@nikhil_telkar/codeshield 0.0.0-stage → 0.1.0

package/dist/report/terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.js","sourceRoot":"","sources":["../../src/report/terminal.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAgB,MAAM,aAAa,CAAC;AAQtD,SAAS,iBAAiB,CACxB,MAAkB,EAClB,YAA0B,EAC1B,CAAY,EACZ,OAA+B;IAE/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,YAAY,QAAQ,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAE9H,MAAM,KAAK,GAAG;QACZ,KAAK,CAAC,CAAC,GAAG,CAAC,8DAA8D,CAAC,EAAE;QAC5E,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,UAAU,GAAG;KACrH,CAAC;IAEF,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,OAAO,EAAE,EAC1C,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,YAAY,CAAC,aAAa,KAAK,YAAY,GAAG,EAC/E,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,QAAQ,EAAE,EAC3C,CAAC,CAAC,GAAG,CAAC,8DAA8D,CAAC,CACtE,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,CAAY,EAAE,UAAU,GAAG,KAAK;IACtE,MAAM,KAAK,GAAa;QACtB,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE;QACrF,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE;KAClF,CAAC;IAEF,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,UAAU,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAExE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAkB,EAClB,YAA0B,EAC1B,OAA+B;IAE/B,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC,IAAI,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEvD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IAEhE,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC;QACpD,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,SAAS,gBAAgB,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,6CAA6C,CAAC,EAAE,CAC1H,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAkB,EAClB,YAA0B,EAC1B,OAA+B;IAE/B,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC,IAAI,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IAExE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/scanners/code.d.ts

@@ -0,0 +1,22 @@
+import { Finding, ScanContext, ScannedFile, Scanner, Severity } from '../types.js';
+export declare const CODE_EXTENSIONS: Set<string>;
+export declare function isCodeFile(filePath: string): boolean;
+export interface RuleMatch {
+    line: number;
+    snippet?: string;
+    customExplanation?: string;
+}
+export interface CodeRule {
+    id: string;
+    severity: Severity;
+    title: string;
+    cwe: string;
+    plainExplanation: string;
+    fix: string;
+    aiPromptTemplate: string;
+    check: (file: ScannedFile, context: ScanContext) => RuleMatch[];
+}
+export declare const CODE_RULES: readonly CodeRule[];
+export declare function scanCode(context: ScanContext): Finding[];
+export declare const codeScanner: Scanner;
+//# sourceMappingURL=code.d.ts.map

package/dist/scanners/code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../src/scanners/code.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGnF,eAAO,MAAM,eAAe,aAA0D,CAAC;AAEvF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGpD;AAoBD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;CACjE;AA0ED,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAuOzC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,EAAE,CAmCxD;AAED,eAAO,MAAM,WAAW,EAAE,OAGzB,CAAC"}

package/dist/scanners/code.js

@@ -0,0 +1,319 @@
+import * as path from 'node:path';
+import { sanitize } from '../utils/sanitize.js';
+export const CODE_EXTENSIONS = new Set(['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs']);
+export function isCodeFile(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    return CODE_EXTENSIONS.has(ext);
+}
+function isCommentLine(line) {
+    const trimmed = line.trim();
+    return (trimmed.startsWith('//') ||
+        trimmed.startsWith('*') ||
+        trimmed.startsWith('/*') ||
+        trimmed.startsWith('<!--'));
+}
+function isLineIgnored(line) {
+    return /codeshield-ignore|@codeshield-ignore|codeshield-disable/i.test(line);
+}
+function isIgnoredFile(content) {
+    return content.includes('codeshield-ignore-file');
+}
+function matchLineRegex(file, matcher) {
+    const matches = [];
+    for (let i = 0; i < file.lines.length; i++) {
+        const line = file.lines[i] ?? '';
+        if (isCommentLine(line) || isLineIgnored(line))
+            continue;
+        if (matcher(line, i + 1)) {
+            matches.push({ line: i + 1, snippet: line.trim() });
+        }
+    }
+    return matches;
+}
+const EVAL_RE = /\b(?:eval\s*\(|new\s+Function\s*\()/;
+const SQL_KEYWORD_RE = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM)\b/i;
+function isSqlConcatenation(line) {
+    const hasJsConcat = /['"`]\s*\+|\+\s*['"`]/.test(line);
+    const hasTemplateVar = /\$\{[^}]+\}/.test(line) && line.includes('`');
+    if (SQL_KEYWORD_RE.test(line)) {
+        if (hasTemplateVar)
+            return true;
+        if (hasJsConcat)
+            return true;
+    }
+    if (/\.(?:query|raw|execute)\s*\(/.test(line)) {
+        if (hasTemplateVar || hasJsConcat)
+            return true;
+    }
+    return false;
+}
+const NOSQL_INJECTION_RE = /\b(?:\w+\.)?(?:find|findOne|findOneAndUpdate|findOneAndDelete|findById|deleteMany|deleteOne|updateOne|updateMany|countDocuments)\s*\(\s*(?:req\.body|req\.query|req\.params)\s*(?:,|\))/;
+const EXEC_CALL_RE = /(?:\b(?:child_process|cp)\.exec\s*\(|(?<!\.)\bexec\s*\()/;
+const STATIC_STRING_EXEC_RE = /(?:\b(?:child_process|cp)\.exec|(?<!\.)\bexec)\s*\(\s*(?:'[^']*'|"[^"]*")\s*[,)]/;
+const MATH_RANDOM_RE = /Math\.random\s*\(\)/;
+const SENSITIVE_TOKEN_RE = /(?:token|pass(?:word|wd)?|secret|key|salt|nonce|session|otp|auth|pin|csrf)/i;
+const WEAK_HASH_RE = /(?:createHash\s*\(\s*['"](?:md5|sha1)['"]\s*\)|crypto\.createHash\(\s*['"](?:md5|sha1)['"]\s*\))/i;
+const PWD_CONTEXT_RE = /(?:pass(?:word|wd)?|pwd|secret|auth|credential|token|user)/i;
+function isDangerousHtmlInjection(line) {
+    if (/dangerouslySetInnerHTML\s*=/.test(line)) {
+        if (!/dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:\s*['"`][^'"`${}]*['"`]\s*\}\s*\}/.test(line)) {
+            return true;
+        }
+    }
+    if (/\binnerHTML\s*=/.test(line)) {
+        const parts = line.split(/innerHTML\s*=\s*/);
+        const rhs = parts[1]?.trim() ?? '';
+        const cleanRhs = rhs.replace(/;$/, '').trim();
+        if (/^'(?:[^'\\]|\\.)*'$/.test(cleanRhs) && !cleanRhs.includes('+'))
+            return false;
+        if (/^"(?:[^"\\]|\\.)*"$/.test(cleanRhs) && !cleanRhs.includes('+'))
+            return false;
+        if (/^`[^`]*`$/.test(cleanRhs) && !cleanRhs.includes('${') && !cleanRhs.includes('+'))
+            return false;
+        return true;
+    }
+    return false;
+}
+const CORS_WILDCARD_RE = /cors\s*\(\s*\{[^}]*origin\s*:\s*(?:['"]\*['"]|true)/;
+const CORS_HEADER_WILDCARD_RE = /res\.(?:setHeader|header)\s*\(\s*['"]Access-Control-Allow-Origin['"]\s*,\s*['"]\*['"]\s*\)/;
+const COOKIE_CALL_RE = /res\.cookie\s*\(/;
+const JWT_SIGN_RE = /jwt\.sign\s*\(/;
+const STACK_IN_RES_RE = /res\.(?:status\(\d+\)\.)?(?:send|json)\s*\([^)]*(?:err|error)\.stack\b/;
+const SUPABASE_SERVICE_ROLE_RE = /\b(?:SUPABASE_SERVICE_ROLE_KEY|service_role)\b/;
+export const CODE_RULES = [
+    {
+        id: 'COD-001',
+        severity: 'critical',
+        title: 'Dynamic Code Execution via eval() or new Function()',
+        cwe: 'CWE-95',
+        plainExplanation: 'Using `eval()` or `new Function()` executes arbitrary strings as JavaScript code. ' +
+            'If any untrusted input reaches these functions, attackers can execute arbitrary code ' +
+            'on your server or in your users’ browsers (Remote Code Execution / XSS).',
+        fix: 'Parse structured data using `JSON.parse()`, or replace dynamic code evaluation with standard functions and object lookups.',
+        aiPromptTemplate: 'Remove `eval()` or `new Function()` on line {LINE}. Replace it with safe data parsing such as `JSON.parse()` or static lookup maps.',
+        check: (file) => matchLineRegex(file, (line) => EVAL_RE.test(line)),
+    },
+    {
+        id: 'COD-002',
+        severity: 'critical',
+        title: 'SQL Query Built via String Concatenation (SQL Injection)',
+        cwe: 'CWE-89',
+        plainExplanation: 'Constructing SQL queries using template literals (${...}) or string concatenation (+) allows ' +
+            'attackers to inject malicious SQL clauses (SQL Injection). This can bypass authentication, ' +
+            'leak confidential records, or destroy database tables.',
+        fix: 'Use parameterized queries or prepared statements (e.g., `db.query("SELECT * FROM users WHERE id = $1", [id])`) or a type-safe ORM/query builder.',
+        aiPromptTemplate: 'Refactor the SQL query on line {LINE} to use parameterized queries with placeholders ($1, ?, or named parameters) instead of string concatenation.',
+        check: (file) => matchLineRegex(file, (line) => isSqlConcatenation(line)),
+    },
+    {
+        id: 'COD-003',
+        severity: 'high',
+        title: 'Unsanitized Request Body in Database Query (NoSQL Injection)',
+        cwe: 'CWE-943',
+        plainExplanation: 'Passing `req.body`, `req.query`, or `req.params` directly to database query methods (e.g. `find(req.body)`) ' +
+            'allows attackers to pass objects containing NoSQL operators like `{ "$gt": "" }` to bypass password checks or extract all records.',
+        fix: 'Extract and validate individual primitive fields explicitly (e.g., `{ email: String(req.body.email) }`) or validate payloads with Zod.',
+        aiPromptTemplate: 'Refactor the database query on line {LINE} to pass only explicitly validated primitive fields instead of the whole `req.body` object.',
+        check: (file) => matchLineRegex(file, (line) => NOSQL_INJECTION_RE.test(line)),
+    },
+    {
+        id: 'COD-004',
+        severity: 'critical',
+        title: 'Command Injection Risk in child_process.exec()',
+        cwe: 'CWE-78',
+        plainExplanation: 'Calling `child_process.exec()` with variables or string concatenation passes input directly to an OS shell. ' +
+            'If arguments contain shell metacharacters (`;`, `|`, `&&`, `$()`), attackers can execute arbitrary OS commands.',
+        fix: 'Use `child_process.execFile()` or `spawn()` with an array of arguments, and ensure `{ shell: false }`.',
+        aiPromptTemplate: 'Replace `child_process.exec()` on line {LINE} with `execFile()` or `spawn()`, passing arguments as an array instead of string concatenation.',
+        check: (file) => matchLineRegex(file, (line) => {
+            if (!EXEC_CALL_RE.test(line))
+                return false;
+            if (STATIC_STRING_EXEC_RE.test(line) && !line.includes('+') && !line.includes('${')) {
+                return false;
+            }
+            return true;
+        }),
+    },
+    {
+        id: 'COD-005',
+        severity: 'high',
+        title: 'Insecure PRNG (Math.random) Used for Security-Sensitive Value',
+        cwe: 'CWE-338',
+        plainExplanation: '`Math.random()` is not cryptographically secure; its sequence can be predicted by attackers. ' +
+            'Using it for tokens, session IDs, OTPs, or passwords allows attackers to guess generated values.',
+        fix: 'Use Node.js `crypto.randomBytes(32).toString("hex")` or `crypto.randomUUID()` for cryptographically secure randomness.',
+        aiPromptTemplate: 'Replace `Math.random()` on line {LINE} with `crypto.randomBytes()` or `crypto.randomUUID()` from `node:crypto`.',
+        check: (file) => matchLineRegex(file, (line) => {
+            if (!MATH_RANDOM_RE.test(line))
+                return false;
+            return SENSITIVE_TOKEN_RE.test(line);
+        }),
+    },
+    {
+        id: 'COD-006',
+        severity: 'high',
+        title: 'Weak Hash Algorithm (MD5/SHA1) Used for Credentials',
+        cwe: 'CWE-327',
+        plainExplanation: 'MD5 and SHA-1 are cryptographically broken algorithms susceptible to collisions and fast brute-force/rainbow table attacks. ' +
+            'They must never be used for storing or hashing passwords.',
+        fix: 'Use an adaptive, salted password hashing algorithm such as `bcrypt`, `argon2`, or `scrypt`.',
+        aiPromptTemplate: 'Replace MD5/SHA-1 on line {LINE} with a dedicated password hashing library such as `bcrypt` or `argon2`.',
+        check: (file) => matchLineRegex(file, (line) => {
+            if (!WEAK_HASH_RE.test(line))
+                return false;
+            return PWD_CONTEXT_RE.test(line);
+        }),
+    },
+    {
+        id: 'COD-007',
+        severity: 'high',
+        title: 'Unescaped HTML Injection via innerHTML or dangerouslySetInnerHTML',
+        cwe: 'CWE-79',
+        plainExplanation: 'Rendering dynamic content through `dangerouslySetInnerHTML` or `element.innerHTML` bypasses framework XSS sanitization. ' +
+            'If user-controlled data is injected, attackers can execute malicious scripts in victims’ browsers (Cross-Site Scripting).',
+        fix: 'Use standard text rendering (`{text}` in JSX or `element.textContent`), or sanitize HTML with DOMPurify before inserting.',
+        aiPromptTemplate: 'Refactor line {LINE} to use safe text interpolation or sanitize HTML using `DOMPurify.sanitize()` before setting innerHTML.',
+        check: (file) => matchLineRegex(file, (line) => isDangerousHtmlInjection(line)),
+    },
+    {
+        id: 'COD-008',
+        severity: 'medium',
+        title: 'Overly Permissive CORS Policy (Wildcard Origin)',
+        cwe: 'CWE-942',
+        plainExplanation: 'Configuring CORS with `origin: "*"` or `Access-Control-Allow-Origin: *` allows any website on the internet ' +
+            'to make requests to your API. If your API handles authentication cookies or private data, malicious sites can read responses.',
+        fix: 'Specify an explicit array of approved frontend domains or validate the request Origin header against an allowlist.',
+        aiPromptTemplate: 'Update the CORS configuration on line {LINE} to specify allowed origin domains explicitly rather than using wildcard "*".',
+        check: (file) => matchLineRegex(file, (line) => {
+            if (CORS_WILDCARD_RE.test(line))
+                return true;
+            if (CORS_HEADER_WILDCARD_RE.test(line))
+                return true;
+            return false;
+        }),
+    },
+    {
+        id: 'COD-009',
+        severity: 'medium',
+        title: 'Cookie Set Without httpOnly or secure Flags',
+        cwe: 'CWE-1004',
+        plainExplanation: 'Cookies set without `httpOnly: true` can be accessed by JavaScript, exposing session credentials to Cross-Site Scripting (XSS) theft. ' +
+            'Missing `secure: true` allows cookies to be transmitted over unencrypted HTTP.',
+        fix: 'Configure cookies with `{ httpOnly: true, secure: true, sameSite: "lax" }`.',
+        aiPromptTemplate: 'Add `{ httpOnly: true, secure: true, sameSite: "lax" }` to the cookie options on line {LINE}.',
+        check: (file) => matchLineRegex(file, (line) => {
+            if (!COOKIE_CALL_RE.test(line))
+                return false;
+            const hasHttpOnly = /httpOnly\s*:\s*true/.test(line);
+            const hasSecure = /secure\s*:\s*true/.test(line);
+            return !hasHttpOnly || !hasSecure;
+        }),
+    },
+    {
+        id: 'COD-010',
+        severity: 'medium',
+        title: 'JWT Token Signed Without Expiration (expiresIn)',
+        cwe: 'CWE-613',
+        plainExplanation: 'JSON Web Tokens created without an `expiresIn` option remain valid indefinitely. ' +
+            'If a token is ever intercepted or leaked, attackers maintain permanent access unless you build a token revocation system.',
+        fix: 'Specify an expiration window in the `jwt.sign()` options, e.g. `{ expiresIn: "1h" }` or `{ expiresIn: "15m" }`.',
+        aiPromptTemplate: 'Add an expiration option to `jwt.sign()` on line {LINE}, such as `{ expiresIn: "1h" }`.',
+        check: (file) => matchLineRegex(file, (line) => {
+            if (!JWT_SIGN_RE.test(line))
+                return false;
+            return !/expiresIn\s*:/.test(line);
+        }),
+    },
+    {
+        id: 'COD-011',
+        severity: 'medium',
+        title: 'Missing Security Headers Middleware (Helmet) in Express App',
+        cwe: 'CWE-693',
+        plainExplanation: 'This Express application does not use `helmet` to set secure HTTP headers. ' +
+            'Helmet protects your app against MIME-type sniffing, clickjacking, XSS framing, and information disclosure.',
+        fix: 'Install helmet (`npm install helmet`) and add `app.use(helmet())` near the top of your Express middleware stack.',
+        aiPromptTemplate: 'Import `helmet` from "helmet" and add `app.use(helmet())` right after initializing the Express application.',
+        check: (file) => {
+            const content = file.content;
+            const isExpressApp = /\bexpress\s*\(\s*\)/.test(content) &&
+                /\b\.listen\s*\(/.test(content);
+            if (!isExpressApp)
+                return [];
+            const hasHelmet = /\bhelmet\b/.test(content) ||
+                /\bapp\.use\s*\(\s*helmet/.test(content);
+            if (!hasHelmet) {
+                return [{ line: 1, customExplanation: 'Express application initialized without helmet() security headers middleware.' }];
+            }
+            return [];
+        },
+    },
+    {
+        id: 'COD-012',
+        severity: 'high',
+        title: 'Server Stack Trace Exposed in HTTP Response',
+        cwe: 'CWE-209',
+        plainExplanation: 'Returning `err.stack` or raw error objects in HTTP responses leaks internal code paths, database queries, ' +
+            'library versions, and architecture details to potential attackers.',
+        fix: 'Log the stack trace on the server with `console.error(err)` and return a generic error message (e.g. `{ error: "Internal Server Error" }`) to the client.',
+        aiPromptTemplate: 'Remove `err.stack` from the HTTP response on line {LINE}. Log it server-side using `console.error(err)` and return a generic error message to clients.',
+        check: (file) => matchLineRegex(file, (line) => STACK_IN_RES_RE.test(line)),
+    },
+    {
+        id: 'COD-013',
+        severity: 'critical',
+        title: 'Supabase service_role Admin Key Used in Client-Side Code',
+        cwe: 'CWE-798',
+        plainExplanation: 'The Supabase `service_role` key bypasses all Row Level Security (RLS) policies and grants complete admin access to your database. ' +
+            'Referencing it in client components or browser bundles leaks your entire database to any web visitor.',
+        fix: 'Use the public `anon` key (`NEXT_PUBLIC_SUPABASE_ANON_KEY`) in client code, and restrict `service_role` strictly to backend API routes.',
+        aiPromptTemplate: 'Remove the `service_role` key from client code on line {LINE}. Use the public `anon` key instead and enforce Row Level Security in Supabase.',
+        check: (file) => {
+            const isExplicitClient = file.content.includes("'use client'") || file.content.includes('"use client"');
+            const ext = path.extname(file.relativePath).toLowerCase();
+            const isReactComponent = (ext === '.jsx' || ext === '.tsx') && !file.relativePath.includes('/api/') && !file.relativePath.includes('/server/');
+            if (!isExplicitClient && !isReactComponent)
+                return [];
+            return matchLineRegex(file, (line) => SUPABASE_SERVICE_ROLE_RE.test(line));
+        },
+    },
+];
+export function scanCode(context) {
+    const findings = [];
+    for (const file of context.files) {
+        if (!isCodeFile(file.relativePath))
+            continue;
+        if (isIgnoredFile(file.content))
+            continue;
+        for (const rule of CODE_RULES) {
+            try {
+                const matches = rule.check(file, context);
+                for (const match of matches) {
+                    const lineNum = match.line;
+                    const snippet = match.snippet ? sanitize(match.snippet) : '';
+                    const explanation = match.customExplanation ?? rule.plainExplanation;
+                    findings.push({
+                        ruleId: rule.id,
+                        severity: rule.severity,
+                        title: rule.title,
+                        cwe: rule.cwe,
+                        plainExplanation: explanation,
+                        file: file.relativePath,
+                        line: lineNum,
+                        fix: rule.fix,
+                        aiPrompt: rule.aiPromptTemplate.replace('{LINE}', String(lineNum)) + (snippet ? ` Code: \`${snippet}\`` : ''),
+                        ...(snippet ? { snippet } : {}),
+                    });
+                }
+            }
+            catch {
+                // rule failure should not crash scanner
+            }
+        }
+    }
+    return findings;
+}
+export const codeScanner = {
+    name: 'code',
+    scan: scanCode,
+};
+//# sourceMappingURL=code.js.map

package/dist/scanners/code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code.js","sourceRoot":"","sources":["../../src/scanners/code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvF,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AACpD,CAAC;AAmBD,SAAS,cAAc,CACrB,IAAiB,EACjB,OAAmD;IAEnD,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,SAAS;QACzD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,GAAG,qCAAqC,CAAC;AACtD,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAE5E,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEtE,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,cAAc;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;IAC/B,CAAC;IACD,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,cAAc,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,kBAAkB,GAAG,yLAAyL,CAAC;AAErN,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAChF,MAAM,qBAAqB,GAAG,kFAAkF,CAAC;AAEjH,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,6EAA6E,CAAC;AAEzG,MAAM,YAAY,GAAG,mGAAmG,CAAC;AACzH,MAAM,cAAc,GAAG,6DAA6D,CAAC;AAErF,SAAS,wBAAwB,CAAC,IAAY;IAC5C,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,qFAAqF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9C,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAClF,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAClF,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,gBAAgB,GAAG,qDAAqD,CAAC;AAC/E,MAAM,uBAAuB,GAAG,4FAA4F,CAAC;AAE7H,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,eAAe,GAAG,wEAAwE,CAAC;AACjG,MAAM,wBAAwB,GAAG,gDAAgD,CAAC;AAElF,MAAM,CAAC,MAAM,UAAU,GAAwB;IAC7C;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,qDAAqD;QAC5D,GAAG,EAAE,QAAQ;QACb,gBAAgB,EACd,oFAAoF;YACpF,uFAAuF;YACvF,0EAA0E;QAC5E,GAAG,EAAE,4HAA4H;QACjI,gBAAgB,EACd,qIAAqI;QACvI,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACrD;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,0DAA0D;QACjE,GAAG,EAAE,QAAQ;QACb,gBAAgB,EACd,+FAA+F;YAC/F,6FAA6F;YAC7F,wDAAwD;QAC1D,GAAG,EAAE,kJAAkJ;QACvJ,gBAAgB,EACd,oJAAoJ;QACtJ,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;KAC3D;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,8DAA8D;QACrE,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,8GAA8G;YAC9G,oIAAoI;QACtI,GAAG,EAAE,wIAAwI;QAC7I,gBAAgB,EACd,uIAAuI;QACzI,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAChE;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,gDAAgD;QACvD,GAAG,EAAE,QAAQ;QACb,gBAAgB,EACd,8GAA8G;YAC9G,iHAAiH;QACnH,GAAG,EAAE,wGAAwG;QAC7G,gBAAgB,EACd,8IAA8I;QAChJ,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;KACL;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,+DAA+D;QACtE,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,+FAA+F;YAC/F,kGAAkG;QACpG,GAAG,EAAE,wHAAwH;QAC7H,gBAAgB,EACd,iHAAiH;QACnH,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC;KACL;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,qDAAqD;QAC5D,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,8HAA8H;YAC9H,2DAA2D;QAC7D,GAAG,EAAE,6FAA6F;QAClG,gBAAgB,EACd,0GAA0G;QAC5G,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC;KACL;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,mEAAmE;QAC1E,GAAG,EAAE,QAAQ;QACb,gBAAgB,EACd,0HAA0H;YAC1H,2HAA2H;QAC7H,GAAG,EAAE,2HAA2H;QAChI,gBAAgB,EACd,6HAA6H;QAC/H,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;KACjE;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,iDAAiD;QACxD,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,6GAA6G;YAC7G,+HAA+H;QACjI,GAAG,EAAE,oHAAoH;QACzH,gBAAgB,EACd,2HAA2H;QAC7H,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7C,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;KACL;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,6CAA6C;QACpD,GAAG,EAAE,UAAU;QACf,gBAAgB,EACd,wIAAwI;YACxI,gFAAgF;QAClF,GAAG,EAAE,6EAA6E;QAClF,gBAAgB,EACd,+FAA+F;QACjG,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7C,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC;QACpC,CAAC,CAAC;KACL;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,iDAAiD;QACxD,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,mFAAmF;YACnF,2HAA2H;QAC7H,GAAG,EAAE,iHAAiH;QACtH,gBAAgB,EACd,yFAAyF;QAC3F,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC;KACL;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,6DAA6D;QACpE,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,6EAA6E;YAC7E,6GAA6G;QAC/G,GAAG,EAAE,kHAAkH;QACvH,gBAAgB,EACd,6GAA6G;QAC/G,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,MAAM,YAAY,GAChB,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;gBACnC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAElC,IAAI,CAAC,YAAY;gBAAE,OAAO,EAAE,CAAC;YAE7B,MAAM,SAAS,GACb,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC1B,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE3C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,+EAA+E,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;KACF;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,6CAA6C;QACpD,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,4GAA4G;YAC5G,oEAAoE;QACtE,GAAG,EAAE,2JAA2J;QAChK,gBAAgB,EACd,wJAAwJ;QAC1J,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAC7D;IACD;QACE,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,0DAA0D;QACjE,GAAG,EAAE,SAAS;QACd,gBAAgB,EACd,oIAAoI;YACpI,uGAAuG;QACzG,GAAG,EAAE,yIAAyI;QAC9I,gBAAgB,EACd,8IAA8I;QAChJ,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACxG,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1D,MAAM,gBAAgB,GAAG,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAE/I,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB;gBAAE,OAAO,EAAE,CAAC;YAEtD,OAAO,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,OAAoB;IAC3C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC7C,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAE1C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;oBAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,CAAC;oBAErE,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,gBAAgB,EAAE,WAAW;wBAC7B,IAAI,EAAE,IAAI,CAAC,YAAY;wBACvB,IAAI,EAAE,OAAO;wBACb,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7G,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAY;IAClC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,QAAQ;CACf,CAAC"}

package/dist/scanners/dependencies.d.ts

@@ -0,0 +1,10 @@
+import { Finding, ScanContext, Scanner } from '../types.js';
+import { type RegistryFetchFn } from '../utils/registry.js';
+export declare function isValidNpmName(name: string): boolean;
+export interface DepScanOptions {
+    offline?: boolean;
+    fetchFn?: RegistryFetchFn;
+}
+export declare function scanDependencies(context: ScanContext, options?: DepScanOptions): Promise<Finding[]>;
+export declare const depScanner: Scanner;
+//# sourceMappingURL=dependencies.d.ts.map

package/dist/scanners/dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/scanners/dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAM3E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAkED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AA2GD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,OAAO,EAAE,CAAC,CAyFpB;AAED,eAAO,MAAM,UAAU,EAAE,OAKxB,CAAC"}

package/dist/scanners/dependencies.js

@@ -0,0 +1,240 @@
+import { fetchRegistry } from '../utils/registry.js';
+import { levenshtein } from '../utils/levenshtein.js';
+const NPM_NAME_RE = /^(?:@[a-z0-9-*~][a-z0-9-*._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+export function isValidNpmName(name) {
+    if (name.length === 0 || name.length > 214)
+        return false;
+    return NPM_NAME_RE.test(name);
+}
+const POPULAR_PACKAGES = [
+    'react', 'react-dom', 'react-router', 'react-router-dom',
+    'next', 'nuxt', 'vue', 'angular', 'svelte',
+    'express', 'fastify', 'koa', 'hapi',
+    'lodash', 'underscore', 'ramda',
+    'axios', 'node-fetch', 'got', 'superagent',
+    'typescript', 'ts-node', 'tsx',
+    'webpack', 'vite', 'rollup', 'esbuild', 'parcel',
+    'jest', 'vitest', 'mocha', 'jasmine', 'ava', 'tap',
+    'eslint', 'prettier', 'husky', 'lint-staged',
+    'dotenv', 'cors', 'helmet', 'morgan', 'body-parser',
+    'mongoose', 'sequelize', 'prisma', 'typeorm', 'knex',
+    'socket.io', 'ws', 'jsonwebtoken', 'bcrypt', 'bcryptjs',
+    'uuid', 'dayjs', 'moment', 'date-fns',
+    'chalk', 'colors', 'ora', 'inquirer',
+    'zod', 'yup', 'joi',
+    'sharp', 'multer', 'formidable',
+];
+function findTyposquat(name) {
+    const bare = name.includes('/') ? (name.split('/')[1] ?? name) : name;
+    for (const popular of POPULAR_PACKAGES) {
+        if (levenshtein(bare, popular) === 1) {
+            return popular;
+        }
+    }
+    return undefined;
+}
+class Semaphore {
+    limit;
+    running = 0;
+    queue = [];
+    constructor(limit) {
+        this.limit = limit;
+    }
+    async run(fn) {
+        await this.acquire();
+        try {
+            return await fn();
+        }
+        finally {
+            this.release();
+        }
+    }
+    acquire() {
+        if (this.running < this.limit) {
+            this.running++;
+            return Promise.resolve();
+        }
+        return new Promise((resolve) => {
+            this.queue.push(resolve);
+        });
+    }
+    release() {
+        const next = this.queue.shift();
+        if (next) {
+            next();
+        }
+        else {
+            this.running--;
+        }
+    }
+}
+function findingHallucinated(pkgName, pkgFile) {
+    return {
+        ruleId: 'DEP-001',
+        severity: 'critical',
+        title: `Package "${pkgName}" does not exist on npm`,
+        plainExplanation: `The package "${pkgName}" was not found on the npm registry. ` +
+            'AI assistants sometimes invent package names that do not exist — ' +
+            'called "package hallucination". Installing a non-existent package may ' +
+            'succeed if a malicious actor has since published one with that name.',
+        file: pkgFile,
+        line: 1,
+        fix: `Search for "${pkgName}" on npmjs.com to find the correct package name, or remove the dependency.`,
+        aiPrompt: `The package "${pkgName}" does not exist on npm. ` +
+            'Please find the correct package name or suggest an alternative that actually exists.',
+        cwe: 'CWE-829',
+    };
+}
+function findingNewPackage(pkgName, pkgFile, createdAt) {
+    return {
+        ruleId: 'DEP-002',
+        severity: 'high',
+        title: `Package "${pkgName}" was first published less than 30 days ago`,
+        plainExplanation: `"${pkgName}" appeared on npm only recently (${createdAt}). ` +
+            'Very new packages have not been reviewed by the community and could be ' +
+            'malicious or abandoned. Confirm this is the package you intended.',
+        file: pkgFile,
+        line: 1,
+        fix: `Verify "${pkgName}" on npmjs.com. Prefer well-established packages with a track record.`,
+        aiPrompt: `The package "${pkgName}" was published less than 30 days ago. ` +
+            'Is there a more established alternative? If this package is intentional, explain why.',
+        cwe: 'CWE-1104',
+    };
+}
+function findingInstallScript(pkgName, pkgFile, scriptName) {
+    return {
+        ruleId: 'DEP-003',
+        severity: 'high',
+        title: `Package "${pkgName}" runs a "${scriptName}" script on install`,
+        plainExplanation: `"${pkgName}" defines a \`${scriptName}\` script that runs automatically when you do \`npm install\`. ` +
+            'This is a common vector for supply-chain attacks: malicious code can ' +
+            'exfiltrate secrets, install backdoors, or modify your files at install time.',
+        file: pkgFile,
+        line: 1,
+        fix: `Audit the source of "${pkgName}" before installing, or use \`npm install --ignore-scripts\` and verify manually.`,
+        aiPrompt: `The package "${pkgName}" has an \`${scriptName}\` script. ` +
+            'Is this script necessary? What does it do, and is there a safer alternative?',
+        cwe: 'CWE-506',
+    };
+}
+function findingTyposquat(pkgName, pkgFile, similarTo) {
+    return {
+        ruleId: 'DEP-004',
+        severity: 'high',
+        title: `Package "${pkgName}" looks like a typosquat of "${similarTo}"`,
+        plainExplanation: `"${pkgName}" is one character away from the popular package "${similarTo}". ` +
+            'Typosquatting is an attack where a malicious package is published with a name ' +
+            'nearly identical to a trusted one, hoping developers will mistype it.',
+        file: pkgFile,
+        line: 1,
+        fix: `Double-check whether you meant "${similarTo}". If not, verify "${pkgName}" is legitimate on npmjs.com.`,
+        aiPrompt: `The package "${pkgName}" is one character away from "${similarTo}". ` +
+            `Did you mean "${similarTo}"? If "${pkgName}" is intentional, please confirm it is a known package.`,
+        cwe: 'CWE-829',
+    };
+}
+function findingCouldNotCheck(pkgName, pkgFile, reason) {
+    return {
+        ruleId: 'DEP-005',
+        severity: 'info',
+        title: `Could not check package "${pkgName}" against npm registry`,
+        plainExplanation: `CodeShield tried to look up "${pkgName}" on the npm registry but failed: ${reason}. ` +
+            'The package has NOT been verified as safe — please check it manually.',
+        file: pkgFile,
+        line: 1,
+        fix: `Manually verify "${pkgName}" at https://www.npmjs.com/package/${pkgName}`,
+        aiPrompt: `The npm registry check for "${pkgName}" failed (${reason}). ` +
+            'Please manually confirm this package is legitimate.',
+    };
+}
+function extractDependencies(pkgJson) {
+    const deps = [];
+    for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+        const section = pkgJson[field];
+        if (section !== null && typeof section === 'object') {
+            deps.push(...Object.keys(section));
+        }
+    }
+    return [...new Set(deps)];
+}
+export async function scanDependencies(context, options = {}) {
+    const findings = [];
+    const pkgFile = context.files.find((f) => f.relativePath === 'package.json' || f.relativePath === './package.json');
+    if (!pkgFile)
+        return findings;
+    let pkgJson;
+    try {
+        pkgJson = JSON.parse(pkgFile.content);
+    }
+    catch {
+        return findings;
+    }
+    const depNames = extractDependencies(pkgJson);
+    if (depNames.length === 0)
+        return findings;
+    const pkgFilePath = pkgFile.relativePath;
+    if (options.offline) {
+        for (const name of depNames) {
+            if (!isValidNpmName(name))
+                continue;
+            const typosquat = findTyposquat(name);
+            if (typosquat)
+                findings.push(findingTyposquat(name, pkgFilePath, typosquat));
+        }
+        return findings;
+    }
+    const sem = new Semaphore(5);
+    const thirtyDaysMs = 30 * 24 * 60 * 60 * 1000;
+    const tasks = depNames.map((name) => sem.run(async () => {
+        const local = [];
+        const typosquat = findTyposquat(name);
+        if (typosquat)
+            local.push(findingTyposquat(name, pkgFilePath, typosquat));
+        if (!isValidNpmName(name)) {
+            return local;
+        }
+        let result;
+        try {
+            result = await fetchRegistry(name, 5_000, options.fetchFn);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            local.push(findingCouldNotCheck(name, pkgFilePath, reason));
+            return local;
+        }
+        if (result.status === 'not-found') {
+            local.push(findingHallucinated(name, pkgFilePath));
+            return local;
+        }
+        if (result.status === 'error') {
+            local.push(findingCouldNotCheck(name, pkgFilePath, result.reason));
+            return local;
+        }
+        const { data } = result;
+        if (data.created) {
+            const createdMs = Date.parse(data.created);
+            if (!isNaN(createdMs) && Date.now() - createdMs < thirtyDaysMs) {
+                local.push(findingNewPackage(name, pkgFilePath, data.created));
+            }
+        }
+        for (const scriptName of ['install', 'postinstall', 'preinstall']) {
+            if (scriptName in data.latestScripts) {
+                local.push(findingInstallScript(name, pkgFilePath, scriptName));
+                break;
+            }
+        }
+        return local;
+    }));
+    const allResults = await Promise.all(tasks);
+    for (const result of allResults) {
+        findings.push(...result);
+    }
+    return findings;
+}
+export const depScanner = {
+    name: 'dependencies',
+    scan: (_context) => {
+        return [];
+    },
+};
+//# sourceMappingURL=dependencies.js.map

package/dist/scanners/dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../src/scanners/dependencies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,MAAM,WAAW,GACf,4DAA4D,CAAC;AAE/D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,gBAAgB,GAAsB;IAC1C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB;IACxD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ;IAC1C,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM;IACnC,QAAQ,EAAE,YAAY,EAAE,OAAO;IAC/B,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY;IAC1C,YAAY,EAAE,SAAS,EAAE,KAAK;IAC9B,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;IAChD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK;IAClD,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa;IAC5C,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa;IACnD,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;IACpD,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU;IACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;IACrC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU;IACpC,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,OAAO,EAAE,QAAQ,EAAE,YAAY;CAChC,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,SAAS;IAIgB;IAHrB,OAAO,GAAG,CAAC,CAAC;IACZ,KAAK,GAAsB,EAAE,CAAC;IAEtC,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,KAAK,CAAC,GAAG,CAAI,EAAoB;QAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,OAAO;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AAOD,SAAS,mBAAmB,CAAC,OAAe,EAAE,OAAe;IAC3D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,YAAY,OAAO,yBAAyB;QACnD,gBAAgB,EACd,gBAAgB,OAAO,uCAAuC;YAC9D,mEAAmE;YACnE,wEAAwE;YACxE,sEAAsE;QACxE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,eAAe,OAAO,4EAA4E;QACvG,QAAQ,EACN,gBAAgB,OAAO,2BAA2B;YAClD,sFAAsF;QACxF,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,OAAe,EAAE,SAAiB;IAC5E,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,YAAY,OAAO,6CAA6C;QACvE,gBAAgB,EACd,IAAI,OAAO,oCAAoC,SAAS,KAAK;YAC7D,yEAAyE;YACzE,mEAAmE;QACrE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,WAAW,OAAO,uEAAuE;QAC9F,QAAQ,EACN,gBAAgB,OAAO,yCAAyC;YAChE,uFAAuF;QACzF,GAAG,EAAE,UAAU;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,OAAe,EAAE,UAAkB;IAChF,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,YAAY,OAAO,aAAa,UAAU,qBAAqB;QACtE,gBAAgB,EACd,IAAI,OAAO,iBAAiB,UAAU,iEAAiE;YACvG,uEAAuE;YACvE,8EAA8E;QAChF,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,wBAAwB,OAAO,mFAAmF;QACvH,QAAQ,EACN,gBAAgB,OAAO,cAAc,UAAU,aAAa;YAC5D,8EAA8E;QAChF,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,OAAe,EAAE,SAAiB;IAC3E,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,YAAY,OAAO,gCAAgC,SAAS,GAAG;QACtE,gBAAgB,EACd,IAAI,OAAO,qDAAqD,SAAS,KAAK;YAC9E,gFAAgF;YAChF,uEAAuE;QACzE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,mCAAmC,SAAS,sBAAsB,OAAO,+BAA+B;QAC7G,QAAQ,EACN,gBAAgB,OAAO,iCAAiC,SAAS,KAAK;YACtE,iBAAiB,SAAS,UAAU,OAAO,yDAAyD;QACtG,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc;IAC5E,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,4BAA4B,OAAO,wBAAwB;QAClE,gBAAgB,EACd,gCAAgC,OAAO,qCAAqC,MAAM,IAAI;YACtF,uEAAuE;QACzE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,oBAAoB,OAAO,sCAAsC,OAAO,EAAE;QAC/E,QAAQ,EACN,+BAA+B,OAAO,aAAa,MAAM,KAAK;YAC9D,qDAAqD;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC;IAC3D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,CAAU,EAAE,CAAC;QACrF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAiB,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAoB,EACpB,UAA0B,EAAE;IAE5B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,cAAc,IAAI,CAAC,CAAC,YAAY,KAAK,gBAAgB,CAChF,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAA4B,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE3C,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAEzC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE9C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAwB,EAAE;QACrC,MAAM,KAAK,GAAc,EAAE,CAAC;QAE5B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAE1E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAExB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,YAAY,EAAE,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAU,EAAE,CAAC;YAC3E,IAAI,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;gBAChE,MAAM;YACR,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAY;IACjC,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,CAAC,QAAqB,EAAa,EAAE;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC"}