@cencori/scan 0.1.1 → 0.3.0

package/dist/index.js

@@ -97,6 +97,12 @@ var SECRET_PATTERNS = [
     pattern: /sk_test_[0-9a-zA-Z]{24,}/g,
     severity: "medium"
   },
+  {
+    name: "Stripe Webhook Secret",
+    provider: "Stripe",
+    pattern: /whsec_[a-zA-Z0-9]{24,}/g,
+    severity: "critical"
+  },
   // AWS
   {
     name: "AWS Access Key ID",
@@ -123,6 +129,12 @@ var SECRET_PATTERNS = [
     pattern: /gho_[a-zA-Z0-9]{36}/g,
     severity: "critical"
   },
+  {
+    name: "GitHub Webhook Secret",
+    provider: "GitHub",
+    pattern: /sha256=[a-fA-F0-9]{64}/g,
+    severity: "high"
+  },
   // Telegram
   {
     name: "Telegram Bot Token",
@@ -205,13 +217,56 @@ var SECRET_PATTERNS = [
     pattern: /hf_[a-zA-Z0-9]{34}/g,
     severity: "critical"
   },
-  // Cohere
+  // JWT Secrets
   {
-    name: "Cohere API Key",
-    provider: "Cohere",
-    pattern: /[a-zA-Z0-9]{40}/g,
-    // Less specific, check context
-    severity: "medium"
+    name: "JWT Secret Assignment",
+    provider: "Generic",
+    pattern: /JWT_SECRET\s*[:=]\s*["'][^"']{16,}["']/gi,
+    severity: "critical"
+  },
+  {
+    name: "Hardcoded JWT Sign",
+    provider: "Generic",
+    pattern: /jwt\.(sign|verify)\s*\([^,]+,\s*["'][^"']{10,}["']/gi,
+    severity: "critical"
+  },
+  // OAuth Secrets
+  {
+    name: "OAuth Client Secret",
+    provider: "Generic",
+    pattern: /client_secret\s*[:=]\s*["'][a-zA-Z0-9_-]{20,}["']/gi,
+    severity: "critical"
+  },
+  {
+    name: "Google Client Secret",
+    provider: "Google",
+    pattern: /GOOGLE_CLIENT_SECRET\s*[:=]\s*["'][^"']+["']/gi,
+    severity: "critical"
+  },
+  // Database Connection Strings
+  {
+    name: "MongoDB Connection String",
+    provider: "MongoDB",
+    pattern: /mongodb(\+srv)?:\/\/[^@\s]+@[^\s"']+/g,
+    severity: "critical"
+  },
+  {
+    name: "PostgreSQL Connection String",
+    provider: "PostgreSQL",
+    pattern: /postgres(ql)?:\/\/[^\s"']+/g,
+    severity: "critical"
+  },
+  {
+    name: "MySQL Connection String",
+    provider: "MySQL",
+    pattern: /mysql:\/\/[^\s"']+/g,
+    severity: "critical"
+  },
+  {
+    name: "Redis Connection String",
+    provider: "Redis",
+    pattern: /redis:\/\/[^\s"']+/g,
+    severity: "high"
   }
 ];
 var PII_PATTERNS = [
@@ -247,7 +302,7 @@ var PII_PATTERNS = [
   }
 ];
 var ROUTE_PATTERNS = [
-  // Next.js API routes without auth
+  // Next.js API routes
   {
     name: "Next.js API Route (check for auth)",
     framework: "Next.js",
@@ -262,6 +317,120 @@ var ROUTE_PATTERNS = [
     pattern: /app\.(get|post|put|delete|patch)\s*\(\s*["'`][^"'`]+["'`]\s*,\s*(?!.*auth)/gi,
     severity: "medium",
     description: "Express route - check if auth middleware is applied"
+  },
+  // Admin routes
+  {
+    name: "Admin Route Exposed",
+    framework: "Generic",
+    pattern: /["'`](\/admin|\/dashboard|\/internal|\/private)[^"'`]*["'`]/gi,
+    severity: "high",
+    description: "Sensitive route - ensure proper authentication"
+  }
+];
+var VULNERABILITY_PATTERNS = [
+  // Hardcoded URLs
+  {
+    name: "Localhost URL in Code",
+    category: "hardcoded-url",
+    pattern: /https?:\/\/localhost[:\d]*/gi,
+    severity: "medium",
+    description: "Development URL - should use environment variables"
+  },
+  {
+    name: "Staging/Dev URL in Code",
+    category: "hardcoded-url",
+    pattern: /https?:\/\/(staging\.|dev\.|test\.)[^\s"']+/gi,
+    severity: "medium",
+    description: "Non-production URL in code"
+  },
+  // Debug artifacts (skip console.log - too many false positives for CLI tools)
+  {
+    name: "Debug Flag Enabled",
+    category: "debug",
+    pattern: /DEBUG\s*[:=]\s*(true|1|["']true["'])/gi,
+    severity: "medium",
+    description: "Debug mode enabled - disable in production"
+  },
+  {
+    name: "Hardcoded Development Mode",
+    category: "debug",
+    pattern: /NODE_ENV\s*[:=]\s*["']development["']/gi,
+    severity: "medium",
+    description: "Hardcoded development mode"
+  },
+  // CORS issues
+  {
+    name: "CORS Wildcard Origin",
+    category: "cors",
+    pattern: /Access-Control-Allow-Origin['":\s]+\*/g,
+    severity: "high",
+    description: "Allows requests from any origin - security risk"
+  },
+  {
+    name: "Permissive CORS Config",
+    category: "cors",
+    pattern: /cors\s*\(\s*\)/g,
+    severity: "medium",
+    description: "CORS with default (permissive) settings"
+  },
+  // SQL Injection
+  {
+    name: "SQL String Concatenation",
+    category: "injection",
+    pattern: /query\s*\(\s*[`'"].*\$\{.*\}/g,
+    severity: "critical",
+    description: "Potential SQL injection - use parameterized queries"
+  },
+  {
+    name: "SQL String Addition",
+    category: "injection",
+    pattern: /(SELECT|INSERT|UPDATE|DELETE).*["']\s*\+\s*\w+/gi,
+    severity: "critical",
+    description: "SQL built with string concatenation"
+  },
+  // XSS Vulnerabilities
+  {
+    name: "React dangerouslySetInnerHTML",
+    category: "xss",
+    pattern: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html/g,
+    severity: "high",
+    description: "Renders raw HTML - ensure input is sanitized"
+  },
+  {
+    name: "Direct innerHTML Assignment",
+    category: "xss",
+    pattern: /\.innerHTML\s*=/g,
+    severity: "high",
+    description: "Direct HTML injection - use textContent instead"
+  },
+  {
+    name: "Vue v-html Directive",
+    category: "xss",
+    pattern: /v-html\s*=\s*["'][^"']+["']/g,
+    severity: "high",
+    description: "Vue raw HTML binding - ensure input is sanitized"
+  },
+  {
+    name: "Document Write",
+    category: "xss",
+    pattern: /document\.write\s*\(/g,
+    severity: "high",
+    description: "Deprecated and potentially dangerous"
+  },
+  // Eval and code execution
+  {
+    name: "Eval Usage",
+    category: "injection",
+    pattern: /\beval\s*\(/g,
+    severity: "critical",
+    description: "Code execution - major security risk"
+  },
+  {
+    name: "Function Constructor",
+    category: "injection",
+    pattern: /new\s+Function\s*\(/g,
+    severity: "high",
+    description: "Dynamic code execution risk"
   }
 ];
 var IGNORE_PATTERNS = [
@@ -302,7 +471,9 @@ var SCANNABLE_EXTENSIONS = [
   ".sql",
   ".sh",
   ".bash",
-  ".zsh"
+  ".zsh",
+  ".vue",
+  ".svelte"
 ];
 
 // src/scanner/index.ts
@@ -332,9 +503,14 @@ function isScannable(filePath) {
   const ext = path.extname(filePath).toLowerCase();
   return SCANNABLE_EXTENSIONS.includes(ext);
 }
+function isDocOrTestFile(filePath) {
+  const lower = filePath.toLowerCase();
+  return lower.includes(".test.") || lower.includes(".spec.") || lower.includes("__tests__") || lower.includes("/test/") || lower.includes("/tests/") || lower.endsWith(".md") || lower.includes("/docs/");
+}
 function scanFile(filePath, content) {
   const issues = [];
   const relativePath = filePath;
+  const isDocFile = isDocOrTestFile(filePath);
   for (const pattern of SECRET_PATTERNS) {
     pattern.pattern.lastIndex = 0;
     let match;
@@ -352,47 +528,73 @@ function scanFile(filePath, content) {
       });
     }
   }
-  for (const pattern of PII_PATTERNS) {
+  if (!isDocFile) {
+    for (const pattern of PII_PATTERNS) {
+      pattern.pattern.lastIndex = 0;
+      let match;
+      while ((match = pattern.pattern.exec(content)) !== null) {
+        const matchStr = match[0];
+        if (isLikelyFalsePositive(matchStr, pattern.name, filePath)) {
+          continue;
+        }
+        const pos = getPosition(content, match.index);
+        issues.push({
+          type: "pii",
+          severity: pattern.severity,
+          name: pattern.name,
+          file: relativePath,
+          line: pos.line,
+          column: pos.column,
+          match: redact(matchStr, 3)
+        });
+      }
+    }
+  }
+  for (const pattern of ROUTE_PATTERNS) {
     pattern.pattern.lastIndex = 0;
     let match;
     while ((match = pattern.pattern.exec(content)) !== null) {
-      const matchStr = match[0];
-      if (isLikelyFalsePositive(matchStr, pattern.name)) {
-        continue;
-      }
       const pos = getPosition(content, match.index);
       issues.push({
-        type: "pii",
+        type: "route",
         severity: pattern.severity,
         name: pattern.name,
         file: relativePath,
         line: pos.line,
         column: pos.column,
-        match: redact(matchStr, 3)
+        match: match[0],
+        description: pattern.description
       });
     }
   }
-  for (const pattern of ROUTE_PATTERNS) {
+  for (const pattern of VULNERABILITY_PATTERNS) {
+    if (pattern.category === "debug" && isDocFile) {
+      continue;
+    }
     pattern.pattern.lastIndex = 0;
     let match;
     while ((match = pattern.pattern.exec(content)) !== null) {
+      if (pattern.category === "debug" && pattern.name === "Console Log Statement") {
+        if (match[0].includes("error") || match[0].includes("warn")) {
+          continue;
+        }
+      }
       const pos = getPosition(content, match.index);
       issues.push({
-        type: "route",
+        type: "vulnerability",
+        category: pattern.category,
         severity: pattern.severity,
         name: pattern.name,
         file: relativePath,
         line: pos.line,
         column: pos.column,
-        match: match[0],
+        match: match[0].length > 50 ? match[0].slice(0, 50) + "..." : match[0],
         description: pattern.description
       });
     }
   }
   const fileName = path.basename(filePath);
   if (fileName.startsWith(".env") && !fileName.includes(".example")) {
-    const gitignorePath = path.join(path.dirname(filePath), ".gitignore");
-    const gitignoreExists = fs.existsSync(gitignorePath);
     issues.push({
       type: "config",
       severity: "high",
@@ -401,20 +603,14 @@ function scanFile(filePath, content) {
       line: 1,
       column: 1,
       match: fileName,
-      description: gitignoreExists ? "Verify this file is in .gitignore" : "Add .env* to .gitignore"
+      description: "Add .env* to .gitignore"
     });
   }
   return issues;
 }
-function isLikelyFalsePositive(match, patternName) {
+function isLikelyFalsePositive(match, patternName, filePath) {
   if (patternName === "Email Address") {
-    const falseDomains = [
-      "example.com",
-      "example.org",
-      "test.com",
-      "localhost",
-      "placeholder.com"
-    ];
+    const falseDomains = ["example.com", "example.org", "test.com", "localhost", "placeholder.com"];
     if (falseDomains.some((d) => match.includes(d))) {
       return true;
     }
@@ -456,13 +652,12 @@ function calculateScore(issues) {
   const critical = issues.filter((i) => i.severity === "critical").length;
   const high = issues.filter((i) => i.severity === "high").length;
   const medium = issues.filter((i) => i.severity === "medium").length;
-  const total = issues.length;
   if (critical > 0) return "F";
   if (high >= 3) return "F";
   if (high >= 2) return "D";
   if (high >= 1 || medium >= 5) return "C";
   if (medium >= 2) return "B";
-  if (total === 0) return "A";
+  if (issues.length === 0) return "A";
   return "B";
 }
 function getTierDescription(score) {
@@ -476,7 +671,7 @@ function getTierDescription(score) {
     case "D":
       return "Poor. Significant security issues detected.";
     case "F":
-      return "Critical! Your app is leaking secrets.";
+      return "Critical! Major security vulnerabilities found.";
     default:
       return "";
   }
@@ -519,6 +714,7 @@ async function scan(targetPath) {
       pii: issues.filter((i) => i.type === "pii").length,
       routes: issues.filter((i) => i.type === "route").length,
       config: issues.filter((i) => i.type === "config").length,
+      vulnerabilities: issues.filter((i) => i.type === "vulnerability").length,
       critical: issues.filter((i) => i.severity === "critical").length,
       high: issues.filter((i) => i.severity === "high").length,
       medium: issues.filter((i) => i.severity === "medium").length,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/scanner/index.ts","../src/scanner/patterns.ts"],"sourcesContent":["/**\n * Cencori Vibe Check\n * Security scanner for AI apps\n */\n\nexport { scan, type ScanResult, type ScanIssue } from './scanner/index.js';\nexport {\n    SECRET_PATTERNS,\n    PII_PATTERNS,\n    ROUTE_PATTERNS,\n    type SecretPattern,\n    type PIIPattern,\n    type RoutePattern,\n} from './scanner/patterns.js';\n","import * as fs from 'fs';\nimport * as path from 'path';\nimport { glob } from 'glob';\nimport {\n    SECRET_PATTERNS,\n    PII_PATTERNS,\n    ROUTE_PATTERNS,\n    IGNORE_PATTERNS,\n    SCANNABLE_EXTENSIONS,\n    type SecretPattern,\n    type PIIPattern,\n    type RoutePattern,\n} from './patterns';\n\nexport interface ScanIssue {\n    type: 'secret' | 'pii' | 'route' | 'config';\n    severity: 'critical' | 'high' | 'medium' | 'low';\n    name: string;\n    provider?: string;\n    file: string;\n    line: number;\n    column: number;\n    match: string; // Redacted version\n    description?: string;\n}\n\nexport interface ScanResult {\n    score: 'A' | 'B' | 'C' | 'D' | 'F';\n    tierDescription: string;\n    issues: ScanIssue[];\n    filesScanned: number;\n    scanDuration: number;\n    summary: {\n        secrets: number;\n        pii: number;\n        routes: number;\n        config: number;\n        critical: number;\n        high: number;\n        medium: number;\n        low: number;\n    };\n}\n\n/**\n * Redact sensitive content for display\n */\nfunction redact(match: string, showChars: number = 4): string {\n    if (match.length <= showChars * 2) {\n        return '*'.repeat(match.length);\n    }\n    return match.slice(0, showChars) + '****' + match.slice(-showChars);\n}\n\n/**\n * Get line and column number for a match index\n */\nfunction getPosition(content: string, index: number): { line: number; column: number } {\n    const lines = content.slice(0, index).split('\\n');\n    return {\n        line: lines.length,\n        column: lines[lines.length - 1].length + 1,\n    };\n}\n\n/**\n * Check if a file should be ignored\n */\nfunction shouldIgnore(filePath: string): boolean {\n    const normalized = filePath.replace(/\\\\/g, '/');\n    return IGNORE_PATTERNS.some(pattern => {\n        if (pattern.startsWith('*')) {\n            return normalized.endsWith(pattern.slice(1));\n        }\n        return normalized.includes(pattern);\n    });\n}\n\n/**\n * Check if file has scannable extension\n */\nfunction isScannable(filePath: string): boolean {\n    const ext = path.extname(filePath).toLowerCase();\n    return SCANNABLE_EXTENSIONS.includes(ext);\n}\n\n/**\n * Scan a single file for issues\n */\nfunction scanFile(filePath: string, content: string): ScanIssue[] {\n    const issues: ScanIssue[] = [];\n    const relativePath = filePath;\n\n    // Scan for secrets\n    for (const pattern of SECRET_PATTERNS) {\n        // Reset regex lastIndex\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'secret',\n                severity: pattern.severity,\n                name: pattern.name,\n                provider: pattern.provider,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: redact(match[0]),\n            });\n        }\n    }\n\n    // Scan for PII\n    for (const pattern of PII_PATTERNS) {\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            // Skip common false positives\n            const matchStr = match[0];\n            if (isLikelyFalsePositive(matchStr, pattern.name)) {\n                continue;\n            }\n\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'pii',\n                severity: pattern.severity,\n                name: pattern.name,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: redact(matchStr, 3),\n            });\n        }\n    }\n\n    // Scan for exposed routes\n    for (const pattern of ROUTE_PATTERNS) {\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'route',\n                severity: pattern.severity,\n                name: pattern.name,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: match[0],\n                description: pattern.description,\n            });\n        }\n    }\n\n    // Check for .env files in wrong places\n    const fileName = path.basename(filePath);\n    if (fileName.startsWith('.env') && !fileName.includes('.example')) {\n        // If we're scanning a .env file, it might be committed\n        const gitignorePath = path.join(path.dirname(filePath), '.gitignore');\n        const gitignoreExists = fs.existsSync(gitignorePath);\n\n        issues.push({\n            type: 'config',\n            severity: 'high',\n            name: 'Environment file in repository',\n            file: relativePath,\n            line: 1,\n            column: 1,\n            match: fileName,\n            description: gitignoreExists\n                ? 'Verify this file is in .gitignore'\n                : 'Add .env* to .gitignore',\n        });\n    }\n\n    return issues;\n}\n\n/**\n * Filter out likely false positives\n */\nfunction isLikelyFalsePositive(match: string, patternName: string): boolean {\n    // Common email false positives\n    if (patternName === 'Email Address') {\n        const falseDomains = [\n            'example.com',\n            'example.org',\n            'test.com',\n            'localhost',\n            'placeholder.com',\n        ];\n        if (falseDomains.some(d => match.includes(d))) {\n            return true;\n        }\n\n        // Common public email prefixes (not personal PII)\n        const publicPrefixes = [\n            'support@',\n            'help@',\n            'info@',\n            'contact@',\n            'sales@',\n            'admin@',\n            'noreply@',\n            'no-reply@',\n            'hello@',\n            'team@',\n            'partners@',\n            'enterprise@',\n            'security@',\n            'privacy@',\n            'legal@',\n        ];\n        if (publicPrefixes.some(p => match.toLowerCase().startsWith(p))) {\n            return true;\n        }\n    }\n\n    // IP address false positives (version numbers, etc)\n    if (patternName === 'IP Address') {\n        const falseIPs = ['0.0.0.0', '127.0.0.1', '192.168.', '10.0.', '172.16.'];\n        if (falseIPs.some(ip => match.startsWith(ip))) {\n            return true;\n        }\n    }\n\n    // Phone number false positives (example numbers in docs)\n    if (patternName.includes('Phone Number')) {\n        // Common example phone numbers\n        if (match.includes('555') || match.includes('123-456') || match.includes('000-000')) {\n            return true;\n        }\n    }\n\n    return false;\n}\n\n/**\n * Calculate the fragility score based on issues\n */\nfunction calculateScore(issues: ScanIssue[]): 'A' | 'B' | 'C' | 'D' | 'F' {\n    const critical = issues.filter(i => i.severity === 'critical').length;\n    const high = issues.filter(i => i.severity === 'high').length;\n    const medium = issues.filter(i => i.severity === 'medium').length;\n    const total = issues.length;\n\n    // Scoring algorithm\n    if (critical > 0) return 'F';\n    if (high >= 3) return 'F';\n    if (high >= 2) return 'D';\n    if (high >= 1 || medium >= 5) return 'C';\n    if (medium >= 2) return 'B';\n    if (total === 0) return 'A';\n    return 'B';\n}\n\n/**\n * Get tier description\n */\nfunction getTierDescription(score: string): string {\n    switch (score) {\n        case 'A':\n            return 'Excellent! No security issues detected.';\n        case 'B':\n            return 'Good, but minor improvements recommended.';\n        case 'C':\n            return 'Fair. Some security concerns need attention.';\n        case 'D':\n            return 'Poor. Significant security issues detected.';\n        case 'F':\n            return 'Critical! Your app is leaking secrets.';\n        default:\n            return '';\n    }\n}\n\n/**\n * Main scan function\n */\nexport async function scan(targetPath: string): Promise<ScanResult> {\n    const startTime = Date.now();\n    const absolutePath = path.resolve(targetPath);\n\n    // Get all files\n    const files = await glob('**/*', {\n        cwd: absolutePath,\n        nodir: true,\n        ignore: IGNORE_PATTERNS,\n        absolute: true,\n    });\n\n    const issues: ScanIssue[] = [];\n    let filesScanned = 0;\n\n    for (const file of files) {\n        if (!isScannable(file) || shouldIgnore(file)) {\n            continue;\n        }\n\n        try {\n            const content = fs.readFileSync(file, 'utf-8');\n            const relativePath = path.relative(absolutePath, file);\n            const fileIssues = scanFile(relativePath, content);\n            issues.push(...fileIssues);\n            filesScanned++;\n        } catch {\n            // Skip files that can't be read\n            continue;\n        }\n    }\n\n    const score = calculateScore(issues);\n    const scanDuration = Date.now() - startTime;\n\n    return {\n        score,\n        tierDescription: getTierDescription(score),\n        issues,\n        filesScanned,\n        scanDuration,\n        summary: {\n            secrets: issues.filter(i => i.type === 'secret').length,\n            pii: issues.filter(i => i.type === 'pii').length,\n            routes: issues.filter(i => i.type === 'route').length,\n            config: issues.filter(i => i.type === 'config').length,\n            critical: issues.filter(i => i.severity === 'critical').length,\n            high: issues.filter(i => i.severity === 'high').length,\n            medium: issues.filter(i => i.severity === 'medium').length,\n            low: issues.filter(i => i.severity === 'low').length,\n        },\n    };\n}\n","/**\n * Secret detection patterns for common API keys and tokens\n */\nexport interface SecretPattern {\n    name: string;\n    provider: string;\n    pattern: RegExp;\n    severity: 'critical' | 'high' | 'medium' | 'low';\n}\n\nexport const SECRET_PATTERNS: SecretPattern[] = [\n    // OpenAI\n    {\n        name: 'OpenAI API Key',\n        provider: 'OpenAI',\n        pattern: /sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'OpenAI Project Key',\n        provider: 'OpenAI',\n        pattern: /sk-proj-[a-zA-Z0-9_-]{80,}/g,\n        severity: 'critical',\n    },\n    // Anthropic\n    {\n        name: 'Anthropic API Key',\n        provider: 'Anthropic',\n        pattern: /sk-ant-[a-zA-Z0-9-]{90,}/g,\n        severity: 'critical',\n    },\n    // Google\n    {\n        name: 'Google API Key',\n        provider: 'Google',\n        pattern: /AIza[0-9A-Za-z_-]{35}/g,\n        severity: 'critical',\n    },\n    // Supabase\n    {\n        name: 'Supabase Service Role Key',\n        provider: 'Supabase',\n        pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\\.[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Supabase Anon Key (if hardcoded)',\n        provider: 'Supabase',\n        pattern: /SUPABASE_ANON_KEY\\s*[:=]\\s*[\"']eyJ[^\"']+[\"']/g,\n        severity: 'medium',\n    },\n    // Stripe\n    {\n        name: 'Stripe Secret Key',\n        provider: 'Stripe',\n        pattern: /sk_live_[0-9a-zA-Z]{24,}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Stripe Test Key',\n        provider: 'Stripe',\n        pattern: /sk_test_[0-9a-zA-Z]{24,}/g,\n        severity: 'medium',\n    },\n    // AWS\n    {\n        name: 'AWS Access Key ID',\n        provider: 'AWS',\n        pattern: /AKIA[0-9A-Z]{16}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'AWS Secret Access Key',\n        provider: 'AWS',\n        pattern: /aws_secret_access_key\\s*[:=]\\s*[\"'][A-Za-z0-9/+=]{40}[\"']/gi,\n        severity: 'critical',\n    },\n    // GitHub\n    {\n        name: 'GitHub Personal Access Token',\n        provider: 'GitHub',\n        pattern: /ghp_[a-zA-Z0-9]{36}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'GitHub OAuth Token',\n        provider: 'GitHub',\n        pattern: /gho_[a-zA-Z0-9]{36}/g,\n        severity: 'critical',\n    },\n    // Telegram\n    {\n        name: 'Telegram Bot Token',\n        provider: 'Telegram',\n        pattern: /[0-9]{9,10}:[a-zA-Z0-9_-]{35}/g,\n        severity: 'high',\n    },\n    // Discord\n    {\n        name: 'Discord Bot Token',\n        provider: 'Discord',\n        pattern: /[MN][A-Za-z\\d]{23,}\\.[\\w-]{6}\\.[\\w-]{27}/g,\n        severity: 'high',\n    },\n    // Slack\n    {\n        name: 'Slack Bot Token',\n        provider: 'Slack',\n        pattern: /xoxb-[0-9]{11}-[0-9]{11}-[a-zA-Z0-9]{24}/g,\n        severity: 'high',\n    },\n    // SendGrid\n    {\n        name: 'SendGrid API Key',\n        provider: 'SendGrid',\n        pattern: /SG\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9_-]{43}/g,\n        severity: 'high',\n    },\n    // Twilio\n    {\n        name: 'Twilio API Key',\n        provider: 'Twilio',\n        pattern: /SK[a-fA-F0-9]{32}/g,\n        severity: 'high',\n    },\n    // Mailgun\n    {\n        name: 'Mailgun API Key',\n        provider: 'Mailgun',\n        pattern: /key-[a-zA-Z0-9]{32}/g,\n        severity: 'high',\n    },\n    // Firebase\n    {\n        name: 'Firebase Database URL',\n        provider: 'Firebase',\n        pattern: /https:\\/\\/[a-z0-9-]+\\.firebaseio\\.com/g,\n        severity: 'medium',\n    },\n    // Generic patterns\n    {\n        name: 'Private Key',\n        provider: 'Generic',\n        pattern: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Generic API Key Assignment',\n        provider: 'Generic',\n        pattern: /(api_key|apikey|api_secret|secret_key)\\s*[:=]\\s*[\"'][a-zA-Z0-9_-]{20,}[\"']/gi,\n        severity: 'high',\n    },\n    {\n        name: 'Password Assignment',\n        provider: 'Generic',\n        pattern: /(password|passwd|pwd)\\s*[:=]\\s*[\"'][^\"']{8,}[\"']/gi,\n        severity: 'high',\n    },\n    // Replicate\n    {\n        name: 'Replicate API Token',\n        provider: 'Replicate',\n        pattern: /r8_[a-zA-Z0-9]{38}/g,\n        severity: 'critical',\n    },\n    // Hugging Face\n    {\n        name: 'Hugging Face Token',\n        provider: 'Hugging Face',\n        pattern: /hf_[a-zA-Z0-9]{34}/g,\n        severity: 'critical',\n    },\n    // Cohere\n    {\n        name: 'Cohere API Key',\n        provider: 'Cohere',\n        pattern: /[a-zA-Z0-9]{40}/g, // Less specific, check context\n        severity: 'medium',\n    },\n];\n\n/**\n * PII detection patterns\n */\nexport interface PIIPattern {\n    name: string;\n    pattern: RegExp;\n    severity: 'high' | 'medium' | 'low';\n}\n\nexport const PII_PATTERNS: PIIPattern[] = [\n    {\n        name: 'Email Address',\n        pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Phone Number (US)',\n        pattern: /(\\+1[-.\\s]?)?\\(?\\d{3}\\)?[-.\\s]?\\d{3}[-.\\s]?\\d{4}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Phone Number (International)',\n        pattern: /\\+[1-9]\\d{1,14}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Social Security Number',\n        pattern: /\\b\\d{3}-\\d{2}-\\d{4}\\b/g,\n        severity: 'high',\n    },\n    {\n        name: 'Credit Card Number',\n        pattern: /\\b(?:\\d{4}[-\\s]?){3}\\d{4}\\b/g,\n        severity: 'high',\n    },\n    {\n        name: 'IP Address',\n        pattern: /\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b/g,\n        severity: 'low',\n    },\n];\n\n/**\n * Exposed route patterns for common frameworks\n */\nexport interface RoutePattern {\n    name: string;\n    framework: string;\n    pattern: RegExp;\n    severity: 'high' | 'medium' | 'low';\n    description: string;\n}\n\nexport const ROUTE_PATTERNS: RoutePattern[] = [\n    // Next.js API routes without auth\n    {\n        name: 'Next.js API Route (check for auth)',\n        framework: 'Next.js',\n        pattern: /export\\s+(async\\s+)?function\\s+(GET|POST|PUT|DELETE|PATCH)\\s*\\(/g,\n        severity: 'medium',\n        description: 'API route handler - verify authentication is implemented',\n    },\n    // Express routes\n    {\n        name: 'Express Route without Auth Middleware',\n        framework: 'Express',\n        pattern: /app\\.(get|post|put|delete|patch)\\s*\\(\\s*[\"'`][^\"'`]+[\"'`]\\s*,\\s*(?!.*auth)/gi,\n        severity: 'medium',\n        description: 'Express route - check if auth middleware is applied',\n    },\n];\n\n/**\n * Files/patterns to ignore\n */\nexport const IGNORE_PATTERNS = [\n    'node_modules',\n    '.git',\n    'dist',\n    'build',\n    '.next',\n    '.venv',\n    '__pycache__',\n    '*.min.js',\n    '*.min.css',\n    '*.map',\n    'package-lock.json',\n    'yarn.lock',\n    'pnpm-lock.yaml',\n];\n\n/**\n * File extensions to scan\n */\nexport const SCANNABLE_EXTENSIONS = [\n    '.js',\n    '.jsx',\n    '.ts',\n    '.tsx',\n    '.mjs',\n    '.cjs',\n    '.py',\n    '.rb',\n    '.go',\n    '.java',\n    '.php',\n    '.env',\n    '.json',\n    '.yaml',\n    '.yml',\n    '.toml',\n    '.xml',\n    '.md',\n    '.txt',\n    '.sql',\n    '.sh',\n    '.bash',\n    '.zsh',\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAoB;AACpB,WAAsB;AACtB,kBAAqB;;;ACQd,IAAM,kBAAmC;AAAA;AAAA,EAE5C;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,IACT,UAAU;AAAA,EACd;AACJ;AAWO,IAAM,eAA6B;AAAA,EACtC;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AACJ;AAaO,IAAM,iBAAiC;AAAA;AAAA,EAE1C;AAAA,IACI,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AACJ;AAKO,IAAM,kBAAkB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;AAKO,IAAM,uBAAuB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;;;AD5PA,SAAS,OAAO,OAAe,YAAoB,GAAW;AAC1D,MAAI,MAAM,UAAU,YAAY,GAAG;AAC/B,WAAO,IAAI,OAAO,MAAM,MAAM;AAAA,EAClC;AACA,SAAO,MAAM,MAAM,GAAG,SAAS,IAAI,SAAS,MAAM,MAAM,CAAC,SAAS;AACtE;AAKA,SAAS,YAAY,SAAiB,OAAiD;AACnF,QAAM,QAAQ,QAAQ,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI;AAChD,SAAO;AAAA,IACH,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM,MAAM,SAAS,CAAC,EAAE,SAAS;AAAA,EAC7C;AACJ;AAKA,SAAS,aAAa,UAA2B;AAC7C,QAAM,aAAa,SAAS,QAAQ,OAAO,GAAG;AAC9C,SAAO,gBAAgB,KAAK,aAAW;AACnC,QAAI,QAAQ,WAAW,GAAG,GAAG;AACzB,aAAO,WAAW,SAAS,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC/C;AACA,WAAO,WAAW,SAAS,OAAO;AAAA,EACtC,CAAC;AACL;AAKA,SAAS,YAAY,UAA2B;AAC5C,QAAM,MAAW,aAAQ,QAAQ,EAAE,YAAY;AAC/C,SAAO,qBAAqB,SAAS,GAAG;AAC5C;AAKA,SAAS,SAAS,UAAkB,SAA8B;AAC9D,QAAM,SAAsB,CAAC;AAC7B,QAAM,eAAe;AAGrB,aAAW,WAAW,iBAAiB;AAEnC,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AACrD,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,UAAU,QAAQ;AAAA,QAClB,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,OAAO,MAAM,CAAC,CAAC;AAAA,MAC1B,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,aAAW,WAAW,cAAc;AAChC,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AAErD,YAAM,WAAW,MAAM,CAAC;AACxB,UAAI,sBAAsB,UAAU,QAAQ,IAAI,GAAG;AAC/C;AAAA,MACJ;AAEA,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,OAAO,UAAU,CAAC;AAAA,MAC7B,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,aAAW,WAAW,gBAAgB;AAClC,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AACrD,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,MAAM,CAAC;AAAA,QACd,aAAa,QAAQ;AAAA,MACzB,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,QAAM,WAAgB,cAAS,QAAQ;AACvC,MAAI,SAAS,WAAW,MAAM,KAAK,CAAC,SAAS,SAAS,UAAU,GAAG;AAE/D,UAAM,gBAAqB,UAAU,aAAQ,QAAQ,GAAG,YAAY;AACpE,UAAM,kBAAqB,cAAW,aAAa;AAEnD,WAAO,KAAK;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,MACV,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,aAAa,kBACP,sCACA;AAAA,IACV,CAAC;AAAA,EACL;AAEA,SAAO;AACX;AAKA,SAAS,sBAAsB,OAAe,aAA8B;AAExE,MAAI,gBAAgB,iBAAiB;AACjC,UAAM,eAAe;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AACA,QAAI,aAAa,KAAK,OAAK,MAAM,SAAS,CAAC,CAAC,GAAG;AAC3C,aAAO;AAAA,IACX;AAGA,UAAM,iBAAiB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AACA,QAAI,eAAe,KAAK,OAAK,MAAM,YAAY,EAAE,WAAW,CAAC,CAAC,GAAG;AAC7D,aAAO;AAAA,IACX;AAAA,EACJ;AAGA,MAAI,gBAAgB,cAAc;AAC9B,UAAM,WAAW,CAAC,WAAW,aAAa,YAAY,SAAS,SAAS;AACxE,QAAI,SAAS,KAAK,QAAM,MAAM,WAAW,EAAE,CAAC,GAAG;AAC3C,aAAO;AAAA,IACX;AAAA,EACJ;AAGA,MAAI,YAAY,SAAS,cAAc,GAAG;AAEtC,QAAI,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS,KAAK,MAAM,SAAS,SAAS,GAAG;AACjF,aAAO;AAAA,IACX;AAAA,EACJ;AAEA,SAAO;AACX;AAKA,SAAS,eAAe,QAAkD;AACtE,QAAM,WAAW,OAAO,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AAC/D,QAAM,OAAO,OAAO,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AACvD,QAAM,SAAS,OAAO,OAAO,OAAK,EAAE,aAAa,QAAQ,EAAE;AAC3D,QAAM,QAAQ,OAAO;AAGrB,MAAI,WAAW,EAAG,QAAO;AACzB,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,QAAQ,KAAK,UAAU,EAAG,QAAO;AACrC,MAAI,UAAU,EAAG,QAAO;AACxB,MAAI,UAAU,EAAG,QAAO;AACxB,SAAO;AACX;AAKA,SAAS,mBAAmB,OAAuB;AAC/C,UAAQ,OAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX,KAAK;AACD,aAAO;AAAA,IACX;AACI,aAAO;AAAA,EACf;AACJ;AAKA,eAAsB,KAAK,YAAyC;AAChE,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,eAAoB,aAAQ,UAAU;AAG5C,QAAM,QAAQ,UAAM,kBAAK,QAAQ;AAAA,IAC7B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,EACd,CAAC;AAED,QAAM,SAAsB,CAAC;AAC7B,MAAI,eAAe;AAEnB,aAAW,QAAQ,OAAO;AACtB,QAAI,CAAC,YAAY,IAAI,KAAK,aAAa,IAAI,GAAG;AAC1C;AAAA,IACJ;AAEA,QAAI;AACA,YAAM,UAAa,gBAAa,MAAM,OAAO;AAC7C,YAAM,eAAoB,cAAS,cAAc,IAAI;AACrD,YAAM,aAAa,SAAS,cAAc,OAAO;AACjD,aAAO,KAAK,GAAG,UAAU;AACzB;AAAA,IACJ,QAAQ;AAEJ;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,QAAQ,eAAe,MAAM;AACnC,QAAM,eAAe,KAAK,IAAI,IAAI;AAElC,SAAO;AAAA,IACH;AAAA,IACA,iBAAiB,mBAAmB,KAAK;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,MACL,SAAS,OAAO,OAAO,OAAK,EAAE,SAAS,QAAQ,EAAE;AAAA,MACjD,KAAK,OAAO,OAAO,OAAK,EAAE,SAAS,KAAK,EAAE;AAAA,MAC1C,QAAQ,OAAO,OAAO,OAAK,EAAE,SAAS,OAAO,EAAE;AAAA,MAC/C,QAAQ,OAAO,OAAO,OAAK,EAAE,SAAS,QAAQ,EAAE;AAAA,MAChD,UAAU,OAAO,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AAAA,MACxD,MAAM,OAAO,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AAAA,MAChD,QAAQ,OAAO,OAAO,OAAK,EAAE,aAAa,QAAQ,EAAE;AAAA,MACpD,KAAK,OAAO,OAAO,OAAK,EAAE,aAAa,KAAK,EAAE;AAAA,IAClD;AAAA,EACJ;AACJ;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/scanner/index.ts","../src/scanner/patterns.ts"],"sourcesContent":["/**\n * Cencori Vibe Check\n * Security scanner for AI apps\n */\n\nexport { scan, type ScanResult, type ScanIssue } from './scanner/index.js';\nexport {\n    SECRET_PATTERNS,\n    PII_PATTERNS,\n    ROUTE_PATTERNS,\n    type SecretPattern,\n    type PIIPattern,\n    type RoutePattern,\n} from './scanner/patterns.js';\n","import * as fs from 'fs';\nimport * as path from 'path';\nimport { glob } from 'glob';\nimport {\n    SECRET_PATTERNS,\n    PII_PATTERNS,\n    ROUTE_PATTERNS,\n    VULNERABILITY_PATTERNS,\n    IGNORE_PATTERNS,\n    SCANNABLE_EXTENSIONS,\n} from './patterns';\n\nexport type IssueType = 'secret' | 'pii' | 'route' | 'config' | 'vulnerability';\nexport type IssueSeverity = 'critical' | 'high' | 'medium' | 'low';\n\nexport interface ScanIssue {\n    type: IssueType;\n    category?: string;\n    severity: IssueSeverity;\n    name: string;\n    provider?: string;\n    file: string;\n    line: number;\n    column: number;\n    match: string;\n    description?: string;\n}\n\nexport interface ScanResult {\n    score: 'A' | 'B' | 'C' | 'D' | 'F';\n    tierDescription: string;\n    issues: ScanIssue[];\n    filesScanned: number;\n    scanDuration: number;\n    summary: {\n        secrets: number;\n        pii: number;\n        routes: number;\n        config: number;\n        vulnerabilities: number;\n        critical: number;\n        high: number;\n        medium: number;\n        low: number;\n    };\n}\n\n/**\n * Redact sensitive content for display\n */\nfunction redact(match: string, showChars: number = 4): string {\n    if (match.length <= showChars * 2) {\n        return '*'.repeat(match.length);\n    }\n    return match.slice(0, showChars) + '****' + match.slice(-showChars);\n}\n\n/**\n * Get line and column number for a match index\n */\nfunction getPosition(content: string, index: number): { line: number; column: number } {\n    const lines = content.slice(0, index).split('\\n');\n    return {\n        line: lines.length,\n        column: lines[lines.length - 1].length + 1,\n    };\n}\n\n/**\n * Check if a file should be ignored\n */\nfunction shouldIgnore(filePath: string): boolean {\n    const normalized = filePath.replace(/\\\\/g, '/');\n    return IGNORE_PATTERNS.some(pattern => {\n        if (pattern.startsWith('*')) {\n            return normalized.endsWith(pattern.slice(1));\n        }\n        return normalized.includes(pattern);\n    });\n}\n\n/**\n * Check if file has scannable extension\n */\nfunction isScannable(filePath: string): boolean {\n    const ext = path.extname(filePath).toLowerCase();\n    return SCANNABLE_EXTENSIONS.includes(ext);\n}\n\n/**\n * Check if file is a documentation or test file\n */\nfunction isDocOrTestFile(filePath: string): boolean {\n    const lower = filePath.toLowerCase();\n    return (\n        lower.includes('.test.') ||\n        lower.includes('.spec.') ||\n        lower.includes('__tests__') ||\n        lower.includes('/test/') ||\n        lower.includes('/tests/') ||\n        lower.endsWith('.md') ||\n        lower.includes('/docs/')\n    );\n}\n\n/**\n * Scan a single file for issues\n */\nfunction scanFile(filePath: string, content: string): ScanIssue[] {\n    const issues: ScanIssue[] = [];\n    const relativePath = filePath;\n    const isDocFile = isDocOrTestFile(filePath);\n\n    // Scan for secrets\n    for (const pattern of SECRET_PATTERNS) {\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'secret',\n                severity: pattern.severity,\n                name: pattern.name,\n                provider: pattern.provider,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: redact(match[0]),\n            });\n        }\n    }\n\n    // Scan for PII (skip in doc files)\n    if (!isDocFile) {\n        for (const pattern of PII_PATTERNS) {\n            pattern.pattern.lastIndex = 0;\n            let match;\n            while ((match = pattern.pattern.exec(content)) !== null) {\n                const matchStr = match[0];\n                if (isLikelyFalsePositive(matchStr, pattern.name, filePath)) {\n                    continue;\n                }\n\n                const pos = getPosition(content, match.index);\n                issues.push({\n                    type: 'pii',\n                    severity: pattern.severity,\n                    name: pattern.name,\n                    file: relativePath,\n                    line: pos.line,\n                    column: pos.column,\n                    match: redact(matchStr, 3),\n                });\n            }\n        }\n    }\n\n    // Scan for exposed routes\n    for (const pattern of ROUTE_PATTERNS) {\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'route',\n                severity: pattern.severity,\n                name: pattern.name,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: match[0],\n                description: pattern.description,\n            });\n        }\n    }\n\n    // Scan for vulnerabilities (skip debug checks in test files)\n    for (const pattern of VULNERABILITY_PATTERNS) {\n        // Skip debug pattern checks in test/doc files\n        if (pattern.category === 'debug' && isDocFile) {\n            continue;\n        }\n\n        pattern.pattern.lastIndex = 0;\n        let match;\n        while ((match = pattern.pattern.exec(content)) !== null) {\n            // Skip console.log false positives\n            if (pattern.category === 'debug' && pattern.name === 'Console Log Statement') {\n                // Allow console.error and console.warn\n                if (match[0].includes('error') || match[0].includes('warn')) {\n                    continue;\n                }\n            }\n\n            const pos = getPosition(content, match.index);\n            issues.push({\n                type: 'vulnerability',\n                category: pattern.category,\n                severity: pattern.severity,\n                name: pattern.name,\n                file: relativePath,\n                line: pos.line,\n                column: pos.column,\n                match: match[0].length > 50 ? match[0].slice(0, 50) + '...' : match[0],\n                description: pattern.description,\n            });\n        }\n    }\n\n    // Check for .env files\n    const fileName = path.basename(filePath);\n    if (fileName.startsWith('.env') && !fileName.includes('.example')) {\n        issues.push({\n            type: 'config',\n            severity: 'high',\n            name: 'Environment file in repository',\n            file: relativePath,\n            line: 1,\n            column: 1,\n            match: fileName,\n            description: 'Add .env* to .gitignore',\n        });\n    }\n\n    return issues;\n}\n\n/**\n * Filter out likely false positives\n */\nfunction isLikelyFalsePositive(match: string, patternName: string, filePath: string): boolean {\n    // Email false positives\n    if (patternName === 'Email Address') {\n        const falseDomains = ['example.com', 'example.org', 'test.com', 'localhost', 'placeholder.com'];\n        if (falseDomains.some(d => match.includes(d))) {\n            return true;\n        }\n\n        const publicPrefixes = [\n            'support@', 'help@', 'info@', 'contact@', 'sales@', 'admin@',\n            'noreply@', 'no-reply@', 'hello@', 'team@', 'partners@',\n            'enterprise@', 'security@', 'privacy@', 'legal@',\n        ];\n        if (publicPrefixes.some(p => match.toLowerCase().startsWith(p))) {\n            return true;\n        }\n    }\n\n    // IP address false positives\n    if (patternName === 'IP Address') {\n        const falseIPs = ['0.0.0.0', '127.0.0.1', '192.168.', '10.0.', '172.16.'];\n        if (falseIPs.some(ip => match.startsWith(ip))) {\n            return true;\n        }\n    }\n\n    // Phone number false positives\n    if (patternName.includes('Phone Number')) {\n        if (match.includes('555') || match.includes('123-456') || match.includes('000-000')) {\n            return true;\n        }\n    }\n\n    return false;\n}\n\n/**\n * Calculate the security score\n */\nfunction calculateScore(issues: ScanIssue[]): 'A' | 'B' | 'C' | 'D' | 'F' {\n    const critical = issues.filter(i => i.severity === 'critical').length;\n    const high = issues.filter(i => i.severity === 'high').length;\n    const medium = issues.filter(i => i.severity === 'medium').length;\n\n    if (critical > 0) return 'F';\n    if (high >= 3) return 'F';\n    if (high >= 2) return 'D';\n    if (high >= 1 || medium >= 5) return 'C';\n    if (medium >= 2) return 'B';\n    if (issues.length === 0) return 'A';\n    return 'B';\n}\n\n/**\n * Get tier description\n */\nfunction getTierDescription(score: string): string {\n    switch (score) {\n        case 'A': return 'Excellent! No security issues detected.';\n        case 'B': return 'Good, but minor improvements recommended.';\n        case 'C': return 'Fair. Some security concerns need attention.';\n        case 'D': return 'Poor. Significant security issues detected.';\n        case 'F': return 'Critical! Major security vulnerabilities found.';\n        default: return '';\n    }\n}\n\n/**\n * Main scan function\n */\nexport async function scan(targetPath: string): Promise<ScanResult> {\n    const startTime = Date.now();\n    const absolutePath = path.resolve(targetPath);\n\n    const files = await glob('**/*', {\n        cwd: absolutePath,\n        nodir: true,\n        ignore: IGNORE_PATTERNS,\n        absolute: true,\n    });\n\n    const issues: ScanIssue[] = [];\n    let filesScanned = 0;\n\n    for (const file of files) {\n        if (!isScannable(file) || shouldIgnore(file)) {\n            continue;\n        }\n\n        try {\n            const content = fs.readFileSync(file, 'utf-8');\n            const relativePath = path.relative(absolutePath, file);\n            const fileIssues = scanFile(relativePath, content);\n            issues.push(...fileIssues);\n            filesScanned++;\n        } catch {\n            continue;\n        }\n    }\n\n    const score = calculateScore(issues);\n    const scanDuration = Date.now() - startTime;\n\n    return {\n        score,\n        tierDescription: getTierDescription(score),\n        issues,\n        filesScanned,\n        scanDuration,\n        summary: {\n            secrets: issues.filter(i => i.type === 'secret').length,\n            pii: issues.filter(i => i.type === 'pii').length,\n            routes: issues.filter(i => i.type === 'route').length,\n            config: issues.filter(i => i.type === 'config').length,\n            vulnerabilities: issues.filter(i => i.type === 'vulnerability').length,\n            critical: issues.filter(i => i.severity === 'critical').length,\n            high: issues.filter(i => i.severity === 'high').length,\n            medium: issues.filter(i => i.severity === 'medium').length,\n            low: issues.filter(i => i.severity === 'low').length,\n        },\n    };\n}\n","/**\n * Secret detection patterns for common API keys and tokens\n */\nexport interface SecretPattern {\n    name: string;\n    provider: string;\n    pattern: RegExp;\n    severity: 'critical' | 'high' | 'medium' | 'low';\n}\n\nexport const SECRET_PATTERNS: SecretPattern[] = [\n    // OpenAI\n    {\n        name: 'OpenAI API Key',\n        provider: 'OpenAI',\n        pattern: /sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'OpenAI Project Key',\n        provider: 'OpenAI',\n        pattern: /sk-proj-[a-zA-Z0-9_-]{80,}/g,\n        severity: 'critical',\n    },\n    // Anthropic\n    {\n        name: 'Anthropic API Key',\n        provider: 'Anthropic',\n        pattern: /sk-ant-[a-zA-Z0-9-]{90,}/g,\n        severity: 'critical',\n    },\n    // Google\n    {\n        name: 'Google API Key',\n        provider: 'Google',\n        pattern: /AIza[0-9A-Za-z_-]{35}/g,\n        severity: 'critical',\n    },\n    // Supabase\n    {\n        name: 'Supabase Service Role Key',\n        provider: 'Supabase',\n        pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\\.[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Supabase Anon Key (if hardcoded)',\n        provider: 'Supabase',\n        pattern: /SUPABASE_ANON_KEY\\s*[:=]\\s*[\"']eyJ[^\"']+[\"']/g,\n        severity: 'medium',\n    },\n    // Stripe\n    {\n        name: 'Stripe Secret Key',\n        provider: 'Stripe',\n        pattern: /sk_live_[0-9a-zA-Z]{24,}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Stripe Test Key',\n        provider: 'Stripe',\n        pattern: /sk_test_[0-9a-zA-Z]{24,}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Stripe Webhook Secret',\n        provider: 'Stripe',\n        pattern: /whsec_[a-zA-Z0-9]{24,}/g,\n        severity: 'critical',\n    },\n    // AWS\n    {\n        name: 'AWS Access Key ID',\n        provider: 'AWS',\n        pattern: /AKIA[0-9A-Z]{16}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'AWS Secret Access Key',\n        provider: 'AWS',\n        pattern: /aws_secret_access_key\\s*[:=]\\s*[\"'][A-Za-z0-9/+=]{40}[\"']/gi,\n        severity: 'critical',\n    },\n    // GitHub\n    {\n        name: 'GitHub Personal Access Token',\n        provider: 'GitHub',\n        pattern: /ghp_[a-zA-Z0-9]{36}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'GitHub OAuth Token',\n        provider: 'GitHub',\n        pattern: /gho_[a-zA-Z0-9]{36}/g,\n        severity: 'critical',\n    },\n    {\n        name: 'GitHub Webhook Secret',\n        provider: 'GitHub',\n        pattern: /sha256=[a-fA-F0-9]{64}/g,\n        severity: 'high',\n    },\n    // Telegram\n    {\n        name: 'Telegram Bot Token',\n        provider: 'Telegram',\n        pattern: /[0-9]{9,10}:[a-zA-Z0-9_-]{35}/g,\n        severity: 'high',\n    },\n    // Discord\n    {\n        name: 'Discord Bot Token',\n        provider: 'Discord',\n        pattern: /[MN][A-Za-z\\d]{23,}\\.[\\w-]{6}\\.[\\w-]{27}/g,\n        severity: 'high',\n    },\n    // Slack\n    {\n        name: 'Slack Bot Token',\n        provider: 'Slack',\n        pattern: /xoxb-[0-9]{11}-[0-9]{11}-[a-zA-Z0-9]{24}/g,\n        severity: 'high',\n    },\n    // SendGrid\n    {\n        name: 'SendGrid API Key',\n        provider: 'SendGrid',\n        pattern: /SG\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9_-]{43}/g,\n        severity: 'high',\n    },\n    // Twilio\n    {\n        name: 'Twilio API Key',\n        provider: 'Twilio',\n        pattern: /SK[a-fA-F0-9]{32}/g,\n        severity: 'high',\n    },\n    // Mailgun\n    {\n        name: 'Mailgun API Key',\n        provider: 'Mailgun',\n        pattern: /key-[a-zA-Z0-9]{32}/g,\n        severity: 'high',\n    },\n    // Firebase\n    {\n        name: 'Firebase Database URL',\n        provider: 'Firebase',\n        pattern: /https:\\/\\/[a-z0-9-]+\\.firebaseio\\.com/g,\n        severity: 'medium',\n    },\n    // Generic patterns\n    {\n        name: 'Private Key',\n        provider: 'Generic',\n        pattern: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Generic API Key Assignment',\n        provider: 'Generic',\n        pattern: /(api_key|apikey|api_secret|secret_key)\\s*[:=]\\s*[\"'][a-zA-Z0-9_-]{20,}[\"']/gi,\n        severity: 'high',\n    },\n    {\n        name: 'Password Assignment',\n        provider: 'Generic',\n        pattern: /(password|passwd|pwd)\\s*[:=]\\s*[\"'][^\"']{8,}[\"']/gi,\n        severity: 'high',\n    },\n    // Replicate\n    {\n        name: 'Replicate API Token',\n        provider: 'Replicate',\n        pattern: /r8_[a-zA-Z0-9]{38}/g,\n        severity: 'critical',\n    },\n    // Hugging Face\n    {\n        name: 'Hugging Face Token',\n        provider: 'Hugging Face',\n        pattern: /hf_[a-zA-Z0-9]{34}/g,\n        severity: 'critical',\n    },\n    // JWT Secrets\n    {\n        name: 'JWT Secret Assignment',\n        provider: 'Generic',\n        pattern: /JWT_SECRET\\s*[:=]\\s*[\"'][^\"']{16,}[\"']/gi,\n        severity: 'critical',\n    },\n    {\n        name: 'Hardcoded JWT Sign',\n        provider: 'Generic',\n        pattern: /jwt\\.(sign|verify)\\s*\\([^,]+,\\s*[\"'][^\"']{10,}[\"']/gi,\n        severity: 'critical',\n    },\n    // OAuth Secrets\n    {\n        name: 'OAuth Client Secret',\n        provider: 'Generic',\n        pattern: /client_secret\\s*[:=]\\s*[\"'][a-zA-Z0-9_-]{20,}[\"']/gi,\n        severity: 'critical',\n    },\n    {\n        name: 'Google Client Secret',\n        provider: 'Google',\n        pattern: /GOOGLE_CLIENT_SECRET\\s*[:=]\\s*[\"'][^\"']+[\"']/gi,\n        severity: 'critical',\n    },\n    // Database Connection Strings\n    {\n        name: 'MongoDB Connection String',\n        provider: 'MongoDB',\n        pattern: /mongodb(\\+srv)?:\\/\\/[^@\\s]+@[^\\s\"']+/g,\n        severity: 'critical',\n    },\n    {\n        name: 'PostgreSQL Connection String',\n        provider: 'PostgreSQL',\n        pattern: /postgres(ql)?:\\/\\/[^\\s\"']+/g,\n        severity: 'critical',\n    },\n    {\n        name: 'MySQL Connection String',\n        provider: 'MySQL',\n        pattern: /mysql:\\/\\/[^\\s\"']+/g,\n        severity: 'critical',\n    },\n    {\n        name: 'Redis Connection String',\n        provider: 'Redis',\n        pattern: /redis:\\/\\/[^\\s\"']+/g,\n        severity: 'high',\n    },\n];\n\n/**\n * PII detection patterns\n */\nexport interface PIIPattern {\n    name: string;\n    pattern: RegExp;\n    severity: 'high' | 'medium' | 'low';\n}\n\nexport const PII_PATTERNS: PIIPattern[] = [\n    {\n        name: 'Email Address',\n        pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Phone Number (US)',\n        pattern: /(\\+1[-.\\s]?)?\\(?\\d{3}\\)?[-.\\s]?\\d{3}[-.\\s]?\\d{4}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Phone Number (International)',\n        pattern: /\\+[1-9]\\d{1,14}/g,\n        severity: 'medium',\n    },\n    {\n        name: 'Social Security Number',\n        pattern: /\\b\\d{3}-\\d{2}-\\d{4}\\b/g,\n        severity: 'high',\n    },\n    {\n        name: 'Credit Card Number',\n        pattern: /\\b(?:\\d{4}[-\\s]?){3}\\d{4}\\b/g,\n        severity: 'high',\n    },\n    {\n        name: 'IP Address',\n        pattern: /\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b/g,\n        severity: 'low',\n    },\n];\n\n/**\n * Exposed route patterns for common frameworks\n */\nexport interface RoutePattern {\n    name: string;\n    framework: string;\n    pattern: RegExp;\n    severity: 'high' | 'medium' | 'low';\n    description: string;\n}\n\nexport const ROUTE_PATTERNS: RoutePattern[] = [\n    // Next.js API routes\n    {\n        name: 'Next.js API Route (check for auth)',\n        framework: 'Next.js',\n        pattern: /export\\s+(async\\s+)?function\\s+(GET|POST|PUT|DELETE|PATCH)\\s*\\(/g,\n        severity: 'medium',\n        description: 'API route handler - verify authentication is implemented',\n    },\n    // Express routes\n    {\n        name: 'Express Route without Auth Middleware',\n        framework: 'Express',\n        pattern: /app\\.(get|post|put|delete|patch)\\s*\\(\\s*[\"'`][^\"'`]+[\"'`]\\s*,\\s*(?!.*auth)/gi,\n        severity: 'medium',\n        description: 'Express route - check if auth middleware is applied',\n    },\n    // Admin routes\n    {\n        name: 'Admin Route Exposed',\n        framework: 'Generic',\n        pattern: /[\"'`](\\/admin|\\/dashboard|\\/internal|\\/private)[^\"'`]*[\"'`]/gi,\n        severity: 'high',\n        description: 'Sensitive route - ensure proper authentication',\n    },\n];\n\n/**\n * Security vulnerability patterns\n */\nexport interface VulnerabilityPattern {\n    name: string;\n    category: string;\n    pattern: RegExp;\n    severity: 'critical' | 'high' | 'medium' | 'low';\n    description: string;\n}\n\nexport const VULNERABILITY_PATTERNS: VulnerabilityPattern[] = [\n    // Hardcoded URLs\n    {\n        name: 'Localhost URL in Code',\n        category: 'hardcoded-url',\n        pattern: /https?:\\/\\/localhost[:\\d]*/gi,\n        severity: 'medium',\n        description: 'Development URL - should use environment variables',\n    },\n    {\n        name: 'Staging/Dev URL in Code',\n        category: 'hardcoded-url',\n        pattern: /https?:\\/\\/(staging\\.|dev\\.|test\\.)[^\\s\"']+/gi,\n        severity: 'medium',\n        description: 'Non-production URL in code',\n    },\n    // Debug artifacts (skip console.log - too many false positives for CLI tools)\n    {\n        name: 'Debug Flag Enabled',\n        category: 'debug',\n        pattern: /DEBUG\\s*[:=]\\s*(true|1|[\"']true[\"'])/gi,\n        severity: 'medium',\n        description: 'Debug mode enabled - disable in production',\n    },\n    {\n        name: 'Hardcoded Development Mode',\n        category: 'debug',\n        pattern: /NODE_ENV\\s*[:=]\\s*[\"']development[\"']/gi,\n        severity: 'medium',\n        description: 'Hardcoded development mode',\n    },\n    // CORS issues\n    {\n        name: 'CORS Wildcard Origin',\n        category: 'cors',\n        pattern: /Access-Control-Allow-Origin['\":\\s]+\\*/g,\n        severity: 'high',\n        description: 'Allows requests from any origin - security risk',\n    },\n    {\n        name: 'Permissive CORS Config',\n        category: 'cors',\n        pattern: /cors\\s*\\(\\s*\\)/g,\n        severity: 'medium',\n        description: 'CORS with default (permissive) settings',\n    },\n    // SQL Injection\n    {\n        name: 'SQL String Concatenation',\n        category: 'injection',\n        pattern: /query\\s*\\(\\s*[`'\"].*\\$\\{.*\\}/g,\n        severity: 'critical',\n        description: 'Potential SQL injection - use parameterized queries',\n    },\n    {\n        name: 'SQL String Addition',\n        category: 'injection',\n        pattern: /(SELECT|INSERT|UPDATE|DELETE).*[\"']\\s*\\+\\s*\\w+/gi,\n        severity: 'critical',\n        description: 'SQL built with string concatenation',\n    },\n    // XSS Vulnerabilities\n    {\n        name: 'React dangerouslySetInnerHTML',\n        category: 'xss',\n        pattern: /dangerouslySetInnerHTML\\s*=\\s*\\{\\s*\\{\\s*__html/g,\n        severity: 'high',\n        description: 'Renders raw HTML - ensure input is sanitized',\n    },\n    {\n        name: 'Direct innerHTML Assignment',\n        category: 'xss',\n        pattern: /\\.innerHTML\\s*=/g,\n        severity: 'high',\n        description: 'Direct HTML injection - use textContent instead',\n    },\n    {\n        name: 'Vue v-html Directive',\n        category: 'xss',\n        pattern: /v-html\\s*=\\s*[\"'][^\"']+[\"']/g,\n        severity: 'high',\n        description: 'Vue raw HTML binding - ensure input is sanitized',\n    },\n    {\n        name: 'Document Write',\n        category: 'xss',\n        pattern: /document\\.write\\s*\\(/g,\n        severity: 'high',\n        description: 'Deprecated and potentially dangerous',\n    },\n    // Eval and code execution\n    {\n        name: 'Eval Usage',\n        category: 'injection',\n        pattern: /\\beval\\s*\\(/g,\n        severity: 'critical',\n        description: 'Code execution - major security risk',\n    },\n    {\n        name: 'Function Constructor',\n        category: 'injection',\n        pattern: /new\\s+Function\\s*\\(/g,\n        severity: 'high',\n        description: 'Dynamic code execution risk',\n    },\n];\n\n/**\n * Files/patterns to ignore\n */\nexport const IGNORE_PATTERNS = [\n    'node_modules',\n    '.git',\n    'dist',\n    'build',\n    '.next',\n    '.venv',\n    '__pycache__',\n    '*.min.js',\n    '*.min.css',\n    '*.map',\n    'package-lock.json',\n    'yarn.lock',\n    'pnpm-lock.yaml',\n];\n\n/**\n * File extensions to scan\n */\nexport const SCANNABLE_EXTENSIONS = [\n    '.js',\n    '.jsx',\n    '.ts',\n    '.tsx',\n    '.mjs',\n    '.cjs',\n    '.py',\n    '.rb',\n    '.go',\n    '.java',\n    '.php',\n    '.env',\n    '.json',\n    '.yaml',\n    '.yml',\n    '.toml',\n    '.xml',\n    '.md',\n    '.txt',\n    '.sql',\n    '.sh',\n    '.bash',\n    '.zsh',\n    '.vue',\n    '.svelte',\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAoB;AACpB,WAAsB;AACtB,kBAAqB;;;ACQd,IAAM,kBAAmC;AAAA;AAAA,EAE5C;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AACJ;AAWO,IAAM,eAA6B;AAAA,EACtC;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,EACd;AACJ;AAaO,IAAM,iBAAiC;AAAA;AAAA,EAE1C;AAAA,IACI,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AACJ;AAaO,IAAM,yBAAiD;AAAA;AAAA,EAE1D;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA;AAAA,EAEA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AAAA,EACA;AAAA,IACI,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACjB;AACJ;AAKO,IAAM,kBAAkB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;AAKO,IAAM,uBAAuB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;;;ADjbA,SAAS,OAAO,OAAe,YAAoB,GAAW;AAC1D,MAAI,MAAM,UAAU,YAAY,GAAG;AAC/B,WAAO,IAAI,OAAO,MAAM,MAAM;AAAA,EAClC;AACA,SAAO,MAAM,MAAM,GAAG,SAAS,IAAI,SAAS,MAAM,MAAM,CAAC,SAAS;AACtE;AAKA,SAAS,YAAY,SAAiB,OAAiD;AACnF,QAAM,QAAQ,QAAQ,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI;AAChD,SAAO;AAAA,IACH,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM,MAAM,SAAS,CAAC,EAAE,SAAS;AAAA,EAC7C;AACJ;AAKA,SAAS,aAAa,UAA2B;AAC7C,QAAM,aAAa,SAAS,QAAQ,OAAO,GAAG;AAC9C,SAAO,gBAAgB,KAAK,aAAW;AACnC,QAAI,QAAQ,WAAW,GAAG,GAAG;AACzB,aAAO,WAAW,SAAS,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC/C;AACA,WAAO,WAAW,SAAS,OAAO;AAAA,EACtC,CAAC;AACL;AAKA,SAAS,YAAY,UAA2B;AAC5C,QAAM,MAAW,aAAQ,QAAQ,EAAE,YAAY;AAC/C,SAAO,qBAAqB,SAAS,GAAG;AAC5C;AAKA,SAAS,gBAAgB,UAA2B;AAChD,QAAM,QAAQ,SAAS,YAAY;AACnC,SACI,MAAM,SAAS,QAAQ,KACvB,MAAM,SAAS,QAAQ,KACvB,MAAM,SAAS,WAAW,KAC1B,MAAM,SAAS,QAAQ,KACvB,MAAM,SAAS,SAAS,KACxB,MAAM,SAAS,KAAK,KACpB,MAAM,SAAS,QAAQ;AAE/B;AAKA,SAAS,SAAS,UAAkB,SAA8B;AAC9D,QAAM,SAAsB,CAAC;AAC7B,QAAM,eAAe;AACrB,QAAM,YAAY,gBAAgB,QAAQ;AAG1C,aAAW,WAAW,iBAAiB;AACnC,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AACrD,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,UAAU,QAAQ;AAAA,QAClB,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,OAAO,MAAM,CAAC,CAAC;AAAA,MAC1B,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,MAAI,CAAC,WAAW;AACZ,eAAW,WAAW,cAAc;AAChC,cAAQ,QAAQ,YAAY;AAC5B,UAAI;AACJ,cAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AACrD,cAAM,WAAW,MAAM,CAAC;AACxB,YAAI,sBAAsB,UAAU,QAAQ,MAAM,QAAQ,GAAG;AACzD;AAAA,QACJ;AAEA,cAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,eAAO,KAAK;AAAA,UACR,MAAM;AAAA,UACN,UAAU,QAAQ;AAAA,UAClB,MAAM,QAAQ;AAAA,UACd,MAAM;AAAA,UACN,MAAM,IAAI;AAAA,UACV,QAAQ,IAAI;AAAA,UACZ,OAAO,OAAO,UAAU,CAAC;AAAA,QAC7B,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACJ;AAGA,aAAW,WAAW,gBAAgB;AAClC,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AACrD,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,MAAM,CAAC;AAAA,QACd,aAAa,QAAQ;AAAA,MACzB,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,aAAW,WAAW,wBAAwB;AAE1C,QAAI,QAAQ,aAAa,WAAW,WAAW;AAC3C;AAAA,IACJ;AAEA,YAAQ,QAAQ,YAAY;AAC5B,QAAI;AACJ,YAAQ,QAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,MAAM;AAErD,UAAI,QAAQ,aAAa,WAAW,QAAQ,SAAS,yBAAyB;AAE1E,YAAI,MAAM,CAAC,EAAE,SAAS,OAAO,KAAK,MAAM,CAAC,EAAE,SAAS,MAAM,GAAG;AACzD;AAAA,QACJ;AAAA,MACJ;AAEA,YAAM,MAAM,YAAY,SAAS,MAAM,KAAK;AAC5C,aAAO,KAAK;AAAA,QACR,MAAM;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,MAAM,CAAC,EAAE,SAAS,KAAK,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,IAAI,QAAQ,MAAM,CAAC;AAAA,QACrE,aAAa,QAAQ;AAAA,MACzB,CAAC;AAAA,IACL;AAAA,EACJ;AAGA,QAAM,WAAgB,cAAS,QAAQ;AACvC,MAAI,SAAS,WAAW,MAAM,KAAK,CAAC,SAAS,SAAS,UAAU,GAAG;AAC/D,WAAO,KAAK;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,MACV,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,aAAa;AAAA,IACjB,CAAC;AAAA,EACL;AAEA,SAAO;AACX;AAKA,SAAS,sBAAsB,OAAe,aAAqB,UAA2B;AAE1F,MAAI,gBAAgB,iBAAiB;AACjC,UAAM,eAAe,CAAC,eAAe,eAAe,YAAY,aAAa,iBAAiB;AAC9F,QAAI,aAAa,KAAK,OAAK,MAAM,SAAS,CAAC,CAAC,GAAG;AAC3C,aAAO;AAAA,IACX;AAEA,UAAM,iBAAiB;AAAA,MACnB;AAAA,MAAY;AAAA,MAAS;AAAA,MAAS;AAAA,MAAY;AAAA,MAAU;AAAA,MACpD;AAAA,MAAY;AAAA,MAAa;AAAA,MAAU;AAAA,MAAS;AAAA,MAC5C;AAAA,MAAe;AAAA,MAAa;AAAA,MAAY;AAAA,IAC5C;AACA,QAAI,eAAe,KAAK,OAAK,MAAM,YAAY,EAAE,WAAW,CAAC,CAAC,GAAG;AAC7D,aAAO;AAAA,IACX;AAAA,EACJ;AAGA,MAAI,gBAAgB,cAAc;AAC9B,UAAM,WAAW,CAAC,WAAW,aAAa,YAAY,SAAS,SAAS;AACxE,QAAI,SAAS,KAAK,QAAM,MAAM,WAAW,EAAE,CAAC,GAAG;AAC3C,aAAO;AAAA,IACX;AAAA,EACJ;AAGA,MAAI,YAAY,SAAS,cAAc,GAAG;AACtC,QAAI,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS,KAAK,MAAM,SAAS,SAAS,GAAG;AACjF,aAAO;AAAA,IACX;AAAA,EACJ;AAEA,SAAO;AACX;AAKA,SAAS,eAAe,QAAkD;AACtE,QAAM,WAAW,OAAO,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AAC/D,QAAM,OAAO,OAAO,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AACvD,QAAM,SAAS,OAAO,OAAO,OAAK,EAAE,aAAa,QAAQ,EAAE;AAE3D,MAAI,WAAW,EAAG,QAAO;AACzB,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,QAAQ,KAAK,UAAU,EAAG,QAAO;AACrC,MAAI,UAAU,EAAG,QAAO;AACxB,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO;AACX;AAKA,SAAS,mBAAmB,OAAuB;AAC/C,UAAQ,OAAO;AAAA,IACX,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB;AAAS,aAAO;AAAA,EACpB;AACJ;AAKA,eAAsB,KAAK,YAAyC;AAChE,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,eAAoB,aAAQ,UAAU;AAE5C,QAAM,QAAQ,UAAM,kBAAK,QAAQ;AAAA,IAC7B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,EACd,CAAC;AAED,QAAM,SAAsB,CAAC;AAC7B,MAAI,eAAe;AAEnB,aAAW,QAAQ,OAAO;AACtB,QAAI,CAAC,YAAY,IAAI,KAAK,aAAa,IAAI,GAAG;AAC1C;AAAA,IACJ;AAEA,QAAI;AACA,YAAM,UAAa,gBAAa,MAAM,OAAO;AAC7C,YAAM,eAAoB,cAAS,cAAc,IAAI;AACrD,YAAM,aAAa,SAAS,cAAc,OAAO;AACjD,aAAO,KAAK,GAAG,UAAU;AACzB;AAAA,IACJ,QAAQ;AACJ;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,QAAQ,eAAe,MAAM;AACnC,QAAM,eAAe,KAAK,IAAI,IAAI;AAElC,SAAO;AAAA,IACH;AAAA,IACA,iBAAiB,mBAAmB,KAAK;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,MACL,SAAS,OAAO,OAAO,OAAK,EAAE,SAAS,QAAQ,EAAE;AAAA,MACjD,KAAK,OAAO,OAAO,OAAK,EAAE,SAAS,KAAK,EAAE;AAAA,MAC1C,QAAQ,OAAO,OAAO,OAAK,EAAE,SAAS,OAAO,EAAE;AAAA,MAC/C,QAAQ,OAAO,OAAO,OAAK,EAAE,SAAS,QAAQ,EAAE;AAAA,MAChD,iBAAiB,OAAO,OAAO,OAAK,EAAE,SAAS,eAAe,EAAE;AAAA,MAChE,UAAU,OAAO,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AAAA,MACxD,MAAM,OAAO,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AAAA,MAChD,QAAQ,OAAO,OAAO,OAAK,EAAE,aAAa,QAAQ,EAAE;AAAA,MACpD,KAAK,OAAO,OAAO,OAAK,EAAE,aAAa,KAAK,EAAE;AAAA,IAClD;AAAA,EACJ;AACJ;","names":[]}