ghagga-core 3.0.0 → 3.2.0

package/dist/providers/gateway.js

@@ -9,9 +9,394 @@
  *   Request:  { prompt, system, provider?, model?, project? }
  *   Response: { text, provider, model, tokensUsed }
  *
+ * When `provider` is set, the bridge short-circuits its model-based routing
+ * and selects that provider directly (the model is passed through verbatim).
+ *
  * This provider bypasses the AI SDK entirely — the gateway handles model
  * selection, provider routing, and token management internally.
+ *
+ * ─── SSRF / DNS-rebinding defense (SEC-001) ─────────────────────────────────
+ *
+ * The gateway URL is user-supplied (dashboard provider chain). A naive
+ * `fetch(url)` re-resolves the hostname at connection time, so an attacker who
+ * controls the hostname's DNS can pass a persist-time/validation-time check
+ * (resolving to a public IP) and then rebind the record to loopback, cloud
+ * metadata (169.254.169.254), or an RFC-1918 host before the actual request.
+ *
+ * `pinnedFetch` (below) closes that TOCTOU: it resolves the hostname EXACTLY
+ * ONCE, validates EVERY A/AAAA answer against the forbidden ranges, rejects
+ * mixed public/private answer sets, picks one approved IP, and PINS the socket
+ * to that IP via a custom `lookup` fed to Node's built-in http/https client —
+ * while preserving the original Host header and TLS SNI (servername). Both the
+ * generation path (this file) AND the discovery path (gateway-discovery.ts)
+ * route through the SAME `pinnedFetch`, so they share one pinning policy.
+ *
+ * Node's http/https client never auto-follows redirects, so a 3xx surfaces as a
+ * non-ok response (the old `redirect: 'manual'` posture) and can never chase a
+ * Location header to an unvalidated address.
+ *
+ * Self-hosted escape hatch: `GHAGGA_ALLOW_PRIVATE_GATEWAY=true` skips the
+ * IP-range checks (for gateways that legitimately live on a private network) —
+ * the connection is STILL pinned to the resolved address, and the protocol /
+ * userinfo checks are always enforced.
+ */
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+// ─── SSRF IP-range validation (self-contained) ──────────────────
+//
+// core cannot import the server's safe-url module (wrong dependency
+// direction), so the forbidden-range logic lives here as the single source of
+// truth for the pinned client. It mirrors apps/server/src/lib/safe-url.ts.
+/** Parse a dotted-quad IPv4 string into 4 octets, or null if malformed. */
+function parseIPv4(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return null;
+    const octets = parts.map((p) => Number(p));
+    if (octets.some((o) => !Number.isInteger(o) || o < 0 || o > 255))
+        return null;
+    return octets;
+}
+/** Reason an IPv4 address is in a forbidden range, or null if acceptable. */
+function forbiddenIPv4Reason(ip) {
+    const octets = parseIPv4(ip);
+    if (!octets)
+        return 'malformed IPv4 address';
+    const [a, b] = octets;
+    if (a === 0)
+        return 'unspecified address (0.0.0.0/8)';
+    if (a === 127)
+        return 'loopback address (127.0.0.0/8)';
+    if (a === 10)
+        return 'private address (10.0.0.0/8)';
+    if (a === 172 && b >= 16 && b <= 31)
+        return 'private address (172.16.0.0/12)';
+    if (a === 192 && b === 168)
+        return 'private address (192.168.0.0/16)';
+    if (a === 169 && b === 254)
+        return 'link-local/metadata address (169.254.0.0/16)';
+    // 100.64.0.0/10 — CGNAT (RFC 6598); a real SSRF entry on EKS/GCP internal ranges.
+    if (a === 100 && b >= 64 && b <= 127)
+        return 'CGNAT address (100.64.0.0/10)';
+    // 192.0.0.0/24 — IETF protocol assignments (includes 192.0.0.192).
+    if (a === 192 && b === 0 && octets[2] === 0)
+        return 'IETF protocol assignment (192.0.0.0/24)';
+    // 224.0.0.0/4 — multicast.
+    if (a >= 224 && a <= 239)
+        return 'multicast address (224.0.0.0/4)';
+    // 240.0.0.0/4 — reserved (future use).
+    if (a >= 240)
+        return 'reserved address (240.0.0.0/4)';
+    return null;
+}
+/**
+ * Expand an IPv6 string into 8 hextets. Handles `::` compression and a trailing
+ * embedded dotted IPv4 (e.g. ::ffff:127.0.0.1). Returns null if malformed.
+ */
+function expandIPv6(ip) {
+    let addr = ip.toLowerCase();
+    const zoneIdx = addr.indexOf('%');
+    if (zoneIdx !== -1)
+        addr = addr.slice(0, zoneIdx);
+    const lastColon = addr.lastIndexOf(':');
+    const tail = addr.slice(lastColon + 1);
+    if (tail.includes('.')) {
+        const v4 = parseIPv4(tail);
+        if (!v4)
+            return null;
+        const [a, b, c, d] = v4;
+        const hi = ((a << 8) | b).toString(16);
+        const lo = ((c << 8) | d).toString(16);
+        addr = `${addr.slice(0, lastColon)}:${hi}:${lo}`;
+    }
+    const doubleColonParts = addr.split('::');
+    if (doubleColonParts.length > 2)
+        return null;
+    const toHextets = (s) => {
+        if (s === '')
+            return [];
+        const groups = s.split(':');
+        const nums = [];
+        for (const g of groups) {
+            if (!/^[0-9a-f]{1,4}$/.test(g))
+                return null;
+            nums.push(parseInt(g, 16));
+        }
+        return nums;
+    };
+    if (doubleColonParts.length === 2) {
+        const [headPart, tailPart] = doubleColonParts;
+        const head = toHextets(headPart);
+        const tailHex = toHextets(tailPart);
+        if (!head || !tailHex)
+            return null;
+        const fill = 8 - head.length - tailHex.length;
+        if (fill < 1)
+            return null;
+        return [...head, ...new Array(fill).fill(0), ...tailHex];
+    }
+    const full = toHextets(addr);
+    if (full?.length !== 8)
+        return null;
+    return full;
+}
+/** Reason an IPv6 address is in a forbidden range, or null if acceptable. */
+function forbiddenIPv6Reason(ip) {
+    const hextets = expandIPv6(ip);
+    if (!hextets)
+        return 'malformed IPv6 address';
+    const allZeroExceptLast = hextets.slice(0, 7).every((h) => h === 0);
+    if (allZeroExceptLast && hextets[7] === 0)
+        return 'unspecified address (::)';
+    if (allZeroExceptLast && hextets[7] === 1)
+        return 'loopback address (::1)';
+    const isV4Mapped = hextets.slice(0, 5).every((h) => h === 0) && hextets[5] === 0xffff;
+    if (isV4Mapped) {
+        const [h6, h7] = [hextets[6], hextets[7]];
+        const v4 = `${h6 >> 8}.${h6 & 0xff}.${h7 >> 8}.${h7 & 0xff}`;
+        const reason = forbiddenIPv4Reason(v4);
+        return reason ? `IPv4-mapped ${reason}` : null;
+    }
+    const h0 = hextets[0];
+    if ((h0 & 0xffc0) === 0xfe80)
+        return 'link-local address (fe80::/10)';
+    if ((h0 & 0xfe00) === 0xfc00)
+        return 'private address (fc00::/7)';
+    return null;
+}
+/** Reason an IP literal (v4 or v6) is forbidden, or null if acceptable. */
+function forbiddenIpReason(ip) {
+    const version = isIP(ip);
+    if (version === 4)
+        return forbiddenIPv4Reason(ip);
+    if (version === 6)
+        return forbiddenIPv6Reason(ip);
+    return 'not an IP address';
+}
+function privateGatewayAllowed() {
+    return process.env.GHAGGA_ALLOW_PRIVATE_GATEWAY === 'true';
+}
+const defaultResolveAll = (hostname) => dnsLookup(hostname, { all: true });
+/**
+ * Bounded wait for the DNS resolution phase. `dns/promises.lookup` accepts no
+ * AbortSignal natively, so we race the resolver promise against BOTH the
+ * caller's `signal` (its deadline) and a dedicated DNS timeout. A hanging
+ * resolver therefore rejects promptly instead of stalling a queue worker past
+ * the caller's budget (SEC-001 follow-up). The underlying lookup is not
+ * cancelled — it is simply abandoned — but the operation no longer blocks.
+ */
+const DNS_RESOLUTION_TIMEOUT_MS = 10_000;
+function resolveWithDeadline(work, signal, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(new Error('gateway host DNS resolution aborted'));
+            return;
+        }
+        let settled = false;
+        const cleanup = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+        };
+        const onAbort = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(new Error('gateway host DNS resolution aborted'));
+        };
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(new Error('gateway host DNS resolution timed out'));
+        }, timeoutMs);
+        signal?.addEventListener('abort', onAbort, { once: true });
+        work.then((addresses) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(addresses);
+        }, (err) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(err);
+        });
+    });
+}
+/**
+ * Resolve a user-supplied gateway URL to exactly ONE approved, pinned IP.
+ *
+ * SECURITY: never echoes the hostname/address in thrown messages — the URL IS
+ * the SSRF target. Callers log the category only.
+ *
+ * @throws {Error} with a generic reason if the URL is unusable or forbidden.
+ */
+export async function resolveAndPinHost(rawUrl, resolveAll = defaultResolveAll, opts) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error('gateway URL is not parseable');
+    }
+    // Protocol allowlist — ALWAYS enforced (no escape hatch).
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`gateway URL protocol not allowed: ${url.protocol}`);
+    }
+    // Userinfo (user:pass@host) — ALWAYS rejected (no escape hatch).
+    if (url.username !== '' || url.password !== '') {
+        throw new Error('gateway URL must not contain userinfo');
+    }
+    // URL.hostname wraps IPv6 literals in brackets — strip them for isIP().
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    const isHttps = url.protocol === 'https:';
+    const port = url.port ? parseInt(url.port, 10) : isHttps ? 443 : 80;
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error('gateway URL has an invalid port');
+    }
+    const allowPrivate = privateGatewayAllowed();
+    // IP literal — validate directly and pin to it.
+    const literalVersion = isIP(hostname);
+    if (literalVersion !== 0) {
+        if (!allowPrivate) {
+            const reason = forbiddenIpReason(hostname);
+            if (reason)
+                throw new Error(`gateway URL host is a ${reason}`);
+        }
+        return { url, hostname, ip: hostname, family: literalVersion, port };
+    }
+    // Hostname — resolve ONCE and validate EVERY answer. The resolution phase is
+    // bounded by the caller's signal AND a DNS timeout so a hanging resolver can
+    // never blow past the caller's budget (SEC-001 follow-up).
+    let addresses;
+    try {
+        addresses = await resolveWithDeadline(resolveAll(hostname), opts?.signal, opts?.dnsTimeoutMs ?? DNS_RESOLUTION_TIMEOUT_MS);
+    }
+    catch (err) {
+        // Preserve explicit deadline/abort reasons; collapse everything else to a
+        // generic message (never echo the hostname — it IS the SSRF target).
+        if (err instanceof Error &&
+            (err.message.includes('timed out') || err.message.includes('aborted'))) {
+            throw err;
+        }
+        throw new Error('gateway host DNS resolution failed');
+    }
+    if (addresses.length === 0) {
+        throw new Error('gateway host DNS resolution returned no addresses');
+    }
+    if (!allowPrivate) {
+        // A SINGLE forbidden record fails the whole URL. This rejects a mixed
+        // public/private answer set (the classic rebind payload that returns both
+        // a public and an internal address).
+        for (const { address } of addresses) {
+            const reason = forbiddenIpReason(address);
+            if (reason)
+                throw new Error(`gateway host resolves to a ${reason}`);
+        }
+    }
+    // Every answer is approved — pin to the first one.
+    const [chosen] = addresses;
+    if (!chosen)
+        throw new Error('gateway host resolved to no addresses');
+    const family = isIP(chosen.address) || 4;
+    return { url, hostname, ip: chosen.address, family, port };
+}
+/**
+ * Perform an HTTP(S) request to a user-supplied gateway URL with the connection
+ * PINNED to a validated, non-forbidden IP (SEC-001). See the module header.
+ *
+ * Both the generation and discovery paths call this, so they share one policy.
+ *
+ * ERROR SHAPE: on failure this rejects with a PLAIN `Error` (e.g. 'request
+ * aborted', 'request timed out', 'gateway host DNS resolution timed out'), NOT a
+ * fetch-shaped `TypeError`/`AbortError`. Callers must not branch on error type
+ * (`err.name === 'AbortError'`); inspect the message or treat any rejection as a
+ * failed request.
  */
+export async function pinnedFetch(rawUrl, init) {
+    const pin = await resolveAndPinHost(rawUrl, init.resolveAll ?? defaultResolveAll, {
+        signal: init.signal,
+    });
+    const isHttps = pin.url.protocol === 'https:';
+    const requestFn = isHttps ? httpsRequest : httpRequest;
+    // Header parity with a normal client: sensible defaults that any explicitly
+    // provided header overrides. Accept-Encoding is pinned to `identity` on
+    // purpose — this client reads the body raw and does NOT decompress, so we must
+    // not advertise gzip/deflate or a compressing gateway would hand back bytes we
+    // cannot parse.
+    const headers = {
+        Accept: '*/*',
+        'Accept-Encoding': 'identity',
+        'User-Agent': 'ghagga-gateway-client',
+        ...init.headers,
+    };
+    // Send the body with a known Content-Length (single shot) instead of letting
+    // Node fall back to Transfer-Encoding: chunked — strict gateways / WAFs that
+    // require Content-Length would otherwise reject the POST.
+    if (init.body !== undefined) {
+        headers['Content-Length'] = String(Buffer.byteLength(init.body));
+    }
+    // Pin the socket to the pre-validated IP. Node calls this instead of its own
+    // DNS resolver, so no second resolution (and no rebind) can occur.
+    const pinnedLookup = (_hostname, options, callback) => {
+        const cb = (typeof options === 'function' ? options : callback);
+        const opts = (typeof options === 'function' ? {} : options);
+        if (opts?.all) {
+            cb(null, [{ address: pin.ip, family: pin.family }]);
+        }
+        else {
+            cb(null, pin.ip, pin.family);
+        }
+    };
+    const requestOptions = {
+        method: init.method,
+        // host = hostname → Host header + SNI stay the ORIGINAL host, not the IP.
+        host: pin.hostname,
+        port: pin.port,
+        path: `${pin.url.pathname}${pin.url.search}`,
+        headers,
+        // biome-ignore lint/suspicious/noExplicitAny: net LookupFunction typing is loose across http/https.
+        lookup: pinnedLookup,
+        // Preserve TLS SNI explicitly (https only; ignored for http).
+        servername: isHttps ? pin.hostname : undefined,
+    };
+    return new Promise((resolve, reject) => {
+        if (init.signal?.aborted) {
+            reject(new Error('request aborted'));
+            return;
+        }
+        const req = requestFn(requestOptions, (res) => {
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => {
+                const bodyText = Buffer.concat(chunks).toString('utf8');
+                const status = res.statusCode ?? 0;
+                resolve({
+                    ok: status >= 200 && status < 300,
+                    status,
+                    text: async () => bodyText,
+                    json: async () => JSON.parse(bodyText),
+                });
+            });
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        if (init.signal) {
+            const onAbort = () => req.destroy(new Error('request timed out'));
+            init.signal.addEventListener('abort', onAbort, { once: true });
+            req.on('close', () => init.signal?.removeEventListener('abort', onAbort));
+        }
+        // Single-shot send: with Content-Length set above this avoids chunked
+        // encoding. `req.end(undefined)` is a no-op body when there is nothing to send.
+        req.end(init.body);
+    });
+}
 // ─── Public API ─────────────────────────────────────────────────
 /**
  * Generate text via the LLM Gateway.
@@ -22,14 +407,17 @@
  * @returns Gateway response with generated text and metadata
  */
 export async function generateViaGateway(prompt, systemPrompt, options) {
-    const { gatewayUrl, gatewayToken, model, project } = options ?? {};
+    const { gatewayUrl, gatewayToken, provider, model, project } = options ?? {};
     if (!gatewayUrl) {
         throw new Error('Gateway URL not configured — set it in the dashboard provider chain settings');
     }
     if (!gatewayToken) {
         throw new Error('Gateway token not configured — set the API key in the dashboard provider chain settings');
     }
-    const response = await fetch(`${gatewayUrl}/v1/generate`, {
+    // SSRF: pinnedFetch resolves once, validates every answer, and pins the socket
+    // to a non-forbidden IP (see module header). Node's client never follows a
+    // 3xx, so a redirect surfaces below as a failed generation.
+    const response = await pinnedFetch(`${gatewayUrl}/v1/generate`, {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
@@ -38,17 +426,11 @@ export async function generateViaGateway(prompt, systemPrompt, options) {
         body: JSON.stringify({
             prompt,
             system: systemPrompt,
+            provider,
             model,
             project,
         }),
         signal: AbortSignal.timeout(180_000), // 3 min timeout (matches CLI bridge)
-        // SSRF defense: never follow redirects. The gateway URL was validated by
-        // the server worker (safe-url) against the ORIGINAL host only; a 3xx
-        // Location could redirect this server-side fetch to an unvalidated
-        // private/loopback/metadata address. With redirect:'manual' a 3xx becomes
-        // a non-ok response and is handled below as a failed generation, exactly
-        // like any other gateway error.
-        redirect: 'manual',
     });
     // Non-2xx (including a refused 3xx redirect) is a failed generation.
     if (!response.ok) {

package/dist/providers/gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/providers/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsBH,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,YAAqB,EACrB,OAAwB;IAExB,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAEnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,cAAc,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,YAAY,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM;YACN,MAAM,EAAE,YAAY;YACpB,KAAK;YACL,OAAO;SACR,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,qCAAqC;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,mEAAmE;QACnE,0EAA0E;QAC1E,yEAAyE;QACzE,gCAAgC;QAChC,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IAEH,qEAAqE;IACrE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA8B,CAAC;AACrD,CAAC"}
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/providers/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AA2BhC,mEAAmE;AACnE,EAAE;AACF,oEAAoE;AACpE,8EAA8E;AAC9E,2EAA2E;AAE3E,2EAA2E;AAC3E,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAAC,EAAU;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,wBAAwB,CAAC;IAC7C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAA0C,CAAC;IAE1D,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACtD,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,gCAAgC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,8BAA8B,CAAC;IACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,iCAAiC,CAAC;IAC9E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,kCAAkC,CAAC;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,8CAA8C,CAAC;IAClF,kFAAkF;IAClF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,+BAA+B,CAAC;IAC7E,mEAAmE;IACnE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,yCAAyC,CAAC;IAC9F,2BAA2B;IAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,iCAAiC,CAAC;IACnE,uCAAuC;IACvC,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,gCAAgC,CAAC;IAEtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,EAAsC,CAAC;QAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,SAAS,GAAG,CAAC,CAAS,EAAmB,EAAE;QAC/C,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,gBAAoC,CAAC;QAClE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9C,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,EAAE,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAAC,EAAU;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO,wBAAwB,CAAC;IAE9C,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpE,IAAI,iBAAiB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC7E,IAAI,iBAAiB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IAE3E,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IACtF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAqB,CAAC;QAC9D,MAAM,EAAE,GAAG,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC,CAAC,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAW,CAAC;IAChC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,gCAAgC,CAAC;IACtE,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,4BAA4B,CAAC;IAElE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,EAAU;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM,CAAC;AAC7D,CAAC;AA2BD,MAAM,iBAAiB,GAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,SAAS,mBAAmB,CAC1B,IAA8B,EAC9B,MAA+B,EAC/B,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;QAC7D,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3D,IAAI,CAAC,IAAI,CACP,CAAC,SAAS,EAAE,EAAE;YACZ,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,aAA2B,iBAAiB,EAC5C,IAAsD;IAEtD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,0DAA0D;IAC1D,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iEAAiE;IACjE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAE7C,gDAAgD;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAuB,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,mBAAmB,CACnC,UAAU,CAAC,QAAQ,CAAC,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,IAAI,yBAAyB,CAChD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,qEAAqE;QACrE,IACE,GAAG,YAAY,KAAK;YACpB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EACtE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,sEAAsE;QACtE,0EAA0E;QAC1E,qCAAqC;QACrC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAW,IAAI,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7D,CAAC;AAsBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,IAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE;QAChF,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAEvD,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,+EAA+E;IAC/E,gBAAgB;IAChB,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,UAAU;QAC7B,YAAY,EAAE,uBAAuB;QACrC,GAAG,IAAI,CAAC,OAAO;KAChB,CAAC;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,YAAY,GAAG,CACnB,SAAiB,EACjB,OAAgB,EAChB,QAAwF,EAClF,EAAE;QACR,MAAM,EAAE,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAoB,CAAC;QACnF,MAAM,IAAI,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAkC,CAAC;QAC7F,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC;YACd,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAmB;QACrC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,0EAA0E;QAC1E,IAAI,EAAE,GAAG,CAAC,QAAQ;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE;QAC5C,OAAO;QACP,oGAAoG;QACpG,MAAM,EAAE,YAAmB;QAC3B,8DAA8D;QAC9D,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAC/C,CAAC;IAEF,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACnC,OAAO,CAAC;oBACN,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;oBACjC,MAAM;oBACN,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;oBAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,sEAAsE;QACtE,gFAAgF;QAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,YAAqB,EACrB,OAAwB;IAExB,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAE7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,UAAU,cAAc,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,YAAY,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM;YACN,MAAM,EAAE,YAAY;YACpB,QAAQ;YACR,KAAK;YACL,OAAO;SACR,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,qCAAqC;KAC5E,CAAC,CAAC;IAEH,qEAAqE;IACrE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA8B,CAAC;AACrD,CAAC"}

package/dist/providers/generate-fn.d.ts

@@ -43,6 +43,7 @@ export declare function createCLIBridgeGenerateFn(options: {
 export declare function createGatewayGenerateFn(options: {
     gatewayUrl: string;
     gatewayToken: string;
+    provider?: string;
     model?: string;
     project?: string;
 }): GenerateTextFn;

package/dist/providers/generate-fn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-fn.d.ts","sourceRoot":"","sources":["../../src/providers/generate-fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAIzF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,GAAG,cAAc,CAUjB;AAID;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,cAAc,CAUjB;AAGD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"generate-fn.d.ts","sourceRoot":"","sources":["../../src/providers/generate-fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAIzF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,GAAG,cAAc,CAUjB;AAID;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,cAAc,CAUjB;AAGD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC"}

package/dist/providers/generate-fn.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-fn.js","sourceRoot":"","sources":["../../src/providers/generate-fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAelD,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAIzC;IACC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,CAAC,EAAE,4BAA4B;YAC3C,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,MAAM,CAAC,GAAG;SAClB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAKvC;IACC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;YAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"generate-fn.js","sourceRoot":"","sources":["../../src/providers/generate-fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAelD,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAIzC;IACC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,CAAC,EAAE,4BAA4B;YAC3C,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,MAAM,CAAC,GAAG;SAClB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAMvC;IACC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;YAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC"}

package/dist/tools/cpd.js

@@ -74,7 +74,7 @@ async function findCpdBinary() {
     for (const cmd of pmdPaths) {
         try {
             await execFileAsync(cmd, ['cpd', '--help'], { timeout: 5_000 });
-            console.log(`[ghagga:cpd] Found pmd at: ${cmd}`);
+            console.error(`[ghagga:cpd] Found pmd at: ${cmd}`);
             return { cmd, args: ['cpd'] };
         }
         catch {
@@ -99,7 +99,7 @@ export async function runCpd(scanPath, options = {}) {
             executionTimeMs: Date.now() - start,
         };
     }
-    console.log(`[ghagga:cpd] Binary found: ${binary.cmd} ${binary.args.join(' ')}`);
+    console.error(`[ghagga:cpd] Binary found: ${binary.cmd} ${binary.args.join(' ')}`);
     try {
         const args = [
             ...binary.args,

package/dist/tools/cpd.js.map

@@ -1 +1 @@
-{"version":3,"file":"cpd.js","sourceRoot":"","sources":["../../src/tools/cpd.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,QAAgB;IACvD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,sEAAsE,CAAC;IACxF,MAAM,SAAS,GAAG,wCAAwC,CAAC;IAE3D,IAAI,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,KAAK,GAA0C,EAAE,CAAC;QACxD,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;QACxB,IAAI,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,SAAS,KAAK,IAAI,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,QAAQ,GAAG,EAAE,EAAE,CAAC;gBAC/C,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,aAAa;gBACvB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI;gBACpB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI;gBACpB,OAAO,EAAE,0BAA0B,KAAK,WAAW,MAAM,sBAAsB,SAAS,EAAE;gBAC1F,UAAU,EAAE,+DAA+D;gBAC3E,MAAM,EAAE,KAAc;aACvB,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa;IAC1B,yDAAyD;IACzD,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,QAAgB,EAChB,UAAsC,EAAE;IAExC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,kBAAkB,CAAC;IAElE,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,4DAA4D;YACnE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACpC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,GAAG,MAAM,CAAC,IAAI;YACd,UAAU;YACV,KAAK;YACL,kBAAkB;YAClB,MAAM,CAAC,aAAa,CAAC;YACrB,OAAO;YACP,QAAQ;YACR,uBAAuB;SACxB,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE;YACvD,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE/C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,QAAQ;YACR,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACpC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mEAAmE;QACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAI,KAA4B,CAAC,MAAM,CAAC;YACpD,IAAI,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC/C,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,QAAQ;oBACR,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBACpC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,eAAe,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAC9E,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACpC,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"cpd.js","sourceRoot":"","sources":["../../src/tools/cpd.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,QAAgB;IACvD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,sEAAsE,CAAC;IACxF,MAAM,SAAS,GAAG,wCAAwC,CAAC;IAE3D,IAAI,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,KAAK,GAA0C,EAAE,CAAC;QACxD,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;QACxB,IAAI,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,SAAS,KAAK,IAAI,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,QAAQ,GAAG,EAAE,EAAE,CAAC;gBAC/C,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,aAAa;gBACvB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI;gBACpB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI;gBACpB,OAAO,EAAE,0BAA0B,KAAK,WAAW,MAAM,sBAAsB,SAAS,EAAE;gBAC1F,UAAU,EAAE,+DAA+D;gBAC3E,MAAM,EAAE,KAAc;aACvB,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa;IAC1B,yDAAyD;IACzD,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,QAAgB,EAChB,UAAsC,EAAE;IAExC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,kBAAkB,CAAC;IAElE,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,4DAA4D;YACnE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACpC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEnF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,GAAG,MAAM,CAAC,IAAI;YACd,UAAU;YACV,KAAK;YACL,kBAAkB;YAClB,MAAM,CAAC,aAAa,CAAC;YACrB,OAAO;YACP,QAAQ;YACR,uBAAuB;SACxB,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE;YACvD,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE/C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,QAAQ;YACR,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACpC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mEAAmE;QACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAI,KAA4B,CAAC,MAAM,CAAC;YACpD,IAAI,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC/C,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,QAAQ;oBACR,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBACpC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,eAAe,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAC9E,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACpC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/tools/execution.d.ts

@@ -8,7 +8,9 @@ import type { ExecutionContext } from './types.js';
 /**
  * Create a Node.js-based ExecutionContext.
  *
- * @param logger - Optional logger; defaults to console
+ * @param logger - Optional logger; defaults to a stderr-routing logger so that
+ *   tool progress/diagnostics never corrupt machine output (SARIF/JSON) emitted
+ *   on stdout by CLI consumers. (BL-SARIF-STDOUT)
  */
 export declare function createNodeExecutionContext(logger?: {
     info: (...args: unknown[]) => void;

package/dist/tools/execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/tools/execution.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAe,gBAAgB,EAAiB,MAAM,YAAY,CAAC;AAE/E;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,CAAC,EAAE;IAClD,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC,GAAG,gBAAgB,CAwFnB"}
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/tools/execution.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAe,gBAAgB,EAAiB,MAAM,YAAY,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,CAAC,EAAE;IAClD,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC,GAAG,gBAAgB,CA8FnB"}

package/dist/tools/execution.js

@@ -8,10 +8,18 @@ import { execFile } from 'node:child_process';
 /**
  * Create a Node.js-based ExecutionContext.
  *
- * @param logger - Optional logger; defaults to console
+ * @param logger - Optional logger; defaults to a stderr-routing logger so that
+ *   tool progress/diagnostics never corrupt machine output (SARIF/JSON) emitted
+ *   on stdout by CLI consumers. (BL-SARIF-STDOUT)
  */
 export function createNodeExecutionContext(logger) {
-    const log = logger ?? console;
+    // Default logger routes ALL diagnostic levels to stderr. `console.info`/`console.log`
+    // write to stdout, which would interleave with and corrupt machine output.
+    const log = logger ?? {
+        info: (...args) => console.error(...args),
+        warn: (...args) => console.error(...args),
+        error: (...args) => console.error(...args),
+    };
     return {
         async exec(command, args, opts) {
             return new Promise((resolve, reject) => {

package/dist/tools/execution.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution.js","sourceRoot":"","sources":["../../src/tools/execution.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAI1C;IACC,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC;IAE9B,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,IAAc,EAAE,IAAiB;YAC3D,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACpD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;gBACjC,IAAI,QAAQ,GAAG,KAAK,CAAC;gBAErB,iBAAiB;gBACjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,QAAQ,GAAG,IAAI,CAAC;oBAChB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;gBAErE,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,EACP,IAAI,EACJ;oBACE,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG;oBACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;oBACpC,MAAM,EAAE,EAAE,CAAC,MAAM;iBAClB,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;oBAEpB,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,CAAC;4BACN,MAAM,EAAE,MAAM,IAAI,EAAE;4BACpB,MAAM,EAAE,MAAM,IAAI,EAAE;4BACpB,QAAQ,EAAE,CAAC,CAAC;4BACZ,QAAQ,EAAE,IAAI;yBACf,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBAED,2CAA2C;oBAC3C,MAAM,QAAQ,GAAG,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,IAAe,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAE9E,mCAAmC;oBACnC,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;oBACzD,IAAI,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC9C,wDAAwD;wBACxD,OAAO,CAAC;4BACN,MAAM,EAAE,MAAM,IAAI,EAAE;4BACpB,MAAM,EAAE,MAAM,IAAI,EAAE;4BACpB,QAAQ;4BACR,QAAQ,EAAE,KAAK;yBAChB,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBAED,OAAO,CAAC;wBACN,MAAM,EAAE,MAAM,IAAI,EAAE;wBACpB,MAAM,EAAE,MAAM,IAAI,EAAE;wBACpB,QAAQ;wBACR,QAAQ,EAAE,KAAK;qBAChB,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;gBAEF,sBAAsB;gBACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,MAAgB;YACpD,6CAA6C;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,MAAgB;YACjD,uCAAuC;QACzC,CAAC;QAED,GAAG,CAAC,KAAgC,EAAE,OAAe;YACnD,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAED,qFAAqF;QACrF,OAAO,EAAE,SAAS;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"execution.js","sourceRoot":"","sources":["../../src/tools/execution.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAI1C;IACC,sFAAsF;IACtF,2EAA2E;IAC3E,MAAM,GAAG,GAAG,MAAM,IAAI;QACpB,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACpD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACpD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;KACtD,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,IAAc,EAAE,IAAiB;YAC3D,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACpD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;gBACjC,IAAI,QAAQ,GAAG,KAAK,CAAC;gBAErB,iBAAiB;gBACjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,QAAQ,GAAG,IAAI,CAAC;oBAChB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;gBAErE,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,EACP,IAAI,EACJ;oBACE,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG;oBACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;oBACpC,MAAM,EAAE,EAAE,CAAC,MAAM;iBAClB,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;oBAEpB,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,CAAC;4BACN,MAAM,EAAE,MAAM,IAAI,EAAE;4BACpB,MAAM,EAAE,MAAM,IAAI,EAAE;4BACpB,QAAQ,EAAE,CAAC,CAAC;4BACZ,QAAQ,EAAE,IAAI;yBACf,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBAED,2CAA2C;oBAC3C,MAAM,QAAQ,GAAG,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,IAAe,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAE9E,mCAAmC;oBACnC,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;oBACzD,IAAI,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC9C,wDAAwD;wBACxD,OAAO,CAAC;4BACN,MAAM,EAAE,MAAM,IAAI,EAAE;4BACpB,MAAM,EAAE,MAAM,IAAI,EAAE;4BACpB,QAAQ;4BACR,QAAQ,EAAE,KAAK;yBAChB,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBAED,OAAO,CAAC;wBACN,MAAM,EAAE,MAAM,IAAI,EAAE;wBACpB,MAAM,EAAE,MAAM,IAAI,EAAE;wBACpB,QAAQ;wBACR,QAAQ,EAAE,KAAK;qBAChB,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;gBAEF,sBAAsB;gBACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,MAAgB;YACpD,6CAA6C;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,MAAgB;YACjD,uCAAuC;QACzC,CAAC;QAED,GAAG,CAAC,KAAgC,EAAE,OAAe;YACnD,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAED,qFAAqF;QACrF,OAAO,EAAE,SAAS;KACnB,CAAC;AACJ,CAAC"}

package/dist/tools/gitleaks-config.toml

@@ -32,4 +32,27 @@ paths = [
   '''.*/tests?/.*''',
   '''.*/fixtures?/.*''',
   '''.*/testdata/.*''',
+  # Generated GitHub Action bundle (ncc output). Committed so the Action can run
+  # without a build step, but it inlines third-party deps that ship fake/example
+  # credentials (e.g. JSDoc samples, the public Azure devstorage emulator key).
+  # Not human-authored source — never a place a real secret should originate.
+  '''apps/action/dist/.*''',
+]
+
+# Specific placeholder/example secret values that appear in documentation and CI.
+# These are NOT real credentials: they are deterministic dummies or truncated
+# samples used to illustrate env-var setup. Matched against the secret value so
+# a genuine secret in the same file would still be flagged.
+regexes = [
+  # Deterministic all-hex dummy ENCRYPTION_KEY used in CI test env + setup docs
+  # (.github/workflows/ci.yml, CONTRIBUTING.md).
+  '''0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef''',
+  # a1b2c3... placeholder secrets in docs/self-hosted.md examples — both the
+  # full repeated ENCRYPTION_KEY/STATE_SECRET form and the truncated
+  # "a1b2c3d4e5f6..." webhook-secret sample.
+  '''(?:a1b2c3d4e5f6)+(?:\.\.\.)?''',
+  # Truncated/ellipsis example secrets in docs (e.g. "LS0tLS1...", "Ov23li...",
+  # "MIIEpAIBAAKCAQEA...") and Spanish placeholder text in deploy guides.
+  '''(?:LS0tLS1CRUdJTi|Ov23li|MIIEpAIBAAKCAQEA)\.\.\.''',
+  '''los_64_caracteres_hex_aqui''',
 ]

package/dist/tools/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/tools/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAiB,cAAc,EAAE,oBAAoB,EAAc,MAAM,aAAa,CAAC;AAUnG;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,IAAI,CACZ,cAAc,EACd,eAAe,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,GAAG,eAAe,CACjG,GACA,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AA8CD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAqChF"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/tools/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAiB,cAAc,EAAE,oBAAoB,EAAc,MAAM,aAAa,CAAC;AAUnG;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,IAAI,CACZ,cAAc,EACd,eAAe,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,GAAG,eAAe,CACjG,GACA,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AA+CD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAqChF"}

package/dist/tools/runner.js

@@ -33,7 +33,8 @@ export async function runStaticAnalysis(files, scanPath, settings) {
  * @internal
  */
 async function runStaticAnalysisWithRegistry(scanPath, fileList, settings) {
-    console.log('[ghagga:tools] Running static analysis with registry-driven orchestrator');
+    // Diagnostic/progress → stderr; stdout is reserved for machine output (SARIF/JSON).
+    console.error('[ghagga:tools] Running static analysis with registry-driven orchestrator');
     // Ensure plugins are registered
     initializeDefaultTools();
     // Resolve which tools should run

package/dist/tools/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/tools/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,2DAA2D;AAC3D,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA0B,EAC1B,QAAgB,EAChB,QAGC;IAED,OAAO,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,6BAA6B,CAC1C,QAAgB,EAChB,QAAkB,EAClB,QAGC;IAED,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAExF,gCAAgC;IAChC,sBAAsB,EAAE,CAAC;IAEzB,iCAAiC;IACjC,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;IAEH,wCAAwC;IACxC,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAExE,OAAO,OAA+B,CAAC;AACzC,CAAC;AAED,8DAA8D;AAC9D,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAA4B;IACtE,8CAA8C;IAC9C,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;YAC7E,WAAW,CAAC,IAAI,CAAC,GAAI,UAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,mDAAmD;IACnD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAElG,oBAAoB;IACpB,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC;IACtC,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,CAAC,wEAAwE,EAAE,EAAE,CAAC,CAAC;IAE7F,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjF,KAAK,CAAC,IAAI,CACR,QAAQ,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,OAAO,CAAC,QAAQ,KAAK,QAAQ,KAAK,OAAO,CAAC,OAAO,EAAE,CAChG,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,WAAW,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,aAAa,WAAW,OAAO,UAAU,iCAAiC,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAE7F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/tools/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,2DAA2D;AAC3D,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA0B,EAC1B,QAAgB,EAChB,QAGC;IAED,OAAO,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,6BAA6B,CAC1C,QAAgB,EAChB,QAAkB,EAClB,QAGC;IAED,oFAAoF;IACpF,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAE1F,gCAAgC;IAChC,sBAAsB,EAAE,CAAC;IAEzB,iCAAiC;IACjC,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;IAEH,wCAAwC;IACxC,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAExE,OAAO,OAA+B,CAAC;AACzC,CAAC;AAED,8DAA8D;AAC9D,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAA4B;IACtE,8CAA8C;IAC9C,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;YAC7E,WAAW,CAAC,IAAI,CAAC,GAAI,UAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,mDAAmD;IACnD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAElG,oBAAoB;IACpB,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC;IACtC,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,CAAC,wEAAwE,EAAE,EAAE,CAAC,CAAC;IAE7F,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACjF,KAAK,CAAC,IAAI,CACR,QAAQ,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,OAAO,CAAC,QAAQ,KAAK,QAAQ,KAAK,OAAO,CAAC,OAAO,EAAE,CAChG,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,WAAW,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,aAAa,WAAW,OAAO,UAAU,iCAAiC,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAE7F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}