supply-chain-guard 5.9.0 → 5.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -1
- package/dist/agentic-workflow-scanner.d.ts +15 -0
- package/dist/agentic-workflow-scanner.d.ts.map +1 -0
- package/dist/agentic-workflow-scanner.js +168 -0
- package/dist/agentic-workflow-scanner.js.map +1 -0
- package/dist/cli.js +1 -1
- package/dist/cli.js.map +1 -1
- package/dist/correlation-engine.d.ts.map +1 -1
- package/dist/correlation-engine.js +32 -0
- package/dist/correlation-engine.js.map +1 -1
- package/dist/github-actions-scanner.js +157 -0
- package/dist/github-actions-scanner.js.map +1 -1
- package/dist/patterns.d.ts.map +1 -1
- package/dist/patterns.js +10 -3
- package/dist/patterns.js.map +1 -1
- package/dist/reporter.js +5 -5
- package/dist/reporter.js.map +1 -1
- package/dist/risk-engine.d.ts.map +1 -1
- package/dist/risk-engine.js +2 -0
- package/dist/risk-engine.js.map +1 -1
- package/dist/scanner.d.ts.map +1 -1
- package/dist/scanner.js +3 -0
- package/dist/scanner.js.map +1 -1
- package/dist/skills-scanner.d.ts.map +1 -1
- package/dist/skills-scanner.js +10 -3
- package/dist/skills-scanner.js.map +1 -1
- package/dist/workflow-ast.d.ts +6 -0
- package/dist/workflow-ast.d.ts.map +1 -1
- package/dist/workflow-ast.js +72 -0
- package/dist/workflow-ast.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -64,6 +64,7 @@ For a deep dive into how GlassWorm infiltrates the software supply chain and the
|
|
|
64
64
|
|
|
65
65
|
### Infrastructure & CI/CD
|
|
66
66
|
- GitHub Actions: unpinned actions, secrets exfiltration, encoded payloads, curl piping
|
|
67
|
+
- Agentic workflows (GitLost class): AI-agent steps and gh-aw `.github/workflows/*.md` that ingest untrusted issue/PR text, hold a cross-repo token, and can post publicly - the prompt-injection data-leak posture
|
|
67
68
|
- Dockerfile: curl pipe, unpinned base images, hardcoded secrets, SUID bits
|
|
68
69
|
- Terraform/IaC: inline scripts, external modules, hardcoded secrets
|
|
69
70
|
- Package manager configs (.npmrc, .yarnrc, pip.conf): HTTP registries, exposed tokens
|
|
@@ -122,7 +123,7 @@ Run the scanner as a [pre-commit](https://pre-commit.com) hook (Python-ecosystem
|
|
|
122
123
|
```yaml
|
|
123
124
|
repos:
|
|
124
125
|
- repo: https://github.com/homeofe/supply-chain-guard
|
|
125
|
-
rev: v5.
|
|
126
|
+
rev: v5.10.0
|
|
126
127
|
hooks:
|
|
127
128
|
- id: supply-chain-guard
|
|
128
129
|
```
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* GitHub Agentic Workflow (gh-aw) markdown scanner (v5.10).
|
|
3
|
+
*
|
|
4
|
+
* GitHub Agentic Workflows live in `.github/workflows/*.md`: YAML frontmatter
|
|
5
|
+
* (on:/permissions:/engine:/tools:/safe-outputs:) plus a natural-language body
|
|
6
|
+
* that IS the agent's instructions. The legacy .yml-only workflow scanner skips
|
|
7
|
+
* these entirely. The GitLost disclosure (Noma, July 2026) exploited exactly
|
|
8
|
+
* this file shape: an untrusted issue trigger + a public add-comment tool +
|
|
9
|
+
* cross-repo read = private data leaked through a public comment. We can only
|
|
10
|
+
* see the static POSTURE, never the runtime issue payload.
|
|
11
|
+
*/
|
|
12
|
+
import type { Finding } from "./types.js";
|
|
13
|
+
/** Scan `.github/workflows/*.md` gh-aw files under `dir`. */
|
|
14
|
+
export declare function scanAgenticWorkflows(dir: string): Finding[];
|
|
15
|
+
//# sourceMappingURL=agentic-workflow-scanner.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agentic-workflow-scanner.d.ts","sourceRoot":"","sources":["../src/agentic-workflow-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,YAAY,CAAC;AAwDpD,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CA8B3D"}
|
|
@@ -0,0 +1,168 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* GitHub Agentic Workflow (gh-aw) markdown scanner (v5.10).
|
|
4
|
+
*
|
|
5
|
+
* GitHub Agentic Workflows live in `.github/workflows/*.md`: YAML frontmatter
|
|
6
|
+
* (on:/permissions:/engine:/tools:/safe-outputs:) plus a natural-language body
|
|
7
|
+
* that IS the agent's instructions. The legacy .yml-only workflow scanner skips
|
|
8
|
+
* these entirely. The GitLost disclosure (Noma, July 2026) exploited exactly
|
|
9
|
+
* this file shape: an untrusted issue trigger + a public add-comment tool +
|
|
10
|
+
* cross-repo read = private data leaked through a public comment. We can only
|
|
11
|
+
* see the static POSTURE, never the runtime issue payload.
|
|
12
|
+
*/
|
|
13
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
14
|
+
if (k2 === undefined) k2 = k;
|
|
15
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
16
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
17
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
18
|
+
}
|
|
19
|
+
Object.defineProperty(o, k2, desc);
|
|
20
|
+
}) : (function(o, m, k, k2) {
|
|
21
|
+
if (k2 === undefined) k2 = k;
|
|
22
|
+
o[k2] = m[k];
|
|
23
|
+
}));
|
|
24
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
25
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
26
|
+
}) : function(o, v) {
|
|
27
|
+
o["default"] = v;
|
|
28
|
+
});
|
|
29
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
30
|
+
var ownKeys = function(o) {
|
|
31
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
32
|
+
var ar = [];
|
|
33
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
34
|
+
return ar;
|
|
35
|
+
};
|
|
36
|
+
return ownKeys(o);
|
|
37
|
+
};
|
|
38
|
+
return function (mod) {
|
|
39
|
+
if (mod && mod.__esModule) return mod;
|
|
40
|
+
var result = {};
|
|
41
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
42
|
+
__setModuleDefault(result, mod);
|
|
43
|
+
return result;
|
|
44
|
+
};
|
|
45
|
+
})();
|
|
46
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
47
|
+
exports.scanAgenticWorkflows = scanAgenticWorkflows;
|
|
48
|
+
const fs = __importStar(require("node:fs"));
|
|
49
|
+
const path = __importStar(require("node:path"));
|
|
50
|
+
const workflow_ast_js_1 = require("./workflow-ast.js");
|
|
51
|
+
const patterns_js_1 = require("./patterns.js");
|
|
52
|
+
/** Triggers that feed attacker-controllable text into the agent. */
|
|
53
|
+
const UNTRUSTED_TRIGGERS = [
|
|
54
|
+
"issues", "issue_comment", "pull_request", "pull_request_target",
|
|
55
|
+
"pull_request_review", "pull_request_review_comment", "discussion", "discussion_comment",
|
|
56
|
+
];
|
|
57
|
+
/** gh-aw tool names that post PUBLICLY (the exfiltration channel). */
|
|
58
|
+
const PUBLIC_POST_TOOLS = [
|
|
59
|
+
"add-comment", "add-issue-comment", "create-issue", "update-issue",
|
|
60
|
+
"add-pull-request-review-comment", "create-pull-request-review-comment",
|
|
61
|
+
];
|
|
62
|
+
/**
|
|
63
|
+
* Split a gh-aw markdown file into its YAML frontmatter and body. Returns null
|
|
64
|
+
* when there is no `---` frontmatter fence (i.e. it is an ordinary md file).
|
|
65
|
+
*/
|
|
66
|
+
function splitFrontmatter(content) {
|
|
67
|
+
const norm = content.replace(/\r/g, "");
|
|
68
|
+
if (!norm.startsWith("---\n"))
|
|
69
|
+
return null;
|
|
70
|
+
const end = norm.indexOf("\n---", 4);
|
|
71
|
+
if (end === -1)
|
|
72
|
+
return null;
|
|
73
|
+
const frontmatter = norm.slice(4, end);
|
|
74
|
+
const afterFence = norm.indexOf("\n", end + 1);
|
|
75
|
+
const body = afterFence === -1 ? "" : norm.slice(afterFence + 1);
|
|
76
|
+
return { frontmatter, body };
|
|
77
|
+
}
|
|
78
|
+
function rec(rule) {
|
|
79
|
+
const map = {
|
|
80
|
+
AGENTIC_WF_UNTRUSTED_TRIGGER: "This Agentic Workflow ingests attacker-controllable issue/PR text by design. Gate it on author " +
|
|
81
|
+
"trust and never let the agent treat that text as instructions.",
|
|
82
|
+
AGENTIC_WF_PUBLIC_POST_TOOL: "Remove public-post tools (add-comment/create-issue/...) from Agentic Workflows triggered by untrusted " +
|
|
83
|
+
"input, or scope the agent read-only. Read private + post public is the GitLost exfiltration channel.",
|
|
84
|
+
AGENTIC_WF_BROAD_ACCESS: "Scope the agent's token/permissions to the single repository it needs. A cross-repo PAT lets a " +
|
|
85
|
+
"prompt-injected agent read every private repo it can reach.",
|
|
86
|
+
AGENTIC_WF_PROMPT_INJECTION: "An LLM control token or override phrase appears in this agent instruction file. Remove it: agents read " +
|
|
87
|
+
"the body verbatim, so embedded control tokens hijack the agent.",
|
|
88
|
+
};
|
|
89
|
+
return map[rule] ?? "Review this Agentic Workflow's posture.";
|
|
90
|
+
}
|
|
91
|
+
function push(findings, rule, severity, description, file, line) {
|
|
92
|
+
findings.push({ rule, description, severity, file, line, recommendation: rec(rule) });
|
|
93
|
+
}
|
|
94
|
+
/** Scan `.github/workflows/*.md` gh-aw files under `dir`. */
|
|
95
|
+
function scanAgenticWorkflows(dir) {
|
|
96
|
+
const findings = [];
|
|
97
|
+
const wfDir = path.join(dir, ".github", "workflows");
|
|
98
|
+
if (!fs.existsSync(wfDir))
|
|
99
|
+
return findings;
|
|
100
|
+
let entries;
|
|
101
|
+
try {
|
|
102
|
+
entries = fs.readdirSync(wfDir, { withFileTypes: true });
|
|
103
|
+
}
|
|
104
|
+
catch {
|
|
105
|
+
return findings;
|
|
106
|
+
}
|
|
107
|
+
for (const entry of entries) {
|
|
108
|
+
if (!entry.isFile())
|
|
109
|
+
continue;
|
|
110
|
+
if (path.extname(entry.name).toLowerCase() !== ".md")
|
|
111
|
+
continue;
|
|
112
|
+
const rel = path.join(".github", "workflows", entry.name).replace(/\\/g, "/");
|
|
113
|
+
let content;
|
|
114
|
+
try {
|
|
115
|
+
content = fs.readFileSync(path.join(wfDir, entry.name), "utf-8");
|
|
116
|
+
}
|
|
117
|
+
catch {
|
|
118
|
+
continue;
|
|
119
|
+
}
|
|
120
|
+
const parts = splitFrontmatter(content);
|
|
121
|
+
if (!parts)
|
|
122
|
+
continue; // ordinary markdown, not a gh-aw workflow
|
|
123
|
+
scanOne(parts.frontmatter, parts.body, rel, findings);
|
|
124
|
+
}
|
|
125
|
+
return findings;
|
|
126
|
+
}
|
|
127
|
+
function scanOne(frontmatter, body, rel, findings) {
|
|
128
|
+
let triggers = [];
|
|
129
|
+
try {
|
|
130
|
+
triggers = (0, workflow_ast_js_1.parseWorkflow)(frontmatter).triggers ?? [];
|
|
131
|
+
}
|
|
132
|
+
catch {
|
|
133
|
+
triggers = [];
|
|
134
|
+
}
|
|
135
|
+
const triggerSet = new Set(triggers);
|
|
136
|
+
const untrusted = UNTRUSTED_TRIGGERS.filter((t) => triggerSet.has(t));
|
|
137
|
+
const fmLower = frontmatter.toLowerCase();
|
|
138
|
+
if (untrusted.length > 0) {
|
|
139
|
+
push(findings, "AGENTIC_WF_UNTRUSTED_TRIGGER", "medium", `Agentic Workflow triggers on ${untrusted.join(", ")}, feeding attacker-controllable text ` +
|
|
140
|
+
`into the agent's instruction context.`, rel, 1);
|
|
141
|
+
}
|
|
142
|
+
const hasPublicPostTool = PUBLIC_POST_TOOLS.some((t) => fmLower.includes(t));
|
|
143
|
+
if (hasPublicPostTool && untrusted.length > 0) {
|
|
144
|
+
push(findings, "AGENTIC_WF_PUBLIC_POST_TOOL", "high", `Agentic Workflow on an untrusted trigger grants a public-post tool (add-comment / create-issue). ` +
|
|
145
|
+
`The agent can post what it read as a public comment: the GitLost exfiltration channel.`, rel, 1);
|
|
146
|
+
}
|
|
147
|
+
// Cross-repo / broad access indicators in frontmatter.
|
|
148
|
+
const hasNonDefaultSecret = /\$\{\{\s*secrets\.(?!github_token\b)[a-z0-9_]+\s*\}\}/i.test(frontmatter);
|
|
149
|
+
const hasRepoList = /^\s*(?:repos|repositories)\s*:/im.test(frontmatter);
|
|
150
|
+
if ((hasNonDefaultSecret || hasRepoList) && untrusted.length > 0) {
|
|
151
|
+
push(findings, "AGENTIC_WF_BROAD_ACCESS", "high", `Agentic Workflow on an untrusted trigger shows cross-repo access indicators ` +
|
|
152
|
+
`(custom token secret or explicit repo list). Combined with a public-post tool this is the ` +
|
|
153
|
+
`full GitLost lethal trifecta.`, rel, 1);
|
|
154
|
+
}
|
|
155
|
+
// LLM control tokens hidden in the instruction body.
|
|
156
|
+
const bodyLines = body.split("\n");
|
|
157
|
+
for (const p of patterns_js_1.PROMPT_INJECTION_PATTERNS) {
|
|
158
|
+
const re = new RegExp(p.pattern, "i");
|
|
159
|
+
for (let i = 0; i < bodyLines.length; i++) {
|
|
160
|
+
if (re.test(bodyLines[i] ?? "")) {
|
|
161
|
+
push(findings, "AGENTIC_WF_PROMPT_INJECTION", "high", `LLM control token / override phrase in an Agentic Workflow instruction body ` +
|
|
162
|
+
`(matched ${p.rule}). Agents read the body verbatim.`, rel, i + 1);
|
|
163
|
+
break; // one finding per pattern is enough
|
|
164
|
+
}
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
}
|
|
168
|
+
//# sourceMappingURL=agentic-workflow-scanner.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agentic-workflow-scanner.js","sourceRoot":"","sources":["../src/agentic-workflow-scanner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DH,oDA8BC;AAzFD,4CAA8B;AAC9B,gDAAkC;AAElC,uDAAkD;AAClD,+CAA0D;AAE1D,oEAAoE;AACpE,MAAM,kBAAkB,GAAG;IACzB,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,qBAAqB;IAChE,qBAAqB,EAAE,6BAA6B,EAAE,YAAY,EAAE,oBAAoB;CACzF,CAAC;AAEF,sEAAsE;AACtE,MAAM,iBAAiB,GAAG;IACxB,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc;IAClE,iCAAiC,EAAE,oCAAoC;CACxE,CAAC;AAEF;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,GAAG,GAA2B;QAClC,4BAA4B,EAC1B,iGAAiG;YACjG,gEAAgE;QAClE,2BAA2B,EACzB,wGAAwG;YACxG,sGAAsG;QACxG,uBAAuB,EACrB,iGAAiG;YACjG,6DAA6D;QAC/D,2BAA2B,EACzB,yGAAyG;YACzG,iEAAiE;KACpE,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,yCAAyC,CAAC;AAChE,CAAC;AAED,SAAS,IAAI,CACX,QAAmB,EAAE,IAAY,EAAE,QAAkB,EAAE,WAAmB,EAC1E,IAAY,EAAE,IAAY;IAE1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,6DAA6D;AAC7D,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE3C,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,SAAS;QAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,0CAA0C;QAEhE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CACd,WAAmB,EAAE,IAAY,EAAE,GAAW,EAAE,QAAmB;IAEnE,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,+BAAa,EAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAE1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,EAAE,8BAA8B,EAAE,QAAQ,EACrD,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC;YAC3F,uCAAuC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,iBAAiB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,6BAA6B,EAAE,MAAM,EAClD,mGAAmG;YACnG,wFAAwF,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,uDAAuD;IACvD,MAAM,mBAAmB,GAAG,wDAAwD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvG,MAAM,WAAW,GAAG,kCAAkC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzE,IAAI,CAAC,mBAAmB,IAAI,WAAW,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,yBAAyB,EAAE,MAAM,EAC9C,8EAA8E;YAC9E,4FAA4F;YAC5F,+BAA+B,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,qDAAqD;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,uCAAyB,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,EAAE,MAAM,EAClD,8EAA8E;oBAC9E,YAAY,CAAC,CAAC,IAAI,mCAAmC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrE,MAAM,CAAC,oCAAoC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
|
package/dist/cli.js
CHANGED
|
@@ -20,7 +20,7 @@ const program = new commander_1.Command();
|
|
|
20
20
|
program
|
|
21
21
|
.name("supply-chain-guard")
|
|
22
22
|
.description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
|
|
23
|
-
.version("5.
|
|
23
|
+
.version("5.10.0");
|
|
24
24
|
// ── scan command ────────────────────────────────────────────────────
|
|
25
25
|
program
|
|
26
26
|
.command("scan")
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;AAEA;;;;;GAKG;;AAEH,yCAAoC;AACpC,6CAAoC;AACpC,qDAAkD;AAClD,uDAAoD;AACpD,2DAA0D;AAC1D,uEAAoE;AACpE,uEAAgG;AAChG,2DAQ6B;AAC7B,+CAA6C;AAG7C,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,oBAAoB,CAAC;KAC1B,WAAW,CACV,sLAAsL,CACvL;KACA,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,UAAU,EAAE,yCAAyC,CAAC;KAC/D,MAAM,CAAC,uBAAuB,EAAE,uEAAuE,EAAE,MAAM,CAAC;KAChH,MAAM,CACL,+BAA+B,EAC/B,+DAA+D,CAChE;KACA,MAAM,CACL,uBAAuB,EACvB,6CAA6C,CAC9C;KACA,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,IAAI,CAAC;KAC9D,MAAM,CACL,sBAAsB,EACtB,6FAA6F,CAC9F;KACA,MAAM,CAAC,mBAAmB,EAAE,wDAAwD,CAAC;KACrF,MAAM,CAAC,wBAAwB,EAAE,oDAAoD,CAAC;KACtF,MAAM,CAAC,kBAAkB,EAAE,uDAAuD,CAAC;KACnF,MAAM,CAAC,sBAAsB,EAAE,8CAA8C,CAAC;KAC9E,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KAC1E,MAAM,CAAC,sBAAsB,EAAE,6CAA6C,CAAC;KAC7E,MAAM,CAAC,cAAc,EAAE,gEAAgE,CAAC;KACxF,MAAM,CAAC,kBAAkB,EAAE,sHAAsH,CAAC;KAClJ,MAAM,CACL,KAAK,EACH,MAAc,EACd,IAeC,EACD,EAAE;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAgB;YAC3B,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAA+B;YAC5C,WAAW,EAAE,IAAI,CAAC,WAAmC;YACrD,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClC,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,SAAS,EAAE,IAAI,CAAC,OAAO,KAAK,KAAK;YACjC,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI;SAC3C,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAI,EAAC,OAAO,CAAC,CAAC;QAEnC,6BAA6B;QAC7B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC5D,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC;QAC/F,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBACjE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACtF,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,UAAU,oBAAoB,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,cAAc,CAAC,CAAC;QAC3H,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC7C,IAAI,GAAG,CAAC,MAAM;oBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;QAED,kBAAkB;QAClB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,aAAa,GAA2B;gBAC5C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;aACjD,CAAC;YACF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CACrD,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,2EAA2E,CAAC;KACxF,QAAQ,CAAC,WAAW,EAAE,0CAA0C,CAAC;KACjE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,EAAE,MAAM,CAAC;KACrF,MAAM,CACL,+BAA+B,EAC/B,4BAA4B,CAC7B;KACA,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,IAA8C,EAC9C,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAc,EAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,IAAI,CAAC,MAAyD;YACtE,WAAW,EAAE,IAAI,CAAC,WAAmC;SACtD,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAAyD,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,2EAA2E,CAAC;KACxF,QAAQ,CAAC,WAAW,EAAE,2CAA2C,CAAC;KAClE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,EAAE,MAAM,CAAC;KACrF,MAAM,CACL,+BAA+B,EAC/B,4BAA4B,CAC7B;KACA,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,IAA8C,EAC9C,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAe,EAAC,WAAW,EAAE;YAChD,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,IAAI,CAAC,MAAyD;YACtE,WAAW,EAAE,IAAI,CAAC,WAAmC;SACtD,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAAyD,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gFAAgF,CAAC;KAC7F,QAAQ,CACP,UAAU,EACV,iFAAiF,CAClF;KACA,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,EAAE,MAAM,CAAC;KACrF,MAAM,CACL,+BAA+B,EAC/B,4BAA4B,CAC7B;KACA,MAAM,CACL,uBAAuB,EACvB,yDAAyD,EACzD,aAAa,CACd;KACA,MAAM,CACL,KAAK,EACH,MAAc,EACd,IAAgE,EAChE,EAAE;IACF,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,QAAQ,yCAAyC,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAmB,EAAC;YACvC,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAyD;YACtE,WAAW,EAAE,IAAI,CAAC,WAAmC;YACrD,QAAQ,EAAE,IAAI,CAAC,QAAqC;SACrD,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAAyD,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,QAAQ,CAAC,UAAU,EAAE,gDAAgD,CAAC;KACtE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,EAAE,MAAM,CAAC;KACrF,MAAM,CACL,+BAA+B,EAC/B,4BAA4B,CAC7B;KACA,MAAM,CAAC,UAAU,EAAE,wCAAwC,CAAC;KAC5D,MAAM,CACL,KAAK,EACH,MAAc,EACd,IAA4D,EAC5D,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,iDAAuB,EAAC;YAC3C,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAyD;YACtE,WAAW,EAAE,IAAI,CAAC,WAAmC;YACrD,cAAc,EAAE,IAAI,CAAC,GAAG;SACzB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAAyD,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,qEAAqE;AAErE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sEAAsE,CAAC;KACnF,QAAQ,CAAC,OAAO,EAAE,6DAA6D,CAAC;KAChF,MAAM,CAAC,uBAAuB,EAAE,uEAAuE,EAAE,MAAM,CAAC;KAChH,MAAM,CACL,KAAK,EACH,GAAW,EACX,IAAwB,EACxB,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wCAAc,EAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GAAG,IAAA,4CAAkB,EAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAEpE,kDAAkD;QAClD,MAAM,OAAO,GAAgB;YAC3B,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,IAAI,CAAC,MAA+B;SAC7C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAI,EAAC,OAAO,CAAC,CAAC;QAEnC,qCAAqC;QACrC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QAC1F,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAClF,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACtF,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;QAChF,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAElF,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAA+B,CAAC,CAAC,CAAC;QAExE,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,qEAAqE;AAErE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,gDAAgD,CAAC;KAC7D,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;KAC7C,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;KACpE,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,IAAI,CAAC;KACxD,MAAM,CACL,KAAK,EACH,GAAW,EACX,IAAuC,EACvC,EAAE;IACF,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAE1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,+BAA+B,GAAG,+BAA+B,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0C,CAAC;QACvE,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAI,EAAC;oBACxB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,IAAI,CAAC,MAA+B;iBAC7C,CAAC,CAAC;gBACH,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;gBAClF,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;gBAC9E,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBACnC,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,KAAK,SAAS,cAAc,SAAS,OAAO,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,eAAe,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,KAAK,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACxE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC5B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,kDAAkD,CAAC;KAC/D,QAAQ,CAAC,WAAW,EAAE,kCAAkC,CAAC;KACzD,MAAM,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,IAAI,CAAC;KACvE,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,EAAE,IAAI,CAAC;KAChE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;KACpE,MAAM,CAAC,QAAQ,EAAE,gDAAgD,CAAC;KAClE,MAAM,CACL,KAAK,EACH,OAAe,EACf,IAKC,EACD,EAAE;IACF,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,iBAAiB;YACjB,MAAM,OAAO,GAAG,MAAM,IAAA,+BAAW,EAC/B,OAAO,EACP,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CACzB,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,yBAAyB,CAAC,CAAC;oBAClE,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;wBACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;wBAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACnD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;4BACjB,OAAO,CAAC,GAAG,CACT,gBAAgB,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9D,CAAC;wBACJ,CAAC;wBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,MAAM,IAAA,iCAAa,EACjB;YACE,OAAO;YACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACrC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAyB;SACvC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAA,+BAAW,EAAC,KAAK,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,+EAA+E;AAE/E,MAAM,SAAS,GAAG,OAAO;KACtB,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,gDAAgD,CAAC,CAAC;AAEjE,SAAS;KACN,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,8CAA8C,CAAC;KAC3D,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;KAC9C,cAAc,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;KAC3E,MAAM,CAAC,CAAC,OAAe,EAAE,IAAsB,EAAE,EAAE;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,kCAAc,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,OAAO,GAAG,IAAA,iCAAa,GAAE,CAAC;IAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oCAAoC,CAAC;KACjD,QAAQ,CAAC,WAAW,EAAE,iCAAiC,CAAC;KACxD,MAAM,CAAC,CAAC,OAAe,EAAE,EAAE;IAC1B,IAAI,CAAC;QACH,IAAA,uCAAmB,EAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,oBAAoB,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,IAAI,CAAC;KACvE,MAAM,CAAC,qBAAqB,EAAE,sCAAsC,EAAE,IAAI,CAAC;KAC3E,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,CAAC;KAC9D,MAAM,CACL,KAAK,EAAE,IAA2D,EAAE,EAAE;IACpE,IAAI,CAAC;QACH,MAAM,IAAA,oCAAgB,EACpB;YACE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACrC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC/B,UAAU,EAAE,IAAI,CAAC,OAAO;SACzB,EACD,CAAC,KAAK,EAAE,EAAE;YACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,+EAA+E;AAE/E,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,+CAA+C,CAAC,CAAC;AAEhE,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CACtE,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CACV,uIAAuI,CACxI;KACA,MAAM,CAAC,iBAAiB,EAAE,6CAA6C,CAAC;KACxE,MAAM,CAAC,uBAAuB,EAAE,mDAAmD,CAAC;KACpF,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,UAAU,kBAAkB,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,kEAAkE,CAAC;KAC/E,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3D,cAAc,EAAE,CAAC;AACnB,CAAC,CAAC,CAAC;AAEL,uEAAuE;AAEvE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,mBAAmB;AACnB,OAAO,CAAC,uBAAuB,EAAE,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CACV,+GAA+G,CAChH;KACA,kBAAkB,EAAE;KACpB,QAAQ,CAAC,WAAW,EAAE,uCAAuC,CAAC;KAC9D,QAAQ,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;KACjF,MAAM,CAAC,SAAS,EAAE,yCAAyC,CAAC;KAC5D,MAAM,CAAC,WAAW,EAAE,8CAA8C,CAAC;KACnE,MAAM,CACL,KAAK,EACH,OAAe,EACf,WAAqB,EACrB,IAA2C,EAC3C,EAAE;IACF,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE;YACjD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,OAAO,CAAC,KAAK,EAAE,CAAC"}
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;AAEA;;;;;GAKG;;AAEH,yCAAoC;AACpC,6CAAoC;AACpC,qDAAkD;AAClD,uDAAoD;AACpD,2DAA0D;AAC1D,uEAAoE;AACpE,uEAAgG;AAChG,2DAQ6B;AAC7B,+CAA6C;AAG7C,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,oBAAoB,CAAC;KAC1B,WAAW,CACV,sLAAsL,CACvL;KACA,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErB,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,UAAU,EAAE,yCAAyC,CAAC;KAC/D,MAAM,CAAC,uBAAuB,EAAE,uEAAuE,EAAE,MAAM,CAAC;KAChH,MAAM,CACL,+BAA+B,EAC/B,+DAA+D,CAChE;KACA,MAAM,CACL,uBAAuB,EACvB,6CAA6C,CAC9C;KACA,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,IAAI,CAAC;KAC9D,MAAM,CACL,sBAAsB,EACtB,6FAA6F,CAC9F;KACA,MAAM,CAAC,mBAAmB,EAAE,wDAAwD,CAAC;KACrF,MAAM,CAAC,wBAAwB,EAAE,oDAAoD,CAAC;KACtF,MAAM,CAAC,kBAAkB,EAAE,uDAAuD,CAAC;KACnF,MAAM,CAAC,sBAAsB,EAAE,8CAA8C,CAAC;KAC9E,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KAC1E,MAAM,CAAC,sBAAsB,EAAE,6CAA6C,CAAC;KAC7E,MAAM,CAAC,cAAc,EAAE,gEAAgE,CAAC;KACxF,MAAM,CAAC,kBAAkB,EAAE,sHAAsH,CAAC;KAClJ,MAAM,CACL,KAAK,EACH,MAAc,EACd,IAeC,EACD,EAAE;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAgB;YAC3B,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAA+B;YAC5C,WAAW,EAAE,IAAI,CAAC,WAAmC;YACrD,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClC,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,SAAS,EAAE,IAAI,CAAC,OAAO,KAAK,KAAK;YACjC,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI;SAC3C,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAI,EAAC,OAAO,CAAC,CAAC;QAEnC,6BAA6B;QAC7B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC5D,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC;QAC/F,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBACjE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACtF,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,UAAU,oBAAoB,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,cAAc,CAAC,CAAC;QAC3H,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC7C,IAAI,GAAG,CAAC,MAAM;oBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;QAED,kBAAkB;QAClB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,aAAa,GAA2B;gBAC5C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;aACjD,CAAC;YACF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CACrD,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,2EAA2E,CAAC;KACxF,QAAQ,CAAC,WAAW,EAAE,0CAA0C,CAAC;KACjE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,EAAE,MAAM,CAAC;KACrF,MAAM,CACL,+BAA+B,EAC/B,4BAA4B,CAC7B;KACA,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,IAA8C,EAC9C,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAc,EAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,IAAI,CAAC,MAAyD;YACtE,WAAW,EAAE,IAAI,CAAC,WAAmC;SACtD,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAAyD,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,2EAA2E,CAAC;KACxF,QAAQ,CAAC,WAAW,EAAE,2CAA2C,CAAC;KAClE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,EAAE,MAAM,CAAC;KACrF,MAAM,CACL,+BAA+B,EAC/B,4BAA4B,CAC7B;KACA,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,IAA8C,EAC9C,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAe,EAAC,WAAW,EAAE;YAChD,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,IAAI,CAAC,MAAyD;YACtE,WAAW,EAAE,IAAI,CAAC,WAAmC;SACtD,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAAyD,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gFAAgF,CAAC;KAC7F,QAAQ,CACP,UAAU,EACV,iFAAiF,CAClF;KACA,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,EAAE,MAAM,CAAC;KACrF,MAAM,CACL,+BAA+B,EAC/B,4BAA4B,CAC7B;KACA,MAAM,CACL,uBAAuB,EACvB,yDAAyD,EACzD,aAAa,CACd;KACA,MAAM,CACL,KAAK,EACH,MAAc,EACd,IAAgE,EAChE,EAAE;IACF,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,QAAQ,yCAAyC,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAA,uCAAmB,EAAC;YACvC,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAyD;YACtE,WAAW,EAAE,IAAI,CAAC,WAAmC;YACrD,QAAQ,EAAE,IAAI,CAAC,QAAqC;SACrD,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAAyD,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,QAAQ,CAAC,UAAU,EAAE,gDAAgD,CAAC;KACtE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,EAAE,MAAM,CAAC;KACrF,MAAM,CACL,+BAA+B,EAC/B,4BAA4B,CAC7B;KACA,MAAM,CAAC,UAAU,EAAE,wCAAwC,CAAC;KAC5D,MAAM,CACL,KAAK,EACH,MAAc,EACd,IAA4D,EAC5D,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,iDAAuB,EAAC;YAC3C,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAyD;YACtE,WAAW,EAAE,IAAI,CAAC,WAAmC;YACrD,cAAc,EAAE,IAAI,CAAC,GAAG;SACzB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAAyD,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,qEAAqE;AAErE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sEAAsE,CAAC;KACnF,QAAQ,CAAC,OAAO,EAAE,6DAA6D,CAAC;KAChF,MAAM,CAAC,uBAAuB,EAAE,uEAAuE,EAAE,MAAM,CAAC;KAChH,MAAM,CACL,KAAK,EACH,GAAW,EACX,IAAwB,EACxB,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wCAAc,EAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GAAG,IAAA,4CAAkB,EAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAEpE,kDAAkD;QAClD,MAAM,OAAO,GAAgB;YAC3B,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,IAAI,CAAC,MAA+B;SAC7C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAI,EAAC,OAAO,CAAC,CAAC;QAEnC,qCAAqC;QACrC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QAC1F,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAClF,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACtF,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;QAChF,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAElF,OAAO,CAAC,GAAG,CAAC,IAAA,0BAAY,EAAC,MAAM,EAAE,IAAI,CAAC,MAA+B,CAAC,CAAC,CAAC;QAExE,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,qEAAqE;AAErE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,gDAAgD,CAAC;KAC7D,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;KAC7C,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;KACpE,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,IAAI,CAAC;KACxD,MAAM,CACL,KAAK,EACH,GAAW,EACX,IAAuC,EACvC,EAAE;IACF,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAE1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,+BAA+B,GAAG,+BAA+B,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0C,CAAC;QACvE,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAI,EAAC;oBACxB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,IAAI,CAAC,MAA+B;iBAC7C,CAAC,CAAC;gBACH,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;gBAClF,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;gBAC9E,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBACnC,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,KAAK,SAAS,cAAc,SAAS,OAAO,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,eAAe,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,KAAK,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACxE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC5B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,kDAAkD,CAAC;KAC/D,QAAQ,CAAC,WAAW,EAAE,kCAAkC,CAAC;KACzD,MAAM,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,IAAI,CAAC;KACvE,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,EAAE,IAAI,CAAC;KAChE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;KACpE,MAAM,CAAC,QAAQ,EAAE,gDAAgD,CAAC;KAClE,MAAM,CACL,KAAK,EACH,OAAe,EACf,IAKC,EACD,EAAE;IACF,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,iBAAiB;YACjB,MAAM,OAAO,GAAG,MAAM,IAAA,+BAAW,EAC/B,OAAO,EACP,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CACzB,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,yBAAyB,CAAC,CAAC;oBAClE,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;wBACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;wBAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACnD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;4BACjB,OAAO,CAAC,GAAG,CACT,gBAAgB,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9D,CAAC;wBACJ,CAAC;wBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,MAAM,IAAA,iCAAa,EACjB;YACE,OAAO;YACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACrC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAyB;SACvC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAA,+BAAW,EAAC,KAAK,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,+EAA+E;AAE/E,MAAM,SAAS,GAAG,OAAO;KACtB,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,gDAAgD,CAAC,CAAC;AAEjE,SAAS;KACN,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,8CAA8C,CAAC;KAC3D,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;KAC9C,cAAc,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;KAC3E,MAAM,CAAC,CAAC,OAAe,EAAE,IAAsB,EAAE,EAAE;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,kCAAc,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,OAAO,GAAG,IAAA,iCAAa,GAAE,CAAC;IAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oCAAoC,CAAC;KACjD,QAAQ,CAAC,WAAW,EAAE,iCAAiC,CAAC;KACxD,MAAM,CAAC,CAAC,OAAe,EAAE,EAAE;IAC1B,IAAI,CAAC;QACH,IAAA,uCAAmB,EAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,oBAAoB,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,IAAI,CAAC;KACvE,MAAM,CAAC,qBAAqB,EAAE,sCAAsC,EAAE,IAAI,CAAC;KAC3E,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,CAAC;KAC9D,MAAM,CACL,KAAK,EAAE,IAA2D,EAAE,EAAE;IACpE,IAAI,CAAC;QACH,MAAM,IAAA,oCAAgB,EACpB;YACE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACrC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC/B,UAAU,EAAE,IAAI,CAAC,OAAO;SACzB,EACD,CAAC,KAAK,EAAE,EAAE;YACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,+EAA+E;AAE/E,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,+CAA+C,CAAC,CAAC;AAEhE,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CACtE,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,KAAK,0BAA0B,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CACV,uIAAuI,CACxI;KACA,MAAM,CAAC,iBAAiB,EAAE,6CAA6C,CAAC;KACxE,MAAM,CAAC,uBAAuB,EAAE,mDAAmD,CAAC;KACpF,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,UAAU,kBAAkB,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,uEAAuE;AAEvE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,kEAAkE,CAAC;KAC/E,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3D,cAAc,EAAE,CAAC;AACnB,CAAC,CAAC,CAAC;AAEL,uEAAuE;AAEvE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,mBAAmB;AACnB,OAAO,CAAC,uBAAuB,EAAE,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CACV,+GAA+G,CAChH;KACA,kBAAkB,EAAE;KACpB,QAAQ,CAAC,WAAW,EAAE,uCAAuC,CAAC;KAC9D,QAAQ,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;KACjF,MAAM,CAAC,SAAS,EAAE,yCAAyC,CAAC;KAC5D,MAAM,CAAC,WAAW,EAAE,8CAA8C,CAAC;KACnE,MAAM,CACL,KAAK,EACH,OAAe,EACf,WAAqB,EACrB,IAA2C,EAC3C,EAAE;IACF,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE;YACjD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC;AAEJ,OAAO,CAAC,KAAK,EAAE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"correlation-engine.d.ts","sourceRoot":"","sources":["../src/correlation-engine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAY,eAAe,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"correlation-engine.d.ts","sourceRoot":"","sources":["../src/correlation-engine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAY,eAAe,EAAE,MAAM,YAAY,CAAC;AAiQrE,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAsDxE"}
|
|
@@ -136,6 +136,38 @@ const CORRELATION_RULES = [
|
|
|
136
136
|
"Cordyceps composition pattern (novee.security, 2026) - no single line is wrong, but together they " +
|
|
137
137
|
"allow code execution or secret theft across a workflow trust boundary.",
|
|
138
138
|
},
|
|
139
|
+
// --- GitLost-class agentic workflow exfiltration posture (v5.10) ---
|
|
140
|
+
// An AI agent that ingests untrusted issue/PR text, holds a cross-repo token,
|
|
141
|
+
// and can post publicly is the GitLost lethal trifecta (Noma, July 2026). Any
|
|
142
|
+
// two of these together is a strong static signal of the vulnerable posture.
|
|
143
|
+
{
|
|
144
|
+
rules: [
|
|
145
|
+
"GHA_AGENT_UNTRUSTED_PROMPT",
|
|
146
|
+
"GHA_AGENT_PUBLIC_POST",
|
|
147
|
+
"GHA_AGENT_CROSS_REPO_TOKEN",
|
|
148
|
+
"GHA_AGENT_NO_AUTHOR_GATE",
|
|
149
|
+
"AGENTIC_WF_UNTRUSTED_TRIGGER",
|
|
150
|
+
"AGENTIC_WF_PUBLIC_POST_TOOL",
|
|
151
|
+
"AGENTIC_WF_BROAD_ACCESS",
|
|
152
|
+
],
|
|
153
|
+
minMatch: 2,
|
|
154
|
+
// The medium hygiene rules (NO_AUTHOR_GATE, UNTRUSTED_TRIGGER) co-occur on
|
|
155
|
+
// ordinary triage bots, so 2-of-N alone would false-fire. Require at least
|
|
156
|
+
// one rule that proves the agent actually ingests untrusted input OR can
|
|
157
|
+
// post publicly (mirrors the Cordyceps requireAnyOf guard).
|
|
158
|
+
requireAnyOf: [
|
|
159
|
+
"GHA_AGENT_UNTRUSTED_PROMPT",
|
|
160
|
+
"GHA_AGENT_PUBLIC_POST",
|
|
161
|
+
"AGENTIC_WF_PUBLIC_POST_TOOL",
|
|
162
|
+
],
|
|
163
|
+
incident: "GitLost-class Agentic Workflow Exfiltration Posture",
|
|
164
|
+
severity: "critical",
|
|
165
|
+
confidenceBoost: 0.2,
|
|
166
|
+
narrative: "An AI-agent workflow ingests attacker-controllable issue/PR text, can reach cross-repo data, " +
|
|
167
|
+
"and can post publicly - the GitLost lethal trifecta (Noma Security, July 2026). An unauthenticated " +
|
|
168
|
+
"attacker who files an issue could prompt-inject the agent into leaking private repository contents " +
|
|
169
|
+
"through a public comment. Scope the token to one repo, gate on author trust, and remove public-write.",
|
|
170
|
+
},
|
|
139
171
|
// --- Obfuscation + exfil = malware ---
|
|
140
172
|
{
|
|
141
173
|
rules: ["EVAL_ATOB", "HIGH_ENTROPY_STRING", "ENV_EXFILTRATION", "DEAD_DROP_TELEGRAM"],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"correlation-engine.js","sourceRoot":"","sources":["../src/correlation-engine.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;
|
|
1
|
+
{"version":3,"file":"correlation-engine.js","sourceRoot":"","sources":["../src/correlation-engine.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAmRH,8CAsDC;AA5SD,MAAM,iBAAiB,GAAsB;IAC3C,0BAA0B;IAC1B;QACE,KAAK,EAAE,CAAC,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,oJAAoJ;KAChK;IACD;QACE,KAAK,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACjG,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8CAA8C;QACxD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8IAA8I;KAC1J;IACD;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,yBAAyB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,gGAAgG;KAC5G;IAED,6BAA6B;IAC7B;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,CAAC;QAClH,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8JAA8J;KAC1K;IACD;QACE,KAAK,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACtE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,4BAA4B;QACtC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,+HAA+H;KAC3I;IAED,qCAAqC;IACrC;QACE,KAAK,EAAE,CAAC,2BAA2B,EAAE,sBAAsB,EAAE,qBAAqB,CAAC;QACnF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,mIAAmI;KAC/I;IACD;QACE,KAAK,EAAE,CAAC,2BAA2B,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;QACxF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,uCAAuC;QACjD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8IAA8I;KAC1J;IACD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;QAC5E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,yIAAyI;KACrJ;IAED,2BAA2B;IAC3B;QACE,KAAK,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,CAAC;QAClG,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,sCAAsC;QAChD,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8HAA8H;KAC1I;IACD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,oBAAoB,CAAC;QAC9E,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,uBAAuB;QACjC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,4GAA4G;KACxH;IAED,0BAA0B;IAC1B;QACE,KAAK,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACvE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,0BAA0B;QACpC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,qHAAqH;KACjI;IAED,6CAA6C;IAC7C,6EAA6E;IAC7E,2EAA2E;IAC3E,6DAA6D;IAC7D;QACE,KAAK,EAAE;YACL,mCAAmC;YACnC,0BAA0B;YAC1B,6BAA6B;YAC7B,wBAAwB;YACxB,sBAAsB;YACtB,qBAAqB;YACrB,yBAAyB;SAC1B;QACD,QAAQ,EAAE,CAAC;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,sDAAsD;QACtD,YAAY,EAAE;YACZ,mCAAmC;YACnC,0BAA0B;YAC1B,6BAA6B;YAC7B,sBAAsB;YACtB,qBAAqB;SACtB;QACD,QAAQ,EAAE,oCAAoC;QAC9C,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EACP,oGAAoG;YACpG,uGAAuG;YACvG,oGAAoG;YACpG,wEAAwE;KAC3E;IAED,sEAAsE;IACtE,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E;QACE,KAAK,EAAE;YACL,4BAA4B;YAC5B,uBAAuB;YACvB,4BAA4B;YAC5B,0BAA0B;YAC1B,8BAA8B;YAC9B,6BAA6B;YAC7B,yBAAyB;SAC1B;QACD,QAAQ,EAAE,CAAC;QACX,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,4DAA4D;QAC5D,YAAY,EAAE;YACZ,4BAA4B;YAC5B,uBAAuB;YACvB,6BAA6B;SAC9B;QACD,QAAQ,EAAE,qDAAqD;QAC/D,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,GAAG;QACpB,SAAS,EACP,+FAA+F;YAC/F,qGAAqG;YACrG,qGAAqG;YACrG,uGAAuG;KAC1G;IAED,wCAAwC;IACxC;QACE,KAAK,EAAE,CAAC,WAAW,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;QACrF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,4BAA4B;QACtC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,kHAAkH;KAC9H;IAED,2BAA2B;IAC3B;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;QACtH,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,2BAA2B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,6GAA6G;KACzH;IAED,kDAAkD;IAClD;QACE,KAAK,EAAE,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;QACvD,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8BAA8B;QACxC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,iHAAiH;KAC7H;IAED,2CAA2C;IAC3C;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC;QACtE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,2BAA2B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,8GAA8G;KAC1H;IACD;QACE,KAAK,EAAE,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,yBAAyB,CAAC;QACtF,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,kCAAkC;QAC5C,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,0HAA0H;KACtI;IACD;QACE,KAAK,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;QACpE,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,8BAA8B;QACxC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,IAAI;QACrB,SAAS,EAAE,wGAAwG;KACpH;CACF,CAAC;AAeF,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;GAEG;AACH,SAAgB,iBAAiB,CAAC,QAAmB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,aAAa,GACjB,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtE,IAAI,YAAY,CAAC,MAAM,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;YAErC,iDAAiD;YACjD,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAE9E,uCAAuC;YACvC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChC,CAAC,CAAC,aAAa,GAAG,EAAE,CAAC;gBACrB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;YAC7E,CAAC;YAED,gCAAgC;YAChC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAC1C,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAC,CAC3C,GAAG,eAAe,CAAC,MAAM,CAAC;YAE3B,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE;gBACF,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;gBACxC,QAAQ,EAAE,eAAe;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC;YAEH,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,mCAAmC,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACrI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAEpC,gCAAgC;IAChC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAEtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC"}
|
|
@@ -273,6 +273,107 @@ function scanWorkflowContent(content, relativePath, findings) {
|
|
|
273
273
|
// know which event fires the workflow and what its token can do, which the
|
|
274
274
|
// line-by-line passes above are blind to.
|
|
275
275
|
checkWorkflowAstRules(content, relativePath, findings);
|
|
276
|
+
// v5.10: GitLost-class agent-workflow posture (trigger + agent step + token + public post)
|
|
277
|
+
checkAgentWorkflowRules(content, relativePath, findings);
|
|
278
|
+
}
|
|
279
|
+
/**
|
|
280
|
+
* v5.10 GitLost-class rules. An AI-agent step that ingests attacker-controllable
|
|
281
|
+
* event text, holds a cross-repo-capable token, and can post publicly is the
|
|
282
|
+
* exact "lethal trifecta" the GitLost disclosure (Noma, July 2026) exploited.
|
|
283
|
+
* We can only see the checked-in POSTURE, never the runtime injection payload,
|
|
284
|
+
* so these are pre-attack hardening warnings, not attack detections.
|
|
285
|
+
*/
|
|
286
|
+
function checkAgentWorkflowRules(content, relativePath, findings) {
|
|
287
|
+
let ast;
|
|
288
|
+
try {
|
|
289
|
+
ast = (0, workflow_ast_js_1.parseWorkflow)(content);
|
|
290
|
+
}
|
|
291
|
+
catch {
|
|
292
|
+
return;
|
|
293
|
+
}
|
|
294
|
+
const triggerSet = new Set(ast.triggers);
|
|
295
|
+
const untrusted = AGENT_UNTRUSTED_TRIGGERS.filter((t) => triggerSet.has(t));
|
|
296
|
+
if (untrusted.length === 0)
|
|
297
|
+
return; // no attacker-controllable input path
|
|
298
|
+
// Collect agent steps across all jobs.
|
|
299
|
+
const agentSteps = [];
|
|
300
|
+
for (const job of ast.jobs) {
|
|
301
|
+
for (const step of job.steps) {
|
|
302
|
+
if (isAgentStep(step))
|
|
303
|
+
agentSteps.push({ step, job });
|
|
304
|
+
}
|
|
305
|
+
}
|
|
306
|
+
if (agentSteps.length === 0)
|
|
307
|
+
return;
|
|
308
|
+
const canPostPublicly = (job) => {
|
|
309
|
+
const scopeWrites = (p) => p.writeAll || PUBLIC_POST_SCOPES.some((s) => p.scopes[s] === "write");
|
|
310
|
+
return scopeWrites(ast.permissions) || scopeWrites(job.permissions);
|
|
311
|
+
};
|
|
312
|
+
for (const { step, job } of agentSteps) {
|
|
313
|
+
// GHA_AGENT_UNTRUSTED_PROMPT (critical): agent ingests untrusted event context.
|
|
314
|
+
if (UNTRUSTED_CTX_RE.test(agentStepText(step))) {
|
|
315
|
+
findings.push({
|
|
316
|
+
rule: "GHA_AGENT_UNTRUSTED_PROMPT",
|
|
317
|
+
description: `AI-agent step ingests attacker-controllable GitHub event context ` +
|
|
318
|
+
`(issue/PR/comment body or title) as part of its instructions on an untrusted ` +
|
|
319
|
+
`trigger (${untrusted.join(", ")}). This is the core of the GitLost prompt-injection ` +
|
|
320
|
+
`class: the agent cannot distinguish your instructions from an attacker's issue text.`,
|
|
321
|
+
severity: "critical",
|
|
322
|
+
file: relativePath,
|
|
323
|
+
line: step.line,
|
|
324
|
+
recommendation: getWorkflowRecommendation("GHA_AGENT_UNTRUSTED_PROMPT"),
|
|
325
|
+
});
|
|
326
|
+
}
|
|
327
|
+
// GHA_AGENT_PUBLIC_POST (high): the same job can post the agent's output publicly.
|
|
328
|
+
if (canPostPublicly(job)) {
|
|
329
|
+
findings.push({
|
|
330
|
+
rule: "GHA_AGENT_PUBLIC_POST",
|
|
331
|
+
description: `AI-agent job on an untrusted trigger (${untrusted.join(", ")}) also holds ` +
|
|
332
|
+
`issues:write / pull-requests:write, so the agent can post its output as a public ` +
|
|
333
|
+
`comment. That comment is the GitLost exfiltration channel: private data the agent ` +
|
|
334
|
+
`read becomes readable by anyone who can see the issue.`,
|
|
335
|
+
severity: "high",
|
|
336
|
+
file: relativePath,
|
|
337
|
+
line: step.line,
|
|
338
|
+
recommendation: getWorkflowRecommendation("GHA_AGENT_PUBLIC_POST"),
|
|
339
|
+
});
|
|
340
|
+
}
|
|
341
|
+
// GHA_AGENT_CROSS_REPO_TOKEN (high): a non-default token is fed to the agent.
|
|
342
|
+
const tokenRefs = [
|
|
343
|
+
step.withToken ?? "",
|
|
344
|
+
step.env?.GH_TOKEN ?? "",
|
|
345
|
+
step.env?.GITHUB_TOKEN ?? "",
|
|
346
|
+
].join(" ");
|
|
347
|
+
const usesNonDefaultSecret = /\$\{\{\s*secrets\.(?!GITHUB_TOKEN\b)[A-Za-z0-9_]+\s*\}\}/.test(tokenRefs);
|
|
348
|
+
if (usesNonDefaultSecret) {
|
|
349
|
+
findings.push({
|
|
350
|
+
rule: "GHA_AGENT_CROSS_REPO_TOKEN",
|
|
351
|
+
description: `AI-agent step is handed a custom token secret (not the default GITHUB_TOKEN). ` +
|
|
352
|
+
`A broadly-scoped PAT lets the agent read OTHER repositories, including private ones - ` +
|
|
353
|
+
`the cross-repo read that turns a single-repo prompt injection into an org-wide leak. ` +
|
|
354
|
+
`Verify this token is a fine-grained, single-repository token.`,
|
|
355
|
+
severity: "high",
|
|
356
|
+
file: relativePath,
|
|
357
|
+
line: step.line,
|
|
358
|
+
recommendation: getWorkflowRecommendation("GHA_AGENT_CROSS_REPO_TOKEN"),
|
|
359
|
+
});
|
|
360
|
+
}
|
|
361
|
+
}
|
|
362
|
+
// GHA_AGENT_NO_AUTHOR_GATE (medium): agent driven by an externally-fileable
|
|
363
|
+
// trigger with no author-trust gate anywhere in the file.
|
|
364
|
+
const externallyFileable = EXTERNALLY_FILEABLE_TRIGGERS.some((t) => triggerSet.has(t));
|
|
365
|
+
if (externallyFileable && !AUTHOR_GATE_RE.test(content)) {
|
|
366
|
+
findings.push({
|
|
367
|
+
rule: "GHA_AGENT_NO_AUTHOR_GATE",
|
|
368
|
+
description: `AI-agent workflow is triggered by issues/comments (externally fileable by anyone) ` +
|
|
369
|
+
`but has no author-trust gate. An unauthenticated attacker can open an issue and drive ` +
|
|
370
|
+
`the agent - the entry point the GitLost attack used.`,
|
|
371
|
+
severity: "medium",
|
|
372
|
+
file: relativePath,
|
|
373
|
+
line: agentSteps[0].step.line,
|
|
374
|
+
recommendation: getWorkflowRecommendation("GHA_AGENT_NO_AUTHOR_GATE"),
|
|
375
|
+
});
|
|
376
|
+
}
|
|
276
377
|
}
|
|
277
378
|
// ── v5.7 Cordyceps trigger-aware rules ──────────────────────────────────────
|
|
278
379
|
/**
|
|
@@ -299,6 +400,50 @@ const PWN_CHECKOUT_TRIGGERS = ["pull_request_target", "workflow_run", "issue_com
|
|
|
299
400
|
const PR_HEAD_REF_RE = /github\.head_ref|github\.event\.pull_request\.head|github\.event\.workflow_run\.head|github\.event\.(?:pull_request\.number|number)|refs\/pull\/|\$\{\{\s*(?:matrix|steps|needs)\./;
|
|
300
401
|
/** Untrusted context interpolated inside an actions/github-script `script:` body. */
|
|
301
402
|
const UNTRUSTED_CTX_RE = /\$\{\{\s*github\.(?:event\.(?:issue|pull_request|comment|review|discussion|head_commit|commits?)|head_ref|ref_name)\b/;
|
|
403
|
+
// ── v5.10 GitLost-class agent-workflow rules ────────────────────────────────
|
|
404
|
+
/**
|
|
405
|
+
* Actions that hand control to an autonomous AI agent which then reads workflow
|
|
406
|
+
* inputs (issue/PR/comment text) as instructions. Matched owner/repo prefix,
|
|
407
|
+
* ref-agnostic. This is an allowlist that will grow as new agent actions ship.
|
|
408
|
+
*/
|
|
409
|
+
const AGENT_ACTION_RE = /^(?:anthropics\/claude-code-action|anthropics\/claude-code-base-action|githubnext\/gh-aw|google-github-actions\/run-gemini-cli|google-gemini\/gemini-cli-action|openai\/codex-action)(?:@|$|\/)/i;
|
|
410
|
+
/** Agent CLIs invoked from a `run:` block (the non-action form of the same thing). */
|
|
411
|
+
const AGENT_CLI_RE = /\b(?:claude\s+(?:-p|--print)|copilot\s+(?:-p|suggest|exec)|gemini\s+(?:-p|--prompt)|codex\s+exec|aider\s+(?:--message|-m)\b)/i;
|
|
412
|
+
/**
|
|
413
|
+
* Triggers that feed ATTACKER-CONTROLLABLE text (issue/PR/comment/discussion
|
|
414
|
+
* bodies and titles) into the workflow, and hence into an agent step's prompt.
|
|
415
|
+
* `issues`/`issue_comment` are the verified GitLost vectors; the pull_request*
|
|
416
|
+
* and discussion* families are the same class.
|
|
417
|
+
*/
|
|
418
|
+
const AGENT_UNTRUSTED_TRIGGERS = [
|
|
419
|
+
"issues",
|
|
420
|
+
"issue_comment",
|
|
421
|
+
"pull_request",
|
|
422
|
+
"pull_request_target",
|
|
423
|
+
"pull_request_review",
|
|
424
|
+
"pull_request_review_comment",
|
|
425
|
+
"discussion",
|
|
426
|
+
"discussion_comment",
|
|
427
|
+
];
|
|
428
|
+
/** Token scopes that let a job post PUBLICLY (the GitLost exfiltration channel). */
|
|
429
|
+
const PUBLIC_POST_SCOPES = ["issues", "pull-requests"];
|
|
430
|
+
/** Any signal that the workflow gates on WHO triggered it (author trust). */
|
|
431
|
+
const AUTHOR_GATE_RE = /author_association|github\.actor\b|github\.triggering_actor\b|\.user\.login\b/;
|
|
432
|
+
/** Issue/comment triggers where an anonymous external user drives the agent. */
|
|
433
|
+
const EXTERNALLY_FILEABLE_TRIGGERS = ["issues", "issue_comment"];
|
|
434
|
+
/** True when a step hands control to an AI agent (action form or CLI form). */
|
|
435
|
+
function isAgentStep(step) {
|
|
436
|
+
if (step.uses && AGENT_ACTION_RE.test(step.uses))
|
|
437
|
+
return true;
|
|
438
|
+
if (step.run && AGENT_CLI_RE.test(step.run))
|
|
439
|
+
return true;
|
|
440
|
+
return false;
|
|
441
|
+
}
|
|
442
|
+
/** All text an agent step ingests where untrusted context could appear. */
|
|
443
|
+
function agentStepText(step) {
|
|
444
|
+
const envVals = step.env ? Object.values(step.env).join("\n") : "";
|
|
445
|
+
return [step.withPrompt ?? "", step.run ?? "", envVals].join("\n");
|
|
446
|
+
}
|
|
302
447
|
/**
|
|
303
448
|
* Structural rules that depend on the workflow's trigger and token model.
|
|
304
449
|
* Parsed once per file via the zero-dependency workflow-ast parser.
|
|
@@ -679,6 +824,18 @@ function getWorkflowRecommendation(rule) {
|
|
|
679
824
|
"top-level permissions to read-only and grant write only where required.",
|
|
680
825
|
GHA_PERMS_DEFAULT_BROAD: "Add an explicit top-level 'permissions:' block scoped to the minimum (start from 'contents: read'). Privileged " +
|
|
681
826
|
"triggers should never rely on the repository default token, which is often read+write across all scopes.",
|
|
827
|
+
GHA_AGENT_UNTRUSTED_PROMPT: "Do not interpolate untrusted event context (github.event.issue/comment/pull_request body or title) " +
|
|
828
|
+
"into an AI-agent prompt. Pass only sanitized, structured fields, gate the job on author_association, " +
|
|
829
|
+
"and treat all issue/PR text as untrusted data the agent must never act on as instructions.",
|
|
830
|
+
GHA_AGENT_PUBLIC_POST: "Remove issues:write / pull-requests:write from any job where an AI agent processes untrusted input, " +
|
|
831
|
+
"or split the agent (read-only, no public-write token) from the step that posts. An agent that can both " +
|
|
832
|
+
"read private data and post publicly is a one-step exfiltration channel.",
|
|
833
|
+
GHA_AGENT_CROSS_REPO_TOKEN: "Scope the agent's token to the single repository it needs. Prefer the default GITHUB_TOKEN or a " +
|
|
834
|
+
"fine-grained PAT limited to one repo. A broad org/classic PAT lets a prompt-injected agent read every " +
|
|
835
|
+
"private repo it can reach.",
|
|
836
|
+
GHA_AGENT_NO_AUTHOR_GATE: "Gate AI-agent jobs triggered by issues/comments on the author's trust level " +
|
|
837
|
+
"(if: contains(fromJSON('[\"OWNER\",\"MEMBER\",\"COLLABORATOR\"]'), github.event.issue.author_association)) " +
|
|
838
|
+
"so anonymous external users cannot drive the agent.",
|
|
682
839
|
};
|
|
683
840
|
return map[rule] ?? "Review this finding and assess whether it represents legitimate CI/CD functionality.";
|
|
684
841
|
}
|