@oculum/scanner 1.0.14 → 1.0.15

package/dist/taint/file-analysis-cache.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Per-File Analysis Cache
+ *
+ * Computes CFGs, sources, sinks, sanitizers, and import bindings exactly once
+ * per file. Eliminates redundant recomputation in cross-file resolution where
+ * a utility called from N files would get fully re-analyzed N times.
+ *
+ * Phase 8, Part 1.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCFGNodeMap = buildCFGNodeMap;
+exports.buildFileAnalysisCache = buildFileAnalysisCache;
+exports.buildProjectAnalysisCache = buildProjectAnalysisCache;
+const cfg_builder_1 = require("./cfg-builder");
+const source_classifier_1 = require("./source-classifier");
+const sink_classifier_1 = require("./sink-classifier");
+const sanitizer_registry_1 = require("./sanitizer-registry");
+const helpers_1 = require("./helpers");
+const scope_analysis_1 = require("../detect/ast-rules/helpers/scope-analysis");
+const python_helpers_1 = require("../detect/ast-rules/helpers/python-helpers");
+// ============================================================================
+// CFG Node Map (for O(D) parent-chain lookup — Part 4)
+// ============================================================================
+/**
+ * Build a map from AST node ID → CFGNode for all nodes in a CFG.
+ * Used by findContainingCFGNodeFast() for O(D) parent-chain walk.
+ */
+function buildCFGNodeMap(cfg) {
+    const map = new Map();
+    for (const [, cfgNode] of cfg.nodes) {
+        if (cfgNode.astNode) {
+            map.set(cfgNode.astNode.id, cfgNode);
+        }
+    }
+    return map;
+}
+// ============================================================================
+// Per-File Cache Builder
+// ============================================================================
+/**
+ * Build analysis cache for a single file.
+ * Calls buildFileCFGs, classifySources, classifySinks, buildSanitizerRegistry,
+ * collectImportBindings exactly once.
+ */
+function buildFileAnalysisCache(ast) {
+    const cfgs = (0, cfg_builder_1.buildFileCFGs)(ast);
+    // Route imports based on language
+    const importBindings = ast.language === 'python'
+        ? (0, python_helpers_1.collectPythonImportBindings)(ast.tree.rootNode)
+        : (0, helpers_1.collectImportBindings)(ast.tree.rootNode);
+    const aliases = ast.language === 'python'
+        ? new Map() // Python aliases handled differently
+        : (0, scope_analysis_1.collectVariableAliases)(ast.tree.rootNode);
+    const sources = (0, source_classifier_1.classifySources)(ast, importBindings);
+    const sinks = (0, sink_classifier_1.classifySinks)(ast, importBindings, aliases);
+    const sanitizers = (0, sanitizer_registry_1.buildSanitizerRegistry)(ast, importBindings, aliases);
+    // Build per-function CFG node maps
+    const cfgNodeMaps = new Map();
+    for (const [name, cfg] of cfgs) {
+        cfgNodeMaps.set(name, buildCFGNodeMap(cfg));
+    }
+    return { cfgs, sources, sinks, sanitizers, importBindings, aliases, cfgNodeMaps };
+}
+// ============================================================================
+// Lazy Project-Level Cache
+// ============================================================================
+/**
+ * Lazy project analysis cache — computes per-file analysis on first access.
+ *
+ * Most files have zero taint sources and are never accessed during cross-file
+ * resolution. Eager computation wasted 3-15s on large repos (2800-5600 files).
+ * This lazy wrapper only builds CFGs/sources/sinks/sanitizers when `.get()` is
+ * called, reducing overhead to near-zero for untouched files.
+ */
+class LazyProjectAnalysisCache extends Map {
+    constructor(asts) {
+        super();
+        this.computed = new Set();
+        this.asts = asts;
+    }
+    get(filePath) {
+        // Return cached result if already computed
+        if (this.computed.has(filePath)) {
+            return super.get(filePath);
+        }
+        // Compute on first access
+        const ast = this.asts.get(filePath);
+        if (!ast)
+            return undefined;
+        const cache = buildFileAnalysisCache(ast);
+        super.set(filePath, cache);
+        this.computed.add(filePath);
+        return cache;
+    }
+    has(filePath) {
+        return this.computed.has(filePath) || this.asts.has(filePath);
+    }
+}
+/**
+ * Build a lazy project analysis cache.
+ * Per-file caches are computed on first .get() access, not eagerly.
+ */
+function buildProjectAnalysisCache(asts) {
+    return new LazyProjectAnalysisCache(asts);
+}
+//# sourceMappingURL=file-analysis-cache.js.map

package/dist/taint/file-analysis-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-analysis-cache.js","sourceRoot":"","sources":["../../src/taint/file-analysis-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA0CH,0CAQC;AAWD,wDAuBC;AAgDD,8DAIC;AApID,+CAA6C;AAC7C,2DAAqD;AACrD,uDAAiD;AACjD,6DAA6D;AAC7D,uCAAiD;AACjD,+EAAmF;AACnF,+EAAwF;AAwBxF,+EAA+E;AAC/E,uDAAuD;AACvD,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,eAAe,CAAC,GAAQ;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAA;IACtC,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,GAAc;IACnD,MAAM,IAAI,GAAG,IAAA,2BAAa,EAAC,GAAG,CAAC,CAAA;IAE/B,kCAAkC;IAClC,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAC9C,CAAC,CAAC,IAAA,4CAA2B,EAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChD,CAAC,CAAC,IAAA,+BAAqB,EAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAE5C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACvC,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAE,qCAAqC;QAClE,CAAC,CAAC,IAAA,uCAAsB,EAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAE7C,MAAM,OAAO,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,IAAA,+BAAa,EAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,IAAA,2CAAsB,EAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;IAEvE,mCAAmC;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAA;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;AACnF,CAAC;AAED,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,wBAAyB,SAAQ,GAA8B;IAInE,YAAY,IAA4B;QACtC,KAAK,EAAE,CAAA;QAHD,aAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;QAIlC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAEQ,GAAG,CAAC,QAAgB;QAC3B,2CAA2C;QAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5B,CAAC;QAED,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAA;QAE1B,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;QACzC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IAEQ,GAAG,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/D,CAAC;CACF;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,IAA4B;IAE5B,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC"}

package/dist/taint/framework-models.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Framework Models — Middleware Chain & Route Handler Detection
+ *
+ * Models framework-specific request lifecycles as taint propagation context:
+ *
+ * 1. Express middleware chains: `app.use(middleware)` → `app.get('/path', handler)`
+ *    Detects middleware registration order and models that middleware-modified
+ *    `req` properties carry taint to downstream handlers.
+ *
+ * 2. Express route handler resolution: Identifies `app.get('/users', handler)`
+ *    where `handler` may be an imported function, enabling cross-file taint
+ *    tracking through the cross-file index.
+ *
+ * 3. Next.js Server Actions: Detects 'use server' functions that receive
+ *    form data as tainted input.
+ *
+ * Integration: Called from the project-level taint orchestrator to generate
+ * additional synthetic taint sources beyond what the source classifier finds.
+ */
+import type Parser from 'tree-sitter';
+import type { ParsedAST } from '../parse/ast';
+import type { TaintSource } from './types';
+export interface MiddlewareRegistration {
+    filePath: string;
+    /** The app/router object (e.g., 'app', 'router') */
+    appObject: string;
+    /** The middleware function name or reference */
+    middlewareName: string;
+    /** The mount path (e.g., '/api', '/') */
+    mountPath: string | null;
+    /** AST node of the registration call */
+    node: Parser.SyntaxNode;
+    /** Line number */
+    line: number;
+}
+export interface RouteRegistration {
+    filePath: string;
+    /** HTTP method (get, post, put, delete, all, use) */
+    method: string;
+    /** Route path */
+    path: string | null;
+    /** Handler function name(s) */
+    handlerNames: string[];
+    /** AST node */
+    node: Parser.SyntaxNode;
+    line: number;
+}
+/**
+ * Detect Express-style middleware and route registrations in a file.
+ */
+export declare function detectExpressRoutes(ast: ParsedAST, filePath: string): {
+    middleware: MiddlewareRegistration[];
+    routes: RouteRegistration[];
+};
+/**
+ * Detect Next.js Server Actions ('use server' directive) and generate
+ * synthetic taint sources for their form data parameters.
+ *
+ * Server Actions receive form data from the client as their first argument
+ * (when called from <form action={myAction}>). The FormData parameter is
+ * a taint source with all taint kinds.
+ */
+export declare function detectServerActions(ast: ParsedAST, filePath: string): TaintSource[];
+/**
+ * Generate synthetic taint sources for route handler parameters.
+ *
+ * When a route handler is registered with `app.get('/users', handler)`,
+ * the `handler`'s `req` and `res` parameters are taint sources.
+ * The source classifier already handles this for inline handlers,
+ * but for imported handlers we need synthetic sources.
+ *
+ * This function generates sources for route handler parameters that
+ * are identifiers (imported or local function references), which the
+ * cross-file index can resolve.
+ */
+export declare function generateRouteHandlerSources(routes: RouteRegistration[], ast: ParsedAST, filePath: string): TaintSource[];
+//# sourceMappingURL=framework-models.d.ts.map

package/dist/taint/framework-models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-models.d.ts","sourceRoot":"","sources":["../../src/taint/framework-models.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,SAAS,CAAA;AAQrD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,cAAc,EAAE,MAAM,CAAA;IACtB,yCAAyC;IACzC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAA;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,+BAA+B;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,eAAe;IACf,IAAI,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;CACb;AASD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,MAAM,GACf;IAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IAAC,MAAM,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAyEvE;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAyCf;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,iBAAiB,EAAE,EAC3B,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CA4Bf"}

package/dist/taint/framework-models.js

@@ -0,0 +1,258 @@
+"use strict";
+/**
+ * Framework Models — Middleware Chain & Route Handler Detection
+ *
+ * Models framework-specific request lifecycles as taint propagation context:
+ *
+ * 1. Express middleware chains: `app.use(middleware)` → `app.get('/path', handler)`
+ *    Detects middleware registration order and models that middleware-modified
+ *    `req` properties carry taint to downstream handlers.
+ *
+ * 2. Express route handler resolution: Identifies `app.get('/users', handler)`
+ *    where `handler` may be an imported function, enabling cross-file taint
+ *    tracking through the cross-file index.
+ *
+ * 3. Next.js Server Actions: Detects 'use server' functions that receive
+ *    form data as tainted input.
+ *
+ * Integration: Called from the project-level taint orchestrator to generate
+ * additional synthetic taint sources beyond what the source classifier finds.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectExpressRoutes = detectExpressRoutes;
+exports.detectServerActions = detectServerActions;
+exports.generateRouteHandlerSources = generateRouteHandlerSources;
+const ast_1 = require("../parse/ast");
+const types_1 = require("./types");
+const helpers_1 = require("./helpers");
+// ============================================================================
+// Express Middleware & Route Detection
+// ============================================================================
+const EXPRESS_METHODS = /^(get|post|put|patch|delete|all|use|options|head)$/;
+const ROUTER_OBJECTS = /^(app|router|server|api|route)$/i;
+/**
+ * Detect Express-style middleware and route registrations in a file.
+ */
+function detectExpressRoutes(ast, filePath) {
+    const middleware = [];
+    const routes = [];
+    const root = ast.tree.rootNode;
+    (0, ast_1.walkAST)(root, (node) => {
+        if (node.type !== 'call_expression')
+            return false;
+        const fnNode = node.childForFieldName('function');
+        if (!fnNode || fnNode.type !== 'member_expression')
+            return false;
+        const obj = fnNode.childForFieldName('object');
+        const prop = fnNode.childForFieldName('property');
+        if (!obj || !prop)
+            return false;
+        if (!ROUTER_OBJECTS.test(obj.text) || !EXPRESS_METHODS.test(prop.text))
+            return false;
+        const argsNode = node.childForFieldName('arguments');
+        if (!argsNode)
+            return false;
+        const args = argsNode.namedChildren;
+        if (args.length === 0)
+            return false;
+        const method = prop.text;
+        // Determine if first arg is a path string
+        let routePath = null;
+        let handlerStartIdx = 0;
+        if (args[0].type === 'string' || args[0].type === 'template_string') {
+            routePath = args[0].text.replace(/^['"`]|['"`]$/g, '');
+            handlerStartIdx = 1;
+        }
+        // app.use() with only function args is middleware registration
+        if (method === 'use') {
+            for (let i = handlerStartIdx; i < args.length; i++) {
+                const handlerName = extractHandlerName(args[i]);
+                if (handlerName) {
+                    middleware.push({
+                        filePath,
+                        appObject: obj.text,
+                        middlewareName: handlerName,
+                        mountPath: routePath,
+                        node,
+                        line: node.startPosition.row + 1,
+                    });
+                }
+            }
+            return false;
+        }
+        // Route handler registration
+        const handlerNames = [];
+        for (let i = handlerStartIdx; i < args.length; i++) {
+            const name = extractHandlerName(args[i]);
+            if (name)
+                handlerNames.push(name);
+        }
+        if (handlerNames.length > 0) {
+            routes.push({
+                filePath,
+                method,
+                path: routePath,
+                handlerNames,
+                node,
+                line: node.startPosition.row + 1,
+            });
+        }
+        return false;
+    });
+    return { middleware, routes };
+}
+// ============================================================================
+// Next.js Server Actions
+// ============================================================================
+/**
+ * Detect Next.js Server Actions ('use server' directive) and generate
+ * synthetic taint sources for their form data parameters.
+ *
+ * Server Actions receive form data from the client as their first argument
+ * (when called from <form action={myAction}>). The FormData parameter is
+ * a taint source with all taint kinds.
+ */
+function detectServerActions(ast, filePath) {
+    const sources = [];
+    const root = ast.tree.rootNode;
+    // Check for file-level 'use server' directive
+    const hasFileDirective = hasDirective(root, 'use server');
+    (0, ast_1.walkAST)(root, (node) => {
+        const fnTypes = new Set([
+            'function_declaration', 'arrow_function', 'function_expression',
+        ]);
+        if (!fnTypes.has(node.type))
+            return false;
+        // Check for function-level 'use server' directive
+        const isServerAction = hasFileDirective || hasFunctionDirective(node, 'use server');
+        if (!isServerAction)
+            return false;
+        // Get parameters — first param of server action is FormData
+        const params = node.childForFieldName('parameters');
+        if (!params)
+            return false;
+        for (const param of params.namedChildren) {
+            const paramName = extractActionParamName(param);
+            if (!paramName)
+                continue;
+            sources.push({
+                node: param,
+                line: param.startPosition.row + 1,
+                variable: paramName,
+                expression: `Server Action param: ${paramName}`,
+                sourceType: 'form_data',
+                taintKinds: new Set(types_1.ALL_TAINT_KINDS),
+                confidence: 'high',
+                framework: 'nextjs',
+            });
+        }
+        return true; // don't descend into function body
+    });
+    return sources;
+}
+// ============================================================================
+// Synthetic Source Generation for Route Handlers
+// ============================================================================
+/**
+ * Generate synthetic taint sources for route handler parameters.
+ *
+ * When a route handler is registered with `app.get('/users', handler)`,
+ * the `handler`'s `req` and `res` parameters are taint sources.
+ * The source classifier already handles this for inline handlers,
+ * but for imported handlers we need synthetic sources.
+ *
+ * This function generates sources for route handler parameters that
+ * are identifiers (imported or local function references), which the
+ * cross-file index can resolve.
+ */
+function generateRouteHandlerSources(routes, ast, filePath) {
+    const sources = [];
+    const root = ast.tree.rootNode;
+    const imports = (0, helpers_1.collectImportBindings)(root);
+    for (const route of routes) {
+        for (const handlerName of route.handlerNames) {
+            // Check if this is an imported handler
+            const binding = imports.get(handlerName);
+            if (!binding)
+                continue;
+            // The handler's first parameter (req) is a taint source
+            // We create a synthetic source that will be picked up by the
+            // cross-file analyzer when resolving the handler function
+            sources.push({
+                node: route.node,
+                line: route.line,
+                variable: `${handlerName}.req`,
+                expression: `${route.method.toUpperCase()} ${route.path ?? '/'} → ${handlerName}`,
+                sourceType: 'http_body',
+                taintKinds: new Set(types_1.ALL_TAINT_KINDS),
+                confidence: 'high',
+                framework: 'express',
+            });
+        }
+    }
+    return sources;
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+function extractHandlerName(node) {
+    if (node.type === 'identifier')
+        return node.text;
+    if (node.type === 'member_expression')
+        return node.text;
+    // Inline arrow/function: can't name it, skip
+    return null;
+}
+function extractActionParamName(param) {
+    if (param.type === 'identifier')
+        return param.text;
+    if (param.type === 'required_parameter' || param.type === 'optional_parameter') {
+        const pattern = param.childForFieldName('pattern');
+        if (pattern?.type === 'identifier')
+            return pattern.text;
+    }
+    return null;
+}
+/**
+ * Check if the file has a top-level 'use server' / 'use client' directive.
+ */
+function hasDirective(root, directive) {
+    for (const child of root.children) {
+        if (child.type === 'expression_statement') {
+            const expr = child.namedChildren[0];
+            if (expr?.type === 'string') {
+                const text = expr.text.replace(/^['"`]|['"`]$/g, '');
+                if (text === directive)
+                    return true;
+            }
+        }
+        // Directives must appear before any other statement
+        if (child.type !== 'expression_statement' && child.type !== 'comment')
+            break;
+    }
+    return false;
+}
+/**
+ * Check if a function body starts with a 'use server' directive.
+ */
+function hasFunctionDirective(fnNode, directive) {
+    const body = fnNode.childForFieldName('body');
+    if (!body || body.type !== 'statement_block')
+        return false;
+    // Use namedChildren to skip punctuation tokens ({ and })
+    for (const child of body.namedChildren) {
+        if (child.type === 'expression_statement') {
+            const expr = child.namedChildren[0];
+            if (expr?.type === 'string') {
+                const text = expr.text.replace(/^['"`]|['"`]$/g, '');
+                if (text === directive)
+                    return true;
+            }
+        }
+        // Directives must appear before any other statement
+        if (child.type !== 'expression_statement' && child.type !== 'comment')
+            break;
+    }
+    return false;
+}
+//# sourceMappingURL=framework-models.js.map

package/dist/taint/framework-models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-models.js","sourceRoot":"","sources":["../../src/taint/framework-models.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AAkDH,kDA4EC;AAcD,kDA4CC;AAkBD,kEAgCC;AAtOD,sCAAsC;AAEtC,mCAAyC;AACzC,uCAAiD;AAiCjD,+EAA+E;AAC/E,uCAAuC;AACvC,+EAA+E;AAE/E,MAAM,eAAe,GAAG,oDAAoD,CAAA;AAC5E,MAAM,cAAc,GAAG,kCAAkC,CAAA;AAEzD;;GAEG;AACH,SAAgB,mBAAmB,CACjC,GAAc,EACd,QAAgB;IAEhB,MAAM,UAAU,GAA6B,EAAE,CAAA;IAC/C,MAAM,MAAM,GAAwB,EAAE,CAAA;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;IAE9B,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAA;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,KAAK,CAAA;QAEhE,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QAC/B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAEpF,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAA;QAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAEnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAA;QAExB,0CAA0C;QAC1C,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,eAAe,GAAG,CAAC,CAAA;QAEvB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpE,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;YACtD,eAAe,GAAG,CAAC,CAAA;QACrB,CAAC;QAED,+DAA+D;QAC/D,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC/C,IAAI,WAAW,EAAE,CAAC;oBAChB,UAAU,CAAC,IAAI,CAAC;wBACd,QAAQ;wBACR,SAAS,EAAE,GAAG,CAAC,IAAI;wBACnB,cAAc,EAAE,WAAW;wBAC3B,SAAS,EAAE,SAAS;wBACpB,IAAI;wBACJ,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;qBACjC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,KAAK,IAAI,CAAC,GAAG,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YACxC,IAAI,IAAI;gBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ;gBACR,MAAM;gBACN,IAAI,EAAE,SAAS;gBACf,YAAY;gBACZ,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;aACjC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AAC/B,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,GAAc,EACd,QAAgB;IAEhB,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;IAE9B,8CAA8C;IAC9C,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAEzD,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;YACtB,sBAAsB,EAAE,gBAAgB,EAAE,qBAAqB;SAChE,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAEzC,kDAAkD;QAClD,MAAM,cAAc,GAAG,gBAAgB,IAAI,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QACnF,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAA;QAEjC,4DAA4D;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAEzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;YAC/C,IAAI,CAAC,SAAS;gBAAE,SAAQ;YAExB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBACjC,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,wBAAwB,SAAS,EAAE;gBAC/C,UAAU,EAAE,WAAW;gBACvB,UAAU,EAAE,IAAI,GAAG,CAAC,uBAAe,CAAC;gBACpC,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAA,CAAC,mCAAmC;IACjD,CAAC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,+EAA+E;AAC/E,iDAAiD;AACjD,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACH,SAAgB,2BAA2B,CACzC,MAA2B,EAC3B,GAAc,EACd,QAAgB;IAEhB,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAA;IAC9B,MAAM,OAAO,GAAG,IAAA,+BAAqB,EAAC,IAAI,CAAC,CAAA;IAE3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7C,uCAAuC;YACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACxC,IAAI,CAAC,OAAO;gBAAE,SAAQ;YAEtB,wDAAwD;YACxD,6DAA6D;YAC7D,0DAA0D;YAC1D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,GAAG,WAAW,MAAM;gBAC9B,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,MAAM,WAAW,EAAE;gBACjF,UAAU,EAAE,WAAW;gBACvB,UAAU,EAAE,IAAI,GAAG,CAAC,uBAAe,CAAC;gBACpC,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,SAAS;aACrB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,SAAS,kBAAkB,CAAC,IAAuB;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IACvD,6CAA6C;IAC7C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAwB;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IAClD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAClD,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY;YAAE,OAAO,OAAO,CAAC,IAAI,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,IAAuB,EAAE,SAAiB;IAC9D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;YACnC,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;gBACpD,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;YACrC,CAAC;QACH,CAAC;QACD,oDAAoD;QACpD,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAK;IAC9E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,MAAyB,EAAE,SAAiB;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAE1D,yDAAyD;IACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;YACnC,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;gBACpD,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;YACrC,CAAC;QACH,CAAC;QACD,oDAAoD;QACpD,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAK;IAC9E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/taint/helpers.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Taint Engine Helpers
+ *
+ * Standalone helpers for taint classifiers. These are intentionally duplicated
+ * from detect/ast-rules/index.ts to avoid importing the AST rule engine module,
+ * which causes tree-sitter native GC issues when running taint tests in Jest.
+ */
+import type Parser from 'tree-sitter';
+/**
+ * Check if a set of call arguments represents a parameterized query (safe binding).
+ * Returns true if the first argument contains SQL placeholders ($1, $name, ?, :param, @param)
+ * and the second argument is an array or object with bind values.
+ *
+ * This is the single source of truth for parameterized query detection,
+ * used by both sink-classifier and sanitizer-registry.
+ */
+export declare function isParameterizedQueryArgs(args: Parser.SyntaxNode[]): boolean;
+/**
+ * Collect import bindings from a file's AST root.
+ *
+ * Returns a map: local binding name → { module, originalName }
+ * Handles both ES imports and CJS require().
+ *
+ * NOTE: This is a standalone copy of the function in detect/ast-rules/index.ts
+ * to keep the taint module tree independent of the detection module tree.
+ */
+export declare function collectImportBindings(root: Parser.SyntaxNode): Map<string, {
+    module: string;
+    originalName: string;
+}>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/taint/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/taint/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAIrC;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,OAAO,CA+B3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,UAAU,GACtB,GAAG,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEvD"}

package/dist/taint/helpers.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Taint Engine Helpers
+ *
+ * Standalone helpers for taint classifiers. These are intentionally duplicated
+ * from detect/ast-rules/index.ts to avoid importing the AST rule engine module,
+ * which causes tree-sitter native GC issues when running taint tests in Jest.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isParameterizedQueryArgs = isParameterizedQueryArgs;
+exports.collectImportBindings = collectImportBindings;
+const ast_1 = require("../parse/ast");
+const python_helpers_1 = require("../detect/ast-rules/helpers/python-helpers");
+/**
+ * Check if a set of call arguments represents a parameterized query (safe binding).
+ * Returns true if the first argument contains SQL placeholders ($1, $name, ?, :param, @param)
+ * and the second argument is an array or object with bind values.
+ *
+ * This is the single source of truth for parameterized query detection,
+ * used by both sink-classifier and sanitizer-registry.
+ */
+function isParameterizedQueryArgs(args) {
+    if (args.length < 2)
+        return false;
+    const firstArg = args[0];
+    if (firstArg.type !== 'string' && firstArg.type !== 'template_string')
+        return false;
+    const text = firstArg.text;
+    // Check for placeholder patterns: $1, $name, ?, :paramName, @paramName
+    // Note: \? is safe here because we already verified the first arg is a
+    // string/template_string, and the second arg must be an array/object bind.
+    const hasPlaceholders = /\$\w+/.test(text) || /\?/.test(text) ||
+        /:\w+/.test(text) || /@\w+/.test(text);
+    if (!hasPlaceholders)
+        return false;
+    const secondArg = args[1];
+    // Array of values: [val1, val2]
+    if (secondArg?.type === 'array')
+        return true;
+    // Object with bind/replacements: { bind: [...], replacements: {...} }
+    if (secondArg?.type === 'object') {
+        const props = secondArg.namedChildren;
+        for (const prop of props) {
+            if (prop.type === 'pair') {
+                const key = prop.childForFieldName('key');
+                if (key && /^(bind|replacements|values|params)$/.test(key.text))
+                    return true;
+            }
+        }
+        // Even without explicit bind/replacements, object as 2nd arg with placeholders is usually safe
+        return true;
+    }
+    return false;
+}
+/**
+ * Collect import bindings from a file's AST root.
+ *
+ * Returns a map: local binding name → { module, originalName }
+ * Handles both ES imports and CJS require().
+ *
+ * NOTE: This is a standalone copy of the function in detect/ast-rules/index.ts
+ * to keep the taint module tree independent of the detection module tree.
+ */
+function collectImportBindings(root) {
+    // Python module root type is 'module', not 'program'
+    if (root.type === 'module') {
+        return (0, python_helpers_1.collectPythonImportBindings)(root);
+    }
+    const bindings = new Map();
+    (0, ast_1.walkAST)(root, (node) => {
+        // ES import
+        if (node.type === 'import_statement') {
+            const source = node.childForFieldName('source');
+            const moduleName = source?.text.replace(/^['"]|['"]$/g, '') ?? '';
+            // Find the import clause (might be a field or a direct child depending on grammar)
+            const clause = node.childForFieldName('import')
+                ?? node.children.find(c => c.type === 'import_clause');
+            if (clause) {
+                // import { a, b as c } from 'mod'
+                const namedImports = clause.descendantsOfType('import_specifier');
+                for (const spec of namedImports) {
+                    const nameNode = spec.childForFieldName('name');
+                    const aliasNode = spec.childForFieldName('alias');
+                    const original = nameNode?.text ?? '';
+                    const local = aliasNode?.text ?? original;
+                    bindings.set(local, { module: moduleName, originalName: original });
+                }
+                // import foo from 'mod' (default)
+                const defaultImport = clause.descendantsOfType('identifier');
+                if (defaultImport.length === 1 && namedImports.length === 0) {
+                    bindings.set(defaultImport[0].text, { module: moduleName, originalName: 'default' });
+                }
+            }
+            return true; // skip subtree
+        }
+        // CJS require: const { foo } = require('mod')
+        if (node.type === 'lexical_declaration' || node.type === 'variable_declaration') {
+            for (const declarator of node.descendantsOfType('variable_declarator')) {
+                const init = declarator.childForFieldName('value');
+                if (init?.type === 'call_expression' &&
+                    init.childForFieldName('function')?.text === 'require') {
+                    const args = init.childForFieldName('arguments');
+                    const firstArg = args?.namedChildren[0];
+                    const moduleName = firstArg?.text.replace(/^['"]|['"]$/g, '') ?? '';
+                    const nameNode = declarator.childForFieldName('name');
+                    if (nameNode?.type === 'object_pattern') {
+                        // const { foo, bar: baz } = require('mod')
+                        for (const prop of nameNode.namedChildren) {
+                            if (prop.type === 'shorthand_property_identifier_pattern') {
+                                bindings.set(prop.text, { module: moduleName, originalName: prop.text });
+                            }
+                            else if (prop.type === 'pair_pattern') {
+                                const key = prop.childForFieldName('key')?.text ?? '';
+                                const value = prop.childForFieldName('value')?.text ?? '';
+                                bindings.set(value, { module: moduleName, originalName: key });
+                            }
+                        }
+                    }
+                    else if (nameNode?.type === 'identifier') {
+                        // const foo = require('mod')
+                        bindings.set(nameNode.text, { module: moduleName, originalName: 'default' });
+                    }
+                }
+            }
+        }
+        return false;
+    });
+    return bindings;
+}
+//# sourceMappingURL=helpers.js.map

package/dist/taint/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/taint/helpers.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAcH,4DA+BC;AAWD,sDA2EC;AAhID,sCAAsC;AACtC,+EAAwF;AAExF;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CAAC,IAAyB;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAEnF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,uEAAuE;IACvE,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAA;IAElC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,gCAAgC;IAChC,IAAI,SAAS,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAC5C,sEAAsE;IACtE,IAAI,SAAS,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAA;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;gBACzC,IAAI,GAAG,IAAI,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAA;YAC9E,CAAC;QACH,CAAC;QACD,+FAA+F;QAC/F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CACnC,IAAuB;IAEvB,qDAAqD;IACrD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,IAAA,4CAA2B,EAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoD,CAAA;IAE5E,IAAA,aAAO,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,YAAY;QACZ,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;YAEjE,mFAAmF;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;mBAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;YAExD,IAAI,MAAM,EAAE,CAAC;gBACX,kCAAkC;gBAClC,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;gBACjE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;oBACjD,MAAM,QAAQ,GAAG,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAA;oBACrC,MAAM,KAAK,GAAG,SAAS,EAAE,IAAI,IAAI,QAAQ,CAAA;oBACzC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACrE,CAAC;gBACD,kCAAkC;gBAClC,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;gBAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;gBACtF,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA,CAAC,eAAe;QAC7B,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAChF,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;gBAClD,IACE,IAAI,EAAE,IAAI,KAAK,iBAAiB;oBAChC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,KAAK,SAAS,EACtD,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;oBAChD,MAAM,QAAQ,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;oBACvC,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;oBAEnE,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBACrD,IAAI,QAAQ,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBACxC,2CAA2C;wBAC3C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;4BAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,uCAAuC,EAAE,CAAC;gCAC1D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;4BAC1E,CAAC;iCAAM,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gCACxC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,EAAE,CAAA;gCACrD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,CAAA;gCACzD,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAA;4BAChE,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,IAAI,QAAQ,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC3C,6BAA6B;wBAC7B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;oBAC9E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC"}