supply-chain-guard 5.6.3 → 5.7.0

package/README.md

@@ -122,7 +122,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
 ```yaml
 repos:
   - repo: https://github.com/homeofe/supply-chain-guard
-    rev: v5.6.3
+    rev: v5.7.0
     hooks:
       - id: supply-chain-guard
 ```

package/dist/cli.js

@@ -20,7 +20,7 @@ const program = new commander_1.Command();
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.6.3");
+    .version("5.7.0");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/correlation-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"correlation-engine.d.ts","sourceRoot":"","sources":["../src/correlation-engine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAY,eAAe,EAAE,MAAM,YAAY,CAAC;AAqLrE,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAoDxE"}
+{"version":3,"file":"correlation-engine.d.ts","sourceRoot":"","sources":["../src/correlation-engine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAY,eAAe,EAAE,MAAM,YAAY,CAAC;AA+NrE,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAsDxE"}

package/dist/correlation-engine.js

@@ -102,6 +102,40 @@ const CORRELATION_RULES = [
         confidenceBoost: 0.20,
         narrative: "GitHub Actions workflow downloads and executes remote code while accessing secrets. CI/CD pipeline compromise risk.",
     },
+    // --- Cordyceps CI/CD composition (v5.7) ---
+    // The single-file GHA symptoms are individually valid YAML; the attack lives
+    // in how they compose. Any two of these together is a strong signal that a
+    // workflow is exploitable through a trust boundary crossing.
+    {
+        rules: [
+            "GHA_CROSS_WORKFLOW_ARTIFACT_TRUST",
+            "GHA_PWN_REQUEST_CHECKOUT",
+            "GHA_GITHUB_SCRIPT_INJECTION",
+            "GHA_PRIVILEGED_TRIGGER",
+            "GHA_SCRIPT_INJECTION",
+            "GHA_PERMS_WRITE_ALL",
+            "GHA_PERMS_DEFAULT_BROAD",
+        ],
+        minMatch: 2,
+        // The two hygiene rules (GHA_PRIVILEGED_TRIGGER, GHA_PERMS_DEFAULT_BROAD)
+        // always co-occur on an ordinary pull_request_target bot, so 2-of-7 alone
+        // would false-fire a critical incident on benign repos. Require at least one
+        // genuinely-independent strong signal to corroborate.
+        requireAnyOf: [
+            "GHA_CROSS_WORKFLOW_ARTIFACT_TRUST",
+            "GHA_PWN_REQUEST_CHECKOUT",
+            "GHA_GITHUB_SCRIPT_INJECTION",
+            "GHA_SCRIPT_INJECTION",
+            "GHA_PERMS_WRITE_ALL",
+        ],
+        incident: "Cordyceps CI/CD Composition Attack",
+        severity: "critical",
+        confidenceBoost: 0.25,
+        narrative: "Multiple GitHub Actions trust-boundary weaknesses combine into an exploitable chain: a privileged " +
+            "trigger runs attacker-influenced input or artifacts with secrets and a write token. This matches the " +
+            "Cordyceps composition pattern (novee.security, 2026) - no single line is wrong, but together they " +
+            "allow code execution or secret theft across a workflow trust boundary.",
+    },
     // --- Obfuscation + exfil = malware ---
     {
         rules: ["EVAL_ATOB", "HIGH_ENTROPY_STRING", "ENV_EXFILTRATION", "DEAD_DROP_TELEGRAM"],
@@ -170,7 +204,8 @@ function correlateFindings(findings) {
     for (const rule of CORRELATION_RULES) {
         const minMatch = rule.minMatch ?? rule.rules.length;
         const matchedRules = rule.rules.filter((r) => ruleSet.has(r));
-        if (matchedRules.length >= minMatch) {
+        const strongPresent = !rule.requireAnyOf || rule.requireAnyOf.some((r) => ruleSet.has(r));
+        if (matchedRules.length >= minMatch && strongPresent) {
             const id = `incident-${++clusterId}`;
             // Collect all findings matching this correlation
             const clusterFindings = findings.filter((f) => matchedRules.includes(f.rule));

package/dist/correlation-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"correlation-engine.js","sourceRoot":"","sources":["../src/correlation-engine.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAuMH,8CAoDC;AApOD,MAAM,iBAAiB,GAAsB;IAC3C,0BAA0B;IAC1B;QACE,KAAK,EAAE,CAAC,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,oJAAoJ;KAChK;IACD;QACE,KAAK,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACjG,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8CAA8C;QACxD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8IAA8I;KAC1J;IACD;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,yBAAyB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,gGAAgG;KAC5G;IAED,6BAA6B;IAC7B;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,CAAC;QAClH,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8JAA8J;KAC1K;IACD;QACE,KAAK,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACtE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,4BAA4B;QACtC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,+HAA+H;KAC3I;IAED,qCAAqC;IACrC;QACE,KAAK,EAAE,CAAC,2BAA2B,EAAE,sBAAsB,EAAE,qBAAqB,CAAC;QACnF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,mIAAmI;KAC/I;IACD;QACE,KAAK,EAAE,CAAC,2BAA2B,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;QACxF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,uCAAuC;QACjD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8IAA8I;KAC1J;IACD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;QAC5E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,yIAAyI;KACrJ;IAED,2BAA2B;IAC3B;QACE,KAAK,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,CAAC;QAClG,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,sCAAsC;QAChD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8HAA8H;KAC1I;IACD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,oBAAoB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,4GAA4G;KACxH;IAED,0BAA0B;IAC1B;QACE,KAAK,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACvE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,0BAA0B;QACpC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,qHAAqH;KACjI;IAED,wCAAwC;IACxC;QACE,KAAK,EAAE,CAAC,WAAW,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;QACrF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,4BAA4B;QACtC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,kHAAkH;KAC9H;IAED,2BAA2B;IAC3B;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;QACtH,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,2BAA2B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,6GAA6G;KACzH;IAED,kDAAkD;IAClD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;QACvD,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8BAA8B;QACxC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,iHAAiH;KAC7H;IAED,2CAA2C;IAC3C;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC;QACtE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,2BAA2B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8GAA8G;KAC1H;IACD;QACE,KAAK,EAAE,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,yBAAyB,CAAC;QACtF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,kCAAkC;QAC5C,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,0HAA0H;KACtI;IACD;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACpE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8BAA8B;QACxC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,wGAAwG;KACpH;CACF,CAAC;AAeF,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;GAEG;AACH,SAAgB,iBAAiB,CAAC,QAAmB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9D,IAAI,YAAY,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;YAErC,iDAAiD;YACjD,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAE9E,uCAAuC;YACvC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChC,CAAC,CAAC,aAAa,GAAG,EAAE,CAAC;gBACrB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;YAC7E,CAAC;YAED,gCAAgC;YAChC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAC1C,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAC,CAC3C,GAAG,eAAe,CAAC,MAAM,CAAC;YAE3B,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE;gBACF,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;gBACxC,QAAQ,EAAE,eAAe;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC;YAEH,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,mCAAmC,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACrI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAEpC,gCAAgC;IAChC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAEtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"correlation-engine.js","sourceRoot":"","sources":["../src/correlation-engine.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAiPH,8CAsDC;AA1QD,MAAM,iBAAiB,GAAsB;IAC3C,0BAA0B;IAC1B;QACE,KAAK,EAAE,CAAC,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,oJAAoJ;KAChK;IACD;QACE,KAAK,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACjG,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8CAA8C;QACxD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8IAA8I;KAC1J;IACD;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,yBAAyB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,gGAAgG;KAC5G;IAED,6BAA6B;IAC7B;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,CAAC;QAClH,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8JAA8J;KAC1K;IACD;QACE,KAAK,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACtE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,4BAA4B;QACtC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,+HAA+H;KAC3I;IAED,qCAAqC;IACrC;QACE,KAAK,EAAE,CAAC,2BAA2B,EAAE,sBAAsB,EAAE,qBAAqB,CAAC;QACnF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,mIAAmI;KAC/I;IACD;QACE,KAAK,EAAE,CAAC,2BAA2B,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;QACxF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,uCAAuC;QACjD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8IAA8I;KAC1J;IACD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;QAC5E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,yIAAyI;KACrJ;IAED,2BAA2B;IAC3B;QACE,KAAK,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,CAAC;QAClG,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,sCAAsC;QAChD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8HAA8H;KAC1I;IACD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,oBAAoB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,4GAA4G;KACxH;IAED,0BAA0B;IAC1B;QACE,KAAK,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACvE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,0BAA0B;QACpC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,qHAAqH;KACjI;IAED,6CAA6C;IAC7C,6EAA6E;IAC7E,2EAA2E;IAC3E,6DAA6D;IAC7D;QACE,KAAK,EAAE;YACL,mCAAmC;YACnC,0BAA0B;YAC1B,6BAA6B;YAC7B,wBAAwB;YACxB,sBAAsB;YACtB,qBAAqB;YACrB,yBAAyB;SAC1B;QACD,QAAQ,EAAE,CAAC;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,sDAAsD;QACtD,YAAY,EAAE;YACZ,mCAAmC;YACnC,0BAA0B;YAC1B,6BAA6B;YAC7B,sBAAsB;YACtB,qBAAqB;SACtB;QACD,QAAQ,EAAE,oCAAoC;QAC9C,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EACP,oGAAoG;YACpG,uGAAuG;YACvG,oGAAoG;YACpG,wEAAwE;KAC3E;IAED,wCAAwC;IACxC;QACE,KAAK,EAAE,CAAC,WAAW,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;QACrF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,4BAA4B;QACtC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,kHAAkH;KAC9H;IAED,2BAA2B;IAC3B;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;QACtH,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,2BAA2B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,6GAA6G;KACzH;IAED,kDAAkD;IAClD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;QACvD,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8BAA8B;QACxC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,iHAAiH;KAC7H;IAED,2CAA2C;IAC3C;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC;QACtE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,2BAA2B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8GAA8G;KAC1H;IACD;QACE,KAAK,EAAE,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,yBAAyB,CAAC;QACtF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,kCAAkC;QAC5C,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,0HAA0H;KACtI;IACD;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACpE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8BAA8B;QACxC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,wGAAwG;KACpH;CACF,CAAC;AAeF,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;GAEG;AACH,SAAgB,iBAAiB,CAAC,QAAmB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,aAAa,GACjB,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtE,IAAI,YAAY,CAAC,MAAM,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;YAErC,iDAAiD;YACjD,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAE9E,uCAAuC;YACvC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChC,CAAC,CAAC,aAAa,GAAG,EAAE,CAAC;gBACrB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;YAC7E,CAAC;YAED,gCAAgC;YAChC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAC1C,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAC,CAC3C,GAAG,eAAe,CAAC,MAAM,CAAC;YAE3B,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE;gBACF,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;gBACxC,QAAQ,EAAE,eAAe;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC;YAEH,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,mCAAmC,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACrI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAEpC,gCAAgC;IAChC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAEtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC"}

package/dist/github-actions-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-actions-scanner.d.ts","sourceRoot":"","sources":["../src/github-actions-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,YAAY,CAAC;AAwMpD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAgCjE"}
+{"version":3,"file":"github-actions-scanner.d.ts","sourceRoot":"","sources":["../src/github-actions-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,YAAY,CAAC;AA6MpD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAgCjE"}

package/dist/github-actions-scanner.js

@@ -43,6 +43,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanGitHubActionsWorkflows = scanGitHubActionsWorkflows;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const workflow_ast_js_1 = require("./workflow-ast.js");
 /**
  * Patterns for detecting dangerous content in GitHub Actions workflow files.
  */
@@ -145,10 +146,14 @@ const WORKFLOW_PATTERNS = [
         severity: "critical",
         rule: "GHA_PPE_PULL_TARGET",
     },
-    // Script injection via user-controlled context (issue body, PR title, commit message)
+    // Script injection via user-controlled context (issue/PR body, PR/commit title,
+    // comment body, review body, discussion, PR head ref/label). v5.7 broadened the
+    // object list (added comment/review/discussion) and the field list (added
+    // label/ref/description) - the pre-v5.7 regex missed the issue_comment vector
+    // (github.event.comment.body) entirely.
     {
-        pattern: "\\$\\{\\{\\s*github\\.event\\.(?:issue|pull_request|head_commit|commits?)\\.[^}]*(?:body|title|message|name)\\s*\\}\\}",
-        description: "User-controlled GitHub event data (issue/PR body, commit message) injected directly into a run: step — GitHub Actions Script Injection risk",
+        pattern: "\\$\\{\\{\\s*github\\.event\\.(?:issue|pull_request|head_commit|commits?|comment|review|discussion)\\.[^}]*(?:body|title|message|name)\\s*\\}\\}",
+        description: "User-controlled GitHub event data (issue/PR body, comment body, PR title, commit message) injected directly into a run: step — GitHub Actions Script Injection risk",
         severity: "critical",
         rule: "GHA_SCRIPT_INJECTION",
     },
@@ -264,6 +269,144 @@ function scanWorkflowContent(content, relativePath, findings) {
     checkActionReferences(lines, relativePath, findings);
     // Check for secrets sent to external URLs across multi-line run blocks
     checkSecretsExfiltration(lines, relativePath, findings);
+    // v5.7: structural, trigger-aware rules (Cordyceps class) — these need to
+    // know which event fires the workflow and what its token can do, which the
+    // line-by-line passes above are blind to.
+    checkWorkflowAstRules(content, relativePath, findings);
+}
+// ── v5.7 Cordyceps trigger-aware rules ──────────────────────────────────────
+/**
+ * Triggers that run in the BASE repository context with access to secrets and
+ * a read+write GITHUB_TOKEN (unlike plain `pull_request`, which runs in the
+ * fork context with a read-only token). These are the elevated-privilege
+ * entry points the Cordyceps composition attacks abuse.
+ */
+const PRIVILEGED_TRIGGERS = [
+    "pull_request_target",
+    "workflow_run",
+    "issue_comment",
+    "pull_request_review_comment",
+];
+/** Triggers where checking out untrusted PR/head code executes it WITH secrets. */
+const PWN_CHECKOUT_TRIGGERS = ["pull_request_target", "workflow_run", "issue_comment"];
+/**
+ * A `with: ref:` value that resolves to attacker-controlled PR/head code.
+ * Covers the head ref/sha, the numeric `refs/pull/N/merge|head` form, and
+ * indirection through a matrix var / step output / needs output (all common
+ * pwn-request evasions). Deliberately excludes the base ref (github.sha /
+ * github.ref) which points at the trusted default branch.
+ */
+const PR_HEAD_REF_RE = /github\.head_ref|github\.event\.pull_request\.head|github\.event\.workflow_run\.head|github\.event\.(?:pull_request\.number|number)|refs\/pull\/|\$\{\{\s*(?:matrix|steps|needs)\./;
+/** Untrusted context interpolated inside an actions/github-script `script:` body. */
+const UNTRUSTED_CTX_RE = /\$\{\{\s*github\.(?:event\.(?:issue|pull_request|comment|review|discussion|head_commit|commits?)|head_ref|ref_name)\b/;
+/**
+ * Structural rules that depend on the workflow's trigger and token model.
+ * Parsed once per file via the zero-dependency workflow-ast parser.
+ */
+function checkWorkflowAstRules(content, relativePath, findings) {
+    let ast;
+    try {
+        ast = (0, workflow_ast_js_1.parseWorkflow)(content);
+    }
+    catch {
+        return; // never let a parse hiccup break the scan
+    }
+    const lines = content.split("\n");
+    const findLine = (re) => {
+        for (let i = 0; i < lines.length; i++) {
+            if (re.test(lines[i] ?? ""))
+                return i + 1;
+        }
+        return undefined;
+    };
+    const triggerSet = new Set(ast.triggers);
+    const privileged = PRIVILEGED_TRIGGERS.filter((t) => triggerSet.has(t));
+    // GHA_PRIVILEGED_TRIGGER — the workflow runs in an elevated context.
+    if (privileged.length > 0) {
+        findings.push({
+            rule: "GHA_PRIVILEGED_TRIGGER",
+            description: `Workflow is triggered by ${privileged.join(", ")}, which runs in the base repository ` +
+                `context with access to secrets and a read/write GITHUB_TOKEN. This is the elevated entry ` +
+                `point Cordyceps-style attacks abuse; every step here is security-sensitive.`,
+            severity: "low",
+            file: relativePath,
+            line: findLine(new RegExp(`\\b(?:${privileged.join("|")})\\b`)) ?? 1,
+            match: privileged.join(", "),
+            recommendation: getWorkflowRecommendation("GHA_PRIVILEGED_TRIGGER"),
+        });
+    }
+    // GHA_PWN_REQUEST_CHECKOUT — privileged trigger checks out attacker PR/head code.
+    const hasPwnTrigger = ast.triggers.some((t) => PWN_CHECKOUT_TRIGGERS.includes(t));
+    if (hasPwnTrigger) {
+        for (const job of ast.jobs) {
+            for (const step of job.steps) {
+                if (step.uses && /checkout/i.test(step.uses) &&
+                    step.withRef && PR_HEAD_REF_RE.test(step.withRef)) {
+                    findings.push({
+                        rule: "GHA_PWN_REQUEST_CHECKOUT",
+                        description: `Privileged workflow checks out attacker-controlled PR/head code ` +
+                            `(ref: ${truncateMatch(step.withRef, 60)}) and then runs it with secrets in scope. ` +
+                            `This is the canonical "pwn request" - remote code execution with the maintainer token.`,
+                        severity: "critical",
+                        file: relativePath,
+                        line: step.line,
+                        match: truncateMatch(step.withRef),
+                        recommendation: getWorkflowRecommendation("GHA_PWN_REQUEST_CHECKOUT"),
+                    });
+                }
+            }
+        }
+    }
+    // GHA_GITHUB_SCRIPT_INJECTION — untrusted context eval'd as JS by github-script.
+    for (const job of ast.jobs) {
+        for (const step of job.steps) {
+            if (step.uses && /github-script/i.test(step.uses) &&
+                step.withScript && UNTRUSTED_CTX_RE.test(step.withScript)) {
+                findings.push({
+                    rule: "GHA_GITHUB_SCRIPT_INJECTION",
+                    description: `actions/github-script step evaluates untrusted GitHub event context as JavaScript at ` +
+                        `runtime (code injection). An attacker who controls that context executes arbitrary code ` +
+                        `with the workflow token.`,
+                    severity: "high",
+                    file: relativePath,
+                    line: step.line,
+                    recommendation: getWorkflowRecommendation("GHA_GITHUB_SCRIPT_INJECTION"),
+                });
+            }
+        }
+    }
+    // GHA_PERMS_WRITE_ALL — the token is granted every scope.
+    if (ast.permissions.writeAll || ast.jobs.some((j) => j.permissions.writeAll)) {
+        findings.push({
+            rule: "GHA_PERMS_WRITE_ALL",
+            description: `Workflow grants "permissions: write-all", giving the GITHUB_TOKEN write access to every scope ` +
+                `(contents, packages, actions, pages, deployments...). If any step is compromised, the blast ` +
+                `radius is the whole repository.`,
+            severity: "high",
+            file: relativePath,
+            line: findLine(/permissions:\s*write-all/) ?? 1,
+            match: "write-all",
+            recommendation: getWorkflowRecommendation("GHA_PERMS_WRITE_ALL"),
+        });
+    }
+    // GHA_PERMS_DEFAULT_BROAD — privileged trigger with no explicit least-privilege.
+    // Fire when there is no top-level permissions block AND at least one job runs
+    // without its own block (inheriting the broad repo default). A single sibling
+    // job declaring permissions must not silence the rule for the jobs that don't.
+    const topPermsDeclared = ast.permissions.declared;
+    const someJobUnprotected = ast.jobs.length === 0 || ast.jobs.some((j) => !j.permissions.declared);
+    if (privileged.length > 0 && !topPermsDeclared && someJobUnprotected) {
+        findings.push({
+            rule: "GHA_PERMS_DEFAULT_BROAD",
+            description: `Privileged workflow (${privileged.join(", ")}) declares no explicit permissions, so the ` +
+                `GITHUB_TOKEN falls back to the repository default - frequently read+write across all scopes. ` +
+                `Combined with an elevated trigger, that default is loot for a Cordyceps-style compromise.`,
+            severity: "medium",
+            file: relativePath,
+            line: findLine(new RegExp(`\\b(?:${privileged.join("|")})\\b`)) ?? 1,
+            recommendation: getWorkflowRecommendation("GHA_PERMS_DEFAULT_BROAD"),
+        });
+    }
 }
 /**
  * Check workflow content against known dangerous patterns.
@@ -524,6 +667,18 @@ function getWorkflowRecommendation(rule) {
             "to persist malicious code. Investigate immediately and audit recent workflow file changes.",
         GHA_KNOWN_MALICIOUS_SHA: "Replace this action immediately and rotate all secrets accessible during builds that used this action. " +
             "File a security incident report and review all build logs for exfiltrated data.",
+        GHA_PRIVILEGED_TRIGGER: "Treat every step in this workflow as running with production privileges. Prefer 'pull_request' over " +
+            "'pull_request_target' for untrusted contributions, set an explicit least-privilege 'permissions:' block, " +
+            "and gate privileged jobs behind manual approval (environments) for first-time contributors.",
+        GHA_PWN_REQUEST_CHECKOUT: "Never check out PR/head code inside a privileged (pull_request_target/workflow_run) workflow. Move build/test " +
+            "of untrusted code to a 'pull_request' workflow (read-only token, no secrets), or split into a privileged job " +
+            "that does NOT run the checked-out code. If you must, gate it behind an environment approval.",
+        GHA_GITHUB_SCRIPT_INJECTION: "Do not interpolate ${{ github.event... }} directly into an actions/github-script 'script:' block - it is eval'd " +
+            "as JavaScript. Pass the value through an env var and read process.env inside the script instead.",
+        GHA_PERMS_WRITE_ALL: "Remove 'permissions: write-all'. Declare the minimal scopes each job needs (e.g. 'contents: read'). Default the " +
+            "top-level permissions to read-only and grant write only where required.",
+        GHA_PERMS_DEFAULT_BROAD: "Add an explicit top-level 'permissions:' block scoped to the minimum (start from 'contents: read'). Privileged " +
+            "triggers should never rely on the repository default token, which is often read+write across all scopes.",
     };
     return map[rule] ?? "Review this finding and assess whether it represents legitimate CI/CD functionality.";
 }

package/dist/github-actions-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-actions-scanner.js","sourceRoot":"","sources":["../src/github-actions-scanner.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgNH,gEAgCC;AA9OD,4CAA8B;AAC9B,gDAAkC;AAGlC;;GAEG;AACH,MAAM,iBAAiB,GAMlB;IACH,0CAA0C;IAC1C;QACE,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;KAC3B;IACD;QACE,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;KAC3B;IACD;QACE,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,wBAAwB;KAC/B;IACD;QACE,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,wBAAwB;KAC/B;IAED,mCAAmC;IACnC;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,8DAA8D;QAC3E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,8DAA8D;QAC3E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IAED,0BAA0B;IAC1B;QACE,OAAO,EAAE,iEAAiE;QAC1E,WAAW,EAAE,qEAAqE;QAClF,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;KAC3B;IACD;QACE,OAAO,EAAE,+DAA+D;QACxE,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,gBAAgB;KACvB;IAED,uFAAuF;IACvF;QACE,OAAO,EAAE,gGAAgG;QACzG,WAAW,EAAE,oFAAoF;QACjG,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,eAAe;KACtB;IAED,4BAA4B;IAC5B;QACE,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,qEAAqE;QAClF,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,mBAAmB;KAC1B;IACD;QACE,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,iBAAiB;KACxB;IAED,yEAAyE;IAEzE,oFAAoF;IACpF;QACE,OAAO,EAAE,+CAA+C;QACxD,WAAW,EACT,8GAA8G;YAC9G,0DAA0D;QAC5D,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qBAAqB;KAC5B;IACD,sFAAsF;IACtF;QACE,OAAO,EAAE,wHAAwH;QACjI,WAAW,EACT,6IAA6I;QAC/I,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,sBAAsB;KAC7B;IACD,kFAAkF;IAClF;QACE,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sHAAsH;YACtH,oFAAoF;QACtF,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,qBAAqB;KAC5B;IACD,sEAAsE;IACtE;QACE,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EACT,+DAA+D;YAC/D,0GAA0G;QAC5G,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,qBAAqB;KAC5B;IACD,4FAA4F;IAC5F;QACE,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,4FAA4F;YAC5F,+DAA+D;QACjE,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,uBAAuB;KAC9B;IACD,yDAAyD;IACzD;QACE,OAAO,EAAE,gEAAgE;QACzE,WAAW,EACT,oIAAoI;QACtI,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,iBAAiB;KACxB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAiB;IAC1D,+EAA+E;IAC/E,6EAA6E;IAC7E,CAAC,0CAA0C,EAAE,gDAAgD,CAAC;IAC9F,CAAC,0CAA0C,EAAE,wDAAwD,CAAC;IACtG,0EAA0E;IAC1E,CAAC,0CAA0C,EAAE,gDAAgD,CAAC;CAC/F,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,aAAa;IACb,uBAAuB;IACvB,WAAW;IACX,QAAQ;IACR,MAAM;IACN,WAAW;IACX,SAAS;IACT,WAAW;IACX,aAAa;IACb,WAAW;CACZ,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAE7E,8DAA8D;AAC9D,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;GAGG;AACH,SAAgB,0BAA0B,CAAC,GAAW;IACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAE3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,SAAS;QAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,iEAAiE;IACjE,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAErD,6CAA6C;IAC7C,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAErD,uEAAuE;IACvE,wBAAwB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,KAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QAEhE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,kEAAkE;YAClE,gEAAgE;YAChE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAE3B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC9B,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aAC7C,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aAClD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,qEAAqE;YACrE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,KAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEjC,yCAAyC;QACzC,IAAI,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,SAAS;QACX,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7C,0EAA0E;QAC1E,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,WAAW,EAAE,WAAW,SAAS,gDAAgD,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,oCAAoC;gBACzJ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC;gBAC/B,cAAc,EACZ,uGAAuG;oBACvG,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EAAE,WAAW,SAAS,+BAA+B,GAAG,gGAAgG;gBACnK,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC;gBAC/B,cAAc,EACZ,qJAAqJ;aACxJ,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,QAAQ,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,WAAW,SAAS,uGAAuG;oBACxI,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC;oBAC/B,cAAc,EACZ,uHAAuH;iBAC1H,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,0DAA0D;YAC1D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,WAAW,EAAE,WAAW,SAAS,gCAAgC,KAAK,4CAA4C;gBAClH,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACxC,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC;gBAC/B,cAAc,EAAE,aAAa;oBAC3B,CAAC,CAAC,2FAA2F,UAAU,IAAI;oBAC3G,CAAC,CAAC,QAAQ,SAAS,yEAAyE;aAC/F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAC/B,KAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,MAAM,aAAa,GAAG,8BAA8B,CAAC;IACrD,MAAM,cAAc,GAAG,wCAAwC,CAAC;IAChE,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;IAE5D,mEAAmE;IACnE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,oDAAoD;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE5B,uCAAuC;QACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhE,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,GAAG,IAAI,CAAC;YAClB,aAAa,GAAG,CAAC,CAAC;YAClB,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC5C,kBAAkB,GAAG,KAAK,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,yDAAyD;YACzD,UAAU,GAAG,KAAK,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,qEAAqE;YACrE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;YACzD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,mBAAmB;gBACnB,IAAI,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;oBAC7C,yDAAyD;oBACzD,kCAAkC;oBAClC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;wBAC9D,CAAC,CAAC,IAAI,KAAK,YAAY;wBACvB,CAAC,CAAC,IAAI,KAAK,SAAS;wBACpB,CAAC,CAAC,IAAI,IAAI,aAAa,GAAG,CAAC;wBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,CACd,CAAC;oBACF,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,4BAA4B;4BAClC,WAAW,EAAE,yGAAyG;4BACtH,QAAQ,EAAE,MAAM;4BAChB,IAAI,EAAE,YAAY;4BAClB,IAAI,EAAE,aAAa,GAAG,CAAC;4BACvB,cAAc,EACZ,sHAAsH;yBACzH,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,UAAU,GAAG,KAAK,CAAC;YACrB,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,kBAAkB,GAAG,IAAI,CAAC;gBACxD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,kBAAkB,GAAG,IAAI,CAAC;gBAEzD,2DAA2D;gBAC3D,IAAI,kBAAkB,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,kBAAkB,GAAG,IAAI,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,UAAU,IAAI,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;YAC9D,CAAC,CAAC,IAAI,KAAK,YAAY,CAC1B,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,yGAAyG;gBACtH,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,aAAa,GAAG,CAAC;gBACvB,cAAc,EACZ,sHAAsH;aACzH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAA2B;QAClC,kBAAkB,EAChB,yGAAyG;QAC3G,kBAAkB,EAChB,yGAAyG;QAC3G,sBAAsB,EACpB,wGAAwG;QAC1G,sBAAsB,EACpB,wGAAwG;QAC1G,eAAe,EACb,uGAAuG;QACzG,eAAe,EACb,gHAAgH;QAClH,kBAAkB,EAChB,wGAAwG;QAC1G,eAAe,EACb,uGAAuG;QACzG,cAAc,EACZ,sGAAsG;QACxG,aAAa,EACX,6GAA6G;QAC/G,iBAAiB,EACf,uGAAuG;QACzG,eAAe,EACb,wFAAwF;QAC1F,mBAAmB,EACjB,uFAAuF;YACvF,iFAAiF;QACnF,oBAAoB,EAClB,oHAAoH;YACpH,+GAA+G;QACjH,mBAAmB,EACjB,wGAAwG;YACxG,2EAA2E;QAC7E,mBAAmB,EACjB,iGAAiG;YACjG,8DAA8D;QAChE,qBAAqB,EACnB,qFAAqF;YACrF,6EAA6E;QAC/E,eAAe,EACb,0GAA0G;YAC1G,4FAA4F;QAC9F,uBAAuB,EACrB,yGAAyG;YACzG,iFAAiF;KACpF,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,sFAAsF,CAAC;AAC7G,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,MAAM,GAAG,GAAG;IAChD,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"github-actions-scanner.js","sourceRoot":"","sources":["../src/github-actions-scanner.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqNH,gEAgCC;AAnPD,4CAA8B;AAC9B,gDAAkC;AAElC,uDAAkD;AAElD;;GAEG;AACH,MAAM,iBAAiB,GAMlB;IACH,0CAA0C;IAC1C;QACE,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;KAC3B;IACD;QACE,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;KAC3B;IACD;QACE,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,wBAAwB;KAC/B;IACD;QACE,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,wBAAwB;KAC/B;IAED,mCAAmC;IACnC;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,8DAA8D;QAC3E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,8DAA8D;QAC3E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IACD;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,6DAA6D;QAC1E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IAED,0BAA0B;IAC1B;QACE,OAAO,EAAE,iEAAiE;QAC1E,WAAW,EAAE,qEAAqE;QAClF,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;KAC3B;IACD;QACE,OAAO,EAAE,+DAA+D;QACxE,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACxB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,gBAAgB;KACvB;IAED,uFAAuF;IACvF;QACE,OAAO,EAAE,gGAAgG;QACzG,WAAW,EAAE,oFAAoF;QACjG,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,eAAe;KACtB;IAED,4BAA4B;IAC5B;QACE,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,qEAAqE;QAClF,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,mBAAmB;KAC1B;IACD;QACE,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,iBAAiB;KACxB;IAED,yEAAyE;IAEzE,oFAAoF;IACpF;QACE,OAAO,EAAE,+CAA+C;QACxD,WAAW,EACT,8GAA8G;YAC9G,0DAA0D;QAC5D,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qBAAqB;KAC5B;IACD,gFAAgF;IAChF,gFAAgF;IAChF,0EAA0E;IAC1E,8EAA8E;IAC9E,wCAAwC;IACxC;QACE,OAAO,EAAE,kJAAkJ;QAC3J,WAAW,EACT,qKAAqK;QACvK,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,sBAAsB;KAC7B;IACD,kFAAkF;IAClF;QACE,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sHAAsH;YACtH,oFAAoF;QACtF,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,qBAAqB;KAC5B;IACD,sEAAsE;IACtE;QACE,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EACT,+DAA+D;YAC/D,0GAA0G;QAC5G,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,qBAAqB;KAC5B;IACD,4FAA4F;IAC5F;QACE,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,4FAA4F;YAC5F,+DAA+D;QACjE,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,uBAAuB;KAC9B;IACD,yDAAyD;IACzD;QACE,OAAO,EAAE,gEAAgE;QACzE,WAAW,EACT,oIAAoI;QACtI,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,iBAAiB;KACxB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAiB;IAC1D,+EAA+E;IAC/E,6EAA6E;IAC7E,CAAC,0CAA0C,EAAE,gDAAgD,CAAC;IAC9F,CAAC,0CAA0C,EAAE,wDAAwD,CAAC;IACtG,0EAA0E;IAC1E,CAAC,0CAA0C,EAAE,gDAAgD,CAAC;CAC/F,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,aAAa;IACb,uBAAuB;IACvB,WAAW;IACX,QAAQ;IACR,MAAM;IACN,WAAW;IACX,SAAS;IACT,WAAW;IACX,aAAa;IACb,WAAW;CACZ,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAE7E,8DAA8D;AAC9D,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;GAGG;AACH,SAAgB,0BAA0B,CAAC,GAAW;IACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAE3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,SAAS;QAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,iEAAiE;IACjE,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAErD,6CAA6C;IAC7C,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAErD,uEAAuE;IACvE,wBAAwB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAExD,0EAA0E;IAC1E,2EAA2E;IAC3E,0CAA0C;IAC1C,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG;IAC1B,qBAAqB;IACrB,cAAc;IACd,eAAe;IACf,6BAA6B;CAC9B,CAAC;AAEF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,CAAC,qBAAqB,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,cAAc,GAClB,oLAAoL,CAAC;AAEvL,qFAAqF;AACrF,MAAM,gBAAgB,GACpB,uHAAuH,CAAC;AAE1H;;;GAGG;AACH,SAAS,qBAAqB,CAC5B,OAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,+BAAa,EAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,0CAA0C;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAsB,EAAE;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,qEAAqE;IACrE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EACT,4BAA4B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;gBACvF,2FAA2F;gBAC3F,6EAA6E;YAC/E,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YACpE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,cAAc,EAAE,yBAAyB,CAAC,wBAAwB,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC7B,IACE,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBACxC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EACjD,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,0BAA0B;wBAChC,WAAW,EACT,kEAAkE;4BAClE,SAAS,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,4CAA4C;4BACpF,wFAAwF;wBAC1F,QAAQ,EAAE,UAAU;wBACpB,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;wBAClC,cAAc,EAAE,yBAAyB,CAAC,0BAA0B,CAAC;qBACtE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IACE,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7C,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EACzD,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,6BAA6B;oBACnC,WAAW,EACT,uFAAuF;wBACvF,0FAA0F;wBAC1F,0BAA0B;oBAC5B,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,cAAc,EAAE,yBAAyB,CAAC,6BAA6B,CAAC;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EACT,gGAAgG;gBAChG,8FAA8F;gBAC9F,iCAAiC;YACnC,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC;YAC/C,KAAK,EAAE,WAAW;YAClB,cAAc,EAAE,yBAAyB,CAAC,qBAAqB,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,gBAAgB,GAAG,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC;IAClD,MAAM,kBAAkB,GACtB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EACT,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C;gBAC1F,+FAA+F;gBAC/F,2FAA2F;YAC7F,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YACpE,cAAc,EAAE,yBAAyB,CAAC,yBAAyB,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,KAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QAEhE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,kEAAkE;YAClE,gEAAgE;YAChE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAE3B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC9B,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aAC7C,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aAClD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,qEAAqE;YACrE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,KAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEjC,yCAAyC;QACzC,IAAI,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,SAAS;QACX,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7C,0EAA0E;QAC1E,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,WAAW,EAAE,WAAW,SAAS,gDAAgD,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,oCAAoC;gBACzJ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC;gBAC/B,cAAc,EACZ,uGAAuG;oBACvG,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EAAE,WAAW,SAAS,+BAA+B,GAAG,gGAAgG;gBACnK,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC;gBAC/B,cAAc,EACZ,qJAAqJ;aACxJ,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,QAAQ,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,WAAW,SAAS,uGAAuG;oBACxI,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC;oBAC/B,cAAc,EACZ,uHAAuH;iBAC1H,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,0DAA0D;YAC1D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,WAAW,EAAE,WAAW,SAAS,gCAAgC,KAAK,4CAA4C;gBAClH,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACxC,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC;gBAC/B,cAAc,EAAE,aAAa;oBAC3B,CAAC,CAAC,2FAA2F,UAAU,IAAI;oBAC3G,CAAC,CAAC,QAAQ,SAAS,yEAAyE;aAC/F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAC/B,KAAe,EACf,YAAoB,EACpB,QAAmB;IAEnB,MAAM,aAAa,GAAG,8BAA8B,CAAC;IACrD,MAAM,cAAc,GAAG,wCAAwC,CAAC;IAChE,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;IAE5D,mEAAmE;IACnE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,oDAAoD;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE5B,uCAAuC;QACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhE,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,GAAG,IAAI,CAAC;YAClB,aAAa,GAAG,CAAC,CAAC;YAClB,cAAc,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC5C,kBAAkB,GAAG,KAAK,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,yDAAyD;YACzD,UAAU,GAAG,KAAK,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,qEAAqE;YACrE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;YACzD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,mBAAmB;gBACnB,IAAI,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;oBAC7C,yDAAyD;oBACzD,kCAAkC;oBAClC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;wBAC9D,CAAC,CAAC,IAAI,KAAK,YAAY;wBACvB,CAAC,CAAC,IAAI,KAAK,SAAS;wBACpB,CAAC,CAAC,IAAI,IAAI,aAAa,GAAG,CAAC;wBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,CACd,CAAC;oBACF,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,4BAA4B;4BAClC,WAAW,EAAE,yGAAyG;4BACtH,QAAQ,EAAE,MAAM;4BAChB,IAAI,EAAE,YAAY;4BAClB,IAAI,EAAE,aAAa,GAAG,CAAC;4BACvB,cAAc,EACZ,sHAAsH;yBACzH,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,UAAU,GAAG,KAAK,CAAC;YACrB,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,kBAAkB,GAAG,IAAI,CAAC;gBACxD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,kBAAkB,GAAG,IAAI,CAAC;gBAEzD,2DAA2D;gBAC3D,IAAI,kBAAkB,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,kBAAkB,GAAG,IAAI,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,UAAU,IAAI,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;YAC9D,CAAC,CAAC,IAAI,KAAK,YAAY,CAC1B,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,yGAAyG;gBACtH,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,aAAa,GAAG,CAAC;gBACvB,cAAc,EACZ,sHAAsH;aACzH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAA2B;QAClC,kBAAkB,EAChB,yGAAyG;QAC3G,kBAAkB,EAChB,yGAAyG;QAC3G,sBAAsB,EACpB,wGAAwG;QAC1G,sBAAsB,EACpB,wGAAwG;QAC1G,eAAe,EACb,uGAAuG;QACzG,eAAe,EACb,gHAAgH;QAClH,kBAAkB,EAChB,wGAAwG;QAC1G,eAAe,EACb,uGAAuG;QACzG,cAAc,EACZ,sGAAsG;QACxG,aAAa,EACX,6GAA6G;QAC/G,iBAAiB,EACf,uGAAuG;QACzG,eAAe,EACb,wFAAwF;QAC1F,mBAAmB,EACjB,uFAAuF;YACvF,iFAAiF;QACnF,oBAAoB,EAClB,oHAAoH;YACpH,+GAA+G;QACjH,mBAAmB,EACjB,wGAAwG;YACxG,2EAA2E;QAC7E,mBAAmB,EACjB,iGAAiG;YACjG,8DAA8D;QAChE,qBAAqB,EACnB,qFAAqF;YACrF,6EAA6E;QAC/E,eAAe,EACb,0GAA0G;YAC1G,4FAA4F;QAC9F,uBAAuB,EACrB,yGAAyG;YACzG,iFAAiF;QACnF,sBAAsB,EACpB,sGAAsG;YACtG,2GAA2G;YAC3G,6FAA6F;QAC/F,wBAAwB,EACtB,gHAAgH;YAChH,+GAA+G;YAC/G,8FAA8F;QAChG,2BAA2B,EACzB,kHAAkH;YAClH,kGAAkG;QACpG,mBAAmB,EACjB,kHAAkH;YAClH,yEAAyE;QAC3E,uBAAuB,EACrB,iHAAiH;YACjH,0GAA0G;KAC7G,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,sFAAsF,CAAC;AAC7G,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,MAAM,GAAG,GAAG;IAChD,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;AAC5C,CAAC"}

package/dist/index.d.ts

@@ -44,6 +44,8 @@ export { exportIncidentBundle, exportIncidentMarkdown, exportCsvSummary } from "
 export { buildAttackGraph, exportGraphMermaid } from "./attack-graph.js";
 export { validateFindings, promoteConfidence } from "./active-validation.js";
 export { modelWorkflows } from "./workflow-modeler.js";
+export { scanWorkflowGraph } from "./workflow-graph.js";
+export { parseWorkflow } from "./workflow-ast.js";
 export { checkHoneytokenAccess, getHoneytokenEnv } from "./secret-simulator.js";
 export { calculateOrgPosture } from "./posture-engine.js";
 export { loadRiskHistory, saveRiskHistory, analyzeRiskTrend } from "./continuous-monitor.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACzH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,WAAW,EACX,QAAQ,EACR,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACzH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,WAAW,EACX,QAAQ,EACR,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -7,8 +7,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectTrustSignals = exports.saveBaseline = exports.applyBaseline = exports.applyPolicy = exports.loadPolicyConfig = exports.calculateTrustBreakdown = exports.correlateFindings = exports.scanReleaseArtifacts = exports.analyzePublishingAnomalies = exports.levenshtein = exports.analyzeDependencyRisks = exports.analyzeInstallHooks = exports.scanReadmeLures = exports.parseGitHubUrl = exports.analyzeGitHubTrust = exports.checkBadVersion = exports.checkIOCBlocklist = exports.scanNuGetFiles = exports.scanComposerFiles = exports.scanRubyGemsFiles = exports.scanGoFiles = exports.scanCargoFiles = exports.shannonEntropy = exports.analyzeEntropy = exports.scanGitSecurity = exports.scanConfigFile = exports.scanConfigFiles = exports.scanDockerFile = exports.scanDockerFiles = exports.scanGitHubActionsWorkflows = exports.checkBunLockfile = exports.checkYarnLockfile = exports.checkPnpmLockfile = exports.checkNpmLockfile = exports.checkLockfile = exports.formatReport = exports.monitorWatchlist = exports.listWatchlist = exports.removeFromWatchlist = exports.addToWatchlist = exports.saveWatchlist = exports.loadWatchlist = exports.formatAlert = exports.checkWallet = exports.monitorWallet = exports.scanDependencyConfusion = exports.scanVscodeExtension = exports.scanPypiPackage = exports.scanNpmPackage = exports.scan = void 0;
-exports.handleMcpLine = exports.handleMcpMessage = exports.scanAgentSettingsContent = exports.scanSkillContent = exports.scanAgentSkillFiles = exports.MCP_CONFIG_FILES = exports.hasMcpConfigFiles = exports.scanMcpConfigContent = exports.scanMcpConfigs = exports.scanPypiDependencyConfusion = exports.getSLSALevel = exports.verifySLSA = exports.generateSbomDocument = exports.calculateMetrics = exports.forecastRisk = exports.checkSlaCompliance = exports.checkTriageGovernance = exports.saveTriageDecisions = exports.loadTriageDecisions = exports.analyzeRiskTrend = exports.saveRiskHistory = exports.loadRiskHistory = exports.calculateOrgPosture = exports.getHoneytokenEnv = exports.checkHoneytokenAccess = exports.modelWorkflows = exports.promoteConfidence = exports.validateFindings = exports.exportGraphMermaid = exports.buildAttackGraph = exports.exportCsvSummary = exports.exportIncidentMarkdown = exports.exportIncidentBundle = exports.checkDependencyGovernance = exports.generatePlaybooks = exports.generateFixSuggestions = exports.generateRemediations = exports.analyzeOrgFindings = exports.listOrgRepos = exports.getChangedFiles = exports.calculateRiskDimensions = exports.DEFAULT_FEED_URL = exports.parseFeedPayload = exports.refreshFeed = exports.feedStats = exports.getBundledFeed = exports.matchPackageIOC = exports.checkThreatIntel = exports.updateThreatFeed = exports.loadThreatIntel = void 0;
-exports.SUPPORTED_MANAGERS = exports.resolveManagerBinary = exports.parseSpecToken = exports.extractInstallSpecs = exports.runInstallGuard = exports.analyzeInstallCommand = exports.startMcpServer = void 0;
+exports.scanAgentSettingsContent = exports.scanSkillContent = exports.scanAgentSkillFiles = exports.MCP_CONFIG_FILES = exports.hasMcpConfigFiles = exports.scanMcpConfigContent = exports.scanMcpConfigs = exports.scanPypiDependencyConfusion = exports.getSLSALevel = exports.verifySLSA = exports.generateSbomDocument = exports.calculateMetrics = exports.forecastRisk = exports.checkSlaCompliance = exports.checkTriageGovernance = exports.saveTriageDecisions = exports.loadTriageDecisions = exports.analyzeRiskTrend = exports.saveRiskHistory = exports.loadRiskHistory = exports.calculateOrgPosture = exports.getHoneytokenEnv = exports.checkHoneytokenAccess = exports.parseWorkflow = exports.scanWorkflowGraph = exports.modelWorkflows = exports.promoteConfidence = exports.validateFindings = exports.exportGraphMermaid = exports.buildAttackGraph = exports.exportCsvSummary = exports.exportIncidentMarkdown = exports.exportIncidentBundle = exports.checkDependencyGovernance = exports.generatePlaybooks = exports.generateFixSuggestions = exports.generateRemediations = exports.analyzeOrgFindings = exports.listOrgRepos = exports.getChangedFiles = exports.calculateRiskDimensions = exports.DEFAULT_FEED_URL = exports.parseFeedPayload = exports.refreshFeed = exports.feedStats = exports.getBundledFeed = exports.matchPackageIOC = exports.checkThreatIntel = exports.updateThreatFeed = exports.loadThreatIntel = void 0;
+exports.SUPPORTED_MANAGERS = exports.resolveManagerBinary = exports.parseSpecToken = exports.extractInstallSpecs = exports.runInstallGuard = exports.analyzeInstallCommand = exports.startMcpServer = exports.handleMcpLine = exports.handleMcpMessage = void 0;
 var scanner_js_1 = require("./scanner.js");
 Object.defineProperty(exports, "scan", { enumerable: true, get: function () { return scanner_js_1.scan; } });
 var npm_scanner_js_1 = require("./npm-scanner.js");
@@ -124,6 +124,10 @@ Object.defineProperty(exports, "validateFindings", { enumerable: true, get: func
 Object.defineProperty(exports, "promoteConfidence", { enumerable: true, get: function () { return active_validation_js_1.promoteConfidence; } });
 var workflow_modeler_js_1 = require("./workflow-modeler.js");
 Object.defineProperty(exports, "modelWorkflows", { enumerable: true, get: function () { return workflow_modeler_js_1.modelWorkflows; } });
+var workflow_graph_js_1 = require("./workflow-graph.js");
+Object.defineProperty(exports, "scanWorkflowGraph", { enumerable: true, get: function () { return workflow_graph_js_1.scanWorkflowGraph; } });
+var workflow_ast_js_1 = require("./workflow-ast.js");
+Object.defineProperty(exports, "parseWorkflow", { enumerable: true, get: function () { return workflow_ast_js_1.parseWorkflow; } });
 var secret_simulator_js_1 = require("./secret-simulator.js");
 Object.defineProperty(exports, "checkHoneytokenAccess", { enumerable: true, get: function () { return secret_simulator_js_1.checkHoneytokenAccess; } });
 Object.defineProperty(exports, "getHoneytokenEnv", { enumerable: true, get: function () { return secret_simulator_js_1.getHoneytokenEnv; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;AAEH,2CAAoC;AAA3B,kGAAA,IAAI,OAAA;AACb,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,qEAAoE;AAA3D,kIAAA,uBAAuB,OAAA;AAChC,yDAU6B;AAT3B,kHAAA,aAAa,OAAA;AACb,gHAAA,WAAW,OAAA;AACX,gHAAA,WAAW,OAAA;AACX,kHAAA,aAAa,OAAA;AACb,kHAAA,aAAa,OAAA;AACb,mHAAA,cAAc,OAAA;AACd,wHAAA,mBAAmB,OAAA;AACnB,kHAAA,aAAa,OAAA;AACb,qHAAA,gBAAgB,OAAA;AAElB,6CAA6C;AAApC,2GAAA,YAAY,OAAA;AACrB,6DAM+B;AAL7B,oHAAA,aAAa,OAAA;AACb,uHAAA,gBAAgB,OAAA;AAChB,wHAAA,iBAAiB,OAAA;AACjB,wHAAA,iBAAiB,OAAA;AACjB,uHAAA,gBAAgB,OAAA;AAElB,yEAAyE;AAAhE,uIAAA,0BAA0B,OAAA;AACnC,iEAA0E;AAAjE,wHAAA,eAAe,OAAA;AAAE,uHAAA,cAAc,OAAA;AACxC,yDAAsE;AAA7D,oHAAA,eAAe,OAAA;AAAE,mHAAA,cAAc,OAAA;AACxC,mDAAmD;AAA1C,iHAAA,eAAe,OAAA;AACxB,2CAA8D;AAArD,4GAAA,cAAc,OAAA;AAAE,4GAAA,cAAc,OAAA;AACvC,uDAAoD;AAA3C,kHAAA,cAAc,OAAA;AACvB,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AACpB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,uDAAoD;AAA3C,kHAAA,cAAc,OAAA;AACvB,uDAAwE;AAA/D,qHAAA,iBAAiB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAC3C,qEAAgG;AAAvF,6HAAA,kBAAkB,OAAA;AAAE,yHAAA,cAAc,OAAA;AAAE,0HAAA,eAAe,OAAA;AAC5D,qEAAgE;AAAvD,8HAAA,mBAAmB,OAAA;AAC5B,6EAAoF;AAA3E,qIAAA,sBAAsB,OAAA;AAAE,0HAAA,WAAW,OAAA;AAC5C,mFAA8E;AAArE,4IAAA,0BAA0B,OAAA;AACnC,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAC7B,iEAA4D;AAAnD,0HAAA,iBAAiB,OAAA;AAC1B,2DAA+D;AAAtD,6HAAA,uBAAuB,OAAA;AAChC,uDAAgG;AAAvF,oHAAA,gBAAgB,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,gHAAA,YAAY,OAAA;AACnE,uDAAwD;AAA/C,sHAAA,kBAAkB,OAAA;AAC3B,qDAAyH;AAAhH,kHAAA,eAAe,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAAE,iHAAA,cAAc,OAAA;AAC7F,qCAAuF;AAA9E,oGAAA,SAAS,OAAA;AAAE,sGAAA,WAAW,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AACnE,mDAA2D;AAAlD,yHAAA,uBAAuB,OAAA;AAChC,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,mDAAoE;AAA3D,8GAAA,YAAY,OAAA;AAAE,oHAAA,kBAAkB,OAAA;AACzC,iEAAuF;AAA9E,6HAAA,oBAAoB,OAAA;AAAE,+HAAA,sBAAsB,OAAA;AACrD,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,uEAAuE;AAA9D,qIAAA,yBAAyB,OAAA;AAClC,qDAAmG;AAA1F,uHAAA,oBAAoB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AACvE,qDAAyE;AAAhE,mHAAA,gBAAgB,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAC7C,+DAA6E;AAApE,wHAAA,gBAAgB,OAAA;AAAE,yHAAA,iBAAiB,OAAA;AAC5C,6DAAuD;AAA9C,qHAAA,cAAc,OAAA;AACvB,6DAAgF;AAAvE,4HAAA,qBAAqB,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAChD,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,iEAA6F;AAApF,wHAAA,eAAe,OAAA;AAAE,wHAAA,eAAe,OAAA;AAAE,yHAAA,gBAAgB,OAAA;AAC3D,uDAAqG;AAA5F,uHAAA,mBAAmB,OAAA;AAAE,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AACxE,iDAAqD;AAA5C,mHAAA,kBAAkB,OAAA;AAC3B,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AACrB,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA;AACzB,yDAA2D;AAAlD,yHAAA,oBAAoB,OAAA;AAC7B,uDAA8D;AAArD,8GAAA,UAAU,OAAA;AAAE,gHAAA,YAAY,OAAA;AACjC,qEAAwE;AAA/D,sIAAA,2BAA2B,OAAA;AACpC,mDAA6G;AAApG,gHAAA,cAAc,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAAE,mHAAA,iBAAiB,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAClF,yDAI6B;AAH3B,wHAAA,mBAAmB,OAAA;AACnB,qHAAA,gBAAgB,OAAA;AAChB,6HAAA,wBAAwB,OAAA;AAE1B,iDAAkF;AAAzE,iHAAA,gBAAgB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,+GAAA,cAAc,OAAA;AACxD,uDAO4B;AAN1B,yHAAA,qBAAqB,OAAA;AACrB,mHAAA,eAAe,OAAA;AACf,uHAAA,mBAAmB,OAAA;AACnB,kHAAA,cAAc,OAAA;AACd,wHAAA,oBAAoB,OAAA;AACpB,sHAAA,kBAAkB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;AAEH,2CAAoC;AAA3B,kGAAA,IAAI,OAAA;AACb,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,qEAAoE;AAA3D,kIAAA,uBAAuB,OAAA;AAChC,yDAU6B;AAT3B,kHAAA,aAAa,OAAA;AACb,gHAAA,WAAW,OAAA;AACX,gHAAA,WAAW,OAAA;AACX,kHAAA,aAAa,OAAA;AACb,kHAAA,aAAa,OAAA;AACb,mHAAA,cAAc,OAAA;AACd,wHAAA,mBAAmB,OAAA;AACnB,kHAAA,aAAa,OAAA;AACb,qHAAA,gBAAgB,OAAA;AAElB,6CAA6C;AAApC,2GAAA,YAAY,OAAA;AACrB,6DAM+B;AAL7B,oHAAA,aAAa,OAAA;AACb,uHAAA,gBAAgB,OAAA;AAChB,wHAAA,iBAAiB,OAAA;AACjB,wHAAA,iBAAiB,OAAA;AACjB,uHAAA,gBAAgB,OAAA;AAElB,yEAAyE;AAAhE,uIAAA,0BAA0B,OAAA;AACnC,iEAA0E;AAAjE,wHAAA,eAAe,OAAA;AAAE,uHAAA,cAAc,OAAA;AACxC,yDAAsE;AAA7D,oHAAA,eAAe,OAAA;AAAE,mHAAA,cAAc,OAAA;AACxC,mDAAmD;AAA1C,iHAAA,eAAe,OAAA;AACxB,2CAA8D;AAArD,4GAAA,cAAc,OAAA;AAAE,4GAAA,cAAc,OAAA;AACvC,uDAAoD;AAA3C,kHAAA,cAAc,OAAA;AACvB,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AACpB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,uDAAoD;AAA3C,kHAAA,cAAc,OAAA;AACvB,uDAAwE;AAA/D,qHAAA,iBAAiB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAC3C,qEAAgG;AAAvF,6HAAA,kBAAkB,OAAA;AAAE,yHAAA,cAAc,OAAA;AAAE,0HAAA,eAAe,OAAA;AAC5D,qEAAgE;AAAvD,8HAAA,mBAAmB,OAAA;AAC5B,6EAAoF;AAA3E,qIAAA,sBAAsB,OAAA;AAAE,0HAAA,WAAW,OAAA;AAC5C,mFAA8E;AAArE,4IAAA,0BAA0B,OAAA;AACnC,2DAA4D;AAAnD,0HAAA,oBAAoB,OAAA;AAC7B,iEAA4D;AAAnD,0HAAA,iBAAiB,OAAA;AAC1B,2DAA+D;AAAtD,6HAAA,uBAAuB,OAAA;AAChC,uDAAgG;AAAvF,oHAAA,gBAAgB,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,gHAAA,YAAY,OAAA;AACnE,uDAAwD;AAA/C,sHAAA,kBAAkB,OAAA;AAC3B,qDAAyH;AAAhH,kHAAA,eAAe,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAAE,iHAAA,cAAc,OAAA;AAC7F,qCAAuF;AAA9E,oGAAA,SAAS,OAAA;AAAE,sGAAA,WAAW,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AACnE,mDAA2D;AAAlD,yHAAA,uBAAuB,OAAA;AAChC,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,mDAAoE;AAA3D,8GAAA,YAAY,OAAA;AAAE,oHAAA,kBAAkB,OAAA;AACzC,iEAAuF;AAA9E,6HAAA,oBAAoB,OAAA;AAAE,+HAAA,sBAAsB,OAAA;AACrD,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,uEAAuE;AAA9D,qIAAA,yBAAyB,OAAA;AAClC,qDAAmG;AAA1F,uHAAA,oBAAoB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AACvE,qDAAyE;AAAhE,mHAAA,gBAAgB,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAC7C,+DAA6E;AAApE,wHAAA,gBAAgB,OAAA;AAAE,yHAAA,iBAAiB,OAAA;AAC5C,6DAAuD;AAA9C,qHAAA,cAAc,OAAA;AACvB,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAC1B,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,6DAAgF;AAAvE,4HAAA,qBAAqB,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAChD,yDAA0D;AAAjD,wHAAA,mBAAmB,OAAA;AAC5B,iEAA6F;AAApF,wHAAA,eAAe,OAAA;AAAE,wHAAA,eAAe,OAAA;AAAE,yHAAA,gBAAgB,OAAA;AAC3D,uDAAqG;AAA5F,uHAAA,mBAAmB,OAAA;AAAE,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AACxE,iDAAqD;AAA5C,mHAAA,kBAAkB,OAAA;AAC3B,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AACrB,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA;AACzB,yDAA2D;AAAlD,yHAAA,oBAAoB,OAAA;AAC7B,uDAA8D;AAArD,8GAAA,UAAU,OAAA;AAAE,gHAAA,YAAY,OAAA;AACjC,qEAAwE;AAA/D,sIAAA,2BAA2B,OAAA;AACpC,mDAA6G;AAApG,gHAAA,cAAc,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAAE,mHAAA,iBAAiB,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAClF,yDAI6B;AAH3B,wHAAA,mBAAmB,OAAA;AACnB,qHAAA,gBAAgB,OAAA;AAChB,6HAAA,wBAAwB,OAAA;AAE1B,iDAAkF;AAAzE,iHAAA,gBAAgB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,+GAAA,cAAc,OAAA;AACxD,uDAO4B;AAN1B,yHAAA,qBAAqB,OAAA;AACrB,mHAAA,eAAe,OAAA;AACf,uHAAA,mBAAmB,OAAA;AACnB,kHAAA,cAAc,OAAA;AACd,wHAAA,oBAAoB,OAAA;AACpB,sHAAA,kBAAkB,OAAA"}

package/dist/reporter.js

@@ -60,7 +60,7 @@ function formatJson(report) {
 function formatText(report) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "5.6.3";
+    const VERSION = "5.7.0";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -495,7 +495,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "5.6.3",
+                        version: "5.7.0",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -557,7 +557,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "5.6.3" },
+                    { type: "application", name: "supply-chain-guard", version: "5.7.0" },
                 ],
             },
             component: {
@@ -675,7 +675,7 @@ function formatGitlab(report) {
         name: "supply-chain-guard",
         url: "https://github.com/homeofe/supply-chain-guard",
         vendor: { name: "supply-chain-guard" },
-        version: "5.6.3",
+        version: "5.7.0",
     };
     const vulnerabilities = report.findings
         .filter((f) => !f.suppressed)
@@ -857,7 +857,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.6.3
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.7.0
   </footer>
 </div>
 <script>

package/dist/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAW,WAAW,EAAE,UAAU,EAAyB,MAAM,YAAY,CAAC;AA8E1F;;GAEG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAoZpE"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAW,WAAW,EAAE,UAAU,EAAyB,MAAM,YAAY,CAAC;AA+E1F;;GAEG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0ZpE"}

package/dist/scanner.js

@@ -73,6 +73,7 @@ const playbooks_js_1 = require("./playbooks.js");
 const attack_graph_js_1 = require("./attack-graph.js");
 const active_validation_js_1 = require("./active-validation.js");
 const workflow_modeler_js_1 = require("./workflow-modeler.js");
+const workflow_graph_js_1 = require("./workflow-graph.js");
 const continuous_monitor_js_1 = require("./continuous-monitor.js");
 const triage_engine_js_1 = require("./triage-engine.js");
 const risk_forecast_js_1 = require("./risk-forecast.js");
@@ -329,6 +330,11 @@ async function scan(options) {
     // v4.7: Workflow execution modeling
     const wfFindings = (0, workflow_modeler_js_1.modelWorkflows)(scanDir);
     findings.push(...wfFindings);
+    // v5.7: Cross-workflow trust-boundary analysis (Cordyceps composition attacks).
+    // Runs across ALL workflow files - catches the producer->consumer artifact
+    // escalation that the single-file GHA scanner and modeler cannot see.
+    const wfGraphFindings = (0, workflow_graph_js_1.scanWorkflowGraph)(scanDir);
+    findings.push(...wfGraphFindings);
     // v4.4: Detect positive trust signals (only for GitHub repo scans)
     if (scanType === "github") {
         const trustSignals = (0, trust_signals_js_1.detectTrustSignals)(scanDir);