toolip 1.0.7 → 2.0.1

package/dist/src/contracts/report.d.ts

@@ -0,0 +1,30 @@
+import type { Finding } from './finding.js';
+export declare const TOOLIP_REPORT_SCHEMA_VERSION = "2.0";
+export type ReportSummary = {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    info: number;
+    total: number;
+};
+export type ToolipReportV2 = {
+    schemaVersion: typeof TOOLIP_REPORT_SCHEMA_VERSION;
+    generatedAt: string;
+    toolipVersion: string;
+    project: {
+        root: string;
+        name?: string;
+        packageManager?: string;
+    };
+    summary: ReportSummary;
+    findings: Finding[];
+    analyzers: Array<{
+        id: string;
+        version: string;
+        durationMs: number;
+        findingCount: number;
+        warnings?: string[];
+    }>;
+    metadata?: Record<string, unknown>;
+};

package/dist/src/contracts/report.js

@@ -0,0 +1,2 @@
+export const TOOLIP_REPORT_SCHEMA_VERSION = '2.0';
+//# sourceMappingURL=report.js.map

package/dist/src/contracts/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/contracts/report.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC"}

package/dist/src/contracts/rule.d.ts

@@ -0,0 +1,12 @@
+import type { FindingConfidence, FindingSeverity } from './finding.js';
+export type RuleDefinition = {
+    id: string;
+    title: string;
+    category: string;
+    defaultSeverity: FindingSeverity;
+    defaultConfidence: FindingConfidence;
+    description: string;
+    remediation: string;
+    references?: string[];
+};
+export declare function assertValidRuleId(ruleId: string): void;

package/dist/src/contracts/rule.js

@@ -0,0 +1,7 @@
+const RULE_ID_PATTERN = /^TLP-[A-Z]+-\d{3}$/;
+export function assertValidRuleId(ruleId) {
+    if (!RULE_ID_PATTERN.test(ruleId)) {
+        throw new Error(`Invalid Toolip rule ID "${ruleId}". Expected format: TLP-CATEGORY-001.`);
+    }
+}
+//# sourceMappingURL=rule.js.map

package/dist/src/contracts/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../../src/contracts/rule.ts"],"names":[],"mappings":"AAgBA,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,uCAAuC,CACzE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/core/announce/generate.d.ts

@@ -0,0 +1,9 @@
+export type AnnouncementInput = {
+    version?: string;
+    fixed: number;
+    added: number;
+    removed: number;
+    scoreBefore?: number;
+    scoreAfter?: number;
+};
+export declare function generateAnnouncement(input: AnnouncementInput): string;

package/dist/src/core/announce/generate.js

@@ -0,0 +1,19 @@
+export function generateAnnouncement(input) {
+    const title = input.version
+        ? `Toolip ${input.version} security update`
+        : 'Toolip security update';
+    const lines = [
+        title,
+        '',
+        `Fixed findings: ${input.fixed}`,
+        `New findings: ${input.added}`,
+        `Removed findings: ${input.removed}`
+    ];
+    if (input.scoreBefore !== undefined &&
+        input.scoreAfter !== undefined) {
+        lines.push(`Security score: ${input.scoreBefore} → ${input.scoreAfter}`);
+    }
+    lines.push('', 'This summary was generated locally from structured Toolip scan differences.');
+    return lines.join('\n');
+}
+//# sourceMappingURL=generate.js.map

package/dist/src/core/announce/generate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../../../src/core/announce/generate.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO;QACzB,CAAC,CAAC,UAAU,KAAK,CAAC,OAAO,kBAAkB;QAC3C,CAAC,CAAC,wBAAwB,CAAC;IAE7B,MAAM,KAAK,GAAG;QACZ,KAAK;QACL,EAAE;QACF,mBAAmB,KAAK,CAAC,KAAK,EAAE;QAChC,iBAAiB,KAAK,CAAC,KAAK,EAAE;QAC9B,qBAAqB,KAAK,CAAC,OAAO,EAAE;KACrC,CAAC;IAEF,IACE,KAAK,CAAC,WAAW,KAAK,SAAS;QAC/B,KAAK,CAAC,UAAU,KAAK,SAAS,EAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CACR,mBAAmB,KAAK,CAAC,WAAW,MAAM,KAAK,CAAC,UAAU,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,6EAA6E,CAC9E,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/core/config/load.d.ts

@@ -0,0 +1,3 @@
+import { type ToolipConfig } from './schema.js';
+export declare const TOOLIP_CONFIG_FILE = "toolip.config.json";
+export declare function loadToolipConfig(root: string): Promise<ToolipConfig>;

package/dist/src/core/config/load.js

@@ -0,0 +1,21 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { toolipConfigSchema } from './schema.js';
+export const TOOLIP_CONFIG_FILE = 'toolip.config.json';
+export async function loadToolipConfig(root) {
+    const filePath = path.join(root, TOOLIP_CONFIG_FILE);
+    try {
+        const raw = await readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return toolipConfigSchema.parse(parsed);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            'code' in error &&
+            error.code === 'ENOENT') {
+            return toolipConfigSchema.parse({});
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=load.js.map

package/dist/src/core/config/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../../src/core/config/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,kBAAkB,GAC7B,oBAAoB,CAAC;AAEvB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,IAAI,EACJ,kBAAkB,CACnB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAE1C,OAAO,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,KAAK;YACtB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;YACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/core/config/policy.d.ts

@@ -0,0 +1,3 @@
+import type { Finding } from '../../contracts/finding.js';
+import type { ToolipConfig } from './schema.js';
+export declare function applyFindingPolicy(findings: Finding[], config: ToolipConfig): Finding[];

package/dist/src/core/config/policy.js

@@ -0,0 +1,48 @@
+function wildcardMatch(value, pattern) {
+    const escaped = pattern
+        .replaceAll(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replaceAll('**', '___DOUBLE_STAR___')
+        .replaceAll('*', '[^/]*')
+        .replaceAll('___DOUBLE_STAR___', '.*');
+    return new RegExp(`^${escaped}$`).test(value);
+}
+function suppressionActive(expiresAt) {
+    return (expiresAt === undefined ||
+        new Date(expiresAt).getTime() > Date.now());
+}
+export function applyFindingPolicy(findings, config) {
+    const output = [];
+    for (const finding of findings) {
+        const rule = config.rules[finding.ruleId];
+        const file = finding.location?.file ?? '';
+        if (rule?.enabled === false) {
+            continue;
+        }
+        let severity = rule?.severity ?? finding.severity;
+        for (const pathRule of rule?.paths ?? []) {
+            if (file &&
+                wildcardMatch(file, pathRule.pattern)) {
+                if (pathRule.enabled === false) {
+                    severity = finding.severity;
+                    break;
+                }
+                severity =
+                    pathRule.severity ?? severity;
+            }
+        }
+        const suppressed = config.suppressions.some((suppression) => suppression.ruleId === finding.ruleId &&
+            suppressionActive(suppression.expiresAt) &&
+            (suppression.path === undefined ||
+                (file &&
+                    wildcardMatch(file, suppression.path))));
+        if (suppressed) {
+            continue;
+        }
+        output.push({
+            ...finding,
+            severity
+        });
+    }
+    return output;
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/core/config/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../src/core/config/policy.ts"],"names":[],"mappings":"AAGA,SAAS,aAAa,CACpB,KAAa,EACb,OAAe;IAEf,MAAM,OAAO,GAAG,OAAO;SACpB,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACvC,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC;SACrC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAEzC,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAkB;IAElB,OAAO,CACL,SAAS,KAAK,SAAS;QACvB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAmB,EACnB,MAAoB;IAEpB,MAAM,MAAM,GAAc,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAE1C,IAAI,IAAI,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,GACV,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IACE,IAAI;gBACJ,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,EACrC,CAAC;gBACD,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;oBAC/B,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;oBAC5B,MAAM;gBACR,CAAC;gBAED,QAAQ;oBACN,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC;YAClC,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CACzC,CAAC,WAAW,EAAE,EAAE,CACd,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YACrC,iBAAiB,CACf,WAAW,CAAC,SAAS,CACtB;YACD,CACE,WAAW,CAAC,IAAI,KAAK,SAAS;gBAC9B,CACE,IAAI;oBACJ,aAAa,CACX,IAAI,EACJ,WAAW,CAAC,IAAI,CACjB,CACF,CACF,CACJ,CAAC;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,OAAO;YACV,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/core/config/schema.d.ts

@@ -0,0 +1,172 @@
+import { z } from 'zod';
+export declare const toolipConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodDefault<z.ZodLiteral<"1.0">>;
+    include: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    exclude: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        severity: z.ZodOptional<z.ZodEnum<["critical", "high", "medium", "low", "info"]>>;
+        paths: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodString;
+            severity: z.ZodOptional<z.ZodEnum<["critical", "high", "medium", "low", "info"]>>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }, {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+        enabled?: boolean | undefined;
+        paths?: {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+    }, {
+        severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+        enabled?: boolean | undefined;
+        paths?: {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+    }>>>;
+    suppressions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        ruleId: z.ZodString;
+        path: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        ruleId: string;
+        reason: string;
+        expiresAt?: string | undefined;
+        path?: string | undefined;
+    }, {
+        ruleId: string;
+        reason: string;
+        expiresAt?: string | undefined;
+        path?: string | undefined;
+    }>, "many">>;
+    history: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxEntries: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        maxEntries: number;
+    }, {
+        enabled?: boolean | undefined;
+        maxEntries?: number | undefined;
+    }>>;
+    providers: z.ZodDefault<z.ZodObject<{
+        osv: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            timeoutMs: number;
+            enabled: boolean;
+        }, {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        }>>;
+        depsDev: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            timeoutMs: number;
+            enabled: boolean;
+        }, {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        osv: {
+            timeoutMs: number;
+            enabled: boolean;
+        };
+        depsDev: {
+            timeoutMs: number;
+            enabled: boolean;
+        };
+    }, {
+        osv?: {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+        depsDev?: {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    schemaVersion: "1.0";
+    history: {
+        enabled: boolean;
+        maxEntries: number;
+    };
+    include: string[];
+    exclude: string[];
+    rules: Record<string, {
+        severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+        enabled?: boolean | undefined;
+        paths?: {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+    }>;
+    suppressions: {
+        ruleId: string;
+        reason: string;
+        expiresAt?: string | undefined;
+        path?: string | undefined;
+    }[];
+    providers: {
+        osv: {
+            timeoutMs: number;
+            enabled: boolean;
+        };
+        depsDev: {
+            timeoutMs: number;
+            enabled: boolean;
+        };
+    };
+}, {
+    schemaVersion?: "1.0" | undefined;
+    history?: {
+        enabled?: boolean | undefined;
+        maxEntries?: number | undefined;
+    } | undefined;
+    include?: string[] | undefined;
+    exclude?: string[] | undefined;
+    rules?: Record<string, {
+        severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+        enabled?: boolean | undefined;
+        paths?: {
+            pattern: string;
+            severity?: "info" | "low" | "medium" | "high" | "critical" | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+    }> | undefined;
+    suppressions?: {
+        ruleId: string;
+        reason: string;
+        expiresAt?: string | undefined;
+        path?: string | undefined;
+    }[] | undefined;
+    providers?: {
+        osv?: {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+        depsDev?: {
+            timeoutMs?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+    } | undefined;
+}>;
+export type ToolipConfig = z.infer<typeof toolipConfigSchema>;

package/dist/src/core/config/schema.js

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+export const toolipConfigSchema = z.object({
+    schemaVersion: z.literal('1.0').default('1.0'),
+    include: z.array(z.string()).default([]),
+    exclude: z.array(z.string()).default([]),
+    rules: z
+        .record(z.object({
+        enabled: z.boolean().optional(),
+        severity: z
+            .enum([
+            'critical',
+            'high',
+            'medium',
+            'low',
+            'info'
+        ])
+            .optional(),
+        paths: z
+            .array(z.object({
+            pattern: z.string(),
+            severity: z
+                .enum([
+                'critical',
+                'high',
+                'medium',
+                'low',
+                'info'
+            ])
+                .optional(),
+            enabled: z.boolean().optional()
+        }))
+            .optional()
+    }))
+        .default({}),
+    suppressions: z
+        .array(z.object({
+        ruleId: z.string(),
+        path: z.string().optional(),
+        reason: z.string().min(3),
+        expiresAt: z.string().datetime().optional()
+    }))
+        .default([]),
+    history: z
+        .object({
+        enabled: z.boolean().default(true),
+        maxEntries: z.number().int().positive().max(5000).default(500)
+    })
+        .default({
+        enabled: true,
+        maxEntries: 500
+    }),
+    providers: z
+        .object({
+        osv: z
+            .object({
+            enabled: z.boolean().default(true),
+            timeoutMs: z.number().int().positive().default(20000)
+        })
+            .default({
+            enabled: true,
+            timeoutMs: 20000
+        }),
+        depsDev: z
+            .object({
+            enabled: z.boolean().default(true),
+            timeoutMs: z.number().int().positive().default(20000)
+        })
+            .default({
+            enabled: true,
+            timeoutMs: 20000
+        })
+    })
+        .default({
+        osv: {
+            enabled: true,
+            timeoutMs: 20000
+        },
+        depsDev: {
+            enabled: true,
+            timeoutMs: 20000
+        }
+    })
+});
+//# sourceMappingURL=schema.js.map

package/dist/src/core/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/core/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,KAAK,EAAE,CAAC;SACL,MAAM,CACL,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC;YACJ,UAAU;YACV,MAAM;YACN,QAAQ;YACR,KAAK;YACL,MAAM;SACP,CAAC;aACD,QAAQ,EAAE;QACb,KAAK,EAAE,CAAC;aACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC;gBACJ,UAAU;gBACV,MAAM;gBACN,QAAQ;gBACR,KAAK;gBACL,MAAM;aACP,CAAC;iBACD,QAAQ,EAAE;YACb,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAChC,CAAC,CACH;aACA,QAAQ,EAAE;KACd,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAC/D,CAAC;SACD,OAAO,CAAC;QACP,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,GAAG;KAChB,CAAC;IACJ,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,GAAG,EAAE,CAAC;aACH,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACtD,CAAC;aACD,OAAO,CAAC;YACP,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB,CAAC;QACJ,OAAO,EAAE,CAAC;aACP,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACtD,CAAC;aACD,OAAO,CAAC;YACP,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB,CAAC;KACL,CAAC;SACD,OAAO,CAAC;QACP,GAAG,EAAE;YACH,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB;QACD,OAAO,EAAE;YACP,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB;KACF,CAAC;CACL,CAAC,CAAC"}

package/dist/src/core/dependencies/inventory.d.ts

@@ -0,0 +1,9 @@
+export type DependencyIdentity = {
+    ecosystem: 'npm';
+    name: string;
+    version: string;
+    direct: boolean;
+    development: boolean;
+    source: 'package-lock';
+};
+export declare function readNpmDependencyInventory(root: string): Promise<DependencyIdentity[]>;

package/dist/src/core/dependencies/inventory.js

@@ -0,0 +1,43 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+function packageNameFromLockPath(lockPath) {
+    const marker = 'node_modules/';
+    const markerIndex = lockPath.lastIndexOf(marker);
+    if (markerIndex === -1)
+        return undefined;
+    return lockPath.slice(markerIndex + marker.length);
+}
+function isDirectPackagePath(lockPath) {
+    if (!lockPath.startsWith('node_modules/'))
+        return false;
+    const remainder = lockPath.slice('node_modules/'.length);
+    if (remainder.startsWith('@'))
+        return remainder.split('/').length === 2;
+    return !remainder.includes('/');
+}
+export async function readNpmDependencyInventory(root) {
+    const raw = await readFile(path.join(root, 'package-lock.json'), 'utf8');
+    const lockfile = JSON.parse(raw);
+    if (!lockfile.packages) {
+        throw new Error('Toolip requires package-lock.json lockfileVersion 2 or newer.');
+    }
+    const dependencies = new Map();
+    for (const [lockPath, entry] of Object.entries(lockfile.packages)) {
+        if (lockPath === '' || !entry.version)
+            continue;
+        const name = entry.name ?? packageNameFromLockPath(lockPath);
+        if (!name)
+            continue;
+        const identity = {
+            ecosystem: 'npm',
+            name,
+            version: entry.version,
+            direct: isDirectPackagePath(lockPath),
+            development: Boolean(entry.dev),
+            source: 'package-lock'
+        };
+        dependencies.set(`npm:${identity.name}@${identity.version}`, identity);
+    }
+    return [...dependencies.values()].sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+}
+//# sourceMappingURL=inventory.js.map

package/dist/src/core/dependencies/inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../../../../src/core/dependencies/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,MAAM,GAAG,eAAe,CAAC;IAC/B,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,QAAQ,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACxE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY;IAC3D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAElD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,QAAQ,GAAuB;YACnC,SAAS,EAAE,KAAK;YAChB,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC;YACrC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;YAC/B,MAAM,EAAE,cAAc;SACvB,CAAC;QAEF,YAAY,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CACjE,CAAC;AACJ,CAAC"}

package/dist/src/core/diff/security-diff.d.ts

@@ -0,0 +1,10 @@
+export type SecurityDiffResult = {
+    base: string;
+    head: string;
+    files: string[];
+    packageManifestChanged: boolean;
+    lockfileChanged: boolean;
+    dockerfilesChanged: string[];
+    sourceFilesChanged: string[];
+};
+export declare function securityDiff(root: string, base: string, head: string): Promise<SecurityDiffResult>;

package/dist/src/core/diff/security-diff.js

@@ -0,0 +1,20 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+export async function securityDiff(root, base, head) {
+    const { stdout } = await execFileAsync('git', ['diff', '--name-only', `${base}..${head}`], {
+        cwd: root,
+        encoding: 'utf8'
+    });
+    const files = stdout.split(/\r?\n/).filter(Boolean);
+    return {
+        base,
+        head,
+        files,
+        packageManifestChanged: files.some((file) => /(^|\/)package\.json$/.test(file)),
+        lockfileChanged: files.some((file) => /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock)$/.test(file)),
+        dockerfilesChanged: files.filter((file) => /(^|\/)Dockerfile(?:\..+)?$/.test(file)),
+        sourceFilesChanged: files.filter((file) => /\.(js|jsx|ts|tsx|mjs|cjs)$/.test(file))
+    };
+}
+//# sourceMappingURL=security-diff.js.map

package/dist/src/core/diff/security-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-diff.js","sourceRoot":"","sources":["../../../../src/core/diff/security-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,IAAY,EACZ,IAAY;IAEZ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,EAC3C;QACE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;KACjB,CACF,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEpD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,KAAK;QACL,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1G,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACpF,CAAC;AACJ,CAAC"}

package/dist/src/core/github/remote-audit.d.ts

@@ -0,0 +1,5 @@
+import { runSecurityDoctor } from '../security-doctor.js';
+export declare function auditRemoteRepository(url: string): Promise<{
+    repository: string;
+    report: Awaited<ReturnType<typeof runSecurityDoctor>>;
+}>;

package/dist/src/core/github/remote-audit.js

@@ -0,0 +1,28 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import os from 'node:os';
+import path from 'node:path';
+import { runSecurityDoctor } from '../security-doctor.js';
+const execFileAsync = promisify(execFile);
+export async function auditRemoteRepository(url) {
+    if (!/^https:\/\/github\.com\/[^/]+\/[^/]+(?:\.git)?$/.test(url)) {
+        throw new Error('Only public GitHub repository URLs are supported.');
+    }
+    const temporaryRoot = await mkdtemp(path.join(os.tmpdir(), 'toolip-remote-audit-'));
+    const target = path.join(temporaryRoot, 'repository');
+    try {
+        await execFileAsync('gh', ['repo', 'clone', url, target, '--', '--depth=1'], {
+            encoding: 'utf8'
+        });
+        const report = await runSecurityDoctor(target);
+        return {
+            repository: url,
+            report
+        };
+    }
+    finally {
+        await rm(temporaryRoot, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=remote-audit.js.map

package/dist/src/core/github/remote-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-audit.js","sourceRoot":"","sources":["../../../../src/core/github/remote-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IAIrD,IAAI,CAAC,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;YAC3E,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO;YACL,UAAU,EAAE,GAAG;YACf,MAAM;SACP,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/src/core/github/upgrade-pr.d.ts

@@ -0,0 +1,4 @@
+export declare function createUpgradePullRequest(root: string, packageName: string, targetVersion: string, dryRun: boolean): Promise<{
+    branch: string;
+    changed: boolean;
+}>;

package/dist/src/core/github/upgrade-pr.js

@@ -0,0 +1,41 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import path from 'node:path';
+const execFileAsync = promisify(execFile);
+export async function createUpgradePullRequest(root, packageName, targetVersion, dryRun) {
+    const manifestPath = path.join(root, 'package.json');
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+    const sections = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
+    let changed = false;
+    for (const section of sections) {
+        if (manifest[section]?.[packageName]) {
+            manifest[section][packageName] = targetVersion;
+            changed = true;
+        }
+    }
+    if (!changed) {
+        throw new Error(`${packageName} is not declared in package.json.`);
+    }
+    const branch = `toolip/upgrade-${packageName.replaceAll(/[^A-Za-z0-9]/g, '-')}-${targetVersion}`;
+    if (dryRun) {
+        return { branch, changed: true };
+    }
+    await execFileAsync('git', ['switch', '-c', branch], { cwd: root });
+    await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+    await execFileAsync('npm', ['install', '--package-lock-only'], { cwd: root });
+    await execFileAsync('npm', ['test'], { cwd: root });
+    await execFileAsync('git', ['add', 'package.json', 'package-lock.json'], { cwd: root });
+    await execFileAsync('git', ['commit', '-m', `chore: upgrade ${packageName} to ${targetVersion}`], { cwd: root });
+    await execFileAsync('git', ['push', '-u', 'origin', branch], { cwd: root });
+    await execFileAsync('gh', [
+        'pr',
+        'create',
+        '--title',
+        `chore: upgrade ${packageName} to ${targetVersion}`,
+        '--body',
+        `Toolip generated this dependency upgrade after updating the lockfile and running the project test suite.`
+    ], { cwd: root });
+    return { branch, changed: true };
+}
+//# sourceMappingURL=upgrade-pr.js.map

package/dist/src/core/github/upgrade-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-pr.js","sourceRoot":"","sources":["../../../../src/core/github/upgrade-pr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,WAAmB,EACnB,aAAqB,EACrB,MAAe;IAEf,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAwB,CAAC;IACzF,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;IACjG,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,GAAG,aAAa,CAAC;YAC/C,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,mCAAmC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,WAAW,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;IAEjG,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,kBAAkB,WAAW,OAAO,aAAa,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,aAAa,CACjB,IAAI,EACJ;QACE,IAAI;QACJ,QAAQ;QACR,SAAS;QACT,kBAAkB,WAAW,OAAO,aAAa,EAAE;QACnD,QAAQ;QACR,0GAA0G;KAC3G,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,CACd,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC"}