@cencori/scan 0.1.0

package/dist/index.js

@@ -0,0 +1,536 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  PII_PATTERNS: () => PII_PATTERNS,
+  ROUTE_PATTERNS: () => ROUTE_PATTERNS,
+  SECRET_PATTERNS: () => SECRET_PATTERNS,
+  scan: () => scan
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/scanner/index.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_glob = require("glob");
+
+// src/scanner/patterns.ts
+var SECRET_PATTERNS = [
+  // OpenAI
+  {
+    name: "OpenAI API Key",
+    provider: "OpenAI",
+    pattern: /sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20}/g,
+    severity: "critical"
+  },
+  {
+    name: "OpenAI Project Key",
+    provider: "OpenAI",
+    pattern: /sk-proj-[a-zA-Z0-9_-]{80,}/g,
+    severity: "critical"
+  },
+  // Anthropic
+  {
+    name: "Anthropic API Key",
+    provider: "Anthropic",
+    pattern: /sk-ant-[a-zA-Z0-9-]{90,}/g,
+    severity: "critical"
+  },
+  // Google
+  {
+    name: "Google API Key",
+    provider: "Google",
+    pattern: /AIza[0-9A-Za-z_-]{35}/g,
+    severity: "critical"
+  },
+  // Supabase
+  {
+    name: "Supabase Service Role Key",
+    provider: "Supabase",
+    pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,
+    severity: "critical"
+  },
+  {
+    name: "Supabase Anon Key (if hardcoded)",
+    provider: "Supabase",
+    pattern: /SUPABASE_ANON_KEY\s*[:=]\s*["']eyJ[^"']+["']/g,
+    severity: "medium"
+  },
+  // Stripe
+  {
+    name: "Stripe Secret Key",
+    provider: "Stripe",
+    pattern: /sk_live_[0-9a-zA-Z]{24,}/g,
+    severity: "critical"
+  },
+  {
+    name: "Stripe Test Key",
+    provider: "Stripe",
+    pattern: /sk_test_[0-9a-zA-Z]{24,}/g,
+    severity: "medium"
+  },
+  // AWS
+  {
+    name: "AWS Access Key ID",
+    provider: "AWS",
+    pattern: /AKIA[0-9A-Z]{16}/g,
+    severity: "critical"
+  },
+  {
+    name: "AWS Secret Access Key",
+    provider: "AWS",
+    pattern: /aws_secret_access_key\s*[:=]\s*["'][A-Za-z0-9/+=]{40}["']/gi,
+    severity: "critical"
+  },
+  // GitHub
+  {
+    name: "GitHub Personal Access Token",
+    provider: "GitHub",
+    pattern: /ghp_[a-zA-Z0-9]{36}/g,
+    severity: "critical"
+  },
+  {
+    name: "GitHub OAuth Token",
+    provider: "GitHub",
+    pattern: /gho_[a-zA-Z0-9]{36}/g,
+    severity: "critical"
+  },
+  // Telegram
+  {
+    name: "Telegram Bot Token",
+    provider: "Telegram",
+    pattern: /[0-9]{9,10}:[a-zA-Z0-9_-]{35}/g,
+    severity: "high"
+  },
+  // Discord
+  {
+    name: "Discord Bot Token",
+    provider: "Discord",
+    pattern: /[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}/g,
+    severity: "high"
+  },
+  // Slack
+  {
+    name: "Slack Bot Token",
+    provider: "Slack",
+    pattern: /xoxb-[0-9]{11}-[0-9]{11}-[a-zA-Z0-9]{24}/g,
+    severity: "high"
+  },
+  // SendGrid
+  {
+    name: "SendGrid API Key",
+    provider: "SendGrid",
+    pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
+    severity: "high"
+  },
+  // Twilio
+  {
+    name: "Twilio API Key",
+    provider: "Twilio",
+    pattern: /SK[a-fA-F0-9]{32}/g,
+    severity: "high"
+  },
+  // Mailgun
+  {
+    name: "Mailgun API Key",
+    provider: "Mailgun",
+    pattern: /key-[a-zA-Z0-9]{32}/g,
+    severity: "high"
+  },
+  // Firebase
+  {
+    name: "Firebase Database URL",
+    provider: "Firebase",
+    pattern: /https:\/\/[a-z0-9-]+\.firebaseio\.com/g,
+    severity: "medium"
+  },
+  // Generic patterns
+  {
+    name: "Private Key",
+    provider: "Generic",
+    pattern: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
+    severity: "critical"
+  },
+  {
+    name: "Generic API Key Assignment",
+    provider: "Generic",
+    pattern: /(api_key|apikey|api_secret|secret_key)\s*[:=]\s*["'][a-zA-Z0-9_-]{20,}["']/gi,
+    severity: "high"
+  },
+  {
+    name: "Password Assignment",
+    provider: "Generic",
+    pattern: /(password|passwd|pwd)\s*[:=]\s*["'][^"']{8,}["']/gi,
+    severity: "high"
+  },
+  // Replicate
+  {
+    name: "Replicate API Token",
+    provider: "Replicate",
+    pattern: /r8_[a-zA-Z0-9]{38}/g,
+    severity: "critical"
+  },
+  // Hugging Face
+  {
+    name: "Hugging Face Token",
+    provider: "Hugging Face",
+    pattern: /hf_[a-zA-Z0-9]{34}/g,
+    severity: "critical"
+  },
+  // Cohere
+  {
+    name: "Cohere API Key",
+    provider: "Cohere",
+    pattern: /[a-zA-Z0-9]{40}/g,
+    // Less specific, check context
+    severity: "medium"
+  }
+];
+var PII_PATTERNS = [
+  {
+    name: "Email Address",
+    pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+    severity: "medium"
+  },
+  {
+    name: "Phone Number (US)",
+    pattern: /(\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}/g,
+    severity: "medium"
+  },
+  {
+    name: "Phone Number (International)",
+    pattern: /\+[1-9]\d{1,14}/g,
+    severity: "medium"
+  },
+  {
+    name: "Social Security Number",
+    pattern: /\b\d{3}-\d{2}-\d{4}\b/g,
+    severity: "high"
+  },
+  {
+    name: "Credit Card Number",
+    pattern: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
+    severity: "high"
+  },
+  {
+    name: "IP Address",
+    pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
+    severity: "low"
+  }
+];
+var ROUTE_PATTERNS = [
+  // Next.js API routes without auth
+  {
+    name: "Next.js API Route (check for auth)",
+    framework: "Next.js",
+    pattern: /export\s+(async\s+)?function\s+(GET|POST|PUT|DELETE|PATCH)\s*\(/g,
+    severity: "medium",
+    description: "API route handler - verify authentication is implemented"
+  },
+  // Express routes
+  {
+    name: "Express Route without Auth Middleware",
+    framework: "Express",
+    pattern: /app\.(get|post|put|delete|patch)\s*\(\s*["'`][^"'`]+["'`]\s*,\s*(?!.*auth)/gi,
+    severity: "medium",
+    description: "Express route - check if auth middleware is applied"
+  }
+];
+var IGNORE_PATTERNS = [
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  ".venv",
+  "__pycache__",
+  "*.min.js",
+  "*.min.css",
+  "*.map",
+  "package-lock.json",
+  "yarn.lock",
+  "pnpm-lock.yaml"
+];
+var SCANNABLE_EXTENSIONS = [
+  ".js",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".mjs",
+  ".cjs",
+  ".py",
+  ".rb",
+  ".go",
+  ".java",
+  ".php",
+  ".env",
+  ".json",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".xml",
+  ".md",
+  ".txt",
+  ".sql",
+  ".sh",
+  ".bash",
+  ".zsh"
+];
+
+// src/scanner/index.ts
+function redact(match, showChars = 4) {
+  if (match.length <= showChars * 2) {
+    return "*".repeat(match.length);
+  }
+  return match.slice(0, showChars) + "****" + match.slice(-showChars);
+}
+function getPosition(content, index) {
+  const lines = content.slice(0, index).split("\n");
+  return {
+    line: lines.length,
+    column: lines[lines.length - 1].length + 1
+  };
+}
+function shouldIgnore(filePath) {
+  const normalized = filePath.replace(/\\/g, "/");
+  return IGNORE_PATTERNS.some((pattern) => {
+    if (pattern.startsWith("*")) {
+      return normalized.endsWith(pattern.slice(1));
+    }
+    return normalized.includes(pattern);
+  });
+}
+function isScannable(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  return SCANNABLE_EXTENSIONS.includes(ext);
+}
+function scanFile(filePath, content) {
+  const issues = [];
+  const relativePath = filePath;
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.pattern.lastIndex = 0;
+    let match;
+    while ((match = pattern.pattern.exec(content)) !== null) {
+      const pos = getPosition(content, match.index);
+      issues.push({
+        type: "secret",
+        severity: pattern.severity,
+        name: pattern.name,
+        provider: pattern.provider,
+        file: relativePath,
+        line: pos.line,
+        column: pos.column,
+        match: redact(match[0])
+      });
+    }
+  }
+  for (const pattern of PII_PATTERNS) {
+    pattern.pattern.lastIndex = 0;
+    let match;
+    while ((match = pattern.pattern.exec(content)) !== null) {
+      const matchStr = match[0];
+      if (isLikelyFalsePositive(matchStr, pattern.name)) {
+        continue;
+      }
+      const pos = getPosition(content, match.index);
+      issues.push({
+        type: "pii",
+        severity: pattern.severity,
+        name: pattern.name,
+        file: relativePath,
+        line: pos.line,
+        column: pos.column,
+        match: redact(matchStr, 3)
+      });
+    }
+  }
+  for (const pattern of ROUTE_PATTERNS) {
+    pattern.pattern.lastIndex = 0;
+    let match;
+    while ((match = pattern.pattern.exec(content)) !== null) {
+      const pos = getPosition(content, match.index);
+      issues.push({
+        type: "route",
+        severity: pattern.severity,
+        name: pattern.name,
+        file: relativePath,
+        line: pos.line,
+        column: pos.column,
+        match: match[0],
+        description: pattern.description
+      });
+    }
+  }
+  const fileName = path.basename(filePath);
+  if (fileName.startsWith(".env") && !fileName.includes(".example")) {
+    const gitignorePath = path.join(path.dirname(filePath), ".gitignore");
+    const gitignoreExists = fs.existsSync(gitignorePath);
+    issues.push({
+      type: "config",
+      severity: "high",
+      name: "Environment file in repository",
+      file: relativePath,
+      line: 1,
+      column: 1,
+      match: fileName,
+      description: gitignoreExists ? "Verify this file is in .gitignore" : "Add .env* to .gitignore"
+    });
+  }
+  return issues;
+}
+function isLikelyFalsePositive(match, patternName) {
+  if (patternName === "Email Address") {
+    const falseDomains = [
+      "example.com",
+      "example.org",
+      "test.com",
+      "localhost",
+      "placeholder.com"
+    ];
+    if (falseDomains.some((d) => match.includes(d))) {
+      return true;
+    }
+    const publicPrefixes = [
+      "support@",
+      "help@",
+      "info@",
+      "contact@",
+      "sales@",
+      "admin@",
+      "noreply@",
+      "no-reply@",
+      "hello@",
+      "team@",
+      "partners@",
+      "enterprise@",
+      "security@",
+      "privacy@",
+      "legal@"
+    ];
+    if (publicPrefixes.some((p) => match.toLowerCase().startsWith(p))) {
+      return true;
+    }
+  }
+  if (patternName === "IP Address") {
+    const falseIPs = ["0.0.0.0", "127.0.0.1", "192.168.", "10.0.", "172.16."];
+    if (falseIPs.some((ip) => match.startsWith(ip))) {
+      return true;
+    }
+  }
+  if (patternName.includes("Phone Number")) {
+    if (match.includes("555") || match.includes("123-456") || match.includes("000-000")) {
+      return true;
+    }
+  }
+  return false;
+}
+function calculateScore(issues) {
+  const critical = issues.filter((i) => i.severity === "critical").length;
+  const high = issues.filter((i) => i.severity === "high").length;
+  const medium = issues.filter((i) => i.severity === "medium").length;
+  const total = issues.length;
+  if (critical > 0) return "F";
+  if (high >= 3) return "F";
+  if (high >= 2) return "D";
+  if (high >= 1 || medium >= 5) return "C";
+  if (medium >= 2) return "B";
+  if (total === 0) return "A";
+  return "B";
+}
+function getTierDescription(score) {
+  switch (score) {
+    case "A":
+      return "Excellent! No security issues detected.";
+    case "B":
+      return "Good, but minor improvements recommended.";
+    case "C":
+      return "Fair. Some security concerns need attention.";
+    case "D":
+      return "Poor. Significant security issues detected.";
+    case "F":
+      return "Critical! Your app is leaking secrets.";
+    default:
+      return "";
+  }
+}
+async function scan(targetPath) {
+  const startTime = Date.now();
+  const absolutePath = path.resolve(targetPath);
+  const files = await (0, import_glob.glob)("**/*", {
+    cwd: absolutePath,
+    nodir: true,
+    ignore: IGNORE_PATTERNS,
+    absolute: true
+  });
+  const issues = [];
+  let filesScanned = 0;
+  for (const file of files) {
+    if (!isScannable(file) || shouldIgnore(file)) {
+      continue;
+    }
+    try {
+      const content = fs.readFileSync(file, "utf-8");
+      const relativePath = path.relative(absolutePath, file);
+      const fileIssues = scanFile(relativePath, content);
+      issues.push(...fileIssues);
+      filesScanned++;
+    } catch {
+      continue;
+    }
+  }
+  const score = calculateScore(issues);
+  const scanDuration = Date.now() - startTime;
+  return {
+    score,
+    tierDescription: getTierDescription(score),
+    issues,
+    filesScanned,
+    scanDuration,
+    summary: {
+      secrets: issues.filter((i) => i.type === "secret").length,
+      pii: issues.filter((i) => i.type === "pii").length,
+      routes: issues.filter((i) => i.type === "route").length,
+      config: issues.filter((i) => i.type === "config").length,
+      critical: issues.filter((i) => i.severity === "critical").length,
+      high: issues.filter((i) => i.severity === "high").length,
+      medium: issues.filter((i) => i.severity === "medium").length,
+      low: issues.filter((i) => i.severity === "low").length
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PII_PATTERNS,
+  ROUTE_PATTERNS,
+  SECRET_PATTERNS,
+  scan
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/scanner/index.ts","../src/scanner/patterns.ts"],"sourcesContent":["/**\n * Cencori Vibe Check\n * Security scanner for AI apps\n */\n\nexport { scan, type ScanResult, type ScanIssue } from './scanner/index.js';\nexport {\n    SECRET_PATTERNS,\n    PII_PATTERNS,\n    ROUTE_PATTERNS,\n    type SecretPattern,\n    type PIIPattern,\n    type RoutePattern,\n} from './scanner/patterns.js';\n","import * as fs from 'fs';\nimport * as path from 'path';\nimport { glob } from 'glob';\nimport {\n    SECRET_PATTERNS,\n    PII_PATTERNS,\n    ROUTE_PATTERNS,\n    IGNORE_PATTERNS,\n    SCANNABLE_EXTENSIONS,\n    type SecretPattern,\n    type PIIPattern,\n    type RoutePattern,\n} from './patterns';\n\nexport interface ScanIssue {\n    type: 'secret' | 'pii' | 'route' | 'config';\n    severity: 'critical' | 'high' | 'medium' | 'low';\n    name: string;\n    provider?: string;\n    file: string;\n    line: number;\n    column: number;\n    match: string; // Redacted version\n    description?: string;\n}\n\nexport interface ScanResult {\n    score: 'A' | 'B' | 'C' | 'D' | 'F';\n    tierDescription: string;\n    issues: ScanIssue[];\n    filesScanned: number;\n    scanDuration: number;\n    summary: {\n        secrets: number;\n        pii: number;\n        routes: number;\n        config: number;\n        critical: number;\n        high: number;\n        medium: number;\n        low: number;\n    };\n}\n\n/**\n * Redact sensitive content for display\n */\nfunction redact(match: string, showChars: number = 4): string {\n    if (match.length <= showChars * 2) {\n        return '*'.repeat(match.length);\n    }\n    return match.slice(0, showChars) + '****' + match.slice(-showChars);\n}\n\n/**\n * Get line and column number for a match index\n */\nfunction getPosition(content: string, index: number): { line: number; column: number } {\n    const lines = content.slice(0, index).split('\\n');\n    return {\n        line: lines.length,\n        column: lines[lines.length - 1].length + 1,\n    };\n}\n\n/**\n * Check if a file should be ignored\n */\nfunction shouldIgnore(filePath: string): boolean {\n    const normalized = filePath.replace(/\\\\/g, '/');\n    return IGNORE_PATTERNS.some(pattern => {\n        if (pattern.startsWith('*')) {\n            return normalized.endsWith(pattern.slice(1));\n        }\n        return normalized.includes(pattern);\n    });\n}\n\n/**\n * Check if file has scannable extension\n */\nfunction isScannable(filePath: string): boolean {\n    const ext = path.extname(filePath).toLowerCase();\n    return SCANNABLE_EXTENSIONS.includes(ext);\n}\n\n/**\n * Scan a single file for issues\n */\nfunction scanFile(filePath: string, content: string): ScanIssue[] {\n    const issues: ScanIssue[] = [];\n    const relativePath = filePath;\n\n    // Scan for secrets\n    for (const pattern of SECRET_PATTERNS) {\n        // Reset regex lastIndex\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'secret',\n                severity: pattern.severity,\n                name: pattern.name,\n                provider: pattern.provider,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: redact(match[0]),\n            });\n        }\n    }\n\n    // Scan for PII\n    for (const pattern of PII_PATTERNS) {\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            // Skip common false positives\n            const matchStr = match[0];\n            if (isLikelyFalsePositive(matchStr, pattern.name)) {\n                continue;\n            }\n\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'pii',\n                severity: pattern.severity,\n                name: pattern.name,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: redact(matchStr, 3),\n            });\n        }\n    }\n\n    // Scan for exposed routes\n    for (const pattern of ROUTE_PATTERNS) {\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'route',\n                severity: pattern.severity,\n                name: pattern.name,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: match[0],\n                description: pattern.description,\n            });\n        }\n    }\n\n    // Check for .env files in wrong places\n    const fileName = path.basename(filePath);\n    if (fileName.startsWith('.env') && !fileName.includes('.example')) {\n        // If we're scanning a .env file, it might be committed\n        const gitignorePath = path.join(path.dirname(filePath), '.gitignore');\n        const gitignoreExists = fs.existsSync(gitignorePath);\n\n        issues.push({\n            type: 'config',\n            severity: 'high',\n            name: 'Environment file in repository',\n            file: relativePath,\n            line: 1,\n            column: 1,\n            match: fileName,\n            description: gitignoreExists\n                ? 'Verify this file is in .gitignore'\n                : 'Add .env* to .gitignore',\n        });\n    }\n\n    return issues;\n}\n\n/**\n * Filter out likely false positives\n */\nfunction isLikelyFalsePositive(match: string, patternName: string): boolean {\n    // Common email false positives\n    if (patternName === 'Email Address') {\n        const falseDomains = [\n            'example.com',\n            'example.org',\n            'test.com',\n            'localhost',\n            'placeholder.com',\n        ];\n        if (falseDomains.some(d => match.includes(d))) {\n            return true;\n        }\n\n        // Common public email prefixes (not personal PII)\n        const publicPrefixes = [\n            'support@',\n            'help@',\n            'info@',\n            'contact@',\n            'sales@',\n            'admin@',\n            'noreply@',\n            'no-reply@',\n            'hello@',\n            'team@',\n            'partners@',\n            'enterprise@',\n            'security@',\n            'privacy@',\n            'legal@',\n        ];\n        if (publicPrefixes.some(p => match.toLowerCase().startsWith(p))) {\n            return true;\n        }\n    }\n\n    // IP address false positives (version numbers, etc)\n    if (patternName === 'IP Address') {\n        const falseIPs = ['0.0.0.0', '127.0.0.1', '192.168.', '10.0.', '172.16.'];\n        if (falseIPs.some(ip => match.startsWith(ip))) {\n            return true;\n        }\n    }\n\n    // Phone number false positives (example numbers in docs)\n    if (patternName.includes('Phone Number')) {\n        // Common example phone numbers\n        if (match.includes('555') || match.includes('123-456') || match.includes('000-000')) {\n            return true;\n        }\n    }\n\n    return false;\n}\n\n/**\n * Calculate the fragility score based on issues\n */\nfunction calculateScore(issues: ScanIssue[]): 'A' | 'B' | 'C' | 'D' | 'F' {\n    const critical = issues.filter(i => i.severity === 'critical').length;\n    const high = issues.filter(i => i.severity === 'high').length;\n    const medium = issues.filter(i => i.severity === 'medium').length;\n    const total = issues.length;\n\n    // Scoring algorithm\n    if (critical > 0) return 'F';\n    if (high >= 3) return 'F';\n    if (high >= 2) return 'D';\n    if (high >= 1 || medium >= 5) return 'C';\n    if (medium >= 2) return 'B';\n    if (total === 0) return 'A';\n    return 'B';\n}\n\n/**\n * Get tier description\n */\nfunction getTierDescription(score: string): string {\n    switch (score) {\n        case 'A':\n            return 'Excellent! No security issues detected.';\n        case 'B':\n            return 'Good, but minor improvements recommended.';\n        case 'C':\n            return 'Fair. Some security concerns need attention.';\n        case 'D':\n            return 'Poor. Significant security issues detected.';\n        case 'F':\n            return 'Critical! Your app is leaking secrets.';\n        default:\n            return '';\n    }\n}\n\n/**\n * Main scan function\n */\nexport async function scan(targetPath: string): Promise<ScanResult> {\n    const startTime = Date.now();\n    const absolutePath = path.resolve(targetPath);\n\n    // Get all files\n    const files = await glob('**/*', {\n        cwd: absolutePath,\n        nodir: true,\n        ignore: IGNORE_PATTERNS,\n        absolute: true,\n    });\n\n    const issues: ScanIssue[] = [];\n    let filesScanned = 0;\n\n    for (const file of files) {\n        if (!isScannable(file) || shouldIgnore(file)) {\n            continue;\n        }\n\n        try {\n            const content = fs.readFileSync(file, 'utf-8');\n            const relativePath = path.relative(absolutePath, file);\n            const fileIssues = scanFile(relativePath, content);\n            issues.push(...fileIssues);\n            filesScanned++;\n        } catch {\n            // Skip files that can't be read\n            continue;\n        }\n    }\n\n    const score = calculateScore(issues);\n    const scanDuration = Date.now() - startTime;\n\n    return {\n        score,\n        tierDescription: getTierDescription(score),\n        issues,\n        filesScanned,\n        scanDuration,\n        summary: {\n            secrets: issues.filter(i => i.type === 'secret').length,\n            pii: issues.filter(i => i.type === 'pii').length,\n            routes: issues.filter(i => i.type === 'route').length,\n            config: issues.filter(i => i.type === 'config').length,\n            critical: issues.filter(i => i.severity === 'critical').length,\n            high: issues.filter(i => i.severity === 'high').length,\n            medium: issues.filter(i => i.severity === 'medium').length,\n            low: issues.filter(i => i.severity === 'low').length,\n        },\n    };\n}\n","/**\n * Secret detection patterns for common API keys and tokens\n */\nexport interface SecretPattern {\n    name: string;\n    provider: string;\n    pattern: RegExp;\n    severity: 'critical' | 'high' | 'medium' | 'low';\n}\n\nexport const SECRET_PATTERNS: SecretPattern[] = [\n    // OpenAI\n    {\n        name: 'OpenAI API Key',\n        provider: 'OpenAI',\n        pattern: /sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'OpenAI Project Key',\n        provider: 'OpenAI',\n        pattern: /sk-proj-[a-zA-Z0-9_-]{80,}/g,\n        severity: 'critical',\n    },\n    // Anthropic\n    {\n        name: 'Anthropic API Key',\n        provider: 'Anthropic',\n        pattern: /sk-ant-[a-zA-Z0-9-]{90,}/g,\n        severity: 'critical',\n    },\n    // Google\n    {\n        name: 'Google API Key',\n        provider: 'Google',\n        pattern: /AIza[0-9A-Za-z_-]{35}/g,\n        severity: 'critical',\n    },\n    // Supabase\n    {\n        name: 'Supabase Service Role Key',\n        provider: 'Supabase',\n        pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\\.[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Supabase Anon Key (if hardcoded)',\n        provider: 'Supabase',\n        pattern: /SUPABASE_ANON_KEY\\s*[:=]\\s*[\"']eyJ[^\"']+[\"']/g,\n        severity: 'medium',\n    },\n    // Stripe\n    {\n        name: 'Stripe Secret Key',\n        provider: 'Stripe',\n        pattern: /sk_live_[0-9a-zA-Z]{24,}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Stripe Test Key',\n        provider: 'Stripe',\n        pattern: /sk_test_[0-9a-zA-Z]{24,}/g,\n        severity: 'medium',\n    },\n    // AWS\n    {\n        name: 'AWS Access Key ID',\n        provider: 'AWS',\n        pattern: /AKIA[0-9A-Z]{16}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'AWS Secret Access Key',\n        provider: 'AWS',\n        pattern: /aws_secret_access_key\\s*[:=]\\s*[\"'][A-Za-z0-9/+=]{40}[\"']/gi,\n        severity: 'critical',\n    },\n    // GitHub\n    {\n        name: 'GitHub Personal Access Token',\n        provider: 'GitHub',\n        pattern: /ghp_[a-zA-Z0-9]{36}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'GitHub OAuth Token',\n        provider: 'GitHub',\n        pattern: /gho_[a-zA-Z0-9]{36}/g,\n        severity: 'critical',\n    },\n    // Telegram\n    {\n        name: 'Telegram Bot Token',\n        provider: 'Telegram',\n        pattern: /[0-9]{9,10}:[a-zA-Z0-9_-]{35}/g,\n        severity: 'high',\n    },\n    // Discord\n    {\n        name: 'Discord Bot Token',\n        provider: 'Discord',\n        pattern: /[MN][A-Za-z\\d]{23,}\\.[\\w-]{6}\\.[\\w-]{27}/g,\n        severity: 'high',\n    },\n    // Slack\n    {\n        name: 'Slack Bot Token',\n        provider: 'Slack',\n        pattern: /xoxb-[0-9]{11}-[0-9]{11}-[a-zA-Z0-9]{24}/g,\n        severity: 'high',\n    },\n    // SendGrid\n    {\n        name: 'SendGrid API Key',\n        provider: 'SendGrid',\n        pattern: /SG\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9_-]{43}/g,\n        severity: 'high',\n    },\n    // Twilio\n    {\n        name: 'Twilio API Key',\n        provider: 'Twilio',\n        pattern: /SK[a-fA-F0-9]{32}/g,\n        severity: 'high',\n    },\n    // Mailgun\n    {\n        name: 'Mailgun API Key',\n        provider: 'Mailgun',\n        pattern: /key-[a-zA-Z0-9]{32}/g,\n        severity: 'high',\n    },\n    // Firebase\n    {\n        name: 'Firebase Database URL',\n        provider: 'Firebase',\n        pattern: /https:\\/\\/[a-z0-9-]+\\.firebaseio\\.com/g,\n        severity: 'medium',\n    },\n    // Generic patterns\n    {\n        name: 'Private Key',\n        provider: 'Generic',\n        pattern: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Generic API Key Assignment',\n        provider: 'Generic',\n        pattern: /(api_key|apikey|api_secret|secret_key)\\s*[:=]\\s*[\"'][a-zA-Z0-9_-]{20,}[\"']/gi,\n        severity: 'high',\n    },\n    {\n        name: 'Password Assignment',\n        provider: 'Generic',\n        pattern: /(password|passwd|pwd)\\s*[:=]\\s*[\"'][^\"']{8,}[\"']/gi,\n        severity: 'high',\n    },\n    // Replicate\n    {\n        name: 'Replicate API Token',\n        provider: 'Replicate',\n        pattern: /r8_[a-zA-Z0-9]{38}/g,\n        severity: 'critical',\n    },\n    // Hugging Face\n    {\n        name: 'Hugging Face Token',\n        provider: 'Hugging Face',\n        pattern: /hf_[a-zA-Z0-9]{34}/g,\n        severity: 'critical',\n    },\n    // Cohere\n    {\n        name: 'Cohere API Key',\n        provider: 'Cohere',\n        pattern: /[a-zA-Z0-9]{40}/g, // Less specific, check context\n        severity: 'medium',\n    },\n];\n\n/**\n * PII detection patterns\n */\nexport interface PIIPattern {\n    name: string;\n    pattern: RegExp;\n    severity: 'high' | 'medium' | 'low';\n}\n\nexport const PII_PATTERNS: PIIPattern[] = [\n    {\n        name: 'Email Address',\n        pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Phone Number (US)',\n        pattern: /(\\+1[-.\\s]?)?\\(?\\d{3}\\)?[-.\\s]?\\d{3}[-.\\s]?\\d{4}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Phone Number (International)',\n        pattern: /\\+[1-9]\\d{1,14}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Social Security Number',\n        pattern: /\\b\\d{3}-\\d{2}-\\d{4}\\b/g,\n        severity: 'high',\n    },\n    {\n        name: 'Credit Card Number',\n        pattern: /\\b(?:\\d{4}[-\\s]?){3}\\d{4}\\b/g,\n        severity: 'high',\n    },\n    {\n        name: 'IP Address',\n        pattern: /\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b/g,\n        severity: 'low',\n    },\n];\n\n/**\n * Exposed route patterns for common frameworks\n */\nexport interface RoutePattern {\n    name: string;\n    framework: string;\n    pattern: RegExp;\n    severity: 'high' | 'medium' | 'low';\n    description: string;\n}\n\nexport const ROUTE_PATTERNS: RoutePattern[] = [\n    // Next.js API routes without auth\n    {\n        name: 'Next.js API Route (check for auth)',\n        framework: 'Next.js',\n        pattern: /export\\s+(async\\s+)?function\\s+(GET|POST|PUT|DELETE|PATCH)\\s*\\(/g,\n        severity: 'medium',\n        description: 'API route handler - verify authentication is implemented',\n    },\n    // Express routes\n    {\n        name: 'Express Route without Auth Middleware',\n        framework: 'Express',\n        pattern: /app\\.(get|post|put|delete|patch)\\s*\\(\\s*[\"'`][^\"'`]+[\"'`]\\s*,\\s*(?!.*auth)/gi,\n        severity: 'medium',\n        description: 'Express route - check if auth middleware is applied',\n    },\n];\n\n/**\n * Files/patterns to ignore\n */\nexport const IGNORE_PATTERNS = [\n    'node_modules',\n    '.git',\n    'dist',\n    'build',\n    '.next',\n    '.venv',\n    '__pycache__',\n    '*.min.js',\n    '*.min.css',\n    '*.map',\n    'package-lock.json',\n    'yarn.lock',\n    'pnpm-lock.yaml',\n];\n\n/**\n * File extensions to scan\n */\nexport const SCANNABLE_EXTENSIONS = [\n    '.js',\n    '.jsx',\n    '.ts',\n    '.tsx',\n    '.mjs',\n    '.cjs',\n    '.py',\n    '.rb',\n    '.go',\n    '.java',\n    '.php',\n    '.env',\n    '.json',\n    '.yaml',\n    '.yml',\n    '.toml',\n    '.xml',\n    '.md',\n    '.txt',\n    '.sql',\n    '.sh',\n    '.bash',\n    '.zsh',\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAoB;AACpB,WAAsB;AACtB,kBAAqB;;;ACQd,IAAM,kBAAmC;AAAA;AAAA,EAE5C;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,IACT,UAAU;AAAA,EACd;AACJ;AAWO,IAAM,eAA6B;AAAA,EACtC;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AACJ;AAaO,IAAM,iBAAiC;AAAA;AAAA,EAE1C;AAAA,IACI,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AACJ;AAKO,IAAM,kBAAkB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;AAKO,IAAM,uBAAuB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;;;AD5PA,SAAS,OAAO,OAAe,YAAoB,GAAW;AAC1D,MAAI,MAAM,UAAU,YAAY,GAAG;AAC/B,WAAO,IAAI,OAAO,MAAM,MAAM;AAAA,EAClC;AACA,SAAO,MAAM,MAAM,GAAG,SAAS,IAAI,SAAS,MAAM,MAAM,CAAC,SAAS;AACtE;AAKA,SAAS,YAAY,SAAiB,OAAiD;AACnF,QAAM,QAAQ,QAAQ,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI;AAChD,SAAO;AAAA,IACH,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM,MAAM,SAAS,CAAC,EAAE,SAAS;AAAA,EAC7C;AACJ;AAKA,SAAS,aAAa,UAA2B;AAC7C,QAAM,aAAa,SAAS,QAAQ,OAAO,GAAG;AAC9C,SAAO,gBAAgB,KAAK,aAAW;AACnC,QAAI,QAAQ,WAAW,GAAG,GAAG;AACzB,aAAO,WAAW,SAAS,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC/C;AACA,WAAO,WAAW,SAAS,OAAO;AAAA,EACtC,CAAC;AACL;AAKA,SAAS,YAAY,UAA2B;AAC5C,QAAM,MAAW,aAAQ,QAAQ,EAAE,YAAY;AAC/C,SAAO,qBAAqB,SAAS,GAAG;AAC5C;AAKA,SAAS,SAAS,UAAkB,SAA8B;AAC9D,QAAM,SAAsB,CAAC;AAC7B,QAAM,eAAe;AAGrB,aAAW,WAAW,iBAAiB;AAEnC,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AACrD,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,UAAU,QAAQ;AAAA,QAClB,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,OAAO,MAAM,CAAC,CAAC;AAAA,MAC1B,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,aAAW,WAAW,cAAc;AAChC,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AAErD,YAAM,WAAW,MAAM,CAAC;AACxB,UAAI,sBAAsB,UAAU,QAAQ,IAAI,GAAG;AAC/C;AAAA,MACJ;AAEA,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,OAAO,UAAU,CAAC;AAAA,MAC7B,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,aAAW,WAAW,gBAAgB;AAClC,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AACrD,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,MAAM,CAAC;AAAA,QACd,aAAa,QAAQ;AAAA,MACzB,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,QAAM,WAAgB,cAAS,QAAQ;AACvC,MAAI,SAAS,WAAW,MAAM,KAAK,CAAC,SAAS,SAAS,UAAU,GAAG;AAE/D,UAAM,gBAAqB,UAAU,aAAQ,QAAQ,GAAG,YAAY;AACpE,UAAM,kBAAqB,cAAW,aAAa;AAEnD,WAAO,KAAK;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,MACV,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,aAAa,kBACP,sCACA;AAAA,IACV,CAAC;AAAA,EACL;AAEA,SAAO;AACX;AAKA,SAAS,sBAAsB,OAAe,aAA8B;AAExE,MAAI,gBAAgB,iBAAiB;AACjC,UAAM,eAAe;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AACA,QAAI,aAAa,KAAK,OAAK,MAAM,SAAS,CAAC,CAAC,GAAG;AAC3C,aAAO;AAAA,IACX;AAGA,UAAM,iBAAiB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AACA,QAAI,eAAe,KAAK,OAAK,MAAM,YAAY,EAAE,WAAW,CAAC,CAAC,GAAG;AAC7D,aAAO;AAAA,IACX;AAAA,EACJ;AAGA,MAAI,gBAAgB,cAAc;AAC9B,UAAM,WAAW,CAAC,WAAW,aAAa,YAAY,SAAS,SAAS;AACxE,QAAI,SAAS,KAAK,QAAM,MAAM,WAAW,EAAE,CAAC,GAAG;AAC3C,aAAO;AAAA,IACX;AAAA,EACJ;AAGA,MAAI,YAAY,SAAS,cAAc,GAAG;AAEtC,QAAI,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS,KAAK,MAAM,SAAS,SAAS,GAAG;AACjF,aAAO;AAAA,IACX;AAAA,EACJ;AAEA,SAAO;AACX;AAKA,SAAS,eAAe,QAAkD;AACtE,QAAM,WAAW,OAAO,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AAC/D,QAAM,OAAO,OAAO,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AACvD,QAAM,SAAS,OAAO,OAAO,OAAK,EAAE,aAAa,QAAQ,EAAE;AAC3D,QAAM,QAAQ,OAAO;AAGrB,MAAI,WAAW,EAAG,QAAO;AACzB,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,QAAQ,KAAK,UAAU,EAAG,QAAO;AACrC,MAAI,UAAU,EAAG,QAAO;AACxB,MAAI,UAAU,EAAG,QAAO;AACxB,SAAO;AACX;AAKA,SAAS,mBAAmB,OAAuB;AAC/C,UAAQ,OAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX;AACI,aAAO;AAAA,EACf;AACJ;AAKA,eAAsB,KAAK,YAAyC;AAChE,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,eAAoB,aAAQ,UAAU;AAG5C,QAAM,QAAQ,UAAM,kBAAK,QAAQ;AAAA,IAC7B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,EACd,CAAC;AAED,QAAM,SAAsB,CAAC;AAC7B,MAAI,eAAe;AAEnB,aAAW,QAAQ,OAAO;AACtB,QAAI,CAAC,YAAY,IAAI,KAAK,aAAa,IAAI,GAAG;AAC1C;AAAA,IACJ;AAEA,QAAI;AACA,YAAM,UAAa,gBAAa,MAAM,OAAO;AAC7C,YAAM,eAAoB,cAAS,cAAc,IAAI;AACrD,YAAM,aAAa,SAAS,cAAc,OAAO;AACjD,aAAO,KAAK,GAAG,UAAU;AACzB;AAAA,IACJ,QAAQ;AAEJ;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,QAAQ,eAAe,MAAM;AACnC,QAAM,eAAe,KAAK,IAAI,IAAI;AAElC,SAAO;AAAA,IACH;AAAA,IACA,iBAAiB,mBAAmB,KAAK;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,MACL,SAAS,OAAO,OAAO,OAAK,EAAE,SAAS,QAAQ,EAAE;AAAA,MACjD,KAAK,OAAO,OAAO,OAAK,EAAE,SAAS,KAAK,EAAE;AAAA,MAC1C,QAAQ,OAAO,OAAO,OAAK,EAAE,SAAS,OAAO,EAAE;AAAA,MAC/C,QAAQ,OAAO,OAAO,OAAK,EAAE,SAAS,QAAQ,EAAE;AAAA,MAChD,UAAU,OAAO,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AAAA,MACxD,MAAM,OAAO,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AAAA,MAChD,QAAQ,OAAO,OAAO,OAAK,EAAE,aAAa,QAAQ,EAAE;AAAA,MACpD,KAAK,OAAO,OAAO,OAAK,EAAE,aAAa,KAAK,EAAE;AAAA,IAClD;AAAA,EACJ;AACJ;","names":[]}