@avi770/testteam 2.0.0 → 3.2.0

package/dist/agents/115-multihop-taint-tracker.js

@@ -0,0 +1,340 @@
+/**
+ * Multi-Hop Taint Tracker — generalises #112's single-hop analysis to an
+ * N-hop fixpoint over the call graph.
+ *
+ * #112 connects a request source to a sink one hop away:
+ *   source → wrapper(param) → sink.
+ * Real code chains helpers more deeply:
+ *
+ *   // routes.ts
+ *   app.post('/run', (req, res) => handle(req.body.cmd));   // source
+ *   // service.ts
+ *   export function handle(input) { return dispatch(input); }    // hop 1
+ *   // exec.ts
+ *   export function dispatch(arg) { return runShell(arg); }      // hop 2
+ *   export function runShell(cmd) { return exec(cmd); }          // sink
+ *
+ * This agent propagates "a parameter of F reaches a dangerous sink" backwards
+ * through the call graph to a fixpoint:
+ *
+ *   1. Seed: functions whose parameter reaches a sink DIRECTLY (depth 0 — the
+ *      #112 sink-wrappers), reusing #112's sink detection.
+ *   2. Propagate: if F passes one of its own parameters into the dangerous
+ *      slot of an already-dangerous function G, then that parameter of F is
+ *      dangerous too (depth = G.depth + 1). Iterate until nothing changes.
+ *   3. Report: external call sites that pass request-tainted data into a
+ *      dangerous slot whose depth ≥ 1 — i.e. genuinely MULTI-hop chains
+ *      (≥ 2 function hops to the sink). Depth-0 (single-hop) flows are left
+ *      to #112, so the two agents don't double-report.
+ *
+ * Each finding names the full chain `entry() → … → sinkWrapper() → <kind>`.
+ * Cycle-safe (depths only decrease; bounded). Standalone functions and
+ * `const fn = …` arrows only — methods out of scope (same bound as #112).
+ *
+ * Findings:
+ *   - 115-taint-chain   high   code-bug-security
+ *   - 115-clean / 115-summary  info
+ *
+ * Persists `evidence/multihop-taint-analysis.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+import { extractFunctions, extractResolvers, unshadowedResolverTaint, sinksUsingParams, taintedLocals, isTainted, readBalanced, splitArgs, identAppears, } from './112-taint-tracker.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', '.run', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+/** Safety cap on chain depth (number of intermediate hops). */
+const MAX_DEPTH = 12;
+// ─────────────────────────────────────────────────────────────────────────
+// Local helpers (trivial; per-agent convention)
+// ─────────────────────────────────────────────────────────────────────────
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            walk(full, results);
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name)))
+            results.push(full);
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+function escapeReg(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+export function analyzeMultiHopTaint(files) {
+    const fns = [];
+    const dangerous = new Map();
+    const setDanger = (name, slot, d) => {
+        if (d.depth > MAX_DEPTH)
+            return false;
+        let inner = dangerous.get(name);
+        if (!inner) {
+            inner = new Map();
+            dangerous.set(name, inner);
+        }
+        const cur = inner.get(slot);
+        if (!cur || d.depth < cur.depth) {
+            inner.set(slot, d);
+            return true;
+        }
+        return false;
+    };
+    // Pass 1 — extract functions and seed direct sinks (depth 0).
+    for (const file of files) {
+        const masked = maskNonCode(file.content);
+        for (const fn of extractFunctions(masked)) {
+            if (fn.paramSlots.length === 0)
+                continue;
+            fns.push({ name: fn.name, paramSlots: fn.paramSlots, bodyText: fn.bodyText });
+            for (const hit of sinksUsingParams(fn, masked)) {
+                setDanger(fn.name, hit.slot, { kind: hit.kind, depth: 0, viaName: null, viaSlot: -1 });
+            }
+        }
+    }
+    // Pass 2 — propagate to a fixpoint.
+    let changed = true;
+    let guard = 0;
+    while (changed && guard++ < MAX_DEPTH + 2) {
+        changed = false;
+        for (const fn of fns) {
+            for (const [calleeName, slots] of [...dangerous.entries()]) {
+                const callRe = new RegExp(`(?<![.\\w])${escapeReg(calleeName)}\\s*\\(`, 'g');
+                let m;
+                while ((m = callRe.exec(fn.bodyText)) !== null) {
+                    const parenIdx = m.index + m[0].length - 1;
+                    const args = readBalanced(fn.bodyText, parenIdx, '(', ')');
+                    if (!args)
+                        continue;
+                    const argList = splitArgs(args.text);
+                    for (const [calleeSlot, ds] of [...slots.entries()]) {
+                        const arg = argList[calleeSlot];
+                        if (arg === undefined)
+                            continue;
+                        for (let s = 0; s < fn.paramSlots.length; s++) {
+                            for (const ident of fn.paramSlots[s]) {
+                                if (ident && identAppears(arg, ident)) {
+                                    if (setDanger(fn.name, s, { kind: ds.kind, depth: ds.depth + 1, viaName: calleeName, viaSlot: calleeSlot })) {
+                                        changed = true;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    const buildChain = (name, slot) => {
+        const chain = [name];
+        let curName = name;
+        let curSlot = slot;
+        let g = 0;
+        while (g++ < MAX_DEPTH + 2) {
+            const ds = dangerous.get(curName)?.get(curSlot);
+            if (!ds || ds.viaName === null)
+                break;
+            chain.push(ds.viaName);
+            curName = ds.viaName;
+            curSlot = ds.viaSlot;
+        }
+        return chain;
+    };
+    // Pass 3 — external request-tainted call sites into multi-hop (depth ≥ 1) slots.
+    const flows = [];
+    const seen = new Set();
+    for (const file of files) {
+        const masked = maskNonCode(file.content);
+        const locals = taintedLocals(masked);
+        // Inside a GraphQL resolver body, the resolver's `args`-slot identifiers are
+        // also taint sources — mirrors #112's Pass 2. Gated on the canonical resolver
+        // signature via extractResolvers, so bare `args` (e.g. execFile(cmd, args))
+        // never taints outside a resolver. Scoped to each resolver's body offset range
+        // so an `args` local elsewhere in the file stays clean (the reverted FP shape).
+        const resolvers = extractResolvers(masked);
+        for (const [name, slots] of dangerous) {
+            const multiSlots = [...slots.entries()].filter(([, d]) => d.depth >= 1);
+            if (multiSlots.length === 0)
+                continue;
+            const callRe = new RegExp(`(?<![.\\w])${escapeReg(name)}\\s*\\(`, 'g');
+            let m;
+            while ((m = callRe.exec(masked)) !== null) {
+                const before = masked.slice(Math.max(0, m.index - 12), m.index);
+                if (/\bfunction\s+$/.test(before))
+                    continue;
+                const parenIdx = m.index + m[0].length - 1;
+                const args = readBalanced(masked, parenIdx, '(', ')');
+                if (!args)
+                    continue;
+                const argList = splitArgs(args.text);
+                let resolverTaint = [];
+                for (const r of resolvers) {
+                    if (m.index >= r.bodyStart && m.index < r.bodyEnd) {
+                        resolverTaint = unshadowedResolverTaint(r, m.index);
+                        break;
+                    }
+                }
+                for (const [slot, ds] of multiSlots) {
+                    const arg = argList[slot];
+                    if (arg === undefined)
+                        continue;
+                    const tainted = isTainted(arg, locals)
+                        || (resolverTaint.length > 0 && resolverTaint.some((n) => identAppears(arg, n)));
+                    if (!tainted)
+                        continue;
+                    const callLine = lineOf(file.content, m.index);
+                    const key = `${file.path}:${callLine}:${name}:${slot}`;
+                    if (seen.has(key))
+                        continue;
+                    seen.add(key);
+                    flows.push({
+                        callFile: file.path,
+                        callLine,
+                        entryFn: name,
+                        paramSlot: slot,
+                        chain: buildChain(name, slot),
+                        sinkKind: ds.kind,
+                        hops: ds.depth + 1,
+                        snippet: snippetOf(file.content, m.index),
+                    });
+                }
+            }
+        }
+    }
+    return { dangerous, flows };
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Agent
+// ─────────────────────────────────────────────────────────────────────────
+const SINK_LABEL = {
+    sql: 'raw-SQL',
+    eval: 'dynamic-code-execution',
+    command: 'shell-command',
+    'fs-path': 'filesystem-path',
+    redirect: 'HTTP-redirect',
+    ssrf: 'outbound-HTTP (SSRF)',
+};
+export class MultiHopTaintTrackerAgent extends BaseAgent {
+    agentId = 115;
+    agentName = 'Multi-Hop Taint Tracker';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const filePaths = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    filePaths.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                filePaths.add(f);
+        }
+        const files = [];
+        for (const abs of filePaths) {
+            if (isTestPath(abs, projectRoot))
+                continue;
+            try {
+                files.push({ path: relativise(abs, projectRoot), content: fs.readFileSync(abs, 'utf-8') });
+            }
+            catch {
+                // skip unreadable
+            }
+        }
+        const { dangerous, flows } = analyzeMultiHopTaint(files);
+        this.persistAudit(projectRoot, files.length, dangerous.size, flows);
+        if (flows.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'multihop-taint-tracker',
+                description: `Scanned ${files.length} non-test file(s) — no multi-hop (≥2 hop) request-to-sink taint chains found.`,
+            });
+            return findings;
+        }
+        for (const flow of flows.slice(0, 100)) {
+            const chainStr = [...flow.chain.map((c) => `${c}()`), `${SINK_LABEL[flow.sinkKind]} sink`].join(' → ');
+            findings.push({
+                id: `${this.agentId}-taint-chain-${flow.callFile.replace(/[^\w]/g, '_')}-${flow.callLine}-${flow.entryFn}`,
+                type: 'code-bug-security',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'multihop-taint-tracker',
+                description: `Multi-hop taint (${flow.hops} hops) at ${flow.callFile}:${flow.callLine}: request input flows through ${chainStr}. Each hop passes the value along unsanitised. Validate/parameterise at the boundary before calling ${flow.entryFn}(). \`${flow.snippet}\``,
+                file: flow.callFile,
+                line: flow.callLine,
+            });
+        }
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'multihop-taint-tracker',
+            description: `Multi-hop taint analysis: ${flows.length} chain(s) (max ${Math.max(...flows.map(f => f.hops))} hops) across ${files.length} file(s); ${dangerous.size} function(s) reach a sink.`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, dangerousFns, flows) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            dangerousFns,
+            flows,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'multihop-taint-analysis.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/multihop-taint-analysis.json',
+                description: `Multi-hop taint: ${flows.length} chain(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=115-multihop-taint-tracker.js.map

package/dist/agents/115-multihop-taint-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"115-multihop-taint-tracker.js","sourceRoot":"","sources":["../../agents/115-multihop-taint-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,SAAS,EACT,YAAY,GAGb,MAAM,qBAAqB,CAAC;AAE7B,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAClH,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,SAAS,GAAG,EAAE,CAAC;AAyBrB,4EAA4E;AAC5E,gDAAgD;AAChD,4EAA4E;AAE5E,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;aACxC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAwBD,MAAM,UAAU,oBAAoB,CAAC,KAAmB;IACtD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE7D,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,CAAa,EAAW,EAAE;QACvE,IAAI,CAAC,CAAC,KAAK,GAAG,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;YAChC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,8DAA8D;IAC9D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,MAAM,EAAE,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9E,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC/C,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,OAAO,IAAI,KAAK,EAAE,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,cAAc,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC7E,IAAI,CAAyB,CAAC;gBAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;oBAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC3D,IAAI,CAAC,IAAI;wBAAE,SAAS;oBACpB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACrC,KAAK,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;wBACpD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;wBAChC,IAAI,GAAG,KAAK,SAAS;4BAAE,SAAS;wBAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;4BAC9C,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gCACrC,IAAI,KAAK,IAAI,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;oCACtC,IAAI,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;wCAC5G,OAAO,GAAG,IAAI,CAAC;oCACjB,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAY,EAAE;QAC1D,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,EAAE,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI;gBAAE,MAAM;YACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;YACrB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;QACvB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,iFAAiF;IACjF,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,6EAA6E;QAC7E,8EAA8E;QAC9E,4EAA4E;QAC5E,+EAA+E;QAC/E,gFAAgF;QAChF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;YACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACtC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,cAAc,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACvE,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAChE,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAC5C,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACtD,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,aAAa,GAAsB,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;wBAClD,aAAa,GAAG,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;wBACpD,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;oBACpC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC1B,IAAI,GAAG,KAAK,SAAS;wBAAE,SAAS;oBAChC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC;2BACjC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnF,IAAI,CAAC,OAAO;wBAAE,SAAS;oBACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;oBAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,SAAS;oBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACd,KAAK,CAAC,IAAI,CAAC;wBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ;wBACR,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC;wBAC7B,QAAQ,EAAE,EAAE,CAAC,IAAI;wBACjB,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC;wBAClB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;qBAC1C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,4EAA4E;AAC5E,QAAQ;AACR,4EAA4E;AAE5E,MAAM,UAAU,GAA6B;IAC3C,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,wBAAwB;IAC9B,OAAO,EAAE,eAAe;IACxB,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,eAAe;IACzB,IAAI,EAAE,sBAAsB;CAC7B,CAAC;AAEF,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IAC7C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,yBAAyB,CAAC;IAErC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IAAI,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EAAE,WAAW,KAAK,CAAC,MAAM,+EAA+E;aACpH,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvG,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,gBAAgB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE;gBAC1G,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EAAE,oBAAoB,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,iCAAiC,QAAQ,uGAAuG,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,OAAO,IAAI;gBAC1Q,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;aACpB,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,6BAA6B,KAAK,CAAC,MAAM,kBAAkB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,CAAC,MAAM,aAAa,SAAS,CAAC,IAAI,4BAA4B;SAChM,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,YAAoB,EAAE,KAAuB;QAC3G,MAAM,KAAK,GAAkB;YAC3B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,YAAY;YACZ,KAAK;SACN,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,8BAA8B,CAAC,EACtD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,uCAAuC;gBAC7C,WAAW,EAAE,oBAAoB,KAAK,CAAC,MAAM,oBAAoB,YAAY,UAAU;aACxF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/116-runtime-contract-capture.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Runtime Contract Capture (Agent #116) — the runtime counterpart to #113.
+ *
+ * #113 reads source statically and infers the response shape a handler
+ * *builds*. This agent probes a RUNNING server, captures the *actual* JSON
+ * responses, and diffs them against the OpenAPI/Swagger contract. A live
+ * response is ground truth — it sees fields a serializer adds, fields a
+ * `select *` leaks, and shape changes a static read would miss.
+ *
+ * Strictly opt-in (`config.runtimeContract.enabled`, default false) so a
+ * normal/CI run never touches the network. Only **GET** routes with no path
+ * parameters are probed (safe, deterministic, non-mutating). The HTTP client
+ * is injectable (`agent._fetch`) so tests run without a real server.
+ *
+ * Findings (per route):
+ *   - 116-runtime-undeclared-field      medium  infra-issue       live response
+ *       returns a field the contract never declares.
+ *   - 116-runtime-undeclared-sensitive  high    code-bug-security undeclared field
+ *       looks sensitive (password / token / secret …) — live data exposure.
+ *   - 116-runtime-missing-required      medium  infra-issue       contract requires
+ *       a field the live response omits (single-schema paths only).
+ *   - 116-runtime-unexpected-status     medium  infra-issue       documented route
+ *       answered with a non-2xx status.
+ *   - 116-runtime-non-json              low     infra-issue       documented JSON
+ *       route answered with a non-JSON body.
+ *   - 116-disabled / 116-no-spec / 116-unreachable / 116-clean / 116-summary  info
+ *
+ * Persists `evidence/runtime-contract-capture.json`. Sequential (owns
+ * network I/O); never run in parallel.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+import { type Json } from './113-response-contract-auditor.js';
+export interface RuntimeResponse {
+    ok: boolean;
+    status: number;
+    headers: {
+        get(name: string): string | null;
+    };
+    text(): Promise<string>;
+}
+export type RuntimeFetch = (url: string, init?: {
+    signal?: AbortSignal;
+}) => Promise<RuntimeResponse>;
+export interface RouteCapture {
+    path: string;
+    method: string;
+    status: number;
+    /** Top-level keys of the JSON body, or null when the body was not a JSON object. */
+    bodyKeys: string[] | null;
+    /** True when the response declared/parsed as JSON. */
+    isJson: boolean;
+}
+export type RuntimeDriftKind = 'runtime-undeclared-field' | 'runtime-undeclared-sensitive' | 'runtime-missing-required' | 'runtime-unexpected-status' | 'runtime-non-json';
+export interface RuntimeDrift {
+    kind: RuntimeDriftKind;
+    path: string;
+    field: string;
+    status: number;
+}
+export declare function auditRuntimeContract(doc: Json, captures: RouteCapture[]): RuntimeDrift[];
+/** Pull top-level object keys out of a raw response body string. */
+export declare function jsonKeysOf(body: string): {
+    isJson: boolean;
+    bodyKeys: string[] | null;
+};
+export declare class RuntimeContractCaptureAgent extends BaseAgent {
+    readonly agentId = 116;
+    readonly agentName = "Runtime Contract Capture";
+    /** Injectable HTTP client (defaults to global fetch). Overridden in tests. */
+    _fetch: RuntimeFetch | null;
+    protected preFlight(): Promise<void>;
+    private resolveBaseUrl;
+    protected execute(): Promise<Finding[]>;
+    private probe;
+    private info;
+    private persistAudit;
+}
+//# sourceMappingURL=116-runtime-contract-capture.d.ts.map

package/dist/agents/116-runtime-contract-capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"116-runtime-contract-capture.d.ts","sourceRoot":"","sources":["../../agents/116-runtime-contract-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAIL,KAAK,IAAI,EACV,MAAM,iCAAiC,CAAC;AAMzC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAWtG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,gBAAgB,GACxB,0BAA0B,GAC1B,8BAA8B,GAC9B,0BAA0B,GAC1B,2BAA2B,GAC3B,kBAAkB,CAAC;AAEvB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CA+CxF;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAAE,CAYvF;AA6BD,qBAAa,2BAA4B,SAAQ,SAAS;IACxD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,8BAA8B;IAEhD,8EAA8E;IAC9E,MAAM,EAAE,YAAY,GAAG,IAAI,CAAkB;cAE7B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAO1C,OAAO,CAAC,cAAc;cAON,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAgG/B,KAAK;IAiBnB,OAAO,CAAC,IAAI;IAWZ,OAAO,CAAC,YAAY;CAkBrB"}