openpitstop 1.0.0

package/dist/pen/static.js

@@ -0,0 +1,565 @@
+/**
+ * pen/static.ts — the static phase of `pitstop pen`.
+ *
+ * Cheap, dependency-free, honest heuristics. Every finding is labelled with
+ * its confidence: `heuristic` (pattern matched, no proof yet), `indicated`
+ * (the data flow is concrete: user input reaching a sink). Nothing is ever
+ * labelled `proven` here — proof is the dynamic phase's job.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { walkFiles } from "../analyzers/util.js";
+import { findRoutesInFile, ROUTE_EXTS } from "../analyzers/routes.js";
+import { findingIdFor } from "../repro/ids.js";
+const JS_EXTS = [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"];
+const PY_EXTS = [".py"];
+const SECRET_PATTERNS = [
+    {
+        type: "hardcoded-secret",
+        severity: "critical",
+        re: /\bAKIA[0-9A-Z]{16}\b/,
+        name: "AWS access key",
+    },
+    {
+        type: "hardcoded-secret",
+        severity: "critical",
+        re: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/,
+        name: "GitHub token",
+    },
+    {
+        type: "hardcoded-secret",
+        severity: "high",
+        re: /\bsk_(live|prod)_[A-Za-z0-9]{16,}\b/,
+        name: "live Stripe secret key",
+    },
+    {
+        type: "hardcoded-secret",
+        severity: "high",
+        re: /\brzp_live_[A-Za-z0-9]{10,}\b|\brz_live_[A-Za-z0-9]{10,}\b/,
+        name: "live Razorpay key",
+    },
+    {
+        type: "hardcoded-secret",
+        severity: "high",
+        re: /\bAIza[0-9A-Za-z_-]{35}\b/,
+        name: "Google API key",
+    },
+    {
+        type: "hardcoded-secret",
+        severity: "high",
+        re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/,
+        name: "Slack token",
+    },
+    {
+        type: "hardcoded-secret",
+        severity: "critical",
+        re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
+        name: "private key block",
+    },
+];
+/** Values that are clearly placeholders — never flag these. */
+const PLACEHOLDER_RE = /^(test|example|changeme|change-me|dummy|fake|placeholder|your|secret|password|token|xxx+|\.\.\.|none|null|undefined)$/i;
+const TEST_CRED_RE = /(test|demo|sample|example|fake|pitstop|mock)/i;
+function scanSecrets(repo) {
+    const hits = [];
+    const files = walkFiles(repo, [...JS_EXTS, ...PY_EXTS, ".env", ".env.production", ".env.local", ".env.example"].filter((e, i, a) => a.indexOf(e) === i));
+    for (const file of files) {
+        let content;
+        try {
+            content = fs.readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        // Strip comments so placeholders in docs/tests don't scream.
+        const lines = content.split(/\r?\n/);
+        lines.forEach((raw, i) => {
+            const line = raw.trim();
+            if (!line || line.startsWith("#") || line.startsWith("//") || line.startsWith("*"))
+                return;
+            for (const p of SECRET_PATTERNS) {
+                const m = line.match(p.re);
+                if (!m)
+                    continue;
+                const value = m[0];
+                if (p.type === "hardcoded-secret" && /(?:password|passwd|secret|api[_-]?key|token)\s*[:=]\s*["']?([^"'\s,;)]+)/i.test(line)) {
+                    const v = (line.match(/(?:password|passwd|secret|api[_-]?key|token)\s*[:=]\s*["']?([^"'\s,;)]+)/i) || [])[1] || "";
+                    if (PLACEHOLDER_RE.test(v) || TEST_CRED_RE.test(v))
+                        continue;
+                }
+                hits.push({ file, line: i + 1, pattern: p, value });
+                break; // one secret per line is enough
+            }
+        });
+    }
+    return hits;
+}
+/** Generic `SOMETHING_KEY = "value"` where value is clearly real (high entropy-ish). */
+const GENERIC_KEY_RE = /\b(?:[A-Z][A-Z0-9_]{3,})?(?:PASSWORD|PASSWD|SECRET|API_?KEY|TOKEN|PRIVATE_?KEY)\s*[:=]\s*["']([^"'\s]{12,})["']/i;
+function scanGenericKeys(repo) {
+    const hits = [];
+    const files = walkFiles(repo, [...JS_EXTS, ...PY_EXTS, ".env", ".env.production", ".env.local", ".env.example"].filter((e, i, a) => a.indexOf(e) === i));
+    for (const file of files) {
+        let content;
+        try {
+            content = fs.readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const lines = content.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i].trim();
+            if (!line || line.startsWith("#") || line.startsWith("//"))
+                continue;
+            const m = line.match(GENERIC_KEY_RE);
+            if (!m)
+                continue;
+            const v = m[1];
+            if (PLACEHOLDER_RE.test(v) || TEST_CRED_RE.test(v))
+                continue;
+            // Entropy-ish guard: real secrets are rarely a repeated char or a word.
+            if (/^([a-z0-9])\1{10,}$/i.test(v))
+                continue;
+            hits.push({
+                file,
+                line: i + 1,
+                pattern: {
+                    type: "hardcoded-secret",
+                    severity: "high",
+                    re: GENERIC_KEY_RE,
+                    name: "hardcoded credential",
+                },
+                value: v,
+            });
+        }
+    }
+    return hits;
+}
+/* ------------------------------------------------------------------ */
+/* 2. Route inventory (static, for the dynamic phase)                  */
+/* ------------------------------------------------------------------ */
+const SENSITIVE_WORDS = [
+    "admin",
+    "dashboard",
+    "private",
+    "account",
+    "profile",
+    "settings",
+    "order",
+    "charge",
+    "payment",
+    "refund",
+    "transfer",
+    "webhook",
+    "secret",
+    "token",
+    "otp",
+    "verify",
+    "user",
+    "users",
+    "auth",
+    "login",
+    "signin",
+    "session",
+];
+const LOGIN_WORDS = ["login", "signin", "auth", "otp", "verify", "token", "password", "forgot"];
+export function findRoutes(repo) {
+    const out = [];
+    const add = (file, method, p, line) => {
+        const lower = p.toLowerCase();
+        out.push({
+            method: method.toUpperCase(),
+            path: p,
+            file,
+            line,
+            sensitive: SENSITIVE_WORDS.some((w) => lower.includes(w)),
+            loginLike: LOGIN_WORDS.some((w) => lower.includes(w)),
+        });
+    };
+    for (const file of walkFiles(repo, ROUTE_EXTS)) {
+        let content;
+        try {
+            content = fs.readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const ext = path.extname(file).toLowerCase();
+        for (const r of findRoutesInFile(content, ext))
+            add(file, r.method, r.path, r.line);
+    }
+    return out;
+}
+const STATIC_RULES = [
+    {
+        type: "insecure-cors",
+        severity: "high",
+        confidence: "indicated",
+        title: "CORS allows any origin",
+        describe: () => "CORS is wide open — either a bare `cors()` (defaults to origin: * with credentials off) or an explicit `origin: \"*\"`. Any website can read the responses of this endpoint from a victim's browser.",
+        fix: "Restrict origins to an explicit allowlist: `cors({ origin: [/^https?:\\/\\/(localhost|127\\.0\\.0\\.1)(:\\d+)?$/, ...] })` — or better, list only your real production origins and never combine `origin: *` with credentials.",
+    },
+    {
+        type: "missing-security-headers",
+        severity: "medium",
+        confidence: "indicated",
+        title: "no helmet / security headers middleware",
+        describe: () => "An Express app without helmet() (or manual CSP / X-Frame-Options / X-Content-Type-Options headers). Clickjacking, MIME sniffing and mixed-content protections are all off.",
+        fix: "Install helmet and `app.use(helmet());` after app creation (deterministic patch generated by `pitstop pen --fix` when helmet is already installed).",
+    },
+    {
+        type: "cookie-without-httponly",
+        severity: "medium",
+        confidence: "indicated",
+        title: "cookie set without httpOnly",
+        describe: () => "A session/security cookie is being set without `httpOnly` (and likely without `secure`), so an XSS in any page can steal it via document.cookie.",
+        fix: "Set `{ httpOnly: true, secure: true, sameSite: \"strict\" }` on every session/auth cookie.",
+    },
+    {
+        type: "no-rate-limit",
+        severity: "medium",
+        confidence: "heuristic",
+        title: "no rate limiting on authentication paths",
+        describe: () => "express-rate-limit is not installed and login-ish routes exist — credential stuffing / brute force is unthrottled. The dynamic phase verifies this live.",
+        fix: "Add express-rate-limit and apply a strict limiter to /login /verify /otp /token routes (e.g. 5 requests / 15 min per IP).",
+    },
+    {
+        type: "info-leak",
+        severity: "high",
+        confidence: "indicated",
+        title: "env secrets printed to console",
+        describe: () => "A console statement forwards process.env values (API keys, tokens, DB credentials) into stdout logs where they are one grep away from exfiltration.",
+        fix: "Remove the log, or redact secrets before logging; never log raw process.env.",
+    },
+    {
+        type: "arbitrary-code-execution",
+        severity: "high",
+        confidence: "heuristic",
+        title: "eval / new Function in application code",
+        describe: () => "`eval` or `new Function` turns attacker-influenced strings into executable code. It is never needed for this; replace with a lookup table or JSON.parse.",
+        fix: "Remove eval/new Function. If a template engine is genuinely required, use a sandboxed one (e.g. a compiled template with no global access).",
+    },
+    {
+        type: "sql-injection",
+        severity: "critical",
+        confidence: "indicated",
+        title: "SQL built by string interpolation",
+        describe: () => "A query string is assembled by concatenating or interpolating variables into SQL. Any route feeding these variables becomes a live injection point.",
+        fix: "Use parameterized queries (?, $1 placeholders) or an ORM. Never interpolate values into SQL text.",
+    },
+    {
+        type: "command-injection",
+        severity: "critical",
+        confidence: "indicated",
+        title: "child_process called with request-derived input",
+        describe: () => "exec/spawn/execFile is called with a value that can trace back to request data (query, params, body). If the shell interprets it, that is remote code execution.",
+        fix: "Do not shell out with user input. If unavoidable: execFile with a fixed command, no shell, and validate input against a strict allowlist (e.g. /^[a-z0-9-]{1,64}$/).",
+    },
+    {
+        type: "path-traversal",
+        severity: "high",
+        confidence: "indicated",
+        title: "filesystem access with request-derived paths",
+        describe: () => "fs.readFile/readdir/createReadStream receives a path built from request data — ../ sequences can read or enumerate anything the process can.",
+        fix: "Resolve the path and verify it stays inside a root directory: `path.resolve(root, name)` then check `startsWith(root + path.sep)`; reject anything that escapes.",
+    },
+    {
+        type: "ssrf",
+        severity: "high",
+        confidence: "indicated",
+        title: "outbound HTTP built from request-derived URLs",
+        describe: () => "fetch/http/axios/got is called with a URL that can trace back to request data — the server can be coerced into attacking internal hosts (metadata endpoints, admin panels).",
+        fix: "Allow only an explicit allowlist of hosts; forbid private ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254); resolve and re-check the IP before sending.",
+    },
+    {
+        type: "xss-sink",
+        severity: "high",
+        confidence: "indicated",
+        title: "HTML sink with request-derived data",
+        describe: () => "dangerouslySetInnerHTML / v-html / innerHTML / document.write receives data that can trace back to request data — stored or reflected XSS.",
+        fix: "Never put user data into HTML strings; use text nodes / escaped interpolation. If it must be HTML, sanitize with DOMPurify server-side or an HTML escaper at the sink.",
+    },
+    {
+        type: "prototype-pollution",
+        severity: "high",
+        confidence: "indicated",
+        title: "object merge/assign of untrusted data",
+        describe: () => "A recursive merge/assign (or __proto__ handling) appears with untrusted input — the classic prototype-pollution gadget (admin bypass, RCE via sanitized options).",
+        fix: "Merge only plain, schema-known objects; reject keys __proto__ / constructor / prototype at the boundary before any merge.",
+    },
+];
+const TYPES_WITH_RE = new Map(STATIC_RULES.filter((r) => r.type !== "no-rate-limit").map((r) => [r.type, r]));
+const PATTERNS = [
+    // SQL: template literal query with ${} or concatenated + with a variable.
+    {
+        type: "sql-injection",
+        re: /\b(?:query|execute|exec|raw|run|find|findOne|aggregate|executeSql|sql)\s*\(\s*(?:[`"])[^`"\n]*\$\{/i,
+        requiresUserInput: false,
+    },
+    {
+        type: "sql-injection",
+        re: /\b(?:query|execute|exec|raw|run)\s*\(\s*(?:'|")[^'"\n]*"\s*\+\s*(?!['"])[\w.[\]]+/i,
+        requiresUserInput: true,
+    },
+    {
+        type: "command-injection",
+        re: /\b(?:exec|execFile|spawn|spawnSync|execSync|execFileSync|fork)\s*\(\s*(?:[`"])[^`"\n]*\$\{/i,
+        requiresUserInput: false,
+    },
+    {
+        type: "command-injection",
+        re: /\b(?:exec|spawn)\s*\(\s*[`"'][^`"'\n]*[`"']\s*\+/i,
+        requiresUserInput: true,
+    },
+    {
+        type: "path-traversal",
+        re: /\b(?:readFileSync|readFile|readdir|readdirSync|createReadStream|writeFileSync|writeFile|existsSync|statSync)\s*\(\s*(?:[`"])[^`"\n]*\$\{/i,
+        requiresUserInput: false,
+    },
+    {
+        type: "path-traversal",
+        re: /\b(?:readFileSync|readFile|createReadStream|readdirSync|readdir)\s*\(\s*path\.join\s*\([^)]*(?:req\.|query|body|params|input|user|data)[^)]*\)/i,
+        requiresUserInput: true,
+    },
+    {
+        type: "ssrf",
+        re: /\b(?:fetch|axios|request|got|http|https)\s*\(\s*(?:[`"])[^`"\n]*\$\{(?:url|uri|target|link|image|src|webhook|callback)[^}]*\}/i,
+        requiresUserInput: false,
+    },
+    {
+        type: "ssrf",
+        re: /\b(?:fetch|axios|request|got)\s*\(\s*(?:req\.(?:body|query|params)|[a-z]+\.(?:url|uri|webhook|callback|image|src))\s*[),]/i,
+        requiresUserInput: true,
+    },
+    {
+        type: "xss-sink",
+        re: /\b(?:dangerouslySetInnerHTML|v-html)\b|document\.write\s*\(/i,
+        requiresUserInput: false,
+    },
+    {
+        type: "xss-sink",
+        re: /\binnerHTML\s*=\s*[^;]*(?:req\.|body\.|query\.|params\.|data\.|input)/i,
+        requiresUserInput: true,
+    },
+    {
+        type: "prototype-pollution",
+        re: /["']__proto__["']\s*[:=]\s*\{|Object\.assign\s*\([^)]*\b[a-z]+,[^)]*\)/i,
+        requiresUserInput: false,
+    },
+    {
+        type: "arbitrary-code-execution",
+        re: /\beval\s*\(|\bnew\s+Function\s*\(/i,
+        requiresUserInput: false,
+    },
+];
+const USER_INPUT_RE = /\b(?:req|request|ctx|context|body|query|params|headers|input|payload|user|data|arg|value|url|name|id|file|content|message)\b/i;
+function hasUserInput(line) {
+    return USER_INPUT_RE.test(line);
+}
+/* ------------------------------------------------------------------ */
+/* 4. Config hygiene rules (whole-file, dependency-aware)              */
+/* ------------------------------------------------------------------ */
+function findAppLine(content) {
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        if (/const\s+app\s*=\s*express\s*\(/.test(lines[i]) || /express\s*\(\s*\)/.test(lines[i])) {
+            return { line: i + 1, text: lines[i] };
+        }
+    }
+    return null;
+}
+export function analyzeStatic(repo) {
+    const findings = [];
+    const routes = findRoutes(repo);
+    const jsFiles = walkFiles(repo, JS_EXTS);
+    const pyFiles = walkFiles(repo, PY_EXTS);
+    const allFiles = [...jsFiles, ...pyFiles];
+    let pkg = {};
+    try {
+        pkg = JSON.parse(fs.readFileSync(path.join(repo, "package.json"), "utf8").replace(/^\uFEFF/, ""));
+    }
+    catch {
+        /* no package.json */
+    }
+    const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+    const packages = Object.keys(deps);
+    const hasExpress = packages.includes("express");
+    const framework = hasExpress
+        ? "express"
+        : packages.length > 0
+            ? "other"
+            : "none";
+    const push = (f) => {
+        findings.push({
+            id: findingIdFor("pen", f.type, f.file ?? f.route, f.title),
+            source: "pen-static",
+            ...f,
+        });
+    };
+    // Secrets.
+    for (const hit of [...scanSecrets(repo), ...scanGenericKeys(repo)]) {
+        push({
+            type: hit.pattern.type,
+            severity: hit.pattern.severity,
+            confidence: "proven",
+            title: `${hit.pattern.name} committed to source`,
+            description: `${hit.pattern.name} found in ${path.relative(repo, hit.file).replace(/\\/g, "/")}:${hit.line} (${hit.value.slice(0, 12)}…). This credential is recoverable from git history and any CI log that runs the repo.`,
+            file: hit.file,
+            line: hit.line,
+            repro: `grep -n "${hit.value.slice(0, 12)}" "${path.relative(repo, hit.file).replace(/\\/g, "/")}"`,
+            fix: "Rotate the credential NOW (it may already be compromised), remove it from source, and move it to an environment variable / secret manager. Add the value to .gitignore'd .env and to a secrets policy so it never returns.",
+        });
+    }
+    // Per-file pattern rules.
+    const codeLines = [];
+    for (const file of allFiles) {
+        let content;
+        try {
+            content = fs.readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        content.split(/\r?\n/).forEach((text, i) => {
+            const t = text.trim();
+            if (!t || t.startsWith("//") || t.startsWith("#") || t.startsWith("*"))
+                return;
+            codeLines.push({ file, line: i + 1, text: t });
+        });
+    }
+    const seenPattern = new Set();
+    for (const entry of PATTERNS) {
+        for (const { file, line, text } of codeLines) {
+            if (!entry.re.test(text))
+                continue;
+            if (entry.requiresUserInput && !hasUserInput(text))
+                continue;
+            if (entry.type === "arbitrary-code-execution" && /node_modules|\.test\.|spec\.|__tests__|dist\//.test(file))
+                continue;
+            const rule = TYPES_WITH_RE.get(entry.type);
+            if (!rule)
+                continue;
+            const key = `${entry.type}|${path.relative(repo, file)}|${line}`;
+            if (seenPattern.has(key))
+                continue;
+            seenPattern.add(key);
+            push({
+                type: rule.type,
+                severity: rule.severity,
+                confidence: rule.confidence,
+                title: rule.title,
+                description: rule.describe(file, line, entry.re.exec(text)) + ` (${path.relative(repo, file).replace(/\\/g, "/")}:${line})`,
+                file,
+                line,
+                repro: `open ${path.relative(repo, file).replace(/\\/g, "/")}:${line}`,
+                fix: rule.fix,
+            });
+        }
+    }
+    // Whole-file config hygiene (JS only, express-aware).
+    const seenFileRule = new Set();
+    for (const file of jsFiles) {
+        let content;
+        try {
+            content = fs.readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const c = content;
+        if (/cors\s*\(\s*\)|origin\s*:\s*["']\*["']/.test(c)) {
+            const line = findLineOf(c, /cors\s*\(\s*\)|origin\s*:\s*["']\*["']/);
+            const rule = TYPES_WITH_RE.get("insecure-cors");
+            const key = `insecure-cors|${file}`;
+            if (!seenFileRule.has(key)) {
+                seenFileRule.add(key);
+                push({
+                    type: rule.type,
+                    severity: rule.severity,
+                    confidence: rule.confidence,
+                    title: rule.title,
+                    description: rule.describe(file, line, null),
+                    file,
+                    line,
+                    fix: rule.fix,
+                });
+            }
+        }
+        if (hasExpress && !/\bhelmet\s*\(/.test(c) && !/\bapp\.use\s*\(\s*helmet/.test(c) && /\bexpress\s*\(/.test(c)) {
+            const line = findLineOf(c, /\bexpress\s*\(/);
+            const rule = TYPES_WITH_RE.get("missing-security-headers");
+            const key = `missing-security-headers|${file}`;
+            if (!seenFileRule.has(key)) {
+                seenFileRule.add(key);
+                push({
+                    type: rule.type,
+                    severity: rule.severity,
+                    confidence: rule.confidence,
+                    title: rule.title,
+                    description: rule.describe(file, line, null),
+                    file,
+                    line,
+                    fix: rule.fix,
+                });
+            }
+        }
+        if (/res\.cookie\s*\(/.test(c) && !/\bhttpOnly\s*:\s*true/.test(c)) {
+            const line = findLineOf(c, /res\.cookie\s*\(/);
+            const rule = TYPES_WITH_RE.get("cookie-without-httponly");
+            const key = `cookie-without-httponly|${file}`;
+            if (!seenFileRule.has(key)) {
+                seenFileRule.add(key);
+                push({
+                    type: rule.type,
+                    severity: rule.severity,
+                    confidence: rule.confidence,
+                    title: rule.title,
+                    description: rule.describe(file, line, null),
+                    file,
+                    line,
+                    fix: rule.fix,
+                });
+            }
+        }
+        if (/console\.(?:log|debug|info)\([^)]*process\.env/.test(c)) {
+            const line = findLineOf(c, /console\.(?:log|debug|info)\([^)]*process\.env/);
+            const rule = TYPES_WITH_RE.get("info-leak");
+            const key = `info-leak|${file}`;
+            if (!seenFileRule.has(key)) {
+                seenFileRule.add(key);
+                push({
+                    type: rule.type,
+                    severity: rule.severity,
+                    confidence: rule.confidence,
+                    title: rule.title,
+                    description: rule.describe(file, line, null),
+                    file,
+                    line,
+                    fix: rule.fix,
+                });
+            }
+        }
+    }
+    // no-rate-limit: package-level rule.
+    if (!packages.includes("express-rate-limit") && routes.some((r) => r.loginLike)) {
+        const rule = STATIC_RULES.find((r) => r.type === "no-rate-limit");
+        push({
+            type: rule.type,
+            severity: rule.severity,
+            confidence: rule.confidence,
+            title: rule.title,
+            description: rule.describe(repo, 0, null) + ` Login-ish routes: ${routes.filter((r) => r.loginLike).slice(0, 3).map((r) => `${r.method} ${r.path}`).join(", ")}.`,
+            fix: rule.fix,
+        });
+    }
+    return { findings, routes, framework, packages };
+}
+function findLineOf(content, re) {
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++)
+        if (re.test(lines[i]))
+            return i + 1;
+    return 1;
+}
+//# sourceMappingURL=static.js.map

package/dist/pen/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/pen/static.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/D,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AAaxB,MAAM,eAAe,GAAoB;IACvC;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,UAAU;QACpB,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,gBAAgB;KACvB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,UAAU;QACpB,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE,cAAc;KACrB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,qCAAqC;QACzC,IAAI,EAAE,wBAAwB;KAC/B;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,4DAA4D;QAChE,IAAI,EAAE,mBAAmB;KAC1B;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,gBAAgB;KACvB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,aAAa;KACpB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,UAAU;QACpB,EAAE,EAAE,wDAAwD;QAC5D,IAAI,EAAE,mBAAmB;KAC1B;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,cAAc,GAClB,wHAAwH,CAAC;AAC3H,MAAM,YAAY,GAAG,+CAA+C,CAAC;AASrE,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,6DAA6D;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC3F,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3B,IAAI,CAAC,CAAC;oBAAE,SAAS;gBACjB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,2EAA2E,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5H,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,2EAA2E,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACnH,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;wBAAE,SAAS;gBAC/D,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpD,MAAM,CAAC,gCAAgC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,cAAc,GAClB,kHAAkH,CAAC;AAErH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YACrE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7D,wEAAwE;YACxE,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7C,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI;gBACJ,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,MAAM;oBAChB,EAAE,EAAE,cAAc;oBAClB,IAAI,EAAE,sBAAsB;iBAC7B;gBACD,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,eAAe,GAAG;IACtB,OAAO;IACP,WAAW;IACX,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,SAAS;IACT,QAAQ;IACR,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAEhG,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,CAAS,EAAE,IAAY,EAAE,EAAE;QACpE,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,CAAC;YACP,IAAI;YACJ,IAAI;YACJ,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzD,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SACtD,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD,MAAM,YAAY,GAAiB;IACjC;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,GAAG,EAAE,CAAC,sMAAsM;QACtN,GAAG,EAAE,gOAAgO;KACtO;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,yCAAyC;QAChD,QAAQ,EAAE,GAAG,EAAE,CAAC,4KAA4K;QAC5L,GAAG,EAAE,qJAAqJ;KAC3J;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,6BAA6B;QACpC,QAAQ,EAAE,GAAG,EAAE,CAAC,kJAAkJ;QAClK,GAAG,EAAE,4FAA4F;KAClG;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,0CAA0C;QACjD,QAAQ,EAAE,GAAG,EAAE,CAAC,0JAA0J;QAC1K,GAAG,EAAE,2HAA2H;KACjI;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,GAAG,EAAE,CAAC,qJAAqJ;QACrK,GAAG,EAAE,8EAA8E;KACpF;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,yCAAyC;QAChD,QAAQ,EAAE,GAAG,EAAE,CAAC,0JAA0J;QAC1K,GAAG,EAAE,6IAA6I;KACnJ;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,mCAAmC;QAC1C,QAAQ,EAAE,GAAG,EAAE,CAAC,qJAAqJ;QACrK,GAAG,EAAE,mGAAmG;KACzG;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,iDAAiD;QACxD,QAAQ,EAAE,GAAG,EAAE,CAAC,kKAAkK;QAClL,GAAG,EAAE,sKAAsK;KAC5K;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,8CAA8C;QACrD,QAAQ,EAAE,GAAG,EAAE,CAAC,8IAA8I;QAC9J,GAAG,EAAE,kKAAkK;KACxK;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,+CAA+C;QACtD,QAAQ,EAAE,GAAG,EAAE,CAAC,6KAA6K;QAC7L,GAAG,EAAE,yLAAyL;KAC/L;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,qCAAqC;QAC5C,QAAQ,EAAE,GAAG,EAAE,CAAC,4IAA4I;QAC5J,GAAG,EAAE,wKAAwK;KAC9K;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,uCAAuC;QAC9C,QAAQ,EAAE,GAAG,EAAE,CAAC,mKAAmK;QACnL,GAAG,EAAE,2HAA2H;KACjI;CACF,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC/E,CAAC;AASF,MAAM,QAAQ,GAAmB;IAC/B,0EAA0E;IAC1E;QACE,IAAI,EAAE,eAAe;QACrB,EAAE,EAAE,qGAAqG;QACzG,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,EAAE,EAAE,oFAAoF;QACxF,iBAAiB,EAAE,IAAI;KACxB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,EAAE,EAAE,6FAA6F;QACjG,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,EAAE,EAAE,mDAAmD;QACvD,iBAAiB,EAAE,IAAI;KACxB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,EAAE,EAAE,2IAA2I;QAC/I,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,EAAE,EAAE,iJAAiJ;QACrJ,iBAAiB,EAAE,IAAI;KACxB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,gIAAgI;QACpI,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,4HAA4H;QAChI,iBAAiB,EAAE,IAAI;KACxB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,8DAA8D;QAClE,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,wEAAwE;QAC5E,iBAAiB,EAAE,IAAI;KACxB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,EAAE,EAAE,yEAAyE;QAC7E,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,EAAE,EAAE,oCAAoC;QACxC,iBAAiB,EAAE,KAAK;KACzB;CACF,CAAC;AAEF,MAAM,aAAa,GACjB,+HAA+H,CAAC;AAElI,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAE1C,IAAI,GAAG,GAAQ,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,SAAS,GAAkC,UAAU;QACzD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,MAAM,CAAC;IAEb,MAAM,IAAI,GAAG,CAAC,CAAoC,EAAE,EAAE;QACpD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;YAC3D,MAAM,EAAE,YAAY;YACpB,GAAG,CAAC;SACL,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,WAAW;IACX,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;YAC9B,UAAU,EAAE,QAAiB;YAC7B,KAAK,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,sBAAsB;YAChD,WAAW,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,wFAAwF;YAC7N,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG;YACnG,GAAG,EAAE,4NAA4N;SAClO,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,MAAM,SAAS,GAAwD,EAAE,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC/E,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,IAAI,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtH,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YACjE,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAqB,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;gBAC/I,IAAI;gBACJ,IAAI;gBACJ,KAAK,EAAE,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACtE,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,OAAO,CAAC;QAElB,IAAI,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;YACjD,MAAM,GAAG,GAAG,iBAAiB,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,CAAC;oBACH,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAa,CAAC;oBACrD,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,UAAU,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9G,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,0BAA0B,CAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,4BAA4B,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,CAAC;oBACH,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAa,CAAC;oBACrD,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,2BAA2B,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,CAAC;oBACH,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAa,CAAC;oBACrD,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,gDAAgD,CAAC,CAAC;YAC7E,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,aAAa,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,CAAC;oBACH,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAa,CAAC;oBACrD,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAE,CAAC;QACnE,IAAI,CAAC;YACH,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,IAAa,CAAC,GAAG,sBAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC1K,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,EAAU;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/pen/store.d.ts

@@ -0,0 +1,11 @@
+/**
+ * pen/store.ts — persistence for pen results (sealed evidence, like every
+ * other OpenPitStop artifact) and lookup helpers for `pitstop repro` / inspect.
+ */
+import type { PenFinding, PenResult } from "./types.js";
+export declare function persistPen(repo: string, result: PenResult): {
+    file: string;
+};
+export declare function loadPenLatest(repo: string): PenResult | null;
+export declare function enumeratePenFindings(r: PenResult): PenFinding[];
+export declare function resolvePenFinding(r: PenResult, id: string): PenFinding | null;

package/dist/pen/store.js

@@ -0,0 +1,36 @@
+/**
+ * pen/store.ts — persistence for pen results (sealed evidence, like every
+ * other OpenPitStop artifact) and lookup helpers for `pitstop repro` / inspect.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { seal } from "../evidence.js";
+export function persistPen(repo, result) {
+    const sealed = seal(result, `pitstop pen result for ${repo}`);
+    const outDir = path.join(repo, ".pitstop");
+    fs.mkdirSync(outDir, { recursive: true });
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const file = path.join(outDir, `pen-${ts}.json`);
+    const json = JSON.stringify(sealed, null, 2);
+    fs.writeFileSync(file, json);
+    fs.writeFileSync(path.join(outDir, "pen-latest.json"), json);
+    return { file };
+}
+export function loadPenLatest(repo) {
+    const p = path.join(repo, ".pitstop", "pen-latest.json");
+    if (!fs.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function enumeratePenFindings(r) {
+    return r.findings ?? [];
+}
+export function resolvePenFinding(r, id) {
+    return enumeratePenFindings(r).find((f) => f.id === id) ?? null;
+}
+//# sourceMappingURL=store.js.map

package/dist/pen/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/pen/store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGtC,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAiB;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAY;IAC/C,OAAO,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAY,EAAE,EAAU;IACxD,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AAClE,CAAC"}