		import { mkdir, readFile, writeFile } from 'node:fs/promises';
		import path from 'node:path';
		import { UsageError } from '../core/exitCodes.js';
		import { MCP_CLIENT_IDS, mergeDvalinServer, renderConfig, resolveInstallTarget, } from '../mcp/install.js';
		export function registerMcpInstallCommand(program) {
		program
		.command('mcp-install')
		.description(`Write the Dvalin MCP server into an editor's config: ${MCP_CLIENT_IDS.join(', ')}`)
		.argument('<client>', `editor to configure: ${MCP_CLIENT_IDS.join(', ')}`)
		.option('--global', "write the user-level config instead of the project's")
		.option('--print', 'show the resulting config without writing anything')
		.option('--workspace <dir>', 'workspace the server is allowed to read', '.')
		.option('--name <name>', 'name for the server entry', 'dvalin')
		.action(async (client, options) => {
		const id = parseClientId(client);
		const root = process.cwd();
		const target = resolveInstallTarget(id, root, Boolean(options.global));
		const existing = await readJsonIfPresent(target.file);
		const { config, action } = mergeDvalinServer(existing, target.client, options.workspace, options.name);
		const rendered = renderConfig(config);
		if (options.print) {
		console.log(`# ${target.file}`);
		console.log(rendered.trimEnd());
		return;
		}
		if (action === 'unchanged') {
		console.log(`${target.client.name} already has '${options.name}' configured: ${target.file}`);
		}
		else {
		await mkdir(path.dirname(target.file), { recursive: true });
		await writeFile(target.file, rendered, 'utf8');
		const verb = action === 'added' ? 'Added' : 'Replaced';
		console.log(`${verb} '${options.name}' in ${target.file}`);
		}
		if (target.client.followUp)
		console.log(`\n${target.client.followUp}`);
		});
		}
		function parseClientId(value) {
		if (MCP_CLIENT_IDS.includes(value))
		return value;
		throw new UsageError(`Unknown client '${value}'. Expected one of: ${MCP_CLIENT_IDS.join(', ')}.`);
		}
		/**
		* A malformed config is the user's file, not ours to silently replace — say so
		* and stop, rather than writing over whatever was there.
		*/
		async function readJsonIfPresent(file) {
		let raw;
		try {
		raw = await readFile(file, 'utf8');
		}
		catch {
		return undefined;
		}
		if (!raw.trim())
		return undefined;
		try {
		const parsed = JSON.parse(raw);
		if (typeof parsed !== 'object' \|\| parsed === null \|\| Array.isArray(parsed)) {
		throw new Error('not a JSON object');
		}
		return parsed;
		}
		catch (error) {
		throw new UsageError(`${file} is not valid JSON, so it was left alone: ${error instanceof Error ? error.message : String(error)}`);
		}
		}
		//# sourceMappingURL=mcpInstall.js.map

+1

dist/commands/mcpInstall.js.map

{"version":3,"file":"mcpInstall.js","sourceRoot":"","sources":["../../src/commands/mcpInstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAS3B,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,wDAAwD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAChG,QAAQ,CAAC,UAAU,EAAE,wBAAwB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACzE,MAAM,CAAC,UAAU,EAAE,sDAAsD,CAAC;SAC1E,MAAM,CAAC,SAAS,EAAE,oDAAoD,CAAC;SACvE,MAAM,CAAC,mBAAmB,EAAE,yCAAyC,EAAE,GAAG,CAAC;SAC3E,MAAM,CAAC,eAAe,EAAE,2BAA2B,EAAE,QAAQ,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,OAAgB,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvG,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAEtC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,iBAAiB,OAAO,CAAC,IAAI,iBAAiB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAK,cAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IAC9E,MAAM,IAAI,UAAU,CAAC,mBAAmB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpG,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,6CAA6C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC"}

+47

dist/commands/security.d.ts

		import type { Command } from 'commander';
		import { type FixExecutor } from '../security/fixRecord.js';
		import { type DvalinScannerId } from '../remediation/scannerSuite.js';
		import { type RemediationFinding } from '../remediation/sarif.js';
		import { type RemediationCase } from '../remediation/cases.js';
		import { type DvalinSecurityConfig } from '../security/config.js';
		import { type SecurityGateMode, type SecurityScanEnvelope, type SecurityThreshold } from '../security/contracts.js';
		import { type SecurityWorkflow } from '../security/workflow.js';
		export declare const MAX_SECURITY_SARIF_IMPORT_BYTES: number;
		export type SecuritySarifImport = {
		schemaVersion: 1;
		kind: 'dvalin-security-import';
		root: string;
		reportPath: string;
		source: string;
		totalResults: number;
		skippedResults: number;
		findings: RemediationFinding[];
		cases: RemediationCase[];
		persisted: boolean;
		};
		export type ExecutedSecurityScan = SecurityScanEnvelope & {
		root: string;
		config: DvalinSecurityConfig;
		workflow?: SecurityWorkflow;
		suppressed: number;
		expiredSuppressions: number;
		};
		export declare function registerSecurityCommand(program: Command): void;
		/** Shared by `dvalincode security ...` and the focused `dvalin ...` binary. */
		export declare function registerSecuritySubcommands(parent: Command): void;
		export declare function executeSecurityScan(input: {
		root: string;
		configPath?: string;
		scanners?: DvalinScannerId[];
		timeoutMs?: number;
		threshold?: SecurityThreshold;
		mode?: SecurityGateMode;
		saveWorkflow?: boolean;
		}): Promise<ExecutedSecurityScan>;
		export declare function executeSecuritySarifImport(input: {
		root: string;
		reportPath: string;
		persist?: boolean;
		}): Promise<SecuritySarifImport>;
		export declare function renderSecurityExecution(execution: ExecutedSecurityScan, limit: number): string;
		export declare function parseExecutor(value: string): FixExecutor;

+415

dist/commands/security.js

		import { access, mkdir, open, writeFile } from 'node:fs/promises';
		import { constants } from 'node:fs';
		import path from 'node:path';
		import { EXIT, UsageError } from '../core/exitCodes.js';
		import { FIX_EXECUTORS, renderFixRecord } from '../security/fixRecord.js';
		import { renderSecurityGate } from '../security/render.js';
		import { renderFixRecordVerification, verifyFixRecordFile } from '../security/fixRecordFile.js';
		import { runWorkflowVerification } from '../security/verifyRun.js';
		import { resolveWorkspaceRoot } from '../core/workspace.js';
		import { parseDvalinScannerIds, renderDvalinResult } from './dvalin.js';
		import { DVALIN_SCANNER_IDS, dvalinScannerInstallPlan, installDvalinScanner, listDvalinScanners, runDvalinScanSuite, } from '../remediation/scannerSuite.js';
		import { buildDvalinSarif } from '../remediation/sarifExport.js';
		import { parseSarifForRemediation } from '../remediation/sarif.js';
		import { upsertRemediationCases } from '../remediation/cases.js';
		import { readSecurityBaseline, writeSecurityBaseline } from '../security/baseline.js';
		import { loadSecurityConfig, resolveSecurityPath, writeInitialSecurityConfig, } from '../security/config.js';
		import { SECURITY_SCHEMA_VERSION, compareWithBaseline, deriveCoverage, evaluateSecurityGate, } from '../security/contracts.js';
		import { applySecuritySuppressions } from '../security/suppressions.js';
		import { createSecurityWorkflow, loadSecurityWorkflow, } from '../security/workflow.js';
		export const MAX_SECURITY_SARIF_IMPORT_BYTES = 64 * 1024 * 1024;
		export function registerSecurityCommand(program) {
		const security = program.command('security').description('Deterministic security verification for human- and agent-written code');
		registerSecuritySubcommands(security);
		}
		/** Shared by `dvalincode security ...` and the focused `dvalin ...` binary. */
		export function registerSecuritySubcommands(parent) {
		parent
		.command('init')
		.description('Create a versioned Dvalin security policy')
		.argument('[path]', 'workspace path', '.')
		.option('--force', 'replace an existing policy')
		.action(async (inputPath, options) => {
		const root = await resolveWorkspaceRoot(path.resolve(process.cwd(), inputPath));
		const target = await writeInitialSecurityConfig(root, Boolean(options.force));
		console.log(`Created ${target}`);
		console.log('Next: run `dvalin baseline` once, then use `dvalin scan` as a new-findings gate.');
		});
		parent
		.command('scan')
		.description('Scan code, apply suppressions/baseline policy, and evaluate the gate')
		.argument('[path]', 'workspace path', '.')
		.option('--config <file>', 'security config path (default: dvalin.security.json)')
		.option('--scanners <ids>', `override scanner set: ${DVALIN_SCANNER_IDS.join(', ')}`)
		.option('--timeout <seconds>', 'timeout for each external scanner', '300')
		.option('--limit <count>', 'maximum findings shown in text output', '20')
		.option('--json', 'print the versioned result envelope as JSON')
		.option('--sarif <file>', 'also write SARIF 2.1.0')
		.option('--fail-on <severity>', 'override gate severity: critical, high, medium, low, none')
		.option('--new-only', 'evaluate only findings not present in the baseline')
		.option('--no-workflow', 'do not persist a resumable security workflow')
		.action(async (inputPath, options) => {
		const execution = await executeSecurityScan({
		root: path.resolve(process.cwd(), inputPath),
		configPath: options.config,
		scanners: options.scanners ? parseDvalinScannerIds(options.scanners) : undefined,
		timeoutMs: positiveInteger(options.timeout, '--timeout') * 1000,
		threshold: options.failOn ? parseThreshold(options.failOn) : undefined,
		mode: options.newOnly ? 'new' : undefined,
		saveWorkflow: options.workflow,
		});
		const limit = positiveInteger(options.limit, '--limit');
		if (options.json) {
		console.log(JSON.stringify({
		schemaVersion: execution.schemaVersion,
		scan: execution.scan,
		coverage: execution.coverage,
		delta: execution.delta,
		gate: execution.gate,
		workflowId: execution.workflow?.id,
		suppressed: execution.suppressed,
		expiredSuppressions: execution.expiredSuppressions,
		}, null, 2));
		}
		else {
		console.log(renderSecurityExecution(execution, limit));
		}
		if (options.sarif)
		await writeSarif(execution.scan, execution.root, options.sarif, !options.json);
		if (!execution.gate.passed)
		process.exitCode = EXIT.gateNotMet;
		});
		parent
		.command('import')
		.description('Import a SARIF handoff into Dvalin remediation cases')
		.argument('<report>', 'SARIF 2.1 report exported by Codex Security or another compatible scanner')
		.argument('[path]', 'workspace path used to resolve finding locations', '.')
		.option('--json', 'print the versioned import envelope as JSON')
		.option('--no-persist', 'parse the report without creating remediation cases')
		.action(async (report, inputPath, options) => {
		const imported = await executeSecuritySarifImport({
		root: path.resolve(process.cwd(), inputPath),
		reportPath: path.resolve(process.cwd(), report),
		persist: options.persist,
		});
		if (options.json) {
		console.log(JSON.stringify(imported, null, 2));
		}
		else {
		console.log(`Imported ${imported.findings.length}/${imported.totalResults} finding(s) from ${imported.source}.`);
		if (imported.skippedResults)
		console.log(`Skipped ${imported.skippedResults} result(s) without a safe workspace location.`);
		console.log(imported.persisted
		? `Created or updated ${imported.cases.length} remediation case(s).`
		: 'Persistence disabled; no remediation cases were changed.');
		console.log('Next: review the external evidence, then run `dvalin scan .` as the independent release gate.');
		}
		});
		parent
		.command('baseline')
		.description('Record the current accepted findings for a new-findings gate')
		.argument('[path]', 'workspace path', '.')
		.option('--config <file>', 'security config path (default: dvalin.security.json)')
		.option('--scanners <ids>', `override scanner set: ${DVALIN_SCANNER_IDS.join(', ')}`)
		.option('--timeout <seconds>', 'timeout for each external scanner', '300')
		.option('--output <file>', 'override baseline output path')
		.option('--json', 'print baseline metadata as JSON')
		.action(async (inputPath, options) => {
		const root = await resolveWorkspaceRoot(path.resolve(process.cwd(), inputPath));
		const loaded = await loadSecurityConfig(root, options.config);
		const scanners = options.scanners ? parseDvalinScannerIds(options.scanners) : loaded.config.scanners;
		const raw = await runDvalinScanSuite(root, { scanners, timeoutMs: positiveInteger(options.timeout, '--timeout') * 1000 });
		const suppressed = applySecuritySuppressions(raw, loaded.config.suppressions);
		const output = options.output ?? loaded.config.baseline;
		const written = await writeSecurityBaseline(root, output, suppressed.result);
		const body = { path: written.path, scanId: written.baseline.scanId, findings: written.baseline.findings.length, scanners };
		console.log(options.json ? JSON.stringify(body, null, 2) : `Baseline written to ${written.path} · ${body.findings} accepted finding(s)`);
		});
		parent
		.command('verify')
		.description('Resume a workflow, re-scan it, run the project checks, and issue a fix record')
		.argument('<workflow-id>', 'security workflow id returned by scan')
		.option('--timeout <seconds>', 'timeout for each external scanner', '300')
		.option('--record <file>', 'write the Verified Fix Record as JSON')
		.option('--executor <name>', `who performed the repair, recorded but never consulted: ${FIX_EXECUTORS.join(', ')}`)
		.option('--json', 'print workflow state as JSON')
		.action(async (workflowId, options) => {
		const workflow = await loadSecurityWorkflow(workflowId);
		const loaded = await loadSecurityConfig(workflow.root);
		const timeoutMs = positiveInteger(options.timeout, '--timeout') * 1000;
		const updated = await runWorkflowVerification({
		workflow,
		checks: loaded.config.checks,
		timeoutMs,
		executor: options.executor ? parseExecutor(options.executor) : undefined,
		});
		if (options.record)
		await writeFixRecord(updated, options.record, !options.json);
		if (options.json)
		console.log(JSON.stringify(updated, null, 2));
		else {
		console.log(`Workflow ${updated.id} · ${updated.state} · ${updated.verification?.assurance} · ${updated.latestScan.findings.length} finding(s)`);
		if (updated.verification?.record)
		console.log(renderFixRecord(updated.verification.record));
		}
		if (updated.state !== 'passed')
		process.exitCode = EXIT.gateNotMet;
		});
		parent
		.command('verify-fix')
		.description('Re-derive a Verified Fix Record offline — no workspace, no network, no Dvalin state')
		.argument('<record>', 'fix record JSON issued by `dvalin verify --record`')
		.option('--json', 'print the verification result as JSON')
		.action(async (recordPath, options) => {
		const check = await verifyFixRecordFile(recordPath);
		if (options.json) {
		// A machine caller gets an answer in every case, including this one;
		// the exit code, not the presence of output, carries the distinction.
		console.log(JSON.stringify({ schemaVersion: SECURITY_SCHEMA_VERSION, ...check }, null, 2));
		process.exitCode = check.record ? (check.ok ? EXIT.ok : EXIT.gateNotMet) : EXIT.usageError;
		return;
		}
		// Pointing at the wrong file is a usage error; a real record that fails
		// to re-derive is a gate result. A pipeline has to tell those apart.
		if (!check.record)
		throw new UsageError(`Not a Dvalin fix record: ${check.path}`);
		console.log(renderFixRecordVerification(check));
		// A record that does not re-derive is an answer, not a broken command.
		if (!check.ok)
		process.exitCode = EXIT.gateNotMet;
		});
		parent
		.command('doctor')
		.description('Show security policy, baseline, and scanner readiness')
		.argument('[path]', 'workspace path', '.')
		.option('--config <file>', 'security config path')
		.option('--json', 'print diagnostics as JSON')
		.action(async (inputPath, options) => {
		const root = await resolveWorkspaceRoot(path.resolve(process.cwd(), inputPath));
		const loaded = await loadSecurityConfig(root, options.config);
		const baselinePath = resolveSecurityPath(root, loaded.config.baseline);
		const baselineAvailable = await exists(baselinePath);
		const scanners = await listDvalinScanners();
		const body = { root, configPath: loaded.path, config: loaded.config, baseline: { path: baselinePath, available: baselineAvailable }, scanners };
		if (options.json)
		console.log(JSON.stringify(body, null, 2));
		else {
		console.log(`Dvalin security doctor · ${root}`);
		console.log(`Policy: ${loaded.path ?? 'defaults (builtin scanner, non-blocking)'}`);
		console.log(`Baseline: ${baselineAvailable ? 'ready' : 'missing'} · ${baselinePath}`);
		for (const scanner of scanners) {
		console.log(` ${scanner.available ? '✓' : '!'} ${scanner.name}${scanner.available ? '' : ` · ${scanner.installCommand ?? 'install manually'}`}`);
		}
		}
		});
		const scanners = parent.command('scanners').description('Inspect and install optional scanner engines');
		scanners
		.command('list')
		.description('List scanner readiness and install commands')
		.option('--json', 'print scanner descriptors as JSON')
		.action(async (options) => {
		const listed = await listDvalinScanners();
		console.log(options.json ? JSON.stringify(listed, null, 2) : listed.map(scanner => `${scanner.available ? '✓' : '!'} ${scanner.id} · ${scanner.available ? 'ready' : scanner.installCommand ?? 'install manually'}`).join('\n'));
		});
		scanners
		.command('install')
		.description('Print a fixed install command; execute it only with --yes')
		.argument('<scanner>', `one of ${DVALIN_SCANNER_IDS.join(', ')}`)
		.option('--yes', 'execute the reviewed command under Dvalin policy')
		.action(async (scanner, options) => {
		const id = parseDvalinScannerIds(scanner)[0];
		const plan = dvalinScannerInstallPlan(id);
		if (!plan.command) {
		console.log(plan.reason);
		return;
		}
		console.log(`Install plan: ${plan.command}`);
		if (!options.yes) {
		console.log('Review the command, then rerun with --yes to execute it.');
		return;
		}
		await installDvalinScanner(process.cwd(), id);
		console.log(`${id} installation command completed.`);
		});
		}
		export async function executeSecurityScan(input) {
		const root = await resolveWorkspaceRoot(input.root);
		const loaded = await loadSecurityConfig(root, input.configPath);
		const config = {
		...loaded.config,
		scanners: input.scanners ?? loaded.config.scanners,
		gate: {
		severity: input.threshold ?? loaded.config.gate.severity,
		mode: input.mode ?? loaded.config.gate.mode,
		},
		};
		const raw = await runDvalinScanSuite(root, { scanners: config.scanners, timeoutMs: input.timeoutMs });
		const suppression = applySecuritySuppressions(raw, config.suppressions);
		let delta;
		if (config.gate.mode === 'new') {
		try {
		delta = compareWithBaseline(suppression.result, await readSecurityBaseline(root, config.baseline), { suppressed: suppression.suppressed });
		}
		catch (error) {
		throw new UsageError(`${error instanceof Error ? error.message : String(error)}. Run \`dvalin baseline\` before using a new-findings gate.`);
		}
		}
		const gate = evaluateSecurityGate({ result: suppression.result, threshold: config.gate.severity, mode: config.gate.mode, delta });
		const coverage = deriveCoverage(suppression.result, { suppressed: suppression.suppressed });
		const workflow = input.saveWorkflow === false
		? undefined
		: await createSecurityWorkflow({ root, result: suppression.result, gate, delta, coverage });
		return {
		schemaVersion: SECURITY_SCHEMA_VERSION,
		scan: suppression.result,
		coverage,
		delta,
		gate,
		root,
		config,
		workflow,
		suppressed: suppression.suppressed.length,
		expiredSuppressions: suppression.expired.length,
		};
		}
		export async function executeSecuritySarifImport(input) {
		const root = await resolveWorkspaceRoot(input.root);
		const reportPath = path.resolve(input.reportPath);
		let reportText;
		try {
		reportText = await readUtf8FileWithLimit(reportPath, MAX_SECURITY_SARIF_IMPORT_BYTES);
		}
		catch (error) {
		if (error instanceof UsageError)
		throw error;
		throw new UsageError(`Cannot read SARIF report ${reportPath}: ${error instanceof Error ? error.message : String(error)}`);
		}
		let report;
		try {
		report = JSON.parse(reportText);
		}
		catch (error) {
		throw new UsageError(`Invalid SARIF JSON in ${reportPath}: ${error instanceof Error ? error.message : String(error)}`);
		}
		const parsed = await parseSarifForRemediation(report, { cwd: root }).catch(error => {
		throw new UsageError(`Cannot import SARIF report ${reportPath}: ${error instanceof Error ? error.message : String(error)}`);
		});
		const persisted = input.persist !== false;
		const cases = persisted
		? await upsertRemediationCases({ cwd: root, findings: parsed.findings })
		: [];
		return {
		schemaVersion: 1,
		kind: 'dvalin-security-import',
		root,
		reportPath,
		source: parsed.source,
		totalResults: parsed.totalResults,
		skippedResults: parsed.skippedResults,
		findings: parsed.findings,
		cases,
		persisted,
		};
		}
		async function readUtf8FileWithLimit(file, maxBytes) {
		const handle = await open(file, 'r');
		try {
		const info = await handle.stat();
		if (!info.isFile())
		throw new UsageError(`SARIF report is not a regular file: ${file}`);
		if (info.size > maxBytes) {
		throw new UsageError(`SARIF report exceeds the ${Math.floor(maxBytes / 1024 / 1024)} MiB import limit: ${file}`);
		}
		const chunks = [];
		let totalBytes = 0;
		while (true) {
		const remaining = maxBytes + 1 - totalBytes;
		if (remaining <= 0) {
		throw new UsageError(`SARIF report exceeds the ${Math.floor(maxBytes / 1024 / 1024)} MiB import limit: ${file}`);
		}
		const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining));
		const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
		if (bytesRead === 0)
		break;
		totalBytes += bytesRead;
		if (totalBytes > maxBytes) {
		throw new UsageError(`SARIF report exceeds the ${Math.floor(maxBytes / 1024 / 1024)} MiB import limit: ${file}`);
		}
		chunks.push(chunk.subarray(0, bytesRead));
		}
		return Buffer.concat(chunks, totalBytes).toString('utf8');
		}
		finally {
		await handle.close();
		}
		}
		export function renderSecurityExecution(execution, limit) {
		const lines = [renderDvalinResult(execution.scan, execution.root, limit, execution.coverage)];
		if (execution.delta) {
		const delta = execution.delta;
		const parts = [
		`${delta.new.length} new`,
		`${delta.existing.length} existing`,
		`${delta.resolved.length} resolved`,
		];
		if (delta.reopened.length)
		parts.push(`${delta.reopened.length} reopened`);
		if (delta.dismissed.length)
		parts.push(`${delta.dismissed.length} dismissed`);
		// Never fold this into "resolved": these were not looked for.
		if (delta.unknown.length)
		parts.push(`${delta.unknown.length} unknown`);
		lines.push('', `Baseline delta · ${parts.join(' · ')}`);
		}
		if (execution.suppressed)
		lines.push(`Suppressed: ${execution.suppressed}`);
		if (execution.expiredSuppressions)
		lines.push(`Expired suppressions: ${execution.expiredSuppressions}`);
		lines.push(renderSecurityGate(execution.gate));
		if (execution.workflow)
		lines.push(`Workflow: ${execution.workflow.id}`);
		return lines.join('\n');
		}
		function parseThreshold(value) {
		if (['critical', 'high', 'medium', 'low', 'none'].includes(value))
		return value;
		throw new UsageError('--fail-on must be one of critical, high, medium, low, none.');
		}
		function positiveInteger(value, label) {
		const parsed = Number(value);
		if (!Number.isInteger(parsed) \|\| parsed <= 0)
		throw new UsageError(`${label} must be a positive integer.`);
		return parsed;
		}
		async function writeSarif(result, root, file, announce) {
		const target = path.resolve(process.cwd(), file);
		await mkdir(path.dirname(target), { recursive: true });
		await writeFile(target, `${JSON.stringify(buildDvalinSarif(result, root), null, 2)}\n`, 'utf8');
		if (announce)
		console.log(`SARIF written to ${target}`);
		}
		export function parseExecutor(value) {
		if (FIX_EXECUTORS.includes(value))
		return value;
		throw new UsageError(`--executor must be one of ${FIX_EXECUTORS.join(', ')}.`);
		}
		async function writeFixRecord(workflow, file, announce) {
		const record = workflow.verification?.record;
		if (!record)
		throw new UsageError('This workflow has no fix record to write.');
		const target = path.resolve(process.cwd(), file);
		await mkdir(path.dirname(target), { recursive: true });
		await writeFile(target, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
		if (announce)
		console.log(`Fix record written to ${target}`);
		}
		async function exists(file) {
		try {
		await access(file, constants.R_OK);
		return true;
		}
		catch {
		return false;
		}
		}
		//# sourceMappingURL=security.js.map

+1

dist/commands/security.js.map

+3

dist/dvalinCli.d.ts

		import { Command } from 'commander';
		export declare function buildDvalinProgram(): Command;
		export declare function runDvalinCli(argv: string[]): Promise<void>;

+36

dist/dvalinCli.js

		import { Command, CommanderError } from 'commander';
		import { registerSecuritySubcommands } from './commands/security.js';
		import { registerMcpServeCommand } from './commands/mcpServe.js';
		import { registerMcpInstallCommand } from './commands/mcpInstall.js';
		import { EXIT } from './core/exitCodes.js';
		import { VERSION } from './version.js';
		export function buildDvalinProgram() {
		const program = new Command()
		.name('dvalin')
		.description('Discover, remediate, and independently verify security findings')
		.version(VERSION);
		registerSecuritySubcommands(program);
		registerMcpServeCommand(program);
		registerMcpInstallCommand(program);
		return program;
		}
		export async function runDvalinCli(argv) {
		const program = buildDvalinProgram();
		applyExitOverride(program);
		try {
		await program.parseAsync(argv);
		}
		catch (error) {
		if (error instanceof CommanderError) {
		process.exitCode = error.exitCode === 0 ? EXIT.ok : EXIT.usageError;
		return;
		}
		throw error;
		}
		}
		function applyExitOverride(command) {
		command.exitOverride();
		for (const child of command.commands)
		applyExitOverride(child);
		}
		//# sourceMappingURL=dvalinCli.js.map

+1

dist/dvalinCli.js.map

{"version":3,"file":"dvalinCli.js","sourceRoot":"","sources":["../src/dvalinCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;SAC1B,IAAI,CAAC,QAAQ,CAAC;SACd,WAAW,CAAC,iEAAiE,CAAC;SAC9E,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ;QAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

+2

dist/dvalinIndex.d.ts

		#!/usr/bin/env node
		export {};

+9

dist/dvalinIndex.js

		#!/usr/bin/env node
		import { runDvalinCli } from './dvalinCli.js';
		import { EXIT, UsageError } from './core/exitCodes.js';
		runDvalinCli(process.argv).catch(error => {
		const message = error instanceof Error ? error.message : String(error);
		console.error(`dvalin: ${message}`);
		process.exitCode = error instanceof UsageError ? EXIT.usageError : EXIT.runtimeError;
		});
		//# sourceMappingURL=dvalinIndex.js.map

+1

dist/dvalinIndex.js.map

{"version":3,"file":"dvalinIndex.js","sourceRoot":"","sources":["../src/dvalinIndex.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEvD,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,QAAQ,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AACvF,CAAC,CAAC,CAAC"}

+48

dist/mcp/install.d.ts

		/**
		* Where each editor keeps its MCP configuration, and what shape it expects.
		*
		* The shapes are not the same, and the difference is silent: VS Code keys its
		* servers under `servers`, Cursor under `mcpServers`. Putting Cursor's key in a
		* VS Code file produces no error and no server — the tools simply never appear,
		* which is a bad afternoon for whoever tries it. Encoding the difference here
		* is the point of this module.
		*
		* Every entry below was read from that editor's own documentation. An editor
		* whose format could not be confirmed is deliberately absent: a wrong config is
		* worse than none, because it fails quietly.
		*/
		export type McpClientId = 'cursor' \| 'vscode' \| 'claude-code';
		export declare const MCP_CLIENT_IDS: McpClientId[];
		export type McpClient = {
		id: McpClientId;
		name: string;
		/** Key the servers live under in the config file. */
		serversKey: 'servers' \| 'mcpServers';
		/** Path relative to the project root. */
		projectPath: string;
		/** Path relative to the user's home directory, when the editor has one. */
		userPath?: string;
		/** Anything the user still has to do after the file is written. */
		followUp?: string;
		};
		export declare function mcpClient(id: McpClientId): McpClient;
		export type McpInstallTarget = {
		client: McpClient;
		file: string;
		};
		export declare function resolveInstallTarget(id: McpClientId, root: string, global: boolean): McpInstallTarget;
		/** The server entry itself, which is the same everywhere the key is not. */
		export declare function dvalinServerEntry(workspace: string): Record<string, unknown>;
		export type MergeOutcome = {
		config: Record<string, unknown>;
		/** `added` when there was no dvalin entry, `replaced` when one was overwritten. */
		action: 'added' \| 'replaced' \| 'unchanged';
		};
		/**
		* Merge the Dvalin server into whatever is already there.
		*
		* An editor's MCP file usually belongs to the whole team, not to this tool, so
		* the other servers in it survive untouched and key order is preserved.
		*/
		export declare function mergeDvalinServer(existing: Record<string, unknown> \| undefined, client: McpClient, workspace: string, serverName?: string): MergeOutcome;
		export declare function renderConfig(config: Record<string, unknown>): string;

+74

dist/mcp/install.js

		import { homedir } from 'node:os';
		import path from 'node:path';
		export const MCP_CLIENT_IDS = ['cursor', 'vscode', 'claude-code'];
		const CLIENTS = {
		cursor: {
		id: 'cursor',
		name: 'Cursor',
		serversKey: 'mcpServers',
		projectPath: path.join('.cursor', 'mcp.json'),
		userPath: path.join('.cursor', 'mcp.json'),
		},
		vscode: {
		id: 'vscode',
		name: 'VS Code',
		// Not `mcpServers`. VS Code is the odd one out, and the reason this module
		// exists rather than a single documented snippet.
		serversKey: 'servers',
		projectPath: path.join('.vscode', 'mcp.json'),
		followUp: 'VS Code keeps its user-level MCP config inside the profile folder; run the "MCP: Open User Configuration" command to edit it.',
		},
		'claude-code': {
		id: 'claude-code',
		name: 'Claude Code',
		serversKey: 'mcpServers',
		projectPath: '.mcp.json',
		followUp: 'A .mcp.json arriving with a repository is untrusted until approved. Run `claude` once in the project and approve it, or use `claude mcp add --scope local` for your machine only.',
		},
		};
		export function mcpClient(id) {
		return CLIENTS[id];
		}
		export function resolveInstallTarget(id, root, global) {
		const client = mcpClient(id);
		if (!global)
		return { client, file: path.join(root, client.projectPath) };
		if (!client.userPath) {
		throw new Error(`${client.name} has no user-level file this command can write. ${client.followUp ?? ''}`.trim());
		}
		return { client, file: path.join(homedir(), client.userPath) };
		}
		/** The server entry itself, which is the same everywhere the key is not. */
		export function dvalinServerEntry(workspace) {
		return {
		command: 'npx',
		args: ['-y', 'dvalincode', 'mcp-serve', '--workspace', workspace],
		};
		}
		/**
		* Merge the Dvalin server into whatever is already there.
		*
		* An editor's MCP file usually belongs to the whole team, not to this tool, so
		* the other servers in it survive untouched and key order is preserved.
		*/
		export function mergeDvalinServer(existing, client, workspace, serverName = 'dvalin') {
		const config = { ...(existing ?? {}) };
		const servers = { ...(asRecord(config[client.serversKey]) ?? {}) };
		const entry = dvalinServerEntry(workspace);
		const previous = servers[serverName];
		if (previous !== undefined && JSON.stringify(previous) === JSON.stringify(entry)) {
		return { config: { ...config, [client.serversKey]: servers }, action: 'unchanged' };
		}
		servers[serverName] = entry;
		config[client.serversKey] = servers;
		return { config, action: previous === undefined ? 'added' : 'replaced' };
		}
		export function renderConfig(config) {
		return `${JSON.stringify(config, null, 2)}\n`;
		}
		function asRecord(value) {
		return typeof value === 'object' && value !== null && !Array.isArray(value)
		? value
		: undefined;
		}
		//# sourceMappingURL=install.js.map

+1

dist/mcp/install.js.map

{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/mcp/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B,MAAM,CAAC,MAAM,cAAc,GAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAejF,MAAM,OAAO,GAAmC;IAC9C,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,YAAY;QACxB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;QAC7C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;KAC3C;IACD,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,SAAS;QACf,2EAA2E;QAC3E,kDAAkD;QAClD,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;QAC7C,QAAQ,EAAE,+HAA+H;KAC1I;IACD,aAAa,EAAE;QACb,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,YAAY;QACxB,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,mLAAmL;KAC9L;CACF,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,EAAe;IACvC,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AACrB,CAAC;AAID,MAAM,UAAU,oBAAoB,CAAC,EAAe,EAAE,IAAY,EAAE,MAAe;IACjF,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,mDAAmD,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC;KAClE,CAAC;AACJ,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA6C,EAC7C,MAAiB,EACjB,SAAiB,EACjB,UAAU,GAAG,QAAQ;IAErB,MAAM,MAAM,GAA4B,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtF,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;IAC5B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA+B;IAC1D,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

+29

dist/remediation/diffScope.d.ts

		/**
		* The set of lines a scan should report on.
		*
		* A path present in `files` but absent from `lines` is in scope in full — that
		* is how a newly added or untracked file is represented, since every line of it
		* is new.
		*/
		export type DiffScope = {
		/** What was compared, for reporting. */
		ref: string;
		/** Workspace-relative POSIX paths. */
		files: Set<string>;
		/** Changed line numbers on the new side, per path. */
		lines: Map<string, Set<number>>;
		};
		export type DiffScopeOptions = {
		/** A git revision or range. Defaults to uncommitted work against HEAD. */
		ref?: string;
		/** Compare the index instead of the working tree. */
		staged?: boolean;
		};
		export declare function assertSafeRef(ref: string): void;
		/**
		* Resolve which files and lines changed, so a scan can report on new work
		* without drowning it in a repository's pre-existing findings.
		*/
		export declare function resolveDiffScope(root: string, options?: DiffScopeOptions): Promise<DiffScope>;
		/** Whether a finding at this path and line falls inside the scope. */
		export declare function isWithinDiffScope(scope: DiffScope, filePath: string, startLine: number \| undefined): boolean;

+107

dist/remediation/diffScope.js

		import { execFile } from 'node:child_process';
		import { promisify } from 'node:util';
		const execFileAsync = promisify(execFile);
		/**
		* Refs reach `git` as a single argv element, so there is no shell to inject
		* into — but a leading dash would still be read as a flag, and git's own ref
		* grammar is narrower than "any string".
		*/
		const SAFE_REF = /^[A-Za-z0-9][A-Za-z0-9._/@{}~^:-]*$/;
		/** `@@ -old,count +new,count @@` — the new-side pair is what a scan reports on. */
		const HUNK_HEADER = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/;
		export function assertSafeRef(ref) {
		if (!SAFE_REF.test(ref)) {
		throw new Error(`Refusing to use '${ref}' as a git revision: expected a ref name or range.`);
		}
		}
		/**
		* Resolve which files and lines changed, so a scan can report on new work
		* without drowning it in a repository's pre-existing findings.
		*/
		export async function resolveDiffScope(root, options = {}) {
		const args = ['diff', '--unified=0', '--no-color', '--no-ext-diff', '--diff-filter=d'];
		let ref;
		if (options.staged) {
		args.push('--cached');
		ref = 'staged';
		}
		else if (options.ref) {
		assertSafeRef(options.ref);
		args.push(options.ref);
		ref = options.ref;
		}
		else {
		args.push('HEAD');
		ref = 'HEAD';
		}
		const files = new Set();
		const lines = new Map();
		parseUnifiedDiff(await git(root, args), files, lines);
		// An agent's new files are untracked, and `git diff` cannot see them. They
		// are in scope whole — every line is new.
		if (!options.staged && !options.ref) {
		for (const file of await git(root, ['ls-files', '--others', '--exclude-standard']).then(splitLines)) {
		files.add(file);
		}
		}
		return { ref, files, lines };
		}
		/** Whether a finding at this path and line falls inside the scope. */
		export function isWithinDiffScope(scope, filePath, startLine) {
		if (!scope.files.has(filePath))
		return false;
		const changed = scope.lines.get(filePath);
		// No line detail means the whole file is in scope.
		if (changed === undefined)
		return true;
		// A finding without a line cannot be placed, so keep it rather than lose it.
		return startLine === undefined \|\| changed.has(startLine);
		}
		function parseUnifiedDiff(diff, files, lines) {
		let current;
		for (const line of diff.split('\n')) {
		if (line.startsWith('+++ ')) {
		const target = line.slice(4).trim();
		current = target === '/dev/null' ? undefined : stripDiffPrefix(target);
		if (current)
		files.add(current);
		continue;
		}
		if (!current)
		continue;
		const hunk = HUNK_HEADER.exec(line);
		if (!hunk)
		continue;
		const start = Number(hunk[1]);
		// An absent count means one line; an explicit zero means the hunk only
		// removed lines, and there is nothing on the new side to scan.
		const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
		if (count === 0)
		continue;
		let changed = lines.get(current);
		if (!changed) {
		changed = new Set();
		lines.set(current, changed);
		}
		for (let offset = 0; offset < count; offset += 1)
		changed.add(start + offset);
		}
		}
		/** `+++ b/src/app.ts` → `src/app.ts`. Quoted paths keep git's own escaping. */
		function stripDiffPrefix(target) {
		return target.replace(/^[abciow]\//, '');
		}
		function splitLines(output) {
		return output.split('\n').map(line => line.trim()).filter(Boolean);
		}
		async function git(root, args) {
		try {
		const { stdout } = await execFileAsync('git', args, { cwd: root, maxBuffer: 32 * 1024 * 1024 });
		return stdout;
		}
		catch (error) {
		const detail = error instanceof Error ? error.message : String(error);
		throw new Error(`git ${args.join(' ')} failed: ${detail}`);
		}
		}
		//# sourceMappingURL=diffScope.js.map

+1

dist/remediation/diffScope.js.map

{"version":3,"file":"diffScope.js","sourceRoot":"","sources":["../../src/remediation/diffScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAyB1C;;;;GAIG;AACH,MAAM,QAAQ,GAAG,qCAAqC,CAAC;AAEvD,mFAAmF;AACnF,MAAM,WAAW,GAAG,yCAAyC,CAAC;AAE9D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,oDAAoD,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAO,GAAqB,EAAE;IACjF,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACvF,IAAI,GAAW,CAAC;IAEhB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACvB,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,0CAA0C;IAC1C,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACpG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,QAAgB,EAAE,SAA6B;IACjG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,mDAAmD;IACnD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,6EAA6E;IAC7E,OAAO,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAkB,EAAE,KAA+B;IACzF,IAAI,OAA2B,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,GAAG,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,OAAO;gBAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,CAAC;YAAE,SAAS;QAE1B,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAc;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC"}

+60

dist/remediation/executor.d.ts

		/**
		* Who performs a remediation.
		*
		* An executor edits code. That is the whole job: Dvalin runs the project's
		* checks itself and re-scans independently, so nothing here is trusted and
		* there is no trust surface on this interface to get wrong. Choosing an
		* executor is a question of cost and quality, not of what it may be believed
		* about.
		*/
		export type ExecutorId = 'dvalin' \| 'codex';
		export declare const EXECUTOR_IDS: ExecutorId[];
		/** The subset of agent activity the remediation console renders. */
		export type ExecutorEvent = {
		type: 'tool_call';
		name: string;
		} \| {
		type: 'tool_error';
		name: string;
		error: string;
		};
		export type ExecutorRequest = {
		prompt: string;
		cwd: string;
		/** Continue the conversation a previous turn started. */
		resume?: string;
		/** Override the model provider, where the executor has one to override. */
		provider?: string;
		};
		export type ExecutorTurn = {
		/** The executor's final message. Callers read it for a summary or a PR URL. */
		output: string;
		/** Handle for continuing this conversation in a later turn. */
		session?: string;
		};
		export type RemediationExecutor = {
		id: ExecutorId;
		name: string;
		/** `undefined` when usable; otherwise the reason it is not. */
		unavailableReason(): Promise<string \| undefined>;
		run(request: ExecutorRequest, onEvent?: (event: ExecutorEvent) => void): Promise<ExecutorTurn>;
		};
		/** Dvalin's own agent: the existing behaviour, unchanged. */
		export declare const dvalinAgentExecutor: RemediationExecutor;
		/**
		* OpenAI's Codex harness, through `codex exec`.
		*
		* `--json` is what makes this usable as a backend rather than a black box:
		* `thread.started` carries the handle that `codex exec resume` needs, which is
		* what keeps fix and publish in one conversation, and completed commands stream
		* out as structured items so a long remediation is not silent.
		*/
		export declare const codexExecExecutor: RemediationExecutor;
		/**
		* Read a `codex exec --json` JSONL stream.
		*
		* Exported for its own sake: the parsing is the part worth testing, and it can
		* be exercised against recorded output without a model or a network.
		*/
		export declare function parseCodexStream(stdout: string): ExecutorTurn;
		export declare function resolveExecutor(id: ExecutorId): RemediationExecutor;

+144

dist/remediation/executor.js

		import { spawn } from 'node:child_process';
		import { runAgentTurn } from '../agent/session.js';
		export const EXECUTOR_IDS = ['dvalin', 'codex'];
		/** Dvalin's own agent: the existing behaviour, unchanged. */
		export const dvalinAgentExecutor = {
		id: 'dvalin',
		name: 'Dvalin agent',
		async unavailableReason() {
		return undefined;
		},
		async run(request, onEvent) {
		const turn = await runAgentTurn({
		content: request.prompt,
		cwd: request.cwd,
		sessionId: request.resume,
		mode: 'dvalin',
		codePermissionMode: 'bypass',
		providerOverride: request.provider,
		}, {
		onEvent: event => {
		if (event.type === 'tool_call')
		onEvent?.({ type: 'tool_call', name: event.name });
		if (event.type === 'tool_error')
		onEvent?.({ type: 'tool_error', name: event.name, error: event.error });
		},
		});
		return { output: turn.result.output, session: turn.sessionId };
		},
		};
		/**
		* OpenAI's Codex harness, through `codex exec`.
		*
		* `--json` is what makes this usable as a backend rather than a black box:
		* `thread.started` carries the handle that `codex exec resume` needs, which is
		* what keeps fix and publish in one conversation, and completed commands stream
		* out as structured items so a long remediation is not silent.
		*/
		export const codexExecExecutor = {
		id: 'codex',
		name: 'Codex (codex exec)',
		async unavailableReason() {
		const found = await new Promise(resolve => {
		const probe = spawn('codex', ['--version'], { stdio: 'ignore' });
		probe.on('error', () => resolve(false));
		probe.on('close', code => resolve(code === 0));
		});
		if (!found)
		return 'the `codex` CLI is not on PATH — install it with `npm i -g @openai/codex`';
		if (!process.env.CODEX_API_KEY && !process.env.OPENAI_API_KEY) {
		return 'neither CODEX_API_KEY nor OPENAI_API_KEY is set, and `codex exec` needs credentials in automation';
		}
		return undefined;
		},
		async run(request, onEvent) {
		// `workspace-write` is the least permission that still lets a remediation
		// edit code. The isolated worktree, not the sandbox, is what keeps the
		// original workspace out of reach.
		const args = request.resume
		? ['exec', 'resume', request.resume, '--json', '--sandbox', 'workspace-write', request.prompt]
		: ['exec', '--json', '--sandbox', 'workspace-write', request.prompt];
		const { stdout, stderr, code } = await runCodex(args, request.cwd, onEvent);
		if (code !== 0) {
		throw new Error(`codex exec exited ${code}: ${stderr.trim().slice(0, 500) \|\| 'no stderr'}`);
		}
		return parseCodexStream(stdout);
		},
		};
		/**
		* Read a `codex exec --json` JSONL stream.
		*
		* Exported for its own sake: the parsing is the part worth testing, and it can
		* be exercised against recorded output without a model or a network.
		*/
		export function parseCodexStream(stdout) {
		let output = '';
		let session;
		for (const line of stdout.split('\n')) {
		const trimmed = line.trim();
		if (!trimmed)
		continue;
		let event;
		try {
		event = JSON.parse(trimmed);
		}
		catch {
		// Anything the harness prints that is not an event is not ours to read.
		continue;
		}
		if (event.type === 'thread.started' && typeof event.thread_id === 'string') {
		session = event.thread_id;
		continue;
		}
		if (event.type !== 'item.completed')
		continue;
		const item = event.item;
		if (!item)
		continue;
		// The last agent message is the turn's result; earlier ones are progress.
		if (item.type === 'agent_message' && typeof item.text === 'string')
		output = item.text;
		}
		return { output, session };
		}
		export function resolveExecutor(id) {
		return id === 'codex' ? codexExecExecutor : dvalinAgentExecutor;
		}
		function runCodex(args, cwd, onEvent) {
		return new Promise((resolve, reject) => {
		const child = spawn('codex', args, { cwd, env: process.env, stdio: ['ignore', 'pipe', 'pipe'] });
		let stdout = '';
		let stderr = '';
		let pending = '';
		child.stdout.on('data', chunk => {
		stdout += chunk;
		// Report commands as they complete, so a long remediation is not silent.
		pending += chunk;
		const lines = pending.split('\n');
		pending = lines.pop() ?? '';
		for (const line of lines)
		reportCodexLine(line, onEvent);
		});
		child.stderr.on('data', chunk => (stderr += chunk));
		child.on('error', reject);
		child.on('close', code => resolve({ stdout, stderr, code }));
		});
		}
		function reportCodexLine(line, onEvent) {
		if (!onEvent \|\| !line.trim())
		return;
		try {
		const event = JSON.parse(line);
		const item = event.item;
		if (event.type !== 'item.completed' \|\| item?.type !== 'command_execution' \|\| !item.command)
		return;
		if (item.status === 'failed')
		onEvent({ type: 'tool_error', name: item.command, error: 'command failed' });
		else
		onEvent({ type: 'tool_call', name: item.command });
		}
		catch {
		// Not an event line.
		}
		}
		//# sourceMappingURL=executor.js.map

+1

dist/remediation/executor.js.map

+38

dist/remediation/verify.d.ts

		import { type CheckKind } from '../tools/runCheck.js';
		import type { AuditSink } from '../audit/log.js';
		import type { SecurityCheckEvidence } from '../security/workflow.js';
		export type VerificationRun = {
		evidence: SecurityCheckEvidence[];
		/** Checks that could not be found in this project, so nothing was run for them. */
		skipped: CheckKind[];
		};
		export type VerifyOptions = {
		cwd: string;
		/** Explicit commands, for projects whose checks cannot be detected. */
		commands?: string[];
		/** Which project checks to look for. Defaults to test, typecheck, build. */
		kinds?: CheckKind[];
		timeoutMs?: number;
		/**
		* Write each executed check into the hash-chained audit log.
		*
		* Without this the exit codes exist only in memory: the verdict is sound but
		* nothing afterwards can show what was run. A Verified Fix Record anchors to
		* the chain, so the chain has to contain the checks.
		*/
		audit?: AuditSink;
		};
		export declare function runProjectVerification(options: VerifyOptions): Promise<VerificationRun>;
		/**
		* Split a configured command into argv.
		*
		* Deliberately not a shell: a check command is a program and its arguments, and
		* running it through a shell would hand the project's own configuration a way
		* to run something else. Quotes are honoured only so an argument may contain a
		* space — `npm test -- --grep "two words"` — and nothing else about them is
		* interpreted.
		*/
		export declare function splitCommand(commandLine: string): {
		command: string;
		args: string[];
		};

+116

dist/remediation/verify.js

		import { checkCommand, loadPolicy } from '../core/policy.js';
		import { runGovernedProcess } from '../core/subprocessSandbox.js';
		import { pickProjectCheck } from '../tools/runCheck.js';
		import { sha256 } from '../audit/hash.js';
		/**
		* Dvalin runs the project's checks itself.
		*
		* Asking the agent that just wrote a patch whether its patch is good is the one
		* question it is least able to answer honestly, and no amount of prompt
		* wording fixes that. Running the commands here means the exit codes in the
		* verification gate are observed, not reported — which is what lets the choice
		* of remediation executor be a question of cost and quality rather than trust.
		*/
		const DEFAULT_KINDS = ['test', 'typecheck', 'build'];
		export async function runProjectVerification(options) {
		const timeoutMs = options.timeoutMs ?? 300_000;
		const policy = loadPolicy(options.cwd).policy;
		const evidence = [];
		const skipped = [];
		if (options.commands?.length) {
		for (const commandLine of options.commands) {
		evidence.push(await runOne('custom', splitCommand(commandLine), options.cwd, policy, timeoutMs, options.audit));
		}
		return { evidence, skipped };
		}
		// `kinds: []` is a project saying "run no checks", which is different from
		// not asking. It leads to an unverifiable record, which is the honest result.
		for (const kind of options.kinds ?? DEFAULT_KINDS) {
		const picked = await pickProjectCheck(options.cwd, kind, []);
		if (!picked) {
		skipped.push(kind);
		continue;
		}
		evidence.push(await runOne(kind, picked, options.cwd, policy, timeoutMs, options.audit));
		}
		return { evidence, skipped };
		}
		async function runOne(kind, picked, cwd, policy, timeoutMs, audit) {
		const commandLine = [picked.command, ...picked.args].join(' ');
		try {
		return await execute(kind, picked, commandLine, cwd, policy, timeoutMs, audit);
		}
		catch (error) {
		// A check that could not be executed did not pass. Letting the throw escape
		// would abandon the remaining checks and lose the verification entirely,
		// when the honest record is simply that this one produced no exit code.
		audit?.append({
		type: 'tool_call',
		tool: 'run_check',
		argsSummary: `${kind}: ${error instanceof Error ? error.message : String(error)}`,
		status: 'error',
		durationMs: 0,
		});
		return { kind, command: commandLine, exitCode: null, passed: false };
		}
		}
		async function execute(kind, picked, commandLine, cwd, policy, timeoutMs, audit) {
		// The same gate every other governed command passes. A policy that forbids a
		// command does not get bypassed because the caller is the verifier.
		const decision = checkCommand(policy, commandLine);
		if (!decision.allowed) {
		audit?.append({ type: 'policy_violation', rule: decision.rule ?? 'command denied', tool: 'run_check', target: picked.command });
		return { kind, command: commandLine, exitCode: null, passed: false };
		}
		const startedAt = Date.now();
		const result = await runGovernedProcess({
		command: picked.command,
		args: picked.args,
		cwd,
		timeoutMs,
		policy,
		toolName: 'dvalin_verify',
		preferSandboxWhenUnrestricted: true,
		});
		// Same shape the tool-layer tap emits for `run_check`, so anything already
		// reading the chain for check evidence keeps working.
		audit?.append({
		type: 'tool_call',
		tool: 'run_check',
		argsSummary: kind,
		status: result.exitCode === 0 && !result.timedOut ? 'ok' : 'error',
		durationMs: Date.now() - startedAt,
		});
		audit?.append({
		type: 'shell_exec',
		command: picked.command,
		argsCount: picked.args.length,
		inputHash: sha256(commandLine),
		exitCode: result.exitCode,
		sandbox: result.sandbox === 'seatbelt' \|\| result.sandbox === 'bwrap' ? result.sandbox : 'none',
		});
		return {
		kind,
		command: commandLine,
		exitCode: result.exitCode,
		// A timeout is not a pass, whatever the exit code ends up being.
		passed: result.exitCode === 0 && !result.timedOut,
		};
		}
		/**
		* Split a configured command into argv.
		*
		* Deliberately not a shell: a check command is a program and its arguments, and
		* running it through a shell would hand the project's own configuration a way
		* to run something else. Quotes are honoured only so an argument may contain a
		* space — `npm test -- --grep "two words"` — and nothing else about them is
		* interpreted.
		*/
		export function splitCommand(commandLine) {
		const parts = commandLine.match(/"[^"]"\|'[^']'\|\S+/g) ?? [];
		const argv = parts.map(part => (part.startsWith('"') && part.endsWith('"')) \|\| (part.startsWith("'") && part.endsWith("'"))
		? part.slice(1, -1)
		: part);
		return { command: argv[0] ?? '', args: argv.slice(1) };
		}
		//# sourceMappingURL=verify.js.map

+1

dist/remediation/verify.js.map

+7

dist/security/baseline.d.ts

		import type { DvalinScanSuiteResult } from '../remediation/scannerSuite.js';
		import { type SecurityBaseline } from './contracts.js';
		export declare function readSecurityBaseline(root: string, file: string): Promise<SecurityBaseline>;
		export declare function writeSecurityBaseline(root: string, file: string, result: DvalinScanSuiteResult): Promise<{
		path: string;
		baseline: SecurityBaseline;
		}>;

+26

dist/security/baseline.js

		import { mkdir, readFile, writeFile } from 'node:fs/promises';
		import path from 'node:path';
		import { UsageError } from '../core/exitCodes.js';
		import { createBaseline, isSecurityBaseline } from './contracts.js';
		import { resolveSecurityPath } from './config.js';
		export async function readSecurityBaseline(root, file) {
		const target = resolveSecurityPath(root, file);
		let parsed;
		try {
		parsed = JSON.parse(await readFile(target, 'utf8'));
		}
		catch (error) {
		throw new UsageError(`Cannot read security baseline ${target}: ${error instanceof Error ? error.message : String(error)}`);
		}
		if (!isSecurityBaseline(parsed))
		throw new UsageError(`Invalid or unsupported security baseline: ${target}`);
		return parsed;
		}
		export async function writeSecurityBaseline(root, file, result) {
		const target = resolveSecurityPath(root, file);
		const baseline = createBaseline(result);
		await mkdir(path.dirname(target), { recursive: true });
		await writeFile(target, `${JSON.stringify(baseline, null, 2)}\n`, 'utf8');
		return { path: target, baseline };
		}
		//# sourceMappingURL=baseline.js.map

+1

dist/security/baseline.js.map

{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../src/security/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAyB,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAY;IACnE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAY,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,iCAAiC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,6CAA6C,MAAM,EAAE,CAAC,CAAC;IAC7G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAY,EAAE,MAA6B;IAInG,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC"}

+32

dist/security/config.d.ts

		import type { DvalinScannerId } from '../remediation/scannerSuite.js';
		import type { SecurityGateMode, SecurityThreshold } from './contracts.js';
		export declare const SECURITY_CONFIG_FILE = "dvalin.security.json";
		export declare const DEFAULT_BASELINE_FILE = ".dvalin/baseline.json";
		export type SecuritySuppression = {
		fingerprint?: string;
		ruleId?: string;
		path?: string;
		reason: string;
		owner?: string;
		expiresAt?: string;
		};
		export type DvalinSecurityConfig = {
		version: 1;
		scanners: DvalinScannerId[];
		gate: {
		severity: SecurityThreshold;
		mode: SecurityGateMode;
		};
		baseline: string;
		checks: Array<'test' \| 'typecheck' \| 'build' \| 'lint'>;
		suppressions: SecuritySuppression[];
		};
		export declare const DEFAULT_SECURITY_CONFIG: DvalinSecurityConfig;
		export declare const INITIALIZED_SECURITY_CONFIG: DvalinSecurityConfig;
		export declare function loadSecurityConfig(root: string, explicitPath?: string): Promise<{
		config: DvalinSecurityConfig;
		path?: string;
		}>;
		export declare function writeInitialSecurityConfig(root: string, force?: boolean): Promise<string>;
		export declare function parseSecurityConfig(value: unknown, source?: string): DvalinSecurityConfig;
		export declare function resolveSecurityPath(root: string, candidate: string): string;

+131

dist/security/config.js

		import { access, readFile, writeFile } from 'node:fs/promises';
		import path from 'node:path';
		import { constants } from 'node:fs';
		import { UsageError } from '../core/exitCodes.js';
		export const SECURITY_CONFIG_FILE = 'dvalin.security.json';
		export const DEFAULT_BASELINE_FILE = '.dvalin/baseline.json';
		export const DEFAULT_SECURITY_CONFIG = {
		version: 1,
		scanners: ['builtin'],
		gate: { severity: 'none', mode: 'all' },
		baseline: DEFAULT_BASELINE_FILE,
		checks: ['test'],
		suppressions: [],
		};
		export const INITIALIZED_SECURITY_CONFIG = {
		...DEFAULT_SECURITY_CONFIG,
		gate: { severity: 'high', mode: 'new' },
		};
		export async function loadSecurityConfig(root, explicitPath) {
		const candidate = explicitPath ? path.resolve(root, explicitPath) : path.join(root, SECURITY_CONFIG_FILE);
		try {
		await access(candidate, constants.R_OK);
		}
		catch {
		if (explicitPath)
		throw new UsageError(`Security config not found: ${candidate}`);
		return { config: structuredClone(DEFAULT_SECURITY_CONFIG) };
		}
		let parsed;
		try {
		parsed = JSON.parse(await readFile(candidate, 'utf8'));
		}
		catch (error) {
		throw new UsageError(`Invalid security config ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
		}
		return { config: parseSecurityConfig(parsed, candidate), path: candidate };
		}
		export async function writeInitialSecurityConfig(root, force = false) {
		const target = path.join(root, SECURITY_CONFIG_FILE);
		if (!force) {
		try {
		await access(target, constants.F_OK);
		throw new UsageError(`${SECURITY_CONFIG_FILE} already exists. Use --force to replace it.`);
		}
		catch (error) {
		if (error instanceof UsageError)
		throw error;
		}
		}
		await writeFile(target, `${JSON.stringify(INITIALIZED_SECURITY_CONFIG, null, 2)}\n`, 'utf8');
		return target;
		}
		export function parseSecurityConfig(value, source = SECURITY_CONFIG_FILE) {
		if (!value \|\| typeof value !== 'object' \|\| Array.isArray(value))
		throw new UsageError(`${source} must contain a JSON object.`);
		const input = value;
		if (input.version !== 1)
		throw new UsageError(`${source}: version must be 1.`);
		const scanners = parseScanners(input.scanners, source);
		const gateInput = asRecord(input.gate);
		const severity = gateInput?.severity ?? DEFAULT_SECURITY_CONFIG.gate.severity;
		const mode = gateInput?.mode ?? DEFAULT_SECURITY_CONFIG.gate.mode;
		if (!['critical', 'high', 'medium', 'low', 'none'].includes(String(severity))) {
		throw new UsageError(`${source}: gate.severity must be critical, high, medium, low, or none.`);
		}
		if (mode !== 'all' && mode !== 'new')
		throw new UsageError(`${source}: gate.mode must be all or new.`);
		const baseline = input.baseline ?? DEFAULT_SECURITY_CONFIG.baseline;
		if (typeof baseline !== 'string' \|\| !baseline.trim())
		throw new UsageError(`${source}: baseline must be a path string.`);
		const checks = input.checks ?? DEFAULT_SECURITY_CONFIG.checks;
		if (!Array.isArray(checks) \|\| checks.some(check => !['test', 'typecheck', 'build', 'lint'].includes(String(check)))) {
		throw new UsageError(`${source}: checks must contain only test, typecheck, build, or lint.`);
		}
		const suppressions = input.suppressions ?? [];
		if (!Array.isArray(suppressions))
		throw new UsageError(`${source}: suppressions must be an array.`);
		return {
		version: 1,
		scanners,
		gate: { severity: severity, mode },
		baseline,
		checks: [...new Set(checks)],
		suppressions: suppressions.map((suppression, index) => parseSuppression(suppression, `${source}: suppressions[${index}]`)),
		};
		}
		export function resolveSecurityPath(root, candidate) {
		const resolvedRoot = path.resolve(root);
		const resolved = path.resolve(resolvedRoot, candidate);
		const relative = path.relative(resolvedRoot, resolved);
		if (relative.startsWith('..' + path.sep) \|\| relative === '..' \|\| path.isAbsolute(relative)) {
		throw new UsageError(`Security artifact path must stay inside the workspace: ${candidate}`);
		}
		return resolved;
		}
		function parseScanners(value, source) {
		const scanners = value ?? DEFAULT_SECURITY_CONFIG.scanners;
		const allowed = ['builtin', 'semgrep', 'trivy', 'osv-scanner'];
		if (!Array.isArray(scanners) \|\| !scanners.length \|\| scanners.some(scanner => !allowed.includes(scanner))) {
		throw new UsageError(`${source}: scanners must contain one or more of ${allowed.join(', ')}.`);
		}
		return [...new Set(scanners)];
		}
		function parseSuppression(value, source) {
		const input = asRecord(value);
		if (!input)
		throw new UsageError(`${source} must be an object.`);
		if (typeof input.reason !== 'string' \|\| !input.reason.trim())
		throw new UsageError(`${source}.reason is required.`);
		if (!input.fingerprint && !input.ruleId)
		throw new UsageError(`${source} needs fingerprint or ruleId.`);
		for (const field of ['fingerprint', 'ruleId', 'path', 'owner', 'expiresAt']) {
		if (input[field] !== undefined && typeof input[field] !== 'string')
		throw new UsageError(`${source}.${field} must be a string.`);
		}
		if (typeof input.expiresAt === 'string' && !Number.isFinite(Date.parse(input.expiresAt))) {
		throw new UsageError(`${source}.expiresAt must be an ISO date.`);
		}
		return {
		fingerprint: input.fingerprint,
		ruleId: input.ruleId,
		path: input.path,
		reason: input.reason,
		owner: input.owner,
		expiresAt: input.expiresAt,
		};
		}
		function asRecord(value) {
		return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
		}
		//# sourceMappingURL=config.js.map

+1

dist/security/config.js.map

+149

dist/security/contracts.d.ts

		import type { RemediationFinding } from '../remediation/sarif.js';
		import type { DvalinScannerId, DvalinScannerRun, DvalinScanSuiteResult } from '../remediation/scannerSuite.js';
		export declare const SECURITY_SCHEMA_VERSION: 2;
		/**
		* Versions this build can read. Writers always emit the current version.
		*
		* A baseline is committed to the user's repository, so raising the version
		* without accepting the previous one would break every repository that already
		* has one on the first upgrade. Records written before coverage existed load
		* fine and simply report `unknown` coverage — which is the honest answer for a
		* scan that never recorded what it looked at.
		*/
		export declare const SUPPORTED_SECURITY_SCHEMA_VERSIONS: readonly number[];
		export declare const SECURITY_SEVERITIES: readonly ['critical', 'high', 'medium', 'low'];
		export type SecuritySeverity = typeof SECURITY_SEVERITIES[number];
		export type SecurityThreshold = SecuritySeverity \| 'none';
		export type SecurityGateMode = 'all' \| 'new';
		export type SecurityFindingSnapshot = {
		fingerprint: string;
		targetFingerprint: string;
		findingId: string;
		source: string;
		/**
		* Which engine produced this finding. Absent on records written before the
		* field existed, and on imported SARIF from a tool outside the fleet; the
		* delta falls back to matching `source` by name and, failing that, treats the
		* finding's coverage as unattributable.
		*/
		scanner?: DvalinScannerId;
		ruleId: string;
		ruleName?: string;
		severity: RemediationFinding['severity'];
		securitySeverity?: string;
		message: string;
		path: string;
		startLine?: number;
		endLine?: number;
		helpUri?: string;
		tags: string[];
		};
		export type SecurityBaseline = {
		schemaVersion: typeof SECURITY_SCHEMA_VERSION;
		kind: 'dvalin-security-baseline';
		createdAt: string;
		scanId: string;
		scanners: DvalinScannerId[];
		/** Absent on baselines written before coverage was recorded. */
		coverage?: SecurityCoverage;
		findings: SecurityFindingSnapshot[];
		};
		export declare const SECURITY_COVERAGE_STATUSES: readonly ['complete', 'partial', 'unknown'];
		export type SecurityCoverageStatus = typeof SECURITY_COVERAGE_STATUSES[number];
		/**
		* What the scan actually looked at.
		*
		* A gate result means nothing without it: "no findings" from a run where
		* Semgrep was not installed and half the results were dropped is not the same
		* answer as "no findings" from a complete run, and reporting them identically
		* is the way a number stops meaning anything.
		*/
		export type SecurityCoverage = {
		status: SecurityCoverageStatus;
		/** Per-engine outcome for the engines this scan selected. */
		scanners: Array<{
		id: DvalinScannerId;
		status: DvalinScannerRun['status'];
		}>;
		/** Deliberately not looked at: suppressions, ignore rules, policy denials. */
		exclusions: string[];
		/** Not fully examined, though nothing chose to skip it. */
		deferred: string[];
		notes: string[];
		};
		/**
		* How each finding moved since the baseline.
		*
		* `unknown` exists because the alternative is a lie: a baseline finding absent
		* from a run whose engine never executed has not been resolved, it has not been
		* looked for. Before this field, such findings were reported as `resolved`.
		*/
		export type SecurityFindingDelta = {
		new: SecurityFindingSnapshot[];
		existing: SecurityFindingSnapshot[];
		resolved: SecurityFindingSnapshot[];
		/** Gone from the baseline by fingerprint, but the same rule is back in the same file. */
		reopened: SecurityFindingSnapshot[];
		/** Removed by an active suppression, with a recorded reason. */
		dismissed: SecurityFindingSnapshot[];
		/** Cannot be judged: the engine that would have found it did not complete. */
		unknown: SecurityFindingSnapshot[];
		};
		export type SecurityGateResult = {
		passed: boolean;
		mode: SecurityGateMode;
		threshold: SecurityThreshold;
		considered: number;
		blocking: SecurityFindingSnapshot[];
		};
		export type SecurityScanEnvelope = {
		schemaVersion: typeof SECURITY_SCHEMA_VERSION;
		scan: DvalinScanSuiteResult;
		coverage: SecurityCoverage;
		delta?: SecurityFindingDelta;
		gate: SecurityGateResult;
		};
		/**
		* Stable identity for a workspace, shared by the workflow, the fix record, and
		* the Evidence Pack so all three agree on which project a record belongs to.
		*/
		export declare function securityProjectId(root: string): string;
		export declare function severityOfFinding(finding: Pick<RemediationFinding, 'severity' \| 'securitySeverity'>): SecuritySeverity;
		export declare function findingFingerprint(finding: Pick<RemediationFinding, 'id' \| 'source' \| 'ruleId' \| 'path' \| 'startLine' \| 'message'>): string;
		/** A conservative verification key: a moved instance of the same rule in the same file still remains a target. */
		export declare function findingTargetFingerprint(finding: Pick<RemediationFinding, 'source' \| 'ruleId' \| 'path'>): string;
		/**
		* Best-effort engine attribution for a finding.
		*
		* The suite tags its own findings at scan time; this name match is the fallback
		* for records written before that tag existed. When neither resolves, the
		* caller must treat the finding as unattributable rather than guessing.
		*/
		export declare function scannerIdForSource(source: string): DvalinScannerId \| undefined;
		export declare function snapshotFinding(finding: RemediationFinding): SecurityFindingSnapshot;
		/**
		* Describe what a completed scan actually covered, from facts the suite already
		* recorded. Nothing here re-scans or estimates.
		*/
		export declare function deriveCoverage(result: DvalinScanSuiteResult, options?: {
		suppressed?: Array<{
		finding: Pick<RemediationFinding, 'path' \| 'ruleId'>;
		}>;
		}): SecurityCoverage;
		/** Coverage for a record that never captured any — genuinely not knowable after the fact. */
		export declare function unknownCoverage(note: string): SecurityCoverage;
		export declare function createBaseline(result: DvalinScanSuiteResult): SecurityBaseline;
		export declare function compareWithBaseline(result: DvalinScanSuiteResult, baseline: SecurityBaseline, options?: {
		suppressed?: Array<{
		finding: RemediationFinding;
		}>;
		}): SecurityFindingDelta;
		export declare function evaluateSecurityGate(input: {
		result: DvalinScanSuiteResult;
		threshold: SecurityThreshold;
		mode: SecurityGateMode;
		delta?: SecurityFindingDelta;
		}): SecurityGateResult;
		/** True for any schema version this build can read, not only the one it writes. */
		export declare function isSupportedSecuritySchemaVersion(value: unknown): boolean;
		export declare function isSecurityBaseline(value: unknown): value is SecurityBaseline;

+231

dist/security/contracts.js

		import { createHash } from 'node:crypto';
		import path from 'node:path';
		export const SECURITY_SCHEMA_VERSION = 2;
		/**
		* Versions this build can read. Writers always emit the current version.
		*
		* A baseline is committed to the user's repository, so raising the version
		* without accepting the previous one would break every repository that already
		* has one on the first upgrade. Records written before coverage existed load
		* fine and simply report `unknown` coverage — which is the honest answer for a
		* scan that never recorded what it looked at.
		*/
		export const SUPPORTED_SECURITY_SCHEMA_VERSIONS = [1, 2];
		export const SECURITY_SEVERITIES = ['critical', 'high', 'medium', 'low'];
		export const SECURITY_COVERAGE_STATUSES = ['complete', 'partial', 'unknown'];
		/**
		* Stable identity for a workspace, shared by the workflow, the fix record, and
		* the Evidence Pack so all three agree on which project a record belongs to.
		*/
		export function securityProjectId(root) {
		return createHash('sha256').update(path.resolve(root)).digest('hex').slice(0, 16);
		}
		export function severityOfFinding(finding) {
		const score = Number.parseFloat(finding.securitySeverity ?? '');
		if (score >= 9)
		return 'critical';
		if (finding.severity === 'error' \|\| score >= 7)
		return 'high';
		if (finding.severity === 'warning' \|\| score >= 4)
		return 'medium';
		return 'low';
		}
		export function findingFingerprint(finding) {
		return digest([
		finding.source,
		finding.id,
		finding.ruleId,
		normalizePath(finding.path),
		String(finding.startLine ?? 0),
		finding.message.trim().replace(/\s+/g, ' '),
		]);
		}
		/** A conservative verification key: a moved instance of the same rule in the same file still remains a target. */
		export function findingTargetFingerprint(finding) {
		return digest([finding.source, finding.ruleId, normalizePath(finding.path)]);
		}
		/**
		* Best-effort engine attribution for a finding.
		*
		* The suite tags its own findings at scan time; this name match is the fallback
		* for records written before that tag existed. When neither resolves, the
		* caller must treat the finding as unattributable rather than guessing.
		*/
		export function scannerIdForSource(source) {
		const name = source.toLowerCase();
		if (name.includes('dvalin'))
		return 'builtin';
		if (name.includes('semgrep'))
		return 'semgrep';
		if (name.includes('trivy'))
		return 'trivy';
		if (name.includes('osv'))
		return 'osv-scanner';
		return undefined;
		}
		export function snapshotFinding(finding) {
		const scanner = finding.scanner ?? scannerIdForSource(finding.source);
		return {
		fingerprint: findingFingerprint(finding),
		targetFingerprint: findingTargetFingerprint(finding),
		findingId: finding.id,
		source: finding.source,
		...(scanner ? { scanner } : {}),
		ruleId: finding.ruleId,
		ruleName: finding.ruleName,
		severity: finding.severity,
		securitySeverity: finding.securitySeverity,
		message: finding.message,
		path: normalizePath(finding.path),
		startLine: finding.startLine,
		endLine: finding.endLine,
		helpUri: finding.helpUri,
		tags: [...finding.tags],
		};
		}
		/**
		* Describe what a completed scan actually covered, from facts the suite already
		* recorded. Nothing here re-scans or estimates.
		*/
		export function deriveCoverage(result, options = {}) {
		const scanners = result.scanners.map(scanner => ({ id: scanner.id, status: scanner.status }));
		const exclusions = [];
		const deferred = [];
		const notes = [];
		const incomplete = result.scanners.filter(scanner => scanner.status !== 'completed');
		for (const scanner of incomplete) {
		deferred.push(`${scanner.name}: ${scanner.status}${scanner.error ? ` — ${scanner.error}` : ''}`);
		}
		if (result.skippedResults > 0) {
		deferred.push(`${result.skippedResults} scanner result(s) dropped for lacking a safe workspace location`);
		}
		if (result.scope) {
		// A scoped run answers "did this change introduce anything?". It has never
		// seen the rest of the repository and must not imply that it has.
		deferred.push(`scoped to ${result.scope.ref} (${result.scope.files} file(s)); the rest of the workspace was not scanned`);
		}
		const suppressed = options.suppressed ?? [];
		for (const entry of suppressed) {
		exclusions.push(`${entry.finding.ruleId} in ${entry.finding.path} (suppressed)`);
		}
		let status;
		if (!scanners.length) {
		status = 'unknown';
		notes.push('No engine outcome was recorded for this scan.');
		}
		else if (deferred.length) {
		status = 'partial';
		}
		else {
		status = 'complete';
		}
		return { status, scanners, exclusions, deferred, notes };
		}
		/** Coverage for a record that never captured any — genuinely not knowable after the fact. */
		export function unknownCoverage(note) {
		return { status: 'unknown', scanners: [], exclusions: [], deferred: [], notes: [note] };
		}
		export function createBaseline(result) {
		return {
		schemaVersion: SECURITY_SCHEMA_VERSION,
		kind: 'dvalin-security-baseline',
		createdAt: new Date().toISOString(),
		scanId: result.id,
		scanners: result.scanners.map(scanner => scanner.id),
		coverage: deriveCoverage(result),
		findings: result.findings.map(snapshotFinding),
		};
		}
		export function compareWithBaseline(result, baseline, options = {}) {
		const current = result.findings.map(snapshotFinding);
		const baselineByFingerprint = new Map(baseline.findings.map(finding => [finding.fingerprint, finding]));
		const currentFingerprints = new Set(current.map(finding => finding.fingerprint));
		const baselineTargets = new Set(baseline.findings.map(finding => finding.targetFingerprint));
		// Engines that did not complete leave a hole. A baseline finding behind that
		// hole was not looked for, so it cannot be called resolved.
		const completed = new Set(result.scanners.filter(run => run.status === 'completed').map(run => run.id));
		const attempted = new Set(result.scanners.map(run => run.id));
		const hasHole = result.scanners.some(run => run.status !== 'completed')
		\|\| baseline.scanners.some(id => !attempted.has(id));
		const covers = (finding) => {
		if (!hasHole)
		return true;
		const scanner = finding.scanner ?? scannerIdForSource(finding.source);
		// Unattributable and a hole exists: we cannot claim to have looked for it.
		if (!scanner)
		return false;
		return completed.has(scanner);
		};
		const absent = baseline.findings.filter(finding => !currentFingerprints.has(finding.fingerprint));
		const dismissed = (options.suppressed ?? []).map(entry => snapshotFinding(entry.finding));
		const dismissedFingerprints = new Set(dismissed.map(finding => finding.fingerprint));
		const unresolved = absent.filter(finding => !dismissedFingerprints.has(finding.fingerprint));
		const added = current.filter(finding => !baselineByFingerprint.has(finding.fingerprint));
		return {
		new: added.filter(finding => !baselineTargets.has(finding.targetFingerprint)),
		existing: current.filter(finding => baselineByFingerprint.has(finding.fingerprint)),
		resolved: unresolved.filter(covers),
		// Same rule, same file, different line or wording: the target came back.
		reopened: added.filter(finding => baselineTargets.has(finding.targetFingerprint)),
		dismissed,
		unknown: unresolved.filter(finding => !covers(finding)),
		};
		}
		export function evaluateSecurityGate(input) {
		// A reopened finding is a new occurrence that happens to have a precedent in
		// the baseline. It must face the gate exactly as `new` does — routing it to
		// its own bucket without this would let a fresh critical hide behind any
		// baselined finding of the same rule in the same file.
		const considered = input.mode === 'new'
		? input.delta
		? [...input.delta.new, ...input.delta.reopened]
		: input.result.findings.map(snapshotFinding)
		: input.result.findings.map(snapshotFinding);
		const thresholdIndex = input.threshold === 'none' ? -1 : SECURITY_SEVERITIES.indexOf(input.threshold);
		const blocking = thresholdIndex === -1
		? []
		: considered.filter(finding => SECURITY_SEVERITIES.indexOf(severityOfFinding(finding)) <= thresholdIndex);
		return {
		passed: blocking.length === 0,
		mode: input.mode,
		threshold: input.threshold,
		considered: considered.length,
		blocking,
		};
		}
		/** True for any schema version this build can read, not only the one it writes. */
		export function isSupportedSecuritySchemaVersion(value) {
		return typeof value === 'number' && SUPPORTED_SECURITY_SCHEMA_VERSIONS.includes(value);
		}
		export function isSecurityBaseline(value) {
		if (!value \|\| typeof value !== 'object' \|\| Array.isArray(value))
		return false;
		const record = value;
		return isSupportedSecuritySchemaVersion(record.schemaVersion)
		&& record.kind === 'dvalin-security-baseline'
		&& typeof record.createdAt === 'string'
		&& typeof record.scanId === 'string'
		&& Array.isArray(record.scanners)
		&& Array.isArray(record.findings)
		&& record.findings.every(isFindingSnapshot);
		}
		function isFindingSnapshot(value) {
		if (!value \|\| typeof value !== 'object' \|\| Array.isArray(value))
		return false;
		const record = value;
		return typeof record.fingerprint === 'string'
		&& typeof record.targetFingerprint === 'string'
		&& typeof record.findingId === 'string'
		&& typeof record.source === 'string'
		&& typeof record.ruleId === 'string'
		&& typeof record.message === 'string'
		&& typeof record.path === 'string'
		&& Array.isArray(record.tags);
		}
		function digest(parts) {
		return createHash('sha256').update(parts.join('\0')).digest('hex');
		}
		function normalizePath(filePath) {
		return filePath.replace(/\\/g, '/').replace(/^\.\//, '');
		}
		//# sourceMappingURL=contracts.js.map

+1

dist/security/contracts.js.map

+125

dist/security/fixRecord.d.ts

		import { type SecurityCoverage, type SecurityFindingSnapshot } from './contracts.js';
		import type { SecurityCheckEvidence } from './workflow.js';
		/**
		* A Verified Fix Record.
		*
		* Every other tool in this space asks the model that wrote the patch whether
		* the patch is good. This records the opposite arrangement: who proposed the
		* change is metadata, and the verdict rests on exit codes Dvalin observed and a
		* re-scan Dvalin ran. That is what makes the record worth re-deriving, and what
		* lets it describe a repair produced by any agent, or by a person.
		*
		* What it proves is narrow, and the narrowness is the point: *this finding is
		* gone from this scan, and these checks were observed to pass.* It is not a
		* statement that the code is free of vulnerabilities, and nothing in this
		* module may be extended to imply that.
		*/
		export declare const FIX_RECORD_SCHEMA = "dvalin-fix-record/v1";
		export declare const FIX_EXECUTORS: readonly ['dvalin', 'codex', 'claude-code', 'copilot', 'human', 'unknown'];
		export type FixExecutor = typeof FIX_EXECUTORS[number];
		export type FixRecordScan = {
		scanId: string;
		completedAt: string;
		coverage: SecurityCoverage;
		};
		export type VerifiedFixRecord = {
		schema: typeof FIX_RECORD_SCHEMA;
		generatedAt: string;
		tool: {
		name: 'dvalincode';
		version: string;
		};
		workflowId?: string;
		projectId: string;
		/** Who edited the code. Recorded, never consulted. */
		executor: FixExecutor;
		before: FixRecordScan & {
		targets: SecurityFindingSnapshot[];
		};
		after: FixRecordScan & {
		remainingTargets: SecurityFindingSnapshot[];
		};
		changes?: {
		files: string[];
		diffHash: string;
		};
		/** Commands Dvalin ran itself, with the exit codes it observed. */
		checks: SecurityCheckEvidence[];
		assurance: 'scan-only' \| 'scan-and-checks';
		verdict: {
		verified: boolean;
		reasons: string[];
		};
		/** Where in the hash-chained audit log this verification lives. */
		audit?: {
		runId: string;
		headHash: string;
		};
		policyHash?: string;
		/**
		* Reserved. v1 records are tamper-evident (anyone can re-derive the hash),
		* not signed — signing proves who issued a record, which is a separate
		* question needing key custody this format does not yet define.
		*/
		signatures?: never[];
		recordHash: string;
		};
		export type FixRecordInput = {
		workflowId?: string;
		projectId: string;
		executor?: FixExecutor;
		before: FixRecordScan & {
		targets: SecurityFindingSnapshot[];
		};
		after: FixRecordScan & {
		remainingTargets: SecurityFindingSnapshot[];
		};
		changes?: {
		files: string[];
		diffHash: string;
		};
		checks: SecurityCheckEvidence[];
		audit?: {
		runId: string;
		headHash: string;
		};
		policyHash?: string;
		generatedAt?: string;
		version?: string;
		};
		/**
		* Decide the verdict here and nowhere else.
		*
		* Three callers produce these records; if each applied its own reading of
		* "verified" the word would mean three things. The rules live in one function
		* so that a record from the CLI, the MCP server, and the fix pipeline all mean
		* the same thing.
		*/
		export declare function evaluateFixVerdict(input: {
		checks: SecurityCheckEvidence[];
		remainingTargets: SecurityFindingSnapshot[];
		beforeCoverage: SecurityCoverage;
		afterCoverage: SecurityCoverage;
		}): {
		verified: boolean;
		reasons: string[];
		};
		export declare function buildFixRecord(input: FixRecordInput): VerifiedFixRecord;
		/** Hash of everything except the hash itself, over canonical JSON so key order cannot change it. */
		export declare function fixRecordHash(record: Omit<VerifiedFixRecord, 'recordHash'> \| VerifiedFixRecord): string;
		export type FixRecordVerification = {
		ok: boolean;
		reasons: string[];
		record?: VerifiedFixRecord;
		};
		/**
		* Re-derive a record offline.
		*
		* Needs no workspace, no network, and no Dvalin state — that is the property
		* that lets a reviewer who trusts none of the above check the record anyway.
		* It answers "is this record internally sound and unmodified", not "is the
		* repair still good"; re-running the scanners is a separate, explicit step.
		*/
		export declare function verifyFixRecord(value: unknown): FixRecordVerification;
		/** One-line summary for a terminal or a pull-request comment. */
		export declare function renderFixRecord(record: VerifiedFixRecord): string;

+169

dist/security/fixRecord.js

		import { canonicalJSON, sha256 } from '../audit/hash.js';
		import { VERSION } from '../version.js';
		import { SECURITY_COVERAGE_STATUSES, } from './contracts.js';
		/**
		* A Verified Fix Record.
		*
		* Every other tool in this space asks the model that wrote the patch whether
		* the patch is good. This records the opposite arrangement: who proposed the
		* change is metadata, and the verdict rests on exit codes Dvalin observed and a
		* re-scan Dvalin ran. That is what makes the record worth re-deriving, and what
		* lets it describe a repair produced by any agent, or by a person.
		*
		* What it proves is narrow, and the narrowness is the point: *this finding is
		* gone from this scan, and these checks were observed to pass.* It is not a
		* statement that the code is free of vulnerabilities, and nothing in this
		* module may be extended to imply that.
		*/
		export const FIX_RECORD_SCHEMA = 'dvalin-fix-record/v1';
		export const FIX_EXECUTORS = ['dvalin', 'codex', 'claude-code', 'copilot', 'human', 'unknown'];
		/**
		* Decide the verdict here and nowhere else.
		*
		* Three callers produce these records; if each applied its own reading of
		* "verified" the word would mean three things. The rules live in one function
		* so that a record from the CLI, the MCP server, and the fix pipeline all mean
		* the same thing.
		*/
		export function evaluateFixVerdict(input) {
		const reasons = [];
		if (input.remainingTargets.length) {
		reasons.push(`${input.remainingTargets.length} original finding target(s) still present after the re-scan`);
		}
		if (!input.checks.length) {
		// Matches the rule the verifier already applies: a project whose checks
		// cannot be run has not demonstrated anything, so it does not pass by default.
		reasons.push('no project check could be run, so the repair is unverifiable');
		}
		const failed = input.checks.filter(check => !check.passed);
		if (failed.length) {
		reasons.push(`${failed.length} observed check(s) failed: ${failed.map(check => check.kind).join(', ')}`);
		}
		// A caveat, not a failure. Partial coverage does not make a passing check
		// false — it bounds what the record is entitled to claim, and saying so is
		// the difference between evidence and a badge.
		const caveats = [];
		if (input.afterCoverage.status !== 'complete') {
		caveats.push(`the verifying scan's coverage is ${input.afterCoverage.status}, so this record covers only what was scanned`);
		}
		if (input.beforeCoverage.status !== 'complete') {
		caveats.push(`the original scan's coverage was ${input.beforeCoverage.status}`);
		}
		return { verified: reasons.length === 0, reasons: [...reasons, ...caveats] };
		}
		export function buildFixRecord(input) {
		const verdict = evaluateFixVerdict({
		checks: input.checks,
		remainingTargets: input.after.remainingTargets,
		beforeCoverage: input.before.coverage,
		afterCoverage: input.after.coverage,
		});
		const record = {
		schema: FIX_RECORD_SCHEMA,
		generatedAt: input.generatedAt ?? new Date().toISOString(),
		tool: { name: 'dvalincode', version: input.version ?? VERSION },
		...(input.workflowId ? { workflowId: input.workflowId } : {}),
		projectId: input.projectId,
		executor: input.executor ?? 'unknown',
		before: input.before,
		after: input.after,
		...(input.changes ? { changes: input.changes } : {}),
		checks: input.checks,
		assurance: input.checks.length ? 'scan-and-checks' : 'scan-only',
		verdict,
		...(input.audit ? { audit: input.audit } : {}),
		...(input.policyHash ? { policyHash: input.policyHash } : {}),
		};
		return { ...record, recordHash: fixRecordHash(record) };
		}
		/** Hash of everything except the hash itself, over canonical JSON so key order cannot change it. */
		export function fixRecordHash(record) {
		const { recordHash: _ignored, ...rest } = record;
		return sha256(canonicalJSON(rest));
		}
		/**
		* Re-derive a record offline.
		*
		* Needs no workspace, no network, and no Dvalin state — that is the property
		* that lets a reviewer who trusts none of the above check the record anyway.
		* It answers "is this record internally sound and unmodified", not "is the
		* repair still good"; re-running the scanners is a separate, explicit step.
		*/
		export function verifyFixRecord(value) {
		if (!isFixRecordShape(value)) {
		return { ok: false, reasons: ['Not a Dvalin fix record, or written by an unsupported schema version.'] };
		}
		const record = value;
		const reasons = [];
		const expected = fixRecordHash(record);
		if (expected !== record.recordHash) {
		reasons.push(`recordHash mismatch: the record has been modified since it was issued (expected ${expected}, found ${record.recordHash})`);
		}
		// The verdict is derived, so a record whose stored verdict disagrees with its
		// own evidence has been edited in a way the hash alone would catch only if
		// the hash were left stale. Recomputing it closes that door.
		const derived = evaluateFixVerdict({
		checks: record.checks,
		remainingTargets: record.after.remainingTargets,
		beforeCoverage: record.before.coverage,
		afterCoverage: record.after.coverage,
		});
		if (derived.verified !== record.verdict.verified) {
		reasons.push(`verdict does not follow from the record's own evidence: stored ${record.verdict.verified}, derived ${derived.verified}`);
		}
		const expectedAssurance = record.checks.length ? 'scan-and-checks' : 'scan-only';
		if (record.assurance !== expectedAssurance) {
		reasons.push(`assurance says ${record.assurance} but the record carries ${record.checks.length} check(s)`);
		}
		return { ok: reasons.length === 0, reasons, record };
		}
		/** One-line summary for a terminal or a pull-request comment. */
		export function renderFixRecord(record) {
		const lines = [
		`Fix record ${record.recordHash.slice(0, 12)} · ${record.verdict.verified ? 'VERIFIED' : 'NOT VERIFIED'} · ${record.assurance}`,
		` executor: ${record.executor} (recorded, not consulted)`,
		` targets: ${record.before.targets.length} before · ${record.after.remainingTargets.length} remaining`,
		` coverage: ${record.before.coverage.status} → ${record.after.coverage.status}`,
		];
		for (const check of record.checks) {
		lines.push(` ${check.passed ? '✓' : '✗'} ${check.kind}: ${check.command}${check.exitCode === null ? '' : ` (exit ${check.exitCode})`}`);
		}
		for (const reason of record.verdict.reasons)
		lines.push(` · ${reason}`);
		if (record.audit)
		lines.push(` audit: run ${record.audit.runId} @ ${record.audit.headHash.slice(0, 12)}`);
		return lines.join('\n');
		}
		function isFixRecordShape(value) {
		if (!value \|\| typeof value !== 'object' \|\| Array.isArray(value))
		return false;
		const record = value;
		return record.schema === FIX_RECORD_SCHEMA
		&& typeof record.generatedAt === 'string'
		&& typeof record.projectId === 'string'
		&& typeof record.recordHash === 'string'
		&& (record.assurance === 'scan-only' \|\| record.assurance === 'scan-and-checks')
		&& FIX_EXECUTORS.includes(record.executor)
		&& Array.isArray(record.checks)
		&& isVerdict(record.verdict)
		&& isScanSide(record.before, 'targets')
		&& isScanSide(record.after, 'remainingTargets');
		}
		function isVerdict(value) {
		if (!value \|\| typeof value !== 'object')
		return false;
		const verdict = value;
		return typeof verdict.verified === 'boolean' && Array.isArray(verdict.reasons);
		}
		function isScanSide(value, findingsKey) {
		if (!value \|\| typeof value !== 'object')
		return false;
		const side = value;
		const coverage = side.coverage;
		return typeof side.scanId === 'string'
		&& typeof side.completedAt === 'string'
		&& !!coverage
		&& SECURITY_COVERAGE_STATUSES.includes(coverage.status)
		&& Array.isArray(side[findingsKey]);
		}
		//# sourceMappingURL=fixRecord.js.map

+1

dist/security/fixRecord.js.map

+8

dist/security/fixRecordFile.d.ts

		import { type FixRecordVerification } from './fixRecord.js';
		export type FixRecordFileVerification = FixRecordVerification & {
		path: string;
		};
		/** Load and re-derive a fix record without consulting a workspace or network. */
		export declare function verifyFixRecordFile(recordPath: string, cwd?: string): Promise<FixRecordFileVerification>;
		/** Human-readable verification output shared by the CLI and interactive TUI. */
		export declare function renderFixRecordVerification(check: FixRecordVerification): string;

+37

dist/security/fixRecordFile.js

		import { readFile } from 'node:fs/promises';
		import path from 'node:path';
		import { UsageError } from '../core/exitCodes.js';
		import { renderFixRecord, verifyFixRecord, } from './fixRecord.js';
		/** Load and re-derive a fix record without consulting a workspace or network. */
		export async function verifyFixRecordFile(recordPath, cwd = process.cwd()) {
		const target = path.resolve(cwd, recordPath);
		let parsed;
		try {
		parsed = JSON.parse(await readFile(target, 'utf8'));
		}
		catch (error) {
		throw new UsageError(`Cannot read fix record ${target}: ${error instanceof Error ? error.message : String(error)}`);
		}
		return { path: target, ...verifyFixRecord(parsed) };
		}
		/** Human-readable verification output shared by the CLI and interactive TUI. */
		export function renderFixRecordVerification(check) {
		if (!check.record)
		throw new UsageError('Not a Dvalin fix record.');
		if (check.ok) {
		const meaning = check.record.verdict.verified
		? 'It attests that these findings were gone and these checks were observed to pass. It is not a claim that the code is free of vulnerabilities.'
		: 'Its NOT VERIFIED verdict and caveats are intact; this record does not attest that the repair passed verification.';
		return [
		renderFixRecord(check.record),
		'',
		'Re-derived successfully: this record is unmodified and its verdict follows from its own evidence.',
		meaning,
		].join('\n');
		}
		return [
		'This fix record did not re-derive:',
		...check.reasons.map(reason => ` · ${reason}`),
		].join('\n');
		}
		//# sourceMappingURL=fixRecordFile.js.map

+1

dist/security/fixRecordFile.js.map

{"version":3,"file":"fixRecordFile.js","sourceRoot":"","sources":["../../src/security/fixRecordFile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,eAAe,EACf,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AAIxB,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAY,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,0BAA0B,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,2BAA2B,CAAC,KAA4B;IACtE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;YAC3C,CAAC,CAAC,8IAA8I;YAChJ,CAAC,CAAC,mHAAmH,CAAC;QACxH,OAAO;YACL,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7B,EAAE;YACF,mGAAmG;YACnG,OAAO;SACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO;QACL,oCAAoC;QACpC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,EAAE,CAAC;KAChD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

+23

dist/security/fixRecordStore.d.ts

		import { type VerifiedFixRecord } from './fixRecord.js';
		/**
		* Where issued fix records accumulate.
		*
		* Kept beside the audit log rather than inside a workflow, because a record
		* outlives the workflow that produced it and is the thing a reviewer wants to
		* collect. Writes never throw into a verification: failing to file a record is
		* not a reason to fail the repair it describes.
		*/
		export declare function defaultFixRecordDir(): string;
		/** Persist a record under its own hash, so filing the same one twice is a no-op. */
		export declare function saveFixRecord(record: VerifiedFixRecord, dir?: string): string \| null;
		/**
		* Records that still re-derive, newest first, optionally narrowed to one project.
		*
		* A record that no longer verifies is skipped rather than surfaced: an Evidence
		* Pack that carried one would be asserting something it cannot support, and the
		* pack's own verification would reject it anyway.
		*/
		export declare function listFixRecords(dir?: string, options?: {
		limit?: number;
		projectId?: string;
		}): VerifiedFixRecord[];

+74

dist/security/fixRecordStore.js

		import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
		import os from 'node:os';
		import path from 'node:path';
		import { randomUUID } from 'node:crypto';
		import { verifyFixRecord } from './fixRecord.js';
		/**
		* Where issued fix records accumulate.
		*
		* Kept beside the audit log rather than inside a workflow, because a record
		* outlives the workflow that produced it and is the thing a reviewer wants to
		* collect. Writes never throw into a verification: failing to file a record is
		* not a reason to fail the repair it describes.
		*/
		export function defaultFixRecordDir() {
		return process.env.DVALINCODE_FIX_RECORD_DIR
		?? path.join(os.homedir(), '.dvalincode', 'security', 'fix-records');
		}
		/** Persist a record under its own hash, so filing the same one twice is a no-op. */
		export function saveFixRecord(record, dir = defaultFixRecordDir()) {
		const target = path.join(dir, `${record.recordHash}.json`);
		try {
		mkdirSync(dir, { recursive: true });
		if (existsSync(target))
		return target;
		const temporary = `${target}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
		writeFileSync(temporary, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
		renameSync(temporary, target);
		return target;
		}
		catch {
		return null;
		}
		}
		/**
		* Records that still re-derive, newest first, optionally narrowed to one project.
		*
		* A record that no longer verifies is skipped rather than surfaced: an Evidence
		* Pack that carried one would be asserting something it cannot support, and the
		* pack's own verification would reject it anyway.
		*/
		export function listFixRecords(dir = defaultFixRecordDir(), options = {}) {
		const limit = options.limit ?? 50;
		if (!existsSync(dir))
		return [];
		let names;
		try {
		names = readdirSync(dir).filter(name => name.endsWith('.json'));
		}
		catch {
		return [];
		}
		const records = [];
		for (const name of names) {
		try {
		const parsed = JSON.parse(readFileSync(path.join(dir, name), 'utf8'));
		const check = verifyFixRecord(parsed);
		if (!check.ok \|\| !check.record)
		continue;
		// The store is install-global; a record from another repository is
		// someone else's file paths and rule ids, and does not belong in this
		// project's evidence.
		if (options.projectId && check.record.projectId !== options.projectId)
		continue;
		records.push(check.record);
		}
		catch {
		// An unreadable file is not evidence; leave it out rather than guess.
		}
		}
		return records
		.sort((a, b) => b.generatedAt.localeCompare(a.generatedAt))
		.slice(0, limit);
		}
		//# sourceMappingURL=fixRecordStore.js.map

+1

dist/security/fixRecordStore.js.map

{"version":3,"file":"fixRecordStore.js","sourceRoot":"","sources":["../../src/security/fixRecordStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAA0B,MAAM,gBAAgB,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB;WACvC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACzE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,MAAyB,EAAE,GAAG,GAAW,mBAAmB,EAAE;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAI,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7E,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAG,GAAW,mBAAmB,EAAE,EACnC,OAAO,GAA2C,EAAE;IAEpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;YACjF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YACzC,mEAAmE;YACnE,sEAAsE;YACtE,sBAAsB;YACtB,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,SAAS;YAChF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,OAAO;SACX,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrB,CAAC"}

+8

dist/security/render.d.ts

		import type { SecurityCoverage, SecurityGateResult } from './contracts.js';
		/**
		* State the coverage next to the verdict, always. A gate result read without it
		* says more than the scan knows.
		*/
		export declare function renderCoverage(coverage: SecurityCoverage): string;
		/** `none` is an advisory policy, not a security pass. */
		export declare function renderSecurityGate(gate: SecurityGateResult): string;

+20

dist/security/render.js

		/**
		* State the coverage next to the verdict, always. A gate result read without it
		* says more than the scan knows.
		*/
		export function renderCoverage(coverage) {
		const lines = [`Coverage: ${coverage.status}`];
		for (const entry of coverage.deferred)
		lines.push(` · deferred: ${entry}`);
		for (const entry of coverage.exclusions)
		lines.push(` · excluded: ${entry}`);
		for (const note of coverage.notes)
		lines.push(` · ${note}`);
		return lines.join('\n');
		}
		/** `none` is an advisory policy, not a security pass. */
		export function renderSecurityGate(gate) {
		const status = gate.threshold === 'none' ? 'ADVISORY' : gate.passed ? 'PASS' : 'FAIL';
		return `Gate: ${status} · ${gate.mode} findings · threshold ${gate.threshold}`;
		}
		//# sourceMappingURL=render.js.map

+1

dist/security/render.js.map

{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/security/render.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAA0B;IACvD,MAAM,KAAK,GAAG,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACtF,OAAO,SAAS,MAAM,MAAM,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,SAAS,EAAE,CAAC;AACjF,CAAC"}

+12

dist/security/suppressions.d.ts

		import type { RemediationFinding } from '../remediation/sarif.js';
		import type { DvalinScanSuiteResult } from '../remediation/scannerSuite.js';
		import type { SecuritySuppression } from './config.js';
		export type SuppressionResult = {
		result: DvalinScanSuiteResult;
		suppressed: Array<{
		finding: RemediationFinding;
		suppression: SecuritySuppression;
		}>;
		expired: SecuritySuppression[];
		};
		export declare function applySecuritySuppressions(result: DvalinScanSuiteResult, suppressions: SecuritySuppression[], now?: Date): SuppressionResult;

+60

dist/security/suppressions.js

		import { findingFingerprint } from './contracts.js';
		export function applySecuritySuppressions(result, suppressions, now = new Date()) {
		const expired = suppressions.filter(suppression => suppression.expiresAt && Date.parse(suppression.expiresAt) <= now.getTime());
		const active = suppressions.filter(suppression => !expired.includes(suppression));
		const suppressed = [];
		const findings = result.findings.filter(finding => {
		const fingerprint = findingFingerprint(finding);
		const match = active.find(suppression => (suppression.fingerprint === fingerprint \|\| (!suppression.fingerprint && suppression.ruleId === finding.ruleId))
		&& (!suppression.path \|\| normalizePath(suppression.path) === normalizePath(finding.path)));
		if (!match)
		return true;
		suppressed.push({ finding, suppression: match });
		return false;
		});
		return {
		result: { ...result, findings, metrics: metricsFor(findings), score: scoreFor(findings), grade: gradeFor(scoreFor(findings)) },
		suppressed,
		expired,
		};
		}
		function metricsFor(findings) {
		const metrics = { critical: 0, high: 0, medium: 0, low: 0, files: 0, rules: 0 };
		const files = new Set();
		const rules = new Set();
		for (const finding of findings) {
		const score = Number.parseFloat(finding.securitySeverity ?? '');
		if (score >= 9)
		metrics.critical++;
		else if (finding.severity === 'error' \|\| score >= 7)
		metrics.high++;
		else if (finding.severity === 'warning' \|\| score >= 4)
		metrics.medium++;
		else
		metrics.low++;
		files.add(finding.path);
		rules.add(`${finding.source}:${finding.ruleId}`);
		}
		metrics.files = files.size;
		metrics.rules = rules.size;
		return metrics;
		}
		function scoreFor(findings) {
		const metrics = metricsFor(findings);
		return Math.max(0, 100 - metrics.critical * 22 - metrics.high * 12 - metrics.medium * 5 - metrics.low);
		}
		function gradeFor(score) {
		if (score >= 90)
		return 'A';
		if (score >= 80)
		return 'B';
		if (score >= 70)
		return 'C';
		if (score >= 60)
		return 'D';
		return 'F';
		}
		function normalizePath(filePath) {
		return filePath.replace(/\\/g, '/').replace(/^\.\//, '');
		}
		//# sourceMappingURL=suppressions.js.map

+1

dist/security/suppressions.js.map

{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../src/security/suppressions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAQpD,MAAM,UAAU,yBAAyB,CACvC,MAA6B,EAC7B,YAAmC,EACnC,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAChI,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAChD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CACtC,CAAC,WAAW,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;eAC7G,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAC1F,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE;QAC9H,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAA8B;IAChD,MAAM,OAAO,GAAqC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAClH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,CAAC;aAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC;;YACnE,OAAO,CAAC,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,QAA8B;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC"}

+21

dist/security/verifyRun.d.ts

		import { runDvalinScanSuite } from '../remediation/scannerSuite.js';
		import type { DvalinSecurityConfig } from './config.js';
		import type { FixExecutor } from './fixRecord.js';
		import { type SecurityWorkflow } from './workflow.js';
		/**
		* The one verification path.
		*
		* Every surface that verifies a repair — this command, the `--fix --verify`
		* pipeline, and the MCP server — comes through here, so "verified" means the
		* same thing regardless of who asked. Dvalin re-scans, Dvalin runs the checks,
		* and the record is issued from what Dvalin observed.
		*/
		export declare function runWorkflowVerification(input: {
		workflow: SecurityWorkflow;
		checks: DvalinSecurityConfig['checks'];
		timeoutMs?: number;
		executor?: FixExecutor;
		verifyCommands?: string[];
		/** Dependency seam used by MCP hosts and deterministic contract tests. */
		runScan?: (cwd: string, options: NonNullable<Parameters<typeof runDvalinScanSuite>[1]>) => ReturnType<typeof runDvalinScanSuite>;
		}): Promise<SecurityWorkflow>;

+74

dist/security/verifyRun.js

		import { randomUUID } from 'node:crypto';
		import { AuditSink } from '../audit/log.js';
		import { loadPolicy } from '../core/policy.js';
		import { runProjectVerification } from '../remediation/verify.js';
		import { runDvalinScanSuite } from '../remediation/scannerSuite.js';
		import { deriveCoverage } from './contracts.js';
		import { saveFixRecord } from './fixRecordStore.js';
		import { evaluateWorkflowVerificationGate, verifySecurityWorkflow, } from './workflow.js';
		/**
		* The one verification path.
		*
		* Every surface that verifies a repair — this command, the `--fix --verify`
		* pipeline, and the MCP server — comes through here, so "verified" means the
		* same thing regardless of who asked. Dvalin re-scans, Dvalin runs the checks,
		* and the record is issued from what Dvalin observed.
		*/
		export async function runWorkflowVerification(input) {
		const { workflow } = input;
		// The checks are governed commands; opening a run puts them in the
		// hash-chained log so the record has something to anchor to.
		const audit = new AuditSink(`verify-${randomUUID().slice(0, 8)}`);
		const loadedPolicy = loadPolicy(workflow.root);
		audit.append({
		type: 'run_start',
		task: `security verify ${workflow.id}`,
		mode: 'security-verify',
		provider: 'none',
		model: 'none',
		cwd: workflow.root,
		gitHead: null,
		policyHash: loadedPolicy.hash,
		});
		let result;
		let verification;
		let status = 'done';
		try {
		result = await (input.runScan ?? runDvalinScanSuite)(workflow.root, {
		scanners: workflow.scanners,
		timeoutMs: input.timeoutMs,
		});
		verification = await runProjectVerification({
		cwd: workflow.root,
		kinds: input.checks,
		commands: input.verifyCommands?.length ? input.verifyCommands : undefined,
		timeoutMs: input.timeoutMs,
		audit,
		});
		}
		catch (error) {
		// Recorded as what it was. A run that threw must not be written into the
		// chain as a clean completion — that is the one thing the log exists to
		// make impossible.
		status = 'error';
		throw error;
		}
		finally {
		audit.append({ type: 'run_end', status, iterations: 1, warnings: audit.getWarnings() });
		}
		const gate = evaluateWorkflowVerificationGate(workflow, result);
		const updated = await verifySecurityWorkflow({
		workflow,
		result,
		gate,
		checks: verification.evidence,
		coverage: deriveCoverage(result),
		executor: input.executor,
		audit: { runId: audit.runId, headHash: audit.head() },
		policyHash: loadedPolicy.hash,
		});
		if (updated.verification?.record)
		saveFixRecord(updated.verification.record);
		return updated;
		}
		//# sourceMappingURL=verifyRun.js.map

+1

dist/security/verifyRun.js.map

{"version":3,"file":"verifyRun.js","sourceRoot":"","sources":["../../src/security/verifyRun.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAA8B,MAAM,gCAAgC,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EACL,gCAAgC,EAChC,sBAAsB,GAEvB,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAW7C;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,mEAAmE;IACnE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,UAAU,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,KAAK,CAAC,MAAM,CAAC;QACX,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,mBAAmB,QAAQ,CAAC,EAAE,EAAE;QACtC,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,QAAQ,CAAC,IAAI;QAClB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,YAAY,CAAC,IAAI;KAC9B,CAAC,CAAC;IAEH,IAAI,MAA6B,CAAC;IAClC,IAAI,YAAgE,CAAC;IACrE,IAAI,MAAM,GAAqB,MAAM,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;YAClE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,YAAY,GAAG,MAAM,sBAAsB,CAAC;YAC1C,GAAG,EAAE,QAAQ,CAAC,IAAI;YAClB,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YACzE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,wEAAwE;QACxE,mBAAmB;QACnB,MAAM,GAAG,OAAO,CAAC;QACjB,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,IAAI,GAAG,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;QAC3C,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,MAAM,EAAE,YAAY,CAAC,QAAQ;QAC7B,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE;QACrD,UAAU,EAAE,YAAY,CAAC,IAAI;KAC9B,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY,EAAE,MAAM;QAAE,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC;AACjB,CAAC"}

+98

dist/security/workflow.d.ts

		import { type DvalinScannerId, type DvalinScanMetrics, type DvalinScanSuiteResult } from '../remediation/scannerSuite.js';
		import { type FixExecutor, type VerifiedFixRecord } from './fixRecord.js';
		import { SECURITY_SCHEMA_VERSION, type SecurityCoverage, type SecurityFindingDelta, type SecurityFindingSnapshot, type SecurityGateResult } from './contracts.js';
		export type SecurityWorkflowState = 'created' \| 'scanning' \| 'ready' \| 'external_handoff' \| 'internal_fix' \| 'verifying' \| 'passed' \| 'needs_work' \| 'blocked' \| 'evidence_ready' \| 'publication_pending' \| 'published';
		export type SecurityCheckEvidence = {
		kind: string;
		command: string;
		exitCode: number \| null;
		passed: boolean;
		};
		export type SecurityWorkflowScan = {
		id: string;
		completedAt: string;
		score: number;
		grade: DvalinScanSuiteResult['grade'];
		metrics: DvalinScanMetrics;
		findings: SecurityFindingSnapshot[];
		};
		export type SecurityWorkflow = {
		schemaVersion: typeof SECURITY_SCHEMA_VERSION;
		kind: 'dvalin-security-workflow';
		id: string;
		projectId: string;
		root: string;
		state: SecurityWorkflowState;
		scanners: DvalinScannerId[];
		createdAt: string;
		updatedAt: string;
		initialScan: SecurityWorkflowScan;
		latestScan: SecurityWorkflowScan;
		/**
		* What the latest scan covered. Absent on workflows persisted before coverage
		* was recorded; readers should treat that as `unknown`, not as complete.
		*/
		coverage?: SecurityCoverage;
		delta?: SecurityFindingDelta;
		/** The most recent gate result. Overwritten on every verification round. */
		gate: SecurityGateResult;
		/**
		* The gate as it stood when the workflow was created — the findings the
		* repair is actually meant to eliminate. Kept separately because `gate` is
		* overwritten, and a second verification round comparing against the first
		* round's result would quietly move the goalposts. Absent on workflows
		* persisted before this field existed; readers fall back to `gate`.
		*/
		initialGate?: SecurityGateResult;
		verification?: {
		assurance: 'scan-only' \| 'scan-and-checks';
		checks: SecurityCheckEvidence[];
		verifiedAt: string;
		/** The portable, offline re-verifiable record of this verification. */
		record?: VerifiedFixRecord;
		};
		history: Array<{
		state: SecurityWorkflowState;
		at: string;
		note?: string;
		}>;
		};
		export declare function createSecurityWorkflow(input: {
		root: string;
		result: DvalinScanSuiteResult;
		gate: SecurityGateResult;
		delta?: SecurityFindingDelta;
		coverage?: SecurityCoverage;
		}): Promise<SecurityWorkflow>;
		export declare function loadSecurityWorkflow(id: string): Promise<SecurityWorkflow>;
		export declare function transitionSecurityWorkflow(workflow: SecurityWorkflow, next: SecurityWorkflowState, note?: string): Promise<SecurityWorkflow>;
		export declare function verifySecurityWorkflow(input: {
		workflow: SecurityWorkflow;
		result: DvalinScanSuiteResult;
		gate: SecurityGateResult;
		checks?: SecurityCheckEvidence[];
		/** Coverage of the verifying scan. Omitted means the record says `unknown`. */
		coverage?: SecurityCoverage;
		/** Who edited the code. Recorded on the fix record, never consulted. */
		executor?: FixExecutor;
		changes?: {
		files: string[];
		diffHash: string;
		};
		audit?: {
		runId: string;
		headHash: string;
		};
		policyHash?: string;
		}): Promise<SecurityWorkflow>;
		/**
		* Coverage for a workflow, including one persisted before coverage was
		* recorded. Read it through here rather than off the field, so a legacy record
		* reports `unknown` instead of looking like it covered nothing.
		*/
		export declare function workflowCoverage(workflow: SecurityWorkflow): SecurityCoverage;
		export declare function getWorkflowFinding(workflow: SecurityWorkflow, fingerprint: string): SecurityFindingSnapshot \| undefined;
		/** The findings this workflow set out to eliminate, stable across verification rounds. */
		export declare function originalGate(workflow: SecurityWorkflow): SecurityGateResult;
		/** Re-check the original blocked targets and reject newly introduced severe findings. */
		export declare function evaluateWorkflowVerificationGate(workflow: SecurityWorkflow, result: DvalinScanSuiteResult): SecurityGateResult;

+263

dist/security/workflow.js

		import { randomUUID } from 'node:crypto';
		import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
		import path from 'node:path';
		import { dvalinHome } from '../memory/store.js';
		import { DVALIN_SCANNER_IDS, } from '../remediation/scannerSuite.js';
		import { UsageError } from '../core/exitCodes.js';
		import { buildFixRecord } from './fixRecord.js';
		import { SECURITY_SCHEMA_VERSION, SECURITY_SEVERITIES, isSupportedSecuritySchemaVersion, securityProjectId, severityOfFinding, snapshotFinding, unknownCoverage, } from './contracts.js';
		const SECURITY_WORKFLOW_STATES = [
		'created', 'scanning', 'ready', 'external_handoff', 'internal_fix', 'verifying',
		'passed', 'needs_work', 'blocked', 'evidence_ready', 'publication_pending', 'published',
		];
		const TRANSITIONS = {
		created: ['scanning', 'blocked'],
		scanning: ['ready', 'passed', 'needs_work', 'blocked'],
		ready: ['external_handoff', 'internal_fix', 'verifying', 'needs_work', 'blocked'],
		external_handoff: ['verifying', 'blocked'],
		internal_fix: ['verifying', 'blocked'],
		verifying: ['passed', 'needs_work', 'blocked'],
		passed: ['evidence_ready', 'publication_pending', 'published', 'verifying'],
		needs_work: ['external_handoff', 'internal_fix', 'verifying', 'blocked'],
		blocked: ['scanning', 'verifying'],
		evidence_ready: ['publication_pending', 'published', 'verifying'],
		publication_pending: ['published', 'blocked'],
		published: ['verifying'],
		};
		export async function createSecurityWorkflow(input) {
		const now = new Date().toISOString();
		const root = path.resolve(input.root);
		const initialScan = workflowScan(input.result);
		const state = input.gate.passed ? 'passed' : 'needs_work';
		const workflow = {
		schemaVersion: SECURITY_SCHEMA_VERSION,
		kind: 'dvalin-security-workflow',
		id: `security-${now.replace(/[:.]/g, '-')}-${randomUUID().slice(0, 8)}`,
		projectId: securityProjectId(root),
		root,
		state,
		scanners: input.result.scanners.map(scanner => scanner.id),
		createdAt: now,
		updatedAt: now,
		initialScan,
		latestScan: initialScan,
		coverage: input.coverage,
		delta: input.delta,
		gate: input.gate,
		initialGate: input.gate,
		history: [
		{ state: 'created', at: now },
		{ state: 'scanning', at: now },
		{ state, at: now, note: input.gate.passed ? 'Security gate passed.' : 'Security gate needs remediation.' },
		],
		};
		await persistSecurityWorkflow(workflow);
		return workflow;
		}
		export async function loadSecurityWorkflow(id) {
		assertWorkflowId(id);
		let value;
		try {
		value = JSON.parse(await readFile(workflowPath(id), 'utf8'));
		}
		catch (error) {
		throw new UsageError(`Cannot read security workflow ${id}: ${error instanceof Error ? error.message : String(error)}`);
		}
		if (!isSecurityWorkflow(value) \|\| value.id !== id)
		throw new UsageError(`Invalid or unsupported security workflow: ${id}`);
		return value;
		}
		export async function transitionSecurityWorkflow(workflow, next, note) {
		if (workflow.state !== next && !TRANSITIONS[workflow.state].includes(next)) {
		throw new UsageError(`Invalid security workflow transition: ${workflow.state} -> ${next}`);
		}
		const at = new Date().toISOString();
		const updated = {
		...workflow,
		state: next,
		updatedAt: at,
		history: [...workflow.history, { state: next, at, ...(note ? { note } : {}) }],
		};
		await persistSecurityWorkflow(updated);
		return updated;
		}
		export async function verifySecurityWorkflow(input) {
		let workflow = input.workflow;
		if (workflow.state !== 'verifying')
		workflow = await transitionSecurityWorkflow(workflow, 'verifying');
		const checks = input.checks ?? [];
		const at = new Date().toISOString();
		const record = buildFixRecord({
		workflowId: workflow.id,
		projectId: workflow.projectId,
		executor: input.executor,
		before: {
		scanId: workflow.initialScan.id,
		completedAt: workflow.initialScan.completedAt,
		coverage: workflowCoverage(workflow),
		targets: originalGate(workflow).blocking,
		},
		after: {
		scanId: input.result.id,
		completedAt: input.result.completedAt,
		coverage: input.coverage
		?? unknownCoverage('The verifying scan did not record its coverage.'),
		remainingTargets: input.gate.blocking,
		},
		...(input.changes ? { changes: input.changes } : {}),
		checks,
		...(input.audit ? { audit: input.audit } : {}),
		...(input.policyHash ? { policyHash: input.policyHash } : {}),
		generatedAt: at,
		});
		// The record decides. Deriving the workflow state from anything else would
		// give "verified" two definitions — and the earlier one passed a project with
		// no runnable check, because every() over an empty list is vacuously true.
		const passed = record.verdict.verified;
		const next = passed ? 'passed' : 'needs_work';
		const updated = {
		...workflow,
		state: next,
		updatedAt: at,
		latestScan: workflowScan(input.result),
		gate: input.gate,
		coverage: input.coverage ?? workflow.coverage,
		verification: {
		assurance: record.assurance,
		checks,
		verifiedAt: at,
		record,
		},
		history: [
		...workflow.history,
		{ state: next, at, note: passed ? 'Deterministic verification passed.' : 'Deterministic verification failed.' },
		],
		};
		await persistSecurityWorkflow(updated);
		return updated;
		}
		/**
		* Coverage for a workflow, including one persisted before coverage was
		* recorded. Read it through here rather than off the field, so a legacy record
		* reports `unknown` instead of looking like it covered nothing.
		*/
		export function workflowCoverage(workflow) {
		return workflow.coverage
		?? unknownCoverage('This workflow was recorded before scan coverage was tracked.');
		}
		export function getWorkflowFinding(workflow, fingerprint) {
		return workflow.latestScan.findings.find(finding => finding.fingerprint === fingerprint)
		?? workflow.initialScan.findings.find(finding => finding.fingerprint === fingerprint);
		}
		/** The findings this workflow set out to eliminate, stable across verification rounds. */
		export function originalGate(workflow) {
		return workflow.initialGate ?? workflow.gate;
		}
		/** Re-check the original blocked targets and reject newly introduced severe findings. */
		export function evaluateWorkflowVerificationGate(workflow, result) {
		const original = originalGate(workflow);
		if (original.threshold === 'none') {
		return { passed: true, mode: original.mode, threshold: 'none', considered: result.findings.length, blocking: [] };
		}
		const current = result.findings.map(snapshotFinding);
		const originalTargets = new Set(originalGate(workflow).blocking.map(finding => finding.targetFingerprint));
		const initialFingerprints = new Set(workflow.initialScan.findings.map(finding => finding.fingerprint));
		const thresholdIndex = SECURITY_SEVERITIES.indexOf(original.threshold);
		const blocking = current.filter(finding => {
		if (originalTargets.has(finding.targetFingerprint))
		return true;
		return !initialFingerprints.has(finding.fingerprint)
		&& SECURITY_SEVERITIES.indexOf(severityOfFinding(finding)) <= thresholdIndex;
		});
		return {
		passed: blocking.length === 0,
		mode: original.mode,
		threshold: original.threshold,
		considered: current.length,
		blocking,
		};
		}
		function workflowScan(result) {
		return {
		id: result.id,
		completedAt: result.completedAt,
		score: result.score,
		grade: result.grade,
		metrics: { ...result.metrics },
		findings: result.findings.map(snapshotFinding),
		};
		}
		async function persistSecurityWorkflow(workflow) {
		const directory = workflowDirectory();
		await mkdir(directory, { recursive: true });
		const target = workflowPath(workflow.id);
		const temporary = `${target}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
		await writeFile(temporary, `${JSON.stringify(workflow, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
		await rename(temporary, target);
		}
		function workflowDirectory() {
		return path.join(dvalinHome(), 'security', 'workflows');
		}
		function workflowPath(id) {
		assertWorkflowId(id);
		return path.join(workflowDirectory(), `${id}.json`);
		}
		function assertWorkflowId(id) {
		if (!/^security-[A-Za-z0-9-]+$/.test(id))
		throw new UsageError(`Invalid security workflow id: ${id}`);
		}
		function isSecurityWorkflow(value) {
		if (!value \|\| typeof value !== 'object' \|\| Array.isArray(value))
		return false;
		const record = value;
		return isSupportedSecuritySchemaVersion(record.schemaVersion)
		&& record.kind === 'dvalin-security-workflow'
		&& typeof record.id === 'string'
		&& typeof record.projectId === 'string'
		&& typeof record.root === 'string'
		&& SECURITY_WORKFLOW_STATES.includes(record.state)
		&& Array.isArray(record.scanners)
		&& record.scanners.length > 0
		&& record.scanners.every(scanner => DVALIN_SCANNER_IDS.includes(scanner))
		&& Array.isArray(record.history)
		&& record.history.every(entry => {
		if (!entry \|\| typeof entry !== 'object' \|\| Array.isArray(entry))
		return false;
		const history = entry;
		return SECURITY_WORKFLOW_STATES.includes(history.state) && typeof history.at === 'string';
		})
		&& isWorkflowScan(record.initialScan)
		&& isWorkflowScan(record.latestScan)
		&& isWorkflowGate(record.gate);
		}
		function isWorkflowScan(value) {
		if (!value \|\| typeof value !== 'object' \|\| Array.isArray(value))
		return false;
		const scan = value;
		return typeof scan.id === 'string'
		&& typeof scan.completedAt === 'string'
		&& typeof scan.score === 'number'
		&& ['A', 'B', 'C', 'D', 'F'].includes(String(scan.grade))
		&& !!scan.metrics
		&& Array.isArray(scan.findings)
		&& scan.findings.every(finding => {
		if (!finding \|\| typeof finding !== 'object' \|\| Array.isArray(finding))
		return false;
		const snapshot = finding;
		return typeof snapshot.fingerprint === 'string'
		&& typeof snapshot.targetFingerprint === 'string'
		&& typeof snapshot.ruleId === 'string'
		&& typeof snapshot.path === 'string';
		});
		}
		function isWorkflowGate(value) {
		if (!value \|\| typeof value !== 'object' \|\| Array.isArray(value))
		return false;
		const gate = value;
		return typeof gate.passed === 'boolean'
		&& (gate.mode === 'all' \|\| gate.mode === 'new')
		&& ['critical', 'high', 'medium', 'low', 'none'].includes(String(gate.threshold))
		&& typeof gate.considered === 'number'
		&& Array.isArray(gate.blocking);
		}
		//# sourceMappingURL=workflow.js.map

+1

dist/security/workflow.js.map

+4

-0

dist/cli.js

		@@ -23,2 +23,4 @@ import { Command, CommanderError } from 'commander';
		import { registerMcpServeCommand } from './commands/mcpServe.js';
		import { registerMcpInstallCommand } from './commands/mcpInstall.js';
		import { registerSecurityCommand } from './commands/security.js';
		import { createDefaultToolRegistry } from './tools/registry.js';
		@@ -34,2 +36,3 @@ export function buildProgram() {
		registerDvalinCommand(program);
		registerSecurityCommand(program);
		registerToolsCommand(program, registry);
		@@ -52,2 +55,3 @@ registerRunToolCommand(program, registry);
		registerMcpServeCommand(program);
		registerMcpInstallCommand(program);
		// Bare invocation: launch the terminal agent in an interactive TTY,
		@@ -54,0 +58,0 @@ // otherwise fall back to help (e.g. piped or non-interactive contexts).

+1

-1

dist/cli.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAE7C,OAAO;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,WAAW,CAAC,4EAA4E,CAAC;SACzF,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEjC,oEAAoE;IACpE,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACxB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAChD,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,uEAAuE;YACvE,sEAAsE;YACtE,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ;QAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}
		{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAE7C,OAAO;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,WAAW,CAAC,4EAA4E,CAAC;SACzF,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAEnC,oEAAoE;IACpE,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACxB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAChD,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,uEAAuE;YACvE,sEAAsE;YACtE,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ;QAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

+9

-1

dist/commands/dvalin.d.ts

		import type { Command } from 'commander';
		import { type SecurityCoverage } from '../security/contracts.js';
		import { type DvalinScannerId, type DvalinScanSuiteResult } from '../remediation/scannerSuite.js';
		@@ -7,4 +8,11 @@ declare const SEVERITIES: readonly ['critical', 'high', 'medium', 'low'];
		export declare function dvalinFailureThresholdMet(result: DvalinScanSuiteResult, threshold: FailSeverity): boolean;
		export declare function renderDvalinResult(result: DvalinScanSuiteResult, root: string, limit?: number): string;
		export declare function renderDvalinResult(result: DvalinScanSuiteResult, root: string, limit?: number, coverage?: SecurityCoverage): string;
		export declare function registerDvalinCommand(program: Command): void;
		/**
		* Parse `git status --porcelain -z`.
		*
		* Rename and copy entries carry two NUL-separated paths; the second is the
		* current one. Everything else is a two-character status, a space, then the path.
		*/
		export declare function parsePorcelainZ(output: string): string[];
		export {};

+177

-37

dist/commands/dvalin.js

		@@ -6,8 +6,15 @@ import path from 'node:path';
		import { EXIT, UsageError } from '../core/exitCodes.js';
		import { runAgentTurn } from '../agent/session.js';
		import { upsertRemediationCases, updateRemediationCase } from '../remediation/cases.js';
		import { resolveDiffScope } from '../remediation/diffScope.js';
		import { runProjectVerification } from '../remediation/verify.js';
		import { sha256 } from '../audit/hash.js';
		import { deriveCoverage, findingTargetFingerprint, securityProjectId, snapshotFinding } from '../security/contracts.js';
		import { renderCoverage } from '../security/render.js';
		import { FIX_EXECUTORS, buildFixRecord, renderFixRecord } from '../security/fixRecord.js';
		import { saveFixRecord } from '../security/fixRecordStore.js';
		import { EXECUTOR_IDS, resolveExecutor, } from '../remediation/executor.js';
		import { createRemediationWorktree } from '../remediation/worktree.js';
		import { runDvalinScanSuite, } from '../remediation/scannerSuite.js';
		import { buildDvalinSarif } from '../remediation/sarifExport.js';
		import { buildAutomatedFixPrompt, buildAutomatedVerificationPrompt, buildDraftPrPrompt, evaluateVerificationGate, extractDraftPrUrl, } from '../remediation/automate.js';
		import { buildAutomatedFixPrompt, buildDraftPrPrompt, evaluateVerificationGate, extractDraftPrUrl, } from '../remediation/automate.js';
		const execFileAsync = promisify(execFile);
		@@ -53,6 +60,10 @@ const SCANNER_IDS = ['builtin', 'semgrep', 'trivy', 'osv-scanner'];
		}
		export function renderDvalinResult(result, root, limit = 20) {
		export function renderDvalinResult(result, root, limit = 20, coverage = deriveCoverage(result)) {
		const lines = [
		`Dvalin security scan · ${root}`,
		`Health ${result.score}/100 (${result.grade}) · ${result.findings.length} findings · ${result.metrics.files} files · ${result.metrics.rules} rules`,
		result.scope
		? `Dvalin security scan · ${root} · changed lines vs ${result.scope.ref}`
		: `Dvalin security scan · ${root}`,
		result.scope
		? `${result.findings.length} findings in ${result.scope.files} changed file(s) · ${result.metrics.rules} rules`
		: `Health ${result.score}/100 (${result.grade}) · ${result.findings.length} findings · ${result.metrics.files} files · ${result.metrics.rules} rules`,
		`Severity critical ${result.metrics.critical} · high ${result.metrics.high} · medium ${result.metrics.medium} · low ${result.metrics.low}`,
		@@ -76,6 +87,9 @@ '',
		else {
		lines.push('', 'No actionable findings. Review scanner coverage before treating this as assurance.');
		lines.push('', result.scope
		? 'No actionable findings on the changed lines. Pre-existing findings elsewhere were not read.'
		: 'No actionable findings. Review scanner coverage before treating this as assurance.');
		}
		lines.push('', renderCoverage(coverage));
		if (result.skippedResults)
		lines.push('', `Note: ${result.skippedResults} result(s) were skipped or truncated.`);
		lines.push(`Note: ${result.skippedResults} result(s) were skipped or truncated.`);
		return lines.join('\n');
		@@ -100,2 +114,7 @@ }
		.option('--provider <name>', 'override the configured model provider for remediation')
		.option('--diff [ref]', 'only report on changed lines; optionally against a revision (e.g. origin/main...HEAD)')
		.option('--staged', 'only report on changed lines in the git index')
		.option('--executor <name>', `who performs a --fix: ${EXECUTOR_IDS.join(', ')}`, 'dvalin')
		.option('--verify-command <cmd>', 'command Dvalin runs to verify a fix; repeatable. Detected from the project when omitted', collectVerifyCommand, [])
		.option('--record <file>', 'write the Verified Fix Record as JSON, whether or not the gate passed')
		.action(async (inputPath, options) => {
		@@ -115,4 +134,27 @@ const root = path.resolve(process.cwd(), inputPath);
		}
		const result = await runDvalinScanSuite(root, { scanners, timeoutMs });
		console.log(options.json ? JSON.stringify(result, null, 2) : renderDvalinResult(result, root, limit));
		if (options.diff && options.staged)
		throw new UsageError('Use either --diff or --staged, not both.');
		const scoped = Boolean(options.diff \|\| options.staged);
		if (scoped && shouldFix) {
		// A repair may touch lines the diff never named, so verifying it needs
		// to look wider than the scan did. Until that widening exists, refuse
		// rather than verify against the wrong surface.
		throw new UsageError('--diff and --staged scan only; they cannot be combined with --fix, --verify, or --draft-pr.');
		}
		const scope = scoped
		? await resolveDiffScope(root, {
		staged: Boolean(options.staged),
		ref: typeof options.diff === 'string' ? options.diff : undefined,
		})
		: undefined;
		const executor = shouldFix ? resolveExecutor(parseExecutorId(options.executor)) : undefined;
		if (executor) {
		const unavailable = await executor.unavailableReason();
		if (unavailable)
		throw new UsageError(`--executor ${executor.id} is unusable: ${unavailable}`);
		}
		const result = await runDvalinScanSuite(root, { scanners, timeoutMs, scope });
		console.log(options.json
		? JSON.stringify({ ...result, coverage: deriveCoverage(result) }, null, 2)
		: renderDvalinResult(result, root, limit));
		let thresholdResult = result;
		@@ -126,2 +168,3 @@ if (shouldFix && result.findings.length) {
		root,
		before: result,
		findings,
		@@ -135,2 +178,5 @@ baselineFindings: result.findings,
		provider: options.provider,
		executor: executor,
		verifyCommands: options.verifyCommand,
		recordPath: options.record,
		});
		@@ -155,2 +201,3 @@ }
		async function runAutomatedRemediation(input) {
		const { executor } = input;
		const cases = await upsertRemediationCases({ cwd: input.root, findings: input.findings });
		@@ -180,11 +227,9 @@ let cwd = input.root;
		await updateRemediationCase(remediationCase.id, { status: 'fixing' });
		console.log('\nDvalin agent: validating and fixing findings…');
		const fixTurn = await runAgentTurn({
		content: buildAutomatedFixPrompt(input.findings, worktreeContext),
		console.log(`\n${executor.name}: validating and fixing findings…`);
		const fixTurn = await executor.run({
		prompt: buildAutomatedFixPrompt(input.findings, worktreeContext),
		cwd,
		mode: 'dvalin',
		codePermissionMode: 'bypass',
		providerOverride: input.provider,
		}, { onEvent: renderAutomationEvent });
		console.log(`\n${fixTurn.result.output}\n`);
		provider: input.provider,
		}, renderAutomationEvent);
		console.log(`\n${fixTurn.output}\n`);
		if (!input.verify) {
		@@ -194,12 +239,16 @@ console.log('Fix phase complete. Run again with --verify before publishing.');
		}
		console.log('Dvalin agent: running focused tests and verification…');
		const verificationTurn = await runAgentTurn({
		content: buildAutomatedVerificationPrompt(input.findings, input.scanners),
		sessionId: fixTurn.sessionId,
		// Dvalin runs the checks. The executor is not asked whether its own patch
		// works, because that is the one question it cannot answer against interest.
		console.log('Dvalin: running the project checks…');
		const verification = await runProjectVerification({
		cwd,
		mode: 'dvalin',
		codePermissionMode: 'bypass',
		providerOverride: input.provider,
		}, { onEvent: renderAutomationEvent });
		console.log(`\n${verificationTurn.result.output}\n`);
		commands: input.verifyCommands?.length ? input.verifyCommands : undefined,
		timeoutMs: input.timeoutMs,
		});
		for (const check of verification.evidence) {
		console.log(` ${check.passed ? '✓' : '✗'} ${check.kind}: ${check.command}${check.exitCode === null ? '' : ` (exit ${check.exitCode})`}`);
		}
		if (verification.skipped.length) {
		console.log(` · not detected in this project: ${verification.skipped.join(', ')}. Use --verify-command to name them.`);
		}
		console.log('Dvalin gate: independently re-running scanners…');
		@@ -212,5 +261,35 @@ const after = await runDvalinScanSuite(cwd, { scanners: input.scanners, timeoutMs: input.timeoutMs });
		after,
		agentOutput: verificationTurn.result.output,
		agentOutput: fixTurn.output,
		hasChanges: Boolean(status.trim()),
		checkEvidence: verification.evidence,
		});
		// Issued whether or not the gate passed: a record that says a repair did not
		// verify is exactly as useful as one that says it did, and dropping it on
		// failure would leave the only unrecorded outcome the one worth recording.
		const record = buildFixRecord({
		projectId: securityProjectId(input.root),
		executor: fixExecutorFor(executor.id),
		before: {
		scanId: input.before.id,
		completedAt: input.before.completedAt,
		coverage: deriveCoverage(input.before),
		targets: input.findings.map(snapshotFinding),
		},
		after: {
		scanId: after.id,
		completedAt: after.completedAt,
		coverage: deriveCoverage(after),
		remainingTargets: remainingTargets(input.findings, after),
		},
		changes: await changesFrom(cwd),
		checks: verification.evidence,
		});
		saveFixRecord(record);
		if (input.recordPath) {
		const target = path.resolve(process.cwd(), input.recordPath);
		await mkdir(path.dirname(target), { recursive: true });
		await writeFile(target, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
		console.log(`Fix record written to ${target}`);
		}
		console.log(renderFixRecord(record));
		if (!gate.passed) {
		@@ -224,13 +303,11 @@ throw new Error(`Dvalin verification gate failed: ${gate.reasons.join('; ')}`);
		return after;
		console.log('\nDvalin agent: publishing verified remediation as a draft PR…');
		const publishTurn = await runAgentTurn({
		content: buildDraftPrPrompt(input.findings),
		sessionId: verificationTurn.sessionId,
		console.log(`\n${executor.name}: publishing verified remediation as a draft PR…`);
		const publishTurn = await executor.run({
		prompt: buildDraftPrPrompt(input.findings),
		resume: fixTurn.session,
		cwd,
		mode: 'dvalin',
		codePermissionMode: 'bypass',
		providerOverride: input.provider,
		}, { onEvent: renderAutomationEvent });
		console.log(`\n${publishTurn.result.output}\n`);
		const url = extractDraftPrUrl(publishTurn.result.output);
		provider: input.provider,
		}, renderAutomationEvent);
		console.log(`\n${publishTurn.output}\n`);
		const url = extractDraftPrUrl(publishTurn.output);
		if (!url)
		@@ -241,2 +318,65 @@ throw new Error('Draft PR publication did not return a GitHub pull request URL.');
		}
		/** The original targets still present after the re-scan. */
		function remainingTargets(originals, after) {
		const present = new Set(after.findings.map(finding => findingTargetFingerprint(finding)));
		return originals
		.map(snapshotFinding)
		.filter(target => present.has(target.targetFingerprint));
		}
		/**
		* The changed files and a hash of the change itself.
		*
		* The hash covers the diff text, not the file list: two different patches over
		* the same files are different repairs, and a hash that could not tell them
		* apart would be worse than no hash, because it would look like one.
		*/
		async function changesFrom(cwd) {
		// -z gives NUL-separated names, so a rename or a path with a space or a quote
		// survives intact instead of arriving as `old -> new` or with its quotes.
		const { stdout: named } = await execFileAsync('git', ['status', '--porcelain', '-z'], { cwd });
		const files = parsePorcelainZ(named).sort();
		if (!files.length)
		return undefined;
		// Tracked changes plus the content of anything new, so a repair that only
		// adds a file still hashes to something specific to that file's content.
		const { stdout: tracked } = await execFileAsync('git', ['diff', 'HEAD'], { cwd, maxBuffer: 64 * 1024 * 1024 });
		const { stdout: untracked } = await execFileAsync('git', ['diff', '--no-index', '--', '/dev/null', '.'], { cwd, maxBuffer: 64 * 1024 * 1024 }).catch(() => ({ stdout: '' }));
		return { files, diffHash: sha256(`${tracked}\n${untracked}`) };
		}
		/**
		* Parse `git status --porcelain -z`.
		*
		* Rename and copy entries carry two NUL-separated paths; the second is the
		* current one. Everything else is a two-character status, a space, then the path.
		*/
		export function parsePorcelainZ(output) {
		const fields = output.split('\0').filter(Boolean);
		const files = [];
		for (let index = 0; index < fields.length; index++) {
		const entry = fields[index];
		const status = entry.slice(0, 2);
		const current = entry.slice(3);
		if (status.includes('R') \|\| status.includes('C')) {
		// The origin path follows as its own field; the destination is what exists now.
		files.push(current);
		index += 1;
		continue;
		}
		if (current)
		files.push(current);
		}
		return files;
		}
		/** Map a remediation executor id onto the record's vocabulary. */
		function fixExecutorFor(id) {
		return FIX_EXECUTORS.includes(id) ? id : 'unknown';
		}
		function collectVerifyCommand(value, previous) {
		return [...previous, value];
		}
		function parseExecutorId(value) {
		if (EXECUTOR_IDS.includes(value))
		return value;
		throw new UsageError(`Unknown --executor '${value}'. Expected one of: ${EXECUTOR_IDS.join(', ')}.`);
		}
		function renderAutomationEvent(event) {
		@@ -243,0 +383,0 @@ if (event.type === 'tool_call')

+1

-1

dist/commands/dvalin.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"dvalin.js","sourceRoot":"","sources":["../../src/commands/dvalin.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EACL,kBAAkB,GAGnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,WAAW,GAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACtF,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAkBlE,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAqB,CAAC,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,qCAAqC,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAsB,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAkC,CAAC;QAAE,OAAO,KAAqB,CAAC;IAC9G,MAAM,IAAI,UAAU,CAAC,kCAAkC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,OAAkD;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAA6B,EAAE,SAAuB;IAC9F,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA6B,EAAE,IAAY,EAAE,KAAK,GAAG,EAAE;IACxF,MAAM,KAAK,GAAG;QACZ,0BAA0B,IAAI,EAAE;QAChC,UAAU,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,eAAe,MAAM,CAAC,OAAO,CAAC,KAAK,YAAY,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;QACnJ,qBAAqB,MAAM,CAAC,OAAO,CAAC,QAAQ,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QAC1I,EAAE;QACF,UAAU;QACV,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS;gBACzC,CAAC,CAAC,UAAU,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACnF,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,QAAQ,eAAe,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC9H,OAAO,KAAK,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxC,CAAC,CAAC;KACH,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7G,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnJ,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,oFAAoF,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,MAAM,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,MAAM,CAAC,cAAc,uCAAuC,CAAC,CAAC;IACjH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wCAAwC,CAAC;SACrD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,CAAC;SACzC,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACxG,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,EAAE,KAAK,CAAC;SACzE,MAAM,CAAC,iBAAiB,EAAE,uCAAuC,EAAE,IAAI,CAAC;SACxE,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,sEAAsE,CAAC;SAChG,MAAM,CAAC,sBAAsB,EAAE,8DAA8D,EAAE,MAAM,CAAC;SACtG,MAAM,CAAC,OAAO,EAAE,mFAAmF,CAAC;SACpG,MAAM,CAAC,UAAU,EAAE,kEAAkE,CAAC;SACtF,MAAM,CAAC,YAAY,EAAE,uEAAuE,CAAC;SAC7F,MAAM,CAAC,YAAY,EAAE,uEAAuE,CAAC;SAC7F,MAAM,CAAC,qBAAqB,EAAE,8CAA8C,EAAE,IAAI,CAAC;SACnF,MAAM,CAAC,mBAAmB,EAAE,wDAAwD,CAAC;SACrF,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,OAAsB,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;QACvE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI,IAAI,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,gEAAgE,CAAC,CAAC;QACtH,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,IAAI,UAAU,CAAC,uEAAuE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACtG,IAAI,eAAe,GAAG,MAAM,CAAC;QAC7B,IAAI,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,2BAA2B,CAAC,CAAC;YAChH,CAAC;YACD,eAAe,GAAG,MAAM,uBAAuB,CAAC;gBAC9C,IAAI;gBACJ,QAAQ;gBACR,gBAAgB,EAAE,MAAM,CAAC,QAAQ;gBACjC,QAAQ;gBACR,SAAS;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;gBACjC,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,uEAAuE;YACvE,qCAAqC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5G,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,yBAAyB,CAAC,eAAe,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7F,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAUtC;IACC,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1F,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;IACrB,IAAI,eAAmC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;QACjF,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QACnB,eAAe,GAAG,sCAAsC,QAAQ,CAAC,GAAG,cAAc,QAAQ,CAAC,MAAM,+BAA+B,QAAQ,CAAC,OAAO,GAAG,CAAC;QACpJ,KAAK,MAAM,eAAe,IAAI,KAAK,EAAE,CAAC;YACpC,MAAM,qBAAqB,CAAC,eAAe,CAAC,EAAE,EAAE;gBAC9C,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,IAAI,aAAa,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC/H,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,MAAM,eAAe,IAAI,KAAK;QAAE,MAAM,qBAAqB,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;QACjC,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC;QACjE,GAAG;QACH,IAAI,EAAE,QAAQ;QACd,kBAAkB,EAAE,QAAQ;QAC5B,gBAAgB,EAAE,KAAK,CAAC,QAAQ;KACjC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,OAAO,MAAM,kBAAkB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,MAAM,YAAY,CAAC;QAC1C,OAAO,EAAE,gCAAgC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;QACzE,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG;QACH,IAAI,EAAE,QAAQ;QACd,kBAAkB,EAAE,QAAQ;QAC5B,gBAAgB,EAAE,KAAK,CAAC,QAAQ;KACjC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,gBAAgB,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAErD,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,QAAQ,EAAE,KAAK,CAAC,gBAAgB;QAChC,KAAK;QACL,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM;QAC3C,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,eAAe,IAAI,KAAK;QAAE,MAAM,qBAAqB,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,GAAG,CAAC,gCAAgC,KAAK,CAAC,KAAK,SAAS,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC;IAEhI,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC;QACrC,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,SAAS,EAAE,gBAAgB,CAAC,SAAS;QACrC,GAAG;QACH,IAAI,EAAE,QAAQ;QACd,kBAAkB,EAAE,QAAQ;QAC5B,gBAAgB,EAAE,KAAK,CAAC,QAAQ;KACjC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC"}
		{"version":3,"file":"dvalin.js","sourceRoot":"","sources":["../../src/commands/dvalin.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,eAAe,EAAyB,MAAM,0BAA0B,CAAC;AAC/I,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAoB,MAAM,0BAA0B,CAAC;AAC5G,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,eAAe,GAIhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EACL,kBAAkB,GAGnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,WAAW,GAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACtF,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAuBlE,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAqB,CAAC,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,qCAAqC,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAsB,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAkC,CAAC;QAAE,OAAO,KAAqB,CAAC;IAC9G,MAAM,IAAI,UAAU,CAAC,kCAAkC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,OAAkD;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAA6B,EAAE,SAAuB;IAC9F,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAA6B,EAC7B,IAAY,EACZ,KAAK,GAAG,EAAE,EACV,QAAQ,GAAqB,cAAc,CAAC,MAAM,CAAC;IAEnD,MAAM,KAAK,GAAG;QACZ,MAAM,CAAC,KAAK;YACV,CAAC,CAAC,0BAA0B,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YACzE,CAAC,CAAC,0BAA0B,IAAI,EAAE;QACpC,MAAM,CAAC,KAAK;YACV,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,gBAAgB,MAAM,CAAC,KAAK,CAAC,KAAK,sBAAsB,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YAC/G,CAAC,CAAC,UAAU,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,eAAe,MAAM,CAAC,OAAO,CAAC,KAAK,YAAY,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;QACvJ,qBAAqB,MAAM,CAAC,OAAO,CAAC,QAAQ,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QAC1I,EAAE;QACF,UAAU;QACV,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS;gBACzC,CAAC,CAAC,UAAU,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACnF,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,QAAQ,eAAe,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC9H,OAAO,KAAK,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxC,CAAC,CAAC;KACH,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7G,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnJ,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK;YACzB,CAAC,CAAC,6FAA6F;YAC/F,CAAC,CAAC,oFAAoF,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,cAAc,uCAAuC,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wCAAwC,CAAC;SACrD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,CAAC;SACzC,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACxG,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,EAAE,KAAK,CAAC;SACzE,MAAM,CAAC,iBAAiB,EAAE,uCAAuC,EAAE,IAAI,CAAC;SACxE,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,gBAAgB,EAAE,sEAAsE,CAAC;SAChG,MAAM,CAAC,sBAAsB,EAAE,8DAA8D,EAAE,MAAM,CAAC;SACtG,MAAM,CAAC,OAAO,EAAE,mFAAmF,CAAC;SACpG,MAAM,CAAC,UAAU,EAAE,kEAAkE,CAAC;SACtF,MAAM,CAAC,YAAY,EAAE,uEAAuE,CAAC;SAC7F,MAAM,CAAC,YAAY,EAAE,uEAAuE,CAAC;SAC7F,MAAM,CAAC,qBAAqB,EAAE,8CAA8C,EAAE,IAAI,CAAC;SACnF,MAAM,CAAC,mBAAmB,EAAE,wDAAwD,CAAC;SACrF,MAAM,CAAC,cAAc,EAAE,uFAAuF,CAAC;SAC/G,MAAM,CAAC,UAAU,EAAE,+CAA+C,CAAC;SACnE,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC;SACzF,MAAM,CAAC,wBAAwB,EAAE,yFAAyF,EAAE,oBAAoB,EAAE,EAAE,CAAC;SACrJ,MAAM,CAAC,iBAAiB,EAAE,uEAAuE,CAAC;SAClG,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,OAAsB,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;QACvE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI,IAAI,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,gEAAgE,CAAC,CAAC;QACtH,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,IAAI,UAAU,CAAC,uEAAuE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,0CAA0C,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;YACxB,uEAAuE;YACvE,sEAAsE;YACtE,gDAAgD;YAChD,MAAM,IAAI,UAAU,CAAC,6FAA6F,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM;YAClB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE;gBAC3B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC/B,GAAG,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACvD,IAAI,WAAW;gBAAE,MAAM,IAAI,UAAU,CAAC,cAAc,QAAQ,CAAC,EAAE,iBAAiB,WAAW,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI;YACtB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,eAAe,GAAG,MAAM,CAAC;QAC7B,IAAI,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,2BAA2B,CAAC,CAAC;YAChH,CAAC;YACD,eAAe,GAAG,MAAM,uBAAuB,CAAC;gBAC9C,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,QAAQ;gBACR,gBAAgB,EAAE,MAAM,CAAC,QAAQ;gBACjC,QAAQ;gBACR,SAAS;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;gBACjC,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,QAAS;gBACnB,cAAc,EAAE,OAAO,CAAC,aAAa;gBACrC,UAAU,EAAE,OAAO,CAAC,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,uEAAuE;YACvE,qCAAqC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5G,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,yBAAyB,CAAC,eAAe,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7F,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAetC;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1F,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;IACrB,IAAI,eAAmC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;QACjF,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QACnB,eAAe,GAAG,sCAAsC,QAAQ,CAAC,GAAG,cAAc,QAAQ,CAAC,MAAM,+BAA+B,QAAQ,CAAC,OAAO,GAAG,CAAC;QACpJ,KAAK,MAAM,eAAe,IAAI,KAAK,EAAE,CAAC;YACpC,MAAM,qBAAqB,CAAC,eAAe,CAAC,EAAE,EAAE;gBAC9C,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,IAAI,aAAa,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC/H,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,MAAM,eAAe,IAAI,KAAK;QAAE,MAAM,qBAAqB,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,IAAI,mCAAmC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC;QACjC,MAAM,EAAE,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC;QAChE,GAAG;QACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,EAAE,qBAAqB,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,OAAO,MAAM,kBAAkB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC;QAChD,GAAG;QACH,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACzE,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,qCAAqC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC1H,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,QAAQ,EAAE,KAAK,CAAC,gBAAgB;QAChC,KAAK;QACL,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,aAAa,EAAE,YAAY,CAAC,QAAQ;KACrC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,cAAc,CAAC;QAC5B,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;QACxC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE;YACN,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YACvB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACrC,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;YACtC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;SAC7C;QACD,KAAK,EAAE;YACL,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC;YAC/B,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC;SAC1D;QACD,OAAO,EAAE,MAAM,WAAW,CAAC,GAAG,CAAC;QAC/B,MAAM,EAAE,YAAY,CAAC,QAAQ;KAC9B,CAAC,CAAC;IACH,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAErC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,eAAe,IAAI,KAAK;QAAE,MAAM,qBAAqB,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,GAAG,CAAC,gCAAgC,KAAK,CAAC,KAAK,SAAS,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC;IAEhI,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,IAAI,kDAAkD,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC;QACrC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,OAAO,CAAC,OAAO;QACvB,GAAG;QACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,EAAE,qBAAqB,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,SAAS,gBAAgB,CACvB,SAA4C,EAC5C,KAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,SAAS;SACb,GAAG,CAAC,eAAe,CAAC;SACpB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAEpC,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/G,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAC/C,KAAK,EACL,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAC9C,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CACrC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAEhC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,OAAO,KAAK,SAAS,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,gFAAgF;YAChF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kEAAkE;AAClE,SAAS,cAAc,CAAC,EAAU;IAChC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,QAAkB;IAC7D,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAK,YAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAmB,CAAC;IAC3E,MAAM,IAAI,UAAU,CAAC,uBAAuB,KAAK,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAoB;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC"}

+8

-0

dist/evidence/pack.d.ts

		import { type AuditRecord, type RunMeta, type VerifyResult } from '../audit/log.js';
		import { type PolicySource, type ResolvedPolicy } from '../core/policy.js';
		import { type TrustReport } from '../core/trust.js';
		import { type VerifiedFixRecord } from '../security/fixRecord.js';
		import { type ComplianceEntry } from './compliance.js';
		@@ -32,2 +33,8 @@ export declare const EVIDENCE_SCHEMA = "dvalincode-evidence/v1";
		runs: EvidenceRun[];
		/**
		* Verified Fix Records issued on this install. A reviewer asking "was this
		* repair actually checked, and by whom" gets the answer here rather than
		* from a claim in a pull request.
		*/
		fixRecords: VerifiedFixRecord[];
		compliance: ComplianceEntry[];
		@@ -46,2 +53,3 @@ manifest: {
		last?: number;
		fixRecordsDir?: string;
		};
		@@ -48,0 +56,0 @@ /** Assemble an Evidence Pack from the install's current policy, posture, and audit runs. */

+16

-0

dist/evidence/pack.js

		@@ -6,2 +6,5 @@ import { sha256, canonicalJSON } from '../audit/hash.js';
		import { readJournal } from '../sessions/journal.js';
		import { listFixRecords } from '../security/fixRecordStore.js';
		import { verifyFixRecord } from '../security/fixRecord.js';
		import { securityProjectId } from '../security/contracts.js';
		import { evaluateCompliance } from './compliance.js';
		@@ -37,2 +40,5 @@ export const EVIDENCE_SCHEMA = 'dvalincode-evidence/v1';
		runs,
		// Scoped to this workspace: a pack for one repository must not carry
		// another repository's paths and findings.
		fixRecords: listFixRecords(opts.fixRecordsDir, { projectId: securityProjectId(cwd) }),
		};
		@@ -64,2 +70,9 @@ const compliance = evaluateCompliance(core);
		}
		// Each embedded record re-derives on its own terms too, so a pack cannot
		// launder a fix record that would not survive `dvalin verify-fix`.
		for (const record of pack.fixRecords ?? []) {
		const check = verifyFixRecord(record);
		if (!check.ok)
		runIssues.push(`fix record ${record.recordHash.slice(0, 12)}: ${check.reasons.join('; ')}`);
		}
		const minimizationIssues = scanForSecrets(pack);
		@@ -95,2 +108,5 @@ return {
		runs: sha256(canonicalJSON(core.runs)),
		// Packs exported before fix records existed carry no such section; hashing
		// `undefined` would throw and report them as malformed rather than old.
		fixRecords: sha256(canonicalJSON(core.fixRecords ?? [])),
		compliance: sha256(canonicalJSON(core.compliance)),
		@@ -97,0 +113,0 @@ };

+1

-1

dist/evidence/pack.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../src/evidence/pack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,WAAW,EACX,aAAa,GAId,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAA0C,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAoB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAwB,MAAM,iBAAiB,CAAC;AAE3E,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AA+BxD,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAiB,EAAE;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAkB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC1C,IAAI,OAAO,GAAkB,EAAE,CAAC;QAChC,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,eAAyC;QACjD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAqB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QAC7D,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAC/E,KAAK;QACL,IAAI;KACL,CAAC;IACF,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC;IAC/C,OAAO,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;AACxE,CAAC;AAUD,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,aAAa,CAAC,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC,CAAC;IACnG,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY;QAAE,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAE9D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,SAAS,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,iBAAiB,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEhD,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAC3G,YAAY;QACZ,aAAa;QACb,SAAS;QACT,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,SAAS,CAA8B,MAAS;IACvD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAIrE,CAAC;IACF,OAAO,IAAuB,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,IAAoB,EAAE,KAAa,EAAE,WAAoB;IAC3E,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,CAClD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAChD,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAClF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;AAC3E,CAAC;AAID,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtG,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAkB;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,IAAkB;IACvC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAkB;IACzC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,GAAG,oEAAoE,CAAC;AAExF,uGAAuG;AACvG,SAAS,cAAc,CAAC,KAAc,EAAE,IAAI,GAAG,EAAE;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
		{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../src/evidence/pack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,WAAW,EACX,aAAa,GAId,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAA0C,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAoB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAA0B,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAwB,MAAM,iBAAiB,CAAC;AAE3E,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAsCxD,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAiB,EAAE;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAkB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC1C,IAAI,OAAO,GAAkB,EAAE,CAAC;QAChC,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,eAAyC;QACjD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAqB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QAC7D,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAC/E,KAAK;QACL,IAAI;QACJ,qEAAqE;QACrE,2CAA2C;QAC3C,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;KACtF,CAAC;IACF,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC;IAC/C,OAAO,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;AACxE,CAAC;AAUD,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,aAAa,CAAC,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC,CAAC;IACnG,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY;QAAE,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAE9D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,SAAS,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,iBAAiB,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,SAAS,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEhD,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAC3G,YAAY;QACZ,aAAa;QACb,SAAS;QACT,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,SAAS,CAA8B,MAAS;IACvD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAIrE,CAAC;IACF,OAAO,IAAuB,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,IAAoB,EAAE,KAAa,EAAE,WAAoB;IAC3E,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,CAClD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAChD,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAClF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;AAC3E,CAAC;AAID,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtG,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACxD,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAkB;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,IAAkB;IACvC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAkB;IACzC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,GAAG,oEAAoE,CAAC;AAExF,uGAAuG;AACvG,SAAS,cAAc,CAAC,KAAc,EAAE,IAAI,GAAG,EAAE;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

+10

-1

dist/mcp/server.d.ts

		import type { Readable, Writable } from 'node:stream';
		import { type HarnessRunExecution, type HarnessRunHooks, type HarnessRunRequest } from '../harness/run.js';
		import type { UnattendedPermissionMode } from '../core/policy.js';
		import { type DvalinScannerId, type DvalinScanSuiteResult } from '../remediation/scannerSuite.js';
		import { type DvalinScannerDescriptor, type DvalinScannerId, type DvalinScanSuiteResult } from '../remediation/scannerSuite.js';
		import { type DiffScope } from '../remediation/diffScope.js';
		import { runWorkflowVerification } from '../security/verifyRun.js';
		import { createSecurityWorkflow, loadSecurityWorkflow, verifySecurityWorkflow } from '../security/workflow.js';
		import { type Session } from '../sessions/store.js';
		@@ -27,2 +30,3 @@ type JsonRpcId = string \| number \| null;
		timeoutMs?: number;
		scope?: DiffScope;
		}) => Promise<DvalinScanSuiteResult>;
		@@ -32,2 +36,7 @@ loadSession: (id: string) => Promise<Session \| null>;
		latestRun: () => string \| null;
		createWorkflow: typeof createSecurityWorkflow;
		loadWorkflow: typeof loadSecurityWorkflow;
		verifyWorkflow: typeof verifySecurityWorkflow;
		runVerification: typeof runWorkflowVerification;
		listScanners: () => Promise<DvalinScannerDescriptor[]>;
		};
		@@ -34,0 +43,0 @@ export type DvalinMcpServer = {

+215

-14

dist/mcp/server.js

		@@ -7,3 +7,9 @@ import { realpath } from 'node:fs/promises';
		import { executeHarnessRun, } from '../harness/run.js';
		import { runDvalinScanSuite, } from '../remediation/scannerSuite.js';
		import { listDvalinScanners, runDvalinScanSuite, } from '../remediation/scannerSuite.js';
		import { resolveDiffScope } from '../remediation/diffScope.js';
		import { evaluateSecurityGate, findingFingerprint } from '../security/contracts.js';
		import { loadSecurityConfig } from '../security/config.js';
		import { verifyFixRecord, FIX_EXECUTORS } from '../security/fixRecord.js';
		import { runWorkflowVerification } from '../security/verifyRun.js';
		import { createSecurityWorkflow, getWorkflowFinding, loadSecurityWorkflow, verifySecurityWorkflow, } from '../security/workflow.js';
		import { readJournal } from '../sessions/journal.js';
		@@ -22,3 +28,3 @@ import { loadSession } from '../sessions/store.js';
		*/
		const SUPPORTED_PROTOCOL_VERSIONS = ['2025-06-18', '2025-03-26', '2024-11-05'];
		const SUPPORTED_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
		const LATEST_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0];
		@@ -32,3 +38,3 @@ const SCANNER_IDS = ['builtin', 'semgrep', 'trivy', 'osv-scanner'];
		description: 'Scan a workspace for injection, hardcoded secrets, XSS, dynamic code execution, and unsafe shell use. '
		+ 'Deterministic and read-only: it runs no model, needs no credentials, and never edits files — safe to call '
		+ 'Deterministic and workspace-read-only: it runs no model, needs no credentials, and never edits project files — safe to call '
		+ 'after writing code. Returns findings with file, line, severity, and rule reference.',
		@@ -45,3 +51,14 @@ inputSchema: {
		limit: { type: 'integer', minimum: 1, description: `Maximum findings returned (default ${DEFAULT_FINDING_LIMIT}).` },
		diff: {
		type: 'string',
		description: 'Narrow the scan to changed lines only — use this after writing code, to see what your edit introduced rather than '
		+ "everything already in the repository. Accepts \"uncommitted\" (working tree vs HEAD, including new files), "
		+ '"staged" (the git index), or any git revision or range such as "origin/main...HEAD". Omit to scan the whole workspace.',
		},
		timeout_seconds: { type: 'number', exclusiveMinimum: 0 },
		fail_on: {
		type: 'string',
		enum: ['critical', 'high', 'medium', 'low', 'none'],
		description: 'Workflow gate threshold (default: high).',
		},
		include_remediation_prompts: {
		@@ -54,3 +71,4 @@ type: 'boolean',
		},
		annotations: { readOnlyHint: true },
		annotations: stateAnnotations(true),
		outputSchema: objectOutputSchema(),
		},
		@@ -73,3 +91,4 @@ {
		},
		annotations: { readOnlyHint: false },
		annotations: writeAnnotations(),
		outputSchema: objectOutputSchema(),
		},
		@@ -85,3 +104,4 @@ {
		},
		annotations: { readOnlyHint: true },
		annotations: readAnnotations(),
		outputSchema: objectOutputSchema(),
		},
		@@ -96,4 +116,65 @@ {
		},
		annotations: { readOnlyHint: true },
		annotations: readAnnotations(),
		},
		{
		name: 'dvalin_get_finding',
		description: 'Read one compact finding from a persisted security workflow by fingerprint.',
		inputSchema: {
		type: 'object',
		properties: {
		workflow_id: { type: 'string' },
		fingerprint: { type: 'string' },
		},
		required: ['workflow_id', 'fingerprint'],
		additionalProperties: false,
		},
		annotations: readAnnotations(),
		outputSchema: objectOutputSchema(),
		},
		{
		name: 'dvalin_verify_findings',
		description: 'Re-scan a persisted workflow and independently verify that the blocked targets are gone and no new severe findings were introduced. '
		+ 'Unlike dvalin_scan, this DOES execute the project\'s own checks (test, typecheck, build) so the verdict rests on exit codes Dvalin '
		+ 'observed rather than on any report it was given — every command still passes the org policy gate before it runs. '
		+ 'Returns a Verified Fix Record: a portable, offline re-verifiable statement of what was checked and what was found.',
		inputSchema: {
		type: 'object',
		properties: {
		workflow_id: { type: 'string' },
		timeout_seconds: { type: 'number', exclusiveMinimum: 0 },
		executor: {
		type: 'string',
		enum: [...FIX_EXECUTORS],
		description: 'Who wrote the repair. Recorded on the fix record as metadata; it never affects the verdict.',
		},
		},
		required: ['workflow_id'],
		additionalProperties: false,
		},
		annotations: stateAnnotations(true),
		outputSchema: objectOutputSchema(),
		},
		{
		name: 'dvalin_verify_fix',
		description: 'Re-derive a Verified Fix Record offline. Recomputes the record hash and re-checks that its verdict follows from its own evidence, '
		+ 'so a record that was edited after it was issued fails here. Needs no workspace, no network, and no Dvalin state — '
		+ 'call it to confirm that a fix record handed to you is sound before relying on it.',
		inputSchema: {
		type: 'object',
		properties: {
		record: { type: 'object', description: 'The fix record JSON, as issued by dvalin_verify_findings or `dvalin verify --record`.' },
		},
		required: ['record'],
		additionalProperties: false,
		},
		annotations: readAnnotations(),
		outputSchema: objectOutputSchema(),
		},
		{
		name: 'dvalin_list_scanners',
		description: 'List built-in and optional scanner engines, availability, and reviewable install commands.',
		inputSchema: { type: 'object', properties: {}, additionalProperties: false },
		annotations: readAnnotations(),
		outputSchema: objectOutputSchema(),
		},
		];
		@@ -107,2 +188,7 @@ export async function createMcpServer(options, overrides = {}) {
		latestRun: () => latestRun(),
		createWorkflow: createSecurityWorkflow,
		loadWorkflow: loadSecurityWorkflow,
		verifyWorkflow: verifySecurityWorkflow,
		runVerification: runWorkflowVerification,
		listScanners: listDvalinScanners,
		...overrides,
		@@ -182,9 +268,17 @@ };
		const includePrompts = args.include_remediation_prompts === true;
		const threshold = optionalSecurityThreshold(args.fail_on) ?? 'high';
		const scope = args.diff === undefined
		? undefined
		: await resolveDiffScope(resolvedCwd, diffScopeOptions(requireString(args.diff, 'diff')));
		const result = await context.deps.runScan(resolvedCwd, {
		scanners,
		timeoutMs: timeoutSeconds === undefined ? undefined : timeoutSeconds * 1000,
		scope,
		});
		const gate = evaluateSecurityGate({ result, threshold, mode: 'all' });
		const workflow = await context.deps.createWorkflow({ root: resolvedCwd, result, gate });
		// Trimmed by default: the per-finding repair prompt and source snippet are
		// ~1KB each, and a caller that wants context can read the file itself.
		const findings = result.findings.slice(0, limit).map(finding => ({
		fingerprint: findingFingerprint(finding),
		ruleId: finding.ruleId,
		@@ -202,6 +296,10 @@ ruleName: finding.ruleName,
		}));
		return toolResult(JSON.stringify({
		const body = {
		schemaVersion: 1,
		scanId: result.id,
		workflowId: workflow.id,
		score: result.score,
		grade: result.grade,
		metrics: result.metrics,
		...(result.scope ? { scope: result.scope } : {}),
		totalFindings: result.findings.length,
		@@ -216,3 +314,5 @@ returnedFindings: findings.length,
		})),
		}));
		gate,
		};
		return toolResult(JSON.stringify(body), false, body);
		}
		@@ -241,3 +341,3 @@ if (name === 'dvalin_run_task') {
		});
		return toolResult(JSON.stringify(execution.result), execution.exitCode !== 0);
		return toolResult(JSON.stringify(execution.result), execution.exitCode !== 0, execution.result);
		}
		@@ -251,3 +351,3 @@ if (name === 'dvalin_get_session') {
		const latest = [...readJournal(session.id)].reverse().find((entry) => entry.type === 'turn_end' && !!(entry.runId \|\| entry.auditHead));
		return toolResult(JSON.stringify({
		const body = {
		sessionId: session.id,
		@@ -259,3 +359,4 @@ cwd: session.cwd,
		auditHead: latest?.auditHead,
		}));
		};
		return toolResult(JSON.stringify(body), false, body);
		}
		@@ -269,2 +370,71 @@ if (name === 'dvalin_get_evidence') {
		}
		if (name === 'dvalin_get_finding') {
		const workflowId = requireString(args.workflow_id, 'workflow_id');
		const fingerprint = requireString(args.fingerprint, 'fingerprint');
		const workflow = await context.deps.loadWorkflow(workflowId);
		await resolveAllowedWorkspace(workflow.root, context.allowedWorkspaces);
		const finding = getWorkflowFinding(workflow, fingerprint);
		if (!finding)
		throw new Error(`Finding not found in workflow ${workflowId}: ${fingerprint}`);
		const body = { schemaVersion: 1, workflowId, finding };
		return toolResult(JSON.stringify(body), false, body);
		}
		if (name === 'dvalin_verify_findings') {
		const workflowId = requireString(args.workflow_id, 'workflow_id');
		const timeoutSeconds = optionalPositiveNumber(args.timeout_seconds, 'timeout_seconds', false);
		const executorInput = optionalString(args.executor, 'executor');
		// Validated here rather than trusted: an unrecognised value would produce a
		// record that fails its own shape check, so it would read as VERIFIED while
		// no verifier would accept it.
		if (executorInput !== undefined && !FIX_EXECUTORS.includes(executorInput)) {
		throw new Error(`executor must be one of ${FIX_EXECUTORS.join(', ')}`);
		}
		const executor = executorInput;
		const workflow = await context.deps.loadWorkflow(workflowId);
		// Confines the verification to a permitted workspace before any project
		// command is chosen, let alone run.
		await resolveAllowedWorkspace(workflow.root, context.allowedWorkspaces);
		const config = await loadSecurityConfig(workflow.root);
		const updated = await context.deps.runVerification({
		workflow,
		checks: config.config.checks,
		timeoutMs: timeoutSeconds === undefined ? undefined : timeoutSeconds * 1000,
		executor,
		runScan: context.deps.runScan,
		});
		const body = {
		schemaVersion: 1,
		workflowId: updated.id,
		state: updated.state,
		assurance: updated.verification?.assurance,
		gate: updated.gate,
		coverage: updated.coverage,
		scanId: updated.latestScan.id,
		score: updated.latestScan.score,
		grade: updated.latestScan.grade,
		findings: updated.latestScan.findings.length,
		record: updated.verification?.record,
		};
		// A failing security gate is a successful tool execution with a negative
		// domain result, not an MCP transport/tool error.
		return toolResult(JSON.stringify(body), false, body);
		}
		if (name === 'dvalin_verify_fix') {
		const check = verifyFixRecord(args.record);
		const body = {
		schemaVersion: 1,
		ok: check.ok,
		reasons: check.reasons,
		verified: check.record?.verdict.verified ?? false,
		assurance: check.record?.assurance,
		recordHash: check.record?.recordHash,
		};
		// A record that fails re-derivation is an answer, not a transport failure.
		return toolResult(JSON.stringify(body), false, body);
		}
		if (name === 'dvalin_list_scanners') {
		const scanners = await context.deps.listScanners();
		const body = { schemaVersion: 1, scanners };
		return toolResult(JSON.stringify(body), false, body);
		}
		throw new Error(`Unknown tool: ${name}`);
		@@ -304,5 +474,29 @@ }
		}
		function toolResult(text, isError = false) {
		return { content: [{ type: 'text', text }], ...(isError ? { isError: true } : {}) };
		/** `uncommitted` and `staged` are names, not revisions; anything else is a ref. */
		function diffScopeOptions(value) {
		if (value === 'uncommitted')
		return {};
		if (value === 'staged')
		return { staged: true };
		return { ref: value };
		}
		function toolResult(text, isError = false, structuredContent) {
		return {
		content: [{ type: 'text', text }],
		...(structuredContent ? { structuredContent } : {}),
		...(isError ? { isError: true } : {}),
		};
		}
		function objectOutputSchema() {
		return { type: 'object', additionalProperties: true };
		}
		function readAnnotations(openWorld = false) {
		return { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: openWorld };
		}
		function writeAnnotations() {
		return { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true };
		}
		function stateAnnotations(openWorld = false) {
		return { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: openWorld };
		}
		function asRecord(value) {
		@@ -328,2 +522,9 @@ return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
		}
		function optionalSecurityThreshold(value) {
		if (value === undefined)
		return undefined;
		if (value === 'critical' \|\| value === 'high' \|\| value === 'medium' \|\| value === 'low' \|\| value === 'none')
		return value;
		throw new Error('fail_on must be critical, high, medium, low, or none');
		}
		/**
		@@ -330,0 +531,0 @@ * Omitted means `builtin` only — the one engine that needs nothing installed,

+1

-1

dist/mcp/server.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EACL,iBAAiB,GAIlB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,GAGnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,WAAW,EAAuB,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAgB,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AACxF,MAAM,uBAAuB,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;AAE/D,MAAM,WAAW,GAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACtF,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAmCjC,MAAM,SAAS,GAAG;IAChB;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,wGAAwG;cACtG,4GAA4G;cAC5G,qFAAqF;QACzF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sDAAsD,EAAE;gBAC5F,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;oBAC5C,WAAW,EAAE,4FAA4F;iBAC1G;gBACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,sCAAsC,qBAAqB,IAAI,EAAE;gBACpH,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE;gBACxD,2BAA2B,EAAE;oBAC3B,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,iEAAiE;iBAC/E;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,wHAAwH;QACrI,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACrE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gBAC/C,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE;aACzD;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;YACpB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE;KACrC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC9C,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,uFAAuF;QACpG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC1C,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC;CACO,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAyB,EACzB,SAAS,GAAmC,EAAE;IAE9C,MAAM,IAAI,GAA0B;QAClC,UAAU,EAAE,iBAAiB;QAC7B,OAAO,EAAE,kBAAkB;QAC3B,WAAW;QACX,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;QAC1C,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;QAC5B,GAAG,SAAS;KACb,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpH,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAmC,EAAE;QACzE,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACxF,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;YACnE,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC3B,eAAe,EAAE,wBAAwB,CAAC,gBAAgB,CAAC;gBAC3D,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE;oBAC/C,IAAI;oBACJ,SAAS;oBACT,iBAAiB;oBACjB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;iBAC7C,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAyB,EACzB,EAAE,GAA0C,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;IAE5F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,SAAkB;IACzD,OAAO,2BAA2B,CAAC,QAAQ,CAAC,SAAkB,CAAC;QAC7D,CAAC,CAAE,SAAoB;QACvB,CAAC,CAAC,uBAAuB,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,IAA6B,EAC7B,OAKC;IAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,qBAAqB,CAAC;QACzF,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,cAAc,GAAG,IAAI,CAAC,2BAA2B,KAAK,IAAI,CAAC;QAEjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YACrD,QAAQ;YACR,SAAS,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,GAAG,IAAI;SAC5E,CAAC,CAAC;QAEH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/D,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC,CAAC;QAEJ,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACrC,gBAAgB,EAAE,QAAQ,CAAC,MAAM;YACjC,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACxC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;SACJ,CAAC,CAAC,CAAC;IACN,CAAC;IAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClF,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC1F,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAE9F,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9C,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,WAAW;YAChB,SAAS;YACT,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,cAAgD;YAChE,aAAa;YACb,cAAc;YACd,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACjE,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CACxD,CAAC,KAAK,EAAyD,EAAE,CAC/D,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,CAClE,CAAC;QACF,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;YACrC,KAAK,EAAE,MAAM,EAAE,KAAK;YACpB,SAAS,EAAE,MAAM,EAAE,SAAS;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACpD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,SAAiB,EAAE,OAAiB;IACzE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC/B,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,SAAS,SAAS,CAAC,EAAa,EAAE,MAAe;IAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,EAAa,EAAE,IAAY,EAAE,OAAe;IAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAAO,GAAG,KAAK;IAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/G,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAqB,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzH,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAA0B,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAa,EAAE,OAAgB;IAC7E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
		{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EACL,iBAAiB,GAIlB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAInB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAyC,MAAM,6BAA6B,CAAC;AACtG,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAA0B,MAAM,0BAA0B,CAAC;AAC5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAoB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EACL,sBAAsB,EAEtB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAuB,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAgB,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AACtG,MAAM,uBAAuB,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;AAE/D,MAAM,WAAW,GAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACtF,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwCjC,MAAM,SAAS,GAAG;IAChB;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,wGAAwG;cACtG,8HAA8H;cAC9H,qFAAqF;QACzF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sDAAsD,EAAE;gBAC5F,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;oBAC5C,WAAW,EAAE,4FAA4F;iBAC1G;gBACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,sCAAsC,qBAAqB,IAAI,EAAE;gBACpH,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,oHAAoH;0BAClH,6GAA6G;0BAC7G,wHAAwH;iBAC7H;gBACD,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE;gBACxD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;oBACnD,WAAW,EAAE,0CAA0C;iBACxD;gBACD,2BAA2B,EAAE;oBAC3B,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,iEAAiE;iBAC/E;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC;QACnC,YAAY,EAAE,kBAAkB,EAAE;KACnC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,wHAAwH;QACrI,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACrE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gBAC/C,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE;aACzD;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;YACpB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,gBAAgB,EAAE;QAC/B,YAAY,EAAE,kBAAkB,EAAE;KACnC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC9C,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,eAAe,EAAE;QAC9B,YAAY,EAAE,kBAAkB,EAAE;KACnC;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,uFAAuF;QACpG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC1C,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,eAAe,EAAE;KAC/B;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,6EAA6E;QAC1F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC/B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAChC;YACD,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;YACxC,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,eAAe,EAAE;QAC9B,YAAY,EAAE,kBAAkB,EAAE;KACnC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,sIAAsI;cACpI,qIAAqI;cACrI,mHAAmH;cACnH,oHAAoH;QACxH,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC/B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE;gBACxD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC;oBACxB,WAAW,EAAE,6FAA6F;iBAC3G;aACF;YACD,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC;QACnC,YAAY,EAAE,kBAAkB,EAAE;KACnC;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,oIAAoI;cAClI,oHAAoH;cACpH,mFAAmF;QACvF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uFAAuF,EAAE;aACjI;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;YACpB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE,eAAe,EAAE;QAC9B,YAAY,EAAE,kBAAkB,EAAE;KACnC;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,4FAA4F;QACzG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;QAC5E,WAAW,EAAE,eAAe,EAAE;QAC9B,YAAY,EAAE,kBAAkB,EAAE;KACnC;CACO,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAyB,EACzB,SAAS,GAAmC,EAAE;IAE9C,MAAM,IAAI,GAA0B;QAClC,UAAU,EAAE,iBAAiB;QAC7B,OAAO,EAAE,kBAAkB;QAC3B,WAAW;QACX,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;QAC1C,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE;QAC5B,cAAc,EAAE,sBAAsB;QACtC,YAAY,EAAE,oBAAoB;QAClC,cAAc,EAAE,sBAAsB;QACtC,eAAe,EAAE,uBAAuB;QACxC,YAAY,EAAE,kBAAkB;QAChC,GAAG,SAAS;KACb,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpH,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAmC,EAAE;QACzE,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACxF,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;YACnE,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC3B,eAAe,EAAE,wBAAwB,CAAC,gBAAgB,CAAC;gBAC3D,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE;oBAC/C,IAAI;oBACJ,SAAS;oBACT,iBAAiB;oBACjB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;iBAC7C,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAyB,EACzB,EAAE,GAA0C,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;IAE5F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,SAAkB;IACzD,OAAO,2BAA2B,CAAC,QAAQ,CAAC,SAAkB,CAAC;QAC7D,CAAC,CAAE,SAAoB;QACvB,CAAC,CAAC,uBAAuB,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,IAA6B,EAC7B,OAKC;IAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,qBAAqB,CAAC;QACzF,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,cAAc,GAAG,IAAI,CAAC,2BAA2B,KAAK,IAAI,CAAC;QACjE,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;QAEpE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS;YACnC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAE5F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YACrD,QAAQ;YACR,SAAS,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,GAAG,IAAI;YAC3E,KAAK;SACN,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAExF,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/D,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC;YACxC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC,CAAC;QAEJ,MAAM,IAAI,GAAG;YACX,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YACrC,gBAAgB,EAAE,QAAQ,CAAC,MAAM;YACjC,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACxC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,IAAI;SACL,CAAC;QACF,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClF,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC1F,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAE9F,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9C,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,WAAW;YAChB,SAAS;YACT,IAAI,EAAE,MAAM;YACZ,cAAc,EAAE,cAAgD;YAChE,aAAa;YACb,cAAc;YACd,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,SAAS,CAAC,MAA4C,CAAC,CAAC;IACxI,CAAC;IAED,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACjE,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CACxD,CAAC,KAAK,EAAyD,EAAE,CAC/D,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,CAClE,CAAC;QACF,MAAM,IAAI,GAAG;YACX,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;YACrC,KAAK,EAAE,MAAM,EAAE,KAAK;YACpB,SAAS,EAAE,MAAM,EAAE,SAAS;SAC7B,CAAC;QACF,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACpD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,KAAK,WAAW,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,4EAA4E;QAC5E,4EAA4E;QAC5E,+BAA+B;QAC/B,IAAI,aAAa,KAAK,SAAS,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,KAAK,CAAC,2BAA2B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,QAAQ,GAAG,aAAwC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7D,wEAAwE;QACxE,oCAAoC;QACpC,MAAM,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;YACjD,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;YAC5B,SAAS,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,GAAG,IAAI;YAC3E,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG;YACX,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS;YAC1C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE;YAC7B,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;YAC/B,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;YAC/B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM;YAC5C,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM;SACrC,CAAC;QACF,yEAAyE;QACzE,kDAAkD;QAClD,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG;YACX,aAAa,EAAE,CAAC;YAChB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;YACjD,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS;YAClC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU;SACrC,CAAC;QACF,2EAA2E;QAC3E,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,SAAiB,EAAE,OAAiB;IACzE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC/B,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,SAAS,SAAS,CAAC,EAAa,EAAE,MAAe;IAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,EAAa,EAAE,IAAY,EAAE,OAAe;IAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,OAAO,GAAG,KAAK,EACf,iBAA2C;IAE3C,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,SAAS,GAAG,KAAK;IACxC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACxG,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAS,GAAG,KAAK;IACzC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AAC1G,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/G,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxH,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAqB,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzH,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAA0B,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAa,EAAE,OAAgB;IAC7E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

+4

-1

dist/remediation/automate.d.ts

		import type { DvalinScanSuiteResult } from './scannerSuite.js';
		import type { RemediationFinding } from './sarif.js';
		import type { SecurityCheckEvidence } from '../security/workflow.js';
		export declare const VERIFICATION_MARKER = "DVALIN_VERIFICATION_PASSED";
		export declare function buildAutomatedFixPrompt(findings: RemediationFinding[], worktreeContext?: string): string;
		export declare function buildAutomatedVerificationPrompt(findings: RemediationFinding[], scanners: string[]): string;
		export declare function buildDraftPrPrompt(findings: RemediationFinding[]): string;
		@@ -11,2 +11,4 @@ export type VerificationGate = {
		};
		/** Extract process exit codes from the tamper-evident audit trail, not model prose. */
		export declare function verificationEvidenceFromAudit(runId: string, auditDir?: string): SecurityCheckEvidence[];
		export declare function evaluateVerificationGate(input: {
		@@ -18,3 +20,4 @@ originals: RemediationFinding[];
		hasChanges: boolean;
		checkEvidence?: SecurityCheckEvidence[];
		}): VerificationGate;
		export declare function extractDraftPrUrl(output: string): string \| undefined;

+35

-18

dist/remediation/automate.js

		@@ -0,1 +1,2 @@
		import { readRecords } from '../audit/log.js';
		export const VERIFICATION_MARKER = 'DVALIN_VERIFICATION_PASSED';
		@@ -31,17 +32,2 @@ function findingKey(finding) {
		}
		export function buildAutomatedVerificationPrompt(findings, scanners) {
		return [
		'Verify the Dvalin remediation. Do not make further code changes unless a focused test cannot run because of a trivial fix introduced in this same remediation.',
		'',
		`Original findings: ${findings.map(finding => `${finding.ruleId} at ${finding.path}`).join('; ')}`,
		`Scanner set: ${scanners.join(', ')}`,
		'',
		'Hard verification requirements:',
		'1. Inspect git status and the complete diff. Fail on unrelated changes, test weakening, scanner suppression, generated artifacts, or secrets.',
		'2. Run focused tests covering every changed area. Then run the project typecheck/build/test command that is proportionate to the change.',
		'3. Run the Dvalin security suite again and confirm the original finding class is gone without introducing a new high/critical finding.',
		'4. If any required command fails, evidence is missing, or a finding remains, explain the failure and end with DVALIN_VERIFICATION_FAILED.',
		`5. Only when every requirement passes, end the response with the exact standalone line ${VERIFICATION_MARKER}.`,
		].join('\n');
		}
		export function buildDraftPrPrompt(findings) {
		@@ -58,2 +44,22 @@ return [
		}
		/** Extract process exit codes from the tamper-evident audit trail, not model prose. */
		export function verificationEvidenceFromAudit(runId, auditDir) {
		const records = readRecords(runId, auditDir);
		const evidence = [];
		for (let index = 0; index < records.length; index++) {
		const record = records[index];
		if (record.type !== 'tool_call' \|\| record.tool !== 'run_check')
		continue;
		const execution = records.slice(index + 1).find(candidate => candidate.type === 'tool_call' \|\| candidate.type === 'shell_exec');
		if (!execution \|\| execution.type !== 'shell_exec')
		continue;
		evidence.push({
		kind: record.argsSummary,
		command: execution.command,
		exitCode: execution.exitCode,
		passed: record.status === 'ok' && execution.exitCode === 0,
		});
		}
		return evidence;
		}
		export function evaluateVerificationGate(input) {
		@@ -72,5 +78,16 @@ const reasons = [];
		reasons.push('the remediation worktree has no code changes');
		const markerPattern = new RegExp(`(?:^\|\\n)${VERIFICATION_MARKER}(?:\\n\|$)`);
		if (!markerPattern.test(input.agentOutput.trim()))
		reasons.push('focused tests/build were not reported as passing');
		if (input.checkEvidence) {
		if (!input.checkEvidence.length)
		reasons.push('no run_check execution evidence was recorded');
		const failedChecks = input.checkEvidence.filter(check => !check.passed);
		if (failedChecks.length)
		reasons.push(`${failedChecks.length} recorded check(s) failed`);
		}
		else {
		// Compatibility for programmatic callers that have not supplied audit
		// evidence. The automated remediation path always supplies it.
		const markerPattern = new RegExp(`(?:^\|\\n)${VERIFICATION_MARKER}(?:\\n\|$)`);
		if (!markerPattern.test(input.agentOutput.trim()))
		reasons.push('focused tests/build were not reported as passing');
		}
		return { passed: reasons.length === 0, reasons };
		@@ -77,0 +94,0 @@ }

+1

-1

dist/remediation/automate.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"automate.js","sourceRoot":"","sources":["../../src/remediation/automate.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE,SAAS,UAAU,CAAC,OAA2B;IAC7C,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAA8B,EAAE,eAAwB;IAC9F,OAAO;QACL,yEAAyE;QACzE,eAAe,IAAI,EAAE;QACrB,EAAE;QACF,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,GAAG,KAAK,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE;YACrD,MAAM,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACvE,MAAM,OAAO,CAAC,OAAO,EAAE;SACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE;QACF,oBAAoB;QACpB,2KAA2K;QAC3K,8KAA8K;QAC9K,kIAAkI;QAClI,kFAAkF;QAClF,yEAAyE;QACzE,gGAAgG;KACjG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,QAA8B,EAAE,QAAkB;IACjG,OAAO;QACL,gKAAgK;QAChK,EAAE;QACF,sBAAsB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAClG,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACrC,EAAE;QACF,iCAAiC;QACjC,+IAA+I;QAC/I,0IAA0I;QAC1I,wIAAwI;QACxI,2IAA2I;QAC3I,0FAA0F,mBAAmB,GAAG;KACjH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAA8B;IAC/D,OAAO;QACL,oHAAoH;QACpH,EAAE;QACF,wBAAwB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnG,EAAE;QACF,4HAA4H;QAC5H,kIAAkI;QAClI,mFAAmF;KACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAID,MAAM,UAAU,wBAAwB,CAAC,KAMxC;IACC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,kDAAkD,CAAC,CAAC;IAE1G,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjI,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,+CAA+C,CAAC,CAAC;IACvG,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAEpF,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,YAAY,mBAAmB,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACpH,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC"}
		{"version":3,"file":"automate.js","sourceRoot":"","sources":["../../src/remediation/automate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE,SAAS,UAAU,CAAC,OAA2B;IAC7C,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAA8B,EAAE,eAAwB;IAC9F,OAAO;QACL,yEAAyE;QACzE,eAAe,IAAI,EAAE;QACrB,EAAE;QACF,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,GAAG,KAAK,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE;YACrD,MAAM,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACvE,MAAM,OAAO,CAAC,OAAO,EAAE;SACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE;QACF,oBAAoB;QACpB,2KAA2K;QAC3K,8KAA8K;QAC9K,kIAAkI;QAClI,kFAAkF;QAClF,yEAAyE;QACzE,gGAAgG;KACjG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAA8B;IAC/D,OAAO;QACL,oHAAoH;QACpH,EAAE;QACF,wBAAwB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnG,EAAE;QACF,4HAA4H;QAC5H,kIAAkI;QAClI,mFAAmF;KACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAID,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAAC,KAAa,EAAE,QAAiB;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACzE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QAChI,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;YAAE,SAAS;QAC5D,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,WAAW;YACxB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAOxC;IACC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,kDAAkD,CAAC,CAAC;IAE1G,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjI,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,+CAA+C,CAAC,CAAC;IACvG,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAEpF,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9F,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,YAAY,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,2BAA2B,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,YAAY,mBAAmB,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC"}

+2

-1

dist/remediation/localScan.d.ts

		@@ -0,2 +1,3 @@
		import { type DiffScope } from './diffScope.js';
		import { type SarifImportResult } from './sarif.js';
		export declare function runLocalSecurityScan(cwd: string): Promise<SarifImportResult>;
		export declare function runLocalSecurityScan(cwd: string, scope?: DiffScope): Promise<SarifImportResult>;

+73

-3

dist/remediation/localScan.js

		@@ -6,2 +6,3 @@ import { readFile } from 'node:fs/promises';
		import { resolveRelativeInside, resolveWorkspaceRoot } from '../core/workspace.js';
		import { isWithinDiffScope } from './diffScope.js';
		import { buildRemediationPrompt } from './sarif.js';
		@@ -27,2 +28,5 @@ const DEFAULT_IGNORES = [
		'*/.min.js',
		// Minifiers are not consistent about the separator, and `foo-min.js` is
		// common enough that missing it means reporting on vendored bundles.
		'*/-min.js',
		'*/-lock.json',
		@@ -32,3 +36,20 @@ '**/package-lock.json',
		'**/yarn.lock',
		// Vendored third-party code. Real findings here belong upstream, and the
		// reader of this report cannot act on them.
		'/vendor/',
		'/vendored/',
		'/third_party/',
		'/third-party/',
		];
		/**
		* Test code is not production attack surface: credentials in a test are
		* fixtures, `innerHTML` in a harness is teardown, and reporting on either
		* trains people to ignore the tool. Rules precise enough to mean a real leak
		* opt back in with `reportInTests`.
		*/
		const TEST_DIRECTORY = /(?:^\|\/)(?:tests?\|specs?\|__tests__\|__mocks__\|testdata)\//i;
		const TEST_FILENAME = /(?:^\|\/)[^/]*\.(?:test\|spec)\.[cm]?[jt]sx?$/i;
		function isTestPath(file) {
		return TEST_DIRECTORY.test(file) \|\| TEST_FILENAME.test(file);
		}
		const SCANNABLE_EXTENSIONS = new Set([
		@@ -57,2 +78,10 @@ '.cjs',
		const CONTEXT_RADIUS = 3;
		/**
		* A bare verb is not a statement: `'delete ' + name` is an HTTP message, not
		* SQL. Requiring the companion keyword — FROM, INTO, SET — is what separates a
		* query from an English sentence that happens to start with the same word.
		*/
		const SQL_STATEMENT = String.raw `(?:SELECT\b[^'"\`]\bFROM\|DELETE\b[^'"\`]\bFROM\|INSERT\b[^'"\`]\bINTO\|UPDATE\b[^'"\`]\bSET)`;
		const SQL_CONCATENATION = new RegExp(String.raw `['"\`]\s${SQL_STATEMENT}\b[^;\n]['"\`]\s*\+`
		+ String.raw `\|\+\s['"\`]\s${SQL_STATEMENT}\b`, 'i');
		const RULES = [
		@@ -78,2 +107,4 @@ {
		message: () => 'Possible AWS access key literal. Revoke the key if real and replace it with secret-managed credentials.',
		// A key in the shape of a real one is an incident wherever it is committed.
		reportInTests: true,
		},
		@@ -87,6 +118,18 @@ {
		helpUri: 'https://cwe.mitre.org/data/definitions/89.html',
		pattern: /['"`]\s(?:SELECT\|INSERT\|UPDATE\|DELETE)\b[^;\n]['"`]\s\+\|\+\s['"`]\s*(?:SELECT\|INSERT\|UPDATE\|DELETE)\b/i,
		pattern: SQL_CONCATENATION,
		message: () => 'SQL appears to be built with string concatenation. Use parameterized queries or a safe query builder.',
		},
		{
		id: 'dvalin/nosql-injection',
		name: 'NoSQL query built from untrusted input',
		severity: 'error',
		securitySeverity: '9.0',
		tags: ['security', 'nosql-injection', 'cwe-943'],
		helpUri: 'https://cwe.mitre.org/data/definitions/943.html',
		// `$where` runs JavaScript on the database server, so an interpolated or
		// concatenated value there is remote code execution, not just a bad query.
		pattern: /\$where\s:\s(?:`[^`]\$\{[^`]`\|['"][^'"]['"]\s\+)/,
		message: () => '$where runs JavaScript on the database server and this query interpolates a value into it. Use a structured query, or validate and cast the value first.',
		},
		{
		id: 'dvalin/dom-html-injection',
		@@ -141,2 +184,10 @@ name: 'Unsafe HTML injection sink',
		}
		/**
		* A line that only documents a risk — `// never eval() user input` — is not
		* the risk. Only whole-line comments are skipped, so trailing notes on real
		* code (`const x = eval(y); // FIXME`) still report.
		*/
		function isCommentLine(trimmed) {
		return /^(?:\/\/\|#\|\\|\/\)/.test(trimmed);
		}
		function isLikelyPlaceholder(line) {
		@@ -161,3 +212,3 @@ return /\b(example\|sample\|fixture\|placeholder\|dummy\|changeme\|fake\|invalid\|do[-_]?not[-_]?log\|your[-_]?key\|not[-_]?real\|test[-_]?only)\b/i.test(line);
		}
		export async function runLocalSecurityScan(cwd) {
		export async function runLocalSecurityScan(cwd, scope) {
		const root = await resolveWorkspaceRoot(cwd);
		@@ -173,2 +224,3 @@ const ignore = [...DEFAULT_IGNORES, ...(await loadIgnorePatterns(root))];
		.filter(isScannableFile)
		.filter(file => scope === undefined \|\| scope.files.has(file))
		.sort();
		@@ -184,4 +236,22 @@ const findings = [];
		}
		const rules = isTestPath(file) ? RULES.filter(rule => rule.reportInTests) : RULES;
		if (rules.length === 0)
		continue;
		const lines = content.split(/\r?\n/);
		let inBlockComment = false;
		for (const [lineIndex, line] of lines.entries()) {
		const trimmed = line.trim();
		const wasInBlockComment = inBlockComment;
		if (inBlockComment) {
		if (trimmed.includes('*/'))
		inBlockComment = false;
		}
		else if (trimmed.startsWith('/') && !trimmed.includes('/')) {
		inBlockComment = true;
		}
		if (wasInBlockComment \|\| isCommentLine(trimmed))
		continue;
		// After the comment state is updated, so a scoped scan cannot desync it.
		if (scope !== undefined && !isWithinDiffScope(scope, file, lineIndex + 1))
		continue;
		if (findings.length >= MAX_FINDINGS) {
		@@ -193,3 +263,3 @@ skippedResults += 1;
		continue;
		for (const rule of RULES) {
		for (const rule of rules) {
		const match = line.match(rule.pattern);
		@@ -196,0 +266,0 @@ if (!match)

+1

-1

dist/remediation/localScan.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"localScan.js","sourceRoot":"","sources":["../../src/remediation/localScan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAmD,MAAM,YAAY,CAAC;AAErG,MAAM,eAAe,GAAG;IACtB,YAAY;IACZ,oBAAoB;IACpB,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,aAAa;IACb,wBAAwB;IACxB,cAAc;IACd,YAAY;IACZ,qBAAqB;IACrB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,2BAA2B;IAC3B,aAAa;IACb,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,cAAc;CACf,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAClC,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,CAAC;AAazB,MAAM,KAAK,GAAgB;IACzB;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC;QACvC,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,qFAAqF;QAC9F,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,KAAK,CAAC,CAAC,CAAC,6EAA6E;KAChI;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QAC9C,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,yGAAyG;KACzH;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE,qCAAqC;QAC3C,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,CAAC;QAC9C,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,4GAA4G;QACrH,OAAO,EAAE,GAAG,EAAE,CAAC,uGAAuG;KACvH;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC;QACpC,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,yDAAyD;QAClE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,KAAK,CAAC,CAAC,CAAC,IAAI,yBAAyB,qDAAqD;KACzI;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,CAAC;QAC/C,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,GAAG,EAAE,CAAC,sGAAsG;KACtH;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE,gDAAgD;QACtD,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,mBAAmB,EAAE,SAAS,CAAC;QAClD,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,gEAAgE;QACzE,OAAO,EAAE,GAAG,EAAE,CAAC,8GAA8G;KAC9H;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,QAAQ,KAAK,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,KAAe;IACtC,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,UAAkB;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,cAAc,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,CAAC,CAAC;IAChE,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SAC3E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,kIAAkI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvJ,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAe,EAAE,KAAuB;IACvE,IAAI,IAAI,CAAC,EAAE,KAAK,yBAAyB;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACpD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;QAC9B,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,IAAI;QACf,MAAM;QACN,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;SACA,MAAM,CAAC,eAAe,CAAC;SACvB,IAAI,EAAE,CAAC;IAEV,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE3D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,cAAc,IAAI,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,IAAI,QAAQ,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBACpC,cAAc,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,IAAI,mBAAmB,CAAC,IAAI,CAAC;gBAAE,SAAS;YAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,SAAS;gBAEnD,YAAY,IAAI,CAAC,CAAC;gBAClB,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;gBAChC,MAAM,WAAW,GAAG;oBAClB,EAAE,EAAE,eAAe,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;oBAC9F,MAAM,EAAE,mBAAmB;oBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBAC5B,IAAI,EAAE,IAAI;oBACV,SAAS;oBACT,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC;iBACO,CAAC;gBAE/C,QAAQ,CAAC,IAAI,CAAC;oBACZ,GAAG,WAAW;oBACd,MAAM,EAAE,sBAAsB,CAAC,WAAW,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,mBAAmB;QAC3B,QAAQ;QACR,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}
		{"version":3,"file":"localScan.js","sourceRoot":"","sources":["../../src/remediation/localScan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAkB,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAmD,MAAM,YAAY,CAAC;AAErG,MAAM,eAAe,GAAG;IACtB,YAAY;IACZ,oBAAoB;IACpB,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,aAAa;IACb,wBAAwB;IACxB,cAAc;IACd,YAAY;IACZ,qBAAqB;IACrB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,2BAA2B;IAC3B,aAAa;IACb,wEAAwE;IACxE,qEAAqE;IACrE,aAAa;IACb,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,cAAc;IACd,yEAAyE;IACzE,4CAA4C;IAC5C,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,cAAc,GAAG,2DAA2D,CAAC;AACnF,MAAM,aAAa,GAAG,8CAA8C,CAAC;AAErE,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAClC,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,CAAC;AAezB;;;;GAIG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAA,gGAAgG,CAAC;AAEjI,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,MAAM,CAAC,GAAG,CAAA,YAAY,aAAa,sBAAsB;MACvD,MAAM,CAAC,GAAG,CAAA,kBAAkB,aAAa,IAAI,EAC/C,GAAG,CACJ,CAAC;AAEF,MAAM,KAAK,GAAgB;IACzB;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC;QACvC,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,qFAAqF;QAC9F,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,KAAK,CAAC,CAAC,CAAC,6EAA6E;KAChI;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QAC9C,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,yGAAyG;QACxH,4EAA4E;QAC5E,aAAa,EAAE,IAAI;KACpB;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE,qCAAqC;QAC3C,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,CAAC;QAC9C,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,uGAAuG;KACvH;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,wCAAwC;QAC9C,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,SAAS,CAAC;QAChD,OAAO,EAAE,iDAAiD;QAC1D,yEAAyE;QACzE,2EAA2E;QAC3E,OAAO,EAAE,wDAAwD;QACjE,OAAO,EAAE,GAAG,EAAE,CAAC,0JAA0J;KAC1K;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC;QACpC,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,yDAAyD;QAClE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,KAAK,CAAC,CAAC,CAAC,IAAI,yBAAyB,qDAAqD;KACzI;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,CAAC;QAC/C,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,GAAG,EAAE,CAAC,sGAAsG;KACtH;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE,gDAAgD;QACtD,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,KAAK;QACvB,IAAI,EAAE,CAAC,UAAU,EAAE,mBAAmB,EAAE,SAAS,CAAC;QAClD,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,gEAAgE;QACzE,OAAO,EAAE,GAAG,EAAE,CAAC,8GAA8G;KAC9H;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,QAAQ,KAAK,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,KAAe;IACtC,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAe,EAAE,UAAkB;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,cAAc,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,CAAC,CAAC;IAChE,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SAC3E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,kIAAkI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvJ,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAe,EAAE,KAAuB;IACvE,IAAI,IAAI,CAAC,EAAE,KAAK,yBAAyB;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW,EAAE,KAAiB;IACvE,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;QAC9B,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,IAAI;QACf,MAAM;QACN,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;SACA,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAC5D,IAAI,EAAE,CAAC;IAEV,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE3D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,cAAc,IAAI,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,iBAAiB,GAAG,cAAc,CAAC;YACzC,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,cAAc,GAAG,KAAK,CAAC;YACrD,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,iBAAiB,IAAI,aAAa,CAAC,OAAO,CAAC;gBAAE,SAAS;YAE1D,yEAAyE;YACzE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,GAAG,CAAC,CAAC;gBAAE,SAAS;YAEpF,IAAI,QAAQ,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBACpC,cAAc,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,IAAI,mBAAmB,CAAC,IAAI,CAAC;gBAAE,SAAS;YAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,SAAS;gBAEnD,YAAY,IAAI,CAAC,CAAC;gBAClB,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;gBAChC,MAAM,WAAW,GAAG;oBAClB,EAAE,EAAE,eAAe,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;oBAC9F,MAAM,EAAE,mBAAmB;oBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBAC5B,IAAI,EAAE,IAAI;oBACV,SAAS;oBACT,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC;iBACO,CAAC;gBAE/C,QAAQ,CAAC,IAAI,CAAC;oBACZ,GAAG,WAAW;oBACd,MAAM,EAAE,sBAAsB,CAAC,WAAW,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,mBAAmB;QAC3B,QAAQ;QACR,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}

+6

-0

dist/remediation/sarif.d.ts

		export type RemediationFinding = {
		id: string;
		source: string;
		/**
		* The fleet engine that produced this finding, stamped by the suite. Absent
		* for SARIF imported from a tool outside the fleet, where no engine of ours
		* can be said to have covered it.
		*/
		scanner?: 'builtin' \| 'semgrep' \| 'trivy' \| 'osv-scanner';
		ruleId: string;
		@@ -5,0 +11,0 @@ ruleName?: string;

+36

-14

dist/remediation/sarif.js

		import { readFile } from 'node:fs/promises';
		import path from 'node:path';
		import { resolveInsideWorkspace } from '../core/workspace.js';
		import { fileURLToPath } from 'node:url';
		import { resolveInsideWorkspace, resolveWorkspaceRoot } from '../core/workspace.js';
		const MAX_FINDINGS = 200;
		@@ -31,15 +32,19 @@ const CONTEXT_RADIUS = 4;
		}
		function normalizeSarifPath(uri, cwd) {
		async function normalizeSarifPath(uri, cwd) {
		if (!uri)
		return undefined;
		const trimmed = uri.trim();
		if (!trimmed \|\| trimmed.includes('\0') \|\| trimmed.startsWith('http:') \|\| trimmed.startsWith('https:')) {
		if (!trimmed \|\| trimmed.includes('\0')) {
		return undefined;
		}
		const withoutFileScheme = trimmed.startsWith('file://')
		? trimmed.replace(/^file:\/+/, '/')
		: trimmed;
		let decoded;
		try {
		decoded = decodeURIComponent(withoutFileScheme);
		if (/^file:/i.test(trimmed))
		decoded = fileURLToPath(trimmed);
		else {
		const looksLikeWindowsPath = path.win32.isAbsolute(trimmed);
		if (!looksLikeWindowsPath && /^[a-z][a-z0-9+.-]*:/i.test(trimmed))
		return undefined;
		decoded = decodeURIComponent(trimmed);
		}
		}
		@@ -50,10 +55,27 @@ catch {
		const normalized = path.normalize(decoded);
		if (path.isAbsolute(normalized) && cwd) {
		const relative = path.relative(path.resolve(cwd), normalized);
		if (!relative \|\| (!relative.startsWith('..') && !path.isAbsolute(relative))) {
		return (relative \|\| path.basename(normalized)).replace(/\\/g, '/');
		if (!cwd) {
		const portable = normalized.replace(/\\/g, '/');
		if (path.isAbsolute(normalized) \|\| path.win32.isAbsolute(normalized)
		\|\| portable === '..' \|\| portable.startsWith('../'))
		return undefined;
		return portable.replace(/^\.\//, '');
		}
		const root = await resolveWorkspaceRoot(cwd);
		if (path.win32.isAbsolute(normalized) && !path.isAbsolute(normalized))
		return undefined;
		const candidates = path.isAbsolute(normalized)
		? [path.relative(path.resolve(cwd), normalized), path.relative(root, normalized)]
		: [normalized];
		for (const candidate of new Set(candidates)) {
		try {
		const resolved = await resolveInsideWorkspace(root, candidate);
		const relative = path.relative(root, resolved).replace(/\\/g, '/');
		if (relative && relative !== '..' && !relative.startsWith('../'))
		return relative;
		}
		return undefined;
		catch {
		// Try the canonical-root-relative form before rejecting an absolute URI.
		}
		}
		return normalized.replace(/\\/g, '/');
		return undefined;
		}
		@@ -124,3 +146,3 @@ async function readSnippet(cwd, findingPath, startLine) {
		const physical = location?.physicalLocation;
		const findingPath = normalizeSarifPath(physical?.artifactLocation?.uri, opts.cwd);
		const findingPath = await normalizeSarifPath(physical?.artifactLocation?.uri, opts.cwd);
		if (!findingPath) {
		@@ -127,0 +149,0 @@ skippedResults += 1;

+1

-1

dist/remediation/sarif.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/remediation/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AA8F9D,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAe;IACtC,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,GAAa;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuB,EAAE,GAAY;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtG,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;QACnC,CAAC,CAAC,OAAO,CAAC;IACZ,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5E,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAuB,EAAE,WAAmB,EAAE,SAA6B;IACpG,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;QAC/D,OAAO,KAAK;aACT,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC;aACrB,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;aAC3E,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA2C;IAChF,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;QAC7B,CAAC,CAAC,uCAAuC,OAAO,CAAC,OAAO,YAAY;QACpE,CAAC,CAAC,2EAA2E,CAAC;IAEhF,OAAO;QACL,0BAA0B;QAC1B,EAAE;QACF,SAAS,OAAO,CAAC,MAAM,EAAE;QACzB,SAAS,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5E,aAAa,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,QAAQ,EAAE;QAC3D,aAAa,QAAQ,EAAE;QACvB,SAAS,IAAI,EAAE;QACf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7D,EAAE;QACF,UAAU;QACV,OAAO,CAAC,OAAO;QACf,OAAO;QACP,eAAe;QACf,qFAAqF;QACrF,4FAA4F;QAC5F,2EAA2E;QAC3E,0EAA0E;QAC1E,iHAAiH;KAClH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAe,EAAE,IAAI,GAAqB,EAAE;IACzF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,KAAK,GAAG,IAAgB,CAAC;IAC/B,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE3B,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAClE,YAAY,IAAI,CAAC,CAAC;YAClB,IAAI,QAAQ,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBACpC,cAAc,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,EAAE,gBAAgB,CAAC;YAC5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAClF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,cAAc,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,SAAS,GAAG,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;YAC9C,MAAM,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,EAAE,uBAAuB;mBAClE,MAAM,CAAC,mBAAmB,EAAE,qCAAqC;mBACjE,MAAM,CAAC,YAAY,EAAE,uBAAuB;mBAC5C,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC;YAElC,MAAM,WAAW,GAAG;gBAClB,EAAE,EAAE,eAAe,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBACvF,MAAM;gBACN,MAAM;gBACN,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,gBAAgB,EAAE,IAAI;gBACpD,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtC,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,IAAI,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;gBAC5F,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,kBAAkB;gBAC7G,IAAI,EAAE,WAAW;gBACjB,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,IAAI,EAAE,OAAO;gBACtB,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE;gBAClC,OAAO;aACqC,CAAC;YAE/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,WAAW;gBACd,MAAM,EAAE,sBAAsB,CAAC,WAAW,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,OAAO;QACtC,QAAQ;QACR,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}
		{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/remediation/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAoGpF,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAe;IACtC,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,GAAa;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAuB,EAAE,GAAY;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;aACzD,CAAC;YACJ,MAAM,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,oBAAoB,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpF,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAE3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;eAC/D,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvE,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5C,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACjB,KAAK,MAAM,SAAS,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACnE,IAAI,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAuB,EAAE,WAAmB,EAAE,SAA6B;IACpG,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;QAC/D,OAAO,KAAK;aACT,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC;aACrB,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;aAC3E,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA2C;IAChF,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;QAC7B,CAAC,CAAC,uCAAuC,OAAO,CAAC,OAAO,YAAY;QACpE,CAAC,CAAC,2EAA2E,CAAC;IAEhF,OAAO;QACL,0BAA0B;QAC1B,EAAE;QACF,SAAS,OAAO,CAAC,MAAM,EAAE;QACzB,SAAS,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5E,aAAa,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,QAAQ,EAAE;QAC3D,aAAa,QAAQ,EAAE;QACvB,SAAS,IAAI,EAAE;QACf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7D,EAAE;QACF,UAAU;QACV,OAAO,CAAC,OAAO;QACf,OAAO;QACP,eAAe;QACf,qFAAqF;QACrF,4FAA4F;QAC5F,2EAA2E;QAC3E,0EAA0E;QAC1E,iHAAiH;KAClH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAe,EAAE,IAAI,GAAqB,EAAE;IACzF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,KAAK,GAAG,IAAgB,CAAC;IAC/B,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE3B,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAClE,YAAY,IAAI,CAAC,CAAC;YAClB,IAAI,QAAQ,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBACpC,cAAc,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,EAAE,gBAAgB,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACxF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,cAAc,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,SAAS,GAAG,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;YAC9C,MAAM,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,EAAE,uBAAuB;mBAClE,MAAM,CAAC,mBAAmB,EAAE,qCAAqC;mBACjE,MAAM,CAAC,YAAY,EAAE,uBAAuB;mBAC5C,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC;YAElC,MAAM,WAAW,GAAG;gBAClB,EAAE,EAAE,eAAe,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBACvF,MAAM;gBACN,MAAM;gBACN,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,gBAAgB,EAAE,IAAI;gBACpD,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtC,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,IAAI,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;gBAC5F,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,kBAAkB;gBAC7G,IAAI,EAAE,WAAW;gBACjB,SAAS;gBACT,OAAO;gBACP,OAAO,EAAE,IAAI,EAAE,OAAO;gBACtB,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE;gBAClC,OAAO;aACqC,CAAC;YAE/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,WAAW;gBACd,MAAM,EAAE,sBAAsB,CAAC,WAAW,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,OAAO;QACtC,QAAQ;QACR,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}

+21

-0

dist/remediation/scannerSuite.d.ts

		@@ -0,3 +1,5 @@
		import { type DiffScope } from './diffScope.js';
		import { type RemediationFinding } from './sarif.js';
		export type DvalinScannerId = 'builtin' \| 'semgrep' \| 'trivy' \| 'osv-scanner';
		export declare const DVALIN_SCANNER_IDS: DvalinScannerId[];
		export type DvalinScannerDescriptor = {
		@@ -12,2 +14,8 @@ id: DvalinScannerId;
		};
		export type DvalinScannerInstallPlan = {
		scanner: DvalinScannerId;
		supported: boolean;
		command?: string;
		reason?: string;
		};
		export type DvalinScannerRun = DvalinScannerDescriptor & {
		@@ -39,7 +47,20 @@ status: 'completed' \| 'missing' \| 'error';
		metrics: DvalinScanMetrics;
		/** Set when the scan was narrowed to a diff; absent for a whole-workspace scan. */
		scope?: {
		ref: string;
		files: number;
		};
		};
		export declare function listDvalinScanners(): Promise<DvalinScannerDescriptor[]>;
		/**
		* Return a reviewable install plan. Dvalin never downloads or executes an
		* installer merely because a scan discovered that an optional engine is absent.
		*/
		export declare function dvalinScannerInstallPlan(id: DvalinScannerId): DvalinScannerInstallPlan;
		/** Execute a previously reviewed, fixed installer argv under the resolved policy. */
		export declare function installDvalinScanner(cwd: string, id: DvalinScannerId): Promise<void>;
		export declare function runDvalinScanSuite(cwd: string, options?: {
		scanners?: DvalinScannerId[];
		timeoutMs?: number;
		scope?: DiffScope;
		}): Promise<DvalinScanSuiteResult>;

+65

-4

dist/remediation/scannerSuite.js

		@@ -8,4 +8,6 @@ import { access, mkdir, readFile, rm } from 'node:fs/promises';
		import { resolveWorkspaceRoot } from '../core/workspace.js';
		import { isWithinDiffScope } from './diffScope.js';
		import { runLocalSecurityScan } from './localScan.js';
		import { parseSarifForRemediation } from './sarif.js';
		export const DVALIN_SCANNER_IDS = ['builtin', 'semgrep', 'trivy', 'osv-scanner'];
		const EXTERNAL_SCANNERS = [
		@@ -77,2 +79,43 @@ {
		}
		/**
		* Return a reviewable install plan. Dvalin never downloads or executes an
		* installer merely because a scan discovered that an optional engine is absent.
		*/
		export function dvalinScannerInstallPlan(id) {
		if (id === 'builtin') {
		return { scanner: id, supported: true, reason: 'Dvalin Built-in ships with the CLI; no installation is required.' };
		}
		const scanner = EXTERNAL_SCANNERS.find(candidate => candidate.descriptor.id === id);
		if (!scanner)
		return { scanner: id, supported: false, reason: `Unknown scanner: ${id}` };
		if (!scanner.descriptor.installCommand) {
		return { scanner: id, supported: false, reason: `No managed install command is available for ${scanner.descriptor.name}.` };
		}
		return { scanner: id, supported: true, command: scanner.descriptor.installCommand };
		}
		/** Execute a previously reviewed, fixed installer argv under the resolved policy. */
		export async function installDvalinScanner(cwd, id) {
		const launch = scannerInstaller(id);
		if (!launch) {
		if (id === 'builtin')
		return;
		throw new Error(`No managed installer is available for ${id}.`);
		}
		const policy = loadPolicy(cwd).policy;
		const commandLine = buildShellScript(launch.command, launch.args);
		const decision = checkCommand(policy, commandLine);
		if (!decision.allowed)
		throw new Error(`Scanner installation blocked by policy: ${decision.rule}`);
		const result = await runGovernedExecutable({
		...launch,
		cwd,
		timeoutMs: 600_000,
		policy,
		toolName: 'install_security_scanner',
		preferSandboxWhenUnrestricted: false,
		skipNetworkSandboxWhenPolicyAllows: true,
		});
		if (result.exitCode !== 0)
		throw new Error(result.output.trim() \|\| `${launch.command} exited ${result.exitCode}`);
		}
		export async function runDvalinScanSuite(cwd, options = {}) {
		@@ -88,4 +131,4 @@ const root = await resolveWorkspaceRoot(cwd);
		const t0 = Date.now();
		const result = await runLocalSecurityScan(root);
		findings.push(...result.findings);
		const result = await runLocalSecurityScan(root, options.scope);
		findings.push(...result.findings.map(finding => ({ ...finding, scanner: 'builtin' })));
		totalResults += result.totalResults;
		@@ -153,3 +196,5 @@ skippedResults += result.skippedResults;
		const result = await parseSarifForRemediation(report, { cwd: root });
		findings.push(...result.findings);
		// Stamp the engine here, where it is known. The delta needs it to tell
		// "we looked and it is gone" from "this engine never ran".
		findings.push(...result.findings.map(finding => ({ ...finding, scanner: scanner.descriptor.id })));
		totalResults += result.totalResults;
		@@ -173,3 +218,9 @@ skippedResults += result.skippedResults;
		}
		const deduped = dedupeFindings(findings);
		// The builtin scanner is narrowed before it reads anything, but the external
		// ones only take a root. Filtering here catches all of them at once, because
		// `normalizeSarifPath` has already made every path workspace-relative.
		const scoped = options.scope === undefined
		? findings
		: findings.filter(finding => isWithinDiffScope(options.scope, finding.path, finding.startLine));
		const deduped = dedupeFindings(scoped);
		const metrics = scanMetrics(deduped);
		@@ -189,2 +240,3 @@ const score = scoreFindings(metrics);
		metrics,
		...(options.scope === undefined ? {} : { scope: { ref: options.scope.ref, files: options.scope.files.size } }),
		};
		@@ -264,2 +316,11 @@ }
		}
		function scannerInstaller(id) {
		if (id === 'semgrep')
		return { command: 'python3', args: ['-m', 'pip', 'install', 'semgrep'] };
		if (id === 'trivy')
		return { command: 'brew', args: ['install', 'trivy'] };
		if (id === 'osv-scanner')
		return { command: 'brew', args: ['install', 'osv-scanner'] };
		return null;
		}
		//# sourceMappingURL=scannerSuite.js.map

+1

-1

dist/remediation/scannerSuite.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"scannerSuite.js","sourceRoot":"","sources":["../../src/remediation/scannerSuite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAA2B,MAAM,YAAY,CAAC;AAoD/E,MAAM,iBAAiB,GAAsB;IAC3C;QACE,UAAU,EAAE;YACV,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,0EAA0E;YACvF,cAAc,EAAE,gCAAgC;YAChD,QAAQ,EAAE,iDAAiD;SAC5D;QACD,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK;YAClF,WAAW,EAAE,gBAAgB,EAAE,IAAI;SACpC;QACD,iBAAiB,EAAE,CAAC,CAAC,CAAC;KACvB;IACD;QACE,UAAU,EAAE;YACV,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,iFAAiF;YAC9F,cAAc,EAAE,oBAAoB;YACpC,QAAQ,EAAE,kDAAkD;SAC7D;QACD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACtB,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,uBAAuB;YACpF,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM;YACrE,aAAa,EAAE,gBAAgB,EAAE,IAAI;SACtC;QACD,iBAAiB,EAAE,CAAC,CAAC,CAAC;KACvB;IACD;QACE,UAAU,EAAE;YACV,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,cAAc;YACxB,WAAW,EAAE,2EAA2E;YACxF,cAAc,EAAE,0BAA0B;YAC1C,QAAQ,EAAE,uCAAuC;SAClD;QACD,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI;SACpF;QACD,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC;QAC9B,kBAAkB,EAAE,IAAI;KACzB;CACF,CAAC;AAEF,MAAM,OAAO,GAA4B;IACvC,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,iBAAiB;IACvB,QAAQ,EAAE,SAAS;IACnB,WAAW,EAAE,uFAAuF;IACpG,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,4CAA4C;CACvD,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,CAAC;QACzE,GAAG,OAAO,CAAC,UAAU;QACrB,SAAS,EAAE,OAAO,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;KAC1D,CAAC,CAAC,CAAC,CAAC;IACL,OAAO,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,OAAO,GAAyD,EAAE;IAElE,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACvH,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACpC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC9D,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,kEAAkE,iBAAiB,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,SAAS;YACnD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzD,MAAM,UAAU,GAA4B,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACvE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,UAAU;oBACb,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC;oBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,KAAK,EAAE,sBAAsB,eAAe,CAAC,IAAI,EAAE;iBACpD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC;oBAChD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,IAAI;oBACJ,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;oBACvC,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,QAAQ,EAAE,oBAAoB;oBAC9B,6BAA6B,EAAE,IAAI;oBACnC,kCAAkC,EAAE,IAAI;iBACzC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,WAAW,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChH,CAAC;gBACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;oBACvC,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;wBAC5F,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAY,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAClC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;gBACpC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,UAAU;oBACb,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC;oBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO;QACL,EAAE,EAAE,QAAQ,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACzD,MAAM,EAAE,uBAAuB;QAC/B,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QACtB,QAAQ,EAAE,OAAO;QACjB,YAAY;QACZ,cAAc;QACd,QAAQ,EAAE,IAAI;QACd,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAA8B;IACjD,MAAM,OAAO,GAAsB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,CAAC;aAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC;;YACnE,OAAO,CAAC,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,QAA8B;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/G,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC7C,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,GAAG,SAAS,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,2BAA2B;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC"}
		{"version":3,"file":"scannerSuite.js","sourceRoot":"","sources":["../../src/remediation/scannerSuite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAkB,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAA2B,MAAM,YAAY,CAAC;AAI/E,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AA2DpG,MAAM,iBAAiB,GAAsB;IAC3C;QACE,UAAU,EAAE;YACV,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,0EAA0E;YACvF,cAAc,EAAE,gCAAgC;YAChD,QAAQ,EAAE,iDAAiD;SAC5D;QACD,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK;YAClF,WAAW,EAAE,gBAAgB,EAAE,IAAI;SACpC;QACD,iBAAiB,EAAE,CAAC,CAAC,CAAC;KACvB;IACD;QACE,UAAU,EAAE;YACV,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,iFAAiF;YAC9F,cAAc,EAAE,oBAAoB;YACpC,QAAQ,EAAE,kDAAkD;SAC7D;QACD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACtB,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,uBAAuB;YACpF,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM;YACrE,aAAa,EAAE,gBAAgB,EAAE,IAAI;SACtC;QACD,iBAAiB,EAAE,CAAC,CAAC,CAAC;KACvB;IACD;QACE,UAAU,EAAE;YACV,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,cAAc;YACxB,WAAW,EAAE,2EAA2E;YACxF,cAAc,EAAE,0BAA0B;YAC1C,QAAQ,EAAE,uCAAuC;SAClD;QACD,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI;SACpF;QACD,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC;QAC9B,kBAAkB,EAAE,IAAI;KACzB;CACF,CAAC;AAEF,MAAM,OAAO,GAA4B;IACvC,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,iBAAiB;IACvB,QAAQ,EAAE,SAAS;IACnB,WAAW,EAAE,uFAAuF;IACpG,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,4CAA4C;CACvD,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,CAAC;QACzE,GAAG,OAAO,CAAC,UAAU;QACrB,SAAS,EAAE,OAAO,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;KAC1D,CAAC,CAAC,CAAC,CAAC;IACL,OAAO,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAmB;IAC1D,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACtH,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC;IACzF,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;AACtF,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW,EAAE,EAAmB;IACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO;QAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,GAAG,MAAM;QACT,GAAG;QACH,SAAS,EAAE,OAAO;QAClB,MAAM;QACN,QAAQ,EAAE,0BAA0B;QACpC,6BAA6B,EAAE,KAAK;QACpC,kCAAkC,EAAE,IAAI;KACzC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,OAAO,GAA4E,EAAE;IAErF,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACvH,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;QAChG,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACpC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC9D,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,kEAAkE,iBAAiB,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,SAAS;YACnD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzD,MAAM,UAAU,GAA4B,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACvE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,UAAU;oBACb,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC;oBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,KAAK,EAAE,sBAAsB,eAAe,CAAC,IAAI,EAAE;iBACpD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC;oBAChD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,IAAI;oBACJ,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;oBACvC,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,QAAQ,EAAE,oBAAoB;oBAC9B,6BAA6B,EAAE,IAAI;oBACnC,kCAAkC,EAAE,IAAI;iBACzC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,WAAW,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChH,CAAC;gBACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;oBACvC,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;wBAC5F,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAY,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,uEAAuE;gBACvE,2DAA2D;gBAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnG,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;gBACpC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,UAAU;oBACb,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,CAAC;oBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS;QACxC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO;QACL,EAAE,EAAE,QAAQ,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACzD,MAAM,EAAE,uBAAuB;QAC/B,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QACtB,QAAQ,EAAE,OAAO;QACjB,YAAY;QACZ,cAAc;QACd,QAAQ,EAAE,IAAI;QACd,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;KAC/G,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAA8B;IACjD,MAAM,OAAO,GAAsB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,CAAC;aAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC;;YACnE,OAAO,CAAC,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,QAA8B;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/G,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC7C,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,GAAG,SAAS,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,2BAA2B;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAmB;IAC3C,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;IAC/F,IAAI,EAAE,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAC3E,IAAI,EAAE,KAAK,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC"}

+19

-0

dist/server/routes/remediation.d.ts

		@@ -0,1 +1,20 @@
		import { type Request, type Response } from 'express';
		import { executeSecurityScan } from '../../commands/security.js';
		import { upsertRemediationCases } from '../../remediation/cases.js';
		import { consumeScannerWorkspaceGrant } from '../scannerWorkspaceGrants.js';
		export declare const remediationRouter: import("express-serve-static-core").Router;
		export type SuiteRouteDeps = {
		executeScan: typeof executeSecurityScan;
		consumeGrant: typeof consumeScannerWorkspaceGrant;
		upsertCases: typeof upsertRemediationCases;
		};
		/**
		* Server adapter for the versioned security scan contract.
		*
		* The scan is intentionally still spread at the top level: the current web
		* client consumes that legacy shape. The versioned envelope is added beside
		* it so newer clients can reason about coverage and the gate without breaking
		* existing ones.
		*/
		export declare function handleSuiteRequest(req: Request, res: Response, deps?: SuiteRouteDeps): Promise<void>;
		export declare function handleVerifyFixRequest(req: Request, res: Response): void;

+90

-18

dist/server/routes/remediation.js

		import { Router } from 'express';
		import { executeSecurityScan } from '../../commands/security.js';
		import { UsageError } from '../../core/exitCodes.js';
		import { listRemediationCases, updateRemediationCase, upsertRemediationCases } from '../../remediation/cases.js';
		@@ -6,38 +8,108 @@ import { runLocalSecurityScan } from '../../remediation/localScan.js';
		import { createRemediationWorktree } from '../../remediation/worktree.js';
		import { listDvalinScanners, runDvalinScanSuite } from '../../remediation/scannerSuite.js';
		import { dvalinScannerInstallPlan, installDvalinScanner, listDvalinScanners, } from '../../remediation/scannerSuite.js';
		import { verifyFixRecord } from '../../security/fixRecord.js';
		import { allowWorkspaceRoot, resolveAllowedCwd } from '../security.js';
		import { consumeScannerWorkspaceGrant, issueScannerWorkspaceGrant } from '../scannerWorkspaceGrants.js';
		export const remediationRouter = Router();
		const suiteRouteDeps = {
		executeScan: executeSecurityScan,
		consumeGrant: consumeScannerWorkspaceGrant,
		upsertCases: upsertRemediationCases,
		};
		/**
		* Server adapter for the versioned security scan contract.
		*
		* The scan is intentionally still spread at the top level: the current web
		* client consumes that legacy shape. The versioned envelope is added beside
		* it so newer clients can reason about coverage and the gate without breaking
		* existing ones.
		*/
		export async function handleSuiteRequest(req, res, deps = suiteRouteDeps) {
		const body = req.body;
		try {
		const allowedScanners = new Set(['builtin', 'semgrep', 'trivy', 'osv-scanner']);
		if (body.scanners && (!Array.isArray(body.scanners) \|\| body.scanners.some(scanner => !allowedScanners.has(scanner)))) {
		res.status(400).json({ error: 'scanners must contain only builtin, semgrep, trivy, or osv-scanner' });
		return;
		}
		// The capability is consumed before any scan input is used. Its canonical
		// server-side cwd remains the only workspace root passed to the scanner.
		const cwd = deps.consumeGrant(body.grant);
		const execution = await deps.executeScan({
		root: cwd,
		scanners: body.scanners,
		saveWorkflow: false,
		});
		const cases = execution.scan.findings.length
		? await deps.upsertCases({ cwd, findings: execution.scan.findings })
		: [];
		const response = {
		...execution.scan,
		scan: execution.scan,
		coverage: execution.coverage,
		delta: execution.delta ?? null,
		gate: execution.gate,
		workflowId: execution.workflow?.id ?? null,
		schemaVersion: execution.schemaVersion,
		cases,
		};
		res.json(response);
		}
		catch (err) {
		// A new-findings gate without a baseline is a bad request, not a scanner
		// crash. Preserve UsageError text so the caller sees the baseline remedy.
		if (err instanceof UsageError) {
		res.status(400).json({ error: err.message });
		return;
		}
		res.status(400).json({ error: err instanceof Error ? err.message : 'Could not run Dvalin security suite' });
		}
		}
		export function handleVerifyFixRequest(req, res) {
		const verification = verifyFixRecord(req.body);
		res.json({
		ok: verification.ok,
		reasons: verification.reasons,
		record: verification.record ?? null,
		});
		}
		remediationRouter.get('/scanners', async (_req, res) => {
		res.json(await listDvalinScanners());
		});
		remediationRouter.post('/suite/authorize', async (req, res) => {
		remediationRouter.post('/scanners/install', async (req, res) => {
		const body = req.body;
		const allowed = new Set(['semgrep', 'trivy', 'osv-scanner']);
		if (!body.scanner \|\| !allowed.has(body.scanner)) {
		res.status(400).json({ error: 'scanner must be semgrep, trivy, or osv-scanner' });
		return;
		}
		const plan = dvalinScannerInstallPlan(body.scanner);
		if (!plan.command \|\| body.confirmed !== true \|\| body.command !== plan.command) {
		res.status(400).json({ error: 'The fixed scanner install command must be explicitly confirmed.' });
		return;
		}
		try {
		const cwd = await resolveAllowedCwd(body.cwd);
		res.json({ grant: issueScannerWorkspaceGrant(cwd) });
		await installDvalinScanner(cwd, body.scanner);
		const scanner = (await listDvalinScanners()).find(candidate => candidate.id === body.scanner);
		if (!scanner?.available)
		throw new Error(`${body.scanner} completed installation but is not available on PATH.`);
		res.json(scanner);
		}
		catch (err) {
		res.status(403).json({ error: err instanceof Error ? err.message : 'Workspace is not allowed' });
		catch (error) {
		res.status(400).json({ error: error instanceof Error ? error.message : 'Could not install scanner' });
		}
		});
		remediationRouter.post('/suite', async (req, res) => {
		remediationRouter.post('/suite/authorize', async (req, res) => {
		const body = req.body;
		try {
		const allowedScanners = new Set(['builtin', 'semgrep', 'trivy', 'osv-scanner']);
		if (body.scanners && (!Array.isArray(body.scanners) \|\| body.scanners.some(scanner => !allowedScanners.has(scanner)))) {
		res.status(400).json({ error: 'scanners must contain only builtin, semgrep, trivy, or osv-scanner' });
		return;
		}
		const cwd = consumeScannerWorkspaceGrant(body.grant);
		const result = await runDvalinScanSuite(cwd, { scanners: body.scanners });
		const cases = result.findings.length
		? await upsertRemediationCases({ cwd, findings: result.findings })
		: [];
		res.json({ ...result, cases });
		const cwd = await resolveAllowedCwd(body.cwd);
		res.json({ grant: issueScannerWorkspaceGrant(cwd) });
		}
		catch (err) {
		res.status(400).json({ error: err instanceof Error ? err.message : 'Could not run Dvalin security suite' });
		res.status(403).json({ error: err instanceof Error ? err.message : 'Workspace is not allowed' });
		}
		});
		remediationRouter.post('/suite', (req, res) => void handleSuiteRequest(req, res));
		remediationRouter.post('/verify-fix', handleVerifyFixRequest);
		remediationRouter.get('/cases', async (req, res) => {
		@@ -44,0 +116,0 @@ try {

+1

-1

dist/server/routes/remediation.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../../src/server/routes/remediation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACjH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAwB,MAAM,mCAAmC,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAExG,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC;AAE1C,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACrD,GAAG,CAAC,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwB,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwD,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACjG,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;YAClC,CAAC,CAAC,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG;YAC5D,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA4C,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAoE,EAAE,CAAC,CAAC,CAAC;IACvI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAmD,CAAC,CAAC,CAAC;IAChH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA0C,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwB,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoG,CAAC;IACtH,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE;gBACvC,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,MAAM,CAAC,GAAG;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,EAAE,CAAC,CAAC;IAChH,CAAC;AACH,CAAC,CAAC,CAAC"}
		{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../../src/server/routes/remediation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAA6B,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACjH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAExG,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC;AAQ1C,MAAM,cAAc,GAAmB;IACrC,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,4BAA4B;IAC1C,WAAW,EAAE,sBAAsB;CACpC,CAAC;AAiBF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,GAAa,EACb,IAAI,GAAmB,cAAc;IAErC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwB,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACjG,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;YACvC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAkB;YAC9B,GAAG,SAAS,CAAC,IAAI;YACjB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI;YAC9B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,IAAI;YAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,KAAK;SACN,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,GAAa;IAChE,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,YAAY,CAAC,EAAE;QACnB,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,IAAI;KACpC,CAAC,CAAC;AACL,CAAC;AAED,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACrD,GAAG,CAAC,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,IAA0F,CAAC;IAC5G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;QACnG,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9F,IAAI,CAAC,OAAO,EAAE,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,uDAAuD,CAAC,CAAC;QACjH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACxG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwB,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAElF,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;AAE9D,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG;YAC5D,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA4C,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAoE,EAAE,CAAC,CAAC,CAAC;IACvI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAmD,CAAC,CAAC,CAAC;IAChH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA0C,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwB,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoG,CAAC;IACtH,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE;gBACvC,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,MAAM,CAAC,GAAG;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,EAAE,CAAC,CAAC;IAChH,CAAC;AACH,CAAC,CAAC,CAAC"}

+6

-0

dist/tools/runCheck.d.ts

		@@ -17,2 +17,8 @@ import { z } from 'zod';
		export declare const runCheckTool: Tool<Input>;
		export type CheckKind = Exclude<Input['kind'], 'custom'>;
		export type PickedCommand = {
		command: string;
		args: string[];
		};
		export declare function pickProjectCheck(cwd: string, kind: CheckKind, extraArgs: string[]): Promise<PickedCommand \| null>;
		export {};

+1

-1

dist/tools/runCheck.js

		@@ -77,3 +77,3 @@ import { stat } from 'node:fs/promises';
		}
		async function pickProjectCheck(cwd, kind, extraArgs) {
		export async function pickProjectCheck(cwd, kind, extraArgs) {
		const scripts = await detectScripts(cwd);
		@@ -80,0 +80,0 @@ const scriptNames = preferredScriptNames(kind);

+1

-1

dist/tools/runCheck.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"runCheck.js","sourceRoot":"","sources":["../../src/tools/runCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,qIAAqI;IAClJ,MAAM,EAAE,SAAS;IACjB,WAAW;IACX,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK;IAEvB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ;YACpC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,MAAM,KAAK,CAAC,IAAI,yHAAyH;gBACjJ,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;aAC9C,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gBACpB,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC;aACzC,CAAC,CAAC;YACH,MAAM,IAAI,oBAAoB,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,WAAW;YACrB,6BAA6B,EAAE,IAAI;YACnC,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,aAAa,KAAK,CAAC,IAAI,EAAE;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,aAAa;YACtC,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,kBAAkB,EAAE,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;aAC5E;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAIF,SAAS,UAAU,CAAC,KAAY;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAsC,EAAE,SAAmB;IACtG,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,EAAE,KAAK,MAAM;YAClB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,EAAE;YACxD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAsC;IAClE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC/B,KAAK,WAAW;YACd,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,OAAO;YACV,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAW;IAC7C,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
		{"version":3,"file":"runCheck.js","sourceRoot":"","sources":["../../src/tools/runCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,qIAAqI;IAClJ,MAAM,EAAE,SAAS;IACjB,WAAW;IACX,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK;IAEvB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ;YACpC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,MAAM,KAAK,CAAC,IAAI,yHAAyH;gBACjJ,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;aAC9C,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gBACpB,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC;aACzC,CAAC,CAAC;YACH,MAAM,IAAI,oBAAoB,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,WAAW;YACrB,6BAA6B,EAAE,IAAI;YACnC,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,aAAa,KAAK,CAAC,IAAI,EAAE;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,aAAa;YACtC,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,kBAAkB,EAAE,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;aAC5E;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAMF,SAAS,UAAU,CAAC,KAAY;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAe,EAAE,SAAmB;IACtF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,EAAE,KAAK,MAAM;YAClB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,EAAE;YACxD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAe;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC/B,KAAK,WAAW;YACd,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,OAAO;YACV,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAW;IAC7C,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

+3

-0

dist/tools/runSecuritySuite.d.ts

		import { z } from 'zod';
		import type { DvalinScanSuiteResult } from '../remediation/scannerSuite.js';
		import { type SecurityCoverage } from '../security/contracts.js';
		import type { Tool } from './types.js';
		@@ -13,3 +15,4 @@ declare const inputSchema: z.ZodObject<{
		type Input = z.infer<typeof inputSchema>;
		export declare function renderSecuritySuiteToolOutput(result: DvalinScanSuiteResult, coverage?: SecurityCoverage): string;
		export declare const runSecuritySuiteTool: Tool<Input>;
		export {};

+18

-11

dist/tools/runSecuritySuite.js

		import { z } from 'zod';
		import { runDvalinScanSuite } from '../remediation/scannerSuite.js';
		import { upsertRemediationCases } from '../remediation/cases.js';
		import { deriveCoverage } from '../security/contracts.js';
		import { renderCoverage } from '../security/render.js';
		const inputSchema = z.object({
		@@ -8,2 +10,15 @@ scanners: z.array(z.enum(['builtin', 'semgrep', 'trivy', 'osv-scanner'])).optional(),
		}).strict();
		export function renderSecuritySuiteToolOutput(result, coverage = deriveCoverage(result)) {
		const scannerSummary = result.scanners
		.map(scanner => `${scanner.name}: ${scanner.status}${scanner.status === 'completed' ? ` (${scanner.findings})` : ''}`)
		.join(' · ');
		return [
		`Security health: ${result.score}/100 (${result.grade})`,
		scannerSummary,
		`Findings: ${result.findings.length} · Critical: ${result.metrics.critical} · High: ${result.metrics.high} · Medium: ${result.metrics.medium}`,
		renderCoverage(coverage),
		...result.findings.slice(0, 20).map((finding, index) => `${index + 1}. ${finding.ruleId} — ${finding.path}${finding.startLine ? `:${finding.startLine}` : ''}\n ${finding.message}`),
		result.findings.length > 20 ? `… ${result.findings.length - 20} more findings persisted as remediation cases.` : '',
		].filter(Boolean).join('\n');
		}
		export const runSecuritySuiteTool = {
		@@ -20,15 +35,7 @@ name: 'run_security_suite',
		: [];
		const scannerSummary = result.scanners
		.map(scanner => `${scanner.name}: ${scanner.status}${scanner.status === 'completed' ? ` (${scanner.findings})` : ''}`)
		.join(' · ');
		const coverage = deriveCoverage(result);
		return {
		title: `Dvalin security grade ${result.grade}`,
		output: [
		`Security health: ${result.score}/100 (${result.grade})`,
		scannerSummary,
		`Findings: ${result.findings.length} · Critical: ${result.metrics.critical} · High: ${result.metrics.high} · Medium: ${result.metrics.medium}`,
		...result.findings.slice(0, 20).map((finding, index) => `${index + 1}. ${finding.ruleId} — ${finding.path}${finding.startLine ? `:${finding.startLine}` : ''}\n ${finding.message}`),
		result.findings.length > 20 ? `… ${result.findings.length - 20} more findings persisted as remediation cases.` : '',
		].filter(Boolean).join('\n'),
		metadata: { ...result, cases },
		output: renderSecuritySuiteToolOutput(result, coverage),
		metadata: { ...result, coverage, cases },
		};
		@@ -35,0 +42,0 @@ },

+1

-1

dist/tools/runSecuritySuite.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"runSecuritySuite.js","sourceRoot":"","sources":["../../src/tools/runSecuritySuite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACxC,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAC/C,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,wIAAwI;IACrJ,MAAM,EAAE,SAAS;IACjB,WAAW;IACX,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;YACxD,CAAC,CAAC,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/E,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ;aACnC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;aACrH,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,OAAO;YACL,KAAK,EAAE,yBAAyB,MAAM,CAAC,KAAK,EAAE;YAC9C,MAAM,EAAE;gBACN,oBAAoB,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,KAAK,GAAG;gBACxD,cAAc;gBACd,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,gBAAgB,MAAM,CAAC,OAAO,CAAC,QAAQ,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE;gBAC9I,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACrD,GAAG,KAAK,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,gDAAgD,CAAC,CAAC,CAAC,EAAE;aACpH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;SAC/B,CAAC;IACJ,CAAC;CACF,CAAC"}
		{"version":3,"file":"runSecuritySuite.js","sourceRoot":"","sources":["../../src/tools/runSecuritySuite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAyB,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACxC,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,MAAM,UAAU,6BAA6B,CAC3C,MAA6B,EAC7B,QAAQ,GAAqB,cAAc,CAAC,MAAM,CAAC;IAEnD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ;SACnC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACrH,IAAI,CAAC,KAAK,CAAC,CAAC;IACf,OAAO;QACL,oBAAoB,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,KAAK,GAAG;QACxD,cAAc;QACd,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,gBAAgB,MAAM,CAAC,OAAO,CAAC,QAAQ,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE;QAC9I,cAAc,CAAC,QAAQ,CAAC;QACxB,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACrD,GAAG,KAAK,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,OAAO,CAAC,OAAO,EAAE,CAAC;QAChI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,gDAAgD,CAAC,CAAC,CAAC,EAAE;KACpH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAC/C,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,wIAAwI;IACrJ,MAAM,EAAE,SAAS;IACjB,WAAW;IACX,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;YACxD,CAAC,CAAC,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/E,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO;YACL,KAAK,EAAE,yBAAyB,MAAM,CAAC,KAAK,EAAE;YAC9C,MAAM,EAAE,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC;YACvD,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;SACzC,CAAC;IACJ,CAAC;CACF,CAAC"}

+21

-2

dist/tui/app.js

		@@ -6,2 +6,3 @@ import readline from 'node:readline';
		import { readConfig, writeConfig } from '../server/configStore.js';
		import { renderFixRecordVerification, verifyFixRecordFile } from '../security/fixRecordFile.js';
		import { PROVIDER_PRESETS, findPreset } from './presets.js';
		@@ -142,3 +143,3 @@ import * as R from './render.js';
		/** Returns true if handled locally; false to forward to the agent (e.g. /git). */
		function handleLocal(line) {
		async function handleLocal(line) {
		if (isExitCommand(line)) {
		@@ -168,2 +169,20 @@ shutdown();
		return true;
		case 'verify-fix':
		if (!arg) {
		process.stdout.write(chalk.red(' usage: /verify-fix <record.json>\n'));
		return true;
		}
		try {
		const check = await verifyFixRecordFile(arg, cwd);
		if (!check.record) {
		process.stdout.write(chalk.red(` error: not a Dvalin fix record: ${check.path}\n`));
		}
		else {
		process.stdout.write(R.formatToolResult(renderFixRecordVerification(check)) + '\n');
		}
		}
		catch (error) {
		process.stdout.write(chalk.red(` error: ${error instanceof Error ? error.message : String(error)}\n`));
		}
		return true;
		default:
		@@ -183,3 +202,3 @@ return false; // /git /plan /compact /undo → handled by the agent loop
		continue;
		if (handleLocal(line))
		if (await handleLocal(line))
		continue;
		@@ -186,0 +205,0 @@ await runTurn(line);

+1

-1

dist/tui/app.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/tui/app.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAMjC;6DAC6D;AAC7D,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAI,GAAe,EAAE;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,IAAI,GAAc,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IAC1C,IAAI,kBAAkB,GAAuB,KAAK,CAAC;IACnD,IAAI,SAA6B,CAAC;IAClC,IAAI,WAAW,GAA2B,IAAI,CAAC;IAC/C,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAY,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,OAAO,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACzD,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IAED,IAAI,aAAa,GAAG,cAAc,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,eAAe,EAAE,CAAC;QAClC,aAAa,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEjF,+DAA+D;IAC/D,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnB,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,kBAAkB,EAAE,CAAC;gBACvB,SAAS,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC;YAC1B,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAClB,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,eAAe,GAAG,KAAK,EAAE,GAAW,EAAE,QAAgB,EAAE,KAAc,EAAoB,EAAE;QAChG,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/F,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,KAAK,UAAU,OAAO,CAAC,OAAe;QACpC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,WAAW,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAQ,EAAE;YAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,aAAa;oBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACpC,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM;gBACR,KAAK,WAAW;oBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC9E,MAAM;gBACR,KAAK,aAAa;oBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC9D,MAAM;gBACR,KAAK,YAAY;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;oBACxE,MAAM;YACV,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAC7B,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAC1F,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;YACF,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,+BAA+B,CAAC,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,WAAW,GAAG,IAAI,CAAC;YACnB,kBAAkB,GAAG,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,GAAW;QAC7B,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrE,IAAI,GAAG,CAAC,CAAC;YACT,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;gBACjB,kBAAkB,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAuB,CAAC;YAChH,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,kBAAkB,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,SAAS,WAAW,CAAC,IAAY;QAC/B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC;YACZ,KAAK,MAAM;gBACT,QAAQ,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,KAAK,OAAO;gBACV,SAAS,GAAG,SAAS,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACrD,OAAO,IAAI,CAAC;YACd,KAAK,MAAM;gBACT,UAAU,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,KAAK,MAAM;gBACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,KAAK,CAAC,CAAC,wDAAwD;QAC1E,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,iDAAiD;IACjD,OAAO,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,WAAW,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;qEACqE;AACrE,KAAK,UAAU,gBAAgB,CAC7B,EAAsB,EACtB,GAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC1C,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAE1F,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC5D,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAE,CAAC;IAEjE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,YAAY,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC;IACpE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC;IAExD,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;KAC1F,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,SAAS,CAAC,EAAsB,EAAE,KAAa;IACtD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,KAAK,GAAG,EAAyD,CAAC;QACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QACtC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;YACvC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,QAAQ,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QACD,sEAAsE;QACtE,KAAK,CAAC,cAAc,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACd,EAAsB,EACtB,KAAa,EACb,QAAuB,EACvB,MAAoB;IAEpB,IAAI,QAAQ,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;YACvC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,CAAC;AAC1G,CAAC"}
		{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/tui/app.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAMjC;6DAC6D;AAC7D,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAI,GAAe,EAAE;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,IAAI,GAAc,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IAC1C,IAAI,kBAAkB,GAAuB,KAAK,CAAC;IACnD,IAAI,SAA6B,CAAC;IAClC,IAAI,WAAW,GAA2B,IAAI,CAAC;IAC/C,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAY,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,OAAO,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACzD,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IAED,IAAI,aAAa,GAAG,cAAc,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,eAAe,EAAE,CAAC;QAClC,aAAa,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEjF,+DAA+D;IAC/D,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnB,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,kBAAkB,EAAE,CAAC;gBACvB,SAAS,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC;YAC1B,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAClB,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,eAAe,GAAG,KAAK,EAAE,GAAW,EAAE,QAAgB,EAAE,KAAc,EAAoB,EAAE;QAChG,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/F,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,KAAK,UAAU,OAAO,CAAC,OAAe;QACpC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,WAAW,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAQ,EAAE;YAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,aAAa;oBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACpC,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM;gBACR,KAAK,WAAW;oBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC9E,MAAM;gBACR,KAAK,aAAa;oBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC9D,MAAM;gBACR,KAAK,YAAY;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;oBACxE,MAAM;YACV,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAC7B,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAC1F,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;YACF,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,+BAA+B,CAAC,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,WAAW,GAAG,IAAI,CAAC;YACnB,kBAAkB,GAAG,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,GAAW;QAC7B,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrE,IAAI,GAAG,CAAC,CAAC;YACT,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;gBACjB,kBAAkB,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAuB,CAAC;YAChH,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,kBAAkB,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,UAAU,WAAW,CAAC,IAAY;QACrC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC;YACZ,KAAK,MAAM;gBACT,QAAQ,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,KAAK,OAAO;gBACV,SAAS,GAAG,SAAS,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACrD,OAAO,IAAI,CAAC;YACd,KAAK,MAAM;gBACT,UAAU,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,KAAK,MAAM;gBACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,KAAK,YAAY;gBACf,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC,CAAC;oBACxE,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAClD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;wBAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;oBACvF,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;oBACtF,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1G,CAAC;gBACD,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,KAAK,CAAC,CAAC,wDAAwD;QAC1E,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,iDAAiD;IACjD,OAAO,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,MAAM,WAAW,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;qEACqE;AACrE,KAAK,UAAU,gBAAgB,CAC7B,EAAsB,EACtB,GAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC1C,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAE1F,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC5D,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAE,CAAC;IAEjE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,YAAY,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC;IACpE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC;IAExD,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;KAC1F,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,SAAS,CAAC,EAAsB,EAAE,KAAa;IACtD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,KAAK,GAAG,EAAyD,CAAC;QACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC;QACtC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;YACvC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,QAAQ,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QACD,sEAAsE;QACtE,KAAK,CAAC,cAAc,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACd,EAAsB,EACtB,KAAa,EACb,QAAuB,EACvB,MAAoB;IAEpB,IAAI,QAAQ,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;YACvC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,CAAC;AAC1G,CAAC"}

+2

-0

dist/tui/render.js

		@@ -79,2 +79,3 @@ import chalk from 'chalk';
		chalk.bold.cyan(' DvalinCode') + chalk.dim(' — local-first terminal coding agent'),
		chalk.dim(' verification: coverage-aware scans · /verify-fix <record> offline proof'),
		chalk.dim(' /help for commands · /mode to switch · Ctrl-C to interrupt · /exit to quit'),
		@@ -89,2 +90,3 @@ '',
		' /clear start a fresh session',
		' /verify-fix <record.json> re-derive a Verified Fix Record offline',
		' /git /plan <task> /compact /undo [N] (handled by the agent)',
		@@ -91,0 +93,0 @@ ' /help show this help',

+1

-1

dist/tui/render.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/tui/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B;sEACsE;AAEtE,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS;IAChC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAC1E,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CACxC,CAAC;QACF,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAc;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,YAAY,CAAC,MAAM,CAAC;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC;SACjD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC;QACpE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACjB,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC;KACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAA6C;IAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,MAAM,EAAE,KAAK,CAAC,OAAO;IACrB,IAAI,EAAE,KAAK,CAAC,MAAM;IAClB,MAAM,EAAE,KAAK,CAAC,KAAK;CACpB,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,aAAqB,EAAE,UAAkB;IACnF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAC1C,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAc;IAC3D,OAAO,CACL,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO;QACL,EAAE;QACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC;QACpF,KAAK,CAAC,GAAG,CAAC,8EAA8E,CAAC;QACzF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;QACxB,oGAAoG;QACpG,0DAA0D;QAC1D,oEAAoE;QACpE,mDAAmD;QACnD,yCAAyC;QACzC,EAAE;QACF,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC;KACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
		{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/tui/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B;sEACsE;AAEtE,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS;IAChC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAC1E,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CACxC,CAAC;QACF,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAc;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,YAAY,CAAC,MAAM,CAAC;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC;SACjD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC;QACpE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACjB,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC;KACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAA6C;IAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,MAAM,EAAE,KAAK,CAAC,OAAO;IACrB,IAAI,EAAE,KAAK,CAAC,MAAM;IAClB,MAAM,EAAE,KAAK,CAAC,KAAK;CACpB,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,aAAqB,EAAE,UAAkB;IACnF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAC1C,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAc;IAC3D,OAAO,CACL,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO;QACL,EAAE;QACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC;QACpF,KAAK,CAAC,GAAG,CAAC,2EAA2E,CAAC;QACtF,KAAK,CAAC,GAAG,CAAC,8EAA8E,CAAC;QACzF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;QACxB,oGAAoG;QACpG,0DAA0D;QAC1D,4EAA4E;QAC5E,oEAAoE;QACpE,mDAAmD;QACnD,yCAAyC;QACzC,EAAE;QACF,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC;KACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

+1

-1

dist/version.d.ts

		@@ -8,2 +8,2 @@ /**
		*/
		export declare const VERSION = "0.17.0";
		export declare const VERSION = "0.18.0";

+1

-1

dist/version.js

		@@ -8,3 +8,3 @@ /**
		*/
		export const VERSION = '0.17.0';
		export const VERSION = '0.18.0';
		//# sourceMappingURL=version.js.map

+17

-10

package.json

		{
		"name": "dvalincode",
		"version": "0.17.0",
		"description": "A local-first, provider-neutral CLI foundation for agentic coding workflows.",
		"version": "0.18.0",
		"description": "Open security engineering for code written by humans and AI agents — every repair carries its own offline-verifiable proof.",
		"type": "module",
		@@ -13,3 +13,4 @@ "license": "MIT",
		"bin": {
		"dvalincode": "dist/index.js"
		"dvalincode": "dist/index.js",
		"dvalin": "dist/dvalinIndex.js"
		},
		@@ -58,3 +59,6 @@ "files": [
		"typescript",
		"coding-assistant"
		"coding-assistant",
		"devsecops",
		"security",
		"code-scanning"
		],
		@@ -72,18 +76,21 @@ "engines": {
		"webview-bun": "^2.4.0",
		"ws": "^8.21.1",
		"ws": "^8.21.3",
		"zod": "^4.1.13"
		},
		"devDependencies": {
		"@types/bun": "^1.3.14",
		"@modelcontextprotocol/sdk": "^1.30.0",
		"@types/bun": "^1.4.0",
		"@types/cors": "^2.8.17",
		"@types/express": "^5.0.3",
		"@types/node": "^26.1.0",
		"@types/node": "^26.2.0",
		"@types/ws": "^8.5.14",
		"concurrently": "^10.0.3",
		"ajv": "^8.20.0",
		"ajv-formats": "^3.0.1",
		"concurrently": "^10.0.5",
		"playwright": "^1.61.1",
		"tsx": "^4.23.0",
		"tsx": "^4.23.12",
		"typescript": "^7.0.2",
		"vitepress": "^1.6.4",
		"vitest": "^4.1.9"
		"vitest": "^4.1.11"
		}
		}

+202

-46

README.md

		@@ -12,3 +12,3 @@ <p align="center">
		<a href="https://github.com/arthurpanhku/dvalincode/releases"><img src="https://img.shields.io/github/downloads/arthurpanhku/dvalincode/total?style=for-the-badge&color=blue&label=Downloads" alt="Downloads"></a>
		<a href="#-tests"><img src="https://img.shields.io/badge/Tests-357%20%2F%20357%20%E2%9C%93-success?style=for-the-badge" alt="Tests"></a>
		<a href="#-tests"><img src="https://img.shields.io/badge/Tests-442%20%2F%20442%20%E2%9C%93-success?style=for-the-badge" alt="Tests"></a>
		<a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" alt="License"></a>
		@@ -22,6 +22,43 @@ <a href="https://scorecard.dev/viewer/?uri=github.com/arthurpanhku/dvalincode"><img src="https://api.scorecard.dev/projects/github.com/arthurpanhku/dvalincode/badge" alt="OpenSSF Scorecard"></a>
		<p align="center">
		<b>Find the security holes in your repo, fix them, and prove the fix — in one command.</b><br>
		Every fix is diffed, tested, re-scanned, and recorded in a tamper-evident audit log before it can become a PR.
		<b>Open security engineering for code written by humans and AI agents.</b><br>
		<b>Every repair carries its own proof.</b>
		</p>

		When an agent fixes a security finding, someone has to decide whether the fix
		worked. Almost every tool asks the model that wrote it — which is the one
		question a model cannot answer against its own interest.

		Dvalin decides instead, and hands you the proof. It re-scans, runs your
		project's own tests itself, and reads the exit codes from processes it started.
		Who wrote the repair — our agent, Claude Code, Codex, Copilot, a person — is
		recorded and never consulted. The result is a Verified Fix Record: a small
		JSON file anyone can re-check offline, on a laptop with no network and no
		Dvalin state.

		```sh
		dvalin verify-fix fix-record.json
		```
		```
		Fix record 2c9d71ac03e0 · VERIFIED · scan-and-checks
		executor: claude-code (recorded, not consulted)
		targets: 1 before · 0 remaining
		coverage: complete → complete
		✓ test: npm run test (exit 0)
		audit: run verify-36509f42 @ 414644c75af0
		```

		That record says something narrow on purpose: *these findings were gone, and
		these checks were observed to pass.* It is not a claim that your code is safe,
		and Dvalin will not let it be read as one — every record carries what the scan
		actually covered, and a repair no check could confirm does not pass.
		[The open profile →](docs/spec/FIX-VERIFICATION.md)

		Dvalin is the independent security runtime between code generation and merge.
		Humans, coding agents, and CI call the same versioned contract for discovery,
		remediation, and verification. It runs independently, or interoperates with
		specialist systems such as Codex Security through portable SARIF. Its built-in
		coding capability is a remediation executor — not the trust boundary, and not an
		attempt to compete with every general-purpose coding agent. See the
		[security-agent strategy](docs/SECURITY-AGENT-STRATEGY.md).

		---
		@@ -32,3 +69,4 @@
		```sh
		npx dvalincode dvalin .
		npx dvalincode security scan .
		# After installing the package: dvalin scan .
		```
		@@ -39,5 +77,24 @@
		prints what it found. No account, no model, no config, no code leaves your
		machine. Add `--scanners builtin,semgrep,trivy,osv-scanner` to pull in whichever
		of those engines you already have on `PATH`.
		machine. The default policy runs only Dvalin Built-in, so the first scan always
		works. Add optional engines explicitly, or inspect their fixed install commands:

		```sh
		dvalin scanners list
		dvalin scanners install semgrep # review the command
		dvalin scanners install semgrep --yes # execute it under Dvalin policy
		```

		For an incremental “no new high-risk findings” gate, commit the policy and
		baseline with the repository:

		```sh
		dvalin init
		dvalin baseline
		dvalin scan
		```

		This creates `dvalin.security.json` and `.dvalin/baseline.json`. Suppressions
		require a reason and may have an owner and expiry date. Scan output is a
		versioned envelope with a deterministic gate result and a resumable workflow ID.

		### Or put it on every pull request — nothing to install at all
		@@ -52,5 +109,8 @@
		- uses: actions/checkout@v5
		- uses: arthurpanhku/dvalincode@v0.17.0
		with:
		fetch-depth: 0 # so the scan can reach the base commit
		- uses: arthurpanhku/dvalincode@v0.18.0
		with:
		fail-on: high
		diff: true # only report on what this PR changed
		```
		@@ -62,2 +122,36 @@

		`diff: true` reports only on lines the pull request changed, so the gate blocks
		what this change adds instead of everything the repository already carried.
		That is what makes the check adoptable on a codebase that was not clean to
		begin with. Drop it to scan the whole repository.

		Every comment states what the scan covered — `complete`, `partial`, or
		`unknown` — beside the result, because "no findings" from a run where half the
		engines were missing is not the same answer as "no findings" from a complete one.

		### And publish the proof next to the diff

		If your pipeline produced a fix record, hand it to the same action:

		```yaml
		- uses: arthurpanhku/dvalincode@v0.18.0
		with:
		fix-record: fix-record.json
		```

		The runner re-derives the record from the file alone — recomputing its hash and
		re-deriving its verdict from its own evidence — and posts the result on the pull
		request. A record that was edited after it was issued fails here, and fails the
		job. The reviewer does not have to trust the pipeline that produced it, or us.

		```
		🔏 Verified Fix Record
		✅ ce504a995395 · VERIFIED · scan-and-checks
		- repaired by claude-code — recorded, and not consulted for this verdict
		- targets: 1 before → 0 remaining
		- coverage: complete → complete
		- ✓ test: `npm run test` (exit 0)
		- audit chain: verify-eeb1bae7 @ 80881867270d
		```

		### Or let your agent call it
		@@ -72,12 +166,80 @@

		`dvalin_scan` is read-only and deterministic — no model runs, no credentials are
		needed, no files are touched — so an agent can call it after every edit. A real
		call against a vulnerable fixture returns in ~170ms with a ~600 byte payload.
		The same server also exposes `dvalin_run_task` for delegating a whole governed
		task, plus the session and audit-evidence tools.
		One command configures the editor you actually use:

		Verified end to end with both Claude Code and Codex driving a real tool call
		against the published package, not only completing a handshake.
		[Agent integrations →](integrations/)
		```sh
		npx dvalincode mcp-install cursor # .cursor/mcp.json
		npx dvalincode mcp-install vscode # .vscode/mcp.json
		npx dvalincode mcp-install claude-code # .mcp.json
		```

		The formats differ in a way that fails silently — VS Code keys its servers under
		`servers`, Cursor under `mcpServers` — so the command writes the right one and
		merges into whatever is already there. [Editors and MCP →](integrations/mcp/)

		`dvalin_scan` accepts `diff: "uncommitted"`, which reports only on what the
		agent just wrote rather than everything the repository already carried — the
		difference between a usable answer and a wall of pre-existing findings. It never
		runs a model or edits the target workspace. It records a
		small local workflow so an agent can retrieve one finding by fingerprint and
		request an independent re-scan through `dvalin_get_finding` and
		`dvalin_verify_findings`.

		That last one is the point: an agent that has just written a repair can ask for
		an independent verdict on it. Dvalin re-scans, runs the project's own checks
		itself, and returns a Verified Fix Record — what was targeted, what remains,
		which commands ran and the exit codes Dvalin observed, and how much of the
		codebase was actually covered. Whoever wrote the repair is recorded and never
		consulted. `dvalin_verify_fix` re-derives such a record offline, so the reviewer
		receiving it does not have to trust the tool that issued it.
		[FVP-1 →](docs/spec/FIX-VERIFICATION.md) Responses include MCP `structuredContent`; scanner
		readiness is available through `dvalin_list_scanners`. The same server exposes
		`dvalin_run_task` as an optional implementation helper, plus session and audit
		evidence tools.

		Verified end to end against Claude Code 2.1.226 and Codex 0.147.0, driving a
		real tool call against the published package rather than only completing a
		handshake. [Agent integrations →](integrations/)

		### Wherever you already work

		One server, reached the way each tool expects:

		\| Harness \| How Dvalin reaches it \|
		\|---\|---\|
		\| Claude Code \| `dvalincode mcp-install claude-code`, or `claude mcp add` · [skill](integrations/claude-code/) \|
		\| Codex \| `codex mcp add` · [SARIF interop](integrations/codex-security/) with Codex Security \|
		\| Cursor \| `dvalincode mcp-install cursor` \|
		\| VS Code \| `dvalincode mcp-install vscode` · [extension](editors/vscode/) for the Problems panel — built, not yet published \|
		\| Windsurf · Zed \| stdio MCP through their own settings — [server command](integrations/mcp/) \|
		\| Any MCP client \| [MCP registry](https://registry.modelcontextprotocol.io/): `io.github.arthurpanhku/dvalincode` \|
		\| GitHub Actions \| [Marketplace action](https://github.com/marketplace/actions/dvalin-security-scan) — findings inline on the pull request diff \|
		\| Any CI \| `dvalin scan . --fail-on high`, SARIF out for code scanning \|

		The MCP config formats are not interchangeable — VS Code keys its servers under
		`servers`, Cursor under `mcpServers`, and the wrong one fails silently — so
		`mcp-install` writes the right shape and merges into whatever is already there.
		[Editors and MCP →](integrations/mcp/)

		### Or interoperate with Codex Security

		[Codex Security](https://github.com/openai/codex-security) can export a completed,
		sealed scan as SARIF. Import that portable projection without coupling Dvalin to
		Codex Security's private state directory:

		```sh
		DVALIN_CODEX_SCAN_DIR=/tmp/codex-security-results
		npx @openai/codex-security scan . --output-dir "$DVALIN_CODEX_SCAN_DIR"
		npx @openai/codex-security export "$DVALIN_CODEX_SCAN_DIR" \
		--export-format sarif --source-root "$PWD" --output /tmp/codex-security.sarif

		dvalin import /tmp/codex-security.sarif .
		dvalin scan . --fail-on high
		```

		The import creates stable Dvalin remediation cases; `--no-persist` validates the
		handoff without changing the backlog. Keep Codex Security's original manifest,
		findings, and coverage artifacts together—Dvalin imports the SARIF finding
		projection but does not rewrite its sealed bundle or reinterpret its coverage.
		[Integration guide →](integrations/codex-security/)

		### Then let it fix what it found
		@@ -181,9 +343,10 @@

		> Make AI coding approvable for regulated and security-sensitive teams.
		> Make every code-producing human or agent pass the same independent security gate.

		DvalinCode is built as an approvable agent runtime, not just another coding
		agent app. The core product is not only "AI writes code"; it is the evidence a
		security, compliance, or platform team needs to safely allow AI coding in
		financial services, healthcare, internal enterprise platforms, and other
		confidential codebases.
		DvalinCode is built as an agent-compatible security runtime, not another
		general coding-agent benchmark entry. The core product is scan evidence,
		policy, baseline, deterministic verification, and portable interfaces that a
		human developer, an external agent, or CI can all call. The bundled coding agent
		stays capable enough to implement and test focused remediations reliably; its
		model prose never decides whether the security gate passed.

		@@ -436,8 +599,8 @@ - Any model — every OpenAI-compatible endpoint is a first-class citizen, local models included. Your workflow should never be hostage to one vendor's pricing, rate limits, or quality swings.

		**The verified result — the three `eval` call sites replaced by a constrained
		numeric parser, one new injection regression test, all four open-source engines
		complete, 0 findings, 100/100 · A:**
		**The verified result — a real model-driven Verify turn inspected the repair,
		ran the regression tests and all four open-source engines, then the deterministic
		server re-scan reported complete coverage, a passing gate, 0 findings, 100/100 · A:**

		<p align="center">
		<img src="assets/dvalin-scan-after.jpg" alt="Dvalin verified re-scan showing 100/100 A, zero findings, and the remediation run that produced it" width="100%">
		<img src="assets/dvalin-verify-local.jpg" alt="A local Dvalin model-driven Verify run showing its test evidence beside a deterministic 100/100 A re-scan, complete four-engine coverage, and a passing gate" width="100%">
		</p>
		@@ -683,3 +846,3 @@

		357 tests · 52 files · all green.
		442 tests · 62 files · all green.

		@@ -805,3 +968,3 @@ ---
		cd dvalincode && npm install
		npm test # 357/357 ✅
		npm test # 442/442 ✅
		npm run typecheck
		@@ -842,2 +1005,6 @@ ```
		session lifecycle, MCP integration, and diff-first editing workflows.
		- [OpenAI Codex Security](https://github.com/openai/codex-security) and its
		public documentation informed Dvalin's specialist security-agent research and
		portable SARIF handoff. Dvalin remains an independent, competing security
		runtime.
		- The `AGENTS.md` project-instruction convention, common in coding-agent tools,
		@@ -860,16 +1027,2 @@ informed DvalinCode's project-local instruction loading behavior.

		## ⭐ Star Growth

		<p align="center">
		<a href="https://www.star-history.com/#arthurpanhku/dvalincode&Date">
		<picture>
		<source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=arthurpanhku/dvalincode&type=Date&theme=dark">
		<source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=arthurpanhku/dvalincode&type=Date">
		<img alt="DvalinCode Star History Chart" src="https://api.star-history.com/svg?repos=arthurpanhku/dvalincode&type=Date">
		</picture>
		</a>
		</p>

		---

		## 💛 Thanks to Our Contributors
		@@ -881,10 +1034,13 @@

		<p align="center">
		<a href="https://github.com/arthurpanhku/dvalincode/graphs/contributors">
		<img src="https://contrib.rocks/image?repo=arthurpanhku/dvalincode" alt="DvalinCode contributors">
		</a>
		</p>
		\| Contributor \| GitHub profile \|
		\| --- \| --- \|
		\| Arthur Pan \| [@arthurpanhku](https://github.com/arthurpanhku) \|
		\| Shivas \| [@shivasb42](https://github.com/shivasb42) \|
		\| Aditya \| [@adity982](https://github.com/adity982) \|
		\| badhope \| [@weed33834](https://github.com/weed33834) \|

		See the [complete contribution history](https://github.com/arthurpanhku/dvalincode/graphs/contributors), including automated dependency and maintenance updates.

		<p align="center">
		<sub>Want to join them? Read the <a href="CONTRIBUTING.md">contribution guide</a> and send your first pull request.</sub>
		</p>

+170

-39

README.zh-CN.md

		@@ -12,3 +12,3 @@ <p align="center">
		<a href="https://github.com/arthurpanhku/dvalincode/releases"><img src="https://img.shields.io/github/downloads/arthurpanhku/dvalincode/total?style=for-the-badge&color=blue&label=Downloads" alt="Downloads"></a>
		<a href="#-测试"><img src="https://img.shields.io/badge/Tests-357%20%2F%20357%20%E2%9C%93-success?style=for-the-badge" alt="Tests"></a>
		<a href="#-测试"><img src="https://img.shields.io/badge/Tests-442%20%2F%20442%20%E2%9C%93-success?style=for-the-badge" alt="Tests"></a>
		<a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" alt="License"></a>
		@@ -22,6 +22,37 @@ <a href="https://scorecard.dev/viewer/?uri=github.com/arthurpanhku/dvalincode"><img src="https://api.scorecard.dev/projects/github.com/arthurpanhku/dvalincode/badge" alt="OpenSSF Scorecard"></a>
		<p align="center">
		<b>找出仓库里的安全漏洞，修掉它，并且证明确实修好了 —— 一条命令。</b><br>
		每一处修复都会先出 diff、跑测试、重新扫描，并写入防篡改审计日志，然后才允许变成 PR。
		<b>为人类和 AI Agent 编写的代码提供开放安全工程能力。</b><br>
		<b>每一次修复，都自带证明。</b>
		</p>

		Agent 修好了一个安全问题之后，总得有人判断它到底修好没有。市面上几乎所有工具都是
		去问那个写下修复的模型 —— 而这恰恰是模型最无法违背自身利益去诚实回答的问题。

		Dvalin 自己来判断，并把证明交给你。它重新扫描、亲自跑你项目的测试，看的是它
		自己启动的进程返回的退出码。修复是谁写的 —— 我们的 agent、Claude Code、Codex、
		Copilot，还是人 —— 只被记录，绝不参与判定。产物是一份 Verified Fix Record：
		一个很小的 JSON，任何人都能离线复验，不需要联网，也不需要任何 Dvalin 的本地状态。

		```sh
		dvalin verify-fix fix-record.json
		```
		```
		Fix record 2c9d71ac03e0 · VERIFIED · scan-and-checks
		executor: claude-code (recorded, not consulted)
		targets: 1 before · 0 remaining
		coverage: complete → complete
		✓ test: npm run test (exit 0)
		audit: run verify-36509f42 @ 414644c75af0
		```

		这份记录声称的东西刻意很窄：这些 finding 消失了，这些检查被观察到通过了。它不是
		「你的代码安全了」这种断言，Dvalin 也不允许它被这样解读 —— 每份记录都带着这次扫描
		究竟覆盖了什么，而一个没有任何检查能确认的修复，不会通过。
		[开放规范 →](docs/spec/FIX-VERIFICATION.md)

		Dvalin 是放在“代码生成”和“允许合并”之间的独立安全运行时。人类开发者、Coding
		Agent 和 CI 调用同一套版本化协议完成发现、修复与验证。它既可以独立运行，也可以通过
		可移植的 SARIF 与 Codex Security 等专业系统互操作。内置 Coding 能力只负责可靠地执行
		聚焦修复，不是安全结论的信任边界，也不以打败所有通用 Coding Agent 为目标。
		详见[安全 Agent 战略](docs/SECURITY-AGENT-STRATEGY.md)。

		---
		@@ -32,3 +63,4 @@
		```sh
		npx dvalincode dvalin .
		npx dvalincode security scan .
		# 安装 npm 包后也可直接运行：dvalin scan .
		```
		@@ -38,4 +70,22 @@
		shell 调用，然后把结果打出来。不需要注册、不需要模型、不需要配置，代码不出本机。
		想接入你已经装好的引擎，加上 `--scanners builtin,semgrep,trivy,osv-scanner` 即可。
		默认只启用一定存在的 Dvalin Built-in；可选引擎必须显式启用，其固定安装命令可以先审查：

		```sh
		dvalin scanners list
		dvalin scanners install semgrep # 只显示并审查命令
		dvalin scanners install semgrep --yes # 在 Dvalin 策略约束下执行
		```

		要建立“禁止新增高风险问题”的增量门禁，把策略和基线一并提交到仓库：

		```sh
		dvalin init
		dvalin baseline
		dvalin scan
		```

		这会创建 `dvalin.security.json` 和 `.dvalin/baseline.json`。每条 suppression 都必须
		写原因，还可以设置 owner 和过期时间。扫描输出是版本化 envelope，包含确定性 gate
		结果和可恢复的 workflow ID。

		### 或者挂到每个 PR 上 —— 完全不用装任何东西
		@@ -50,5 +100,8 @@
		- uses: actions/checkout@v5
		- uses: arthurpanhku/dvalincode@v0.17.0
		with:
		fetch-depth: 0 # 让扫描能取到 base commit
		- uses: arthurpanhku/dvalincode@v0.18.0
		with:
		fail-on: high
		diff: true # 只报告这个 PR 改动的部分
		```
		@@ -60,2 +113,34 @@

		`diff: true` 只报告 PR 改动到的行，因此这道门禁拦的是这次改动新引入的问题，
		而不是仓库里本来就有的一堆存量问题。这正是它能在一个并不干净的代码库上被接受的
		原因。去掉它就是全仓库扫描。

		每条评论都会在结论旁边写明这次扫描的覆盖率 —— `complete` / `partial` /
		`unknown`。因为「没发现问题」在半数引擎没装的情况下，和在完整扫描下，根本不是同一个
		答案。

		### 再把证明贴到 diff 旁边

		如果你的流水线产出了 fix record，把它交给同一个 action：

		```yaml
		- uses: arthurpanhku/dvalincode@v0.18.0
		with:
		fix-record: fix-record.json
		```

		runner 会仅凭这个文件本身重新推导它 —— 重算哈希，并从它自己的证据重新推出结论 ——
		然后把结果发到 PR 上。一份签发之后被改过的记录会在这里失败，并让整个 job 失败。
		审查者不需要信任产出它的流水线，也不需要信任我们。

		```
		🔏 Verified Fix Record
		✅ ce504a995395 · VERIFIED · scan-and-checks
		- repaired by claude-code — recorded, and not consulted for this verdict
		- targets: 1 before → 0 remaining
		- coverage: complete → complete
		- ✓ test: `npm run test` (exit 0)
		- audit chain: verify-eeb1bae7 @ 80881867270d
		```

		### 或者让你的 agent 调用它
		@@ -70,9 +155,62 @@

		`dvalin_scan` 只读且确定性 —— 不跑模型、不需要任何凭据、不改文件 —— 所以 agent
		可以每次改完就调一次。对一个真实漏洞样本的实测：约 170ms 返回，payload 约 600 字节。
		同一个 server 还提供 `dvalin_run_task`（委派完整的受管任务）以及会话、审计证据工具。
		一条命令配好你实际在用的编辑器：

		Claude Code 与 Codex 均已用已发布的包做过端到端验证 —— 是真实发起工具调用，而不只是握手成功。
		[Agent 集成 →](integrations/)
		```sh
		npx dvalincode mcp-install cursor # .cursor/mcp.json
		npx dvalincode mcp-install vscode # .vscode/mcp.json
		npx dvalincode mcp-install claude-code # .mcp.json
		```

		这几家的格式不一样，而且写错不会报错——VS Code 的 key 是 `servers`，Cursor 是
		`mcpServers`，填反了编辑器会照单全收然后当没看见。这条命令会写对，并且合并进已有
		配置而不是覆盖。[编辑器与 MCP →](integrations/mcp/)

		`dvalin_scan` 支持 `diff: "uncommitted"`，只报告 agent 刚写的部分，而不是仓库里的全部存量问题。它不跑模型，也不会修改目标 workspace；它只持久化一份精简的本地安全
		workflow。Agent 可以用 fingerprint 精确读取单条发现，再通过 `dvalin_get_finding` 和
		`dvalin_verify_findings` 请求独立复扫。响应包含 MCP `structuredContent`，并可通过
		`dvalin_list_scanners` 查询组件是否就绪。同一 server 也提供可选的 `dvalin_run_task`
		实现助手，以及 session 和审计证据工具。

		已针对 Claude Code 2.1.226 和 Codex 0.147.0 做过端到端验证 —— 是用已发布的包真实发起
		工具调用，而不只是握手成功。[Agent 集成 →](integrations/)

		### 你在哪儿干活，它就在哪儿

		同一个 server，按每个工具各自的方式接进去：

		\| Harness \| 怎么接 \|
		\|---\|---\|
		\| Claude Code \| `dvalincode mcp-install claude-code`，或 `claude mcp add` · [skill](integrations/claude-code/) \|
		\| Codex \| `codex mcp add` · 与 Codex Security 的 [SARIF 互操作](integrations/codex-security/) \|
		\| Cursor \| `dvalincode mcp-install cursor` \|
		\| VS Code \| `dvalincode mcp-install vscode` · 在 Problems 面板出结果的[扩展](editors/vscode/) —— 已构建，尚未发布 \|
		\| Windsurf · Zed \| 在各自设置里配 stdio MCP —— [server 命令](integrations/mcp/) \|
		\| 任意 MCP 客户端 \| [MCP registry](https://registry.modelcontextprotocol.io/)：`io.github.arthurpanhku/dvalincode` \|
		\| GitHub Actions \| [Marketplace action](https://github.com/marketplace/actions/dvalin-security-scan) —— 结果直接标在 PR diff 上 \|
		\| 任意 CI \| `dvalin scan . --fail-on high`，输出 SARIF 供 code scanning 用 \|

		各家的 MCP 配置格式并不通用——VS Code 的 key 是 `servers`，Cursor 是 `mcpServers`，
		填错了不会报错只会静默失效——所以 `mcp-install` 会写对格式，并合并进已有配置。
		[编辑器与 MCP →](integrations/mcp/)

		### 或者和 Codex Security 互操作

		[Codex Security](https://github.com/openai/codex-security) 可以把已完成且密封的扫描
		导出为 SARIF。Dvalin 只导入这个可移植投影，不耦合 Codex Security 的私有状态目录：

		```sh
		DVALIN_CODEX_SCAN_DIR=/tmp/codex-security-results
		npx @openai/codex-security scan . --output-dir "$DVALIN_CODEX_SCAN_DIR"
		npx @openai/codex-security export "$DVALIN_CODEX_SCAN_DIR" \
		--export-format sarif --source-root "$PWD" --output /tmp/codex-security.sarif

		dvalin import /tmp/codex-security.sarif .
		dvalin scan . --fail-on high
		```

		导入会生成稳定的 Dvalin remediation case；`--no-persist` 可以只校验交接件而不修改
		backlog。请继续保存 Codex Security 原始的 manifest、findings 和 coverage 工件——Dvalin
		只导入 SARIF finding 投影，不会改写其密封 bundle，也不会重新解释其覆盖率。
		[集成指南 →](integrations/codex-security/)

		### 然后让它把找到的问题修掉
		@@ -167,7 +305,8 @@

		> 让高合规与安全敏感团队也能批准 AI 编码。
		> 让每一个写代码的人类或 Agent，都通过同一套独立安全门禁。

		DvalinCode 的定位是可审批的 Agent 运行时（runtime），而不只是又一个
		编码 Agent 应用。核心产品不只是“AI 能写代码”，而是金融、医疗、政企、内部平台
		等高保密代码库在引入 AI 编码前所需要的安全、合规和审计证据。
		DvalinCode 的定位是 Agent 可调用的安全运行时，而不是又一个通用 Coding Agent
		榜单参赛者。核心产品是扫描证据、策略、基线、确定性验证，以及能被人类、外部 Agent
		和 CI 共同调用的便携接口。自带 Coding Agent 只需保持可靠完成聚焦修复和测试的能力；
		模型的文字声明永远不能决定安全 gate 是否通过。

		@@ -370,7 +509,7 @@ - 模型自由 —— 任何 OpenAI 兼容端点都是一等公民，包括本地模型。你的工作流不应被任何一家厂商的定价、限流或质量波动绑架。

		**验证后的结果——3 处 `eval` 调用改为受约束的数值解析、新增 1 条注入回归测试、
		4 个开源引擎均完成，0 条发现，100/100 · A：**
		**验证后的结果——真实模型驱动的 Verify 回合检查修复、运行回归测试和 4 个开源引擎，
		随后服务端确定性复扫显示完整覆盖、gate 通过、0 条发现、100/100 · A：**

		<p align="center">
		<img src="assets/dvalin-scan-after.jpg" alt="Dvalin 验证复扫显示 100/100 A、0 条发现，以及产生该结果的修复会话" width="100%">
		<img src="assets/dvalin-verify-local.jpg" alt="Dvalin 本地真实模型 Verify 回合及其确定性复扫：100/100 A、四引擎完整覆盖、gate 通过、0 条发现" width="100%">
		</p>
		@@ -603,3 +742,3 @@

		357 个测试 · 52 个文件 · 全部通过。
		442 个测试 · 62 个文件 · 全部通过。

		@@ -731,3 +870,3 @@ ---
		cd dvalincode && npm install
		npm test # 357/357 ✅
		npm test # 442/442 ✅
		npm run typecheck
		@@ -762,2 +901,5 @@ ```
		项目本地上下文、沙箱、session lifecycle、MCP 集成和 diff-first 编辑工作流的期待。
		- [OpenAI Codex Security](https://github.com/openai/codex-security) 及其公开文档为
		Dvalin 的专业安全 Agent 研究和可移植 SARIF 交接提供了参考；Dvalin 仍是独立且参与
		竞争的安全运行时。
		- `AGENTS.md` 项目指令约定在编码 Agent 工具中较常见，也影响了 DvalinCode
		@@ -778,16 +920,2 @@ 加载项目本地指令的行为设计。

		## ⭐ Star 增长趋势

		<p align="center">
		<a href="https://www.star-history.com/#arthurpanhku/dvalincode&Date">
		<picture>
		<source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=arthurpanhku/dvalincode&type=Date&theme=dark">
		<source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=arthurpanhku/dvalincode&type=Date">
		<img alt="DvalinCode Star 增长趋势图" src="https://api.star-history.com/svg?repos=arthurpanhku/dvalincode&type=Date">
		</picture>
		</a>
		</p>

		---

		## 💛 感谢每一位贡献者
		@@ -799,10 +927,13 @@

		<p align="center">
		<a href="https://github.com/arthurpanhku/dvalincode/graphs/contributors">
		<img src="https://contrib.rocks/image?repo=arthurpanhku/dvalincode" alt="DvalinCode 贡献者">
		</a>
		</p>
		\| 贡献者 \| GitHub 主页 \|
		\| --- \| --- \|
		\| Arthur Pan \| [@arthurpanhku](https://github.com/arthurpanhku) \|
		\| Shivas \| [@shivasb42](https://github.com/shivasb42) \|
		\| Aditya \| [@adity982](https://github.com/adity982) \|
		\| badhope \| [@weed33834](https://github.com/weed33834) \|

		查看[完整贡献记录](https://github.com/arthurpanhku/dvalincode/graphs/contributors)，其中也包含自动依赖更新和维护记录。

		<p align="center">
		<sub>也想加入？阅读<a href="CONTRIBUTING.md">贡献指南</a>，提交你的第一个 Pull Request。</sub>
		</p>

+98

-43

THIRD_PARTY_NOTICES.md

		@@ -19,9 +19,9 @@ # Third-Party Notices
		\| Apache-2.0 \| 27 \|
		\| BSD-2-Clause \| 1 \|
		\| BSD-3-Clause \| 4 \|
		\| BSD-2-Clause \| 2 \|
		\| BSD-3-Clause \| 6 \|
		\| CC-BY-4.0 \| 1 \|
		\| CC0-1.0 \| 1 \|
		\| ISC \| 17 \|
		\| MIT \| 484 \|
		\| MPL-2.0 \| 12 \|
		\| ISC \| 20 \|
		\| MIT \| 521 \|
		\| MPL-2.0 \| 24 \|

		@@ -58,5 +58,8 @@ ## Packages
		\| `@docsearch/react` \| 3.8.2 \| MIT \| CLI package \| \|
		\| `@emnapi/core` \| 1.11.1 \| MIT \| CLI package, Web package \| \|
		\| `@emnapi/runtime` \| 1.11.1 \| MIT \| CLI package, Web package \| \|
		\| `@emnapi/wasi-threads` \| 1.2.2 \| MIT \| CLI package, Web package \| \|
		\| `@emnapi/core` \| 1.11.1 \| MIT \| CLI package \| \|
		\| `@emnapi/core` \| 2.0.0-alpha.3 \| MIT \| Web package \| \|
		\| `@emnapi/runtime` \| 1.11.1 \| MIT \| CLI package \| \|
		\| `@emnapi/runtime` \| 2.0.0-alpha.3 \| MIT \| Web package \| \|
		\| `@emnapi/wasi-threads` \| 1.2.2 \| MIT \| CLI package \| \|
		\| `@emnapi/wasi-threads` \| 2.0.1 \| MIT \| Web package \| \|
		\| `@esbuild/aix-ppc64` \| 0.28.1 \| MIT \| CLI package \| \|
		@@ -88,2 +91,3 @@ \| `@esbuild/android-arm` \| 0.28.1 \| MIT \| CLI package \| \|
		\| `@esbuild/win32-x64` \| 0.28.1 \| MIT \| CLI package \| \|
		\| `@hono/node-server` \| 2.1.1 \| MIT \| CLI package \| \|
		\| `@iconify-json/simple-icons` \| 1.2.89 \| CC0-1.0 \| CLI package \| \|
		@@ -96,22 +100,40 @@ \| `@iconify/types` \| 2.0.0 \| MIT \| CLI package \| \|
		\| `@jridgewell/trace-mapping` \| 0.3.31 \| MIT \| Web package \| \|
		\| `@napi-rs/wasm-runtime` \| 1.1.6 \| MIT \| CLI package, Web package \| \|
		\| `@modelcontextprotocol/sdk` \| 1.30.0 \| MIT \| CLI package \| \|
		\| `@napi-rs/wasm-runtime` \| 1.1.6 \| MIT \| CLI package \| \|
		\| `@napi-rs/wasm-runtime` \| 1.2.2 \| MIT \| Web package \| \|
		\| `@nodelib/fs.scandir` \| 2.1.5 \| MIT \| CLI package \| \|
		\| `@nodelib/fs.stat` \| 2.0.5 \| MIT \| CLI package \| \|
		\| `@nodelib/fs.walk` \| 1.2.8 \| MIT \| CLI package \| \|
		\| `@oxc-project/types` \| 0.139.0 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-android-arm64` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-darwin-arm64` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-darwin-x64` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-freebsd-x64` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-linux-arm-gnueabihf` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-linux-arm64-gnu` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-linux-arm64-musl` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-linux-ppc64-gnu` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-linux-s390x-gnu` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-linux-x64-gnu` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-linux-x64-musl` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-openharmony-arm64` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-wasm32-wasi` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-win32-arm64-msvc` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@rolldown/binding-win32-x64-msvc` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `@oxc-project/types` \| 0.139.0 \| MIT \| CLI package \| \|
		\| `@oxc-project/types` \| 0.142.0 \| MIT \| Web package \| \|
		\| `@rolldown/binding-android-arm64` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-android-arm64` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-darwin-arm64` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-darwin-arm64` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-darwin-x64` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-darwin-x64` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-freebsd-x64` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-freebsd-x64` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-linux-arm-gnueabihf` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-linux-arm-gnueabihf` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-linux-arm64-gnu` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-linux-arm64-gnu` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-linux-arm64-musl` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-linux-arm64-musl` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-linux-ppc64-gnu` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-linux-ppc64-gnu` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-linux-s390x-gnu` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-linux-s390x-gnu` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-linux-x64-gnu` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-linux-x64-gnu` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-linux-x64-musl` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-linux-x64-musl` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-openharmony-arm64` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-openharmony-arm64` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-wasm32-wasi` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-wasm32-wasi` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-win32-arm64-msvc` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-win32-arm64-msvc` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/binding-win32-x64-msvc` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `@rolldown/binding-win32-x64-msvc` \| 1.2.1 \| MIT \| Web package \| \|
		\| `@rolldown/pluginutils` \| 1.0.1 \| MIT \| CLI package, Web package \| \|
		@@ -175,2 +197,3 @@ \| `@rollup/rollup-android-arm-eabi` \| 4.62.2 \| MIT \| CLI package \| \|
		\| `@types/body-parser` \| 1.19.6 \| MIT \| CLI package \| \|
		\| `@types/bun` \| 1.3.14 \| MIT \| CLI package \| \|
		\| `@types/chai` \| 5.2.3 \| MIT \| CLI package \| \|
		@@ -192,7 +215,7 @@ \| `@types/connect` \| 3.4.38 \| MIT \| CLI package \| \|
		\| `@types/ms` \| 2.1.0 \| MIT \| Web package \| \|
		\| `@types/node` \| 26.1.1 \| MIT \| CLI package \| \|
		\| `@types/node` \| 26.2.0 \| MIT \| CLI package \| \|
		\| `@types/qs` \| 6.15.1 \| MIT \| CLI package \| \|
		\| `@types/range-parser` \| 1.2.7 \| MIT \| CLI package \| \|
		\| `@types/react` \| 19.2.17 \| MIT \| Web package \| \|
		\| `@types/react-dom` \| 19.2.3 \| MIT \| Web package \| \|
		\| `@types/react` \| 19.2.18 \| MIT \| Web package \| \|
		\| `@types/react-dom` \| 19.2.4 \| MIT \| Web package \| \|
		\| `@types/send` \| 1.2.1 \| MIT \| CLI package \| \|
		@@ -225,3 +248,3 @@ \| `@types/serve-static` \| 2.2.0 \| MIT \| CLI package \| \|
		\| `@ungap/structured-clone` \| 1.3.2 \| ISC \| CLI package \| \|
		\| `@vitejs/plugin-react` \| 6.0.4 \| MIT \| Web package \| \|
		\| `@vitejs/plugin-react` \| 6.0.5 \| MIT \| Web package \| \|
		\| `@vitest/expect` \| 4.1.10 \| MIT \| CLI package \| \|
		@@ -253,2 +276,4 @@ \| `@vitest/mocker` \| 4.1.10 \| MIT \| CLI package \| \|
		\| `accepts` \| 2.0.0 \| MIT \| CLI package \| \|
		\| `ajv` \| 8.20.0 \| MIT \| CLI package \| \|
		\| `ajv-formats` \| 3.0.1 \| MIT \| CLI package \| \|
		\| `algoliasearch` \| 5.55.1 \| MIT \| CLI package \| \|
		@@ -266,2 +291,3 @@ \| `ansi-regex` \| 6.2.2 \| MIT \| CLI package \| \|
		\| `browserslist` \| 4.28.6 \| MIT \| Web package \| \|
		\| `bun-types` \| 1.3.14 \| MIT \| CLI package \| \|
		\| `bytes` \| 3.1.2 \| MIT \| CLI package \| \|
		@@ -290,2 +316,3 @@ \| `call-bind-apply-helpers` \| 1.0.2 \| MIT \| CLI package \| \|
		\| `cors` \| 2.8.6 \| MIT \| CLI package \| \|
		\| `cross-spawn` \| 7.0.6 \| MIT \| CLI package \| \|
		\| `csstype` \| 3.2.3 \| MIT \| CLI package, Web package \| \|
		@@ -317,7 +344,11 @@ \| `debug` \| 4.4.3 \| MIT \| CLI package, Web package \| \|
		\| `etag` \| 1.8.1 \| MIT \| CLI package \| \|
		\| `eventsource` \| 3.0.7 \| MIT \| CLI package \| \|
		\| `eventsource-parser` \| 3.1.1 \| MIT \| CLI package \| \|
		\| `expect-type` \| 1.3.0 \| Apache-2.0 \| CLI package \| \|
		\| `express` \| 5.2.1 \| MIT \| CLI package \| \|
		\| `express-rate-limit` \| 8.6.1 \| MIT \| CLI package \| \|
		\| `express-rate-limit` \| 8.6.2 \| MIT \| CLI package \| \|
		\| `extend` \| 3.0.2 \| MIT \| Web package \| \|
		\| `fast-deep-equal` \| 3.1.3 \| MIT \| CLI package \| \|
		\| `fast-glob` \| 3.3.3 \| MIT \| CLI package \| \|
		\| `fast-uri` \| 3.1.5 \| BSD-3-Clause \| CLI package \| \|
		\| `fastq` \| 1.20.1 \| ISC \| CLI package \| \|
		@@ -347,3 +378,4 @@ \| `fdir` \| 6.5.0 \| MIT \| Web package \| \|
		\| `hast-util-whitespace` \| 3.0.0 \| MIT \| CLI package, Web package \| \|
		\| `highlight.js` \| 11.11.1 \| BSD-3-Clause \| Web package \| \|
		\| `highlight.js` \| 11.12.0 \| BSD-3-Clause \| Web package \| \|
		\| `hono` \| 4.13.3 \| MIT \| CLI package \| \|
		\| `hookable` \| 5.5.3 \| MIT \| CLI package \| \|
		@@ -356,3 +388,3 @@ \| `html-url-attributes` \| 3.0.1 \| MIT \| Web package \| \|
		\| `inline-style-parser` \| 0.2.7 \| MIT \| Web package \| \|
		\| `ip-address` \| 10.2.0 \| MIT \| CLI package \| \|
		\| `ip-address` \| 10.5.0 \| MIT \| CLI package \| \|
		\| `ipaddr.js` \| 1.9.1 \| MIT \| CLI package \| \|
		@@ -369,3 +401,7 @@ \| `is-alphabetical` \| 2.0.1 \| MIT \| Web package \| \|
		\| `is-what` \| 5.5.0 \| MIT \| CLI package \| \|
		\| `isexe` \| 2.0.0 \| ISC \| CLI package \| \|
		\| `jiti` \| 2.7.0 \| MIT \| Web package \| \|
		\| `jose` \| 6.2.9 \| MIT \| CLI package \| \|
		\| `json-schema-traverse` \| 1.0.0 \| MIT \| CLI package \| \|
		\| `json-schema-typed` \| 8.0.2 \| BSD-2-Clause \| CLI package \| \|
		\| `lightningcss` \| 1.32.0 \| MPL-2.0 \| CLI package, Web package \| \|
		@@ -385,3 +421,4 @@ \| `lightningcss-android-arm64` \| 1.32.0 \| MPL-2.0 \| CLI package, Web package \| \|
		\| `lowlight` \| 3.3.0 \| MIT \| Web package \| \|
		\| `lucide-react` \| 1.27.0 \| ISC \| Web package \| \|
		\| `lowlight/node_modules/highlight.js` \| 11.11.2 \| BSD-3-Clause \| Web package \| \|
		\| `lucide-react` \| 1.31.0 \| ISC \| Web package \| \|
		\| `magic-string` \| 0.30.21 \| MIT \| CLI package, Web package \| \|
		@@ -443,4 +480,3 @@ \| `mark.js` \| 8.11.1 \| MIT \| CLI package \| \|
		\| `ms` \| 2.1.3 \| MIT \| CLI package, Web package \| \|
		\| `nanoid` \| 3.3.15 \| MIT \| CLI package \| \|
		\| `nanoid` \| 3.3.16 \| MIT \| Web package \| \|
		\| `nanoid` \| 3.3.18 \| MIT \| CLI package, Web package \| \|
		\| `negotiator` \| 1.0.0 \| MIT \| CLI package \| \|
		@@ -457,2 +493,3 @@ \| `node-releases` \| 2.0.51 \| MIT \| Web package \| \|
		\| `parseurl` \| 1.3.3 \| MIT \| CLI package \| \|
		\| `path-key` \| 3.1.1 \| MIT \| CLI package \| \|
		\| `path-to-regexp` \| 8.4.2 \| MIT \| CLI package \| \|
		@@ -464,7 +501,7 @@ \| `pathe` \| 2.0.3 \| MIT \| CLI package \| \|
		\| `picomatch` \| 4.0.5 \| MIT \| Web package \| \|
		\| `playwright` \| 1.62.0 \| Apache-2.0 \| CLI package \| \|
		\| `playwright-core` \| 1.62.0 \| Apache-2.0 \| CLI package \| \|
		\| `pkce-challenge` \| 5.0.1 \| MIT \| CLI package \| \|
		\| `playwright` \| 1.62.1 \| Apache-2.0 \| CLI package \| \|
		\| `playwright-core` \| 1.62.1 \| Apache-2.0 \| CLI package \| \|
		\| `playwright/node_modules/fsevents` \| 2.3.2 \| MIT \| CLI package \| \|
		\| `postcss` \| 8.5.16 \| MIT \| CLI package \| \|
		\| `postcss` \| 8.5.23 \| MIT \| Web package \| \|
		\| `postcss` \| 8.5.26 \| MIT \| CLI package, Web package \| \|
		\| `postcss-value-parser` \| 4.2.0 \| MIT \| Web package \| \|
		@@ -490,5 +527,7 @@ \| `preact` \| 10.29.4 \| MIT \| CLI package \| \|
		\| `remark-stringify` \| 11.0.0 \| MIT \| Web package \| \|
		\| `require-from-string` \| 2.0.2 \| MIT \| CLI package \| \|
		\| `reusify` \| 1.1.0 \| MIT \| CLI package \| \|
		\| `rfdc` \| 1.4.1 \| MIT \| CLI package \| \|
		\| `rolldown` \| 1.1.5 \| MIT \| CLI package, Web package \| \|
		\| `rolldown` \| 1.1.5 \| MIT \| CLI package \| \|
		\| `rolldown` \| 1.2.1 \| MIT \| Web package \| \|
		\| `rollup` \| 4.62.2 \| MIT \| CLI package \| \|
		@@ -504,2 +543,4 @@ \| `router` \| 2.2.0 \| MIT \| CLI package \| \|
		\| `setprototypeof` \| 1.2.0 \| ISC \| CLI package \| \|
		\| `shebang-command` \| 2.0.0 \| MIT \| CLI package \| \|
		\| `shebang-regex` \| 3.0.0 \| MIT \| CLI package \| \|
		\| `shell-quote` \| 1.9.0 \| MIT \| CLI package \| \|
		@@ -540,3 +581,3 @@ \| `shiki` \| 2.5.0 \| MIT \| CLI package \| \|
		\| `tslib` \| 2.8.1 \| 0BSD \| CLI package, Web package \| \|
		\| `tsx` \| 4.23.1 \| MIT \| CLI package \| \|
		\| `tsx` \| 4.23.12 \| MIT \| CLI package \| \|
		\| `type-is` \| 2.1.0 \| MIT \| CLI package \| \|
		@@ -559,3 +600,15 @@ \| `type-is/node_modules/content-type` \| 2.0.0 \| MIT \| CLI package \| \|
		\| `vite` \| 8.1.4 \| MIT \| CLI package \| \|
		\| `vite` \| 8.1.5 \| MIT \| Web package \| \|
		\| `vite` \| 8.2.1 \| MIT \| Web package \| \|
		\| `vite/node_modules/lightningcss` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-android-arm64` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-darwin-arm64` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-darwin-x64` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-freebsd-x64` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-linux-arm-gnueabihf` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-linux-arm64-gnu` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-linux-arm64-musl` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-linux-x64-gnu` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-linux-x64-musl` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-win32-arm64-msvc` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/lightningcss-win32-x64-msvc` \| 1.33.0 \| MPL-2.0 \| Web package \| \|
		\| `vite/node_modules/picomatch` \| 4.0.5 \| MIT \| CLI package \| \|
		@@ -593,6 +646,7 @@ \| `vitepress` \| 1.6.4 \| MIT \| CLI package \| \|
		\| `webview-bun` \| 2.4.0 \| MIT \| CLI package \| \|
		\| `which` \| 2.0.2 \| ISC \| CLI package \| \|
		\| `why-is-node-running` \| 2.3.0 \| MIT \| CLI package \| \|
		\| `wrap-ansi` \| 9.0.2 \| MIT \| CLI package \| \|
		\| `wrappy` \| 1.0.2 \| ISC \| CLI package \| \|
		\| `ws` \| 8.21.1 \| MIT \| CLI package \| \|
		\| `ws` \| 8.21.3 \| MIT \| CLI package \| \|
		\| `y18n` \| 5.0.8 \| ISC \| CLI package \| \|
		@@ -602,3 +656,4 @@ \| `yargs` \| 18.0.0 \| MIT \| CLI package \| \|
		\| `zod` \| 4.4.3 \| MIT \| CLI package \| \|
		\| `zod-to-json-schema` \| 3.25.2 \| ISC \| CLI package \| \|
		\| `zwitch` \| 2.0.4 \| MIT \| CLI package, Web package \| \|

dvalincode - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics

Worsened metrics

Dependency changes