@oculum/scanner 1.0.0

package/dist/utils/oauth-flow-detector.js

@@ -0,0 +1,202 @@
+"use strict";
+/**
+ * OAuth Flow Detector
+ * Detects OAuth state generation and validation across multiple files
+ * to prevent false positives when state is implemented correctly but split across files.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectOAuthFlow = detectOAuthFlow;
+exports.isOAuthStateImplemented = isOAuthStateImplemented;
+exports.getOAuthFlowSummary = getOAuthFlowSummary;
+/**
+ * Patterns that indicate OAuth state generation
+ */
+const STATE_GENERATION_PATTERNS = [
+    /generateState\s*\(/i,
+    /crypto\.randomBytes.*state/i,
+    /state\s*=\s*.*random/i,
+    /setCookie.*oauth.*state/i,
+    /cookies?\(\s*\)\.set\s*\([^)]*state/i,
+    /state\s*=\s*generateRandomString/i,
+    /state\s*=\s*nanoid\s*\(/i,
+    /state\s*=\s*uuid/i,
+    /state\s*=\s*crypto\.randomUUID/i,
+    /createState\s*\(/i,
+    /oauth.*state.*=.*crypto/i,
+    /\.setState\s*\(/i,
+    /stateParam\s*=\s*/i,
+    /generateOAuthState/i,
+];
+/**
+ * Patterns that indicate OAuth state validation
+ */
+const STATE_VALIDATION_PATTERNS = [
+    /state\s*!==\s*storedState/i,
+    /storedState.*!==.*state/i,
+    /validateState\s*\(/i,
+    /getCookie.*oauth.*state/i,
+    /cookies?\(\s*\)\.get\s*\([^)]*state/i,
+    /verifyState\s*\(/i,
+    /checkState\s*\(/i,
+    /state\s*===\s*savedState/i,
+    /savedState\s*===\s*state/i,
+    /if\s*\(\s*!?\s*state\s*\)/i,
+    /state\s*!==\s*.*\.get\s*\(/i,
+    /\.getState\s*\(/i,
+    /compareState\s*\(/i,
+];
+/**
+ * Patterns that indicate PKCE code_verifier usage
+ */
+const CODE_VERIFIER_PATTERNS = [
+    /code_verifier/i,
+    /codeVerifier/i,
+    /generateCodeVerifier/i,
+    /createCodeVerifier/i,
+    /pkce/i,
+    /code_challenge/i,
+    /codeChallenge/i,
+];
+/**
+ * Patterns that indicate client_credentials flow (no state needed)
+ */
+const CLIENT_CREDENTIALS_PATTERNS = [
+    /grant_type.*client_credentials/i,
+    /client_credentials.*grant/i,
+    /\.clientCredentials\s*\(/i,
+    /getClientCredentialsToken/i,
+    /machine-to-machine/i,
+    /m2m.*auth/i,
+];
+/**
+ * Known OAuth provider patterns
+ */
+const OAUTH_PROVIDER_PATTERNS = {
+    google: [/googleapis\.com\/oauth/i, /accounts\.google\.com/i, /google.*oauth/i],
+    github: [/github\.com\/login\/oauth/i, /api\.github\.com.*oauth/i],
+    microsoft: [/login\.microsoftonline\.com/i, /microsoft.*oauth/i, /azure.*oauth/i],
+    facebook: [/facebook\.com\/.*oauth/i, /graph\.facebook\.com/i],
+    twitter: [/twitter\.com\/oauth/i, /api\.twitter\.com.*oauth/i],
+    apple: [/appleid\.apple\.com/i, /apple.*oauth/i],
+    auth0: [/auth0\.com/i, /\.auth0\./i],
+    okta: [/okta\.com/i, /\.okta\./i],
+    clerk: [/clerk\.dev/i, /clerk\.com/i, /@clerk\//i],
+    nextauth: [/next-auth/i, /nextauth/i, /authjs/i],
+    lucia: [/lucia-auth/i, /lucia\.ts/i],
+    arctic: [/arctic/i, /oslo\/oauth/i],
+};
+/**
+ * Detect OAuth flow patterns across multiple files
+ */
+function detectOAuthFlow(files) {
+    const context = {
+        hasStateGeneration: false,
+        hasStateValidation: false,
+        hasCodeVerifier: false,
+        flowType: 'unknown',
+        providers: [],
+    };
+    const detectedProviders = new Set();
+    for (const file of files) {
+        const content = file.content;
+        const lines = content.split('\n');
+        // Check for state generation
+        if (!context.hasStateGeneration) {
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (STATE_GENERATION_PATTERNS.some(p => p.test(line))) {
+                    context.hasStateGeneration = true;
+                    context.stateGenerationFile = file.path;
+                    context.stateGenerationLine = i + 1;
+                    break;
+                }
+            }
+        }
+        // Check for state validation
+        if (!context.hasStateValidation) {
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (STATE_VALIDATION_PATTERNS.some(p => p.test(line))) {
+                    context.hasStateValidation = true;
+                    context.stateValidationFile = file.path;
+                    context.stateValidationLine = i + 1;
+                    break;
+                }
+            }
+        }
+        // Check for PKCE
+        if (!context.hasCodeVerifier) {
+            if (CODE_VERIFIER_PATTERNS.some(p => p.test(content))) {
+                context.hasCodeVerifier = true;
+                context.codeVerifierFile = file.path;
+            }
+        }
+        // Check for client_credentials flow
+        if (context.flowType === 'unknown') {
+            if (CLIENT_CREDENTIALS_PATTERNS.some(p => p.test(content))) {
+                context.flowType = 'client_credentials';
+            }
+        }
+        // Detect OAuth providers
+        for (const [provider, patterns] of Object.entries(OAUTH_PROVIDER_PATTERNS)) {
+            if (patterns.some(p => p.test(content))) {
+                detectedProviders.add(provider);
+            }
+        }
+    }
+    // Determine flow type
+    if (context.flowType === 'unknown') {
+        if (context.hasCodeVerifier) {
+            context.flowType = 'pkce';
+        }
+        else if (context.hasStateGeneration || context.hasStateValidation) {
+            context.flowType = 'authorization_code';
+        }
+    }
+    context.providers = Array.from(detectedProviders);
+    return context;
+}
+/**
+ * Check if OAuth state is properly implemented across files
+ */
+function isOAuthStateImplemented(context) {
+    // client_credentials flow doesn't need state
+    if (context.flowType === 'client_credentials') {
+        return true;
+    }
+    // PKCE flow with code_verifier is secure even without traditional state
+    if (context.hasCodeVerifier) {
+        return true;
+    }
+    // Both generation and validation must be present
+    return context.hasStateGeneration && context.hasStateValidation;
+}
+/**
+ * Get a summary of the OAuth flow for logging/context
+ */
+function getOAuthFlowSummary(context) {
+    const parts = [];
+    if (context.flowType !== 'unknown') {
+        parts.push(`Flow: ${context.flowType}`);
+    }
+    if (context.providers.length > 0) {
+        parts.push(`Providers: ${context.providers.join(', ')}`);
+    }
+    if (context.hasStateGeneration) {
+        parts.push(`State generated in: ${context.stateGenerationFile}`);
+    }
+    if (context.hasStateValidation) {
+        parts.push(`State validated in: ${context.stateValidationFile}`);
+    }
+    if (context.hasCodeVerifier) {
+        parts.push(`PKCE enabled (${context.codeVerifierFile})`);
+    }
+    if (isOAuthStateImplemented(context)) {
+        parts.push('✓ OAuth state properly implemented');
+    }
+    else if (context.hasStateGeneration || context.hasStateValidation) {
+        parts.push('⚠ Partial OAuth state implementation detected');
+    }
+    return parts.join('; ');
+}
+//# sourceMappingURL=oauth-flow-detector.js.map

package/dist/utils/oauth-flow-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow-detector.js","sourceRoot":"","sources":["../../src/utils/oauth-flow-detector.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAgHH,0CA4EC;AAKD,0DAaC;AAKD,kDA8BC;AAtND;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAChC,qBAAqB;IACrB,6BAA6B;IAC7B,uBAAuB;IACvB,0BAA0B;IAC1B,sCAAsC;IACtC,mCAAmC;IACnC,0BAA0B;IAC1B,mBAAmB;IACnB,iCAAiC;IACjC,mBAAmB;IACnB,0BAA0B;IAC1B,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;CACtB,CAAA;AAED;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAChC,4BAA4B;IAC5B,0BAA0B;IAC1B,qBAAqB;IACrB,0BAA0B;IAC1B,sCAAsC;IACtC,mBAAmB;IACnB,kBAAkB;IAClB,2BAA2B;IAC3B,2BAA2B;IAC3B,4BAA4B;IAC5B,6BAA6B;IAC7B,kBAAkB;IAClB,oBAAoB;CACrB,CAAA;AAED;;GAEG;AACH,MAAM,sBAAsB,GAAG;IAC7B,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,qBAAqB;IACrB,OAAO;IACP,iBAAiB;IACjB,gBAAgB;CACjB,CAAA;AAED;;GAEG;AACH,MAAM,2BAA2B,GAAG;IAClC,iCAAiC;IACjC,4BAA4B;IAC5B,2BAA2B;IAC3B,4BAA4B;IAC5B,qBAAqB;IACrB,YAAY;CACb,CAAA;AAED;;GAEG;AACH,MAAM,uBAAuB,GAA6B;IACxD,MAAM,EAAE,CAAC,yBAAyB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC;IAC/E,MAAM,EAAE,CAAC,4BAA4B,EAAE,0BAA0B,CAAC;IAClE,SAAS,EAAE,CAAC,8BAA8B,EAAE,mBAAmB,EAAE,eAAe,CAAC;IACjF,QAAQ,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;IAC9D,OAAO,EAAE,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IAC9D,KAAK,EAAE,CAAC,sBAAsB,EAAE,eAAe,CAAC;IAChD,KAAK,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;IACpC,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;IACjC,KAAK,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,CAAC;IAClD,QAAQ,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC;IAChD,KAAK,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;IACpC,MAAM,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC;CACpC,CAAA;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAiB;IAC/C,MAAM,OAAO,GAAqB;QAChC,kBAAkB,EAAE,KAAK;QACzB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,KAAK;QACtB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE,EAAE;KACd,CAAA;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAA;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEjC,6BAA6B;QAC7B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBACrB,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACtD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAA;oBACjC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAA;oBACvC,OAAO,CAAC,mBAAmB,GAAG,CAAC,GAAG,CAAC,CAAA;oBACnC,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBACrB,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACtD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAA;oBACjC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAA;oBACvC,OAAO,CAAC,mBAAmB,GAAG,CAAC,GAAG,CAAC,CAAA;oBACnC,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,eAAe,GAAG,IAAI,CAAA;gBAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAA;YACtC,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAA;YACzC,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC3E,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACxC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAA;QAC3B,CAAC;aAAM,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACpE,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAA;QACzC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEjD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,OAAyB;IAC/D,6CAA6C;IAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wEAAwE;IACxE,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,iDAAiD;IACjD,OAAO,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAA;AACjE,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,OAAyB;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/dist/utils/path-exclusions.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Path Exclusion Utility
+ * Provides configurable exclusion of test files, seed files, examples, and fixtures
+ * to reduce false positives in security scans.
+ */
+import type { Vulnerability } from '../types';
+export interface ExclusionConfig {
+    testPatterns: string[];
+    seedPatterns: string[];
+    examplePatterns: string[];
+    fixturePatterns: string[];
+}
+export type ExclusionReason = 'test_file' | 'seed_file' | 'example_file' | 'fixture_file' | null;
+/**
+ * Check if a file path should be excluded from scanning
+ * Returns the exclusion reason or null if not excluded
+ */
+export declare function getExclusionReason(filePath: string, config?: ExclusionConfig): ExclusionReason;
+/**
+ * Check if a file path should be excluded
+ */
+export declare function isExcludedPath(filePath: string, config?: Partial<ExclusionConfig>): boolean;
+/**
+ * Determine if a finding should be suppressed based on file path and category
+ *
+ * @param finding - The vulnerability finding
+ * @param exclusionReason - The reason the file is excluded (if any)
+ * @returns true if the finding should be suppressed
+ */
+export declare function shouldSuppressFinding(finding: Vulnerability, exclusionReason: ExclusionReason): boolean;
+/**
+ * Get a human-readable description of the exclusion reason
+ */
+export declare function getExclusionDescription(reason: ExclusionReason): string;
+/**
+ * Filter findings based on path exclusions
+ * Returns findings that should be kept and a list of suppressed findings with reasons
+ */
+export declare function filterFindingsByPath(findings: Vulnerability[], config?: Partial<ExclusionConfig>): {
+    kept: Vulnerability[];
+    suppressed: Array<{
+        finding: Vulnerability;
+        reason: ExclusionReason;
+        description: string;
+    }>;
+};
+/**
+ * Get the default exclusion configuration
+ */
+export declare function getDefaultExclusionConfig(): ExclusionConfig;
+/**
+ * Merge custom exclusion patterns with defaults
+ */
+export declare function mergeExclusionConfig(custom: Partial<ExclusionConfig>): ExclusionConfig;
+//# sourceMappingURL=path-exclusions.d.ts.map

package/dist/utils/path-exclusions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-exclusions.d.ts","sourceRoot":"","sources":["../../src/utils/path-exclusions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,UAAU,CAAA;AAEpE,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAwED,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,GAAG,IAAI,CAAA;AA6BhG;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,eAAoC,GAC3C,eAAe,CAwBjB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAChC,OAAO,CAOT;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,eAAe,GAC/B,OAAO,CAkBT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAavE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,aAAa,EAAE,EACzB,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAChC;IACD,IAAI,EAAE,aAAa,EAAE,CAAA;IACrB,UAAU,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,eAAe,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5F,CAwBA;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,eAAe,CAE3D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAC/B,eAAe,CAOjB"}

package/dist/utils/path-exclusions.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * Path Exclusion Utility
+ * Provides configurable exclusion of test files, seed files, examples, and fixtures
+ * to reduce false positives in security scans.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getExclusionReason = getExclusionReason;
+exports.isExcludedPath = isExcludedPath;
+exports.shouldSuppressFinding = shouldSuppressFinding;
+exports.getExclusionDescription = getExclusionDescription;
+exports.filterFindingsByPath = filterFindingsByPath;
+exports.getDefaultExclusionConfig = getDefaultExclusionConfig;
+exports.mergeExclusionConfig = mergeExclusionConfig;
+const DEFAULT_EXCLUSIONS = {
+    testPatterns: [
+        '**/*.spec.ts',
+        '**/*.spec.js',
+        '**/*.test.ts',
+        '**/*.test.js',
+        '**/test/**',
+        '**/tests/**',
+        '**/__tests__/**',
+        '**/e2e/**',
+        '**/app-tests/**',
+        '**/*.spec.tsx',
+        '**/*.spec.jsx',
+        '**/*.test.tsx',
+        '**/*.test.jsx',
+        '**/cypress/**',
+        '**/playwright/**',
+    ],
+    seedPatterns: [
+        '**/seed/**',
+        '**/seeds/**',
+        '**/prisma/seed/**',
+        '**/prisma/seed.ts',
+        '**/prisma/seed.js',
+        '**/db/seed/**',
+        '**/database/seed/**',
+    ],
+    examplePatterns: [
+        '**/examples/**',
+        '**/demo/**',
+        '**/sample/**',
+        '**/samples/**',
+        '**/playground/**',
+    ],
+    fixturePatterns: [
+        '**/fixtures/**',
+        '**/mocks/**',
+        '**/__mocks__/**',
+        '**/stubs/**',
+        '**/__fixtures__/**',
+    ],
+};
+/**
+ * Categories that should be SUPPRESSED in test/seed/example files
+ * These are typically false positives in non-production code
+ */
+const SUPPRESSIBLE_CATEGORIES = [
+    'weak_crypto', // Math.random in tests is fine
+    'dangerous_function', // regex, eval in tests often intentional
+    'hardcoded_secret', // test fixtures have fake secrets
+    'high_entropy_string', // test data often looks like secrets
+    'sensitive_url', // localhost in test configs
+    'sensitive_variable', // test variables named 'password' etc.
+    'insecure_config', // test configs are intentionally loose
+    'ai_pattern', // AI patterns in test code
+];
+/**
+ * Categories that should ALWAYS be scanned, even in test files
+ * These represent real vulnerabilities that matter in test code too
+ */
+const ALWAYS_SCAN_CATEGORIES = [
+    'sql_injection',
+    'command_injection',
+    'xss',
+    'path_traversal', // Cast since not in original types
+    'missing_auth', // Keep but may downgrade
+];
+/**
+ * Convert glob pattern to regex for matching
+ */
+function globToRegex(pattern) {
+    // Escape special regex characters except * and **
+    let regexStr = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*/g, '{{GLOBSTAR}}')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\{\{GLOBSTAR\}\}/g, '.*');
+    return new RegExp(regexStr, 'i');
+}
+/**
+ * Check if a file path matches any pattern in a list
+ */
+function matchesPatterns(filePath, patterns) {
+    // Normalize path separators
+    const normalizedPath = filePath.replace(/\\/g, '/');
+    return patterns.some(pattern => {
+        const regex = globToRegex(pattern);
+        return regex.test(normalizedPath);
+    });
+}
+/**
+ * Check if a file path should be excluded from scanning
+ * Returns the exclusion reason or null if not excluded
+ */
+function getExclusionReason(filePath, config = DEFAULT_EXCLUSIONS) {
+    const normalizedPath = filePath.replace(/\\/g, '/');
+    // Check test patterns
+    if (matchesPatterns(normalizedPath, config.testPatterns)) {
+        return 'test_file';
+    }
+    // Check seed patterns
+    if (matchesPatterns(normalizedPath, config.seedPatterns)) {
+        return 'seed_file';
+    }
+    // Check example patterns
+    if (matchesPatterns(normalizedPath, config.examplePatterns)) {
+        return 'example_file';
+    }
+    // Check fixture patterns
+    if (matchesPatterns(normalizedPath, config.fixturePatterns)) {
+        return 'fixture_file';
+    }
+    return null;
+}
+/**
+ * Check if a file path should be excluded
+ */
+function isExcludedPath(filePath, config) {
+    const mergedConfig = {
+        ...DEFAULT_EXCLUSIONS,
+        ...config,
+    };
+    return getExclusionReason(filePath, mergedConfig) !== null;
+}
+/**
+ * Determine if a finding should be suppressed based on file path and category
+ *
+ * @param finding - The vulnerability finding
+ * @param exclusionReason - The reason the file is excluded (if any)
+ * @returns true if the finding should be suppressed
+ */
+function shouldSuppressFinding(finding, exclusionReason) {
+    // If file is not excluded, don't suppress
+    if (!exclusionReason) {
+        return false;
+    }
+    // Always scan certain critical categories even in test files
+    if (ALWAYS_SCAN_CATEGORIES.includes(finding.category)) {
+        return false;
+    }
+    // Suppress suppressible categories in excluded files
+    if (SUPPRESSIBLE_CATEGORIES.includes(finding.category)) {
+        return true;
+    }
+    // Default: don't suppress
+    return false;
+}
+/**
+ * Get a human-readable description of the exclusion reason
+ */
+function getExclusionDescription(reason) {
+    switch (reason) {
+        case 'test_file':
+            return 'Finding in test file';
+        case 'seed_file':
+            return 'Finding in seed/fixture data file';
+        case 'example_file':
+            return 'Finding in example/demo file';
+        case 'fixture_file':
+            return 'Finding in mock/fixture file';
+        default:
+            return '';
+    }
+}
+/**
+ * Filter findings based on path exclusions
+ * Returns findings that should be kept and a list of suppressed findings with reasons
+ */
+function filterFindingsByPath(findings, config) {
+    const mergedConfig = {
+        ...DEFAULT_EXCLUSIONS,
+        ...config,
+    };
+    const kept = [];
+    const suppressed = [];
+    for (const finding of findings) {
+        const exclusionReason = getExclusionReason(finding.filePath, mergedConfig);
+        if (shouldSuppressFinding(finding, exclusionReason)) {
+            suppressed.push({
+                finding,
+                reason: exclusionReason,
+                description: getExclusionDescription(exclusionReason),
+            });
+        }
+        else {
+            kept.push(finding);
+        }
+    }
+    return { kept, suppressed };
+}
+/**
+ * Get the default exclusion configuration
+ */
+function getDefaultExclusionConfig() {
+    return { ...DEFAULT_EXCLUSIONS };
+}
+/**
+ * Merge custom exclusion patterns with defaults
+ */
+function mergeExclusionConfig(custom) {
+    return {
+        testPatterns: [...DEFAULT_EXCLUSIONS.testPatterns, ...(custom.testPatterns || [])],
+        seedPatterns: [...DEFAULT_EXCLUSIONS.seedPatterns, ...(custom.seedPatterns || [])],
+        examplePatterns: [...DEFAULT_EXCLUSIONS.examplePatterns, ...(custom.examplePatterns || [])],
+        fixturePatterns: [...DEFAULT_EXCLUSIONS.fixturePatterns, ...(custom.fixturePatterns || [])],
+    };
+}
+//# sourceMappingURL=path-exclusions.js.map

package/dist/utils/path-exclusions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-exclusions.js","sourceRoot":"","sources":["../../src/utils/path-exclusions.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAkHH,gDA2BC;AAKD,wCAUC;AASD,sDAqBC;AAKD,0DAaC;AAMD,oDA8BC;AAKD,8DAEC;AAKD,oDASC;AA1PD,MAAM,kBAAkB,GAAoB;IAC1C,YAAY,EAAE;QACZ,cAAc;QACd,cAAc;QACd,cAAc;QACd,cAAc;QACd,YAAY;QACZ,aAAa;QACb,iBAAiB;QACjB,WAAW;QACX,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,eAAe;QACf,eAAe;QACf,eAAe;QACf,kBAAkB;KACnB;IACD,YAAY,EAAE;QACZ,YAAY;QACZ,aAAa;QACb,mBAAmB;QACnB,mBAAmB;QACnB,mBAAmB;QACnB,eAAe;QACf,qBAAqB;KACtB;IACD,eAAe,EAAE;QACf,gBAAgB;QAChB,YAAY;QACZ,cAAc;QACd,eAAe;QACf,kBAAkB;KACnB;IACD,eAAe,EAAE;QACf,gBAAgB;QAChB,aAAa;QACb,iBAAiB;QACjB,aAAa;QACb,oBAAoB;KACrB;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,uBAAuB,GAA4B;IACvD,aAAa,EAAY,+BAA+B;IACxD,oBAAoB,EAAK,yCAAyC;IAClE,kBAAkB,EAAO,kCAAkC;IAC3D,qBAAqB,EAAI,qCAAqC;IAC9D,eAAe,EAAU,4BAA4B;IACrD,oBAAoB,EAAK,uCAAuC;IAChE,iBAAiB,EAAQ,uCAAuC;IAChE,YAAY,EAAa,2BAA2B;CACrD,CAAA;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAA4B;IACtD,eAAe;IACf,mBAAmB;IACnB,KAAK;IACL,gBAAyC,EAAE,mCAAmC;IAC9E,cAAc,EAAW,yBAAyB;CACnD,CAAA;AAID;;GAEG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,kDAAkD;IAClD,IAAI,QAAQ,GAAG,OAAO;SACnB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC;SAChC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAErC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,QAAkB;IAC3D,4BAA4B;IAC5B,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAEnD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAClC,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,QAAgB,EAChB,SAA0B,kBAAkB;IAE5C,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAEnD,sBAAsB;IACtB,IAAI,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,sBAAsB;IACtB,IAAI,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,yBAAyB;IACzB,IAAI,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5D,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,yBAAyB;IACzB,IAAI,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5D,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,QAAgB,EAChB,MAAiC;IAEjC,MAAM,YAAY,GAAoB;QACpC,GAAG,kBAAkB;QACrB,GAAG,MAAM;KACV,CAAA;IAED,OAAO,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,IAAI,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,OAAsB,EACtB,eAAgC;IAEhC,0CAA0C;IAC1C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,6DAA6D;IAC7D,IAAI,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,qDAAqD;IACrD,IAAI,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0BAA0B;IAC1B,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,MAAuB;IAC7D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAA;QAC/B,KAAK,WAAW;YACd,OAAO,mCAAmC,CAAA;QAC5C,KAAK,cAAc;YACjB,OAAO,8BAA8B,CAAA;QACvC,KAAK,cAAc;YACjB,OAAO,8BAA8B,CAAA;QACvC;YACE,OAAO,EAAE,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,QAAyB,EACzB,MAAiC;IAKjC,MAAM,YAAY,GAAoB;QACpC,GAAG,kBAAkB;QACrB,GAAG,MAAM;KACV,CAAA;IAED,MAAM,IAAI,GAAoB,EAAE,CAAA;IAChC,MAAM,UAAU,GAAoF,EAAE,CAAA;IAEtG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAE1E,IAAI,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;YACpD,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO;gBACP,MAAM,EAAE,eAAe;gBACvB,WAAW,EAAE,uBAAuB,CAAC,eAAe,CAAC;aACtD,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB;IACvC,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,MAAgC;IAEhC,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClF,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClF,eAAe,EAAE,CAAC,GAAG,kBAAkB,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAC3F,eAAe,EAAE,CAAC,GAAG,kBAAkB,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;KAC5F,CAAA;AACH,CAAC"}

package/dist/utils/project-context-builder.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Project Context Builder
+ *
+ * Builds a generic project context summary for AI validation by analyzing
+ * common patterns across the codebase. This context helps the AI validator
+ * understand the project's security architecture without hardcoding any
+ * specific framework or vendor.
+ *
+ * Key areas analyzed:
+ * - Authentication & access control patterns
+ * - Data access patterns (ORMs, query builders, raw queries)
+ * - Secrets & configuration handling
+ * - Framework detection
+ */
+import type { ScanFile } from '../types';
+import { type AuthHelperContext, type AuthHelper } from './auth-helper-detector';
+import { type OAuthFlowContext } from './oauth-flow-detector';
+import { type TRPCRouterContext } from './trpc-analyzer';
+export interface ProjectContext {
+    /** Summary string for AI prompt injection */
+    summary: string;
+    /** Authentication & access control patterns */
+    auth: AuthContext;
+    /** Data access patterns */
+    dataAccess: DataAccessContext;
+    /** Secrets & configuration patterns */
+    secrets: SecretsContext;
+    /** Detected frameworks and libraries */
+    frameworks: FrameworkContext;
+    /** File structure insights */
+    structure: StructureContext;
+    /** OAuth flow context */
+    oauth: OAuthFlowContext;
+    /** tRPC router context */
+    trpc: TRPCRouterContext;
+}
+export interface AuthContext {
+    /** Whether global auth middleware is detected */
+    hasGlobalMiddleware: boolean;
+    /** Type of auth provider (clerk, nextauth, auth0, custom, unknown) */
+    authProvider?: string;
+    /** Middleware file path */
+    middlewareFile?: string;
+    /** Protected path patterns */
+    protectedPaths: string[];
+    /** Public/excluded path patterns */
+    publicPaths: string[];
+    /** Auth helper functions detected (names only) */
+    authHelpers: string[];
+    /** Full auth helper context with throwing/return info */
+    authHelperContext?: AuthHelperContext;
+    /** Throwing auth helpers that guarantee authenticated context */
+    throwingAuthHelpers: AuthHelper[];
+    /** Whether user scoping is used in queries */
+    hasUserScoping: boolean;
+    /** User scoping patterns found */
+    userScopingPatterns: string[];
+}
+export interface DataAccessContext {
+    /** ORM/query builder detected */
+    orm?: 'prisma' | 'drizzle' | 'supabase' | 'mongoose' | 'sequelize' | 'typeorm' | 'knex' | 'raw_sql' | 'unknown';
+    /** Whether parameterized queries are the default */
+    usesParameterizedQueries: boolean;
+    /** Database type if detectable */
+    databaseType?: 'postgres' | 'mysql' | 'mongodb' | 'sqlite' | 'unknown';
+    /** Whether RLS (Row Level Security) is mentioned */
+    hasRLS: boolean;
+    /** Data validation library detected */
+    validationLibrary?: string;
+}
+export interface SecretsContext {
+    /** Uses environment variables for secrets */
+    usesEnvVars: boolean;
+    /** Uses a secret manager */
+    usesSecretManager: boolean;
+    /** Secret manager type if detected */
+    secretManagerType?: string;
+    /** Has .env files */
+    hasEnvFiles: boolean;
+    /** Uses NEXT_PUBLIC_ pattern (client-exposed) */
+    hasClientExposedEnvVars: boolean;
+}
+export interface FrameworkContext {
+    /** Primary framework */
+    primary?: 'nextjs' | 'express' | 'fastify' | 'nestjs' | 'django' | 'flask' | 'rails' | 'unknown';
+    /** Frontend framework */
+    frontend?: 'react' | 'vue' | 'svelte' | 'angular' | 'unknown';
+    /** Is this a monorepo? */
+    isMonorepo: boolean;
+    /** Uses TypeScript */
+    usesTypeScript: boolean;
+    /** Uses server components (Next.js 13+) */
+    usesServerComponents: boolean;
+    /** Uses server actions */
+    usesServerActions: boolean;
+}
+export interface StructureContext {
+    /** Has API routes */
+    hasApiRoutes: boolean;
+    /** Has middleware */
+    hasMiddleware: boolean;
+    /** Has server actions */
+    hasServerActions: boolean;
+    /** Total files analyzed */
+    totalFiles: number;
+    /** File types breakdown */
+    fileTypes: Record<string, number>;
+}
+/**
+ * Build a comprehensive project context from scanned files
+ * This context is used to inform AI validation decisions
+ */
+export declare function buildProjectContext(files: ScanFile[]): ProjectContext;
+/**
+ * Generate a compact context string for a single file validation
+ * Used when validating findings in a specific file
+ */
+export declare function getFileValidationContext(file: ScanFile, projectContext: ProjectContext): string;
+//# sourceMappingURL=project-context-builder.d.ts.map

package/dist/utils/project-context-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-context-builder.d.ts","sourceRoot":"","sources":["../../src/utils/project-context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAqB,KAAK,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnG,OAAO,EAAiE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC5H,OAAO,EAAsC,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAM5F,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAA;IAEf,+CAA+C;IAC/C,IAAI,EAAE,WAAW,CAAA;IAEjB,2BAA2B;IAC3B,UAAU,EAAE,iBAAiB,CAAA;IAE7B,uCAAuC;IACvC,OAAO,EAAE,cAAc,CAAA;IAEvB,wCAAwC;IACxC,UAAU,EAAE,gBAAgB,CAAA;IAE5B,8BAA8B;IAC9B,SAAS,EAAE,gBAAgB,CAAA;IAE3B,yBAAyB;IACzB,KAAK,EAAE,gBAAgB,CAAA;IAEvB,0BAA0B;IAC1B,IAAI,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8BAA8B;IAC9B,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,oCAAoC;IACpC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,kDAAkD;IAClD,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC,iEAAiE;IACjE,mBAAmB,EAAE,UAAU,EAAE,CAAA;IACjC,8CAA8C;IAC9C,cAAc,EAAE,OAAO,CAAA;IACvB,kCAAkC;IAClC,mBAAmB,EAAE,MAAM,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,GAAG,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IAC/G,oDAAoD;IACpD,wBAAwB,EAAE,OAAO,CAAA;IACjC,kCAAkC;IAClC,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAA;IACtE,oDAAoD;IACpD,MAAM,EAAE,OAAO,CAAA;IACf,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,4BAA4B;IAC5B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB;IACrB,WAAW,EAAE,OAAO,CAAA;IACpB,iDAAiD;IACjD,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,wBAAwB;IACxB,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;IAChG,yBAAyB;IACzB,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAA;IAC7D,0BAA0B;IAC1B,UAAU,EAAE,OAAO,CAAA;IACnB,sBAAsB;IACtB,cAAc,EAAE,OAAO,CAAA;IACvB,2CAA2C;IAC3C,oBAAoB,EAAE,OAAO,CAAA;IAC7B,0BAA0B;IAC1B,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,YAAY,EAAE,OAAO,CAAA;IACrB,qBAAqB;IACrB,aAAa,EAAE,OAAO,CAAA;IACtB,yBAAyB;IACzB,gBAAgB,EAAE,OAAO,CAAA;IACzB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAgDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,cAAc,CAkCrE;AA4cD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,EACd,cAAc,EAAE,cAAc,GAC7B,MAAM,CA2BR"}