@oculum/scanner 1.0.12 → 1.0.13

package/dist/shared/code-analysis.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Shared Code Analysis Utilities
+ *
+ * ParsedFile-aware versions of control flow analysis and context extraction.
+ * Consolidates duplicated logic from control-flow.ts and various detectors.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInsideTryCatch = isInsideTryCatch;
+exports.hasTryCatchNearby = hasTryCatchNearby;
+exports.extractFunctionContext = extractFunctionContext;
+exports.searchSurroundingLines = searchSurroundingLines;
+const file_classifier_1 = require("../parse/file-classifier");
+/**
+ * Check if a line is inside a try-catch block.
+ * Tracks brace depth from the start of the file to the target line.
+ */
+function isInsideTryCatch(file, lineNumber) {
+    const lines = file.lines;
+    let tryDepth = 0;
+    let inTryBlock = false;
+    const braceStack = [];
+    for (let i = 0; i < lineNumber && i < lines.length; i++) {
+        const line = lines[i];
+        if (/\btry\s*\{/.test(line) && !(0, file_classifier_1.isComment)(line)) {
+            inTryBlock = true;
+            tryDepth++;
+            const openBraces = (line.match(/\{/g) || []).length;
+            const closeBraces = (line.match(/\}/g) || []).length;
+            for (let j = 0; j < openBraces - closeBraces; j++) {
+                braceStack.push('try');
+            }
+        }
+        else if (/\bcatch\s*\(/.test(line) && !(0, file_classifier_1.isComment)(line)) {
+            // Entering catch block - still protected
+        }
+        else if (/\bfinally\s*\{/.test(line) && !(0, file_classifier_1.isComment)(line)) {
+            // Entering finally block - still protected
+        }
+        else {
+            const openBraces = (line.match(/\{/g) || []).length;
+            const closeBraces = (line.match(/\}/g) || []).length;
+            for (let j = 0; j < openBraces; j++) {
+                braceStack.push(inTryBlock && tryDepth > 0 ? 'try' : 'other');
+            }
+            for (let j = 0; j < closeBraces; j++) {
+                const popped = braceStack.pop();
+                if (popped === 'try') {
+                    tryDepth--;
+                    if (tryDepth === 0) {
+                        inTryBlock = false;
+                    }
+                }
+            }
+        }
+    }
+    return tryDepth > 0;
+}
+/**
+ * Simpler heuristic: check if there's a try-catch in the same function scope.
+ * Looks for try { before the line and } catch after, within reasonable bounds.
+ */
+function hasTryCatchNearby(file, lineNumber, windowSize = 20) {
+    const lines = file.lines;
+    const startLine = Math.max(0, lineNumber - windowSize);
+    const endLine = Math.min(lines.length, lineNumber + windowSize);
+    // Look backward for 'try {'
+    let foundTry = false;
+    for (let i = lineNumber - 1; i >= startLine; i--) {
+        const line = lines[i];
+        if (/\btry\s*\{/.test(line) && !(0, file_classifier_1.isComment)(line)) {
+            foundTry = true;
+            break;
+        }
+        if (/\b(function|async function|=>|class)\b/.test(line) && /\{/.test(line)) {
+            break;
+        }
+    }
+    if (!foundTry)
+        return false;
+    // Look forward for '} catch'
+    for (let i = lineNumber; i < endLine; i++) {
+        const line = lines[i];
+        if (/\}\s*catch\s*\(/.test(line) && !(0, file_classifier_1.isComment)(line)) {
+            return true;
+        }
+        if (i > lineNumber && /\b(function|async function|class)\b/.test(line) && /\{/.test(line)) {
+            break;
+        }
+    }
+    return false;
+}
+/**
+ * Extract function context where a call is being made.
+ * Looks backwards from the current line to find enclosing function name.
+ * Returns lowercase function name or null if not found.
+ */
+function extractFunctionContext(file, lineNumber) {
+    const lines = file.lines;
+    const start = Math.max(0, lineNumber - 20);
+    for (let i = lineNumber; i >= start; i--) {
+        const line = lines[i];
+        // Skip anonymous arrow functions in callbacks
+        const hasMethodCallWithArrowCallback = /\.\w+\(.*\([^)]*\)\s*=>/.test(line);
+        if (hasMethodCallWithArrowCallback && !/^(const|let|var|function|async|export)/.test(line.trim())) {
+            continue;
+        }
+        // Named function declaration
+        const funcMatch = line.match(/function\s+(\w+)\s*\(/);
+        if (funcMatch) {
+            return funcMatch[1].toLowerCase();
+        }
+        // Arrow function with const/let/var
+        const arrowMatch = line.match(/(const|let|var)\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)(?:\s*:\s*\w+)?\s*=>/);
+        if (arrowMatch) {
+            return arrowMatch[2].toLowerCase();
+        }
+        // Method declaration
+        const methodMatch = line.match(/^\s*(?:async\s+)?(\w+)\s*\([^)]*\)\s*\{/);
+        if (methodMatch) {
+            return methodMatch[1].toLowerCase();
+        }
+        // Export function
+        const exportFuncMatch = line.match(/export\s+(?:async\s+)?function\s+(\w+)\s*\(/);
+        if (exportFuncMatch) {
+            return exportFuncMatch[1].toLowerCase();
+        }
+        // Export const arrow
+        const exportConstMatch = line.match(/export\s+const\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)(?:\s*:\s*\w+)?\s*=>/);
+        if (exportConstMatch) {
+            return exportConstMatch[1].toLowerCase();
+        }
+    }
+    return null;
+}
+/**
+ * Search surrounding lines for any of the given patterns.
+ * Consolidates the ±N line search pattern used across 55+ occurrences.
+ *
+ * @param file ParsedFile to search in
+ * @param lineIndex 0-based center line
+ * @param patterns RegExp patterns to search for
+ * @param windowSize number of lines before and after to search
+ * @returns found: true if any pattern matched, with matched line and pattern
+ */
+function searchSurroundingLines(file, lineIndex, patterns, windowSize) {
+    const startIndex = Math.max(0, lineIndex - windowSize);
+    const endIndex = Math.min(file.lineCount - 1, lineIndex + windowSize);
+    for (let i = startIndex; i <= endIndex; i++) {
+        const line = file.lines[i];
+        for (const pattern of patterns) {
+            if (pattern.test(line)) {
+                return { found: true, matchedLine: i, matchedPattern: pattern };
+            }
+        }
+    }
+    return { found: false };
+}
+//# sourceMappingURL=code-analysis.js.map

package/dist/shared/code-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-analysis.js","sourceRoot":"","sources":["../../src/shared/code-analysis.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AASH,4CA2CC;AAMD,8CAgCC;AAOD,wDA6CC;AAYD,wDAmBC;AA1KD,8DAAoD;AAEpD;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAgB,EAAE,UAAkB;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IAExB,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,MAAM,UAAU,GAA2B,EAAE,CAAA;IAE7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,2BAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YAChD,UAAU,GAAG,IAAI,CAAA;YACjB,QAAQ,EAAE,CAAA;YACV,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;YACnD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;YACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;aAAM,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,2BAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YACzD,yCAAyC;QAC3C,CAAC;aAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,2BAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,2CAA2C;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;YACnD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;YAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,UAAU,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YAC/D,CAAC;YAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAA;gBAC/B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,QAAQ,EAAE,CAAA;oBACV,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;wBACnB,UAAU,GAAG,KAAK,CAAA;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,GAAG,CAAC,CAAA;AACrB,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAAgB,EAAE,UAAkB,EAAE,aAAqB,EAAE;IAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC,CAAA;IAE/D,4BAA4B;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,KAAK,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,2BAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YAChD,QAAQ,GAAG,IAAI,CAAA;YACf,MAAK;QACP,CAAC;QACD,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE3B,6BAA6B;IAC7B,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,2BAAS,EAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,GAAG,UAAU,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1F,MAAK;QACP,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAgB,EAAE,UAAkB;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IAE1C,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,8CAA8C;QAC9C,MAAM,8BAA8B,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3E,IAAI,8BAA8B,IAAI,CAAC,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClG,SAAQ;QACV,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACrD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACnC,CAAC;QAED,oCAAoC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAA;QACzG,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACpC,CAAC;QAED,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACzE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACrC,CAAC;QAED,kBAAkB;QAClB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;QACjF,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACzC,CAAC;QAED,qBAAqB;QACrB,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAA;QAC9G,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,sBAAsB,CACpC,IAAgB,EAChB,SAAiB,EACjB,QAAkB,EAClB,UAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;IAErE,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC1B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AACzB,CAAC"}

package/dist/shared/comment-analyzer.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Comment Analyzer Utility
+ * Analyzes comment INTENTION - distinguishing explanatory comments from disabled code
+ *
+ * This addresses false positives where comments describing auth checks are flagged
+ * as "disabled authentication" when they're actually explaining the code that follows.
+ *
+ * Key insight: A comment before active code is EXPLANATORY, not disabled code.
+ * Only flag comments when:
+ * 1. The comment is followed by MORE commented code (disabled code block)
+ * 2. The comment matches explicit disable patterns (TODO: add auth, FIXME: needs auth)
+ */
+export interface CommentAnalysis {
+    /** Type of comment based on context */
+    type: 'explanatory' | 'disabled_code' | 'todo_fixme' | 'unknown';
+    /** Whether this comment represents a security concern */
+    isSecurityRelevant: boolean;
+    /** Optional reason for the classification */
+    reason?: string;
+}
+/**
+ * Analyze the INTENTION of a comment at a specific line
+ *
+ * @param lines - Array of all lines in the file
+ * @param commentLineIndex - The 0-indexed line number of the comment to analyze
+ * @returns CommentAnalysis with type and security relevance
+ */
+export declare function analyzeCommentIntention(lines: string[], commentLineIndex: number): CommentAnalysis;
+/**
+ * Check if a comment at a specific line indicates disabled authentication code
+ * This is the main function to use for detection
+ *
+ * @param lines - Array of all lines in the file
+ * @param lineIndex - The 0-indexed line number to check
+ * @returns true if the comment indicates disabled/missing auth that should be flagged
+ */
+export declare function isDisabledAuthComment(lines: string[], lineIndex: number): boolean;
+//# sourceMappingURL=comment-analyzer.d.ts.map

package/dist/shared/comment-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-analyzer.d.ts","sourceRoot":"","sources":["../../src/shared/comment-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,YAAY,GAAG,SAAS,CAAA;IAChE,yDAAyD;IACzD,kBAAkB,EAAE,OAAO,CAAA;IAC3B,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAoGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EAAE,EACf,gBAAgB,EAAE,MAAM,GACvB,eAAe,CAsGjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAGT"}

package/dist/shared/comment-analyzer.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * Comment Analyzer Utility
+ * Analyzes comment INTENTION - distinguishing explanatory comments from disabled code
+ *
+ * This addresses false positives where comments describing auth checks are flagged
+ * as "disabled authentication" when they're actually explaining the code that follows.
+ *
+ * Key insight: A comment before active code is EXPLANATORY, not disabled code.
+ * Only flag comments when:
+ * 1. The comment is followed by MORE commented code (disabled code block)
+ * 2. The comment matches explicit disable patterns (TODO: add auth, FIXME: needs auth)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeCommentIntention = analyzeCommentIntention;
+exports.isDisabledAuthComment = isDisabledAuthComment;
+/**
+ * Patterns that explicitly indicate missing/disabled security
+ * These are genuine concerns even in isolation
+ */
+const EXPLICIT_DISABLE_PATTERNS = [
+    // Explicit disable statements
+    /\/\/\s*(auth|authentication|authorization)\s+(check\s+)?(disabled|removed|skipped)/i,
+    /\/\/\s*(skip|bypass|disable)\s+(auth|authentication|authorization)/i,
+    /\/\/\s*no\s+auth\s*(required|needed|check)?/i,
+    // TODO/FIXME patterns indicating missing security
+    /\/\/\s*TODO:?\s*(add|implement|enable)\s+(auth|authentication|authorization|security)/i,
+    /\/\/\s*FIXME:?\s*(add|implement|enable|missing)\s+(auth|authentication|authorization)/i,
+    /\/\/\s*HACK:?\s*(no|skip|bypass)\s+(auth|authentication)/i,
+    // Temporary bypass patterns
+    /\/\/\s*(temporarily?|temp)\s+(disabled?|removed?|skipped?)\s+(auth|authentication)/i,
+    /\/\/\s*(for\s+)?test(ing)?\s*(only)?:?\s*(skip|no|disable)\s+auth/i,
+];
+/**
+ * Auth-related keywords that might appear in comments
+ * Used to detect if a comment is about authentication/authorization
+ */
+const AUTH_KEYWORDS = [
+    'auth',
+    'authentication',
+    'authorization',
+    'permission',
+    'verify',
+    'check',
+    'validate',
+    'ensure',
+    'require',
+    'protect',
+    'guard',
+    'secure',
+    'token',
+    'session',
+    'credential',
+];
+/**
+ * Patterns indicating active auth implementation in code
+ */
+const AUTH_IMPLEMENTATION_PATTERNS = [
+    /\bawait\s+auth\(/i,
+    /\bassert[A-Z]\w*Auth/i,
+    /\bverify[A-Z]\w*/i,
+    /\bcheck[A-Z]\w*Permission/i,
+    /\brequire[A-Z]\w*Auth/i,
+    /\bensure[A-Z]\w*Auth/i,
+    /\bgetServerSession/i,
+    /\bcurrentUser/i,
+    /\bgetCurrentUser/i,
+    /\bvalidate[A-Z]\w*Token/i,
+    /\bisAuthenticated/i,
+    /\bhasPermission/i,
+    /\bhasRole/i,
+    /\.protect\(/i,
+    /\.authorize\(/i,
+];
+/**
+ * Check if a line is a comment
+ */
+function isCommentLine(line) {
+    const trimmed = line.trim();
+    return (trimmed.startsWith('//') ||
+        trimmed.startsWith('#') ||
+        trimmed.startsWith('*') ||
+        trimmed.startsWith('/*'));
+}
+/**
+ * Check if a line is empty or whitespace only
+ */
+function isEmptyLine(line) {
+    return line.trim().length === 0;
+}
+/**
+ * Check if comment contains auth-related keywords
+ */
+function hasAuthKeyword(line) {
+    const lowerLine = line.toLowerCase();
+    return AUTH_KEYWORDS.some(keyword => lowerLine.includes(keyword));
+}
+/**
+ * Check if a line contains active auth implementation
+ */
+function hasAuthImplementation(line) {
+    return AUTH_IMPLEMENTATION_PATTERNS.some(pattern => pattern.test(line));
+}
+/**
+ * Analyze the INTENTION of a comment at a specific line
+ *
+ * @param lines - Array of all lines in the file
+ * @param commentLineIndex - The 0-indexed line number of the comment to analyze
+ * @returns CommentAnalysis with type and security relevance
+ */
+function analyzeCommentIntention(lines, commentLineIndex) {
+    const commentLine = lines[commentLineIndex];
+    if (!commentLine || !isCommentLine(commentLine)) {
+        return { type: 'unknown', isSecurityRelevant: false };
+    }
+    // PRIORITY 1: Check for explicit disable patterns (always a concern)
+    if (EXPLICIT_DISABLE_PATTERNS.some(pattern => pattern.test(commentLine))) {
+        return {
+            type: 'todo_fixme',
+            isSecurityRelevant: true,
+            reason: 'Comment explicitly indicates disabled or missing security',
+        };
+    }
+    // Check if this comment mentions auth-related keywords
+    if (!hasAuthKeyword(commentLine)) {
+        // Comment doesn't mention auth - not relevant to auth detection
+        return { type: 'unknown', isSecurityRelevant: false };
+    }
+    // PRIORITY 2: Check if next non-empty line is also a comment (disabled code block)
+    let nextLineIndex = commentLineIndex + 1;
+    while (nextLineIndex < lines.length && isEmptyLine(lines[nextLineIndex])) {
+        nextLineIndex++;
+    }
+    if (nextLineIndex < lines.length) {
+        const nextLine = lines[nextLineIndex];
+        // If next line is also a comment, this might be a disabled code block
+        if (isCommentLine(nextLine)) {
+            // Check if the commented-out code looks like auth implementation
+            // e.g., "// await verifyAuth()" or "// if (!session) return"
+            if (hasAuthImplementation(nextLine) || /\/\/\s*(if|await|return|const|let)\s/.test(nextLine)) {
+                return {
+                    type: 'disabled_code',
+                    isSecurityRelevant: true,
+                    reason: 'Comment followed by commented-out code that appears to be auth logic',
+                };
+            }
+            // Multiple consecutive comments without code - could be docs or disabled block
+            // Check deeper
+            let consecutiveComments = 1;
+            let foundCodeComment = false;
+            for (let i = nextLineIndex; i < Math.min(nextLineIndex + 5, lines.length); i++) {
+                if (isEmptyLine(lines[i]))
+                    continue;
+                if (isCommentLine(lines[i])) {
+                    consecutiveComments++;
+                    if (hasAuthImplementation(lines[i]) || /\/\/\s*(if|await|return|const|let)\s/.test(lines[i])) {
+                        foundCodeComment = true;
+                    }
+                }
+                else {
+                    break;
+                }
+            }
+            if (foundCodeComment) {
+                return {
+                    type: 'disabled_code',
+                    isSecurityRelevant: true,
+                    reason: 'Block of commented-out code containing auth logic',
+                };
+            }
+        }
+        // PRIORITY 3: Check if next line is ACTIVE auth implementation
+        // This means the comment is EXPLAINING the auth check, not disabling it
+        if (!isCommentLine(nextLine) && hasAuthImplementation(nextLine)) {
+            return {
+                type: 'explanatory',
+                isSecurityRelevant: false,
+                reason: 'Comment describes the auth check that follows',
+            };
+        }
+        // Check slightly further - the implementation might be 1-2 lines after
+        for (let i = nextLineIndex; i < Math.min(nextLineIndex + 3, lines.length); i++) {
+            const line = lines[i];
+            if (isEmptyLine(line))
+                continue;
+            if (isCommentLine(line))
+                continue;
+            if (hasAuthImplementation(line)) {
+                return {
+                    type: 'explanatory',
+                    isSecurityRelevant: false,
+                    reason: 'Comment describes nearby auth implementation',
+                };
+            }
+            break; // Stop at first non-comment, non-empty line
+        }
+    }
+    // Default: auth-related comment without clear context
+    // Be conservative - don't flag unless we're confident it's disabled code
+    return {
+        type: 'unknown',
+        isSecurityRelevant: false,
+        reason: 'Auth-related comment but no clear indication of disabled code',
+    };
+}
+/**
+ * Check if a comment at a specific line indicates disabled authentication code
+ * This is the main function to use for detection
+ *
+ * @param lines - Array of all lines in the file
+ * @param lineIndex - The 0-indexed line number to check
+ * @returns true if the comment indicates disabled/missing auth that should be flagged
+ */
+function isDisabledAuthComment(lines, lineIndex) {
+    const analysis = analyzeCommentIntention(lines, lineIndex);
+    return analysis.isSecurityRelevant && analysis.type !== 'explanatory';
+}
+//# sourceMappingURL=comment-analyzer.js.map

package/dist/shared/comment-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-analyzer.js","sourceRoot":"","sources":["../../src/shared/comment-analyzer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAoHH,0DAyGC;AAUD,sDAMC;AAlOD;;;GAGG;AACH,MAAM,yBAAyB,GAAG;IAChC,8BAA8B;IAC9B,qFAAqF;IACrF,qEAAqE;IACrE,8CAA8C;IAE9C,kDAAkD;IAClD,wFAAwF;IACxF,wFAAwF;IACxF,2DAA2D;IAE3D,4BAA4B;IAC5B,qFAAqF;IACrF,oEAAoE;CACrE,CAAA;AAED;;;GAGG;AACH,MAAM,aAAa,GAAG;IACpB,MAAM;IACN,gBAAgB;IAChB,eAAe;IACf,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,SAAS;IACT,YAAY;CACb,CAAA;AAED;;GAEG;AACH,MAAM,4BAA4B,GAAG;IACnC,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,4BAA4B;IAC5B,wBAAwB;IACxB,uBAAuB;IACvB,qBAAqB;IACrB,gBAAgB;IAChB,mBAAmB;IACnB,0BAA0B;IAC1B,oBAAoB;IACpB,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,gBAAgB;CACjB,CAAA;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CACzB,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAA;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AACnE,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACzE,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,KAAe,EACf,gBAAwB;IAExB,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAE3C,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAA;IACvD,CAAC;IAED,qEAAqE;IACrE,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,kBAAkB,EAAE,IAAI;YACxB,MAAM,EAAE,2DAA2D;SACpE,CAAA;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,gEAAgE;QAChE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAA;IACvD,CAAC;IAED,mFAAmF;IACnF,IAAI,aAAa,GAAG,gBAAgB,GAAG,CAAC,CAAA;IACxC,OAAO,aAAa,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACzE,aAAa,EAAE,CAAA;IACjB,CAAC;IAED,IAAI,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,CAAA;QAErC,sEAAsE;QACtE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,iEAAiE;YACjE,6DAA6D;YAC7D,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7F,OAAO;oBACL,IAAI,EAAE,eAAe;oBACrB,kBAAkB,EAAE,IAAI;oBACxB,MAAM,EAAE,sEAAsE;iBAC/E,CAAA;YACH,CAAC;YAED,+EAA+E;YAC/E,eAAe;YACf,IAAI,mBAAmB,GAAG,CAAC,CAAA;YAC3B,IAAI,gBAAgB,GAAG,KAAK,CAAA;YAC5B,KAAK,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/E,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAE,SAAQ;gBACnC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5B,mBAAmB,EAAE,CAAA;oBACrB,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7F,gBAAgB,GAAG,IAAI,CAAA;oBACzB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAK;gBACP,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO;oBACL,IAAI,EAAE,eAAe;oBACrB,kBAAkB,EAAE,IAAI;oBACxB,MAAM,EAAE,mDAAmD;iBAC5D,CAAA;YACH,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,wEAAwE;QACxE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,kBAAkB,EAAE,KAAK;gBACzB,MAAM,EAAE,+CAA+C;aACxD,CAAA;QACH,CAAC;QAED,uEAAuE;QACvE,KAAK,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,IAAI,WAAW,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC/B,IAAI,aAAa,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAEjC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,kBAAkB,EAAE,KAAK;oBACzB,MAAM,EAAE,8CAA8C;iBACvD,CAAA;YACH,CAAC;YACD,MAAK,CAAC,4CAA4C;QACpD,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,yEAAyE;IACzE,OAAO;QACL,IAAI,EAAE,SAAS;QACf,kBAAkB,EAAE,KAAK;QACzB,MAAM,EAAE,+DAA+D;KACxE,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CACnC,KAAe,EACf,SAAiB;IAEjB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAC,kBAAkB,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAA;AACvE,CAAC"}

package/dist/shared/diff-detector.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Diff Detection Utility
+ * Compares current repository tree against previous scan data to detect changed files
+ * Used for incremental scanning (Story D)
+ */
+export interface TreeFileInfo {
+    path: string;
+    sha: string;
+}
+export interface DiffResult {
+    /** Files that are new (not in previous scan) */
+    added: string[];
+    /** Files whose SHA changed (content modified) */
+    modified: string[];
+    /** Files that were deleted (in previous scan but not in current) */
+    deleted: string[];
+    /** Files that haven't changed */
+    unchanged: string[];
+    /** Total count of changed files (added + modified) */
+    changedCount: number;
+    /** Whether this is a significant change warranting incremental scan */
+    shouldUseIncremental: boolean;
+}
+/**
+ * Detect which files have changed between the current tree and previous scan
+ *
+ * @param currentTree - Array of files from current GitHub tree (path + sha)
+ * @param previousFileShas - Map of {file_path: sha} from previous scan
+ * @returns DiffResult with categorized file changes
+ */
+export declare function detectChangedFiles(currentTree: TreeFileInfo[], previousFileShas: Record<string, string> | null | undefined): DiffResult;
+/**
+ * Build a file SHA map from a GitHub tree response
+ * Filters to only include blob (file) entries
+ *
+ * @param tree - GitHub tree items with path and sha
+ * @returns Map of {file_path: sha}
+ */
+export declare function buildFileShaMap(tree: Array<{
+    path: string;
+    sha: string;
+    type: 'blob' | 'tree';
+}>): Record<string, string>;
+/**
+ * Check if two tree SHAs are different
+ * Quick check before doing detailed file comparison
+ *
+ * @param currentTreeSha - SHA of current tree
+ * @param previousTreeSha - SHA from previous scan
+ * @returns true if trees are different (need detailed comparison)
+ */
+export declare function hasTreeChanged(currentTreeSha: string, previousTreeSha: string | null | undefined): boolean;
+//# sourceMappingURL=diff-detector.d.ts.map

package/dist/shared/diff-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-detector.d.ts","sourceRoot":"","sources":["../../src/shared/diff-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,iDAAiD;IACjD,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,iCAAiC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAA;IACpB,uEAAuE;IACvE,oBAAoB,EAAE,OAAO,CAAA;CAC9B;AAQD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,YAAY,EAAE,EAC3B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAC1D,UAAU,CAsDZ;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC,GAChE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACzC,OAAO,CAGT"}

package/dist/shared/diff-detector.js

@@ -0,0 +1,104 @@
+"use strict";
+/**
+ * Diff Detection Utility
+ * Compares current repository tree against previous scan data to detect changed files
+ * Used for incremental scanning (Story D)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectChangedFiles = detectChangedFiles;
+exports.buildFileShaMap = buildFileShaMap;
+exports.hasTreeChanged = hasTreeChanged;
+/**
+ * Maximum number of changed files before falling back to full scan
+ * Beyond this threshold, incremental mode provides diminishing returns
+ */
+const MAX_CHANGED_FILES_FOR_INCREMENTAL = 50;
+/**
+ * Detect which files have changed between the current tree and previous scan
+ *
+ * @param currentTree - Array of files from current GitHub tree (path + sha)
+ * @param previousFileShas - Map of {file_path: sha} from previous scan
+ * @returns DiffResult with categorized file changes
+ */
+function detectChangedFiles(currentTree, previousFileShas) {
+    // If no previous data, everything is "new"
+    if (!previousFileShas || Object.keys(previousFileShas).length === 0) {
+        return {
+            added: currentTree.map(f => f.path),
+            modified: [],
+            deleted: [],
+            unchanged: [],
+            changedCount: currentTree.length,
+            shouldUseIncremental: false, // No baseline = full scan
+        };
+    }
+    const added = [];
+    const modified = [];
+    const unchanged = [];
+    const currentPaths = new Set();
+    // Compare current files against previous
+    for (const file of currentTree) {
+        currentPaths.add(file.path);
+        const previousSha = previousFileShas[file.path];
+        if (!previousSha) {
+            // File didn't exist before
+            added.push(file.path);
+        }
+        else if (previousSha !== file.sha) {
+            // File content changed (SHA differs)
+            modified.push(file.path);
+        }
+        else {
+            // Same SHA = unchanged
+            unchanged.push(file.path);
+        }
+    }
+    // Find deleted files (in previous but not in current)
+    const deleted = [];
+    for (const path of Object.keys(previousFileShas)) {
+        if (!currentPaths.has(path)) {
+            deleted.push(path);
+        }
+    }
+    const changedCount = added.length + modified.length;
+    const shouldUseIncremental = changedCount > 0 && changedCount <= MAX_CHANGED_FILES_FOR_INCREMENTAL;
+    return {
+        added,
+        modified,
+        deleted,
+        unchanged,
+        changedCount,
+        shouldUseIncremental,
+    };
+}
+/**
+ * Build a file SHA map from a GitHub tree response
+ * Filters to only include blob (file) entries
+ *
+ * @param tree - GitHub tree items with path and sha
+ * @returns Map of {file_path: sha}
+ */
+function buildFileShaMap(tree) {
+    const map = {};
+    for (const item of tree) {
+        // Only include files (blobs), not directories (trees)
+        if (item.type === 'blob') {
+            map[item.path] = item.sha;
+        }
+    }
+    return map;
+}
+/**
+ * Check if two tree SHAs are different
+ * Quick check before doing detailed file comparison
+ *
+ * @param currentTreeSha - SHA of current tree
+ * @param previousTreeSha - SHA from previous scan
+ * @returns true if trees are different (need detailed comparison)
+ */
+function hasTreeChanged(currentTreeSha, previousTreeSha) {
+    if (!previousTreeSha)
+        return true;
+    return currentTreeSha !== previousTreeSha;
+}
+//# sourceMappingURL=diff-detector.js.map

package/dist/shared/diff-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-detector.js","sourceRoot":"","sources":["../../src/shared/diff-detector.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAmCH,gDAyDC;AASD,0CAaC;AAUD,wCAMC;AA5GD;;;GAGG;AACH,MAAM,iCAAiC,GAAG,EAAE,CAAA;AAE5C;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAChC,WAA2B,EAC3B,gBAA2D;IAE3D,2CAA2C;IAC3C,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACnC,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;YACb,YAAY,EAAE,WAAW,CAAC,MAAM;YAChC,oBAAoB,EAAE,KAAK,EAAE,0BAA0B;SACxD,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtC,yCAAyC;IACzC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,2BAA2B;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvB,CAAC;aAAM,IAAI,WAAW,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,qCAAqC;YACrC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,uBAAuB;YACvB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;IACnD,MAAM,oBAAoB,GAAG,YAAY,GAAG,CAAC,IAAI,YAAY,IAAI,iCAAiC,CAAA;IAElG,OAAO;QACL,KAAK;QACL,QAAQ;QACR,OAAO;QACP,SAAS;QACT,YAAY;QACZ,oBAAoB;KACrB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAC7B,IAAiE;IAEjE,MAAM,GAAG,GAA2B,EAAE,CAAA;IAEtC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,sDAAsD;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,cAAsB,EACtB,eAA0C;IAE1C,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAA;IACjC,OAAO,cAAc,KAAK,eAAe,CAAA;AAC3C,CAAC"}