA,OAAM,KAAK,OAAO,SAAS,CAAC,EAAE;AACvD,YAAQ,IAAI,aAAa,OAAO,SAAS,KAAK,KAAK,GAAG;AACtD,YAAQ,IAAI,aAAa,OAAO,SAAS,MAAM;AAC/C,YAAQ,IAAI;AACZ,YAAQ,IAAIA,OAAM,IAAI,+BAA+B,CAAC;AACtD,YAAQ,IAAI;AACZ,YAAQ,IAAI,gBAAgB,OAAO,SAAS,KAAK,QAAQ,MAAM,OAAO,GAAG;AACzE,YAAQ,IAAI;AACZ,YAAQ,IAAIA,OAAM,IAAI,SAAS,CAAC;AAChC,YAAQ,IAAI;AACZ,YAAQ,IAAI,cAAc,OAAO,eAAe,QAAQ,kBAAkB,OAAO,SAAS,QAAQ;AAClG,YAAQ,IAAI;AAAA,EACd;AACF;;;AjBzDA,SAAS,QAAQ,KAAmB;AAClC,QAAM,QACJ,QAAQ,aAAa,UACjB,SAAS,OAAO,CAAC,MAAM,SAAS,IAAI,GAAG,CAAC,IACxC,QAAQ,aAAa,WACnB,SAAS,QAAQ,CAAC,GAAG,CAAC,IACtB,SAAS,YAAY,CAAC,GAAG,CAAC;AAGlC,QAAM,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAC5B;AAEA,SAAS,qBAA6B;AACpC,MAAI;AACF,UAAM,OAAOC,SAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,UAAM,MAAM,KAAK,MAAMC,cAAaC,MAAK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;AAC9E,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,SAAS,EACd,YAAY,oDAAoD,EAChE,QAAQ,mBAAmB,CAAC;AAE/B,QACG,QAAQ,MAAM,EACd,YAAY,mCAAmC,EAC/C,SAAS,YAAY,uCAAuC,EAC5D,OAAO,qBAAqB,2CAA2C,UAAU,EACjF,OAAO,wBAAwB,8CAA8C,EAC7E,OAAO,cAAc,0DAA0D,EAC/E,OAAO,YAAY,wDAAwD,EAC3E,OAAO,eAAe,sDAAsD,EAC5E,OAAO,eAAe,yCAAyC,EAC/D,OAAO,OAAO,QAAQ,SAAS;AAC9B,MAAI,KAAK,WAAW;AAClB,UAAM,MAAM;AACZ,YAAQ,IAAI,WAAW,GAAG,MAAM;AAChC,YAAQ,GAAG;AAAA,EACb;AACA,QAAM,YAAY,QAAQ;AAAA,IACxB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,EACd,CAAC;AACH,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,oCAAoC,EAChD,OAAO,gBAAgB,iCAAiC,EACxD,OAAO,OAAO,SAAS;AACtB,QAAM,aAAa,EAAE,KAAK,KAAK,IAAI,CAAC;AACtC,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,qDAAgD,EAC5D,OAAO,uBAAuB,qCAAqC,IAAI,EACvE,OAAO,gBAAgB,kCAAkC,EACzD,OAAO,OAAO,SAAS;AACtB,QAAM,aAAa,EAAE,WAAW,SAAS,KAAK,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC;AAC3E,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,6CAA6C,EACzD,SAAS,YAAY,uCAAuC,EAC5D,OAAO,QAAQ,kCAAkC,EACjD,OAAO,OAAO,QAAQ,SAAS;AAC9B,QAAM,aAAa,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC;AAClD,CAAC;AAEH,QACG,QAAQ,UAAU,EAClB,YAAY,gDAAgD,EAC5D,OAAO,YAAY;AAClB,QAAM,MAAM;AACZ,UAAQ,IAAI,WAAW,GAAG,MAAM;AAChC,UAAQ,GAAG;AACb,CAAC;AAEH,QAAQ,MAAM;","names":["readFileSync","dirname","join","readFileSync","existsSync","join","chalk","re","createHash","existsSync","join","readFileSync","chalk","resolve","existsSync","readFileSync","join","basename","homedir","chalk","join","homedir","existsSync","readFileSync","basename","readFileSync","existsSync","join","dirname","basename","homedir","chalk","DEFAULT_SKILL_DIRS","join","homedir","chalk","existsSync","readFileSync","basename","dirname","readFileSync","existsSync","statSync","resolve","join","dirname","basename","chalk","GRADE_COLORS","resolve","existsSync","join","statSync","readFileSync","basename","dirname","chalk","dirname","readFileSync","join"]}
+{"version":3,"sources":["../src/index.ts","../src/commands/scan.ts","../../shared/src/patterns.ts","../../shared/src/scanner/skill-parser.ts","../../shared/src/scanner/static-analysis.ts","../../shared/src/scanner/metadata-validator.ts","../../shared/src/scanner/dependency-checker.ts","../../shared/src/scanner/typosquat-detector.ts","../../shared/src/scanner/risk-scorer.ts","../../shared/src/scanner/cache.ts","../../shared/src/scanner/index.ts","../src/output/terminal.ts","../src/output/json.ts","../src/output/sarif.ts","../src/telemetry.ts","../src/assemble.ts","../src/commands/audit.ts","../src/commands/watch.ts","../src/commands/badge.ts"],"sourcesContent":["import { Command } from \"commander\";\r\nimport { readFileSync } from \"node:fs\";\r\nimport { execFile } from \"node:child_process\";\r\nimport { fileURLToPath } from \"node:url\";\r\nimport { dirname, join } from \"node:path\";\r\nimport { scanCommand } from \"./commands/scan.js\";\r\nimport { auditCommand } from \"./commands/audit.js\";\r\nimport { watchCommand } from \"./commands/watch.js\";\r\nimport { badgeCommand } from \"./commands/badge.js\";\r\n\r\n// Open a URL in the user's browser without going through a shell. Using\r\n// execFile (not exec) means the URL is passed as an argument, never\r\n// interpolated into a command string a shell would parse — no shell-exec\r\n// surface even though the URL here is a constant.\r\nfunction openUrl(url: string): void {\r\n  const child =\r\n    process.platform === \"win32\"\r\n      ? execFile(\"cmd\", [\"/c\", \"start\", \"\", url])\r\n      : process.platform === \"darwin\"\r\n        ? execFile(\"open\", [url])\r\n        : execFile(\"xdg-open\", [url]);\r\n  // Opening a browser is best-effort — never crash the CLI if the opener is\r\n  // missing (e.g. a headless Linux box without xdg-open).\r\n  child.on(\"error\", () => {});\r\n}\r\n\r\nfunction readPackageVersion(): string {\r\n  try {\r\n    const here = dirname(fileURLToPath(import.meta.url));\r\n    const pkg = JSON.parse(readFileSync(join(here, \"..\", \"package.json\"), \"utf-8\"));\r\n    return pkg.version;\r\n  } catch {\r\n    return \"0.0.0\";\r\n  }\r\n}\r\n\r\nconst program = new Command();\r\n\r\nprogram\r\n  .name(\"clawvet\")\r\n  .description(\"Skill vetting & supply chain security for OpenClaw\")\r\n  .version(readPackageVersion());\r\n\r\nprogram\r\n  .command(\"scan\")\r\n  .description(\"Scan a skill for security threats\")\r\n  .argument(\"<target>\", \"Path to skill folder or SKILL.md file\")\r\n  .option(\"--format <format>\", \"Output format: terminal, json, or sarif\", \"terminal\")\r\n  .option(\"--fail-on <severity>\", \"Exit 1 if findings at this severity or above\")\r\n  .option(\"--semantic\", \"Enable AI semantic analysis (requires ANTHROPIC_API_KEY)\")\r\n  .option(\"--remote\", \"Fetch skill from ClawHub by name instead of local path\")\r\n  .option(\"-q, --quiet\", \"Suppress all output, exit code only (0=pass, 1=fail)\")\r\n  .option(\"--subscribe\", \"Open the ClawVet feedback & alerts form\")\r\n  .action(async (target, opts) => {\r\n    if (opts.subscribe) {\r\n      const url = \"https://tally.so/r/jaMdaa\";\r\n      console.log(`Opening ${url} ...`);\r\n      openUrl(url);\r\n    }\r\n    await scanCommand(target, {\r\n      format: opts.format,\r\n      failOn: opts.failOn,\r\n      semantic: opts.semantic,\r\n      remote: opts.remote,\r\n      quiet: opts.quiet,\r\n    });\r\n  });\r\n\r\nprogram\r\n  .command(\"audit\")\r\n  .description(\"Scan all installed OpenClaw skills\")\r\n  .option(\"--dir <path>\", \"Custom skills directory to scan\")\r\n  .action(async (opts) => {\r\n    await auditCommand({ dir: opts.dir });\r\n  });\r\n\r\nprogram\r\n  .command(\"watch\")\r\n  .description(\"Pre-install hook — blocks risky skill installs\")\r\n  .option(\"--threshold <score>\", \"Risk score threshold (default 50)\", \"50\")\r\n  .option(\"--dir <path>\", \"Custom skills directory to watch\")\r\n  .action(async (opts) => {\r\n    await watchCommand({ threshold: parseInt(opts.threshold), dir: opts.dir });\r\n  });\r\n\r\nprogram\r\n  .command(\"badge\")\r\n  .description(\"Generate a trust badge for a skill's README\")\r\n  .argument(\"<target>\", \"Path to skill folder or SKILL.md file\")\r\n  .option(\"--md\", \"Output only the markdown snippet\")\r\n  .action(async (target, opts) => {\r\n    await badgeCommand(target, { markdown: opts.md });\r\n  });\r\n\r\nprogram\r\n  .command(\"feedback\")\r\n  .description(\"Open the ClawVet feedback & threat alerts form\")\r\n  .action(async () => {\r\n    const url = \"https://tally.so/r/jaMdaa\";\r\n    console.log(`Opening ${url} ...`);\r\n    openUrl(url);\r\n  });\r\n\r\nprogram.parse();\r\n","import { readFileSync, existsSync, statSync } from \"node:fs\";\r\nimport { resolve, join, basename, dirname } from \"node:path\";\r\nimport chalk from \"chalk\";\r\nimport { scanSkill } from \"@clawvet/shared\";\r\nimport { printScanResult } from \"../output/terminal.js\";\r\nimport { printJsonResult } from \"../output/json.js\";\r\nimport { printSarifResult } from \"../output/sarif.js\";\r\nimport { sendTelemetry, hasBeenAsked, setTelemetry, isTelemetryEnabled, getScanCount } from \"../telemetry.js\";\r\nimport { assembleSkill } from \"../assemble.js\";\r\n\r\nexport interface ScanOptions {\r\n  format?: \"terminal\" | \"json\" | \"sarif\";\r\n  failOn?: \"critical\" | \"high\" | \"medium\" | \"low\";\r\n  semantic?: boolean;\r\n  remote?: boolean;\r\n  quiet?: boolean;\r\n}\r\n\r\nconst SLUG_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;\r\n\r\nasync function fetchRemoteSkill(slug: string): Promise<string> {\r\n  if (!SLUG_PATTERN.test(slug)) {\r\n    throw new Error(\r\n      `Invalid skill name \"${slug}\". Must be 1-64 chars, alphanumeric + dash/underscore.`\r\n    );\r\n  }\r\n\r\n  const encoded = encodeURIComponent(slug);\r\n  // The ClawHub catalog API returns the skill record as JSON, with the full\r\n  // SKILL.md content in `skill.description`. The other sources serve raw\r\n  // markdown. Try the catalog first, then fall back to raw endpoints.\r\n  const sources: Array<{ url: string; json: boolean }> = [\r\n    { url: `https://clawhub.ai/api/v1/skills/${encoded}`, json: true },\r\n    { url: `https://clawhub.ai/api/v1/skills/${encoded}/raw`, json: false },\r\n    {\r\n      url: `https://raw.githubusercontent.com/openclaw/skills/main/${encoded}/SKILL.md`,\r\n      json: false,\r\n    },\r\n  ];\r\n\r\n  for (const { url, json } of sources) {\r\n    try {\r\n      const res = await fetch(url, { signal: AbortSignal.timeout(10000) });\r\n      if (!res.ok) continue;\r\n\r\n      if (!json) return await res.text();\r\n\r\n      const body = (await res.json()) as {\r\n        skill?: { description?: string };\r\n      };\r\n      const content = body?.skill?.description;\r\n      if (typeof content === \"string\" && content.includes(\"---\")) {\r\n        return content;\r\n      }\r\n    } catch {\r\n      // try next\r\n    }\r\n  }\r\n\r\n  throw new Error(\r\n    `Could not fetch skill \"${slug}\" from ClawHub. Check the skill name and try again.`\r\n  );\r\n}\r\n\r\nexport async function scanCommand(\r\n  target: string,\r\n  options: ScanOptions\r\n): Promise<void> {\r\n  let content: string;\r\n  let fallbackName: string | undefined;\r\n\r\n  if (options.remote) {\r\n    try {\r\n      process.stderr.write(`Fetching \"${target}\" from ClawHub...\\n`);\r\n      content = await fetchRemoteSkill(target);\r\n      fallbackName = target;\r\n    } catch (err) {\r\n      console.error(\r\n        err instanceof Error ? err.message : \"Failed to fetch remote skill\"\r\n      );\r\n      process.exit(1);\r\n    }\r\n  } else {\r\n    const skillPath = resolve(target);\r\n    let skillFile = skillPath;\r\n    let skillDir: string | undefined;\r\n\r\n    if (\r\n      existsSync(skillPath) &&\r\n      statSync(skillPath).isDirectory() &&\r\n      existsSync(join(skillPath, \"SKILL.md\"))\r\n    ) {\r\n      skillDir = skillPath;\r\n      skillFile = join(skillPath, \"SKILL.md\");\r\n    }\r\n\r\n    if (!existsSync(skillFile) || statSync(skillFile).isDirectory()) {\r\n      console.error(`Error: Cannot find SKILL.md at ${skillFile}`);\r\n      console.error(`Hint: If this is a directory of skills, use 'clawvet audit --dir ${target}' instead.`);\r\n      process.exit(1);\r\n    }\r\n\r\n    const skillMd = readFileSync(skillFile, \"utf-8\");\r\n    content = skillDir ? assembleSkill(skillDir, skillMd) : skillMd;\r\n    fallbackName = basename(dirname(skillFile));\r\n  }\r\n\r\n  // Load .clawvetban — block skills by name, author, or slug\r\n  const banFile = join(process.cwd(), \".clawvetban\");\r\n  if (existsSync(banFile)) {\r\n    const banEntries = readFileSync(banFile, \"utf-8\")\r\n      .split(\"\\n\")\r\n      .map((l) => l.trim().toLowerCase())\r\n      .filter((l) => l && !l.startsWith(\"#\"));\r\n\r\n    // Quick parse frontmatter to check name/author before full scan\r\n    const fmMatch = content.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/);\r\n    if (fmMatch) {\r\n      const fmText = fmMatch[1].toLowerCase();\r\n      for (const ban of banEntries) {\r\n        const targetLower = target.toLowerCase();\r\n        if (\r\n          targetLower.includes(ban) ||\r\n          fmText.includes(`name: ${ban}`) ||\r\n          fmText.includes(`author: ${ban}`) ||\r\n          fmText.includes(`slug: ${ban}`)\r\n        ) {\r\n          console.error(\r\n            chalk.bgRed.white.bold(` BANNED `) +\r\n            chalk.red(` Skill matches ban list entry: ${ban}`)\r\n          );\r\n          console.error(chalk.dim(`  Source: ${banFile}`));\r\n          process.exit(1);\r\n        }\r\n      }\r\n    }\r\n  }\r\n\r\n  // Load .clawvetignore\r\n  const ignoreFile = join(process.cwd(), \".clawvetignore\");\r\n  const ignorePatterns: string[] = [];\r\n  if (existsSync(ignoreFile)) {\r\n    const lines = readFileSync(ignoreFile, \"utf-8\").split(\"\\n\");\r\n    for (const line of lines) {\r\n      const trimmed = line.trim();\r\n      if (trimmed && !trimmed.startsWith(\"#\")) {\r\n        ignorePatterns.push(trimmed);\r\n      }\r\n    }\r\n  }\r\n\r\n  const result = await scanSkill(content, {\r\n    semantic: options.semantic ?? false,\r\n    ignorePatterns: ignorePatterns.length ? ignorePatterns : undefined,\r\n    skillName: fallbackName,\r\n  });\r\n\r\n  if (!options.quiet) {\r\n    if (options.format === \"sarif\") {\r\n      printSarifResult(result);\r\n    } else if (options.format === \"json\") {\r\n      printJsonResult(result);\r\n    } else {\r\n      printScanResult(result);\r\n    }\r\n  }\r\n\r\n  // Telemetry: first-run opt-in prompt (only in interactive TTY)\r\n  const isInteractive = !options.quiet && options.format !== \"json\" && options.format !== \"sarif\";\r\n  if (isInteractive) {\r\n    if (!hasBeenAsked() && !isTelemetryEnabled() && process.stdin.isTTY) {\r\n      const readline = await import(\"node:readline\");\r\n      const rl = readline.createInterface({ input: process.stdin, output: process.stderr });\r\n      const answer = await new Promise<string>((resolve) => {\r\n        rl.question(\r\n          chalk.dim(\"Help improve ClawVet — send anonymous usage stats? (y/n) \"),\r\n          (a) => { rl.close(); resolve(a.trim().toLowerCase()); }\r\n        );\r\n      });\r\n      setTelemetry(answer === \"y\" || answer === \"yes\");\r\n    }\r\n\r\n  }\r\n\r\n  // Await telemetry so it completes before any process.exit()\r\n  await sendTelemetry(result);\r\n\r\n  // Show Tally CTA every 5th scan (after increment)\r\n  if (isInteractive && getScanCount() % 5 === 0) {\r\n    console.log(\r\n      chalk.dim(\"  \") +\r\n      chalk.cyan(\"Got feedback? Want threat alerts? → \") +\r\n      chalk.underline.cyan(\"https://tally.so/r/jaMdaa\")\r\n    );\r\n    console.log();\r\n  }\r\n\r\n  const failOn = options.failOn || (options.quiet ? \"high\" : undefined);\r\n  if (failOn) {\r\n    const severityOrder = [\"low\", \"medium\", \"high\", \"critical\"];\r\n    const threshold = severityOrder.indexOf(failOn);\r\n    const hasFailure = result.findings.some(\r\n      (f) => severityOrder.indexOf(f.severity) >= threshold\r\n    );\r\n    if (hasFailure) {\r\n      process.exit(1);\r\n    }\r\n  }\r\n}\r\n","import type { ThreatPattern } from \"./types.js\";\r\n\r\n// Build regex from parts at runtime to avoid AV false positives on signature strings\r\nfunction re(parts: string[], flags: string): RegExp {\r\n  return new RegExp(parts.join(\"\"), flags);\r\n}\r\n\r\nexport const THREAT_PATTERNS: ThreatPattern[] = [\r\n  // ═══════════════════════════════════════════════════════\r\n  // CRITICAL: Remote code execution\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"CURL_PIPE_BASH\",\r\n    pattern: re([\"curl\\\\s+.*\\\\|\\\\s*(ba)?\", \"sh\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Curl piped to shell\",\r\n    description: \"Downloads and executes remote code directly — classic supply chain attack vector.\",\r\n    codeOnly: true,\r\n    fix: \"Download the script first, inspect it, then execute: `curl -o setup.sh URL && cat setup.sh && bash setup.sh`\",\r\n  },\r\n  {\r\n    name: \"WGET_EXECUTE\",\r\n    pattern: re([\"wget\\\\s+.*&&\\\\s*(ba)?\", \"sh\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Wget with shell execution\",\r\n    description: \"Downloads and executes remote code via wget.\",\r\n    codeOnly: true,\r\n    fix: \"Download the file first with `wget -O script.sh URL`, review it, then execute.\",\r\n  },\r\n  {\r\n    name: \"EVAL_DYNAMIC\",\r\n    pattern: re([\"ev\", \"al\\\\s*\\\\(\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Dynamic code evaluation\",\r\n    description: \"Uses dynamic code evaluation which can run arbitrary code.\",\r\n    codeOnly: true,\r\n    fix: \"Replace dynamic evaluation with a safer alternative like JSON.parse() or a sandboxed environment.\",\r\n  },\r\n  {\r\n    name: \"BASE64_DECODE\",\r\n    pattern: re([\"base\", \"64\\\\s+(-d|--dec\", \"ode)\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"obfuscation\",\r\n    title: \"Base64 decode execution\",\r\n    description: \"Decodes base64 content, often used to hide malicious payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Decode and include the command directly so users can review it.\",\r\n  },\r\n  {\r\n    name: \"PYTHON_EXEC\",\r\n    pattern: re([\"pyth\", \"on[3]?\\\\s+-c\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Python inline execution\",\r\n    description: \"Executes inline Python code which may contain hidden payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Move inline code to a separate .py file so users can review it before execution.\",\r\n  },\r\n  {\r\n    name: \"REVERSE_SHELL\",\r\n    pattern: re([\"\\\\/dev\\\\/tc\", \"p\\\\/|nc\\\\s+-[elp]|nca\", \"t\\\\s+-|mkfi\", \"fo\\\\s+.*\\\\/tmp\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Reverse shell\",\r\n    description: \"Creates a reverse connection back to an attacker-controlled server.\",\r\n    codeOnly: true,\r\n    fix: \"Remove reverse connection commands — these are almost never legitimate in skills.\",\r\n  },\r\n  {\r\n    name: \"CRON_PERSISTENCE\",\r\n    pattern: re([\"cron\", \"tab\\\\s+-|\\\\/etc\\\\/cro\", \"n|system\", \"ctl\\\\s+enable\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"persistence\",\r\n    title: \"Scheduled task persistence\",\r\n    description: \"Installs a cron job or systemd service for persistent execution after reboot.\",\r\n    codeOnly: true,\r\n    fix: \"Document the scheduled task in the skill description and require explicit user consent before installing.\",\r\n  },\r\n  {\r\n    name: \"PERL_EXEC\",\r\n    pattern: re([\"per\", \"l\\\\s+-e\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Perl inline execution\",\r\n    description: \"Executes inline Perl code which may contain obfuscated payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Move inline code to a separate .pl file so users can review it before execution.\",\r\n  },\r\n  {\r\n    name: \"NODE_EVAL\",\r\n    pattern: re([\"no\", \"de\\\\s+-e\\\\s\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Node.js inline execution\",\r\n    description: \"Executes inline Node.js code, often used to hide malicious logic.\",\r\n    codeOnly: true,\r\n    fix: \"Move inline code to a separate .js file so users can review it before execution.\",\r\n  },\r\n  {\r\n    name: \"RUBY_EXEC\",\r\n    pattern: re([\"rub\", \"y\\\\s+-e\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"remote_code_execution\",\r\n    title: \"Ruby inline execution\",\r\n    description: \"Executes inline Ruby code which may contain hidden payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Move inline code to a separate .rb file so users can review it before execution.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // HIGH: Credential theft\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"ENV_FILE_READ\",\r\n    pattern: /\\.env|credentials|\\.aws|\\.ssh|keychain/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Sensitive file access\",\r\n    description: \"Accesses credential files (.env, .aws, .ssh, keychain).\",\r\n    fix: \"Declare required env vars in frontmatter under `metadata.openclaw.requires.env`.\",\r\n  },\r\n  {\r\n    name: \"API_KEY_EXFIL\",\r\n    pattern: /(ANTHROPIC|OPENAI|SLACK|DISCORD|TELEGRAM|STRIPE|GITHUB|GITLAB|AWS_SECRET|GROQ|OPENROUTER).*(_KEY|_TOKEN|_SECRET)/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"API key reference\",\r\n    description: \"References specific API keys/tokens that could be exfiltrated.\",\r\n    fix: \"Use environment variable references ($VAR) instead of hardcoding keys, and declare them in requires.env.\",\r\n  },\r\n  {\r\n    name: \"DOTFILE_ACCESS\",\r\n    pattern: /~\\/\\.(openclaw|clawdbot|moltbot)\\//gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"OpenClaw config access\",\r\n    description: \"Accesses OpenClaw/Clawdbot/Moltbot configuration directories.\",\r\n    fix: \"Use the official OpenClaw SDK/API instead of directly reading config directories.\",\r\n  },\r\n  {\r\n    name: \"SESSION_THEFT\",\r\n    pattern: /sessions\\/\\*\\.jsonl/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Session data access\",\r\n    description: \"Accesses session transcript files which may contain sensitive data.\",\r\n    fix: \"Remove session file access — skills should not read conversation transcripts.\",\r\n  },\r\n  {\r\n    name: \"SSH_KEY_ACCESS\",\r\n    pattern: /~\\/\\.ssh\\/id_|\\.pem\\b|BEGIN\\s+(RSA\\s+)?PRIVATE\\s+KEY/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"SSH/private key access\",\r\n    description: \"Accesses SSH keys or private key files that could be stolen.\",\r\n    fix: \"Use ssh-agent or a credential manager instead of directly reading key files.\",\r\n  },\r\n  {\r\n    name: \"BROWSER_DATA\",\r\n    pattern: /\\.config\\/google-chrome|\\.mozilla\\/firefox|Login\\s*Data|Cookies\\.sqlite/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Browser data access\",\r\n    description: \"Accesses browser profiles which contain saved passwords, cookies, and tokens.\",\r\n    fix: \"Remove browser data access — skills should not read browser profiles.\",\r\n  },\r\n  {\r\n    name: \"GIT_CREDENTIALS\",\r\n    pattern: /\\.git-credentials|\\.gitconfig|git\\s+config.*credential/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Git credential access\",\r\n    description: \"Accesses git credential storage which may contain auth tokens.\",\r\n    fix: \"Use `git` CLI commands instead of directly reading credential files.\",\r\n  },\r\n  {\r\n    name: \"NPM_TOKEN\",\r\n    pattern: /\\.npmrc|npm_token|NPM_AUTH_TOKEN/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"npm token access\",\r\n    description: \"Accesses npm auth tokens which could be used to publish malicious packages.\",\r\n    fix: \"Use `npm whoami` or `npm config get` instead of directly reading .npmrc.\",\r\n  },\r\n  {\r\n    name: \"KUBE_CONFIG\",\r\n    pattern: /~\\/\\.kube\\/config|KUBECONFIG/gi,\r\n    severity: \"high\",\r\n    category: \"credential_theft\",\r\n    title: \"Kubernetes config access\",\r\n    description: \"Accesses Kubernetes configuration which contains cluster credentials.\",\r\n    fix: \"Use `kubectl` CLI commands instead of directly reading kubeconfig.\",\r\n  },\r\n  {\r\n    name: \"DOCKER_SOCKET\",\r\n    pattern: /\\/var\\/run\\/docker\\.sock|docker\\s+exec/gi,\r\n    severity: \"high\",\r\n    category: \"container_escape\",\r\n    title: \"Docker socket/exec access\",\r\n    description: \"Accesses Docker socket or runs exec — could enable container escape.\",\r\n    fix: \"Use Docker SDK or CLI with limited permissions instead of direct socket access.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // HIGH: Network exfiltration\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"WEBHOOK_SEND\",\r\n    pattern: /webhook\\.(site|url)|discord\\.com\\/api\\/webhooks|hooks\\.slack\\.com|api\\.telegram\\.org\\/bot/gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Webhook data exfiltration\",\r\n    description: \"Sends data to webhook endpoints (Discord, Slack, Telegram) — common exfiltration channel.\",\r\n    fix: \"If webhook integration is needed, declare it in the skill description and let users configure their own webhook URL.\",\r\n  },\r\n  {\r\n    name: \"BORE_TUNNEL\",\r\n    pattern: /bore\\.pub|ngrok|localtunnel|serveo\\.net|localhost\\.run/gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Tunnel service usage\",\r\n    description: \"Uses tunneling services to expose local services or exfiltrate data.\",\r\n    fix: \"Document tunnel usage in the skill description and require explicit user consent.\",\r\n  },\r\n  {\r\n    name: \"SUSPICIOUS_IP\",\r\n    pattern: /\\b(?:91\\.92\\.242\\.\\d+|45\\.61\\.\\d+\\.\\d+)\\b/g,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Known malicious IP\",\r\n    description: \"Contains IP addresses associated with known ClawHavoc C2 infrastructure.\",\r\n    fix: \"Remove references to known malicious IP addresses.\",\r\n  },\r\n  {\r\n    name: \"DNS_EXFIL\",\r\n    pattern: /dig\\s+.*TXT|nslookup\\s+.*\\$|dns.*exfil|\\.burpcollaborator\\.|\\.oastify\\./gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"DNS exfiltration\",\r\n    description: \"Uses DNS queries to exfiltrate data — bypasses most firewalls.\",\r\n    fix: \"Remove DNS exfiltration patterns — use standard HTTP APIs for data transfer.\",\r\n  },\r\n  {\r\n    name: \"PASTEBIN_FETCH\",\r\n    pattern: /pastebin\\.com|paste\\.ee|hastebin\\.com|ghostbin\\.|dpaste\\./gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Pastebin service usage\",\r\n    description: \"References paste services commonly used to host malicious payloads or receive exfiltrated data.\",\r\n    fix: \"Host code in a version-controlled repository (GitHub, GitLab) instead of paste services.\",\r\n  },\r\n  {\r\n    name: \"SUSPICIOUS_TLD\",\r\n    pattern: /https?:\\/\\/[^\\s\"']*\\.(tk|ml|ga|cf|gq|top|xyz|pw|cc|ws|buzz)\\b/gi,\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Suspicious TLD\",\r\n    description: \"URL uses a top-level domain frequently associated with malicious infrastructure.\",\r\n    fix: \"Use URLs from well-known, reputable domains instead of suspicious TLDs.\",\r\n  },\r\n  {\r\n    name: \"URL_SHORTENER\",\r\n    pattern: /bit\\.ly|tinyurl\\.com|t\\.co\\/|goo\\.gl|is\\.gd|buff\\.ly|ow\\.ly|rb\\.gy/gi,\r\n    severity: \"high\",\r\n    category: \"obfuscation\",\r\n    title: \"URL shortener\",\r\n    description: \"Uses URL shorteners to hide the real destination of links.\",\r\n    fix: \"Use the full, unshortened URL so users can verify the destination.\",\r\n  },\r\n  {\r\n    name: \"RAW_SOCKET\",\r\n    pattern: re([\"new\\\\s+Soc\", \"ket|net\\\\.conn\", \"ect|dgram\\\\.create\", \"Socket\"], \"gi\"),\r\n    severity: \"high\",\r\n    category: \"data_exfiltration\",\r\n    title: \"Raw socket connection\",\r\n    description: \"Creates raw network sockets which can bypass HTTP monitoring.\",\r\n    codeOnly: true,\r\n    fix: \"Use standard HTTP libraries (fetch, axios) instead of raw sockets for network communication.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // MEDIUM: Social engineering\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"PREREQUISITE_INSTALL\",\r\n    pattern: /prerequisite|install.*first|run.*before|required.*dependency/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Prerequisite install trick\",\r\n    description: \"Instructs users to install prerequisites — common social engineering tactic.\",\r\n    fix: \"Declare dependencies in `metadata.openclaw.requires.bins` instead of instructing manual installs.\",\r\n  },\r\n  {\r\n    name: \"COPY_PASTE_COMMAND\",\r\n    pattern: /copy.*paste.*terminal|run.*this.*command/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Copy-paste command instruction\",\r\n    description: \"Instructs users to copy-paste commands into their terminal.\",\r\n    fix: \"Put commands in code blocks with proper context instead of copy-paste instructions.\",\r\n  },\r\n  {\r\n    name: \"FAKE_DEPENDENCY\",\r\n    pattern: /openclaw-core|moltbot-runtime|clawdbot-helper/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Fake dependency reference\",\r\n    description: \"References fake packages that mimic official OpenClaw components.\",\r\n    fix: \"Use only official OpenClaw packages from the verified registry.\",\r\n  },\r\n  {\r\n    name: \"AUTHORITY_SPOOFING\",\r\n    pattern: /official\\s+(openclaw|clawhub)|endorsed\\s+by|verified\\s+(skill|publisher)|from\\s+the\\s+openclaw\\s+team/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Authority spoofing\",\r\n    description: \"Claims official endorsement or verification to gain trust.\",\r\n    fix: \"Remove false authority claims — let the skill's quality speak for itself.\",\r\n  },\r\n  {\r\n    name: \"URGENCY_MANIPULATION\",\r\n    pattern: /critical\\s+update|security\\s+patch|must\\s+install\\s+immediately|urgent.*update/gi,\r\n    severity: \"medium\",\r\n    category: \"social_engineering\",\r\n    title: \"Urgency manipulation\",\r\n    description: \"Creates false urgency to pressure users into installing without review.\",\r\n    fix: \"Remove urgency language — let users evaluate the skill at their own pace.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // MEDIUM: Prompt injection\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"IGNORE_INSTRUCTIONS\",\r\n    pattern: /ignore\\s+(all\\s+)?previous\\s+instructions/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"Prompt injection — ignore instructions\",\r\n    description: \"Attempts to override the AI agent's existing instructions.\",\r\n    fix: \"Remove prompt injection attempts — skills should not try to override agent instructions.\",\r\n  },\r\n  {\r\n    name: \"SYSTEM_OVERRIDE\",\r\n    pattern: /you\\s+are\\s+now|new\\s+instructions|forget\\s+everything/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"Prompt injection — system override\",\r\n    description: \"Attempts to redefine the AI agent's identity or instructions.\",\r\n    fix: \"Remove system override attempts — skills should not alter agent identity.\",\r\n  },\r\n  {\r\n    name: \"MEMORY_MANIPULATION\",\r\n    pattern: /SOUL\\.md|MEMORY\\.md|AGENTS\\.md/gi,\r\n    severity: \"medium\",\r\n    category: \"persistence\",\r\n    title: \"Memory/personality file manipulation\",\r\n    description: \"References core personality or memory files, may attempt persistence.\",\r\n    fix: \"Remove references to agent memory/personality files — skills should not modify agent state.\",\r\n  },\r\n  {\r\n    name: \"JAILBREAK_ATTEMPT\",\r\n    pattern: /\\bDAN\\b|do\\s+anything\\s+now|developer\\s+mode|evil\\s+mode|bypass.*safety/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"Jailbreak attempt\",\r\n    description: \"Uses known jailbreak techniques (DAN, developer mode) to bypass safety constraints.\",\r\n    fix: \"Remove jailbreak attempts — skills should work within the agent's safety constraints.\",\r\n  },\r\n  {\r\n    name: \"ROLE_HIJACK\",\r\n    pattern: /(?:pretend|act|behave)\\s+(?:you\\s+are|as\\s+if|to\\s+be)\\s+(?:a\\s+)?(?:different|new|hacker|evil)/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"Role hijacking\",\r\n    description: \"Attempts to change the agent's persona to bypass safety restrictions.\",\r\n    fix: \"Remove role hijacking attempts — skills should not alter the agent's persona.\",\r\n  },\r\n  {\r\n    name: \"PROMPT_EXTRACTION\",\r\n    pattern: /(?:reveal|show|print|output|tell\\s+me)\\s+(?:your\\s+)?(?:system\\s+)?(?:prompt|instructions|rules)/gi,\r\n    severity: \"medium\",\r\n    category: \"prompt_injection\",\r\n    title: \"System prompt extraction\",\r\n    description: \"Attempts to extract the agent's system prompt or configuration.\",\r\n    fix: \"Remove prompt extraction attempts — skills should not try to access system prompts.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // MEDIUM: Obfuscation\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"HEX_ENCODING\",\r\n    pattern: /\\\\x[0-9a-f]{2}(?:\\\\x[0-9a-f]{2}){3,}/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Hex-encoded payload\",\r\n    description: \"Contains hex-encoded strings commonly used to hide malicious commands.\",\r\n    codeOnly: true,\r\n    fix: \"Replace hex-encoded strings with readable text so users can review the content.\",\r\n  },\r\n  {\r\n    name: \"JS_OBFUSCATOR\",\r\n    pattern: /_0x[a-f0-9]{4,}|var\\s+_0x/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"JavaScript obfuscator output\",\r\n    description: \"Contains patterns from JavaScript obfuscation tools used to hide malicious code.\",\r\n    codeOnly: true,\r\n    fix: \"Provide readable, unobfuscated source code instead of obfuscated JavaScript.\",\r\n  },\r\n  {\r\n    name: \"UNICODE_STEGANOGRAPHY\",\r\n    pattern: /[\\u200B\\u200C\\u200D\\u2060\\uFEFF]{3,}/g,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Hidden zero-width characters\",\r\n    description: \"Contains clusters of invisible zero-width Unicode characters that may hide instructions.\",\r\n    fix: \"Remove zero-width characters — all content should be visible to users.\",\r\n  },\r\n  {\r\n    name: \"RTL_OVERRIDE\",\r\n    pattern: /[\\u202A\\u202B\\u202C\\u202D\\u202E\\u2066\\u2067\\u2068\\u2069]/g,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Bidirectional text override\",\r\n    description: \"Contains Unicode bidi override characters that can reverse displayed text to hide real content.\",\r\n    fix: \"Remove bidirectional text override characters — text direction should be natural.\",\r\n  },\r\n  {\r\n    name: \"HTML_COMMENT_INJECTION\",\r\n    pattern: /<!--[\\s\\S]*?(?:ignore|instructions|system|override|secret)[\\s\\S]*?-->/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Hidden HTML comment instruction\",\r\n    description: \"Embeds instructions inside HTML comments that are invisible to users but read by agents.\",\r\n    fix: \"Move instructions from HTML comments into visible content.\",\r\n  },\r\n  {\r\n    name: \"STRING_CONCAT_OBFUSC\",\r\n    pattern: /[\"'][a-z]{1,3}[\"']\\s*\\+\\s*[\"'][a-z]{1,3}[\"']\\s*\\+\\s*[\"'][a-z]{1,3}[\"']/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"String concatenation obfuscation\",\r\n    description: \"Builds commands via single-character string concatenation to evade pattern detection.\",\r\n    codeOnly: true,\r\n    fix: \"Use complete string literals instead of character-by-character concatenation.\",\r\n  },\r\n  {\r\n    name: \"BUFFER_BASE64_DECODE\",\r\n    pattern: re([\"Buf\", \"fer\\\\.from\\\\s*\\\\(.*['\\\"]base\", \"64['\\\"]\\\\)|at\", \"ob\\\\s*\\\\(\"], \"gi\"),\r\n    severity: \"critical\",\r\n    category: \"obfuscation\",\r\n    title: \"Buffer/atob encoded payload\",\r\n    description: \"Decodes encoded content via Buffer.from() or atob(), often used to hide malicious payloads.\",\r\n    codeOnly: true,\r\n    fix: \"Include the decoded content directly so users can review it.\",\r\n  },\r\n  {\r\n    name: \"STRING_FROMCHARCODE\",\r\n    pattern: re([\"String\\\\.from\", \"CharCode\\\\s*\\\\(\"], \"gi\"),\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"String.fromCharCode usage\",\r\n    description: \"Builds strings from character codes to evade static pattern detection.\",\r\n    codeOnly: true,\r\n    fix: \"Use plain string literals instead of String.fromCharCode().\",\r\n  },\r\n  {\r\n    name: \"DYNAMIC_PROPERTY_ACCESS\",\r\n    pattern: /(?:process|global|window|globalThis)\\s*\\[\\s*['\"`]?\\w*['\"`]?\\s*\\+/gi,\r\n    severity: \"medium\",\r\n    category: \"obfuscation\",\r\n    title: \"Dynamic property access on globals\",\r\n    description: \"Dynamically accesses global object properties via string concatenation to hide intent.\",\r\n    codeOnly: true,\r\n    fix: \"Use direct property access (e.g., `process.env`) instead of dynamic bracket notation.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // MEDIUM: Privilege escalation & system access\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"SUDO_USAGE\",\r\n    pattern: /sudo\\s+(?!apt|dnf|yum|brew)/gi,\r\n    severity: \"medium\",\r\n    category: \"privilege_escalation\",\r\n    title: \"Sudo usage\",\r\n    description: \"Requests elevated privileges — check if actually required for the task.\",\r\n    codeOnly: true,\r\n    fix: \"Remove sudo if not strictly necessary, or document why elevated privileges are required.\",\r\n  },\r\n  {\r\n    name: \"CHMOD_DANGEROUS\",\r\n    pattern: /chmod\\s+(?:777|a\\+[rwx]|[+]s)/gi,\r\n    severity: \"medium\",\r\n    category: \"privilege_escalation\",\r\n    title: \"Dangerous file permissions\",\r\n    description: \"Sets overly permissive file permissions (777) or setuid/setgid bits.\",\r\n    codeOnly: true,\r\n    fix: \"Use least-privilege permissions (e.g., `chmod 755` or `chmod 644`) instead of 777.\",\r\n  },\r\n  {\r\n    name: \"PATH_TRAVERSAL\",\r\n    pattern: /\\.\\.\\//g,\r\n    severity: \"medium\",\r\n    category: \"file_system\",\r\n    title: \"Path traversal\",\r\n    description: \"Uses relative path traversal (../) which could access files outside expected directories.\",\r\n    fix: \"Use absolute paths or paths relative to the skill's working directory.\",\r\n  },\r\n\r\n  // ═══════════════════════════════════════════════════════\r\n  // LOW: Suspicious but not necessarily malicious\r\n  // ═══════════════════════════════════════════════════════\r\n  {\r\n    name: \"SHELL_EXEC\",\r\n    pattern: re([\"child_\", \"process|ex\", \"ec\\\\(|spa\", \"wn\\\\(\"], \"gi\"),\r\n    severity: \"low\",\r\n    category: \"code_execution\",\r\n    title: \"Shell execution API\",\r\n    description: \"Uses shell execution APIs — legitimate but worth noting.\",\r\n    codeOnly: true,\r\n    fix: \"If shell execution is needed, use execFile() with explicit arguments instead of exec() with string commands.\",\r\n  },\r\n  {\r\n    name: \"NETWORK_REQUEST\",\r\n    pattern: /fetch\\(|axios|node-fetch|got\\(/gi,\r\n    severity: \"low\",\r\n    category: \"network\",\r\n    title: \"Network request API\",\r\n    description: \"Makes network requests — legitimate but worth reviewing targets.\",\r\n    codeOnly: true,\r\n    fix: \"Document all network endpoints in the skill description so users can review them.\",\r\n  },\r\n  {\r\n    name: \"FILE_WRITE\",\r\n    pattern: /fs\\.write|writeFileSync/gi,\r\n    severity: \"low\",\r\n    category: \"file_system\",\r\n    title: \"File write operation\",\r\n    description: \"Writes to the filesystem — check what files are being modified.\",\r\n    codeOnly: true,\r\n    fix: \"Document which files are written and why in the skill description.\",\r\n  },\r\n  {\r\n    name: \"ENV_MODIFICATION\",\r\n    pattern: /process\\.env\\[|export\\s+[A-Z_]+=|setenv/gi,\r\n    severity: \"low\",\r\n    category: \"environment\",\r\n    title: \"Environment variable modification\",\r\n    description: \"Modifies environment variables which could affect other tools or processes.\",\r\n    codeOnly: true,\r\n    fix: \"Document env var modifications in the skill description and declare them in requires.env.\",\r\n  },\r\n  {\r\n    name: \"WILDCARD_FILE_ACCESS\",\r\n    pattern: /\\*\\.(pem|key|p12|pfx|jks|keystore|ovpn|rdp)/gi,\r\n    severity: \"low\",\r\n    category: \"credential_theft\",\r\n    title: \"Sensitive file extension glob\",\r\n    description: \"Globs for files with sensitive extensions (keys, certificates, VPN configs).\",\r\n    fix: \"Reference specific files by name instead of using wildcard patterns on sensitive extensions.\",\r\n  },\r\n  {\r\n    name: \"LARGE_BASE64_LITERAL\",\r\n    pattern: /[A-Za-z0-9+/=]{100,}/g,\r\n    severity: \"low\",\r\n    category: \"obfuscation\",\r\n    title: \"Large base64-like string\",\r\n    description: \"Contains a long base64-like string that may be an encoded payload.\",\r\n    fix: \"Include the decoded content directly or explain what the base64 string contains.\",\r\n  },\r\n];\r\n\r\nexport const POPULAR_SKILLS = [\r\n  \"todoist-cli\",\r\n  \"github-manager\",\r\n  \"slack-assistant\",\r\n  \"email-composer\",\r\n  \"calendar-sync\",\r\n  \"weather-forecast\",\r\n  \"news-reader\",\r\n  \"code-reviewer\",\r\n  \"docker-helper\",\r\n  \"aws-manager\",\r\n  \"notion-sync\",\r\n  \"jira-tracker\",\r\n  \"spotify-controller\",\r\n  \"home-assistant\",\r\n  \"file-organizer\",\r\n  \"pdf-reader\",\r\n  \"translate-text\",\r\n  \"image-generator\",\r\n  \"web-scraper\",\r\n  \"database-query\",\r\n  \"git-assistant\",\r\n  \"linux-admin\",\r\n  \"python-helper\",\r\n  \"react-builder\",\r\n  \"api-tester\",\r\n  \"markdown-editor\",\r\n  \"csv-analyzer\",\r\n  \"ssh-manager\",\r\n  \"cron-scheduler\",\r\n  \"log-analyzer\",\r\n];\r\n","import { parse as parseYaml } from \"yaml\";\r\nimport type { ParsedSkill, SkillFrontmatter, CodeBlock } from \"../types.js\";\r\n\r\nconst FRONTMATTER_RE = /^---\\r?\\n([\\s\\S]*?)\\r?\\n---/;\r\nconst CODE_BLOCK_RE = /```(\\w*)\\r?\\n([\\s\\S]*?)```/g;\r\nconst URL_RE = /https?:\\/\\/[^\\s\"'<>\\])+]+/gi;\r\nconst IP_RE = /\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b/g;\r\nconst DOMAIN_RE = /\\b(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}\\b/gi;\r\n\r\nexport function parseSkill(content: string): ParsedSkill {\r\n  let frontmatter: SkillFrontmatter = {};\r\n  let body = content;\r\n\r\n  const fmMatch = content.match(FRONTMATTER_RE);\r\n  if (fmMatch) {\r\n    try {\r\n      frontmatter = parseYaml(fmMatch[1]) as SkillFrontmatter;\r\n    } catch {\r\n      frontmatter = {};\r\n    }\r\n    body = content.slice(fmMatch[0].length).trim();\r\n  }\r\n\r\n  const codeBlocks: CodeBlock[] = [];\r\n  let match: RegExpExecArray | null;\r\n  const cbRe = new RegExp(CODE_BLOCK_RE.source, CODE_BLOCK_RE.flags);\r\n\r\n  while ((match = cbRe.exec(content)) !== null) {\r\n    const before = content.slice(0, match.index);\r\n    const lineStart = before.split(\"\\n\").length;\r\n    const blockLines = match[0].split(\"\\n\").length;\r\n    codeBlocks.push({\r\n      language: match[1] || \"unknown\",\r\n      content: match[2],\r\n      lineStart,\r\n      lineEnd: lineStart + blockLines - 1,\r\n    });\r\n  }\r\n\r\n  const urls = [...new Set(content.match(URL_RE) || [])];\r\n  const ipAddresses = [...new Set(content.match(IP_RE) || [])];\r\n  const domains = [...new Set(content.match(DOMAIN_RE) || [])];\r\n\r\n  return {\r\n    frontmatter,\r\n    body,\r\n    codeBlocks,\r\n    urls,\r\n    ipAddresses,\r\n    domains,\r\n    rawContent: content,\r\n  };\r\n}\r\n","import { THREAT_PATTERNS } from \"../patterns.js\";\r\nimport type { Finding, ParsedSkill, Severity } from \"../types.js\";\r\n\r\nfunction isInCodeBlock(lineNumber: number, skill: ParsedSkill): boolean {\r\n  return skill.codeBlocks.some(\r\n    (block) => lineNumber >= block.lineStart && lineNumber <= block.lineEnd\r\n  );\r\n}\r\n\r\nfunction isInHeading(lineNumber: number, rawContent: string): boolean {\r\n  const lines = rawContent.split(\"\\n\");\r\n  const line = lines[lineNumber - 1] || \"\";\r\n  return /^\\s*#{1,6}\\s/.test(line);\r\n}\r\n\r\nconst BASE_CONFIDENCE: Record<Severity, number> = {\r\n  critical: 0.9,\r\n  high: 0.8,\r\n  medium: 0.6,\r\n  low: 0.5,\r\n};\r\n\r\nexport function runStaticAnalysis(skill: ParsedSkill): Finding[] {\r\n  const findings: Finding[] = [];\r\n\r\n  for (const threat of THREAT_PATTERNS) {\r\n    const re = new RegExp(threat.pattern.source, threat.pattern.flags);\r\n    let match: RegExpExecArray | null;\r\n\r\n    while ((match = re.exec(skill.rawContent)) !== null) {\r\n      const before = skill.rawContent.slice(0, match.index);\r\n      const lineNumber = before.split(\"\\n\").length;\r\n\r\n      if (threat.codeOnly && !isInCodeBlock(lineNumber, skill)) {\r\n        continue;\r\n      }\r\n\r\n      const inCode = isInCodeBlock(lineNumber, skill);\r\n      const inHeading = isInHeading(lineNumber, skill.rawContent);\r\n\r\n      let contextMultiplier: number;\r\n      if (inCode && threat.codeOnly) {\r\n        contextMultiplier = 1.0;\r\n      } else if (inCode) {\r\n        contextMultiplier = 0.95;\r\n      } else if (inHeading) {\r\n        contextMultiplier = 0.5;\r\n      } else if (threat.codeOnly) {\r\n        // codeOnly pattern somehow in prose (shouldn't happen due to skip above)\r\n        contextMultiplier = 0.4;\r\n      } else {\r\n        // Non-codeOnly patterns are designed to match in prose\r\n        contextMultiplier = 0.9;\r\n      }\r\n\r\n      const baseConfidence = BASE_CONFIDENCE[threat.severity];\r\n      const confidence = Math.min(1.0, baseConfidence * contextMultiplier);\r\n\r\n      findings.push({\r\n        category: threat.category,\r\n        severity: threat.severity,\r\n        title: threat.title,\r\n        description: threat.description,\r\n        evidence: match[0],\r\n        lineNumber,\r\n        analysisPass: \"static-analysis\",\r\n        confidence: Math.round(confidence * 100) / 100,\r\n        fix: threat.fix,\r\n      });\r\n    }\r\n  }\r\n\r\n  return findings;\r\n}\r\n","import type { Finding, ParsedSkill } from \"../types.js\";\r\n\r\nconst SEMVER_RE = /^\\d+\\.\\d+\\.\\d+/;\r\n\r\nconst KNOWN_BINS = [\r\n  \"curl\", \"wget\", \"git\", \"python\", \"python3\", \"node\", \"npm\", \"npx\",\r\n  \"brew\", \"apt\", \"pip\", \"docker\", \"kubectl\", \"ssh\", \"scp\", \"rsync\",\r\n  \"ffmpeg\", \"jq\", \"sed\", \"awk\", \"grep\", \"find\",\r\n];\r\n\r\nexport function validateMetadata(skill: ParsedSkill): Finding[] {\r\n  const findings: Finding[] = [];\r\n  const fm = skill.frontmatter;\r\n  const pass = \"metadata-validator\";\r\n\r\n  if (!fm.name) {\r\n    findings.push({\r\n      category: \"metadata\",\r\n      severity: \"medium\",\r\n      title: \"Missing skill name\",\r\n      description: \"SKILL.md frontmatter does not declare a name.\",\r\n      analysisPass: pass,\r\n      fix: \"Add `name:` to the YAML frontmatter.\",\r\n    });\r\n  }\r\n\r\n  if (!fm.description) {\r\n    findings.push({\r\n      category: \"metadata\",\r\n      severity: \"medium\",\r\n      title: \"Missing description\",\r\n      description: \"SKILL.md frontmatter does not declare a description.\",\r\n      analysisPass: pass,\r\n      fix: \"Add `description:` to the YAML frontmatter.\",\r\n    });\r\n  } else if (fm.description.length < 10) {\r\n    findings.push({\r\n      category: \"metadata\",\r\n      severity: \"low\",\r\n      title: \"Vague description\",\r\n      description: \"Skill description is suspiciously short.\",\r\n      evidence: fm.description,\r\n      analysisPass: pass,\r\n      fix: \"Write a more detailed description (at least 10 characters).\",\r\n    });\r\n  }\r\n\r\n  if (fm.version && !SEMVER_RE.test(fm.version)) {\r\n    findings.push({\r\n      category: \"metadata\",\r\n      severity: \"low\",\r\n      title: \"Invalid version format\",\r\n      description: \"Version does not follow semver format.\",\r\n      evidence: fm.version,\r\n      analysisPass: pass,\r\n      fix: \"Use semver format: `version: X.Y.Z` (e.g., `1.0.0`).\",\r\n    });\r\n  }\r\n\r\n  const declaredBins = new Set(fm.metadata?.openclaw?.requires?.bins || []);\r\n\r\n  for (const bin of KNOWN_BINS) {\r\n    const binRe = new RegExp(`\\\\b${bin}\\\\b`, \"i\");\r\n    if (binRe.test(skill.rawContent) && !declaredBins.has(bin)) {\r\n      const usedInCode = skill.codeBlocks.some((cb) => binRe.test(cb.content));\r\n      if (usedInCode) {\r\n        findings.push({\r\n          category: \"metadata\",\r\n          severity: \"low\",\r\n          title: `Undeclared binary: ${bin}`,\r\n          description: `Skill uses '${bin}' in code but does not declare it in requires.bins.`,\r\n          analysisPass: pass,\r\n          fix: `Add '${bin}' to \\`metadata.openclaw.requires.bins\\` in frontmatter.`,\r\n        });\r\n      }\r\n    }\r\n  }\r\n\r\n  const declaredEnv = new Set(fm.metadata?.openclaw?.requires?.env || []);\r\n  const envRe = /\\$\\{?([A-Z][A-Z0-9_]+)\\}?/g;\r\n  let match: RegExpExecArray | null;\r\n\r\n  while ((match = envRe.exec(skill.rawContent)) !== null) {\r\n    const envVar = match[1];\r\n    if (!declaredEnv.has(envVar) && envVar.length > 2) {\r\n      findings.push({\r\n        category: \"metadata\",\r\n        severity: \"low\",\r\n        title: `Undeclared env var: ${envVar}`,\r\n        description: `References environment variable $${envVar} but does not declare it in requires.env.`,\r\n        evidence: match[0],\r\n        analysisPass: pass,\r\n        fix: `Add '${envVar}' to \\`metadata.openclaw.requires.env\\` in frontmatter.`,\r\n      });\r\n    }\r\n  }\r\n\r\n  return findings;\r\n}\r\n","import type { Finding, ParsedSkill } from \"../types.js\";\r\n\r\nconst NPX_AUTO_INSTALL_RE = /npx\\s+-y\\s+/gi;\r\nconst NPM_INSTALL_RE = /npm\\s+install\\s+(-g\\s+)?(\\S+)/gi;\r\n\r\nexport function checkDependencies(skill: ParsedSkill): Finding[] {\r\n  const findings: Finding[] = [];\r\n  const pass = \"dependency-checker\";\r\n\r\n  let match: RegExpExecArray | null;\r\n  const npxRe = new RegExp(NPX_AUTO_INSTALL_RE.source, NPX_AUTO_INSTALL_RE.flags);\r\n\r\n  while ((match = npxRe.exec(skill.rawContent)) !== null) {\r\n    const before = skill.rawContent.slice(0, match.index);\r\n    const lineNumber = before.split(\"\\n\").length;\r\n\r\n    findings.push({\r\n      category: \"dependency_risk\",\r\n      severity: \"medium\",\r\n      title: \"npx auto-install (-y flag)\",\r\n      description: \"Uses 'npx -y' which auto-installs packages without user confirmation.\",\r\n      evidence: match[0],\r\n      lineNumber,\r\n      analysisPass: pass,\r\n      fix: \"Remove the `-y` flag from npx to require user confirmation before installing.\",\r\n    });\r\n  }\r\n\r\n  const npmRe = new RegExp(NPM_INSTALL_RE.source, NPM_INSTALL_RE.flags);\r\n  while ((match = npmRe.exec(skill.rawContent)) !== null) {\r\n    if (match[1]) {\r\n      findings.push({\r\n        category: \"dependency_risk\",\r\n        severity: \"medium\",\r\n        title: \"Global npm package install\",\r\n        description: `Installs npm package globally: ${match[2]}`,\r\n        evidence: match[0],\r\n        analysisPass: pass,\r\n        fix: \"Use a local install (`npm install` without `-g`) or declare the dependency in requires.bins.\",\r\n      });\r\n    }\r\n  }\r\n\r\n  return findings;\r\n}\r\n","import { distance } from \"fastest-levenshtein\";\r\nimport { POPULAR_SKILLS } from \"../patterns.js\";\r\nimport type { Finding } from \"../types.js\";\r\n\r\nconst MAX_EDIT_DISTANCE = 2;\r\n\r\nexport function detectTyposquats(skillName: string): Finding[] {\r\n  if (!skillName) return [];\r\n\r\n  const findings: Finding[] = [];\r\n  const normalized = skillName.toLowerCase().trim();\r\n\r\n  for (const popular of POPULAR_SKILLS) {\r\n    if (normalized === popular) continue;\r\n\r\n    const d = distance(normalized, popular);\r\n    if (d > 0 && d <= MAX_EDIT_DISTANCE) {\r\n      findings.push({\r\n        category: \"typosquatting\",\r\n        severity: \"high\",\r\n        title: `Possible typosquat of \"${popular}\"`,\r\n        description: `Skill name \"${skillName}\" is ${d} edit(s) away from popular skill \"${popular}\". This may be an attempt to impersonate a trusted skill.`,\r\n        evidence: `\"${skillName}\" ≈ \"${popular}\" (distance: ${d})`,\r\n        analysisPass: \"typosquat-detector\",\r\n      });\r\n    }\r\n  }\r\n\r\n  const patterns = [\r\n    { re: /-{2,}/, desc: \"extra hyphens\" },\r\n    { re: /(.)\\1{2,}/, desc: \"repeated characters\" },\r\n  ];\r\n\r\n  for (const p of patterns) {\r\n    if (p.re.test(normalized) && !POPULAR_SKILLS.includes(normalized)) {\r\n      findings.push({\r\n        category: \"typosquatting\",\r\n        severity: \"medium\",\r\n        title: `Suspicious naming pattern: ${p.desc}`,\r\n        description: `Skill name \"${skillName}\" has ${p.desc}, which is a common typosquatting technique.`,\r\n        analysisPass: \"typosquat-detector\",\r\n      });\r\n    }\r\n  }\r\n\r\n  return findings;\r\n}\r\n","import type { Finding, FindingsCount, RiskGrade } from \"../types.js\";\r\n\r\nconst SEVERITY_WEIGHTS = {\r\n  critical: 30,\r\n  high: 15,\r\n  medium: 7,\r\n  low: 3,\r\n} as const;\r\n\r\nexport function calculateRiskScore(findings: Finding[]): number {\r\n  let score = 0;\r\n  for (const f of findings) {\r\n    score += SEVERITY_WEIGHTS[f.severity] * (f.confidence ?? 1.0);\r\n  }\r\n  return Math.round(Math.min(score, 100));\r\n}\r\n\r\nexport function getRiskGrade(score: number): RiskGrade {\r\n  if (score <= 10) return \"A\";\r\n  if (score <= 25) return \"B\";\r\n  if (score <= 50) return \"C\";\r\n  if (score <= 75) return \"D\";\r\n  return \"F\";\r\n}\r\n\r\nexport function countFindings(findings: Finding[]): FindingsCount {\r\n  const counts: FindingsCount = { critical: 0, high: 0, medium: 0, low: 0 };\r\n  for (const f of findings) {\r\n    counts[f.severity]++;\r\n  }\r\n  return counts;\r\n}\r\n","import { createHash } from \"node:crypto\";\r\nimport type { ScanResult } from \"../types.js\";\r\n\r\nconst MAX_ENTRIES = 100;\r\nconst cache = new Map<string, ScanResult>();\r\n\r\nfunction hashContent(content: string): string {\r\n  return createHash(\"sha256\").update(content).digest(\"hex\");\r\n}\r\n\r\nexport function getCached(content: string): ScanResult | undefined {\r\n  const key = hashContent(content);\r\n  const result = cache.get(key);\r\n  if (result) {\r\n    // Move to end (most recently used)\r\n    cache.delete(key);\r\n    cache.set(key, result);\r\n  }\r\n  return result;\r\n}\r\n\r\nexport function setCached(content: string, result: ScanResult): void {\r\n  const key = hashContent(content);\r\n  if (cache.has(key)) {\r\n    cache.delete(key);\r\n  } else if (cache.size >= MAX_ENTRIES) {\r\n    // Evict oldest (first entry)\r\n    const oldest = cache.keys().next().value!;\r\n    cache.delete(oldest);\r\n  }\r\n  cache.set(key, result);\r\n}\r\n","import type { Finding, ScanResult } from \"../types.js\";\r\nimport { parseSkill } from \"./skill-parser.js\";\r\nimport { runStaticAnalysis } from \"./static-analysis.js\";\r\nimport { validateMetadata } from \"./metadata-validator.js\";\r\nimport { checkDependencies } from \"./dependency-checker.js\";\r\nimport { detectTyposquats } from \"./typosquat-detector.js\";\r\nimport { calculateRiskScore, getRiskGrade, countFindings } from \"./risk-scorer.js\";\r\nimport { getCached, setCached } from \"./cache.js\";\r\n\r\nexport interface ScanOptions {\r\n  semantic?: boolean;\r\n  semanticAnalyzer?: (content: string) => Promise<Finding[]>;\r\n  ignorePatterns?: string[];\r\n  skipCache?: boolean;\r\n  /** Fallback name when SKILL.md frontmatter is missing `name`. Typically the folder basename. */\r\n  skillName?: string;\r\n}\r\n\r\nexport async function scanSkill(\r\n  content: string,\r\n  options: ScanOptions = {}\r\n): Promise<ScanResult> {\r\n  if (!options.skipCache) {\r\n    const cached = getCached(content);\r\n    if (cached) {\r\n      return { ...cached, cached: true };\r\n    }\r\n  }\r\n\r\n  const skill = parseSkill(content);\r\n  const allFindings: Finding[] = [];\r\n\r\n  allFindings.push(...runStaticAnalysis(skill));\r\n  allFindings.push(...validateMetadata(skill));\r\n\r\n  if (options.semantic && options.semanticAnalyzer) {\r\n    const semanticFindings = await options.semanticAnalyzer(content);\r\n    allFindings.push(...semanticFindings);\r\n  }\r\n\r\n  allFindings.push(...checkDependencies(skill));\r\n\r\n  if (skill.frontmatter.name) {\r\n    allFindings.push(...detectTyposquats(skill.frontmatter.name));\r\n  }\r\n\r\n  // Filter out ignored patterns\r\n  const filteredFindings = options.ignorePatterns?.length\r\n    ? allFindings.filter(\r\n        (f) => !options.ignorePatterns!.some((ig) => f.title === ig || f.category === ig)\r\n      )\r\n    : allFindings;\r\n\r\n  const riskScore = calculateRiskScore(filteredFindings);\r\n  const riskGrade = getRiskGrade(riskScore);\r\n  const findingsCount = countFindings(filteredFindings);\r\n\r\n  const recommendation =\r\n    riskScore >= 76 ? \"block\" : riskScore >= 26 ? \"warn\" : \"approve\";\r\n\r\n  const result: ScanResult = {\r\n    skillName: skill.frontmatter.name || options.skillName || \"unknown\",\r\n    skillVersion: skill.frontmatter.version,\r\n    skillSource: \"local\",\r\n    status: \"complete\",\r\n    riskScore,\r\n    riskGrade,\r\n    findingsCount,\r\n    findings: filteredFindings,\r\n    recommendation,\r\n  };\r\n\r\n  if (!options.skipCache) {\r\n    setCached(content, result);\r\n  }\r\n\r\n  return result;\r\n}\r\n\r\nexport { parseSkill } from \"./skill-parser.js\";\r\nexport { runStaticAnalysis } from \"./static-analysis.js\";\r\nexport { validateMetadata } from \"./metadata-validator.js\";\r\nexport { checkDependencies } from \"./dependency-checker.js\";\r\nexport { detectTyposquats } from \"./typosquat-detector.js\";\r\nexport { calculateRiskScore, getRiskGrade, countFindings } from \"./risk-scorer.js\";\r\n","import chalk from \"chalk\";\r\nimport type { ScanResult, Finding, Severity } from \"@clawvet/shared\";\r\n\r\nconst SEVERITY_COLORS: Record<Severity, (s: string) => string> = {\r\n  critical: chalk.bgRed.white.bold,\r\n  high: chalk.red.bold,\r\n  medium: chalk.yellow,\r\n  low: chalk.blue,\r\n};\r\n\r\nconst GRADE_COLORS: Record<string, (s: string) => string> = {\r\n  A: chalk.green.bold,\r\n  B: chalk.greenBright,\r\n  C: chalk.yellow.bold,\r\n  D: chalk.redBright.bold,\r\n  F: chalk.bgRed.white.bold,\r\n};\r\n\r\nexport function printScanResult(result: ScanResult): void {\r\n  console.log();\r\n  console.log(chalk.bold(\"━\".repeat(60)));\r\n  console.log(chalk.bold(\"  ClawVet Scan Report\"));\r\n  console.log(chalk.bold(\"━\".repeat(60)));\r\n  console.log();\r\n\r\n  console.log(`  Skill:   ${chalk.bold(result.skillName)}`);\r\n  if (result.skillVersion) {\r\n    console.log(`  Version: ${result.skillVersion}`);\r\n  }\r\n  console.log();\r\n\r\n  // Risk score\r\n  const gradeColor = GRADE_COLORS[result.riskGrade] || chalk.white;\r\n  console.log(\r\n    `  Risk Score: ${gradeColor(`${Math.round(result.riskScore)}/100`)}  Grade: ${gradeColor(result.riskGrade)}`\r\n  );\r\n  console.log();\r\n\r\n  // Findings summary\r\n  const fc = result.findingsCount;\r\n  console.log(\"  Findings:\");\r\n  if (fc.critical)\r\n    console.log(\r\n      `    ${SEVERITY_COLORS.critical(` CRITICAL `)} ${fc.critical}`\r\n    );\r\n  if (fc.high)\r\n    console.log(`    ${SEVERITY_COLORS.high(\"HIGH\")}     ${fc.high}`);\r\n  if (fc.medium)\r\n    console.log(`    ${SEVERITY_COLORS.medium(\"MEDIUM\")}   ${fc.medium}`);\r\n  if (fc.low) console.log(`    ${SEVERITY_COLORS.low(\"LOW\")}      ${fc.low}`);\r\n  if (!fc.critical && !fc.high && !fc.medium && !fc.low) {\r\n    console.log(`    ${chalk.green(\"No findings — skill looks clean!\")}`);\r\n  }\r\n  console.log();\r\n\r\n  // Detailed findings\r\n  if (result.findings.length > 0) {\r\n    console.log(chalk.bold(\"  Details:\"));\r\n    console.log();\r\n    for (const f of result.findings) {\r\n      const color = SEVERITY_COLORS[f.severity];\r\n      const confStr = f.confidence != null ? ` ${Math.round(f.confidence * 100)}%` : \"\";\r\n      console.log(`  ${color(`[${f.severity.toUpperCase()}${confStr}]`)} ${f.title}`);\r\n      console.log(`    ${chalk.dim(f.description)}`);\r\n      if (f.evidence) {\r\n        console.log(`    Evidence: ${chalk.italic(f.evidence)}`);\r\n      }\r\n      if (f.lineNumber) {\r\n        console.log(`    Line: ${f.lineNumber}`);\r\n      }\r\n      if (f.fix) {\r\n        console.log(`    Fix: ${chalk.green(f.fix)}`);\r\n      }\r\n      console.log();\r\n    }\r\n  }\r\n\r\n  // Recommendation\r\n  const recColors: Record<string, (s: string) => string> = {\r\n    block: chalk.bgRed.white.bold,\r\n    warn: chalk.bgYellow.black.bold,\r\n    approve: chalk.bgGreen.black.bold,\r\n  };\r\n  const rec = result.recommendation || \"approve\";\r\n  console.log(\r\n    `  Recommendation: ${(recColors[rec] || chalk.white)(` ${rec.toUpperCase()} `)}`\r\n  );\r\n  console.log();\r\n  console.log(chalk.bold(\"━\".repeat(60)));\r\n  console.log();\r\n}\r\n","import type { ScanResult } from \"@clawvet/shared\";\r\n\r\nexport function printJsonResult(result: ScanResult): void {\r\n  console.log(JSON.stringify(result, null, 2));\r\n}\r\n","import type { ScanResult, Finding, Severity } from \"@clawvet/shared\";\r\n\r\nconst SEVERITY_TO_SARIF: Record<Severity, string> = {\r\n  critical: \"error\",\r\n  high: \"error\",\r\n  medium: \"warning\",\r\n  low: \"note\",\r\n};\r\n\r\nconst SEVERITY_TO_LEVEL: Record<Severity, string> = {\r\n  critical: \"9.0\",\r\n  high: \"7.0\",\r\n  medium: \"4.0\",\r\n  low: \"1.0\",\r\n};\r\n\r\nexport function printSarifResult(result: ScanResult): void {\r\n  const rules = new Map<string, { id: string; finding: Finding }>();\r\n\r\n  for (const f of result.findings) {\r\n    const ruleId = f.category + \"/\" + f.title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\r\n    if (!rules.has(ruleId)) {\r\n      rules.set(ruleId, { id: ruleId, finding: f });\r\n    }\r\n  }\r\n\r\n  const sarif = {\r\n    $schema: \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json\",\r\n    version: \"2.1.0\",\r\n    runs: [\r\n      {\r\n        tool: {\r\n          driver: {\r\n            name: \"clawvet\",\r\n            informationUri: \"https://github.com/clawvet/clawvet\",\r\n            rules: [...rules.values()].map((r) => ({\r\n              id: r.id,\r\n              shortDescription: { text: r.finding.title },\r\n              fullDescription: { text: r.finding.description },\r\n              defaultConfiguration: {\r\n                level: SEVERITY_TO_SARIF[r.finding.severity],\r\n              },\r\n              properties: {\r\n                security_severity: SEVERITY_TO_LEVEL[r.finding.severity],\r\n              },\r\n            })),\r\n          },\r\n        },\r\n        results: result.findings.map((f) => {\r\n          const ruleId = f.category + \"/\" + f.title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\r\n          return {\r\n            ruleId,\r\n            level: SEVERITY_TO_SARIF[f.severity],\r\n            message: {\r\n              text: f.description + (f.evidence ? ` Evidence: ${f.evidence}` : \"\"),\r\n              ...(f.fix ? { markdown: `${f.description}\\n\\n**Fix:** ${f.fix}` } : {}),\r\n            },\r\n            locations: [\r\n              {\r\n                physicalLocation: {\r\n                  artifactLocation: { uri: \"SKILL.md\" },\r\n                  region: { startLine: f.lineNumber ?? 1 },\r\n                },\r\n              },\r\n            ],\r\n          };\r\n        }),\r\n      },\r\n    ],\r\n  };\r\n\r\n  console.log(JSON.stringify(sarif, null, 2));\r\n}\r\n","import { readFileSync, writeFileSync, mkdirSync, existsSync } from \"node:fs\";\r\nimport { join } from \"node:path\";\r\nimport { homedir, platform, release } from \"node:os\";\r\nimport { randomUUID, createHash } from \"node:crypto\";\r\nimport type { ScanResult } from \"@clawvet/shared\";\r\n\r\nconst CONFIG_DIR = join(homedir(), \".clawvet\");\r\nconst CONFIG_FILE = join(CONFIG_DIR, \"config.json\");\r\nconst TELEMETRY_ENDPOINT = \"https://bazzzz--0ab7a9301f3911f1ab9942dde27851f2.web.val.run\";\r\n\r\n// Never send raw skill names — that would leak what skills a user has\r\n// installed (including private/internal ones) to the telemetry endpoint.\r\n// A SHA-256 hash still lets us correlate a *known public* skill across devices\r\n// (hash the public name and match), but arbitrary/private names stay\r\n// unrecoverable, so nothing sensitive leaves the machine in cleartext.\r\nfunction hashSkillName(name: string): string {\r\n  return createHash(\"sha256\").update(name).digest(\"hex\").slice(0, 16);\r\n}\r\n\r\n// Tag traffic so dev/CI runs can be excluded from product metrics server-side\r\n// instead of polluting them (the \"dev-local\" rows problem).\r\nfunction detectEnvironment(): \"ci\" | \"development\" | \"production\" {\r\n  if (process.env.CI || process.env.GITHUB_ACTIONS) return \"ci\";\r\n  if (process.env.CLAWVET_ENV === \"development\" || process.env.NODE_ENV === \"development\") {\r\n    return \"development\";\r\n  }\r\n  return \"production\";\r\n}\r\n\r\nfunction readCliVersion(): string {\r\n  try {\r\n    const pkg = JSON.parse(\r\n      readFileSync(new URL(\"../package.json\", import.meta.url), \"utf-8\")\r\n    );\r\n    return pkg.version ?? \"0.0.0\";\r\n  } catch {\r\n    return \"0.0.0\";\r\n  }\r\n}\r\n\r\ninterface Config {\r\n  telemetry?: \"on\" | \"off\" | undefined; // undefined = not yet asked\r\n  deviceId?: string;\r\n  scanCount?: number;\r\n}\r\n\r\nfunction loadConfig(): Config {\r\n  try {\r\n    if (existsSync(CONFIG_FILE)) {\r\n      return JSON.parse(readFileSync(CONFIG_FILE, \"utf-8\"));\r\n    }\r\n  } catch {\r\n    // corrupted config, start fresh\r\n  }\r\n  return {};\r\n}\r\n\r\nfunction saveConfig(config: Config): void {\r\n  try {\r\n    mkdirSync(CONFIG_DIR, { recursive: true });\r\n    writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));\r\n  } catch {\r\n    // non-critical, ignore\r\n  }\r\n}\r\n\r\nexport function isTelemetryEnabled(): boolean {\r\n  const env = process.env.CLAWVET_TELEMETRY;\r\n  if (env === \"0\" || env === \"off\") return false;\r\n  if (env === \"1\" || env === \"on\") return true;\r\n  const config = loadConfig();\r\n  return config.telemetry === \"on\";\r\n}\r\n\r\nexport function setTelemetry(enabled: boolean): void {\r\n  const config = loadConfig();\r\n  config.telemetry = enabled ? \"on\" : \"off\";\r\n  saveConfig(config);\r\n}\r\n\r\nexport function hasBeenAsked(): boolean {\r\n  const config = loadConfig();\r\n  return config.telemetry !== undefined;\r\n}\r\n\r\nfunction getDeviceId(): string {\r\n  const config = loadConfig();\r\n  if (!config.deviceId) {\r\n    config.deviceId = randomUUID();\r\n    saveConfig(config);\r\n  }\r\n  return config.deviceId;\r\n}\r\n\r\nfunction incrementScanCount(): number {\r\n  const config = loadConfig();\r\n  config.scanCount = (config.scanCount || 0) + 1;\r\n  saveConfig(config);\r\n  return config.scanCount;\r\n}\r\n\r\nexport function getScanCount(): number {\r\n  return loadConfig().scanCount || 0;\r\n}\r\n\r\nexport function sendTelemetry(result: ScanResult): Promise<void> {\r\n  if (!isTelemetryEnabled()) return Promise.resolve();\r\n\r\n  const scanCount = incrementScanCount();\r\n\r\n  const payload = {\r\n    event: \"scan_completed\",\r\n    deviceId: getDeviceId(),\r\n    scanCount,\r\n    ts: new Date().toISOString(),\r\n    os: platform(),\r\n    osVersion: release(),\r\n    cliVersion: readCliVersion(),\r\n    environment: detectEnvironment(),\r\n    skillHash: hashSkillName(result.skillName),\r\n    riskScore: result.riskScore,\r\n    riskGrade: result.riskGrade,\r\n    findingsCount: result.findingsCount,\r\n    cached: result.cached ?? false,\r\n  };\r\n\r\n  return post(payload);\r\n}\r\n\r\nexport interface AuditSummary {\r\n  skillsScanned: number;\r\n  findingsTotal: number;\r\n  grades: Record<string, number>;\r\n  durationMs: number;\r\n}\r\n\r\n/**\r\n * One session-level event summarising a whole `clawvet audit` run, instead of\r\n * one event per scanned skill. Lets an audit of N skills register as a single\r\n * data point (the strongest usage signal) without inflating scan counts.\r\n */\r\nexport function sendAuditTelemetry(summary: AuditSummary): Promise<void> {\r\n  if (!isTelemetryEnabled()) return Promise.resolve();\r\n\r\n  const payload = {\r\n    event: \"audit_completed\",\r\n    deviceId: getDeviceId(),\r\n    ts: new Date().toISOString(),\r\n    os: platform(),\r\n    osVersion: release(),\r\n    cliVersion: readCliVersion(),\r\n    environment: detectEnvironment(),\r\n    skillsScanned: summary.skillsScanned,\r\n    findingsTotal: summary.findingsTotal,\r\n    grades: summary.grades,\r\n    durationMs: summary.durationMs,\r\n  };\r\n\r\n  return post(payload);\r\n}\r\n\r\nfunction post(payload: unknown): Promise<void> {\r\n  return fetch(TELEMETRY_ENDPOINT, {\r\n    method: \"POST\",\r\n    headers: { \"Content-Type\": \"application/json\" },\r\n    body: JSON.stringify(payload),\r\n    signal: AbortSignal.timeout(3000),\r\n  })\r\n    .then(() => {})\r\n    .catch(() => {\r\n      // silently ignore — telemetry is best-effort\r\n    });\r\n}\r\n","import { readFileSync, readdirSync, statSync } from \"node:fs\";\r\nimport { basename, join } from \"node:path\";\r\n\r\nconst MAX_REFERENCED_FILE_SIZE = 256 * 1024;\r\nconst SHALLOW_DIRECTORIES = new Set([\"lib\", \"scripts\"]);\r\n\r\ninterface CandidateFile {\r\n  absolutePath: string;\r\n  relativePath: string;\r\n}\r\n\r\nfunction escapeRegExp(value: string): string {\r\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\r\n}\r\n\r\nfunction isReferenced(skillMd: string, relativePath: string): boolean {\r\n  // ponytail: basename substring match; upgrade to real reference parsing\r\n  // (Markdown links + shell tokens) if benchmark false-negatives appear.\r\n  const names = new Set([basename(relativePath), relativePath]);\r\n  return [...names].some((name) =>\r\n    new RegExp(`\\\\b${escapeRegExp(name)}\\\\b`).test(skillMd)\r\n  );\r\n}\r\n\r\nfunction listCandidates(skillDir: string): CandidateFile[] {\r\n  const candidates: CandidateFile[] = [];\r\n\r\n  let entries;\r\n  try {\r\n    entries = readdirSync(skillDir, { withFileTypes: true });\r\n  } catch {\r\n    return candidates;\r\n  }\r\n\r\n  for (const entry of entries) {\r\n    if (entry.isFile()) {\r\n      if (entry.name !== \"SKILL.md\") {\r\n        candidates.push({\r\n          absolutePath: join(skillDir, entry.name),\r\n          relativePath: entry.name,\r\n        });\r\n      }\r\n      continue;\r\n    }\r\n\r\n    if (!entry.isDirectory() || !SHALLOW_DIRECTORIES.has(entry.name)) {\r\n      continue;\r\n    }\r\n\r\n    try {\r\n      for (const child of readdirSync(join(skillDir, entry.name), {\r\n        withFileTypes: true,\r\n      })) {\r\n        if (child.isFile()) {\r\n          candidates.push({\r\n            absolutePath: join(skillDir, entry.name, child.name),\r\n            relativePath: `${entry.name}/${child.name}`,\r\n          });\r\n        }\r\n      }\r\n    } catch {\r\n      // A missing or unreadable optional directory should not abort the scan.\r\n    }\r\n  }\r\n\r\n  return candidates.sort((a, b) =>\r\n    a.relativePath.localeCompare(b.relativePath)\r\n  );\r\n}\r\n\r\n/**\r\n * Appends local files explicitly referenced by a skill manifest so the shared\r\n * string-only scanner can inspect cross-file payloads without filesystem access.\r\n */\r\nexport function assembleSkill(skillDir: string, skillMd: string): string {\r\n  let assembled = skillMd;\r\n\r\n  for (const candidate of listCandidates(skillDir)) {\r\n    if (!isReferenced(skillMd, candidate.relativePath)) {\r\n      continue;\r\n    }\r\n\r\n    try {\r\n      const stat = statSync(candidate.absolutePath);\r\n      if (stat.size > MAX_REFERENCED_FILE_SIZE) {\r\n        continue;\r\n      }\r\n\r\n      const contents = readFileSync(candidate.absolutePath);\r\n      if (contents.includes(0)) {\r\n        continue;\r\n      }\r\n\r\n      const separator = assembled.endsWith(\"\\n\") ? \"\\n\" : \"\\n\\n\";\r\n      assembled += `${separator}# [clawvet] referenced file: ${candidate.relativePath}\\n${contents.toString(\"utf-8\")}`;\r\n    } catch {\r\n      // Files may disappear or become unreadable between listing and reading.\r\n    }\r\n  }\r\n\r\n  return assembled;\r\n}\r\n","import { readdirSync, existsSync, readFileSync } from \"node:fs\";\r\nimport { join, basename } from \"node:path\";\r\nimport { homedir } from \"node:os\";\r\nimport { scanSkill } from \"@clawvet/shared\";\r\nimport { printScanResult } from \"../output/terminal.js\";\r\nimport { sendAuditTelemetry } from \"../telemetry.js\";\r\nimport chalk from \"chalk\";\r\n\r\nconst DEFAULT_SKILL_DIRS = [\r\n  join(homedir(), \".openclaw\", \"skills\"),\r\n  join(homedir(), \".openclaw\", \"workspace\", \"skills\"),\r\n];\r\n\r\nexport async function auditCommand(options: { dir?: string } = {}): Promise<void> {\r\n  const SKILL_DIRS = options.dir ? [options.dir] : DEFAULT_SKILL_DIRS;\r\n  console.log(chalk.bold(\"\\nClawVet Audit — Scanning all installed skills\\n\"));\r\n\r\n  const startedAt = Date.now();\r\n  let totalScanned = 0;\r\n  let totalThreats = 0;\r\n  const grades: Record<string, number> = { A: 0, B: 0, C: 0, D: 0, F: 0 };\r\n\r\n  for (const dir of SKILL_DIRS) {\r\n    if (!existsSync(dir)) {\r\n      if (options.dir) {\r\n        console.error(chalk.yellow(`Warning: Directory not found: ${dir}\\n`));\r\n        process.exit(1);\r\n      }\r\n      continue;\r\n    }\r\n\r\n    // If the dir itself contains a SKILL.md, scan it directly\r\n    const directSkillFile = join(dir, \"SKILL.md\");\r\n    if (existsSync(directSkillFile)) {\r\n      const content = readFileSync(directSkillFile, \"utf-8\");\r\n      const result = await scanSkill(content, { skillName: basename(dir) });\r\n      totalScanned++;\r\n      totalThreats += result.findings.length;\r\n      grades[result.riskGrade] = (grades[result.riskGrade] ?? 0) + 1;\r\n      printScanResult(result);\r\n      continue;\r\n    }\r\n\r\n    const entries = readdirSync(dir, { withFileTypes: true });\r\n    for (const entry of entries) {\r\n      if (!entry.isDirectory()) continue;\r\n      const skillFile = join(dir, entry.name, \"SKILL.md\");\r\n      if (!existsSync(skillFile)) continue;\r\n\r\n      const content = readFileSync(skillFile, \"utf-8\");\r\n      const result = await scanSkill(content, { skillName: entry.name });\r\n      totalScanned++;\r\n      totalThreats += result.findings.length;\r\n      grades[result.riskGrade] = (grades[result.riskGrade] ?? 0) + 1;\r\n\r\n      printScanResult(result);\r\n    }\r\n  }\r\n\r\n  const gradeColors: Record<string, (s: string) => string> = {\r\n    A: chalk.green.bold,\r\n    B: chalk.greenBright,\r\n    C: chalk.yellow.bold,\r\n    D: chalk.redBright.bold,\r\n    F: chalk.bgRed.white.bold,\r\n  };\r\n  const gradeSummary = ([\"A\", \"B\", \"C\", \"D\", \"F\"] as const)\r\n    .filter((g) => grades[g] > 0)\r\n    .map((g) => `${gradeColors[g](g)} ${grades[g]}`)\r\n    .join(\"  \");\r\n\r\n  console.log(\r\n    chalk.bold(\r\n      `\\nAudit complete: ${totalScanned} skills scanned, ${totalThreats} findings`\r\n    )\r\n  );\r\n  if (totalScanned > 0) {\r\n    console.log(`  Grades: ${gradeSummary}`);\r\n  }\r\n  const blocked = grades.D + grades.F;\r\n  if (blocked > 0) {\r\n    console.log(\r\n      chalk.red(`  ${blocked} skill${blocked > 1 ? \"s\" : \"\"} graded D or F — review before use`)\r\n    );\r\n  }\r\n  console.log();\r\n\r\n  // One session-level telemetry event for the whole audit (best-effort).\r\n  await sendAuditTelemetry({\r\n    skillsScanned: totalScanned,\r\n    findingsTotal: totalThreats,\r\n    grades,\r\n    durationMs: Date.now() - startedAt,\r\n  });\r\n}\r\n","import { readFileSync, existsSync, watch } from \"node:fs\";\r\nimport { join, dirname, basename } from \"node:path\";\r\nimport { homedir } from \"node:os\";\r\nimport chalk from \"chalk\";\r\nimport { scanSkill } from \"@clawvet/shared\";\r\nimport { printScanResult } from \"../output/terminal.js\";\r\n\r\nconst DEFAULT_SKILL_DIRS = [\r\n  join(homedir(), \".openclaw\", \"skills\"),\r\n  join(homedir(), \".openclaw\", \"workspace\", \"skills\"),\r\n];\r\n\r\nexport async function watchCommand(options: {\r\n  threshold?: number;\r\n  dir?: string;\r\n}): Promise<void> {\r\n  const threshold = options.threshold || 50;\r\n  const SKILL_DIRS = options.dir ? [options.dir] : DEFAULT_SKILL_DIRS;\r\n  console.log(\r\n    chalk.bold(\r\n      `\\nClawVet Watch — monitoring skill directories (threshold: ${threshold})\\n`\r\n    )\r\n  );\r\n\r\n  const watchDirs: string[] = [];\r\n  for (const dir of SKILL_DIRS) {\r\n    if (existsSync(dir)) {\r\n      watchDirs.push(dir);\r\n    }\r\n  }\r\n\r\n  if (watchDirs.length === 0) {\r\n    console.log(\r\n      chalk.yellow(\r\n        \"No OpenClaw skill directories found. Watching will start when directories are created.\\n\"\r\n      )\r\n    );\r\n    console.log(chalk.dim(\"Expected directories:\"));\r\n    for (const dir of SKILL_DIRS) {\r\n      console.log(chalk.dim(`  ${dir}`));\r\n    }\r\n    console.log();\r\n    process.exit(1);\r\n  }\r\n\r\n  console.log(chalk.dim(\"Watching:\"));\r\n  for (const dir of watchDirs) {\r\n    console.log(chalk.dim(`  ${dir}`));\r\n  }\r\n  console.log();\r\n\r\n  for (const dir of watchDirs) {\r\n    const watcher = watch(dir, { recursive: true }, async (event, filename) => {\r\n      if (!filename?.endsWith(\"SKILL.md\")) return;\r\n\r\n      const skillFile = join(dir, filename);\r\n      if (!existsSync(skillFile)) return;\r\n\r\n      console.log(chalk.dim(`\\nDetected change: ${filename}`));\r\n\r\n      try {\r\n        const content = readFileSync(skillFile, \"utf-8\");\r\n        const result = await scanSkill(content, {\r\n          skillName: basename(dirname(skillFile)),\r\n        });\r\n\r\n        if (result.cached) {\r\n          console.log(chalk.dim(\"(cached)\"));\r\n        }\r\n        printScanResult(result);\r\n\r\n        if (result.riskScore > threshold) {\r\n          console.log(\r\n            chalk.bgRed.white.bold(\r\n              ` BLOCKED — Risk score ${result.riskScore} exceeds threshold ${threshold} `\r\n            )\r\n          );\r\n          console.log(\r\n            chalk.red(\r\n              `This skill should not be installed. Run 'clawvet scan ${skillFile}' for details.\\n`\r\n            )\r\n          );\r\n        }\r\n      } catch (err) {\r\n        console.error(chalk.red(`Error scanning ${filename}:`), err);\r\n      }\r\n    });\r\n\r\n    process.on(\"SIGINT\", () => {\r\n      watcher.close();\r\n      console.log(chalk.dim(\"\\nWatch stopped.\"));\r\n      process.exit(0);\r\n    });\r\n  }\r\n\r\n  console.log(chalk.dim(\"Press Ctrl+C to stop watching.\\n\"));\r\n  await new Promise(() => {});\r\n}\r\n","import { readFileSync, existsSync, statSync } from \"node:fs\";\r\nimport { resolve, join, dirname, basename } from \"node:path\";\r\nimport chalk from \"chalk\";\r\nimport { scanSkill } from \"@clawvet/shared\";\r\nimport type { RiskGrade } from \"@clawvet/shared\";\r\n\r\nconst GRADE_COLORS: Record<RiskGrade, string> = {\r\n  A: \"brightgreen\",\r\n  B: \"green\",\r\n  C: \"yellow\",\r\n  D: \"orange\",\r\n  F: \"red\",\r\n};\r\n\r\nconst GRADE_LABELS: Record<RiskGrade, string> = {\r\n  A: \"safe\",\r\n  B: \"safe\",\r\n  C: \"review\",\r\n  D: \"risky\",\r\n  F: \"dangerous\",\r\n};\r\n\r\nexport async function badgeCommand(\r\n  target: string,\r\n  options: { markdown?: boolean }\r\n): Promise<void> {\r\n  const skillPath = resolve(target);\r\n  let skillFile = skillPath;\r\n\r\n  if (\r\n    existsSync(skillPath) &&\r\n    !skillPath.endsWith(\".md\") &&\r\n    existsSync(join(skillPath, \"SKILL.md\"))\r\n  ) {\r\n    skillFile = join(skillPath, \"SKILL.md\");\r\n  }\r\n\r\n  if (!existsSync(skillFile) || statSync(skillFile).isDirectory()) {\r\n    console.error(`Error: Cannot find SKILL.md at ${skillFile}`);\r\n    process.exit(1);\r\n  }\r\n\r\n  const content = readFileSync(skillFile, \"utf-8\");\r\n  const result = await scanSkill(content, {\r\n    skillName: basename(dirname(skillFile)),\r\n  });\r\n\r\n  const label = GRADE_LABELS[result.riskGrade];\r\n  const color = GRADE_COLORS[result.riskGrade];\r\n  const badgeUrl = `https://img.shields.io/badge/clawvet-${result.riskGrade}%20${label}-${color}`;\r\n  const linkUrl = \"https://github.com/MohibShaikh/clawvet\";\r\n\r\n  if (options.markdown) {\r\n    console.log(`[![ClawVet ${result.riskGrade}](${badgeUrl})](${linkUrl})`);\r\n  } else {\r\n    console.log();\r\n    console.log(chalk.bold(\"  ClawVet Trust Badge\"));\r\n    console.log();\r\n    console.log(`  Skill:  ${chalk.bold(result.skillName)}`);\r\n    console.log(`  Grade:  ${result.riskGrade} (${label})`);\r\n    console.log(`  Score:  ${result.riskScore}/100`);\r\n    console.log();\r\n    console.log(chalk.dim(\"  Markdown (paste in README):\"));\r\n    console.log();\r\n    console.log(`  [![ClawVet ${result.riskGrade}](${badgeUrl})](${linkUrl})`);\r\n    console.log();\r\n    console.log(chalk.dim(\"  HTML:\"));\r\n    console.log();\r\n    console.log(`  <a href=\"${linkUrl}\"><img src=\"${badgeUrl}\" alt=\"ClawVet ${result.riskGrade}\"></a>`);\r\n    console.log();\r\n  }\r\n}\r\n"],"mappings":";;;AAAA,SAAS,eAAe;AACxB,SAAS,gBAAAA,qBAAoB;AAC7B,SAAS,gBAAgB;AACzB,SAAS,qBAAqB;AAC9B,SAAS,WAAAC,UAAS,QAAAC,aAAY;;;ACJ9B,SAAS,gBAAAC,eAAc,cAAAC,aAAY,YAAAC,iBAAgB;AACnD,SAAS,SAAS,QAAAC,OAAM,YAAAC,WAAU,eAAe;AACjD,OAAOC,YAAW;;;ACClB,SAAS,GAAG,OAAiB,OAAuB;AAClD,SAAO,IAAI,OAAO,MAAM,KAAK,EAAE,GAAG,KAAK;AACzC;AAEO,IAAM,kBAAmC;AAAA;AAAA;AAAA;AAAA,EAI9C;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,0BAA0B,IAAI,GAAG,IAAI;AAAA,IAClD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,yBAAyB,IAAI,GAAG,IAAI;AAAA,IACjD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,MAAM,WAAW,GAAG,IAAI;AAAA,IACrC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,QAAQ,mBAAmB,MAAM,GAAG,IAAI;AAAA,IACrD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,QAAQ,cAAc,GAAG,IAAI;AAAA,IAC1C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,eAAe,yBAAyB,eAAe,gBAAgB,GAAG,IAAI;AAAA,IAC3F,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,QAAQ,yBAAyB,YAAY,eAAe,GAAG,IAAI;AAAA,IAChF,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,OAAO,SAAS,GAAG,IAAI;AAAA,IACpC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,MAAM,aAAa,GAAG,IAAI;AAAA,IACvC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,OAAO,SAAS,GAAG,IAAI;AAAA,IACpC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,cAAc,kBAAkB,sBAAsB,QAAQ,GAAG,IAAI;AAAA,IAClF,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,OAAO,+BAAgC,gBAAiB,WAAW,GAAG,IAAI;AAAA,IACvF,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,iBAAiB,iBAAiB,GAAG,IAAI;AAAA,IACtD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS,GAAG,CAAC,UAAU,cAAc,aAAa,OAAO,GAAG,IAAI;AAAA,IAChE,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,IACV,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,EACP;AACF;AAEO,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AChmBA,SAAS,SAAS,iBAAiB;AAGnC,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,SAAS;AACf,IAAM,QAAQ;AACd,IAAM,YAAY;AAEX,SAAS,WAAW,SAA8B;AACvD,MAAI,cAAgC,CAAC;AACrC,MAAI,OAAO;AAEX,QAAM,UAAU,QAAQ,MAAM,cAAc;AAC5C,MAAI,SAAS;AACX,QAAI;AACF,oBAAc,UAAU,QAAQ,CAAC,CAAC;AAAA,IACpC,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AACA,WAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK;AAAA,EAC/C;AAEA,QAAM,aAA0B,CAAC;AACjC,MAAI;AACJ,QAAM,OAAO,IAAI,OAAO,cAAc,QAAQ,cAAc,KAAK;AAEjE,UAAQ,QAAQ,KAAK,KAAK,OAAO,OAAO,MAAM;AAC5C,UAAM,SAAS,QAAQ,MAAM,GAAG,MAAM,KAAK;AAC3C,UAAM,YAAY,OAAO,MAAM,IAAI,EAAE;AACrC,UAAM,aAAa,MAAM,CAAC,EAAE,MAAM,IAAI,EAAE;AACxC,eAAW,KAAK;AAAA,MACd,UAAU,MAAM,CAAC,KAAK;AAAA,MACtB,SAAS,MAAM,CAAC;AAAA,MAChB;AAAA,MACA,SAAS,YAAY,aAAa;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC;AACrD,QAAM,cAAc,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC;AAC3D,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,CAAC;AAE3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd;AACF;;;ACjDA,SAAS,cAAc,YAAoB,OAA6B;AACtE,SAAO,MAAM,WAAW;AAAA,IACtB,CAAC,UAAU,cAAc,MAAM,aAAa,cAAc,MAAM;AAAA,EAClE;AACF;AAEA,SAAS,YAAY,YAAoB,YAA6B;AACpE,QAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,QAAM,OAAO,MAAM,aAAa,CAAC,KAAK;AACtC,SAAO,eAAe,KAAK,IAAI;AACjC;AAEA,IAAM,kBAA4C;AAAA,EAChD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEO,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,WAAsB,CAAC;AAE7B,aAAW,UAAU,iBAAiB;AACpC,UAAMC,MAAK,IAAI,OAAO,OAAO,QAAQ,QAAQ,OAAO,QAAQ,KAAK;AACjE,QAAI;AAEJ,YAAQ,QAAQA,IAAG,KAAK,MAAM,UAAU,OAAO,MAAM;AACnD,YAAM,SAAS,MAAM,WAAW,MAAM,GAAG,MAAM,KAAK;AACpD,YAAM,aAAa,OAAO,MAAM,IAAI,EAAE;AAEtC,UAAI,OAAO,YAAY,CAAC,cAAc,YAAY,KAAK,GAAG;AACxD;AAAA,MACF;AAEA,YAAM,SAAS,cAAc,YAAY,KAAK;AAC9C,YAAM,YAAY,YAAY,YAAY,MAAM,UAAU;AAE1D,UAAI;AACJ,UAAI,UAAU,OAAO,UAAU;AAC7B,4BAAoB;AAAA,MACtB,WAAW,QAAQ;AACjB,4BAAoB;AAAA,MACtB,WAAW,WAAW;AACpB,4BAAoB;AAAA,MACtB,WAAW,OAAO,UAAU;AAE1B,4BAAoB;AAAA,MACtB,OAAO;AAEL,4BAAoB;AAAA,MACtB;AAEA,YAAM,iBAAiB,gBAAgB,OAAO,QAAQ;AACtD,YAAM,aAAa,KAAK,IAAI,GAAK,iBAAiB,iBAAiB;AAEnE,eAAS,KAAK;AAAA,QACZ,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,aAAa,OAAO;AAAA,QACpB,UAAU,MAAM,CAAC;AAAA,QACjB;AAAA,QACA,cAAc;AAAA,QACd,YAAY,KAAK,MAAM,aAAa,GAAG,IAAI;AAAA,QAC3C,KAAK,OAAO;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;ACvEA,IAAM,YAAY;AAElB,IAAM,aAAa;AAAA,EACjB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAU;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAO;AAAA,EAC3D;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAU;AAAA,EAAW;AAAA,EAAO;AAAA,EAAO;AAAA,EACzD;AAAA,EAAU;AAAA,EAAM;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AACxC;AAEO,SAAS,iBAAiB,OAA+B;AAC9D,QAAM,WAAsB,CAAC;AAC7B,QAAM,KAAK,MAAM;AACjB,QAAM,OAAO;AAEb,MAAI,CAAC,GAAG,MAAM;AACZ,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,GAAG,aAAa;AACnB,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH,WAAW,GAAG,YAAY,SAAS,IAAI;AACrC,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,GAAG;AAAA,MACb,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,MAAI,GAAG,WAAW,CAAC,UAAU,KAAK,GAAG,OAAO,GAAG;AAC7C,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,GAAG;AAAA,MACb,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,QAAM,eAAe,IAAI,IAAI,GAAG,UAAU,UAAU,UAAU,QAAQ,CAAC,CAAC;AAExE,aAAW,OAAO,YAAY;AAC5B,UAAM,QAAQ,IAAI,OAAO,MAAM,GAAG,OAAO,GAAG;AAC5C,QAAI,MAAM,KAAK,MAAM,UAAU,KAAK,CAAC,aAAa,IAAI,GAAG,GAAG;AAC1D,YAAM,aAAa,MAAM,WAAW,KAAK,CAAC,OAAO,MAAM,KAAK,GAAG,OAAO,CAAC;AACvE,UAAI,YAAY;AACd,iBAAS,KAAK;AAAA,UACZ,UAAU;AAAA,UACV,UAAU;AAAA,UACV,OAAO,sBAAsB,GAAG;AAAA,UAChC,aAAa,eAAe,GAAG;AAAA,UAC/B,cAAc;AAAA,UACd,KAAK,QAAQ,GAAG;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,IAAI,IAAI,GAAG,UAAU,UAAU,UAAU,OAAO,CAAC,CAAC;AACtE,QAAM,QAAQ;AACd,MAAI;AAEJ,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,UAAM,SAAS,MAAM,CAAC;AACtB,QAAI,CAAC,YAAY,IAAI,MAAM,KAAK,OAAO,SAAS,GAAG;AACjD,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,uBAAuB,MAAM;AAAA,QACpC,aAAa,oCAAoC,MAAM;AAAA,QACvD,UAAU,MAAM,CAAC;AAAA,QACjB,cAAc;AAAA,QACd,KAAK,QAAQ,MAAM;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AChGA,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AAEhB,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,WAAsB,CAAC;AAC7B,QAAM,OAAO;AAEb,MAAI;AACJ,QAAM,QAAQ,IAAI,OAAO,oBAAoB,QAAQ,oBAAoB,KAAK;AAE9E,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,UAAM,SAAS,MAAM,WAAW,MAAM,GAAG,MAAM,KAAK;AACpD,UAAM,aAAa,OAAO,MAAM,IAAI,EAAE;AAEtC,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,MAAM,CAAC;AAAA,MACjB;AAAA,MACA,cAAc;AAAA,MACd,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AAEA,QAAM,QAAQ,IAAI,OAAO,eAAe,QAAQ,eAAe,KAAK;AACpE,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,QAAI,MAAM,CAAC,GAAG;AACZ,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,kCAAkC,MAAM,CAAC,CAAC;AAAA,QACvD,UAAU,MAAM,CAAC;AAAA,QACjB,cAAc;AAAA,QACd,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AC5CA,SAAS,gBAAgB;AAIzB,IAAM,oBAAoB;AAEnB,SAAS,iBAAiB,WAA8B;AAC7D,MAAI,CAAC,UAAW,QAAO,CAAC;AAExB,QAAM,WAAsB,CAAC;AAC7B,QAAM,aAAa,UAAU,YAAY,EAAE,KAAK;AAEhD,aAAW,WAAW,gBAAgB;AACpC,QAAI,eAAe,QAAS;AAE5B,UAAM,IAAI,SAAS,YAAY,OAAO;AACtC,QAAI,IAAI,KAAK,KAAK,mBAAmB;AACnC,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,0BAA0B,OAAO;AAAA,QACxC,aAAa,eAAe,SAAS,QAAQ,CAAC,qCAAqC,OAAO;AAAA,QAC1F,UAAU,IAAI,SAAS,aAAQ,OAAO,gBAAgB,CAAC;AAAA,QACvD,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,WAAW;AAAA,IACf,EAAE,IAAI,SAAS,MAAM,gBAAgB;AAAA,IACrC,EAAE,IAAI,aAAa,MAAM,sBAAsB;AAAA,EACjD;AAEA,aAAW,KAAK,UAAU;AACxB,QAAI,EAAE,GAAG,KAAK,UAAU,KAAK,CAAC,eAAe,SAAS,UAAU,GAAG;AACjE,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,8BAA8B,EAAE,IAAI;AAAA,QAC3C,aAAa,eAAe,SAAS,SAAS,EAAE,IAAI;AAAA,QACpD,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AC5CA,IAAM,mBAAmB;AAAA,EACvB,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEO,SAAS,mBAAmB,UAA6B;AAC9D,MAAI,QAAQ;AACZ,aAAW,KAAK,UAAU;AACxB,aAAS,iBAAiB,EAAE,QAAQ,KAAK,EAAE,cAAc;AAAA,EAC3D;AACA,SAAO,KAAK,MAAM,KAAK,IAAI,OAAO,GAAG,CAAC;AACxC;AAEO,SAAS,aAAa,OAA0B;AACrD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAEO,SAAS,cAAc,UAAoC;AAChE,QAAM,SAAwB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AACxE,aAAW,KAAK,UAAU;AACxB,WAAO,EAAE,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;;;AC/BA,SAAS,kBAAkB;AAG3B,IAAM,cAAc;AACpB,IAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAS,YAAY,SAAyB;AAC5C,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC1D;AAEO,SAAS,UAAU,SAAyC;AACjE,QAAM,MAAM,YAAY,OAAO;AAC/B,QAAM,SAAS,MAAM,IAAI,GAAG;AAC5B,MAAI,QAAQ;AAEV,UAAM,OAAO,GAAG;AAChB,UAAM,IAAI,KAAK,MAAM;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,UAAU,SAAiB,QAA0B;AACnE,QAAM,MAAM,YAAY,OAAO;AAC/B,MAAI,MAAM,IAAI,GAAG,GAAG;AAClB,UAAM,OAAO,GAAG;AAAA,EAClB,WAAW,MAAM,QAAQ,aAAa;AAEpC,UAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,QAAM,IAAI,KAAK,MAAM;AACvB;;;ACbA,eAAsB,UACpB,SACA,UAAuB,CAAC,GACH;AACrB,MAAI,CAAC,QAAQ,WAAW;AACtB,UAAM,SAAS,UAAU,OAAO;AAChC,QAAI,QAAQ;AACV,aAAO,EAAE,GAAG,QAAQ,QAAQ,KAAK;AAAA,IACnC;AAAA,EACF;AAEA,QAAM,QAAQ,WAAW,OAAO;AAChC,QAAM,cAAyB,CAAC;AAEhC,cAAY,KAAK,GAAG,kBAAkB,KAAK,CAAC;AAC5C,cAAY,KAAK,GAAG,iBAAiB,KAAK,CAAC;AAE3C,MAAI,QAAQ,YAAY,QAAQ,kBAAkB;AAChD,UAAM,mBAAmB,MAAM,QAAQ,iBAAiB,OAAO;AAC/D,gBAAY,KAAK,GAAG,gBAAgB;AAAA,EACtC;AAEA,cAAY,KAAK,GAAG,kBAAkB,KAAK,CAAC;AAE5C,MAAI,MAAM,YAAY,MAAM;AAC1B,gBAAY,KAAK,GAAG,iBAAiB,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9D;AAGA,QAAM,mBAAmB,QAAQ,gBAAgB,SAC7C,YAAY;AAAA,IACV,CAAC,MAAM,CAAC,QAAQ,eAAgB,KAAK,CAAC,OAAO,EAAE,UAAU,MAAM,EAAE,aAAa,EAAE;AAAA,EAClF,IACA;AAEJ,QAAM,YAAY,mBAAmB,gBAAgB;AACrD,QAAM,YAAY,aAAa,SAAS;AACxC,QAAM,gBAAgB,cAAc,gBAAgB;AAEpD,QAAM,iBACJ,aAAa,KAAK,UAAU,aAAa,KAAK,SAAS;AAEzD,QAAM,SAAqB;AAAA,IACzB,WAAW,MAAM,YAAY,QAAQ,QAAQ,aAAa;AAAA,IAC1D,cAAc,MAAM,YAAY;AAAA,IAChC,aAAa;AAAA,IACb,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,WAAW;AACtB,cAAU,SAAS,MAAM;AAAA,EAC3B;AAEA,SAAO;AACT;;;AC7EA,OAAO,WAAW;AAGlB,IAAM,kBAA2D;AAAA,EAC/D,UAAU,MAAM,MAAM,MAAM;AAAA,EAC5B,MAAM,MAAM,IAAI;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,KAAK,MAAM;AACb;AAEA,IAAM,eAAsD;AAAA,EAC1D,GAAG,MAAM,MAAM;AAAA,EACf,GAAG,MAAM;AAAA,EACT,GAAG,MAAM,OAAO;AAAA,EAChB,GAAG,MAAM,UAAU;AAAA,EACnB,GAAG,MAAM,MAAM,MAAM;AACvB;AAEO,SAAS,gBAAgB,QAA0B;AACxD,UAAQ,IAAI;AACZ,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI,MAAM,KAAK,uBAAuB,CAAC;AAC/C,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI;AAEZ,UAAQ,IAAI,cAAc,MAAM,KAAK,OAAO,SAAS,CAAC,EAAE;AACxD,MAAI,OAAO,cAAc;AACvB,YAAQ,IAAI,cAAc,OAAO,YAAY,EAAE;AAAA,EACjD;AACA,UAAQ,IAAI;AAGZ,QAAM,aAAa,aAAa,OAAO,SAAS,KAAK,MAAM;AAC3D,UAAQ;AAAA,IACN,iBAAiB,WAAW,GAAG,KAAK,MAAM,OAAO,SAAS,CAAC,MAAM,CAAC,YAAY,WAAW,OAAO,SAAS,CAAC;AAAA,EAC5G;AACA,UAAQ,IAAI;AAGZ,QAAM,KAAK,OAAO;AAClB,UAAQ,IAAI,aAAa;AACzB,MAAI,GAAG;AACL,YAAQ;AAAA,MACN,OAAO,gBAAgB,SAAS,YAAY,CAAC,IAAI,GAAG,QAAQ;AAAA,IAC9D;AACF,MAAI,GAAG;AACL,YAAQ,IAAI,OAAO,gBAAgB,KAAK,MAAM,CAAC,QAAQ,GAAG,IAAI,EAAE;AAClE,MAAI,GAAG;AACL,YAAQ,IAAI,OAAO,gBAAgB,OAAO,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE;AACtE,MAAI,GAAG,IAAK,SAAQ,IAAI,OAAO,gBAAgB,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE;AAC1E,MAAI,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,CAAC,GAAG,UAAU,CAAC,GAAG,KAAK;AACrD,YAAQ,IAAI,OAAO,MAAM,MAAM,uCAAkC,CAAC,EAAE;AAAA,EACtE;AACA,UAAQ,IAAI;AAGZ,MAAI,OAAO,SAAS,SAAS,GAAG;AAC9B,YAAQ,IAAI,MAAM,KAAK,YAAY,CAAC;AACpC,YAAQ,IAAI;AACZ,eAAW,KAAK,OAAO,UAAU;AAC/B,YAAM,QAAQ,gBAAgB,EAAE,QAAQ;AACxC,YAAM,UAAU,EAAE,cAAc,OAAO,IAAI,KAAK,MAAM,EAAE,aAAa,GAAG,CAAC,MAAM;AAC/E,cAAQ,IAAI,KAAK,MAAM,IAAI,EAAE,SAAS,YAAY,CAAC,GAAG,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;AAC9E,cAAQ,IAAI,OAAO,MAAM,IAAI,EAAE,WAAW,CAAC,EAAE;AAC7C,UAAI,EAAE,UAAU;AACd,gBAAQ,IAAI,iBAAiB,MAAM,OAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,MACzD;AACA,UAAI,EAAE,YAAY;AAChB,gBAAQ,IAAI,aAAa,EAAE,UAAU,EAAE;AAAA,MACzC;AACA,UAAI,EAAE,KAAK;AACT,gBAAQ,IAAI,YAAY,MAAM,MAAM,EAAE,GAAG,CAAC,EAAE;AAAA,MAC9C;AACA,cAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAGA,QAAM,YAAmD;AAAA,IACvD,OAAO,MAAM,MAAM,MAAM;AAAA,IACzB,MAAM,MAAM,SAAS,MAAM;AAAA,IAC3B,SAAS,MAAM,QAAQ,MAAM;AAAA,EAC/B;AACA,QAAM,MAAM,OAAO,kBAAkB;AACrC,UAAQ;AAAA,IACN,sBAAsB,UAAU,GAAG,KAAK,MAAM,OAAO,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC;AAAA,EAChF;AACA,UAAQ,IAAI;AACZ,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI;AACd;;;ACxFO,SAAS,gBAAgB,QAA0B;AACxD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;;;ACFA,IAAM,oBAA8C;AAAA,EAClD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEA,IAAM,oBAA8C;AAAA,EAClD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEO,SAAS,iBAAiB,QAA0B;AACzD,QAAM,QAAQ,oBAAI,IAA8C;AAEhE,aAAW,KAAK,OAAO,UAAU;AAC/B,UAAM,SAAS,EAAE,WAAW,MAAM,EAAE,MAAM,YAAY,EAAE,QAAQ,eAAe,GAAG;AAClF,QAAI,CAAC,MAAM,IAAI,MAAM,GAAG;AACtB,YAAM,IAAI,QAAQ,EAAE,IAAI,QAAQ,SAAS,EAAE,CAAC;AAAA,IAC9C;AAAA,EACF;AAEA,QAAM,QAAQ;AAAA,IACZ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,MAAM;AAAA,MACJ;AAAA,QACE,MAAM;AAAA,UACJ,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,gBAAgB;AAAA,YAChB,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,cACrC,IAAI,EAAE;AAAA,cACN,kBAAkB,EAAE,MAAM,EAAE,QAAQ,MAAM;AAAA,cAC1C,iBAAiB,EAAE,MAAM,EAAE,QAAQ,YAAY;AAAA,cAC/C,sBAAsB;AAAA,gBACpB,OAAO,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,cAC7C;AAAA,cACA,YAAY;AAAA,gBACV,mBAAmB,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,cACzD;AAAA,YACF,EAAE;AAAA,UACJ;AAAA,QACF;AAAA,QACA,SAAS,OAAO,SAAS,IAAI,CAAC,MAAM;AAClC,gBAAM,SAAS,EAAE,WAAW,MAAM,EAAE,MAAM,YAAY,EAAE,QAAQ,eAAe,GAAG;AAClF,iBAAO;AAAA,YACL;AAAA,YACA,OAAO,kBAAkB,EAAE,QAAQ;AAAA,YACnC,SAAS;AAAA,cACP,MAAM,EAAE,eAAe,EAAE,WAAW,cAAc,EAAE,QAAQ,KAAK;AAAA,cACjE,GAAI,EAAE,MAAM,EAAE,UAAU,GAAG,EAAE,WAAW;AAAA;AAAA,WAAgB,EAAE,GAAG,GAAG,IAAI,CAAC;AAAA,YACvE;AAAA,YACA,WAAW;AAAA,cACT;AAAA,gBACE,kBAAkB;AAAA,kBAChB,kBAAkB,EAAE,KAAK,WAAW;AAAA,kBACpC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;AAAA,gBACzC;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAC5C;;;ACxEA,SAAS,cAAc,eAAe,WAAW,kBAAkB;AACnE,SAAS,YAAY;AACrB,SAAS,SAAS,UAAU,eAAe;AAC3C,SAAS,YAAY,cAAAC,mBAAkB;AAGvC,IAAM,aAAa,KAAK,QAAQ,GAAG,UAAU;AAC7C,IAAM,cAAc,KAAK,YAAY,aAAa;AAClD,IAAM,qBAAqB;AAO3B,SAAS,cAAc,MAAsB;AAC3C,SAAOA,YAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACpE;AAIA,SAAS,oBAAyD;AAChE,MAAI,QAAQ,IAAI,MAAM,QAAQ,IAAI,eAAgB,QAAO;AACzD,MAAI,QAAQ,IAAI,gBAAgB,iBAAiB,QAAQ,IAAI,aAAa,eAAe;AACvF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,iBAAyB;AAChC,MAAI;AACF,UAAM,MAAM,KAAK;AAAA,MACf,aAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,OAAO;AAAA,IACnE;AACA,WAAO,IAAI,WAAW;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,aAAqB;AAC5B,MAAI;AACF,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO,KAAK,MAAM,aAAa,aAAa,OAAO,CAAC;AAAA,IACtD;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,CAAC;AACV;AAEA,SAAS,WAAW,QAAsB;AACxC,MAAI;AACF,cAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACzC,kBAAc,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,EAC5D,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,qBAA8B;AAC5C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,OAAO,QAAQ,MAAO,QAAO;AACzC,MAAI,QAAQ,OAAO,QAAQ,KAAM,QAAO;AACxC,QAAM,SAAS,WAAW;AAC1B,SAAO,OAAO,cAAc;AAC9B;AAEO,SAAS,aAAa,SAAwB;AACnD,QAAM,SAAS,WAAW;AAC1B,SAAO,YAAY,UAAU,OAAO;AACpC,aAAW,MAAM;AACnB;AAEO,SAAS,eAAwB;AACtC,QAAM,SAAS,WAAW;AAC1B,SAAO,OAAO,cAAc;AAC9B;AAEA,SAAS,cAAsB;AAC7B,QAAM,SAAS,WAAW;AAC1B,MAAI,CAAC,OAAO,UAAU;AACpB,WAAO,WAAW,WAAW;AAC7B,eAAW,MAAM;AAAA,EACnB;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,qBAA6B;AACpC,QAAM,SAAS,WAAW;AAC1B,SAAO,aAAa,OAAO,aAAa,KAAK;AAC7C,aAAW,MAAM;AACjB,SAAO,OAAO;AAChB;AAEO,SAAS,eAAuB;AACrC,SAAO,WAAW,EAAE,aAAa;AACnC;AAEO,SAAS,cAAc,QAAmC;AAC/D,MAAI,CAAC,mBAAmB,EAAG,QAAO,QAAQ,QAAQ;AAElD,QAAM,YAAY,mBAAmB;AAErC,QAAM,UAAU;AAAA,IACd,OAAO;AAAA,IACP,UAAU,YAAY;AAAA,IACtB;AAAA,IACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC3B,IAAI,SAAS;AAAA,IACb,WAAW,QAAQ;AAAA,IACnB,YAAY,eAAe;AAAA,IAC3B,aAAa,kBAAkB;AAAA,IAC/B,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,IAClB,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO,UAAU;AAAA,EAC3B;AAEA,SAAO,KAAK,OAAO;AACrB;AAcO,SAAS,mBAAmB,SAAsC;AACvE,MAAI,CAAC,mBAAmB,EAAG,QAAO,QAAQ,QAAQ;AAElD,QAAM,UAAU;AAAA,IACd,OAAO;AAAA,IACP,UAAU,YAAY;AAAA,IACtB,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC3B,IAAI,SAAS;AAAA,IACb,WAAW,QAAQ;AAAA,IACnB,YAAY,eAAe;AAAA,IAC3B,aAAa,kBAAkB;AAAA,IAC/B,eAAe,QAAQ;AAAA,IACvB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ;AAAA,EACtB;AAEA,SAAO,KAAK,OAAO;AACrB;AAEA,SAAS,KAAK,SAAiC;AAC7C,SAAO,MAAM,oBAAoB;AAAA,IAC/B,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,IAC5B,QAAQ,YAAY,QAAQ,GAAI;AAAA,EAClC,CAAC,EACE,KAAK,MAAM;AAAA,EAAC,CAAC,EACb,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;;;AC5KA,SAAS,gBAAAC,eAAc,aAAa,gBAAgB;AACpD,SAAS,UAAU,QAAAC,aAAY;AAE/B,IAAM,2BAA2B,MAAM;AACvC,IAAM,sBAAsB,oBAAI,IAAI,CAAC,OAAO,SAAS,CAAC;AAOtD,SAAS,aAAa,OAAuB;AAC3C,SAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEA,SAAS,aAAa,SAAiB,cAA+B;AAGpE,QAAM,QAAQ,oBAAI,IAAI,CAAC,SAAS,YAAY,GAAG,YAAY,CAAC;AAC5D,SAAO,CAAC,GAAG,KAAK,EAAE;AAAA,IAAK,CAAC,SACtB,IAAI,OAAO,MAAM,aAAa,IAAI,CAAC,KAAK,EAAE,KAAK,OAAO;AAAA,EACxD;AACF;AAEA,SAAS,eAAe,UAAmC;AACzD,QAAM,aAA8B,CAAC;AAErC,MAAI;AACJ,MAAI;AACF,cAAU,YAAY,UAAU,EAAE,eAAe,KAAK,CAAC;AAAA,EACzD,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,OAAO,GAAG;AAClB,UAAI,MAAM,SAAS,YAAY;AAC7B,mBAAW,KAAK;AAAA,UACd,cAAcA,MAAK,UAAU,MAAM,IAAI;AAAA,UACvC,cAAc,MAAM;AAAA,QACtB,CAAC;AAAA,MACH;AACA;AAAA,IACF;AAEA,QAAI,CAAC,MAAM,YAAY,KAAK,CAAC,oBAAoB,IAAI,MAAM,IAAI,GAAG;AAChE;AAAA,IACF;AAEA,QAAI;AACF,iBAAW,SAAS,YAAYA,MAAK,UAAU,MAAM,IAAI,GAAG;AAAA,QAC1D,eAAe;AAAA,MACjB,CAAC,GAAG;AACF,YAAI,MAAM,OAAO,GAAG;AAClB,qBAAW,KAAK;AAAA,YACd,cAAcA,MAAK,UAAU,MAAM,MAAM,MAAM,IAAI;AAAA,YACnD,cAAc,GAAG,MAAM,IAAI,IAAI,MAAM,IAAI;AAAA,UAC3C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO,WAAW;AAAA,IAAK,CAAC,GAAG,MACzB,EAAE,aAAa,cAAc,EAAE,YAAY;AAAA,EAC7C;AACF;AAMO,SAAS,cAAc,UAAkB,SAAyB;AACvE,MAAI,YAAY;AAEhB,aAAW,aAAa,eAAe,QAAQ,GAAG;AAChD,QAAI,CAAC,aAAa,SAAS,UAAU,YAAY,GAAG;AAClD;AAAA,IACF;AAEA,QAAI;AACF,YAAM,OAAO,SAAS,UAAU,YAAY;AAC5C,UAAI,KAAK,OAAO,0BAA0B;AACxC;AAAA,MACF;AAEA,YAAM,WAAWD,cAAa,UAAU,YAAY;AACpD,UAAI,SAAS,SAAS,CAAC,GAAG;AACxB;AAAA,MACF;AAEA,YAAM,YAAY,UAAU,SAAS,IAAI,IAAI,OAAO;AACpD,mBAAa,GAAG,SAAS,gCAAgC,UAAU,YAAY;AAAA,EAAK,SAAS,SAAS,OAAO,CAAC;AAAA,IAChH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;;;AdnFA,IAAM,eAAe;AAErB,eAAe,iBAAiB,MAA+B;AAC7D,MAAI,CAAC,aAAa,KAAK,IAAI,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR,uBAAuB,IAAI;AAAA,IAC7B;AAAA,EACF;AAEA,QAAM,UAAU,mBAAmB,IAAI;AAIvC,QAAM,UAAiD;AAAA,IACrD,EAAE,KAAK,oCAAoC,OAAO,IAAI,MAAM,KAAK;AAAA,IACjE,EAAE,KAAK,oCAAoC,OAAO,QAAQ,MAAM,MAAM;AAAA,IACtE;AAAA,MACE,KAAK,0DAA0D,OAAO;AAAA,MACtE,MAAM;AAAA,IACR;AAAA,EACF;AAEA,aAAW,EAAE,KAAK,KAAK,KAAK,SAAS;AACnC,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,GAAK,EAAE,CAAC;AACnE,UAAI,CAAC,IAAI,GAAI;AAEb,UAAI,CAAC,KAAM,QAAO,MAAM,IAAI,KAAK;AAEjC,YAAM,OAAQ,MAAM,IAAI,KAAK;AAG7B,YAAM,UAAU,MAAM,OAAO;AAC7B,UAAI,OAAO,YAAY,YAAY,QAAQ,SAAS,KAAK,GAAG;AAC1D,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,0BAA0B,IAAI;AAAA,EAChC;AACF;AAEA,eAAsB,YACpB,QACA,SACe;AACf,MAAI;AACJ,MAAI;AAEJ,MAAI,QAAQ,QAAQ;AAClB,QAAI;AACF,cAAQ,OAAO,MAAM,aAAa,MAAM;AAAA,CAAqB;AAC7D,gBAAU,MAAM,iBAAiB,MAAM;AACvC,qBAAe;AAAA,IACjB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,eAAe,QAAQ,IAAI,UAAU;AAAA,MACvC;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,UAAM,YAAY,QAAQ,MAAM;AAChC,QAAI,YAAY;AAChB,QAAI;AAEJ,QACEE,YAAW,SAAS,KACpBC,UAAS,SAAS,EAAE,YAAY,KAChCD,YAAWE,MAAK,WAAW,UAAU,CAAC,GACtC;AACA,iBAAW;AACX,kBAAYA,MAAK,WAAW,UAAU;AAAA,IACxC;AAEA,QAAI,CAACF,YAAW,SAAS,KAAKC,UAAS,SAAS,EAAE,YAAY,GAAG;AAC/D,cAAQ,MAAM,kCAAkC,SAAS,EAAE;AAC3D,cAAQ,MAAM,oEAAoE,MAAM,YAAY;AACpG,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,UAAUE,cAAa,WAAW,OAAO;AAC/C,cAAU,WAAW,cAAc,UAAU,OAAO,IAAI;AACxD,mBAAeC,UAAS,QAAQ,SAAS,CAAC;AAAA,EAC5C;AAGA,QAAM,UAAUF,MAAK,QAAQ,IAAI,GAAG,aAAa;AACjD,MAAIF,YAAW,OAAO,GAAG;AACvB,UAAM,aAAaG,cAAa,SAAS,OAAO,EAC7C,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,WAAW,GAAG,CAAC;AAGxC,UAAM,UAAU,QAAQ,MAAM,6BAA6B;AAC3D,QAAI,SAAS;AACX,YAAM,SAAS,QAAQ,CAAC,EAAE,YAAY;AACtC,iBAAW,OAAO,YAAY;AAC5B,cAAM,cAAc,OAAO,YAAY;AACvC,YACE,YAAY,SAAS,GAAG,KACxB,OAAO,SAAS,SAAS,GAAG,EAAE,KAC9B,OAAO,SAAS,WAAW,GAAG,EAAE,KAChC,OAAO,SAAS,SAAS,GAAG,EAAE,GAC9B;AACA,kBAAQ;AAAA,YACNE,OAAM,MAAM,MAAM,KAAK,UAAU,IACjCA,OAAM,IAAI,kCAAkC,GAAG,EAAE;AAAA,UACnD;AACA,kBAAQ,MAAMA,OAAM,IAAI,aAAa,OAAO,EAAE,CAAC;AAC/C,kBAAQ,KAAK,CAAC;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAaH,MAAK,QAAQ,IAAI,GAAG,gBAAgB;AACvD,QAAM,iBAA2B,CAAC;AAClC,MAAIF,YAAW,UAAU,GAAG;AAC1B,UAAM,QAAQG,cAAa,YAAY,OAAO,EAAE,MAAM,IAAI;AAC1D,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,WAAW,CAAC,QAAQ,WAAW,GAAG,GAAG;AACvC,uBAAe,KAAK,OAAO;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,UAAU,SAAS;AAAA,IACtC,UAAU,QAAQ,YAAY;AAAA,IAC9B,gBAAgB,eAAe,SAAS,iBAAiB;AAAA,IACzD,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,QAAQ,OAAO;AAClB,QAAI,QAAQ,WAAW,SAAS;AAC9B,uBAAiB,MAAM;AAAA,IACzB,WAAW,QAAQ,WAAW,QAAQ;AACpC,sBAAgB,MAAM;AAAA,IACxB,OAAO;AACL,sBAAgB,MAAM;AAAA,IACxB;AAAA,EACF;AAGA,QAAM,gBAAgB,CAAC,QAAQ,SAAS,QAAQ,WAAW,UAAU,QAAQ,WAAW;AACxF,MAAI,eAAe;AACjB,QAAI,CAAC,aAAa,KAAK,CAAC,mBAAmB,KAAK,QAAQ,MAAM,OAAO;AACnE,YAAM,WAAW,MAAM,OAAO,UAAe;AAC7C,YAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AACpF,YAAM,SAAS,MAAM,IAAI,QAAgB,CAACG,aAAY;AACpD,WAAG;AAAA,UACDD,OAAM,IAAI,gEAA2D;AAAA,UACrE,CAAC,MAAM;AAAE,eAAG,MAAM;AAAG,YAAAC,SAAQ,EAAE,KAAK,EAAE,YAAY,CAAC;AAAA,UAAG;AAAA,QACxD;AAAA,MACF,CAAC;AACD,mBAAa,WAAW,OAAO,WAAW,KAAK;AAAA,IACjD;AAAA,EAEF;AAGA,QAAM,cAAc,MAAM;AAG1B,MAAI,iBAAiB,aAAa,IAAI,MAAM,GAAG;AAC7C,YAAQ;AAAA,MACND,OAAM,IAAI,IAAI,IACdA,OAAM,KAAK,2CAAsC,IACjDA,OAAM,UAAU,KAAK,2BAA2B;AAAA,IAClD;AACA,YAAQ,IAAI;AAAA,EACd;AAEA,QAAM,SAAS,QAAQ,WAAW,QAAQ,QAAQ,SAAS;AAC3D,MAAI,QAAQ;AACV,UAAM,gBAAgB,CAAC,OAAO,UAAU,QAAQ,UAAU;AAC1D,UAAM,YAAY,cAAc,QAAQ,MAAM;AAC9C,UAAM,aAAa,OAAO,SAAS;AAAA,MACjC,CAAC,MAAM,cAAc,QAAQ,EAAE,QAAQ,KAAK;AAAA,IAC9C;AACA,QAAI,YAAY;AACd,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AACF;;;AehNA,SAAS,eAAAE,cAAa,cAAAC,aAAY,gBAAAC,qBAAoB;AACtD,SAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAC/B,SAAS,WAAAC,gBAAe;AAIxB,OAAOC,YAAW;AAElB,IAAM,qBAAqB;AAAA,EACzBC,MAAKC,SAAQ,GAAG,aAAa,QAAQ;AAAA,EACrCD,MAAKC,SAAQ,GAAG,aAAa,aAAa,QAAQ;AACpD;AAEA,eAAsB,aAAa,UAA4B,CAAC,GAAkB;AAChF,QAAM,aAAa,QAAQ,MAAM,CAAC,QAAQ,GAAG,IAAI;AACjD,UAAQ,IAAIF,OAAM,KAAK,wDAAmD,CAAC;AAE3E,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI,eAAe;AACnB,MAAI,eAAe;AACnB,QAAM,SAAiC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE;AAEtE,aAAW,OAAO,YAAY;AAC5B,QAAI,CAACG,YAAW,GAAG,GAAG;AACpB,UAAI,QAAQ,KAAK;AACf,gBAAQ,MAAMH,OAAM,OAAO,iCAAiC,GAAG;AAAA,CAAI,CAAC;AACpE,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA;AAAA,IACF;AAGA,UAAM,kBAAkBC,MAAK,KAAK,UAAU;AAC5C,QAAIE,YAAW,eAAe,GAAG;AAC/B,YAAM,UAAUC,cAAa,iBAAiB,OAAO;AACrD,YAAM,SAAS,MAAM,UAAU,SAAS,EAAE,WAAWC,UAAS,GAAG,EAAE,CAAC;AACpE;AACA,sBAAgB,OAAO,SAAS;AAChC,aAAO,OAAO,SAAS,KAAK,OAAO,OAAO,SAAS,KAAK,KAAK;AAC7D,sBAAgB,MAAM;AACtB;AAAA,IACF;AAEA,UAAM,UAAUC,aAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AACxD,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,YAAYL,MAAK,KAAK,MAAM,MAAM,UAAU;AAClD,UAAI,CAACE,YAAW,SAAS,EAAG;AAE5B,YAAM,UAAUC,cAAa,WAAW,OAAO;AAC/C,YAAM,SAAS,MAAM,UAAU,SAAS,EAAE,WAAW,MAAM,KAAK,CAAC;AACjE;AACA,sBAAgB,OAAO,SAAS;AAChC,aAAO,OAAO,SAAS,KAAK,OAAO,OAAO,SAAS,KAAK,KAAK;AAE7D,sBAAgB,MAAM;AAAA,IACxB;AAAA,EACF;AAEA,QAAM,cAAqD;AAAA,IACzD,GAAGJ,OAAM,MAAM;AAAA,IACf,GAAGA,OAAM;AAAA,IACT,GAAGA,OAAM,OAAO;AAAA,IAChB,GAAGA,OAAM,UAAU;AAAA,IACnB,GAAGA,OAAM,MAAM,MAAM;AAAA,EACvB;AACA,QAAM,eAAgB,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,EAC3C,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAC9C,KAAK,IAAI;AAEZ,UAAQ;AAAA,IACNA,OAAM;AAAA,MACJ;AAAA,kBAAqB,YAAY,oBAAoB,YAAY;AAAA,IACnE;AAAA,EACF;AACA,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,aAAa,YAAY,EAAE;AAAA,EACzC;AACA,QAAM,UAAU,OAAO,IAAI,OAAO;AAClC,MAAI,UAAU,GAAG;AACf,YAAQ;AAAA,MACNA,OAAM,IAAI,KAAK,OAAO,SAAS,UAAU,IAAI,MAAM,EAAE,yCAAoC;AAAA,IAC3F;AAAA,EACF;AACA,UAAQ,IAAI;AAGZ,QAAM,mBAAmB;AAAA,IACvB,eAAe;AAAA,IACf,eAAe;AAAA,IACf;AAAA,IACA,YAAY,KAAK,IAAI,IAAI;AAAA,EAC3B,CAAC;AACH;;;AC9FA,SAAS,gBAAAO,eAAc,cAAAC,aAAY,aAAa;AAChD,SAAS,QAAAC,OAAM,WAAAC,UAAS,YAAAC,iBAAgB;AACxC,SAAS,WAAAC,gBAAe;AACxB,OAAOC,YAAW;AAIlB,IAAMC,sBAAqB;AAAA,EACzBC,MAAKC,SAAQ,GAAG,aAAa,QAAQ;AAAA,EACrCD,MAAKC,SAAQ,GAAG,aAAa,aAAa,QAAQ;AACpD;AAEA,eAAsB,aAAa,SAGjB;AAChB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,QAAQ,MAAM,CAAC,QAAQ,GAAG,IAAIF;AACjD,UAAQ;AAAA,IACNG,OAAM;AAAA,MACJ;AAAA,gEAA8D,SAAS;AAAA;AAAA,IACzE;AAAA,EACF;AAEA,QAAM,YAAsB,CAAC;AAC7B,aAAW,OAAO,YAAY;AAC5B,QAAIC,YAAW,GAAG,GAAG;AACnB,gBAAU,KAAK,GAAG;AAAA,IACpB;AAAA,EACF;AAEA,MAAI,UAAU,WAAW,GAAG;AAC1B,YAAQ;AAAA,MACND,OAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA,YAAQ,IAAIA,OAAM,IAAI,uBAAuB,CAAC;AAC9C,eAAW,OAAO,YAAY;AAC5B,cAAQ,IAAIA,OAAM,IAAI,KAAK,GAAG,EAAE,CAAC;AAAA,IACnC;AACA,YAAQ,IAAI;AACZ,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,IAAIA,OAAM,IAAI,WAAW,CAAC;AAClC,aAAW,OAAO,WAAW;AAC3B,YAAQ,IAAIA,OAAM,IAAI,KAAK,GAAG,EAAE,CAAC;AAAA,EACnC;AACA,UAAQ,IAAI;AAEZ,aAAW,OAAO,WAAW;AAC3B,UAAM,UAAU,MAAM,KAAK,EAAE,WAAW,KAAK,GAAG,OAAO,OAAO,aAAa;AACzE,UAAI,CAAC,UAAU,SAAS,UAAU,EAAG;AAErC,YAAM,YAAYF,MAAK,KAAK,QAAQ;AACpC,UAAI,CAACG,YAAW,SAAS,EAAG;AAE5B,cAAQ,IAAID,OAAM,IAAI;AAAA,mBAAsB,QAAQ,EAAE,CAAC;AAEvD,UAAI;AACF,cAAM,UAAUE,cAAa,WAAW,OAAO;AAC/C,cAAM,SAAS,MAAM,UAAU,SAAS;AAAA,UACtC,WAAWC,UAASC,SAAQ,SAAS,CAAC;AAAA,QACxC,CAAC;AAED,YAAI,OAAO,QAAQ;AACjB,kBAAQ,IAAIJ,OAAM,IAAI,UAAU,CAAC;AAAA,QACnC;AACA,wBAAgB,MAAM;AAEtB,YAAI,OAAO,YAAY,WAAW;AAChC,kBAAQ;AAAA,YACNA,OAAM,MAAM,MAAM;AAAA,cAChB,8BAAyB,OAAO,SAAS,sBAAsB,SAAS;AAAA,YAC1E;AAAA,UACF;AACA,kBAAQ;AAAA,YACNA,OAAM;AAAA,cACJ,yDAAyD,SAAS;AAAA;AAAA,YACpE;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAMA,OAAM,IAAI,kBAAkB,QAAQ,GAAG,GAAG,GAAG;AAAA,MAC7D;AAAA,IACF,CAAC;AAED,YAAQ,GAAG,UAAU,MAAM;AACzB,cAAQ,MAAM;AACd,cAAQ,IAAIA,OAAM,IAAI,kBAAkB,CAAC;AACzC,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,UAAQ,IAAIA,OAAM,IAAI,kCAAkC,CAAC;AACzD,QAAM,IAAI,QAAQ,MAAM;AAAA,EAAC,CAAC;AAC5B;;;ACjGA,SAAS,gBAAAK,eAAc,cAAAC,aAAY,YAAAC,iBAAgB;AACnD,SAAS,WAAAC,UAAS,QAAAC,OAAM,WAAAC,UAAS,YAAAC,iBAAgB;AACjD,OAAOC,YAAW;AAIlB,IAAMC,gBAA0C;AAAA,EAC9C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAEA,IAAM,eAA0C;AAAA,EAC9C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAEA,eAAsB,aACpB,QACA,SACe;AACf,QAAM,YAAYC,SAAQ,MAAM;AAChC,MAAI,YAAY;AAEhB,MACEC,YAAW,SAAS,KACpB,CAAC,UAAU,SAAS,KAAK,KACzBA,YAAWC,MAAK,WAAW,UAAU,CAAC,GACtC;AACA,gBAAYA,MAAK,WAAW,UAAU;AAAA,EACxC;AAEA,MAAI,CAACD,YAAW,SAAS,KAAKE,UAAS,SAAS,EAAE,YAAY,GAAG;AAC/D,YAAQ,MAAM,kCAAkC,SAAS,EAAE;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,UAAUC,cAAa,WAAW,OAAO;AAC/C,QAAM,SAAS,MAAM,UAAU,SAAS;AAAA,IACtC,WAAWC,UAASC,SAAQ,SAAS,CAAC;AAAA,EACxC,CAAC;AAED,QAAM,QAAQ,aAAa,OAAO,SAAS;AAC3C,QAAM,QAAQP,cAAa,OAAO,SAAS;AAC3C,QAAM,WAAW,wCAAwC,OAAO,SAAS,MAAM,KAAK,IAAI,KAAK;AAC7F,QAAM,UAAU;AAEhB,MAAI,QAAQ,UAAU;AACpB,YAAQ,IAAI,cAAc,OAAO,SAAS,KAAK,QAAQ,MAAM,OAAO,GAAG;AAAA,EACzE,OAAO;AACL,YAAQ,IAAI;AACZ,YAAQ,IAAIQ,OAAM,KAAK,uBAAuB,CAAC;AAC/C,YAAQ,IAAI;AACZ,YAAQ,IAAI,aAAaA,OAAM,KAAK,OAAO,SAAS,CAAC,EAAE;AACvD,YAAQ,IAAI,aAAa,OAAO,SAAS,KAAK,KAAK,GAAG;AACtD,YAAQ,IAAI,aAAa,OAAO,SAAS,MAAM;AAC/C,YAAQ,IAAI;AACZ,YAAQ,IAAIA,OAAM,IAAI,+BAA+B,CAAC;AACtD,YAAQ,IAAI;AACZ,YAAQ,IAAI,gBAAgB,OAAO,SAAS,KAAK,QAAQ,MAAM,OAAO,GAAG;AACzE,YAAQ,IAAI;AACZ,YAAQ,IAAIA,OAAM,IAAI,SAAS,CAAC;AAChC,YAAQ,IAAI;AACZ,YAAQ,IAAI,cAAc,OAAO,eAAe,QAAQ,kBAAkB,OAAO,SAAS,QAAQ;AAClG,YAAQ,IAAI;AAAA,EACd;AACF;;;AlBzDA,SAAS,QAAQ,KAAmB;AAClC,QAAM,QACJ,QAAQ,aAAa,UACjB,SAAS,OAAO,CAAC,MAAM,SAAS,IAAI,GAAG,CAAC,IACxC,QAAQ,aAAa,WACnB,SAAS,QAAQ,CAAC,GAAG,CAAC,IACtB,SAAS,YAAY,CAAC,GAAG,CAAC;AAGlC,QAAM,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAC5B;AAEA,SAAS,qBAA6B;AACpC,MAAI;AACF,UAAM,OAAOC,SAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,UAAM,MAAM,KAAK,MAAMC,cAAaC,MAAK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;AAC9E,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,SAAS,EACd,YAAY,oDAAoD,EAChE,QAAQ,mBAAmB,CAAC;AAE/B,QACG,QAAQ,MAAM,EACd,YAAY,mCAAmC,EAC/C,SAAS,YAAY,uCAAuC,EAC5D,OAAO,qBAAqB,2CAA2C,UAAU,EACjF,OAAO,wBAAwB,8CAA8C,EAC7E,OAAO,cAAc,0DAA0D,EAC/E,OAAO,YAAY,wDAAwD,EAC3E,OAAO,eAAe,sDAAsD,EAC5E,OAAO,eAAe,yCAAyC,EAC/D,OAAO,OAAO,QAAQ,SAAS;AAC9B,MAAI,KAAK,WAAW;AAClB,UAAM,MAAM;AACZ,YAAQ,IAAI,WAAW,GAAG,MAAM;AAChC,YAAQ,GAAG;AAAA,EACb;AACA,QAAM,YAAY,QAAQ;AAAA,IACxB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,EACd,CAAC;AACH,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,oCAAoC,EAChD,OAAO,gBAAgB,iCAAiC,EACxD,OAAO,OAAO,SAAS;AACtB,QAAM,aAAa,EAAE,KAAK,KAAK,IAAI,CAAC;AACtC,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,qDAAgD,EAC5D,OAAO,uBAAuB,qCAAqC,IAAI,EACvE,OAAO,gBAAgB,kCAAkC,EACzD,OAAO,OAAO,SAAS;AACtB,QAAM,aAAa,EAAE,WAAW,SAAS,KAAK,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC;AAC3E,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,6CAA6C,EACzD,SAAS,YAAY,uCAAuC,EAC5D,OAAO,QAAQ,kCAAkC,EACjD,OAAO,OAAO,QAAQ,SAAS;AAC9B,QAAM,aAAa,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC;AAClD,CAAC;AAEH,QACG,QAAQ,UAAU,EAClB,YAAY,gDAAgD,EAC5D,OAAO,YAAY;AAClB,QAAM,MAAM;AACZ,UAAQ,IAAI,WAAW,GAAG,MAAM;AAChC,UAAQ,GAAG;AACb,CAAC;AAEH,QAAQ,MAAM;","names":["readFileSync","dirname","join","readFileSync","existsSync","statSync","join","basename","chalk","re","createHash","readFileSync","join","existsSync","statSync","join","readFileSync","basename","chalk","resolve","readdirSync","existsSync","readFileSync","join","basename","homedir","chalk","join","homedir","existsSync","readFileSync","basename","readdirSync","readFileSync","existsSync","join","dirname","basename","homedir","chalk","DEFAULT_SKILL_DIRS","join","homedir","chalk","existsSync","readFileSync","basename","dirname","readFileSync","existsSync","statSync","resolve","join","dirname","basename","chalk","GRADE_COLORS","resolve","existsSync","join","statSync","readFileSync","basename","dirname","chalk","dirname","readFileSync","join"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawvet",
-  "version": "0.7.5",
+  "version": "0.8.1",
   "description": "Skill vetting & supply chain security for OpenClaw. Scans SKILL.md files for prompt injection, credential theft, RCE, typosquatting, and social engineering.",
   "type": "module",
   "bin": {