@oculum/scanner 1.0.14 → 1.0.15

package/dist/detect/config/rules-file-backdoor.js

@@ -0,0 +1,379 @@
+"use strict";
+/**
+ * Layer 1: Rules File Backdoor Detection
+ *
+ * Detects the "Rules File Backdoor" attack (Pillar Security, March 2025)
+ * targeting AI coding assistant config files (.cursorrules, CLAUDE.md,
+ * .github/copilot-instructions.md, etc.) via:
+ *
+ * A) Invisible Unicode characters (zero-width, bidi overrides, tag blocks)
+ * B) Stealth behavior manipulation instructions
+ * C) File inventory (info-level) for security surface awareness
+ *
+ * @see https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeZeroWidthBinary = decodeZeroWidthBinary;
+exports.decodeTagBlock = decodeTagBlock;
+exports.detectRulesFileBackdoor = detectRulesFileBackdoor;
+const file_classifier_1 = require("../../parse/file-classifier");
+// ============================================================================
+// Unicode Character Classes
+// ============================================================================
+/** Zero-width characters — U+200B through U+200F, U+2060, U+2063, U+FEFF */
+const ZERO_WIDTH_RE = /[\u200B-\u200F\u2060\u2063\uFEFF]/g;
+/** Bidirectional override characters — U+202A-U+202E, U+2066-U+2069, U+061C */
+const BIDI_RE = /[\u202A-\u202E\u2066-\u2069\u061C]/g;
+/** Other invisible characters — U+00AD (soft hyphen), U+180E, U+034F */
+const OTHER_INVISIBLE_RE = /[\u00AD\u180E\u034F]/g;
+/**
+ * Unicode Tag Block characters — U+E0001 through U+E007F
+ * These encode full ASCII and can hide entire payloads invisibly.
+ * Note: These are astral plane characters and require surrogate pair matching in JS.
+ */
+const TAG_BLOCK_RE = /[\uDB40][\uDC01-\uDC7F]/g;
+// Alternative using code point regex for environments supporting it:
+const TAG_BLOCK_CODEPOINT_RE = /[\u{E0001}-\u{E007F}]/gu;
+// ============================================================================
+// Payload Decoders (exported for unit testing)
+// ============================================================================
+/**
+ * Decode zero-width binary encoding: U+200B=0, U+200C=1, 8-bit groups → ASCII
+ */
+function decodeZeroWidthBinary(content) {
+    // Extract only U+200B and U+200C characters
+    const bits = content.replace(/[^\u200B\u200C]/g, '');
+    if (bits.length < 8)
+        return '';
+    const chars = [];
+    for (let i = 0; i + 7 < bits.length; i += 8) {
+        let byte = 0;
+        for (let b = 0; b < 8; b++) {
+            if (bits[i + b] === '\u200C') {
+                byte |= 1 << (7 - b);
+            }
+        }
+        if (byte >= 32 && byte <= 126) {
+            chars.push(String.fromCharCode(byte));
+        }
+    }
+    return chars.join('');
+}
+/**
+ * Decode Unicode Tag Block encoding: U+E00XX → ASCII character XX
+ */
+function decodeTagBlock(content) {
+    const chars = [];
+    for (const ch of content) {
+        const cp = ch.codePointAt(0);
+        if (cp !== undefined && cp >= 0xE0001 && cp <= 0xE007F) {
+            const ascii = cp - 0xE0000;
+            if (ascii >= 32 && ascii <= 126) {
+                chars.push(String.fromCharCode(ascii));
+            }
+        }
+    }
+    return chars.join('');
+}
+const STEALTH_PATTERNS = [
+    // Security weakening
+    {
+        pattern: /\b(?:never|don['']?t|do\s+not|always\s+skip)\s+(?:sanitize|validate|escape|filter)\b/i,
+        title: 'Stealth instruction: security weakening',
+        description: 'AI rules file instructs the assistant to skip input sanitization or validation.',
+        severity: 'high',
+        group: 'security_weakening',
+    },
+    {
+        pattern: /\b(?:disable|turn\s+off|remove|skip)\s+(?:CORS|CSP|CSRF|HSTS|XSS\s+protect|security\s+head)/i,
+        title: 'Stealth instruction: disable security controls',
+        description: 'AI rules file instructs the assistant to disable security controls (CORS, CSP, CSRF, etc.).',
+        severity: 'high',
+        group: 'security_weakening',
+    },
+    {
+        pattern: /\balways\s+use\s+eval\b/i,
+        title: 'Stealth instruction: force eval usage',
+        description: 'AI rules file instructs the assistant to always use eval(), enabling code injection.',
+        severity: 'high',
+        group: 'security_weakening',
+    },
+    // Self-concealment
+    {
+        pattern: /\b(?:do\s+not|don['']?t|never)\s+(?:mention|reveal|disclose|show|display)\s+(?:these|this|the)\s+(?:instruction|rule|directive|config)/i,
+        title: 'Stealth instruction: self-concealment',
+        description: 'AI rules file contains instructions to hide its own directives from the user.',
+        severity: 'critical',
+        group: 'self_concealment',
+    },
+    {
+        pattern: /\bkeep\s+(?:this|these)\s+(?:secret|hidden|private|confidential)\b/i,
+        title: 'Stealth instruction: secrecy directive',
+        description: 'AI rules file instructs the assistant to keep instructions secret from the user.',
+        severity: 'critical',
+        group: 'self_concealment',
+    },
+    // Forced inclusion
+    {
+        pattern: /\b(?:always|must)\s+(?:include|install|add|use)\s+(?:the\s+)?(?:package|dependency|module|library)\s+/i,
+        title: 'Stealth instruction: forced package inclusion',
+        description: 'AI rules file forces the assistant to always include specific packages, potentially introducing supply chain risks.',
+        severity: 'high',
+        group: 'forced_inclusion',
+    },
+    // Credential insertion
+    {
+        pattern: /\b(?:use|set|always\s+use)\s+(?:this|the\s+following)\s+(?:API\s+key|token|secret|password|credential)\b/i,
+        title: 'Stealth instruction: credential insertion',
+        description: 'AI rules file attempts to inject specific credentials into generated code.',
+        severity: 'critical',
+        group: 'credential_insertion',
+    },
+    // Auth bypass
+    {
+        pattern: /\b(?:never|don['']?t|do\s+not|always\s+skip)\s+(?:check|verify|require)\s+(?:auth\w*|token|permission|credential|session|user)/i,
+        title: 'Stealth instruction: authentication bypass',
+        description: 'AI rules file instructs the assistant to skip authentication or authorization checks.',
+        severity: 'high',
+        group: 'auth_bypass',
+    },
+];
+// Educational context detection (reused from agent-skill-injection.ts pattern)
+const EDUCATIONAL_PATTERNS = [
+    /example\s+of/i,
+    /vulnerability/i,
+    /never\s+do\s+this/i,
+    /malicious\s+example/i,
+    /don['']t\s+do/i,
+    /avoid\s+this/i,
+    /anti[- ]?pattern/i,
+    /insecure\s+example/i,
+];
+function isEducationalContext(line) {
+    return EDUCATIONAL_PATTERNS.some(p => p.test(line));
+}
+// ============================================================================
+// Sub-detector A: Invisible Unicode Scanner
+// ============================================================================
+function detectInvisibleUnicode(content, filePath) {
+    const findings = [];
+    const lines = content.split('\n');
+    // Track character classes found
+    let zeroWidthCount = 0;
+    let bidiCount = 0;
+    let tagBlockCount = 0;
+    let otherInvisibleCount = 0;
+    const zeroWidthLines = [];
+    const bidiLines = [];
+    const tagBlockLines = [];
+    const otherLines = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNum = i + 1;
+        // Zero-width characters
+        const zwMatches = line.match(ZERO_WIDTH_RE);
+        if (zwMatches) {
+            // Skip BOM at start of file (byte 0)
+            if (lineNum === 1) {
+                const nonBomMatches = zwMatches.filter((ch, idx) => {
+                    // Only skip FEFF if it's at the very start of the line (byte 0)
+                    if (ch === '\uFEFF' && line.indexOf(ch) === 0 && idx === 0)
+                        return false;
+                    return true;
+                });
+                if (nonBomMatches.length > 0) {
+                    zeroWidthCount += nonBomMatches.length;
+                    zeroWidthLines.push(lineNum);
+                }
+            }
+            else {
+                zeroWidthCount += zwMatches.length;
+                zeroWidthLines.push(lineNum);
+            }
+        }
+        // Bidi override characters
+        const bidiMatches = line.match(BIDI_RE);
+        if (bidiMatches) {
+            bidiCount += bidiMatches.length;
+            bidiLines.push(lineNum);
+        }
+        // Tag block characters
+        const tagMatches = line.match(TAG_BLOCK_CODEPOINT_RE);
+        if (tagMatches) {
+            tagBlockCount += tagMatches.length;
+            tagBlockLines.push(lineNum);
+        }
+        // Other invisible characters
+        const otherMatches = line.match(OTHER_INVISIBLE_RE);
+        if (otherMatches) {
+            otherInvisibleCount += otherMatches.length;
+            otherLines.push(lineNum);
+        }
+    }
+    // Emit findings per character class
+    // Tag Block — always critical (full ASCII encoding capability)
+    if (tagBlockCount > 0) {
+        const decoded = decodeTagBlock(content);
+        const decodedSnippet = decoded.length > 200 ? decoded.slice(0, 200) + '...' : decoded;
+        const line = tagBlockLines[0];
+        findings.push({
+            id: `rfb-tag-${filePath}:${line}`,
+            filePath,
+            lineNumber: line,
+            lineContent: lines[line - 1]?.slice(0, 200) || '',
+            severity: 'critical',
+            category: 'ai_rules_file_backdoor',
+            title: 'Unicode Tag Block characters detected in AI rules file',
+            description: `Found ${tagBlockCount} Unicode Tag Block characters (U+E0001-E007F) that encode hidden ASCII text invisible to human reviewers.${decoded ? ` Decoded payload: "${decodedSnippet}"` : ''}`,
+            confidence: 'high',
+            layer: 1,
+            source: 'config',
+            requiresAIValidation: false,
+        });
+    }
+    // Bidi overrides — always high
+    if (bidiCount > 0) {
+        const line = bidiLines[0];
+        findings.push({
+            id: `rfb-bidi-${filePath}:${line}`,
+            filePath,
+            lineNumber: line,
+            lineContent: lines[line - 1]?.slice(0, 200) || '',
+            severity: 'high',
+            category: 'ai_rules_file_backdoor',
+            title: 'Bidirectional override characters in AI rules file',
+            description: `Found ${bidiCount} bidirectional text override characters (U+202A-202E, U+2066-2069) that can visually reorder text to hide malicious instructions from human reviewers.`,
+            confidence: 'high',
+            layer: 1,
+            source: 'config',
+            requiresAIValidation: false,
+        });
+    }
+    // Zero-width characters — severity by concentration
+    if (zeroWidthCount > 0) {
+        let severity;
+        if (zeroWidthCount >= 16) {
+            severity = 'critical';
+        }
+        else if (zeroWidthCount >= 8) {
+            severity = 'high';
+        }
+        else {
+            severity = 'medium';
+        }
+        const decoded = decodeZeroWidthBinary(content);
+        const decodedSnippet = decoded.length > 200 ? decoded.slice(0, 200) + '...' : decoded;
+        const line = zeroWidthLines[0];
+        findings.push({
+            id: `rfb-zw-${filePath}:${line}`,
+            filePath,
+            lineNumber: line,
+            lineContent: lines[line - 1]?.slice(0, 200) || '',
+            severity,
+            category: 'ai_rules_file_backdoor',
+            title: 'Zero-width Unicode characters in AI rules file',
+            description: `Found ${zeroWidthCount} zero-width characters (U+200B-200F, U+2060, U+FEFF) that are invisible to human reviewers but interpreted by AI models.${decoded ? ` Decoded payload: "${decodedSnippet}"` : ''}`,
+            confidence: 'high',
+            layer: 1,
+            source: 'config',
+            requiresAIValidation: false,
+        });
+    }
+    // Other invisible — medium
+    if (otherInvisibleCount > 0) {
+        const line = otherLines[0];
+        findings.push({
+            id: `rfb-inv-${filePath}:${line}`,
+            filePath,
+            lineNumber: line,
+            lineContent: lines[line - 1]?.slice(0, 200) || '',
+            severity: 'medium',
+            category: 'ai_rules_file_backdoor',
+            title: 'Invisible Unicode characters in AI rules file',
+            description: `Found ${otherInvisibleCount} invisible characters (soft hyphen U+00AD, U+180E, U+034F) that may hide content from human reviewers.`,
+            confidence: 'medium',
+            layer: 1,
+            source: 'config',
+            requiresAIValidation: false,
+        });
+    }
+    return findings;
+}
+// ============================================================================
+// Sub-detector B: Stealth Instruction Scanner
+// ============================================================================
+function detectStealthInstructions(content, filePath) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNum = i + 1;
+        // Skip educational context
+        if (isEducationalContext(line))
+            continue;
+        for (const def of STEALTH_PATTERNS) {
+            if (def.pattern.test(line)) {
+                findings.push({
+                    id: `rfb-stealth-${def.group}-${filePath}:${lineNum}`,
+                    filePath,
+                    lineNumber: lineNum,
+                    lineContent: line.trim().slice(0, 200),
+                    severity: def.severity,
+                    category: 'ai_rules_file_backdoor',
+                    title: def.title,
+                    description: def.description,
+                    confidence: 'high',
+                    layer: 1,
+                    source: 'config',
+                    requiresAIValidation: false,
+                });
+                break; // One finding per line max (avoid duplicates from overlapping patterns)
+            }
+        }
+    }
+    return findings;
+}
+// ============================================================================
+// Sub-detector C: File Inventory
+// ============================================================================
+function createInventoryFinding(filePath) {
+    return {
+        id: `rfb-inventory-${filePath}`,
+        filePath,
+        lineNumber: 0,
+        lineContent: '',
+        severity: 'info',
+        category: 'ai_rules_file_backdoor',
+        title: 'AI rules file detected',
+        description: `AI coding assistant configuration file detected. These files define AI assistant behavior and are potential targets for the "Rules File Backdoor" attack.`,
+        confidence: 'high',
+        layer: 1,
+        source: 'config',
+        requiresAIValidation: false,
+    };
+}
+/**
+ * Detect Rules File Backdoor attacks in AI config files.
+ *
+ * Scans for:
+ * - Invisible Unicode characters (zero-width, bidi, tag blocks)
+ * - Stealth behavior manipulation instructions
+ * - File inventory (info-level awareness)
+ */
+function detectRulesFileBackdoor(content, filePath, options) {
+    // Gate: only scan AI rules files
+    if (!(0, file_classifier_1.isAIRulesFile)(filePath))
+        return [];
+    // Skip test/fixture files
+    if ((0, file_classifier_1.isTestOrMockFile)(filePath) || (0, file_classifier_1.isScannerOrFixtureFile)(filePath))
+        return [];
+    const findings = [];
+    // Sub-detector A: Invisible Unicode
+    findings.push(...detectInvisibleUnicode(content, filePath));
+    // Sub-detector B: Stealth Instructions
+    findings.push(...detectStealthInstructions(content, filePath));
+    // Sub-detector C: File Inventory (always emit info for every AI rules file)
+    findings.push(createInventoryFinding(filePath));
+    return findings;
+}
+//# sourceMappingURL=rules-file-backdoor.js.map

package/dist/detect/config/rules-file-backdoor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-file-backdoor.js","sourceRoot":"","sources":["../../../src/detect/config/rules-file-backdoor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAuCH,sDAkBC;AAKD,wCAYC;AAwUD,0DAuBC;AAraD,iEAIoC;AAEpC,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E,4EAA4E;AAC5E,MAAM,aAAa,GAAG,oCAAoC,CAAA;AAE1D,+EAA+E;AAC/E,MAAM,OAAO,GAAG,qCAAqC,CAAA;AAErD,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,uBAAuB,CAAA;AAElD;;;;GAIG;AACH,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAC/C,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,yBAAyB,CAAA;AAExD,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,qBAAqB,CAAC,OAAe;IACnD,4CAA4C;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAE9B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QACD,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;QAC5B,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,CAAA;YAC1B,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAcD,MAAM,gBAAgB,GAAqB;IACzC,qBAAqB;IACrB;QACE,OAAO,EAAE,uFAAuF;QAChG,KAAK,EAAE,yCAAyC;QAChD,WAAW,EAAE,iFAAiF;QAC9F,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oBAAoB;KAC5B;IACD;QACE,OAAO,EAAE,8FAA8F;QACvG,KAAK,EAAE,gDAAgD;QACvD,WAAW,EAAE,6FAA6F;QAC1G,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oBAAoB;KAC5B;IACD;QACE,OAAO,EAAE,0BAA0B;QACnC,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,sFAAsF;QACnG,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,oBAAoB;KAC5B;IACD,mBAAmB;IACnB;QACE,OAAO,EAAE,yIAAyI;QAClJ,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,+EAA+E;QAC5F,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kBAAkB;KAC1B;IACD;QACE,OAAO,EAAE,qEAAqE;QAC9E,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE,kFAAkF;QAC/F,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kBAAkB;KAC1B;IACD,mBAAmB;IACnB;QACE,OAAO,EAAE,wGAAwG;QACjH,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,qHAAqH;QAClI,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,kBAAkB;KAC1B;IACD,uBAAuB;IACvB;QACE,OAAO,EAAE,2GAA2G;QACpH,KAAK,EAAE,2CAA2C;QAClD,WAAW,EAAE,4EAA4E;QACzF,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,sBAAsB;KAC9B;IACD,cAAc;IACd;QACE,OAAO,EAAE,iIAAiI;QAC1I,KAAK,EAAE,4CAA4C;QACnD,WAAW,EAAE,uFAAuF;QACpG,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,aAAa;KACrB;CACF,CAAA;AAED,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG;IAC3B,eAAe;IACf,gBAAgB;IAChB,oBAAoB;IACpB,sBAAsB;IACtB,gBAAgB;IAChB,eAAe;IACf,mBAAmB;IACnB,qBAAqB;CACtB,CAAA;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,+EAA+E;AAC/E,4CAA4C;AAC5C,+EAA+E;AAE/E,SAAS,sBAAsB,CAAC,OAAe,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,gCAAgC;IAChC,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAC3B,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,MAAM,aAAa,GAAa,EAAE,CAAA;IAClC,MAAM,UAAU,GAAa,EAAE,CAAA;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAA;QAErB,wBAAwB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAC3C,IAAI,SAAS,EAAE,CAAC;YACd,qCAAqC;YACrC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;oBACjD,gEAAgE;oBAChE,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;wBAAE,OAAO,KAAK,CAAA;oBACxE,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAA;gBACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC7B,cAAc,IAAI,aAAa,CAAC,MAAM,CAAA;oBACtC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,cAAc,IAAI,SAAS,CAAC,MAAM,CAAA;gBAClC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,IAAI,WAAW,CAAC,MAAM,CAAA;YAC/B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,aAAa,IAAI,UAAU,CAAC,MAAM,CAAA;YAClC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QAED,6BAA6B;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QACnD,IAAI,YAAY,EAAE,CAAC;YACjB,mBAAmB,IAAI,YAAY,CAAC,MAAM,CAAA;YAC1C,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,oCAAoC;IAEpC,+DAA+D;IAC/D,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAA;QACrF,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,WAAW,QAAQ,IAAI,IAAI,EAAE;YACjC,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE;YACjD,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,wBAAwB;YAClC,KAAK,EAAE,wDAAwD;YAC/D,WAAW,EAAE,SAAS,aAAa,4GAA4G,OAAO,CAAC,CAAC,CAAC,sBAAsB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACvM,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,KAAK;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,+BAA+B;IAC/B,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,YAAY,QAAQ,IAAI,IAAI,EAAE;YAClC,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE;YACjD,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,wBAAwB;YAClC,KAAK,EAAE,oDAAoD;YAC3D,WAAW,EAAE,SAAS,SAAS,wJAAwJ;YACvL,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,KAAK;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,oDAAoD;IACpD,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,QAA+B,CAAA;QACnC,IAAI,cAAc,IAAI,EAAE,EAAE,CAAC;YACzB,QAAQ,GAAG,UAAU,CAAA;QACvB,CAAC;aAAM,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;YAC/B,QAAQ,GAAG,MAAM,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,QAAQ,CAAA;QACrB,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAA;QACrF,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,UAAU,QAAQ,IAAI,IAAI,EAAE;YAChC,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE;YACjD,QAAQ;YACR,QAAQ,EAAE,wBAAwB;YAClC,KAAK,EAAE,gDAAgD;YACvD,WAAW,EAAE,SAAS,cAAc,2HAA2H,OAAO,CAAC,CAAC,CAAC,sBAAsB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACvN,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,KAAK;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,2BAA2B;IAC3B,IAAI,mBAAmB,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,WAAW,QAAQ,IAAI,IAAI,EAAE;YACjC,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE;YACjD,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,wBAAwB;YAClC,KAAK,EAAE,+CAA+C;YACtD,WAAW,EAAE,SAAS,mBAAmB,wGAAwG;YACjJ,UAAU,EAAE,QAAQ;YACpB,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,QAAQ;YAChB,oBAAoB,EAAE,KAAK;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,8CAA8C;AAC9C,+EAA+E;AAE/E,SAAS,yBAAyB,CAAC,OAAe,EAAE,QAAgB;IAClE,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAA;QAErB,2BAA2B;QAC3B,IAAI,oBAAoB,CAAC,IAAI,CAAC;YAAE,SAAQ;QAExC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,eAAe,GAAG,CAAC,KAAK,IAAI,QAAQ,IAAI,OAAO,EAAE;oBACrD,QAAQ;oBACR,UAAU,EAAE,OAAO;oBACnB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACtC,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,QAAQ,EAAE,wBAAwB;oBAClC,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,UAAU,EAAE,MAAM;oBAClB,KAAK,EAAE,CAAC;oBACR,MAAM,EAAE,QAAQ;oBAChB,oBAAoB,EAAE,KAAK;iBAC5B,CAAC,CAAA;gBACF,MAAK,CAAC,wEAAwE;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO;QACL,EAAE,EAAE,iBAAiB,QAAQ,EAAE;QAC/B,QAAQ;QACR,UAAU,EAAE,CAAC;QACb,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,wBAAwB;QAClC,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,2JAA2J;QACxK,UAAU,EAAE,MAAM;QAClB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,QAAQ;QAChB,oBAAoB,EAAE,KAAK;KAC5B,CAAA;AACH,CAAC;AAUD;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CACrC,OAAe,EACf,QAAgB,EAChB,OAAkC;IAElC,iCAAiC;IACjC,IAAI,CAAC,IAAA,+BAAa,EAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAA;IAEvC,0BAA0B;IAC1B,IAAI,IAAA,kCAAgB,EAAC,QAAQ,CAAC,IAAI,IAAA,wCAAsB,EAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAA;IAE7E,MAAM,QAAQ,GAAoB,EAAE,CAAA;IAEpC,oCAAoC;IACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAE3D,uCAAuC;IACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAE9D,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAA;IAE/C,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/detect/index.d.ts

@@ -4,10 +4,43 @@
  * Returns raw findings before noisy aggregation/enrichment (those are called
  * by the orchestrator to keep stage boundaries clean).
  */
-import type { ScanFile, Vulnerability, CancellationToken, DetectorContext, ProgressCallback } from '../shared/types';
-import type { MiddlewareAuthConfig } from '../model/middleware-detector';
-import type { FileAuthImports } from '../model/imported-auth-detector';
-import type { FilterPipeline } from '../postprocess/filtering/pipeline';
+import type { ScanFile, Vulnerability, CancellationToken, DetectorContext, ProgressCallback } from "../shared/types";
+import type { MiddlewareAuthConfig } from "../model/middleware-detector";
+import type { FileAuthImports } from "../model/imported-auth-detector";
+import type { FilterPipeline } from "../postprocess/filtering/pipeline";
+import type { ParsedAST } from "../parse/ast";
+import type { TaintFinding } from "../taint/propagation-types";
+import "./ast-rules/weak-crypto-ast";
+import "./ast-rules/variables-ast";
+import "./ast-rules/risky-imports-ast";
+import "./ast-rules/secret-patterns-ast";
+import "./ast-rules/entropy-ast";
+import "./ast-rules/security-headers-ast";
+import "./ast-rules/dangerous-eval-ast";
+import "./ast-rules/dom-xss-ast";
+import "./ast-rules/json-parse-ast";
+import "./ast-rules/child-process-ast";
+import "./ast-rules/sql-injection-ast";
+import "./ast-rules/request-validation-ast";
+import "./ast-rules/auth-patterns-ast";
+import "./ast-rules/framework-checks-ast";
+import "./ast-rules/data-exposure-ast";
+import "./ast-rules/logic-gates-ast";
+import "./ast-rules/ssrf-ast";
+import "./ast-rules/xxe-ast";
+import "./ast-rules/log-injection-ast";
+import "./ast-rules/ai-fingerprinting-ast";
+import "./ast-rules/flask-debug-ast";
+import "./ast-rules/agent-tools-ast";
+import "./ast-rules/byok-ast";
+import "./ast-rules/endpoint-protection-ast";
+import "./ast-rules/mcp-security-ast";
+import "./ast-rules/model-supply-chain-ast";
+import "./ast-rules/package-hallucination-ast";
+import "./ast-rules/prompt-hygiene-ast";
+import "./ast-rules/rag-safety-ast";
+import "./ast-rules/schema-validation-ast";
+import "./ast-rules/taint-flow-ast";
 export interface DetectorInput {
     files: ScanFile[];
     middlewareConfig?: MiddlewareAuthConfig;
@@ -18,6 +51,10 @@ export interface DetectorInput {
     filterPipeline: FilterPipeline;
     repoName: string;
     quiet: boolean;
+    /** Pre-parsed ASTs from model build (avoids re-parsing + re-analyzing) */
+    precomputedASTs?: Map<string, ParsedAST>;
+    /** Pre-computed cross-file taint findings from model build */
+    precomputedTaintFindings?: TaintFinding[];
 }
 export interface DetectorOutput {
     /** Combined Layer 1 + Layer 2 findings (after localhost aggregation) */
@@ -32,6 +69,6 @@ export interface DetectorOutput {
  * Run all detectors (Layer 1 + Layer 2) and return combined raw findings.
  */
 export declare function runDetectors(input: DetectorInput): Promise<DetectorOutput>;
-export { runLayer1Scan, type Layer1Result } from './secrets';
-export { runLayer2Scan, type Layer2Result } from './structural';
+export { runLayer1Scan, type Layer1Result } from "./secrets";
+export { runLayer2Scan, type Layer2Result } from "./structural";
 //# sourceMappingURL=index.d.ts.map

package/dist/detect/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAIxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAEvE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,QAAQ,EAAE,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC9C,eAAe,EAAE,eAAe,CAAA;IAChC,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC,cAAc,EAAE,cAAc,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,mBAAmB;IACnB,WAAW,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAClD;AAKD;;GAEG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAgFhF;AAGD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAM/D,OAAO,6BAA6B,CAAC;AACrC,OAAO,2BAA2B,CAAC;AACnC,OAAO,+BAA+B,CAAC;AACvC,OAAO,iCAAiC,CAAC;AACzC,OAAO,yBAAyB,CAAC;AACjC,OAAO,kCAAkC,CAAC;AAE1C,OAAO,gCAAgC,CAAC;AACxC,OAAO,yBAAyB,CAAC;AACjC,OAAO,4BAA4B,CAAC;AACpC,OAAO,+BAA+B,CAAC;AACvC,OAAO,+BAA+B,CAAC;AACvC,OAAO,oCAAoC,CAAC;AAE5C,OAAO,+BAA+B,CAAC;AACvC,OAAO,kCAAkC,CAAC;AAC1C,OAAO,+BAA+B,CAAC;AACvC,OAAO,6BAA6B,CAAC;AAErC,OAAO,sBAAsB,CAAC;AAC9B,OAAO,qBAAqB,CAAC;AAC7B,OAAO,+BAA+B,CAAC;AACvC,OAAO,mCAAmC,CAAC;AAE3C,OAAO,6BAA6B,CAAC;AAErC,OAAO,6BAA6B,CAAC;AACrC,OAAO,sBAAsB,CAAC;AAC9B,OAAO,qCAAqC,CAAC;AAE7C,OAAO,8BAA8B,CAAC;AACtC,OAAO,oCAAoC,CAAC;AAC5C,OAAO,uCAAuC,CAAC;AAC/C,OAAO,gCAAgC,CAAC;AACxC,OAAO,4BAA4B,CAAC;AACpC,OAAO,mCAAmC,CAAC;AAE3C,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,eAAe,EAAE,eAAe,CAAC;IACjC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzC,8DAA8D;IAC9D,wBAAwB,CAAC,EAAE,YAAY,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,mBAAmB;IACnB,WAAW,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAKD;;GAEG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,cAAc,CAAC,CAyHzB;AAGD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC"}

package/dist/detect/index.js

@@ -11,6 +11,48 @@ exports.runDetectors = runDetectors;
 const secrets_1 = require("./secrets");
 const structural_1 = require("./structural");
 const urls_1 = require("./config/urls");
+const ast_1 = require("../parse/ast");
+const ast_rules_1 = require("./ast-rules");
+const taint_flow_ast_1 = require("./ast-rules/taint-flow-ast");
+// Import AST rule modules so they self-register
+require("./ast-rules/weak-crypto-ast");
+require("./ast-rules/variables-ast");
+require("./ast-rules/risky-imports-ast");
+require("./ast-rules/secret-patterns-ast");
+require("./ast-rules/entropy-ast");
+require("./ast-rules/security-headers-ast");
+// Wave 2: Dangerous function detectors
+require("./ast-rules/dangerous-eval-ast");
+require("./ast-rules/dom-xss-ast");
+require("./ast-rules/json-parse-ast");
+require("./ast-rules/child-process-ast");
+require("./ast-rules/sql-injection-ast");
+require("./ast-rules/request-validation-ast");
+// Wave 3: Auth + framework detectors
+require("./ast-rules/auth-patterns-ast");
+require("./ast-rules/framework-checks-ast");
+require("./ast-rules/data-exposure-ast");
+require("./ast-rules/logic-gates-ast");
+// Wave 4: Taint-adjacent detectors
+require("./ast-rules/ssrf-ast");
+require("./ast-rules/xxe-ast");
+require("./ast-rules/log-injection-ast");
+require("./ast-rules/ai-fingerprinting-ast");
+// Wave 5: Python-specific detectors
+require("./ast-rules/flask-debug-ast");
+// Wave 5: AI-specific detectors
+require("./ast-rules/agent-tools-ast");
+require("./ast-rules/byok-ast");
+require("./ast-rules/endpoint-protection-ast");
+// execution-sinks-ast: removed in Phase 4, replaced by taint-engine LLM flow detection
+require("./ast-rules/mcp-security-ast");
+require("./ast-rules/model-supply-chain-ast");
+require("./ast-rules/package-hallucination-ast");
+require("./ast-rules/prompt-hygiene-ast");
+require("./ast-rules/rag-safety-ast");
+require("./ast-rules/schema-validation-ast");
+// Wave 6: Taint flow detection (v2 engine)
+require("./ast-rules/taint-flow-ast");
 const fid = (v) => `${v.filePath}:${v.lineNumber}:${v.category}`;
 /**
  * Run all detectors (Layer 1 + Layer 2) and return combined raw findings.
@@ -35,20 +77,24 @@ async function runDetectors(input) {
     const phaseTiming = {};
     // Layer 1: Surface Scan
     const layer1Start = Date.now();
-    reportProgress('layer1', 'Running surface scan (patterns, entropy, config)...');
+    reportProgress("layer1", "Running surface scan (patterns, entropy, config)...");
     let layer1Result = await (0, secrets_1.runLayer1Scan)(files, onProgress, cancellationToken);
     // Aggregate repeated localhost findings
     const layer1RawCount = layer1Result.vulnerabilities.length;
     const layer1BeforeAggregation = layer1Result.vulnerabilities;
     layer1Result = {
         ...layer1Result,
-        vulnerabilities: (0, urls_1.aggregateLocalhostFindings)(layer1Result.vulnerabilities)
+        vulnerabilities: (0, urls_1.aggregateLocalhostFindings)(layer1Result.vulnerabilities),
     };
     if (filterPipeline.isEnabled) {
         const afterIds = new Set(layer1Result.vulnerabilities.map(fid));
         for (const v of layer1BeforeAggregation) {
             if (!afterIds.has(fid(v))) {
-                filterPipeline.record(fid(v), { stage: 'localhost_aggregation', action: 'aggregated', reason: 'Aggregated repeated localhost finding' });
+                filterPipeline.record(fid(v), {
+                    stage: "localhost_aggregation",
+                    action: "aggregated",
+                    reason: "Aggregated repeated localhost finding",
+                });
             }
         }
     }
@@ -56,17 +102,34 @@ async function runDetectors(input) {
     log(`[Layer1] repo=${repoName} findings_raw=${layer1RawCount} findings_deduped=${layer1Result.vulnerabilities.length} duration=${phaseTiming.layer1}ms`);
     // Layer 2: Structural Scan
     const layer2Start = Date.now();
-    reportProgress('layer2', 'Running structural scan (variables, logic gates)...', layer1Result.vulnerabilities.length);
+    reportProgress("layer2", "Running structural scan (variables, logic gates)...", layer1Result.vulnerabilities.length);
     const layer2Result = await (0, structural_1.runLayer2Scan)(files, { middlewareConfig, fileAuthImports, detectorContext }, onProgress, cancellationToken);
     // Format heuristic breakdown for logging
     const heuristicBreakdown = Object.entries(layer2Result.stats.raw)
         .filter(([, count]) => count > 0)
         .map(([name, count]) => `${name}:${count}`)
-        .join(',');
+        .join(",");
     phaseTiming.layer2 = Date.now() - layer2Start;
     log(`[Layer2] repo=${repoName} findings_raw=${Object.values(layer2Result.stats.raw).reduce((a, b) => a + b, 0)} findings_deduped=${layer2Result.vulnerabilities.length} duration=${phaseTiming.layer2}ms heuristic_breakdown={${heuristicBreakdown}}`);
-    // Combine Layer 1 and Layer 2 findings
-    const findings = [...layer1Result.vulnerabilities, ...layer2Result.vulnerabilities];
+    // AST-based detection — reuse pre-computed ASTs + taint findings from model build
+    const astStart = Date.now();
+    const asts = input.precomputedASTs ??
+        (0, ast_1.parseFiles)(files.map((f) => ({ path: f.path, content: f.content })));
+    // Populate taint flow cache for AST rules
+    (0, taint_flow_ast_1.clearTaintFlowCache)();
+    const projectFindings = input.precomputedTaintFindings ?? [];
+    (0, taint_flow_ast_1.setProjectFindings)(projectFindings);
+    const astFindings = (0, ast_rules_1.runASTRulesOnFiles)(asts, files.map((f) => ({ path: f.path, content: f.content })));
+    const astDuration = Date.now() - astStart;
+    if (astFindings.length > 0 || asts.size > 0) {
+        log(`[AST] repo=${repoName} parsed=${asts.size}/${files.length} ast_findings=${astFindings.length} cross_file_taint=${projectFindings.length} duration=${astDuration}ms`);
+    }
+    // Combine Layer 1 + Layer 2 + AST findings
+    const findings = [
+        ...layer1Result.vulnerabilities,
+        ...layer2Result.vulnerabilities,
+        ...astFindings,
+    ];
     return { findings, phaseTiming };
 }
 // Re-export layer results for external consumers

package/dist/detect/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAyCH,oCAgFC;AAhHD,uCAA4D;AAC5D,6CAA+D;AAC/D,wCAA0D;AAwB1D,MAAM,GAAG,GAAG,CAAC,CAA8D,EAAE,EAAE,CAC7E,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAA;AAE/C;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,KAAoB;IACrD,MAAM,EACJ,KAAK,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,QAAQ,EACR,KAAK,GACN,GAAG,KAAK,CAAA;IAET,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,CACrB,MAA2B,EAC3B,OAAe,EACf,uBAA+B,CAAC,EAChC,EAAE;QACF,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC;gBACT,MAAM;gBACN,OAAO;gBACP,cAAc,EAAE,KAAK,CAAC,MAAM;gBAC5B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,oBAAoB;aACrB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAyC,EAAE,CAAA;IAE5D,wBAAwB;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC9B,cAAc,CAAC,QAAQ,EAAE,qDAAqD,CAAC,CAAA;IAC/E,IAAI,YAAY,GAAG,MAAM,IAAA,uBAAa,EAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAA;IAE5E,wCAAwC;IACxC,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,MAAM,CAAA;IAC1D,MAAM,uBAAuB,GAAG,YAAY,CAAC,eAAe,CAAA;IAC5D,YAAY,GAAG;QACb,GAAG,YAAY;QACf,eAAe,EAAE,IAAA,iCAA0B,EAAC,YAAY,CAAC,eAAe,CAAC;KAC1E,CAAA;IACD,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/D,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAA;YAC1I,CAAC;QACH,CAAC;IACH,CAAC;IACD,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAA;IAC7C,GAAG,CAAC,iBAAiB,QAAQ,iBAAiB,cAAc,qBAAqB,YAAY,CAAC,eAAe,CAAC,MAAM,aAAa,WAAW,CAAC,MAAM,IAAI,CAAC,CAAA;IAExJ,2BAA2B;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC9B,cAAc,CAAC,QAAQ,EAAE,qDAAqD,EAAE,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IACpH,MAAM,YAAY,GAAG,MAAM,IAAA,0BAAa,EACtC,KAAK,EACL,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,EACtD,UAAU,EACV,iBAAiB,CAClB,CAAA;IAED,yCAAyC;IACzC,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;SAC1C,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAA;IAC7C,GAAG,CAAC,iBAAiB,QAAQ,iBAAiB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,qBAAqB,YAAY,CAAC,eAAe,CAAC,MAAM,aAAa,WAAW,CAAC,MAAM,2BAA2B,kBAAkB,GAAG,CAAC,CAAA;IAEtP,uCAAuC;IACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC,eAAe,EAAE,GAAG,YAAY,CAAC,eAAe,CAAC,CAAA;IAEnF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;AAClC,CAAC;AAED,iDAAiD;AACjD,qCAA4D;AAAnD,wGAAA,aAAa,OAAA;AACtB,2CAA+D;AAAtD,2GAAA,aAAa,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA4FH,oCA2HC;AA9MD,uCAA6D;AAC7D,6CAAgE;AAChE,wCAA2D;AAK3D,sCAA0C;AAC1C,2CAAiD;AAEjD,+DAGoC;AACpC,gDAAgD;AAChD,uCAAqC;AACrC,qCAAmC;AACnC,yCAAuC;AACvC,2CAAyC;AACzC,mCAAiC;AACjC,4CAA0C;AAC1C,uCAAuC;AACvC,0CAAwC;AACxC,mCAAiC;AACjC,sCAAoC;AACpC,yCAAuC;AACvC,yCAAuC;AACvC,8CAA4C;AAC5C,qCAAqC;AACrC,yCAAuC;AACvC,4CAA0C;AAC1C,yCAAuC;AACvC,uCAAqC;AACrC,mCAAmC;AACnC,gCAA8B;AAC9B,+BAA6B;AAC7B,yCAAuC;AACvC,6CAA2C;AAC3C,oCAAoC;AACpC,uCAAqC;AACrC,gCAAgC;AAChC,uCAAqC;AACrC,gCAA8B;AAC9B,+CAA6C;AAC7C,uFAAuF;AACvF,wCAAsC;AACtC,8CAA4C;AAC5C,iDAA+C;AAC/C,0CAAwC;AACxC,sCAAoC;AACpC,6CAA2C;AAC3C,2CAA2C;AAC3C,sCAAoC;AAyBpC,MAAM,GAAG,GAAG,CAAC,CAA8D,EAAE,EAAE,CAC7E,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEhD;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,KAAoB;IAEpB,MAAM,EACJ,KAAK,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,QAAQ,EACR,KAAK,GACN,GAAG,KAAK,CAAC;IAEV,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CACrB,MAA2B,EAC3B,OAAe,EACf,uBAA+B,CAAC,EAChC,EAAE;QACF,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC;gBACT,MAAM;gBACN,OAAO;gBACP,cAAc,EAAE,KAAK,CAAC,MAAM;gBAC5B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAyC,EAAE,CAAC;IAE7D,wBAAwB;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CACZ,QAAQ,EACR,qDAAqD,CACtD,CAAC;IACF,IAAI,YAAY,GAAG,MAAM,IAAA,uBAAa,EAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAE7E,wCAAwC;IACxC,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC;IAC3D,MAAM,uBAAuB,GAAG,YAAY,CAAC,eAAe,CAAC;IAC7D,YAAY,GAAG;QACb,GAAG,YAAY;QACf,eAAe,EAAE,IAAA,iCAA0B,EAAC,YAAY,CAAC,eAAe,CAAC;KAC1E,CAAC;IACF,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,uCAAuC;iBAChD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IAC9C,GAAG,CACD,iBAAiB,QAAQ,iBAAiB,cAAc,qBAAqB,YAAY,CAAC,eAAe,CAAC,MAAM,aAAa,WAAW,CAAC,MAAM,IAAI,CACpJ,CAAC;IAEF,2BAA2B;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,cAAc,CACZ,QAAQ,EACR,qDAAqD,EACrD,YAAY,CAAC,eAAe,CAAC,MAAM,CACpC,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,IAAA,0BAAa,EACtC,KAAK,EACL,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,EACtD,UAAU,EACV,iBAAiB,CAClB,CAAC;IAEF,yCAAyC;IACzC,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;SAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IAC9C,GAAG,CACD,iBAAiB,QAAQ,iBAAiB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,qBAAqB,YAAY,CAAC,eAAe,CAAC,MAAM,aAAa,WAAW,CAAC,MAAM,2BAA2B,kBAAkB,GAAG,CAClP,CAAC;IAEF,kFAAkF;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,IAAI,GACR,KAAK,CAAC,eAAe;QACrB,IAAA,gBAAU,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvE,0CAA0C;IAC1C,IAAA,oCAAmB,GAAE,CAAC;IACtB,MAAM,eAAe,GAAG,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAC7D,IAAA,mCAAkB,EAAC,eAAe,CAAC,CAAC;IAEpC,MAAM,WAAW,GAAG,IAAA,8BAAkB,EACpC,IAAI,EACJ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CACzD,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;IAC1C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5C,GAAG,CACD,cAAc,QAAQ,WAAW,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,iBAAiB,WAAW,CAAC,MAAM,qBAAqB,eAAe,CAAC,MAAM,aAAa,WAAW,IAAI,CACrK,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,MAAM,QAAQ,GAAG;QACf,GAAG,YAAY,CAAC,eAAe;QAC/B,GAAG,YAAY,CAAC,eAAe;QAC/B,GAAG,WAAW;KACf,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,iDAAiD;AACjD,qCAA6D;AAApD,wGAAA,aAAa,OAAA;AACtB,2CAAgE;AAAvD,2GAAA,aAAa,OAAA"}

package/dist/detect/secrets/config-audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-audit.d.ts","sourceRoot":"","sources":["../../../src/detect/secrets/config-audit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAmB,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAO1D,eAAO,MAAM,YAAY,EAAE,UAAU,EAgSpC,CAAA;AAkBD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,GAChC,aAAa,EAAE,CA4BjB;AAkDD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,aAAa,EAAE,GACxB,OAAO,CAAC,aAAa,EAAE,CAAC,CAmE1B"}
+{"version":3,"file":"config-audit.d.ts","sourceRoot":"","sources":["../../../src/detect/secrets/config-audit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAmB,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAO1D,eAAO,MAAM,YAAY,EAAE,UAAU,EAkUpC,CAAA;AAkBD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,GAChC,aAAa,EAAE,CA4BjB;AAkDD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,aAAa,EAAE,GACxB,OAAO,CAAC,aAAa,EAAE,CAAC,CAmE1B"}