@oculum/scanner 1.0.0

package/dist/layer1/entropy.js

@@ -0,0 +1,500 @@
+"use strict";
+/**
+ * Layer 1: High-Entropy String Detection
+ * Uses Shannon entropy to detect potential secrets that don't match known patterns
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.calculateEntropy = calculateEntropy;
+exports.detectHighEntropyStrings = detectHighEntropyStrings;
+const context_helpers_1 = require("../utils/context-helpers");
+// Shannon entropy calculation
+function calculateEntropy(str) {
+    if (str.length === 0)
+        return 0;
+    const freq = {};
+    for (const char of str) {
+        freq[char] = (freq[char] || 0) + 1;
+    }
+    let entropy = 0;
+    const len = str.length;
+    for (const char in freq) {
+        const p = freq[char] / len;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+// Extract string literals from code
+function extractStringLiterals(content) {
+    const strings = [];
+    const lines = content.split('\n');
+    // Patterns for string literals
+    const patterns = [
+        /"([^"\\]|\\.){20,}"/g, // Double-quoted strings 20+ chars
+        /'([^'\\]|\\.){20,}'/g, // Single-quoted strings 20+ chars
+        /`([^`\\]|\\.){20,}`/g, // Template literals 20+ chars
+    ];
+    lines.forEach((line, index) => {
+        for (const pattern of patterns) {
+            let match;
+            const regex = new RegExp(pattern.source, pattern.flags);
+            while ((match = regex.exec(line)) !== null) {
+                // Remove quotes and get the actual string value
+                const value = match[0].slice(1, -1);
+                strings.push({
+                    value,
+                    line: index + 1,
+                    lineContent: line.trim(),
+                });
+            }
+        }
+    });
+    return strings;
+}
+// Check if string looks like a known safe pattern (URLs, paths, etc.)
+function isSafePattern(str) {
+    const safePatterns = [
+        /^https?:\/\//i, // URLs
+        /^\/[a-z0-9_/-]+$/i, // File paths
+        /^\d{4}-\d{2}-\d{2}/, // Dates
+        /^[a-f0-9]{32}$/i, // MD5 hashes (often used as IDs)
+        /^[a-f0-9]{40}$/i, // SHA1 hashes
+        /^[a-f0-9]{64}$/i, // SHA256 hashes
+        /^data:[a-z]+\/[a-z]+;base64,/i, // Data URLs
+        /^[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$/i, // Emails
+        /^\s*$/, // Whitespace only
+        /^[a-z\s]+$/i, // Only letters and spaces (likely text)
+        /^\/?[\(\)\[\]\{\}\|\?\*\+\.\^\$\\:!_a-z0-9/-]+$/i, // Regex patterns (route matchers, etc.)
+    ];
+    return safePatterns.some(pattern => pattern.test(str));
+}
+// Check if string is a PEM header/footer (not an actual secret)
+function isPEMHeader(str) {
+    const pemPatterns = [
+        /^-{3,}BEGIN\s+(PRIVATE|PUBLIC|RSA|DSA|EC|ENCRYPTED|CERTIFICATE)/i,
+        /^-{3,}END\s+(PRIVATE|PUBLIC|RSA|DSA|EC|ENCRYPTED|CERTIFICATE)/i,
+        /-----BEGIN\s+\w+\s+KEY-----/i,
+        /-----END\s+\w+\s+KEY-----/i,
+    ];
+    return pemPatterns.some(p => p.test(str));
+}
+// Check if string looks like encrypted/encoded content (not the key itself)
+function isEncryptedContent(str, lineContent) {
+    // Patterns for encrypted content blocks (not the key)
+    const encryptedPatterns = [
+        /encrypted_content/i,
+        /ciphertext/i,
+        /encrypted_data/i,
+        /encrypted_value/i,
+        // Base64 encoded binary data (very long, uniform character set)
+        /^[A-Za-z0-9+/]{100,}={0,2}$/, // Long base64 strings are often encrypted payloads
+    ];
+    // Check line context for encrypted content indicators
+    const contextIndicators = [
+        /["']encrypted_content["']\s*:/i,
+        /["']ciphertext["']\s*:/i,
+        /gAAAA/, // Fernet encryption prefix
+    ];
+    return (encryptedPatterns.some(p => p.test(str)) ||
+        contextIndicators.some(p => p.test(lineContent)));
+}
+// Check if string looks like a JWT segment (base64url encoded, starts with eyJ)
+function isJWTSegment(str) {
+    // JWT segments typically start with 'eyJ' (base64 for '{"')
+    // Full JWT format: header.payload.signature (all base64url)
+    if (str.startsWith('eyJ') && /^[A-Za-z0-9_-]+$/.test(str)) {
+        return true;
+    }
+    // Check for full JWT pattern (3 dot-separated base64url segments)
+    if (/^eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(str)) {
+        return true;
+    }
+    return false;
+}
+// Check if string looks like a regex/route matcher pattern
+function isRegexPattern(str) {
+    // Common regex metacharacters and patterns
+    const regexIndicators = ['(?', '(?!', '(?:', '(?=', '\\.', '\\.', '.*', '.+', '[^', '|', '$)', '^', '$'];
+    const indicatorCount = regexIndicators.filter(ind => str.includes(ind)).length;
+    // If it has multiple regex indicators, it's likely a regex pattern
+    return indicatorCount >= 2;
+}
+// Check if string is a template literal with code expressions
+function isTemplateWithCode(str, lineContent) {
+    // Check if the line contains template literal syntax with expressions
+    if (!lineContent.includes('`') && !lineContent.includes('${')) {
+        return false;
+    }
+    // Common code patterns inside template literals that create high entropy
+    const codePatterns = [
+        /\$\{[^}]*\.(toString|padStart|padEnd|toFixed|toLocaleString)\s*\(/i, // Method calls
+        /\$\{[^}]*\?\.[^}]*\}/, // Optional chaining
+        /\$\{[^}]*\s*\?\s*[^:]+\s*:\s*[^}]+\}/, // Ternary operators
+        /var\s*\(\s*\$\{/, // CSS var() with template
+        /\$\{[^}]*\.find\s*\(/i, // Array methods
+        /\$\{[^}]*\.map\s*\(/i,
+        /\$\{[^}]*\.filter\s*\(/i,
+        /\$\{new\s+Date\(\)/i, // Date formatting
+    ];
+    return codePatterns.some(pattern => pattern.test(lineContent));
+}
+// Check if string is human-readable text/markdown content
+function isHumanReadableContent(str) {
+    // Skip short strings
+    if (str.length < 30)
+        return false;
+    // Check for markdown indicators
+    const markdownIndicators = ['## ', '# ', '**', '- [ ]', '- ', '\n\n', '\\n'];
+    const hasMarkdown = markdownIndicators.some(ind => str.includes(ind));
+    // Check word-like pattern ratio (spaces between word-like tokens)
+    const words = str.split(/\s+/).filter(w => w.length > 0);
+    const wordLikeTokens = words.filter(w => /^[a-zA-Z][a-zA-Z0-9'-]*[:.!?,]?$/.test(w));
+    // If more than 50% of tokens look like words, it's probably text
+    const wordRatio = words.length > 0 ? wordLikeTokens.length / words.length : 0;
+    return hasMarkdown || wordRatio > 0.5;
+}
+// Check if string looks like a UI/display string (model names, descriptions, etc.)
+function isUIString(str, lineContent) {
+    // Common UI string patterns
+    const uiPatterns = [
+        /['"`].*Claude.*['"`]/i,
+        /['"`].*GPT.*['"`]/i,
+        /['"`].*Sonnet.*['"`]/i,
+        /['"`].*for\s+(chat|embeddings|completion).*['"`]/i,
+        /['"`]Uses\s+/i,
+        /['"`]Note:\s*/i,
+        /placeholder['"`:]/i,
+        /description['"`:]/i,
+        /label['"`:]/i,
+        /title['"`:]/i,
+        /message['"`:]/i,
+        /tooltip['"`:]/i,
+    ];
+    return uiPatterns.some(pattern => pattern.test(lineContent));
+}
+// Check if string is in a React/JSX UI context (component props, JSX text)
+function isJSXUIContext(lineContent) {
+    // JSX patterns that indicate UI context
+    const jsxUIPatterns = [
+        // Component props (common UI props)
+        /\b(placeholder|title|label|message|description|tooltip|alt|aria-label|name|id|className|testId|data-testid)\s*=\s*['"`]/i,
+        // JSX text children (text between tags)
+        />\s*['"`][^<]*['"`]\s*</,
+        // Common UI component names
+        /<(Button|Text|Label|Title|Heading|Paragraph|Span|Input|Tooltip|Badge|Alert|Toast)/i,
+        // Return statement with JSX template literal
+        /return\s+`[^`]*\$\{/,
+        // Template literals used for display
+        /['"`]Synced\s+/i,
+        /['"`]\d+\s*(h|hr|hour|m|min|minute|s|sec|second)s?\s+ago['"`]/i,
+        // Display formatting patterns
+        /\.toLocaleString\s*\(|\.toFixed\s*\(|\.padStart\s*\(/,
+    ];
+    return jsxUIPatterns.some(pattern => pattern.test(lineContent));
+}
+// Check if string is natural language (high ratio of common English words)
+function isNaturalLanguage(str) {
+    // Skip short strings
+    if (str.length < 25)
+        return false;
+    // Common English words that appear in natural language
+    const commonWords = new Set([
+        'the', 'a', 'an', 'is', 'are', 'was', 'were', 'be', 'been', 'being',
+        'have', 'has', 'had', 'do', 'does', 'did', 'will', 'would', 'could',
+        'should', 'may', 'might', 'must', 'shall', 'can', 'need', 'to', 'of',
+        'in', 'for', 'on', 'with', 'at', 'by', 'from', 'up', 'about', 'into',
+        'through', 'during', 'before', 'after', 'above', 'below', 'between',
+        'under', 'again', 'further', 'then', 'once', 'here', 'there', 'when',
+        'where', 'why', 'how', 'all', 'each', 'few', 'more', 'most', 'other',
+        'some', 'such', 'no', 'nor', 'not', 'only', 'own', 'same', 'so', 'than',
+        'too', 'very', 'just', 'also', 'now', 'and', 'but', 'or', 'if', 'as',
+        'your', 'you', 'this', 'that', 'it', 'they', 'we', 'he', 'she', 'my',
+        'their', 'our', 'his', 'her', 'its', 'ago', 'synced', 'updated', 'created',
+    ]);
+    // Split into words and count common ones
+    const words = str.toLowerCase().split(/\s+/).filter(w => w.length > 1);
+    if (words.length < 3)
+        return false;
+    const commonWordCount = words.filter(w => commonWords.has(w.replace(/[^a-z]/g, ''))).length;
+    const commonWordRatio = commonWordCount / words.length;
+    // If more than 30% of words are common English words, it's likely natural language
+    return commonWordRatio > 0.3;
+}
+// Check if string looks like CSS/Tailwind classes
+function isCSSClasses(str) {
+    // Tailwind/CSS class patterns
+    const cssIndicators = [
+        'flex', 'grid', 'block', 'inline', 'hidden',
+        'items-', 'justify-', 'gap-', 'space-',
+        'text-', 'font-', 'bg-', 'border-', 'rounded',
+        'px-', 'py-', 'pt-', 'pb-', 'pl-', 'pr-', 'p-',
+        'mx-', 'my-', 'mt-', 'mb-', 'ml-', 'mr-', 'm-',
+        'w-', 'h-', 'min-', 'max-',
+        'hover:', 'focus:', 'active:', 'disabled:',
+        'sm:', 'md:', 'lg:', 'xl:', '2xl:',
+        'dark:', 'light:',
+        'transition', 'duration-', 'ease-',
+        'absolute', 'relative', 'fixed', 'sticky',
+        'top-', 'bottom-', 'left-', 'right-',
+        'z-', 'overflow-', 'opacity-',
+        'ring-', 'shadow-', 'outline-',
+    ];
+    // Count how many CSS-like tokens are in the string
+    const tokens = str.toLowerCase().split(/\s+/);
+    const cssTokenCount = tokens.filter(token => cssIndicators.some(indicator => token.includes(indicator))).length;
+    // If more than 30% of tokens look like CSS classes, it's probably CSS
+    return cssTokenCount > 0 && (cssTokenCount / tokens.length) > 0.3;
+}
+// Check if string looks like CSS-in-JS (styled-components, emotion, etc.)
+function isCSSInJS(lineContent) {
+    const cssInJSPatterns = [
+        /styled\./, // styled.div, styled.button
+        /styled\(/, // styled(Component)
+        /css`/, // css`` template literal
+        /keyframes`/, // keyframes`` template literal
+        /@emotion/, // @emotion imports
+        /createGlobalStyle/, // styled-components global
+        /\$\{\s*props\s*=>/, // ${props => ...} in styled
+        /\$\{\s*\(\s*\{/, // ${({ theme }) => ...}
+    ];
+    return cssInJSPatterns.some(p => p.test(lineContent));
+}
+// Check if file is documentation/README
+function isDocumentationFile(filePath) {
+    const docPatterns = [
+        /README/i,
+        /CHANGELOG/i,
+        /CONTRIBUTING/i,
+        /LICENSE/i,
+        /CODE_OF_CONDUCT/i,
+        /SECURITY/i,
+        /AUTHORS/i,
+        /HISTORY/i,
+        /\.md$/i,
+        /\.mdx$/i,
+        /\.rst$/i, // reStructuredText
+        /\.adoc$/i, // AsciiDoc
+        /\.txt$/i, // Plain text docs
+        /\/docs\//i,
+        /\/documentation\//i,
+        /\/wiki\//i,
+        /\/guides?\//i,
+        /\/tutorials?\//i,
+        /\/examples?\//i, // Example directories often have sample configs
+    ];
+    return docPatterns.some(p => p.test(filePath));
+}
+// Check if string is a console.log/debug statement content
+function isDebugLogContent(lineContent) {
+    const debugPatterns = [
+        /console\.(log|debug|info|warn|error)\s*\(/i,
+        /logger\.(log|debug|info|warn|error)\s*\(/i,
+        /\[.*Debug.*\]/i,
+        /\[.*Log.*\]/i,
+    ];
+    return debugPatterns.some(pattern => pattern.test(lineContent));
+}
+// Check if string is inline style (JSX or HTML)
+function isInlineStyle(lineContent) {
+    // JSX inline styles
+    const jsxStylePatterns = [
+        /style\s*=\s*\{\{/, // style={{...}}
+        /style\s*=\s*\{[^}]*:/, // style={{ color: ... }}
+        /className\s*=\s*["`'][^"`']*gradient/i, // gradient classes
+        /className\s*=\s*["`'][^"`']*bg-/i, // bg- classes
+    ];
+    // HTML inline styles
+    const htmlStylePatterns = [
+        /style\s*=\s*["'][^"']*:/, // style="color: ..."
+        /<style[^>]*>/i, // <style> tags
+        /background:\s*linear-gradient/i, // CSS gradients
+        /background:\s*radial-gradient/i, // Radial gradients
+    ];
+    return [...jsxStylePatterns, ...htmlStylePatterns].some(p => p.test(lineContent));
+}
+// Check if string contains CSS tokens (colors, units, functions)
+function hasCSSTokens(str) {
+    const cssTokens = [
+        // CSS units
+        /\d+px\b/, /\d+%\b/, /\d+em\b/, /\d+rem\b/, /\d+deg\b/, /\d+vh\b/, /\d+vw\b/,
+        // Hex colors (standalone or in context)
+        /#[0-9a-f]{3,8}\b/i,
+        // CSS color functions
+        /rgb\s*\(/, /rgba\s*\(/, /hsl\s*\(/, /hsla\s*\(/,
+        /oklab\s*\(/, /oklch\s*\(/, /lab\s*\(/, /lch\s*\(/, // Modern color functions
+        // CSS gradients (all types)
+        /linear-gradient/, /radial-gradient/, /conic-gradient/,
+        /repeating-linear-gradient/, /repeating-radial-gradient/,
+        // Gradient direction keywords (Tailwind-style)
+        /\bfrom-/, /\bto-/, /\bvia-/,
+        // CSS custom properties
+        /var\s*\(--/,
+        // Common CSS properties
+        /\bopacity\s*:\s*[\d.]+/,
+        /\btransform\s*:/,
+        /\btransition\s*:/,
+        /\banimation\s*:/,
+        // Box shadow patterns
+        /\bshadow-/, /box-shadow/,
+        /\d+px\s+\d+px\s+\d+px/, // Shadow offset pattern
+        // Color stops in gradients
+        /\b\d+%\s*(,|$)/, // Percentage color stops
+    ];
+    // Single strong indicators (only need 1 match)
+    const strongIndicators = [
+        /^#[0-9a-f]{6}$/i, // Standalone 6-digit hex color
+        /^#[0-9a-f]{8}$/i, // Standalone 8-digit hex color with alpha
+        /linear-gradient\s*\(/, // Gradient function
+        /radial-gradient\s*\(/,
+        /conic-gradient\s*\(/,
+        /rgba?\s*\(\s*\d/, // rgb/rgba with numbers
+        /hsla?\s*\(\s*\d/, // hsl/hsla with numbers
+    ];
+    // If any strong indicator matches, it's definitely CSS
+    if (strongIndicators.some(pattern => pattern.test(str))) {
+        return true;
+    }
+    // Must match at least 2 CSS indicators to be confident it's CSS
+    const tokenCount = cssTokens.filter(pattern => pattern.test(str)).length;
+    return tokenCount >= 2;
+}
+// Check if value/line contains environment variable placeholders (shell scripts, test files)
+function isEnvVarPlaceholder(lineContent, value) {
+    // Shell script patterns
+    const shellEnvPatterns = [
+        /\$[A-Z_][A-Z0-9_]*/, // $VAR_NAME
+        /\$\{[A-Z_][A-Z0-9_]*\}/, // ${VAR_NAME}
+        /\bexport\s+[A-Z_][A-Z0-9_]*=["']?\$/, // export VAR=$OTHER
+        /:\s*\$\{[A-Z_][A-Z0-9_]*:-/, // ${VAR:-default}
+    ];
+    // Test file env var patterns (common placeholder names)
+    const testEnvPatterns = [
+        /FREE_KEY|PRO_KEY|ULTRA_KEY|TEST_KEY/i,
+        /BASE_URL|API_URL|ENDPOINT_URL/i,
+        /YOUR_[A-Z_]*KEY|REPLACE_[A-Z_]*KEY/i,
+        /\$\{?\w+\}?_KEY|\$\{?\w+\}?_TOKEN/i, // $SOME_KEY, ${SOME_TOKEN}
+    ];
+    return (shellEnvPatterns.some(p => p.test(lineContent)) ||
+        testEnvPatterns.some(p => p.test(value)) ||
+        testEnvPatterns.some(p => p.test(lineContent)));
+}
+function detectHighEntropyStrings(content, filePath) {
+    const vulnerabilities = [];
+    // Skip scanner/fixture files to avoid self-detection
+    if ((0, context_helpers_1.isScannerOrFixtureFile)(filePath)) {
+        return vulnerabilities;
+    }
+    // Skip fixture files (__fixtures__, .fixture., mock-data, etc.)
+    if ((0, context_helpers_1.isFixtureFile)(filePath)) {
+        return vulnerabilities;
+    }
+    // Skip example files
+    if ((0, context_helpers_1.isExampleFile)(filePath)) {
+        return vulnerabilities;
+    }
+    // Skip example directories (/examples/, /demos/, /tutorials/, etc.)
+    if ((0, context_helpers_1.isExampleDirectory)(filePath)) {
+        return vulnerabilities;
+    }
+    // Skip documentation/README files
+    if (isDocumentationFile(filePath)) {
+        return vulnerabilities;
+    }
+    const strings = extractStringLiterals(content);
+    for (const { value, line, lineContent } of strings) {
+        // Skip comments
+        if ((0, context_helpers_1.isComment)(lineContent))
+            continue;
+        // Skip PEM headers/footers (they look high-entropy but aren't secrets)
+        if (isPEMHeader(value))
+            continue;
+        // Skip encrypted content blocks (the payload, not the key)
+        if (isEncryptedContent(value, lineContent))
+            continue;
+        // Skip JWT segments (handled by patterns.ts for specific detection)
+        if (isJWTSegment(value))
+            continue;
+        // Skip inline styles (CSS/JSX style={{...}} or style="...")
+        if (isInlineStyle(lineContent))
+            continue;
+        // Skip strings with CSS tokens (colors, gradients, units)
+        if (hasCSSTokens(value))
+            continue;
+        // Skip environment variable placeholders (shell scripts, test files)
+        if (isEnvVarPlaceholder(lineContent, value))
+            continue;
+        // Skip safe patterns
+        if (isSafePattern(value))
+            continue;
+        // Skip CSS/Tailwind class strings
+        if (isCSSClasses(value))
+            continue;
+        // Skip CSS-in-JS patterns (styled-components, emotion)
+        if (isCSSInJS(lineContent))
+            continue;
+        // Skip debug log statements (they often contain env var names which look high-entropy)
+        if (isDebugLogContent(lineContent))
+            continue;
+        // Skip regex/route matcher patterns
+        if (isRegexPattern(value))
+            continue;
+        // Skip template literals with code expressions (they look high-entropy but aren't secrets)
+        if (isTemplateWithCode(value, lineContent))
+            continue;
+        // Skip human-readable text/markdown content
+        if (isHumanReadableContent(value))
+            continue;
+        // Skip UI strings (model names, descriptions, etc.)
+        if (isUIString(value, lineContent))
+            continue;
+        // Skip JSX UI context (component props, JSX text - like "Synced ${hours}h ago")
+        if (isJSXUIContext(lineContent))
+            continue;
+        // Skip natural language strings (high ratio of common English words)
+        if (isNaturalLanguage(value))
+            continue;
+        // Calculate entropy
+        const entropy = calculateEntropy(value);
+        // Determine if this is a test file (lower severity)
+        const inTestFile = (0, context_helpers_1.isTestOrMockFile)(filePath);
+        // Two thresholds:
+        // - entropy > 4.5 for strings > 20 chars (standard)
+        // - entropy > 4.2 for strings 16-20 chars (slightly stricter to reduce FPs)
+        const meetsThreshold = (entropy > 4.5 && value.length > 20) ||
+            (entropy > 4.2 && value.length >= 16 && value.length <= 20);
+        if (meetsThreshold) {
+            // Additional check: should have mix of character types
+            const hasLower = /[a-z]/.test(value);
+            const hasUpper = /[A-Z]/.test(value);
+            const hasDigit = /[0-9]/.test(value);
+            const hasSpecial = /[^a-zA-Z0-9]/.test(value);
+            const charTypes = [hasLower, hasUpper, hasDigit, hasSpecial].filter(Boolean).length;
+            // Only flag if it has at least 2 character types (looks like a secret)
+            if (charTypes >= 2) {
+                // Final check: skip CSS-like strings that passed earlier filters
+                const looksLikeCSS = /gradient|rgba?|hsla?|#[0-9a-f]{3,8}/i.test(value);
+                if (looksLikeCSS)
+                    continue;
+                // Lower severity for test files
+                const baseSeverity = entropy > 5.0 ? 'high' : 'medium';
+                const severity = inTestFile ? 'low' : baseSeverity;
+                const confidence = inTestFile ? 'low' : (entropy > 5.0 ? 'high' : 'medium');
+                vulnerabilities.push({
+                    id: `entropy-${filePath}-${line}`,
+                    filePath,
+                    lineNumber: line,
+                    lineContent,
+                    severity,
+                    category: 'high_entropy_string',
+                    title: 'Potential hardcoded secret detected',
+                    description: `High-entropy string found (entropy: ${entropy.toFixed(2)}). This may be a hardcoded secret, API key, or password.${inTestFile ? ' (in test file)' : ''}`,
+                    suggestedFix: 'Move this value to an environment variable and access it via process.env',
+                    confidence,
+                    layer: 1,
+                    requiresAIValidation: true, // Entropy findings must be validated by AI
+                });
+            }
+        }
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=entropy.js.map

package/dist/layer1/entropy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../../src/layer1/entropy.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAaH,4CAgBC;AA+ZD,4DAuIC;AAhkBD,8DAOiC;AAEjC,8BAA8B;AAC9B,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAE9B,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IACpC,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAA;IACtB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;QAC1B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oCAAoC;AACpC,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAgE,EAAE,CAAA;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,+BAA+B;IAC/B,MAAM,QAAQ,GAAG;QACf,sBAAsB,EAAO,kCAAkC;QAC/D,sBAAsB,EAAO,kCAAkC;QAC/D,sBAAsB,EAAO,8BAA8B;KAC5D,CAAA;IAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAA;YACT,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACvD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,gDAAgD;gBAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACnC,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK;oBACL,IAAI,EAAE,KAAK,GAAG,CAAC;oBACf,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;iBACzB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,sEAAsE;AACtE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,YAAY,GAAG;QACnB,eAAe,EAAqB,OAAO;QAC3C,mBAAmB,EAAiB,aAAa;QACjD,oBAAoB,EAAgB,QAAQ;QAC5C,iBAAiB,EAAmB,iCAAiC;QACrE,iBAAiB,EAAmB,cAAc;QAClD,iBAAiB,EAAmB,gBAAgB;QACpD,+BAA+B,EAAK,YAAY;QAChD,0CAA0C,EAAE,SAAS;QACrD,OAAO,EAA6B,kBAAkB;QACtD,aAAa,EAAuB,wCAAwC;QAC5E,kDAAkD,EAAE,wCAAwC;KAC7F,CAAA;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,gEAAgE;AAChE,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,WAAW,GAAG;QAClB,kEAAkE;QAClE,gEAAgE;QAChE,8BAA8B;QAC9B,4BAA4B;KAC7B,CAAA;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,GAAW,EAAE,WAAmB;IAC1D,sDAAsD;IACtD,MAAM,iBAAiB,GAAG;QACxB,oBAAoB;QACpB,aAAa;QACb,iBAAiB;QACjB,kBAAkB;QAClB,gEAAgE;QAChE,6BAA6B,EAAG,mDAAmD;KACpF,CAAA;IAED,sDAAsD;IACtD,MAAM,iBAAiB,GAAG;QACxB,gCAAgC;QAChC,yBAAyB;QACzB,OAAO,EAAG,2BAA2B;KACtC,CAAA;IAED,OAAO,CACL,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CACjD,CAAA;AACH,CAAC;AAGD,gFAAgF;AAChF,SAAS,YAAY,CAAC,GAAW;IAC/B,4DAA4D;IAC5D,4DAA4D;IAC5D,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,kEAAkE;IAClE,IAAI,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2DAA2D;AAC3D,SAAS,cAAc,CAAC,GAAW;IACjC,2CAA2C;IAC3C,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACzG,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;IAE9E,mEAAmE;IACnE,OAAO,cAAc,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,8DAA8D;AAC9D,SAAS,kBAAkB,CAAC,GAAW,EAAE,WAAmB;IAC1D,sEAAsE;IACtE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG;QACnB,oEAAoE,EAAG,eAAe;QACtF,sBAAsB,EAAG,oBAAoB;QAC7C,sCAAsC,EAAG,oBAAoB;QAC7D,iBAAiB,EAAG,0BAA0B;QAC9C,uBAAuB,EAAG,gBAAgB;QAC1C,sBAAsB;QACtB,yBAAyB;QACzB,qBAAqB,EAAG,kBAAkB;KAC3C,CAAA;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,0DAA0D;AAC1D,SAAS,sBAAsB,CAAC,GAAW;IACzC,qBAAqB;IACrB,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IAEjC,gCAAgC;IAChC,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAC5E,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAErE,kEAAkE;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACxD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpF,iEAAiE;IACjE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAE7E,OAAO,WAAW,IAAI,SAAS,GAAG,GAAG,CAAA;AACvC,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,GAAW,EAAE,WAAmB;IAClD,4BAA4B;IAC5B,MAAM,UAAU,GAAG;QACjB,uBAAuB;QACvB,oBAAoB;QACpB,uBAAuB;QACvB,mDAAmD;QACnD,eAAe;QACf,gBAAgB;QAChB,oBAAoB;QACpB,oBAAoB;QACpB,cAAc;QACd,cAAc;QACd,gBAAgB;QAChB,gBAAgB;KACjB,CAAA;IAED,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,WAAmB;IACzC,wCAAwC;IACxC,MAAM,aAAa,GAAG;QACpB,oCAAoC;QACpC,0HAA0H;QAC1H,wCAAwC;QACxC,yBAAyB;QACzB,4BAA4B;QAC5B,oFAAoF;QACpF,6CAA6C;QAC7C,qBAAqB;QACrB,qCAAqC;QACrC,iBAAiB;QACjB,gEAAgE;QAChE,8BAA8B;QAC9B,sDAAsD;KACvD,CAAA;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,GAAW;IACpC,qBAAqB;IACrB,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IAEjC,uDAAuD;IACvD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;QAC1B,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;QACnE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;QACnE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI;QACpE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM;QACpE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;QACnE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;QACpE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;QACpE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;QACvE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QACpE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;QACpE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;KAC3E,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAElC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC3F,MAAM,eAAe,GAAG,eAAe,GAAG,KAAK,CAAC,MAAM,CAAA;IAEtD,mFAAmF;IACnF,OAAO,eAAe,GAAG,GAAG,CAAA;AAC9B,CAAC;AAED,kDAAkD;AAClD,SAAS,YAAY,CAAC,GAAW;IAC/B,8BAA8B;IAC9B,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;QAC3C,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;QAC7C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;QAC9C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;QAC9C,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;QAC1B,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW;QAC1C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;QAClC,OAAO,EAAE,QAAQ;QACjB,YAAY,EAAE,WAAW,EAAE,OAAO;QAClC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;QACzC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ;QACpC,IAAI,EAAE,WAAW,EAAE,UAAU;QAC7B,OAAO,EAAE,SAAS,EAAE,UAAU;KAC/B,CAAA;IAED,mDAAmD;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1C,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAC3D,CAAC,MAAM,CAAA;IAER,sEAAsE;IACtE,OAAO,aAAa,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAA;AACnE,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,WAAmB;IACpC,MAAM,eAAe,GAAG;QACtB,UAAU,EAA4B,4BAA4B;QAClE,UAAU,EAA4B,oBAAoB;QAC1D,MAAM,EAAgC,yBAAyB;QAC/D,YAAY,EAA0B,+BAA+B;QACrE,UAAU,EAA4B,mBAAmB;QACzD,mBAAmB,EAAmB,2BAA2B;QACjE,mBAAmB,EAAmB,4BAA4B;QAClE,gBAAgB,EAAsB,wBAAwB;KAC/D,CAAA;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,wCAAwC;AACxC,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,WAAW,GAAG;QAClB,SAAS;QACT,YAAY;QACZ,eAAe;QACf,UAAU;QACV,kBAAkB;QAClB,WAAW;QACX,UAAU;QACV,UAAU;QACV,QAAQ;QACR,SAAS;QACT,SAAS,EAAS,mBAAmB;QACrC,UAAU,EAAQ,WAAW;QAC7B,SAAS,EAAS,kBAAkB;QACpC,WAAW;QACX,oBAAoB;QACpB,WAAW;QACX,cAAc;QACd,iBAAiB;QACjB,gBAAgB,EAAG,gDAAgD;KACpE,CAAA;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,2DAA2D;AAC3D,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,aAAa,GAAG;QACpB,4CAA4C;QAC5C,2CAA2C;QAC3C,gBAAgB;QAChB,cAAc;KACf,CAAA;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;AACjE,CAAC;AAGD,gDAAgD;AAChD,SAAS,aAAa,CAAC,WAAmB;IACxC,oBAAoB;IACpB,MAAM,gBAAgB,GAAG;QACvB,kBAAkB,EAAqB,gBAAgB;QACvD,sBAAsB,EAAiB,yBAAyB;QAChE,uCAAuC,EAAE,mBAAmB;QAC5D,kCAAkC,EAAM,cAAc;KACvD,CAAA;IAED,qBAAqB;IACrB,MAAM,iBAAiB,GAAG;QACxB,yBAAyB,EAAc,qBAAqB;QAC5D,eAAe,EAAyB,eAAe;QACvD,gCAAgC,EAAQ,gBAAgB;QACxD,gCAAgC,EAAQ,mBAAmB;KAC5D,CAAA;IAED,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,iEAAiE;AACjE,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,SAAS,GAAG;QAChB,YAAY;QACZ,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS;QAE5E,wCAAwC;QACxC,mBAAmB;QAEnB,sBAAsB;QACtB,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW;QAChD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAG,yBAAyB;QAE9E,4BAA4B;QAC5B,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB;QACtD,2BAA2B,EAAE,2BAA2B;QAExD,+CAA+C;QAC/C,SAAS,EAAE,OAAO,EAAE,QAAQ;QAE5B,wBAAwB;QACxB,YAAY;QAEZ,wBAAwB;QACxB,wBAAwB;QACxB,iBAAiB;QACjB,kBAAkB;QAClB,iBAAiB;QAEjB,sBAAsB;QACtB,WAAW,EAAE,YAAY;QACzB,uBAAuB,EAAG,wBAAwB;QAElD,2BAA2B;QAC3B,gBAAgB,EAAG,yBAAyB;KAC7C,CAAA;IAED,+CAA+C;IAC/C,MAAM,gBAAgB,GAAG;QACvB,iBAAiB,EAAY,+BAA+B;QAC5D,iBAAiB,EAAY,0CAA0C;QACvE,sBAAsB,EAAO,oBAAoB;QACjD,sBAAsB;QACtB,qBAAqB;QACrB,iBAAiB,EAAY,wBAAwB;QACrD,iBAAiB,EAAY,wBAAwB;KACtD,CAAA;IAED,uDAAuD;IACvD,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gEAAgE;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;IACxE,OAAO,UAAU,IAAI,CAAC,CAAA;AACxB,CAAC;AAED,6FAA6F;AAC7F,SAAS,mBAAmB,CAAC,WAAmB,EAAE,KAAa;IAC7D,wBAAwB;IACxB,MAAM,gBAAgB,GAAG;QACvB,oBAAoB,EAAe,YAAY;QAC/C,wBAAwB,EAAW,cAAc;QACjD,qCAAqC,EAAG,oBAAoB;QAC5D,4BAA4B,EAAO,kBAAkB;KACtD,CAAA;IAED,wDAAwD;IACxD,MAAM,eAAe,GAAG;QACtB,sCAAsC;QACtC,gCAAgC;QAChC,qCAAqC;QACrC,oCAAoC,EAAG,2BAA2B;KACnE,CAAA;IAED,OAAO,CACL,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAC/C,CAAA;AACH,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAe,EACf,QAAgB;IAEhB,MAAM,eAAe,GAAoB,EAAE,CAAA;IAE3C,qDAAqD;IACrD,IAAI,IAAA,wCAAsB,EAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,gEAAgE;IAChE,IAAI,IAAA,+BAAa,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,qBAAqB;IACrB,IAAI,IAAA,+BAAa,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,oEAAoE;IACpE,IAAI,IAAA,oCAAkB,EAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,kCAAkC;IAClC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAE9C,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;QACnD,gBAAgB;QAChB,IAAI,IAAA,2BAAS,EAAC,WAAW,CAAC;YAAE,SAAQ;QAEpC,uEAAuE;QACvE,IAAI,WAAW,CAAC,KAAK,CAAC;YAAE,SAAQ;QAEhC,2DAA2D;QAC3D,IAAI,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC;YAAE,SAAQ;QAEpD,oEAAoE;QACpE,IAAI,YAAY,CAAC,KAAK,CAAC;YAAE,SAAQ;QAEjC,4DAA4D;QAC5D,IAAI,aAAa,CAAC,WAAW,CAAC;YAAE,SAAQ;QAExC,0DAA0D;QAC1D,IAAI,YAAY,CAAC,KAAK,CAAC;YAAE,SAAQ;QAEjC,qEAAqE;QACrE,IAAI,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC;YAAE,SAAQ;QAErD,qBAAqB;QACrB,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,SAAQ;QAElC,kCAAkC;QAClC,IAAI,YAAY,CAAC,KAAK,CAAC;YAAE,SAAQ;QAEjC,uDAAuD;QACvD,IAAI,SAAS,CAAC,WAAW,CAAC;YAAE,SAAQ;QAEpC,uFAAuF;QACvF,IAAI,iBAAiB,CAAC,WAAW,CAAC;YAAE,SAAQ;QAE5C,oCAAoC;QACpC,IAAI,cAAc,CAAC,KAAK,CAAC;YAAE,SAAQ;QAEnC,2FAA2F;QAC3F,IAAI,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC;YAAE,SAAQ;QAEpD,4CAA4C;QAC5C,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAAE,SAAQ;QAE3C,oDAAoD;QACpD,IAAI,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC;YAAE,SAAQ;QAE5C,gFAAgF;QAChF,IAAI,cAAc,CAAC,WAAW,CAAC;YAAE,SAAQ;QAEzC,qEAAqE;QACrE,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,SAAQ;QAEtC,oBAAoB;QACpB,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAEvC,oDAAoD;QACpD,MAAM,UAAU,GAAG,IAAA,kCAAgB,EAAC,QAAQ,CAAC,CAAA;QAE7C,kBAAkB;QAClB,oDAAoD;QACpD,4EAA4E;QAC5E,MAAM,cAAc,GAClB,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;QAE7D,IAAI,cAAc,EAAE,CAAC;YACnB,uDAAuD;YACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;YAEnF,uEAAuE;YACvE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,iEAAiE;gBACjE,MAAM,YAAY,GAAG,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACvE,IAAI,YAAY;oBAAE,SAAQ;gBAC1B,gCAAgC;gBAChC,MAAM,YAAY,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;gBACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAA;gBAClD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;gBAE3E,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,WAAW,QAAQ,IAAI,IAAI,EAAE;oBACjC,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,WAAW;oBACX,QAAQ;oBACR,QAAQ,EAAE,qBAAqB;oBAC/B,KAAK,EAAE,qCAAqC;oBAC5C,WAAW,EAAE,uCAAuC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,2DAA2D,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;oBACtK,YAAY,EAAE,0EAA0E;oBACxF,UAAU;oBACV,KAAK,EAAE,CAAC;oBACR,oBAAoB,EAAE,IAAI,EAAG,2CAA2C;iBACzE,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/layer1/file-flags.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Layer 1: File Extension Red Flags
+ * Detects dangerous files that should not be in a repository
+ */
+import type { Vulnerability } from '../types';
+export declare function detectDangerousFiles(content: string, filePath: string): Vulnerability[];
+//# sourceMappingURL=file-flags.d.ts.map

package/dist/layer1/file-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-flags.d.ts","sourceRoot":"","sources":["../../src/layer1/file-flags.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAqD7C,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,aAAa,EAAE,CAiEjB"}

package/dist/layer1/file-flags.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Layer 1: File Extension Red Flags
+ * Detects dangerous files that should not be in a repository
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDangerousFiles = detectDangerousFiles;
+// Dangerous file extensions and names that should not be committed
+const DANGEROUS_FILE_PATTERNS = [
+    // Private keys
+    { pattern: /\.pem$/i, name: 'PEM Private Key', severity: 'critical' },
+    { pattern: /\.key$/i, name: 'Private Key File', severity: 'critical' },
+    { pattern: /\.p12$/i, name: 'PKCS#12 Certificate', severity: 'critical' },
+    { pattern: /\.pfx$/i, name: 'PFX Certificate', severity: 'critical' },
+    { pattern: /\.p8$/i, name: 'PKCS#8 Private Key', severity: 'critical' },
+    // SSH keys
+    { pattern: /id_rsa$/i, name: 'RSA SSH Private Key', severity: 'critical' },
+    { pattern: /id_dsa$/i, name: 'DSA SSH Private Key', severity: 'critical' },
+    { pattern: /id_ecdsa$/i, name: 'ECDSA SSH Private Key', severity: 'critical' },
+    { pattern: /id_ed25519$/i, name: 'Ed25519 SSH Private Key', severity: 'critical' },
+    // Environment files (should be gitignored)
+    { pattern: /^\.env$/i, name: 'Environment File', severity: 'critical' },
+    { pattern: /^\.env\.local$/i, name: 'Local Environment File', severity: 'critical' },
+    { pattern: /^\.env\.production$/i, name: 'Production Environment File', severity: 'critical' },
+    { pattern: /^\.env\.development$/i, name: 'Development Environment File', severity: 'high' },
+    { pattern: /^\.env\.staging$/i, name: 'Staging Environment File', severity: 'high' },
+    // Credential files
+    { pattern: /\.pgpass$/i, name: 'PostgreSQL Password File', severity: 'critical' },
+    { pattern: /\.npmrc$/i, name: 'NPM Configuration (may contain tokens)', severity: 'high' },
+    { pattern: /\.pypirc$/i, name: 'PyPI Configuration (may contain tokens)', severity: 'high' },
+    { pattern: /\.netrc$/i, name: 'Netrc File (contains credentials)', severity: 'critical' },
+    { pattern: /\.htpasswd$/i, name: 'Apache Password File', severity: 'critical' },
+    // Database files
+    { pattern: /\.sqlite$/i, name: 'SQLite Database', severity: 'medium' },
+    { pattern: /\.sqlite3$/i, name: 'SQLite Database', severity: 'medium' },
+    { pattern: /\.db$/i, name: 'Database File', severity: 'medium' },
+    // Backup files that may contain secrets
+    { pattern: /\.bak$/i, name: 'Backup File', severity: 'low' },
+    { pattern: /\.backup$/i, name: 'Backup File', severity: 'low' },
+    { pattern: /\.old$/i, name: 'Old File Backup', severity: 'low' },
+    // Keystore files
+    { pattern: /\.jks$/i, name: 'Java Keystore', severity: 'high' },
+    { pattern: /\.keystore$/i, name: 'Keystore File', severity: 'high' },
+];
+// Files that are okay in certain contexts but should be reviewed
+const CONTEXT_SENSITIVE_PATTERNS = [
+    { pattern: /\.env\.example$/i, name: 'Environment Example File', checkContent: true },
+    { pattern: /\.env\.sample$/i, name: 'Environment Sample File', checkContent: true },
+    { pattern: /\.env\.template$/i, name: 'Environment Template File', checkContent: true },
+];
+function detectDangerousFiles(content, filePath) {
+    const vulnerabilities = [];
+    const fileName = filePath.split('/').pop() || '';
+    // Check for dangerous file patterns
+    for (const { pattern, name, severity } of DANGEROUS_FILE_PATTERNS) {
+        if (pattern.test(fileName) || pattern.test(filePath)) {
+            vulnerabilities.push({
+                id: `file-flag-${filePath}`,
+                filePath,
+                lineNumber: 1,
+                lineContent: `File: ${fileName}`,
+                severity,
+                category: 'dangerous_file',
+                title: `Dangerous file detected: ${name}`,
+                description: `This file type (${name}) should not be committed to version control as it may contain sensitive information.`,
+                suggestedFix: 'Add this file to .gitignore and remove it from the repository. If it contains secrets, rotate them immediately.',
+                confidence: 'high',
+                layer: 1,
+            });
+        }
+    }
+    // Check context-sensitive files for actual secrets
+    for (const { pattern, name, checkContent } of CONTEXT_SENSITIVE_PATTERNS) {
+        if ((pattern.test(fileName) || pattern.test(filePath)) && checkContent) {
+            // Check if the example/sample file contains what looks like real values
+            const suspiciousPatterns = [
+                /[a-zA-Z0-9_]+=sk-[a-zA-Z0-9]{20,}/, // API keys
+                /[a-zA-Z0-9_]+=ghp_[a-zA-Z0-9]{36,}/, // GitHub tokens
+                /[a-zA-Z0-9_]+=eyJ[a-zA-Z0-9_-]+\./, // JWT tokens
+                /password\s*=\s*[^\s$]{8,}/i, // Passwords (not env vars)
+            ];
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                // Skip lines that reference environment variables
+                if (line.includes('${') || line.includes('$env:') || line.includes('process.env')) {
+                    continue;
+                }
+                for (const suspicious of suspiciousPatterns) {
+                    if (suspicious.test(line)) {
+                        vulnerabilities.push({
+                            id: `file-flag-content-${filePath}-${i + 1}`,
+                            filePath,
+                            lineNumber: i + 1,
+                            lineContent: line.trim(),
+                            severity: 'high',
+                            category: 'dangerous_file',
+                            title: `${name} may contain real secrets`,
+                            description: 'This example/sample file appears to contain real secret values instead of placeholders.',
+                            suggestedFix: 'Replace real values with placeholders like YOUR_API_KEY_HERE or use environment variable references.',
+                            confidence: 'medium',
+                            layer: 1,
+                        });
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=file-flags.js.map