insa-check-core 0.1.0

package/dist/net/http.js

@@ -0,0 +1,114 @@
+import http from "node:http";
+import https from "node:https";
+import { assertAllowedLiteral, guardedLookup } from "./guard.js";
+export class HttpError extends Error {
+    code;
+    url;
+    constructor(message, code, url) {
+        super(message);
+        this.code = code;
+        this.url = url;
+        this.name = "HttpError";
+    }
+}
+const REDIRECT_CODES = new Set([301, 302, 303, 307, 308]);
+/**
+ * Minimal HTTP(S) client on node:http. We avoid fetch() because it refuses
+ * TRACE/TRACK and hides TLS details. Certificate errors are deliberately not
+ * fatal here: the certificate check reports them; other checks still need a
+ * response from misconfigured hosts.
+ */
+export async function httpRequest(url, opts, client) {
+    const followRedirects = opts.followRedirects ?? true;
+    const redirects = [];
+    let current = new URL(url);
+    for (;;) {
+        const res = await singleRequest(current, opts, client);
+        const location = res.headers["location"];
+        if (!followRedirects || !REDIRECT_CODES.has(res.status) || !location) {
+            return { ...res, redirects };
+        }
+        if (redirects.length >= client.maxRedirects) {
+            throw new HttpError(`Too many redirects (>${client.maxRedirects})`, "TOO_MANY_REDIRECTS", url);
+        }
+        const next = new URL(location, current);
+        if (next.protocol !== "http:" && next.protocol !== "https:") {
+            return { ...res, redirects };
+        }
+        redirects.push(current.href);
+        current = next;
+    }
+}
+function singleRequest(url, opts, client) {
+    const lib = url.protocol === "https:" ? https : http;
+    return new Promise((resolve, reject) => {
+        if (client.blockPrivateNetworks) {
+            try {
+                assertAllowedLiteral(url.hostname);
+            }
+            catch (err) {
+                return reject(err);
+            }
+        }
+        const req = lib.request(url, {
+            method: opts.method ?? "GET",
+            headers: {
+                "user-agent": client.userAgent,
+                accept: "text/html,application/xhtml+xml,*/*;q=0.8",
+                "accept-encoding": "identity",
+                ...opts.headers,
+            },
+            rejectUnauthorized: false,
+            timeout: client.timeoutMs,
+            lookup: client.blockPrivateNetworks ? guardedLookup : undefined,
+        }, (res) => {
+            const chunks = [];
+            let size = 0;
+            let done = false;
+            const finish = () => {
+                if (done)
+                    return;
+                done = true;
+                const headers = {};
+                for (const [name, value] of Object.entries(res.headers)) {
+                    if (name === "set-cookie" || value === undefined)
+                        continue;
+                    headers[name] = Array.isArray(value) ? value.join(", ") : value;
+                }
+                resolve({
+                    url: url.href,
+                    status: res.statusCode ?? 0,
+                    headers,
+                    setCookies: res.headers["set-cookie"] ?? [],
+                    body: Buffer.concat(chunks).toString("utf8"),
+                });
+            };
+            res.on("data", (chunk) => {
+                if (size >= client.maxBodyBytes)
+                    return;
+                const room = client.maxBodyBytes - size;
+                chunks.push(chunk.length > room ? chunk.subarray(0, room) : chunk);
+                size += Math.min(chunk.length, room);
+                if (size >= client.maxBodyBytes) {
+                    // Enough for analysis; stop downloading.
+                    res.destroy();
+                    finish();
+                }
+            });
+            res.on("end", finish);
+            res.on("error", (err) => reject(toHttpError(err, url)));
+        });
+        req.on("timeout", () => {
+            req.destroy(new HttpError(`Timed out after ${client.timeoutMs} ms`, "ETIMEDOUT", url.href));
+        });
+        req.on("error", (err) => reject(toHttpError(err, url)));
+        req.end();
+    });
+}
+function toHttpError(err, url) {
+    if (err instanceof HttpError)
+        return err;
+    const e = err;
+    return new HttpError(e.message, e.code, url.href);
+}
+//# sourceMappingURL=http.js.map

package/dist/net/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/net/http.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAWjE,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB,IAAI;IACJ,GAAG;IAHd,YACE,OAAe,EACN,IAAwB,EACxB,GAAW;QAEpB,KAAK,CAAC,OAAO,CAAC,CAAC;oBAHN,IAAI;mBACJ,GAAG;QAGZ,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,IAAoB,EACpB,MAAyB;IAEzB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;IACrD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAE3B,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrE,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,YAAY,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,GAAQ,EACR,IAAoB,EACpB,MAAyB;IAEzB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,GAAG,EACH;YACE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE;gBACP,YAAY,EAAE,MAAM,CAAC,SAAS;gBAC9B,MAAM,EAAE,2CAA2C;gBACnD,iBAAiB,EAAE,UAAU;gBAC7B,GAAG,IAAI,CAAC,OAAO;aAChB;YACD,kBAAkB,EAAE,KAAK;YACzB,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,MAAM,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;SAChE,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,OAAO,GAA2B,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,IAAI,IAAI,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAC3D,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAClE,CAAC;gBACD,OAAO,CAAC;oBACN,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC3B,OAAO;oBACP,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE;oBAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBAC7C,CAAC,CAAC;YACL,CAAC,CAAC;YACF,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,IAAI,MAAM,CAAC,YAAY;oBAAE,OAAO;gBACxC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrC,IAAI,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBAChC,yCAAyC;oBACzC,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,mBAAmB,MAAM,CAAC,SAAS,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,GAAQ;IACzC,IAAI,GAAG,YAAY,SAAS;QAAE,OAAO,GAAG,CAAC;IACzC,MAAM,CAAC,GAAG,GAA4B,CAAC;IACvC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/dist/net/tls.d.ts

@@ -0,0 +1,15 @@
+import type { LegacyTlsVersion, TlsInfo } from "../types.js";
+export interface TlsTarget {
+    host: string;
+    port: number;
+    timeoutMs: number;
+    blockPrivateNetworks: boolean;
+}
+/** Handshake with the target and report protocol, cipher, trust and certificate details. */
+export declare function getTlsInfo(target: TlsTarget): Promise<TlsInfo>;
+/**
+ * Offer only one legacy protocol version. Resolves true if the server accepts it.
+ * SECLEVEL=0 lets the local OpenSSL attempt the old protocol at all.
+ */
+export declare function probeLegacyTls(target: TlsTarget, version: LegacyTlsVersion): Promise<boolean>;
+//# sourceMappingURL=tls.d.ts.map

package/dist/net/tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../../src/net/tls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG7D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CA+C9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAwB7F"}

package/dist/net/tls.js

@@ -0,0 +1,103 @@
+import tls from "node:tls";
+import { assertAllowedLiteral, guardedLookup } from "./guard.js";
+/** Handshake with the target and report protocol, cipher, trust and certificate details. */
+export function getTlsInfo(target) {
+    return new Promise((resolve, reject) => {
+        if (target.blockPrivateNetworks)
+            assertAllowedLiteral(target.host);
+        const socket = tls.connect({
+            host: target.host,
+            port: target.port,
+            servername: isIp(target.host) ? undefined : target.host,
+            // Trust is evaluated and reported, not enforced.
+            rejectUnauthorized: false,
+            timeout: target.timeoutMs,
+            lookup: target.blockPrivateNetworks ? guardedLookup : undefined,
+        });
+        socket.once("secureConnect", () => {
+            const peer = socket.getPeerCertificate();
+            const hasCert = peer && Object.keys(peer).length > 0;
+            const info = {
+                protocol: socket.getProtocol(),
+                cipher: socket.getCipher()?.name ?? null,
+                authorized: socket.authorized,
+                authorizationError: socket.authorizationError
+                    ? String(socket.authorizationError)
+                    : undefined,
+                cert: hasCert
+                    ? {
+                        subject: formatName(peer.subject),
+                        issuer: formatName(peer.issuer),
+                        validFrom: peer.valid_from,
+                        validTo: peer.valid_to,
+                        daysRemaining: Math.floor((Date.parse(peer.valid_to) - Date.now()) / 86_400_000),
+                        subjectAltNames: (peer.subjectaltname ?? "")
+                            .split(",")
+                            .map((s) => s.trim())
+                            .filter(Boolean),
+                        keyType: peer.modulus ? "RSA" : peer.asn1Curve || peer.nistCurve ? "EC" : undefined,
+                        bits: peer.bits,
+                    }
+                    : null,
+            };
+            socket.end();
+            resolve(info);
+        });
+        socket.once("timeout", () => {
+            socket.destroy();
+            reject(new Error(`TLS handshake timed out after ${target.timeoutMs} ms`));
+        });
+        socket.once("error", reject);
+    });
+}
+/**
+ * Offer only one legacy protocol version. Resolves true if the server accepts it.
+ * SECLEVEL=0 lets the local OpenSSL attempt the old protocol at all.
+ */
+export function probeLegacyTls(target, version) {
+    return new Promise((resolve) => {
+        if (target.blockPrivateNetworks && isBlockedLiteral(target.host))
+            return resolve(false);
+        const socket = tls.connect({
+            host: target.host,
+            port: target.port,
+            servername: isIp(target.host) ? undefined : target.host,
+            rejectUnauthorized: false,
+            minVersion: version,
+            maxVersion: version,
+            ciphers: "DEFAULT@SECLEVEL=0",
+            timeout: target.timeoutMs,
+            lookup: target.blockPrivateNetworks ? guardedLookup : undefined,
+        });
+        socket.once("secureConnect", () => {
+            socket.end();
+            resolve(true);
+        });
+        socket.once("timeout", () => {
+            socket.destroy();
+            resolve(false);
+        });
+        socket.once("error", () => resolve(false));
+    });
+}
+function formatName(name) {
+    if (!name)
+        return "";
+    return Object.entries(name)
+        .filter(([, v]) => v !== undefined)
+        .map(([k, v]) => `${k}=${Array.isArray(v) ? v.join("+") : v}`)
+        .join(", ");
+}
+function isBlockedLiteral(host) {
+    try {
+        assertAllowedLiteral(host);
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+function isIp(host) {
+    return /^[\d.]+$/.test(host) || host.includes(":");
+}
+//# sourceMappingURL=tls.js.map

package/dist/net/tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../src/net/tls.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AASjE,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,oBAAoB;YAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;YACvD,iDAAiD;YACjD,kBAAkB,EAAE,KAAK;YACzB,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,MAAM,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACrD,MAAM,IAAI,GAAY;gBACpB,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC9B,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,IAAI,IAAI;gBACxC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACnC,CAAC,CAAC,SAAS;gBACb,IAAI,EAAE,OAAO;oBACX,CAAC,CAAC;wBACE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;wBACjC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC/B,SAAS,EAAE,IAAI,CAAC,UAAU;wBAC1B,OAAO,EAAE,IAAI,CAAC,QAAQ;wBACtB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,UAAU,CAAC;wBAChF,eAAe,EAAE,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;6BACzC,KAAK,CAAC,GAAG,CAAC;6BACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;6BACpB,MAAM,CAAC,OAAO,CAAC;wBAClB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;wBACnF,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB;oBACH,CAAC,CAAC,IAAI;aACT,CAAC;YACF,MAAM,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiB,EAAE,OAAyB;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC,oBAAoB,IAAI,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;YACvD,kBAAkB,EAAE,KAAK;YACzB,UAAU,EAAE,OAAO;YACnB,UAAU,EAAE,OAAO;YACnB,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,MAAM,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;YAChC,MAAM,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAA+D;IACjF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC"}

package/dist/report/html.d.ts

@@ -0,0 +1,14 @@
+import type { EvaluatedBy, Report } from "../types.js";
+export declare function escapeHtml(value: string): string;
+export declare const EVALUATED_LABEL: Record<EvaluatedBy, string>;
+export interface RenderOptions {
+    /** Omit rows still pending manual review (the readiness summary still counts them). */
+    skipUntested?: boolean;
+}
+/** Annex B table as an HTML fragment (summary + one table grouped by section). */
+export declare function renderReportFragment(report: Report, opts?: RenderOptions): string;
+/** Styles for the report fragment. Print-friendly; respects dark mode on screen. */
+export declare const REPORT_CSS = "\n.insa-report { --pass:#1a7f37; --fail:#cf222e; --manual:#6e7781; --error:#9a6700; --na:#0969da; --line:#d0d7de; --muted:#57606a; --section:#f6f8fa;\n  font: 14px/1.45 system-ui, -apple-system, \"Segoe UI\", sans-serif; color: inherit; }\n@media (prefers-color-scheme: dark) { .insa-report { --line:#30363d; --muted:#9198a1; --section:#161b22; --pass:#3fb950; --fail:#f85149; --manual:#9198a1; --error:#d29922; --na:#4493f8; } }\n.insa-report h1 { font-size: 1.4rem; margin: 0 0 .5rem; }\n.insa-report .meta { display:grid; grid-template-columns:max-content 1fr; gap:.15rem 1rem; margin:0 0 1rem; }\n.insa-report .meta dt { color: var(--muted); }\n.insa-report .meta dd { margin:0; overflow-wrap:anywhere; }\n.insa-report .summary { display:flex; flex-wrap:wrap; gap:.5rem; list-style:none; padding:0; margin:0 0 .75rem; }\n.insa-report .summary li { border:1px solid var(--line); border-radius:6px; padding:.35rem .75rem; }\n.insa-report .summary strong { font-size:1.15rem; margin-right:.25rem; }\n.insa-report .summary-pass strong { color:var(--pass); } .insa-report .summary-fail strong { color:var(--fail); }\n.insa-report .summary-manual strong { color:var(--manual); } .insa-report .summary-error strong { color:var(--error); }\n.insa-report .disclaimer { color:var(--muted); font-size:.85rem; margin:0 0 1rem; }\n.insa-report table { width:100%; border-collapse:collapse; }\n.insa-report th, .insa-report td { border:1px solid var(--line); padding:.4rem .5rem; text-align:left; vertical-align:top; }\n.insa-report thead th { background:var(--section); }\n.insa-report tr.section th { background:var(--section); font-weight:600; }\n.insa-report td.num { white-space:nowrap; font-variant-numeric:tabular-nums; }\n.insa-report td.result { white-space:nowrap; }\n.insa-report td.detail { overflow-wrap:anywhere; }\n.insa-report .badge { font-weight:600; }\n.insa-report .badge-pass { color:var(--pass); } .insa-report .badge-fail { color:var(--fail); }\n.insa-report .badge-manual { color:var(--manual); } .insa-report .badge-error { color:var(--error); }\n.insa-report .evidence { margin:.25rem 0 0; padding-left:1.1rem; color:var(--muted); font-size:.85rem; }\n.insa-report .by { display:block; color:var(--muted); font-size:.75rem; font-weight:400; }\n.insa-report .notes { margin:0 0 .75rem; padding-left:1.1rem; color:var(--muted); font-size:.85rem; }\n.insa-report .findings { list-style:none; margin:.4rem 0 0; padding:0; }\n.insa-report .finding { border-left:3px solid var(--line); padding:.2rem 0 .2rem .5rem; margin:.3rem 0; font-size:.85rem; }\n.insa-report .finding.conf-high { border-left-color:var(--fail); }\n.insa-report .finding.conf-medium { border-left-color:var(--error); }\n.insa-report .finding.conf-low { border-left-color:var(--manual); }\n.insa-report .conf { font-weight:600; text-transform:uppercase; font-size:.7rem; letter-spacing:.03em; margin-right:.35rem; }\n.insa-report .conf-high .conf { color:var(--fail); } .insa-report .conf-medium .conf { color:var(--error); } .insa-report .conf-low .conf { color:var(--manual); }\n.insa-report .regex { font-size:.7rem; border:1px solid var(--line); border-radius:4px; padding:0 .25rem; color:var(--muted); }\n.insa-report .snippet { margin:.2rem 0; padding:.25rem .4rem; background:var(--section); border-radius:4px; white-space:pre-wrap; overflow-wrap:anywhere; font-size:.8rem; }\n.insa-report .why { color:var(--muted); }\n.insa-report .badge-not-applicable, .insa-report .summary-na strong { color:var(--na); }\n.insa-report .readiness { display:flex; flex-wrap:wrap; gap:.25rem 1rem; align-items:baseline; border:1px solid var(--line); border-left-width:4px; border-radius:6px; padding:.5rem .75rem; margin:0 0 .75rem; }\n.insa-report .readiness-incomplete { border-left-color:var(--error); }\n.insa-report .readiness-failures { border-left-color:var(--fail); }\n.insa-report .readiness-clean { border-left-color:var(--pass); }\n.insa-report .manual { margin-top:.4rem; padding:.3rem .5rem; border-radius:4px; background:var(--section); font-size:.85rem; }\n.insa-report .manual-meta { color:var(--muted); }\n.insa-report .manual-note { margin:.25rem 0 0; white-space:pre-wrap; overflow-wrap:anywhere; }\n.insa-report .evidence-flag { white-space:nowrap; }\n@media print {\n  .insa-report { --pass:#1a7f37; --fail:#cf222e; --manual:#57606a; --error:#9a6700; --na:#0969da; --line:#999; --section:#eee; --muted:#444; font-size:10pt; color:#000; }\n  .insa-report tr { break-inside: avoid; }\n  .insa-report thead { display: table-header-group; }\n}\n";
+/** Self-contained printable HTML document (open in a browser, Print → Save as PDF). */
+export declare function renderHtmlDocument(report: Report, opts?: RenderOptions): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/report/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/report/html.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAe,WAAW,EAAgB,MAAM,EAAmB,MAAM,aAAa,CAAC;AAInG,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAKvD,CAAC;AAuEF,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAgBD,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CA+CrF;AAED,oFAAoF;AACpF,eAAO,MAAM,UAAU,27IAmDtB,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAmBnF"}

package/dist/report/html.js

@@ -0,0 +1,210 @@
+import { catalog, formatText } from "../content/index.js";
+import { readiness } from "./manual.js";
+import { groupBySection, STATUS_LABEL } from "./summary.js";
+export function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+export const EVALUATED_LABEL = {
+    url: "Automated (URL)",
+    code: "Automated (code)",
+    "url+code": "Automated (URL + code)",
+    manual: "Manual",
+};
+const evaluatedByOf = (r) => r.evaluatedBy ?? (r.status === "manual" ? "manual" : "url");
+function renderFindings(findings) {
+    if (!findings?.length)
+        return "";
+    return `<ul class="findings">${findings
+        .map((f) => `<li class="finding conf-${f.confidence}">
+        <span class="conf">${f.confidence}</span>
+        <code class="loc">${escapeHtml(`${f.file}:${f.line}`)}</code>${f.method === "regex" ? ' <span class="regex" title="Text-pattern match: higher false-positive rate">regex</span>' : ""}
+        <pre class="snippet">${escapeHtml(f.snippet)}</pre>
+        <span class="why">${escapeHtml(f.why)}</span>
+      </li>`)
+        .join("")}</ul>`;
+}
+function renderManual(m) {
+    if (!m)
+        return "";
+    const ui = catalog().ui;
+    const meta = [
+        `${ui.verdictLabel}: ${ui.verdict[m.verdict]}`,
+        m.reviewer ? `${ui.reviewer}: ${escapeHtml(m.reviewer)}` : "",
+        m.reviewedAt ? `${ui.reviewedAt}: ${escapeHtml(m.reviewedAt.slice(0, 16).replace("T", " "))} UTC` : "",
+        m.carriedFrom ? escapeHtml(formatText(ui.carriedFrom, { date: m.carriedFrom.slice(0, 10) })) : "",
+        m.history?.length ? escapeHtml(formatText(ui.historyCount, { count: m.history.length })) : "",
+    ].filter(Boolean);
+    const evidence = [
+        m.attachments?.length ? formatText(ui.evidenceAttached, { count: m.attachments.length }) : "",
+        m.evidenceText ? ui.evidenceTextAttached : "",
+    ].filter(Boolean);
+    return `<div class="manual verdict-${m.verdict}">
+    <div class="manual-meta">${meta.join(" · ")}${evidence.length ? ` <span class="evidence-flag" title="Evidence recorded">&#128206; ${evidence.join(", ")}</span>` : ""}</div>
+    ${m.note ? `<p class="manual-note">${escapeHtml(m.note)}</p>` : ""}
+    ${m.evidenceText ? `<pre class="snippet">${escapeHtml(m.evidenceText)}</pre>` : ""}
+  </div>`;
+}
+function renderReadiness(report) {
+    const r = readiness(report);
+    const ui = catalog().ui;
+    const headline = r.state === "clean"
+        ? ui.readinessClean
+        : r.state === "failures"
+            ? formatText(ui.readinessFailures, { fail: r.fail })
+            : r.pending > 0
+                ? formatText(ui.readinessIncomplete, { pending: r.pending })
+                : r.error > 0
+                    ? formatText(ui.readinessErrors, { error: r.error })
+                    : formatText(ui.readinessNeedsNote, { count: r.needsNote });
+    const lines = [
+        r.state === "incomplete" && r.pending > 0 ? "" : r.pending ? formatText(ui.readinessPendingLine, { pending: r.pending }) : ui.readinessNonePending,
+        r.needsNote && !(r.pending === 0 && r.error === 0) ? formatText(ui.readinessNeedsNoteLine, { count: r.needsNote }) : "",
+        r.carried ? formatText(ui.readinessCarriedLine, { count: r.carried }) : "",
+    ].filter(Boolean);
+    return `<div class="readiness readiness-${r.state}" role="status">
+    <strong>${escapeHtml(headline)}</strong>
+    ${lines.map((l) => `<span>${escapeHtml(l)}</span>`).join("")}
+  </div>
+  <ul class="summary">
+    <li class="summary-pass"><strong>${r.pass}</strong> Pass</li>
+    <li class="summary-fail"><strong>${r.fail}</strong> Fail</li>
+    <li class="summary-manual"><strong>${r.pending}</strong> Pending manual review</li>
+    <li class="summary-na"><strong>${r.notApplicable}</strong> Not applicable</li>
+    <li class="summary-error"><strong>${r.error}</strong> Error</li>
+    <li class="summary-total"><strong>${r.total}</strong> Total</li>
+  </ul>`;
+}
+function renderSources(report) {
+    const s = report.sources;
+    const parts = [];
+    if (s?.url ?? (!s && report.target))
+        parts.push(`<dt>Website</dt><dd>${escapeHtml(s?.url ?? report.target)}</dd>`);
+    if (s?.code) {
+        const c = s.code;
+        const what = [c.language, ...c.frameworks].filter(Boolean).join(", ") || "unknown";
+        parts.push(`<dt>Source code</dt><dd>${escapeHtml(c.name)} (${escapeHtml(what)}; ${c.filesAnalyzed} files analysed${c.parseErrors.length ? `, ${c.parseErrors.length} unparseable` : ""})</dd>`);
+    }
+    return parts.join("");
+}
+/** Annex B table as an HTML fragment (summary + one table grouped by section). */
+export function renderReportFragment(report, opts = {}) {
+    const shown = opts.skipUntested ? report.results.filter((r) => r.status !== "manual") : report.results;
+    const rows = groupBySection(shown)
+        .map((group) => `
+      <tr class="section"><th colspan="4">${escapeHtml(group.section)}</th></tr>
+      ${group.results
+        .map((r) => `
+      <tr class="status-${r.status}">
+        <td class="num">${escapeHtml(r.id)}</td>
+        <td class="title">${escapeHtml(r.title)}</td>
+        <td class="result"><span class="badge badge-${r.status}">${STATUS_LABEL[r.status]}</span><span class="by">${EVALUATED_LABEL[evaluatedByOf(r)]}</span></td>
+        <td class="detail">${escapeHtml(r.detail)}${r.evidence?.length
+        ? `<ul class="evidence">${r.evidence.map((e) => `<li>${escapeHtml(e)}</li>`).join("")}</ul>`
+        : ""}${renderFindings(r.findings)}${renderManual(r.manual)}</td>
+      </tr>`)
+        .join("")}`)
+        .join("");
+    return `
+<section class="insa-report">
+  <header class="report-header">
+    <h1>Secure Website Audit — Annex B Checklist</h1>
+    <dl class="meta">
+      ${renderSources(report)}
+      <dt>Standard</dt><dd>${escapeHtml(report.standard)}</dd>
+      <dt>Scanned</dt><dd>${escapeHtml(report.startedAt)}</dd>
+      <dt>Tool</dt><dd>${escapeHtml(`${report.tool.name} ${report.tool.version}`)}</dd>
+    </dl>
+    ${renderReadiness(report)}
+    ${report.notes?.length ? `<ul class="notes">${report.notes.map((n) => `<li>${escapeHtml(n)}</li>`).join("")}</ul>` : ""}
+    <p class="disclaimer">"Pass" means the automated test found no issue; it is not a certification. URL checks are passive and
+    cover only what the public site shows. Code analysis reports patterns, not proven vulnerabilities: high/medium-confidence
+    findings produce "Fail", low-confidence ones only "Manual review"; regex matches have a higher false-positive rate.
+    Items marked "Manual review" are pending: they have no verdict yet and are never counted as passed.
+    Manual verdicts are recorded by the named reviewer and reflect their testing.${opts.skipUntested ? " Rows pending manual review are hidden in this view." : ""}</p>
+  </header>
+  <table class="annex">
+    <thead><tr><th>No.</th><th>Test</th><th>Result</th><th>Details</th></tr></thead>
+    <tbody>${rows}</tbody>
+  </table>
+</section>`;
+}
+/** Styles for the report fragment. Print-friendly; respects dark mode on screen. */
+export const REPORT_CSS = `
+.insa-report { --pass:#1a7f37; --fail:#cf222e; --manual:#6e7781; --error:#9a6700; --na:#0969da; --line:#d0d7de; --muted:#57606a; --section:#f6f8fa;
+  font: 14px/1.45 system-ui, -apple-system, "Segoe UI", sans-serif; color: inherit; }
+@media (prefers-color-scheme: dark) { .insa-report { --line:#30363d; --muted:#9198a1; --section:#161b22; --pass:#3fb950; --fail:#f85149; --manual:#9198a1; --error:#d29922; --na:#4493f8; } }
+.insa-report h1 { font-size: 1.4rem; margin: 0 0 .5rem; }
+.insa-report .meta { display:grid; grid-template-columns:max-content 1fr; gap:.15rem 1rem; margin:0 0 1rem; }
+.insa-report .meta dt { color: var(--muted); }
+.insa-report .meta dd { margin:0; overflow-wrap:anywhere; }
+.insa-report .summary { display:flex; flex-wrap:wrap; gap:.5rem; list-style:none; padding:0; margin:0 0 .75rem; }
+.insa-report .summary li { border:1px solid var(--line); border-radius:6px; padding:.35rem .75rem; }
+.insa-report .summary strong { font-size:1.15rem; margin-right:.25rem; }
+.insa-report .summary-pass strong { color:var(--pass); } .insa-report .summary-fail strong { color:var(--fail); }
+.insa-report .summary-manual strong { color:var(--manual); } .insa-report .summary-error strong { color:var(--error); }
+.insa-report .disclaimer { color:var(--muted); font-size:.85rem; margin:0 0 1rem; }
+.insa-report table { width:100%; border-collapse:collapse; }
+.insa-report th, .insa-report td { border:1px solid var(--line); padding:.4rem .5rem; text-align:left; vertical-align:top; }
+.insa-report thead th { background:var(--section); }
+.insa-report tr.section th { background:var(--section); font-weight:600; }
+.insa-report td.num { white-space:nowrap; font-variant-numeric:tabular-nums; }
+.insa-report td.result { white-space:nowrap; }
+.insa-report td.detail { overflow-wrap:anywhere; }
+.insa-report .badge { font-weight:600; }
+.insa-report .badge-pass { color:var(--pass); } .insa-report .badge-fail { color:var(--fail); }
+.insa-report .badge-manual { color:var(--manual); } .insa-report .badge-error { color:var(--error); }
+.insa-report .evidence { margin:.25rem 0 0; padding-left:1.1rem; color:var(--muted); font-size:.85rem; }
+.insa-report .by { display:block; color:var(--muted); font-size:.75rem; font-weight:400; }
+.insa-report .notes { margin:0 0 .75rem; padding-left:1.1rem; color:var(--muted); font-size:.85rem; }
+.insa-report .findings { list-style:none; margin:.4rem 0 0; padding:0; }
+.insa-report .finding { border-left:3px solid var(--line); padding:.2rem 0 .2rem .5rem; margin:.3rem 0; font-size:.85rem; }
+.insa-report .finding.conf-high { border-left-color:var(--fail); }
+.insa-report .finding.conf-medium { border-left-color:var(--error); }
+.insa-report .finding.conf-low { border-left-color:var(--manual); }
+.insa-report .conf { font-weight:600; text-transform:uppercase; font-size:.7rem; letter-spacing:.03em; margin-right:.35rem; }
+.insa-report .conf-high .conf { color:var(--fail); } .insa-report .conf-medium .conf { color:var(--error); } .insa-report .conf-low .conf { color:var(--manual); }
+.insa-report .regex { font-size:.7rem; border:1px solid var(--line); border-radius:4px; padding:0 .25rem; color:var(--muted); }
+.insa-report .snippet { margin:.2rem 0; padding:.25rem .4rem; background:var(--section); border-radius:4px; white-space:pre-wrap; overflow-wrap:anywhere; font-size:.8rem; }
+.insa-report .why { color:var(--muted); }
+.insa-report .badge-not-applicable, .insa-report .summary-na strong { color:var(--na); }
+.insa-report .readiness { display:flex; flex-wrap:wrap; gap:.25rem 1rem; align-items:baseline; border:1px solid var(--line); border-left-width:4px; border-radius:6px; padding:.5rem .75rem; margin:0 0 .75rem; }
+.insa-report .readiness-incomplete { border-left-color:var(--error); }
+.insa-report .readiness-failures { border-left-color:var(--fail); }
+.insa-report .readiness-clean { border-left-color:var(--pass); }
+.insa-report .manual { margin-top:.4rem; padding:.3rem .5rem; border-radius:4px; background:var(--section); font-size:.85rem; }
+.insa-report .manual-meta { color:var(--muted); }
+.insa-report .manual-note { margin:.25rem 0 0; white-space:pre-wrap; overflow-wrap:anywhere; }
+.insa-report .evidence-flag { white-space:nowrap; }
+@media print {
+  .insa-report { --pass:#1a7f37; --fail:#cf222e; --manual:#57606a; --error:#9a6700; --na:#0969da; --line:#999; --section:#eee; --muted:#444; font-size:10pt; color:#000; }
+  .insa-report tr { break-inside: avoid; }
+  .insa-report thead { display: table-header-group; }
+}
+`;
+/** Self-contained printable HTML document (open in a browser, Print → Save as PDF). */
+export function renderHtmlDocument(report, opts = {}) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Annex B Audit — ${escapeHtml(new URL(report.target).host)}</title>
+<style>
+:root { color-scheme: light dark; }
+body { margin: 0 auto; padding: 24px 16px; max-width: 1100px; background: Canvas; color: CanvasText; }
+@media print { body { padding: 0; max-width: none; background: #fff; color: #000; } }
+${REPORT_CSS}
+</style>
+</head>
+<body>
+${renderReportFragment(report, opts)}
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=html.js.map

package/dist/report/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/report/html.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAgC;IAC1D,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,kBAAkB;IACxB,UAAU,EAAE,wBAAwB;IACpC,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAc,EAAe,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAEnH,SAAS,cAAc,CAAC,QAAuC;IAC7D,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,wBAAwB,QAAQ;SACpC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,CAAC,UAAU;6BACvB,CAAC,CAAC,UAAU;4BACb,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,0FAA0F,CAAC,CAAC,CAAC,EAAE;+BAC9J,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;4BACxB,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;YACjC,CACP;SACA,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,CAA2B;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,CAAC,YAAY,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;QAC9C,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7D,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACtG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACjG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;KAC9F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAG;QACf,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7F,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE;KAC9C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,8BAA8B,CAAC,CAAC,OAAO;+BACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,oEAAoE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;MACnK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MAChE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;SAC7E,CAAC;AACV,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC;IACxB,MAAM,QAAQ,GACZ,CAAC,CAAC,KAAK,KAAK,OAAO;QACjB,CAAC,CAAC,EAAE,CAAC,cAAc;QACnB,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU;YACtB,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;gBACb,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC5D,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;oBACX,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;oBACpD,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG;QACZ,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB;QAClJ,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACvH,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;KAC3E,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,mCAAmC,CAAC,CAAC,KAAK;cACrC,UAAU,CAAC,QAAQ,CAAC;MAC5B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;;;uCAGzB,CAAC,CAAC,IAAI;uCACN,CAAC,CAAC,IAAI;yCACJ,CAAC,CAAC,OAAO;qCACb,CAAC,CAAC,aAAa;wCACZ,CAAC,CAAC,KAAK;wCACP,CAAC,CAAC,KAAK;QACvC,CAAC;AACT,CAAC;AAOD,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,UAAU,CAAC,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnH,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QACnF,KAAK,CAAC,IAAI,CACR,2BAA2B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,kBAAkB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC,EAAE,QAAQ,CACpL,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAI,GAAkB,EAAE;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACvG,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC;SAC/B,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC;4CAC2B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7D,KAAK,CAAC,OAAO;SACZ,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC;0BACS,CAAC,CAAC,MAAM;0BACR,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BACd,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;sDACO,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,2BAA2B,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;6BACxH,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GACvC,CAAC,CAAC,QAAQ,EAAE,MAAM;QAChB,CAAC,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO;QAC5F,CAAC,CAAC,EACN,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;YAClD,CACH;SACA,IAAI,CAAC,EAAE,CAAC,EAAE,CACd;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO;;;;;QAKD,aAAa,CAAC,MAAM,CAAC;6BACA,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;4BAC5B,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;yBAC/B,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;;MAE3E,eAAe,CAAC,MAAM,CAAC;MACvB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;;;;;mFAKxC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,EAAE;;;;aAIrJ,IAAI;;WAEN,CAAC;AACZ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDzB,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAI,GAAkB,EAAE;IACzE,OAAO;;;;;yBAKgB,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;;;;;EAK9D,UAAU;;;;EAIV,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC;;;CAGnC,CAAC;AACF,CAAC"}

package/dist/report/index.d.ts

@@ -0,0 +1,10 @@
+export * from "./summary.js";
+export * from "./html.js";
+export * from "./merge.js";
+export * from "./validate.js";
+export * from "./manual.js";
+export { ANNEX_B, STANDARD } from "../annex-b.js";
+export { TOOL_NAME, TOOL_VERSION } from "../meta.js";
+export * from "../content/index.js";
+export type * from "../types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/report/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/report/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,cAAc,qBAAqB,CAAC;AACpC,mBAAmB,aAAa,CAAC"}

package/dist/report/index.js

@@ -0,0 +1,10 @@
+// Browser-safe entry point (insa-check-core/report): no Node built-ins may be imported from here.
+export * from "./summary.js";
+export * from "./html.js";
+export * from "./merge.js";
+export * from "./validate.js";
+export * from "./manual.js";
+export { ANNEX_B, STANDARD } from "../annex-b.js";
+export { TOOL_NAME, TOOL_VERSION } from "../meta.js";
+export * from "../content/index.js";
+//# sourceMappingURL=index.js.map

package/dist/report/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/report/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,cAAc,qBAAqB,CAAC"}

package/dist/report/manual.d.ts

@@ -0,0 +1,62 @@
+import type { CheckResult, ManualReview, ManualVerdict, Report, Status } from "../types.js";
+/** Browser-safe Tier 3 helpers: guided manual review recorded on the same report rows. */
+export declare const MANUAL_VERDICTS: readonly ManualVerdict[];
+/** Untested stays "manual" (pending), so an unreviewed item can never count as a pass. */
+export declare function verdictStatus(verdict: ManualVerdict): Status;
+/** A row needs (or received) a human verdict when automation left it undecided. */
+export declare function isReviewable(row: CheckResult): boolean;
+/** Attaches an "untested" review to every undecided row. Idempotent; existing verdicts are kept. */
+export declare function startManualReview(report: Report): Report;
+export declare class ReviewError extends Error {
+    name: string;
+}
+/** Fail and Not applicable must be justified: a verdict without a note keeps the report incomplete. */
+export declare function needsNote(row: CheckResult): boolean;
+/**
+ * Records (part of) a verdict for one item and recomputes the summary.
+ * The previous state goes into `history` when the verdict, reviewer or screenshots change, when a
+ * carried verdict is re-confirmed, or when note/evidence change more than 10 minutes after the last change.
+ * A carried verdict counts as re-confirmed only when a verdict is set; editing just the note keeps the mark.
+ */
+export declare function recordVerdict(report: Report, id: string, patch: Partial<ManualReview>, now?: Date): Report;
+export interface ReviewProgress {
+    /** Rows needing a human verdict (with or without one). */
+    total: number;
+    /** Of those, rows with a verdict other than "untested". */
+    reviewed: number;
+}
+export declare function reviewProgress(report: Report): ReviewProgress;
+export interface Readiness {
+    total: number;
+    pass: number;
+    fail: number;
+    notApplicable: number;
+    /** Rows still waiting for a human verdict (status "manual"). */
+    pending: number;
+    /** Automated checks that did not complete. */
+    error: number;
+    /** Manual Fail / Not applicable verdicts without a reviewer note. */
+    needsNote: number;
+    /** Manual verdicts carried from an earlier report and not yet re-confirmed (informational). */
+    carried: number;
+    /** True only when nothing is pending, nothing errored, and every Fail/N/A verdict has a note. */
+    complete: boolean;
+    /** incomplete: pending or errors remain; failures: complete with fails; clean: complete, no fails. */
+    state: "incomplete" | "failures" | "clean";
+}
+/** Overall readiness across all three tiers. Untested items are counted as pending, never as pass. */
+export declare function readiness(report: Report): Readiness;
+/** A report with every Annex B item pending manual review, for reviewing without any automated scan. */
+export declare function createManualReport(name: string, now?: Date): Report;
+export interface CarryResult {
+    report: Report;
+    /** Items that received a carried verdict. */
+    carried: string[];
+}
+/**
+ * Copies recorded manual verdicts from an earlier report of the same target into a newer one.
+ * Only rows still pending in the new report are filled; existing verdicts and automated results
+ * are never overridden. Carried verdicts are marked (`carriedFrom`) until someone re-records them.
+ */
+export declare function carryForwardReviews(previous: Report, next: Report): CarryResult;
+//# sourceMappingURL=manual.d.ts.map

package/dist/report/manual.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual.d.ts","sourceRoot":"","sources":["../../src/report/manual.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAkB,MAAM,EAAE,MAAM,aAAa,CAAC;AAG5G,0FAA0F;AAE1F,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAAmD,CAAC;AAExG,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAE5D;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEtD;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKxD;AAED,qBAAa,WAAY,SAAQ,KAAK;IAC3B,IAAI,SAAiB;CAC/B;AAeD,uGAAuG;AACvG,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAGnD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,EAC5B,GAAG,GAAE,IAAiB,GACrB,MAAM,CA+BR;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAG7D;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,QAAQ,EAAE,OAAO,CAAC;IAClB,sGAAsG;IACtG,KAAK,EAAE,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;CAC5C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAcnD;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAqB/E;AAWD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CA4C/E"}