cngkit 1.1.5 → 1.1.7

package/dist/commands/scrub.js

@@ -1,20 +1,269 @@
-import {
-  runScrubCommand
-} from "../chunk-UXMP5Z5P.js";
-import "../chunk-TZRXQ6GR.js";
 import {
   GlobalOptionsSchema,
   OptionalPathArgsSchema
-} from "../chunk-YY2VGJ5N.js";
+} from "../chunk-MLKBG5YJ.js";
 import {
   CommandRunner
-} from "../chunk-SNTLRTQ2.js";
-import "../chunk-SSRUN6G5.js";
+} from "../chunk-Z4DDLEWR.js";
+import "../chunk-XDXRVTPK.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/commands/scrub.tsx
 import { option } from "pastel";
 import { z } from "zod";
+
+// src/features/scrub/run-scrub-command.ts
+import process from "process";
+
+// src/features/scrub/masker.ts
+import fs from "fs/promises";
+import path from "path";
+async function scrubFindingsInline(targetPath, findings) {
+  const target = await resolveScrubTarget(targetPath);
+  const findingsByFile = groupFindingsBySafePath(target, findings);
+  let filesChanged = 0;
+  let replacements = 0;
+  for (const [absolutePath, fileFindings] of findingsByFile.safeFindingsByPath) {
+    const originalContent = await fs.readFile(absolutePath, "utf8");
+    let scrubbedContent = originalContent;
+    let fileReplacements = 0;
+    for (const finding of fileFindings) {
+      const placeholder = formatSecretPlaceholder(finding);
+      const nextContent = scrubbedContent.split(finding.rawSecret).join(placeholder);
+      if (nextContent !== scrubbedContent) {
+        fileReplacements += countOccurrences(scrubbedContent, finding.rawSecret);
+        scrubbedContent = nextContent;
+      }
+    }
+    if (scrubbedContent !== originalContent) {
+      await fs.writeFile(absolutePath, scrubbedContent);
+      filesChanged += 1;
+      replacements += fileReplacements;
+    }
+  }
+  return {
+    filesChanged,
+    replacements,
+    skippedFindings: findingsByFile.skippedFindings
+  };
+}
+function formatSecretPlaceholder(finding) {
+  return `[CNGKIT_SECRET:${sanitizePlaceholderPart(finding.detectorName)}:${finding.verified ? "verified" : "unverified"}]`;
+}
+function groupFindingsBySafePath(target, findings) {
+  const safeFindingsByPath = /* @__PURE__ */ new Map();
+  let skippedFindings = 0;
+  for (const finding of findings) {
+    const absolutePath = resolveSafeFindingPath(target, finding.filePath);
+    if (!absolutePath) {
+      skippedFindings += 1;
+      continue;
+    }
+    const fileFindings = safeFindingsByPath.get(absolutePath) ?? [];
+    fileFindings.push(finding);
+    safeFindingsByPath.set(absolutePath, fileFindings);
+  }
+  return { safeFindingsByPath, skippedFindings };
+}
+async function resolveScrubTarget(targetPath) {
+  const absoluteTargetPath = path.resolve(targetPath);
+  const stat = await fs.stat(absoluteTargetPath);
+  if (stat.isFile()) {
+    return {
+      rootDir: path.dirname(absoluteTargetPath),
+      allowedFilePath: absoluteTargetPath
+    };
+  }
+  return {
+    rootDir: absoluteTargetPath
+  };
+}
+function resolveSafeFindingPath(target, findingFilePath) {
+  const absolutePath = path.isAbsolute(findingFilePath) ? path.resolve(findingFilePath) : path.resolve(target.rootDir, findingFilePath);
+  if (target.allowedFilePath) {
+    return absolutePath === target.allowedFilePath ? absolutePath : void 0;
+  }
+  const normalizedRoot = `${path.resolve(target.rootDir)}${path.sep}`;
+  if (absolutePath === path.resolve(target.rootDir) || absolutePath.startsWith(normalizedRoot)) {
+    return absolutePath;
+  }
+  return void 0;
+}
+function countOccurrences(value, search) {
+  if (!search) {
+    return 0;
+  }
+  return value.split(search).length - 1;
+}
+function sanitizePlaceholderPart(value) {
+  return value.replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "Unknown";
+}
+
+// src/features/scrub/trufflehog.ts
+import { spawn } from "child_process";
+import path2 from "path";
+
+// src/features/scrub/findings.ts
+function parseTruffleHogJsonLines(output) {
+  const findings = [];
+  for (const line of output.split(/\r?\n/)) {
+    const trimmedLine = line.trim();
+    if (!trimmedLine.startsWith("{")) {
+      continue;
+    }
+    const parsedLine = parseJsonRecord(trimmedLine);
+    if (!parsedLine) {
+      continue;
+    }
+    const finding = parseTruffleHogFinding(parsedLine);
+    if (finding) {
+      findings.push(finding);
+    }
+  }
+  return findings;
+}
+function parseTruffleHogFinding(finding) {
+  const rawSecret = readString(finding.Raw) || readString(finding.RawV2);
+  const filePath = readFilesystemFilePath(finding);
+  if (!rawSecret || !filePath) {
+    return void 0;
+  }
+  return {
+    detectorName: readString(finding.DetectorName) || "Unknown",
+    filePath,
+    line: readFilesystemLine(finding),
+    rawSecret,
+    redactedSecret: readString(finding.Redacted) || "",
+    verified: finding.Verified === true
+  };
+}
+function readFilesystemFilePath(finding) {
+  const filesystem = readFilesystemMetadata(finding);
+  if (!filesystem) {
+    return void 0;
+  }
+  return readString(filesystem.file) || readString(filesystem.path);
+}
+function readFilesystemLine(finding) {
+  const filesystem = readFilesystemMetadata(finding);
+  if (!filesystem) {
+    return void 0;
+  }
+  return typeof filesystem.line === "number" ? filesystem.line : void 0;
+}
+function readFilesystemMetadata(finding) {
+  const sourceMetadata = readRecord(finding.SourceMetadata);
+  const data = readRecord(sourceMetadata?.Data);
+  return readRecord(data?.Filesystem);
+}
+function parseJsonRecord(line) {
+  try {
+    return readRecord(JSON.parse(line));
+  } catch {
+    return void 0;
+  }
+}
+function isJsonRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function readRecord(value) {
+  return isJsonRecord(value) ? value : void 0;
+}
+function readString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+
+// src/features/scrub/trufflehog.ts
+async function scanFilesystemWithTruffleHog(targetPath, options2) {
+  const absoluteTargetPath = path2.resolve(options2.cwd, targetPath);
+  const { stdout } = await runTruffleHog([
+    "filesystem",
+    absoluteTargetPath,
+    "--json",
+    "--no-update",
+    "--force-skip-binaries",
+    "--force-skip-archives"
+  ]);
+  return parseTruffleHogJsonLines(stdout);
+}
+function runTruffleHog(args2) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("trufflehog", args2, {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    child.stdout.on("data", (chunk) => {
+      stdoutChunks.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderrChunks.push(chunk);
+    });
+    child.on("error", (error) => {
+      if (error.code === "ENOENT") {
+        reject(
+          new Error(
+            "TruffleHog is not installed. Install it with `brew install trufflehog` or see https://github.com/trufflesecurity/trufflehog."
+          )
+        );
+        return;
+      }
+      reject(error);
+    });
+    child.on("close", (exitCode) => {
+      const stdout = Buffer.concat(stdoutChunks).toString("utf8");
+      const stderr = Buffer.concat(stderrChunks).toString("utf8");
+      if (exitCode && exitCode !== 0) {
+        reject(new Error(`TruffleHog scan failed with exit code ${exitCode}: ${stderr.trim()}`));
+        return;
+      }
+      resolve({ stdout, stderr });
+    });
+  });
+}
+
+// src/features/scrub/run-scrub-command.ts
+async function runScrubCommand(targetPath, options2, output, dependencies) {
+  const scrubTargetPath = targetPath ?? ".";
+  const scanFilesystem = dependencies?.scanFilesystem ?? ((scanTargetPath) => scanFilesystemWithTruffleHog(scanTargetPath, {
+    cwd: process.cwd()
+  }));
+  const findings = await scanFilesystem(scrubTargetPath);
+  if (findings.length === 0) {
+    output.info("No secrets found.");
+    return;
+  }
+  output.info(formatScrubReport(findings));
+  if (!options2.yes) {
+    if (options2.mask) {
+      throw new Error("Inline scrubbing rewrites files. Re-run with --yes to continue.");
+    }
+    output.info("Report only. Re-run with --yes to scrub files inline.");
+    return;
+  }
+  const result = await scrubFindingsInline(scrubTargetPath, findings);
+  output.info(
+    `Masked ${result.replacements} secret${result.replacements === 1 ? "" : "s"} in ${result.filesChanged} file${result.filesChanged === 1 ? "" : "s"}.`
+  );
+  if (result.skippedFindings > 0) {
+    output.info(`Skipped ${result.skippedFindings} finding(s) outside the scrub root.`);
+  }
+}
+function formatScrubReport(findings) {
+  const lines = [`Found ${findings.length} possible secret${findings.length === 1 ? "" : "s"}:`];
+  for (const finding of findings) {
+    const location = finding.line ? `${finding.filePath}:${finding.line}` : finding.filePath;
+    const status = finding.verified ? "verified" : "unverified";
+    lines.push(`- ${location} ${finding.detectorName} ${status}`);
+  }
+  return lines.join("\n");
+}
+
+// src/commands/scrub.tsx
 import { jsx } from "react/jsx-runtime";
 var description = "Scan for secrets with TruffleHog and optionally mask them inline";
 var args = OptionalPathArgsSchema;

package/dist/commands/scrub.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/commands/scrub.tsx"],"sourcesContent":["import { option } from \"pastel\";\nimport { z } from \"zod\";\n\nimport { GlobalOptionsSchema, OptionalPathArgsSchema } from \"../cli-options.js\";\nimport { runScrubCommand, type ScrubCommandOptions } from \"../command-actions.js\";\nimport { CommandRunner } from \"../ink/command-runner.js\";\n\nexport const description = \"Scan for secrets with TruffleHog and optionally mask them inline\";\nexport const args = OptionalPathArgsSchema;\nexport const options = GlobalOptionsSchema.extend({\n  mask: z\n    .boolean()\n    .optional()\n    .describe(\n      option({\n        description: \"Compatibility alias for inline scrubbing; --yes is still required\",\n      })\n    ),\n  yes: z\n    .boolean()\n    .optional()\n    .describe(\n      option({\n        description: \"Confirm and run inline scrubbing\",\n      })\n    ),\n});\n\ntype ScrubCommandProps = {\n  readonly args: z.infer<typeof args>;\n  readonly options: ScrubCommandOptions;\n};\n\nexport default function ScrubCommand({ args, options }: ScrubCommandProps) {\n  return <CommandRunner run={(output) => runScrubCommand(args[0], options, output)} />;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,cAAc;AACvB,SAAS,SAAS;AAiCT;AA3BF,IAAM,cAAc;AACpB,IAAM,OAAO;AACb,IAAM,UAAU,oBAAoB,OAAO;AAAA,EAChD,MAAM,EACH,QAAQ,EACR,SAAS,EACT;AAAA,IACC,OAAO;AAAA,MACL,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EACF,KAAK,EACF,QAAQ,EACR,SAAS,EACT;AAAA,IACC,OAAO;AAAA,MACL,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACJ,CAAC;AAOc,SAAR,aAA8B,EAAE,MAAAA,OAAM,SAAAC,SAAQ,GAAsB;AACzE,SAAO,oBAAC,iBAAc,KAAK,CAAC,WAAW,gBAAgBD,MAAK,CAAC,GAAGC,UAAS,MAAM,GAAG;AACpF;","names":["args","options"]}
+{"version":3,"sources":["../../src/commands/scrub.tsx","../../src/features/scrub/run-scrub-command.ts","../../src/features/scrub/masker.ts","../../src/features/scrub/trufflehog.ts","../../src/features/scrub/findings.ts"],"sourcesContent":["import { option } from \"pastel\";\nimport { z } from \"zod\";\n\nimport { GlobalOptionsSchema, OptionalPathArgsSchema } from \"../cli/options.js\";\nimport { runScrubCommand, type ScrubCommandOptions } from \"../features/scrub/run-scrub-command.js\";\nimport { CommandRunner } from \"../cli/command-runner.js\";\n\nexport const description = \"Scan for secrets with TruffleHog and optionally mask them inline\";\nexport const args = OptionalPathArgsSchema;\nexport const options = GlobalOptionsSchema.extend({\n  mask: z\n    .boolean()\n    .optional()\n    .describe(\n      option({\n        description: \"Compatibility alias for inline scrubbing; --yes is still required\",\n      })\n    ),\n  yes: z\n    .boolean()\n    .optional()\n    .describe(\n      option({\n        description: \"Confirm and run inline scrubbing\",\n      })\n    ),\n});\n\ntype ScrubCommandProps = {\n  readonly args: z.infer<typeof args>;\n  readonly options: ScrubCommandOptions;\n};\n\nexport default function ScrubCommand({ args, options }: ScrubCommandProps) {\n  return <CommandRunner run={(output) => runScrubCommand(args[0], options, output)} />;\n}\n","import process from \"node:process\";\n\nimport type { GlobalCommandOptions } from \"../../shared/config.js\";\nimport type { CommandOutput } from \"../../shared/output.js\";\nimport type { ScrubFinding } from \"./findings.js\";\nimport { scrubFindingsInline } from \"./masker.js\";\nimport { scanFilesystemWithTruffleHog } from \"./trufflehog.js\";\n\nexport type ScrubCommandOptions = GlobalCommandOptions & {\n  mask?: boolean;\n  yes?: boolean;\n};\n\nexport type ScrubCommandDependencies = {\n  scanFilesystem(targetPath: string): Promise<ScrubFinding[]>;\n};\n\nexport async function runScrubCommand(\n  targetPath: string | undefined,\n  options: ScrubCommandOptions,\n  output: CommandOutput,\n  dependencies?: ScrubCommandDependencies\n): Promise<void> {\n  const scrubTargetPath = targetPath ?? \".\";\n  const scanFilesystem =\n    dependencies?.scanFilesystem ??\n    ((scanTargetPath: string) =>\n      scanFilesystemWithTruffleHog(scanTargetPath, {\n        cwd: process.cwd(),\n      }));\n  const findings = await scanFilesystem(scrubTargetPath);\n\n  if (findings.length === 0) {\n    output.info(\"No secrets found.\");\n    return;\n  }\n\n  output.info(formatScrubReport(findings));\n\n  if (!options.yes) {\n    if (options.mask) {\n      throw new Error(\"Inline scrubbing rewrites files. Re-run with --yes to continue.\");\n    }\n\n    output.info(\"Report only. Re-run with --yes to scrub files inline.\");\n    return;\n  }\n\n  const result = await scrubFindingsInline(scrubTargetPath, findings);\n  output.info(\n    `Masked ${result.replacements} secret${result.replacements === 1 ? \"\" : \"s\"} in ${\n      result.filesChanged\n    } file${result.filesChanged === 1 ? \"\" : \"s\"}.`\n  );\n\n  if (result.skippedFindings > 0) {\n    output.info(`Skipped ${result.skippedFindings} finding(s) outside the scrub root.`);\n  }\n}\n\nfunction formatScrubReport(findings: ScrubFinding[]): string {\n  const lines = [`Found ${findings.length} possible secret${findings.length === 1 ? \"\" : \"s\"}:`];\n\n  for (const finding of findings) {\n    const location = finding.line ? `${finding.filePath}:${finding.line}` : finding.filePath;\n    const status = finding.verified ? \"verified\" : \"unverified\";\n    lines.push(`- ${location} ${finding.detectorName} ${status}`);\n  }\n\n  return lines.join(\"\\n\");\n}\n","import fs from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport type { ScrubFinding } from \"./findings.js\";\n\nexport type InlineScrubResult = {\n  filesChanged: number;\n  replacements: number;\n  skippedFindings: number;\n};\n\nexport async function scrubFindingsInline(\n  targetPath: string,\n  findings: ScrubFinding[]\n): Promise<InlineScrubResult> {\n  const target = await resolveScrubTarget(targetPath);\n  const findingsByFile = groupFindingsBySafePath(target, findings);\n  let filesChanged = 0;\n  let replacements = 0;\n\n  for (const [absolutePath, fileFindings] of findingsByFile.safeFindingsByPath) {\n    const originalContent = await fs.readFile(absolutePath, \"utf8\");\n    let scrubbedContent = originalContent;\n    let fileReplacements = 0;\n\n    for (const finding of fileFindings) {\n      const placeholder = formatSecretPlaceholder(finding);\n      const nextContent = scrubbedContent.split(finding.rawSecret).join(placeholder);\n      if (nextContent !== scrubbedContent) {\n        fileReplacements += countOccurrences(scrubbedContent, finding.rawSecret);\n        scrubbedContent = nextContent;\n      }\n    }\n\n    if (scrubbedContent !== originalContent) {\n      await fs.writeFile(absolutePath, scrubbedContent);\n      filesChanged += 1;\n      replacements += fileReplacements;\n    }\n  }\n\n  return {\n    filesChanged,\n    replacements,\n    skippedFindings: findingsByFile.skippedFindings,\n  };\n}\n\nexport function formatSecretPlaceholder(finding: ScrubFinding): string {\n  return `[CNGKIT_SECRET:${sanitizePlaceholderPart(finding.detectorName)}:${\n    finding.verified ? \"verified\" : \"unverified\"\n  }]`;\n}\n\nfunction groupFindingsBySafePath(\n  target: ScrubTarget,\n  findings: ScrubFinding[]\n): {\n  safeFindingsByPath: Map<string, ScrubFinding[]>;\n  skippedFindings: number;\n} {\n  const safeFindingsByPath = new Map<string, ScrubFinding[]>();\n  let skippedFindings = 0;\n\n  for (const finding of findings) {\n    const absolutePath = resolveSafeFindingPath(target, finding.filePath);\n    if (!absolutePath) {\n      skippedFindings += 1;\n      continue;\n    }\n\n    const fileFindings = safeFindingsByPath.get(absolutePath) ?? [];\n    fileFindings.push(finding);\n    safeFindingsByPath.set(absolutePath, fileFindings);\n  }\n\n  return { safeFindingsByPath, skippedFindings };\n}\n\ntype ScrubTarget = {\n  rootDir: string;\n  allowedFilePath?: string;\n};\n\nasync function resolveScrubTarget(targetPath: string): Promise<ScrubTarget> {\n  const absoluteTargetPath = path.resolve(targetPath);\n  const stat = await fs.stat(absoluteTargetPath);\n\n  if (stat.isFile()) {\n    return {\n      rootDir: path.dirname(absoluteTargetPath),\n      allowedFilePath: absoluteTargetPath,\n    };\n  }\n\n  return {\n    rootDir: absoluteTargetPath,\n  };\n}\n\nfunction resolveSafeFindingPath(\n  target: ScrubTarget,\n  findingFilePath: string\n): string | undefined {\n  const absolutePath = path.isAbsolute(findingFilePath)\n    ? path.resolve(findingFilePath)\n    : path.resolve(target.rootDir, findingFilePath);\n\n  if (target.allowedFilePath) {\n    return absolutePath === target.allowedFilePath ? absolutePath : undefined;\n  }\n\n  const normalizedRoot = `${path.resolve(target.rootDir)}${path.sep}`;\n\n  if (absolutePath === path.resolve(target.rootDir) || absolutePath.startsWith(normalizedRoot)) {\n    return absolutePath;\n  }\n\n  return undefined;\n}\n\nfunction countOccurrences(value: string, search: string): number {\n  if (!search) {\n    return 0;\n  }\n\n  return value.split(search).length - 1;\n}\n\nfunction sanitizePlaceholderPart(value: string): string {\n  return value.replace(/[^A-Za-z0-9_-]+/g, \"-\").replace(/^-+|-+$/g, \"\") || \"Unknown\";\n}\n","import { spawn } from \"node:child_process\";\nimport path from \"node:path\";\n\nimport { parseTruffleHogJsonLines, type ScrubFinding } from \"./findings.js\";\n\nexport type TruffleHogScanOptions = {\n  cwd: string;\n};\n\nexport async function scanFilesystemWithTruffleHog(\n  targetPath: string,\n  options: TruffleHogScanOptions\n): Promise<ScrubFinding[]> {\n  const absoluteTargetPath = path.resolve(options.cwd, targetPath);\n  const { stdout } = await runTruffleHog([\n    \"filesystem\",\n    absoluteTargetPath,\n    \"--json\",\n    \"--no-update\",\n    \"--force-skip-binaries\",\n    \"--force-skip-archives\",\n  ]);\n\n  return parseTruffleHogJsonLines(stdout);\n}\n\nfunction runTruffleHog(args: string[]): Promise<{ stdout: string; stderr: string }> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(\"trufflehog\", args, {\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    });\n    const stdoutChunks: Buffer[] = [];\n    const stderrChunks: Buffer[] = [];\n\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      stdoutChunks.push(chunk);\n    });\n    child.stderr.on(\"data\", (chunk: Buffer) => {\n      stderrChunks.push(chunk);\n    });\n    child.on(\"error\", (error: NodeJS.ErrnoException) => {\n      if (error.code === \"ENOENT\") {\n        reject(\n          new Error(\n            \"TruffleHog is not installed. Install it with `brew install trufflehog` or see https://github.com/trufflesecurity/trufflehog.\"\n          )\n        );\n        return;\n      }\n\n      reject(error);\n    });\n    child.on(\"close\", (exitCode) => {\n      const stdout = Buffer.concat(stdoutChunks).toString(\"utf8\");\n      const stderr = Buffer.concat(stderrChunks).toString(\"utf8\");\n\n      if (exitCode && exitCode !== 0) {\n        reject(new Error(`TruffleHog scan failed with exit code ${exitCode}: ${stderr.trim()}`));\n        return;\n      }\n\n      resolve({ stdout, stderr });\n    });\n  });\n}\n","export type ScrubFinding = {\n  detectorName: string;\n  filePath: string;\n  line?: number;\n  rawSecret: string;\n  redactedSecret: string;\n  verified: boolean;\n};\n\ntype JsonRecord = Record<string, unknown>;\n\nexport function parseTruffleHogJsonLines(output: string): ScrubFinding[] {\n  const findings: ScrubFinding[] = [];\n\n  for (const line of output.split(/\\r?\\n/)) {\n    const trimmedLine = line.trim();\n    if (!trimmedLine.startsWith(\"{\")) {\n      continue;\n    }\n\n    const parsedLine = parseJsonRecord(trimmedLine);\n    if (!parsedLine) {\n      continue;\n    }\n\n    const finding = parseTruffleHogFinding(parsedLine);\n    if (finding) {\n      findings.push(finding);\n    }\n  }\n\n  return findings;\n}\n\nfunction parseTruffleHogFinding(finding: JsonRecord): ScrubFinding | undefined {\n  const rawSecret = readString(finding.Raw) || readString(finding.RawV2);\n  const filePath = readFilesystemFilePath(finding);\n\n  if (!rawSecret || !filePath) {\n    return undefined;\n  }\n\n  return {\n    detectorName: readString(finding.DetectorName) || \"Unknown\",\n    filePath,\n    line: readFilesystemLine(finding),\n    rawSecret,\n    redactedSecret: readString(finding.Redacted) || \"\",\n    verified: finding.Verified === true,\n  };\n}\n\nfunction readFilesystemFilePath(finding: JsonRecord): string | undefined {\n  const filesystem = readFilesystemMetadata(finding);\n  if (!filesystem) {\n    return undefined;\n  }\n\n  return readString(filesystem.file) || readString(filesystem.path);\n}\n\nfunction readFilesystemLine(finding: JsonRecord): number | undefined {\n  const filesystem = readFilesystemMetadata(finding);\n  if (!filesystem) {\n    return undefined;\n  }\n\n  return typeof filesystem.line === \"number\" ? filesystem.line : undefined;\n}\n\nfunction readFilesystemMetadata(finding: JsonRecord): JsonRecord | undefined {\n  const sourceMetadata = readRecord(finding.SourceMetadata);\n  const data = readRecord(sourceMetadata?.Data);\n  return readRecord(data?.Filesystem);\n}\n\nfunction parseJsonRecord(line: string): JsonRecord | undefined {\n  try {\n    return readRecord(JSON.parse(line));\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isJsonRecord(value: unknown): value is JsonRecord {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction readRecord(value: unknown): JsonRecord | undefined {\n  return isJsonRecord(value) ? value : undefined;\n}\n\nfunction readString(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,cAAc;AACvB,SAAS,SAAS;;;ACDlB,OAAO,aAAa;;;ACApB,OAAO,QAAQ;AACf,OAAO,UAAU;AAUjB,eAAsB,oBACpB,YACA,UAC4B;AAC5B,QAAM,SAAS,MAAM,mBAAmB,UAAU;AAClD,QAAM,iBAAiB,wBAAwB,QAAQ,QAAQ;AAC/D,MAAI,eAAe;AACnB,MAAI,eAAe;AAEnB,aAAW,CAAC,cAAc,YAAY,KAAK,eAAe,oBAAoB;AAC5E,UAAM,kBAAkB,MAAM,GAAG,SAAS,cAAc,MAAM;AAC9D,QAAI,kBAAkB;AACtB,QAAI,mBAAmB;AAEvB,eAAW,WAAW,cAAc;AAClC,YAAM,cAAc,wBAAwB,OAAO;AACnD,YAAM,cAAc,gBAAgB,MAAM,QAAQ,SAAS,EAAE,KAAK,WAAW;AAC7E,UAAI,gBAAgB,iBAAiB;AACnC,4BAAoB,iBAAiB,iBAAiB,QAAQ,SAAS;AACvE,0BAAkB;AAAA,MACpB;AAAA,IACF;AAEA,QAAI,oBAAoB,iBAAiB;AACvC,YAAM,GAAG,UAAU,cAAc,eAAe;AAChD,sBAAgB;AAChB,sBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,iBAAiB,eAAe;AAAA,EAClC;AACF;AAEO,SAAS,wBAAwB,SAA+B;AACrE,SAAO,kBAAkB,wBAAwB,QAAQ,YAAY,CAAC,IACpE,QAAQ,WAAW,aAAa,YAClC;AACF;AAEA,SAAS,wBACP,QACA,UAIA;AACA,QAAM,qBAAqB,oBAAI,IAA4B;AAC3D,MAAI,kBAAkB;AAEtB,aAAW,WAAW,UAAU;AAC9B,UAAM,eAAe,uBAAuB,QAAQ,QAAQ,QAAQ;AACpE,QAAI,CAAC,cAAc;AACjB,yBAAmB;AACnB;AAAA,IACF;AAEA,UAAM,eAAe,mBAAmB,IAAI,YAAY,KAAK,CAAC;AAC9D,iBAAa,KAAK,OAAO;AACzB,uBAAmB,IAAI,cAAc,YAAY;AAAA,EACnD;AAEA,SAAO,EAAE,oBAAoB,gBAAgB;AAC/C;AAOA,eAAe,mBAAmB,YAA0C;AAC1E,QAAM,qBAAqB,KAAK,QAAQ,UAAU;AAClD,QAAM,OAAO,MAAM,GAAG,KAAK,kBAAkB;AAE7C,MAAI,KAAK,OAAO,GAAG;AACjB,WAAO;AAAA,MACL,SAAS,KAAK,QAAQ,kBAAkB;AAAA,MACxC,iBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,EACX;AACF;AAEA,SAAS,uBACP,QACA,iBACoB;AACpB,QAAM,eAAe,KAAK,WAAW,eAAe,IAChD,KAAK,QAAQ,eAAe,IAC5B,KAAK,QAAQ,OAAO,SAAS,eAAe;AAEhD,MAAI,OAAO,iBAAiB;AAC1B,WAAO,iBAAiB,OAAO,kBAAkB,eAAe;AAAA,EAClE;AAEA,QAAM,iBAAiB,GAAG,KAAK,QAAQ,OAAO,OAAO,CAAC,GAAG,KAAK,GAAG;AAEjE,MAAI,iBAAiB,KAAK,QAAQ,OAAO,OAAO,KAAK,aAAa,WAAW,cAAc,GAAG;AAC5F,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAe,QAAwB;AAC/D,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,MAAM,MAAM,EAAE,SAAS;AACtC;AAEA,SAAS,wBAAwB,OAAuB;AACtD,SAAO,MAAM,QAAQ,oBAAoB,GAAG,EAAE,QAAQ,YAAY,EAAE,KAAK;AAC3E;;;ACnIA,SAAS,aAAa;AACtB,OAAOA,WAAU;;;ACUV,SAAS,yBAAyB,QAAgC;AACvE,QAAM,WAA2B,CAAC;AAElC,aAAW,QAAQ,OAAO,MAAM,OAAO,GAAG;AACxC,UAAM,cAAc,KAAK,KAAK;AAC9B,QAAI,CAAC,YAAY,WAAW,GAAG,GAAG;AAChC;AAAA,IACF;AAEA,UAAM,aAAa,gBAAgB,WAAW;AAC9C,QAAI,CAAC,YAAY;AACf;AAAA,IACF;AAEA,UAAM,UAAU,uBAAuB,UAAU;AACjD,QAAI,SAAS;AACX,eAAS,KAAK,OAAO;AAAA,IACvB;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,uBAAuB,SAA+C;AAC7E,QAAM,YAAY,WAAW,QAAQ,GAAG,KAAK,WAAW,QAAQ,KAAK;AACrE,QAAM,WAAW,uBAAuB,OAAO;AAE/C,MAAI,CAAC,aAAa,CAAC,UAAU;AAC3B,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,cAAc,WAAW,QAAQ,YAAY,KAAK;AAAA,IAClD;AAAA,IACA,MAAM,mBAAmB,OAAO;AAAA,IAChC;AAAA,IACA,gBAAgB,WAAW,QAAQ,QAAQ,KAAK;AAAA,IAChD,UAAU,QAAQ,aAAa;AAAA,EACjC;AACF;AAEA,SAAS,uBAAuB,SAAyC;AACvE,QAAM,aAAa,uBAAuB,OAAO;AACjD,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AAEA,SAAO,WAAW,WAAW,IAAI,KAAK,WAAW,WAAW,IAAI;AAClE;AAEA,SAAS,mBAAmB,SAAyC;AACnE,QAAM,aAAa,uBAAuB,OAAO;AACjD,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO;AACjE;AAEA,SAAS,uBAAuB,SAA6C;AAC3E,QAAM,iBAAiB,WAAW,QAAQ,cAAc;AACxD,QAAM,OAAO,WAAW,gBAAgB,IAAI;AAC5C,SAAO,WAAW,MAAM,UAAU;AACpC;AAEA,SAAS,gBAAgB,MAAsC;AAC7D,MAAI;AACF,WAAO,WAAW,KAAK,MAAM,IAAI,CAAC;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,OAAqC;AACzD,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,WAAW,OAAwC;AAC1D,SAAO,aAAa,KAAK,IAAI,QAAQ;AACvC;AAEA,SAAS,WAAW,OAAoC;AACtD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;;;ADzFA,eAAsB,6BACpB,YACAC,UACyB;AACzB,QAAM,qBAAqBC,MAAK,QAAQD,SAAQ,KAAK,UAAU;AAC/D,QAAM,EAAE,OAAO,IAAI,MAAM,cAAc;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO,yBAAyB,MAAM;AACxC;AAEA,SAAS,cAAcE,OAA6D;AAClF,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,QAAQ,MAAM,cAAcA,OAAM;AAAA,MACtC,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,UAAM,eAAyB,CAAC;AAChC,UAAM,eAAyB,CAAC;AAEhC,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,mBAAa,KAAK,KAAK;AAAA,IACzB,CAAC;AACD,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,mBAAa,KAAK,KAAK;AAAA,IACzB,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,UAAiC;AAClD,UAAI,MAAM,SAAS,UAAU;AAC3B;AAAA,UACE,IAAI;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,aAAa;AAC9B,YAAM,SAAS,OAAO,OAAO,YAAY,EAAE,SAAS,MAAM;AAC1D,YAAM,SAAS,OAAO,OAAO,YAAY,EAAE,SAAS,MAAM;AAE1D,UAAI,YAAY,aAAa,GAAG;AAC9B,eAAO,IAAI,MAAM,yCAAyC,QAAQ,KAAK,OAAO,KAAK,CAAC,EAAE,CAAC;AACvF;AAAA,MACF;AAEA,cAAQ,EAAE,QAAQ,OAAO,CAAC;AAAA,IAC5B,CAAC;AAAA,EACH,CAAC;AACH;;;AF/CA,eAAsB,gBACpB,YACAC,UACA,QACA,cACe;AACf,QAAM,kBAAkB,cAAc;AACtC,QAAM,iBACJ,cAAc,mBACb,CAAC,mBACA,6BAA6B,gBAAgB;AAAA,IAC3C,KAAK,QAAQ,IAAI;AAAA,EACnB,CAAC;AACL,QAAM,WAAW,MAAM,eAAe,eAAe;AAErD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO,KAAK,mBAAmB;AAC/B;AAAA,EACF;AAEA,SAAO,KAAK,kBAAkB,QAAQ,CAAC;AAEvC,MAAI,CAACA,SAAQ,KAAK;AAChB,QAAIA,SAAQ,MAAM;AAChB,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AAEA,WAAO,KAAK,uDAAuD;AACnE;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,oBAAoB,iBAAiB,QAAQ;AAClE,SAAO;AAAA,IACL,UAAU,OAAO,YAAY,UAAU,OAAO,iBAAiB,IAAI,KAAK,GAAG,OACzE,OAAO,YACT,QAAQ,OAAO,iBAAiB,IAAI,KAAK,GAAG;AAAA,EAC9C;AAEA,MAAI,OAAO,kBAAkB,GAAG;AAC9B,WAAO,KAAK,WAAW,OAAO,eAAe,qCAAqC;AAAA,EACpF;AACF;AAEA,SAAS,kBAAkB,UAAkC;AAC3D,QAAM,QAAQ,CAAC,SAAS,SAAS,MAAM,mBAAmB,SAAS,WAAW,IAAI,KAAK,GAAG,GAAG;AAE7F,aAAW,WAAW,UAAU;AAC9B,UAAM,WAAW,QAAQ,OAAO,GAAG,QAAQ,QAAQ,IAAI,QAAQ,IAAI,KAAK,QAAQ;AAChF,UAAM,SAAS,QAAQ,WAAW,aAAa;AAC/C,UAAM,KAAK,KAAK,QAAQ,IAAI,QAAQ,YAAY,IAAI,MAAM,EAAE;AAAA,EAC9D;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;;;ADpCS;AA3BF,IAAM,cAAc;AACpB,IAAM,OAAO;AACb,IAAM,UAAU,oBAAoB,OAAO;AAAA,EAChD,MAAM,EACH,QAAQ,EACR,SAAS,EACT;AAAA,IACC,OAAO;AAAA,MACL,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EACF,KAAK,EACF,QAAQ,EACR,SAAS,EACT;AAAA,IACC,OAAO;AAAA,MACL,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACJ,CAAC;AAOc,SAAR,aAA8B,EAAE,MAAAC,OAAM,SAAAC,SAAQ,GAAsB;AACzE,SAAO,oBAAC,iBAAc,KAAK,CAAC,WAAW,gBAAgBD,MAAK,CAAC,GAAGC,UAAS,MAAM,GAAG;AACpF;","names":["path","options","path","args","options","args","options"]}