@opensip-cli/checks-universal 0.1.0

package/dist/checks/security/env-secret-exposure.js

@@ -0,0 +1,127 @@
+// @fitness-ignore-file env-secret-exposure -- Fitness check definition references process.env patterns in longDescription, not actual secret exposure
+// @fitness-ignore-file logging-standards -- Suggestion strings contain logger call examples that match the logging-standards pattern
+// @fitness-ignore-file duplicate-implementation-detection -- similar patterns across diagnostic modules
+// @fitness-ignore-file fitness-ignore-validation -- Fitness-ignore directives reference internal check IDs that may not be statically resolvable
+/**
+ * @fileoverview Detect secrets exposed through env vars in logs/errors
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+/**
+ * Creates a pre-compiled RegExp for pattern matching.
+ * These patterns operate on trusted source code files, not user input,
+ * and use bounded character classes to prevent ReDoS.
+ * @param pattern - The regex pattern string
+ * @param flags - Optional regex flags
+ * @returns Compiled RegExp object
+ */
+function createPattern(pattern, flags) {
+    // @fitness-ignore-next-line semgrep-scan -- non-literal RegExp is intentional; patterns are hardcoded string constants for code analysis, not user input
+    return new RegExp(pattern, flags);
+}
+// Patterns that indicate potential secret exposure
+// Note: These regex patterns operate on trusted source code files, not user input.
+// The patterns use bounded character classes (e.g., [^)], [^;], [^`]) to prevent ReDoS.
+const EXPOSURE_PATTERNS = [
+    // Logging all env vars - uses [^)]* which is bounded by closing paren
+    {
+        regex: createPattern(String.raw `(?:logger|console|log)\.\w+\s*\([^)]*process\.env(?!\.\w+)[^)]*\)`, 'g'),
+        message: 'Logging entire process.env exposes all secrets',
+        suggestion: 'Never log the entire process.env object. Log specific, non-sensitive values individually: logger.info({ nodeEnv: process.env.NODE_ENV }).',
+        severity: 'error',
+    },
+    // Env vars in error messages with interpolation - uses [^;]* which is bounded by semicolon
+    {
+        regex: createPattern(String.raw `(?:Error|throw)[^;]*process\.env\.\w*(?:SECRET|KEY|PASSWORD|TOKEN|CREDENTIAL)`, 'gi'),
+        message: 'Sensitive environment variable in error message may expose secrets',
+        suggestion: 'Do not include secret values in error messages. Log only that the secret was missing or invalid, not its value: throw new Error("API key validation failed");',
+        severity: 'error',
+    },
+    // Stringifying env vars (JSON.stringify(process.env)) - fixed pattern, no variable repetition
+    {
+        regex: createPattern(String.raw `JSON\.stringify\s*\(\s*process\.env\s*\)`, 'g'),
+        message: 'JSON.stringify(process.env) exposes all secrets',
+        suggestion: 'Select specific non-sensitive env vars to stringify: JSON.stringify({ NODE_ENV: process.env.NODE_ENV, PORT: process.env.PORT }).',
+        severity: 'error',
+    },
+    // Spreading env into object that might be logged - fixed pattern
+    {
+        regex: createPattern(String.raw `\{\s*\.\.\.process\.env`, 'g'),
+        message: 'Spreading process.env may expose secrets if object is logged',
+        suggestion: 'Explicitly pick non-sensitive values instead of spreading: { NODE_ENV: process.env.NODE_ENV, PORT: process.env.PORT }.',
+        severity: 'warning',
+    },
+    // Template literal with secret env var - uses [^`]* which is bounded by backtick
+    {
+        regex: createPattern('`[^`]*\\$\\{process\\.env\\.\\w*(?:SECRET|KEY|PASSWORD|TOKEN|CREDENTIAL)[^`]*`', 'gi'),
+        message: 'Sensitive environment variable in template literal may be exposed',
+        suggestion: 'Do not interpolate secret values into strings that may be logged or displayed. Use the value directly for authentication without exposing it.',
+        severity: 'warning',
+    },
+];
+/**
+ * Check: security/env-secret-exposure
+ *
+ * Detects secrets that might be exposed through environment variables
+ * in logs or error messages.
+ */
+export const envSecretExposure = defineCheck({
+    id: '6833b667-cc72-465d-9f1e-2b6b6060faef',
+    slug: 'env-secret-exposure',
+    scope: { languages: ['json', 'typescript', 'yaml'], concerns: ['config'] },
+    description: 'Detect secrets exposed through environment variables in logs or errors',
+    longDescription: `**Purpose:** Detects patterns where sensitive environment variables may be inadvertently exposed through logging, error messages, or serialization.
+
+**Detects:**
+- Logging entire \`process.env\` object: \`logger.info(process.env)\`
+- Sensitive env vars (SECRET, KEY, PASSWORD, TOKEN, CREDENTIAL) in error/throw statements
+- \`JSON.stringify(process.env)\` which serializes all secrets
+- Spreading \`{ ...process.env }\` into objects that may be logged
+- Template literals interpolating sensitive env vars: \`\${process.env.SECRET_KEY}\`
+
+**Why it matters:** Leaked secrets in logs or error reports can be harvested from log aggregators, monitoring dashboards, or error tracking services, leading to credential compromise.
+
+**Scope:** General best practice. Analyzes each file individually.`,
+    tags: ['security', 'secrets', 'logging', 'errors'],
+    fileTypes: ['ts'],
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    analyze(content, filePath) {
+        // Test fixtures intentionally spread/serialize process.env to verify
+        // detection logic — skip tests to avoid noise.
+        if (isTestFile(filePath))
+            return [];
+        logger.debug({
+            evt: 'fitness.checks.env_secret_exposure.analyze',
+            msg: 'Analyzing file for environment secret exposure',
+        });
+        const violations = [];
+        const lines = content.split('\n');
+        for (const [lineNum, line_] of lines.entries()) {
+            const line = line_ ?? '';
+            // Skip comments
+            const trimmed = line.trim();
+            if (trimmed.startsWith('//') || trimmed.startsWith('*')) {
+                continue;
+            }
+            for (const pattern of EXPOSURE_PATTERNS) {
+                // Reset regex state
+                pattern.regex.lastIndex = 0;
+                const match = pattern.regex.exec(line);
+                if (match) {
+                    violations.push({
+                        line: lineNum + 1,
+                        column: match.index,
+                        message: pattern.message,
+                        severity: pattern.severity,
+                        suggestion: pattern.suggestion,
+                        match: match[0],
+                        filePath,
+                    });
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=env-secret-exposure.js.map

package/dist/checks/security/env-secret-exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-secret-exposure.js","sourceRoot":"","sources":["../../../src/checks/security/env-secret-exposure.ts"],"names":[],"mappings":"AAAA,sJAAsJ;AACtJ,qIAAqI;AACrI,wGAAwG;AACxG,iJAAiJ;AACjJ;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AAEpF;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,KAAc;IACpD,yJAAyJ;IACzJ,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,mDAAmD;AACnD,mFAAmF;AACnF,wFAAwF;AACxF,MAAM,iBAAiB,GAAG;IACxB,sEAAsE;IACtE;QACE,KAAK,EAAE,aAAa,CAClB,MAAM,CAAC,GAAG,CAAA,mEAAmE,EAC7E,GAAG,CACJ;QACD,OAAO,EAAE,gDAAgD;QACzD,UAAU,EACR,2IAA2I;QAC7I,QAAQ,EAAE,OAAgB;KAC3B;IACD,2FAA2F;IAC3F;QACE,KAAK,EAAE,aAAa,CAClB,MAAM,CAAC,GAAG,CAAA,+EAA+E,EACzF,IAAI,CACL;QACD,OAAO,EAAE,oEAAoE;QAC7E,UAAU,EACR,+JAA+J;QACjK,QAAQ,EAAE,OAAgB;KAC3B;IACD,8FAA8F;IAC9F;QACE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAA,0CAA0C,EAAE,GAAG,CAAC;QAC/E,OAAO,EAAE,iDAAiD;QAC1D,UAAU,EACR,kIAAkI;QACpI,QAAQ,EAAE,OAAgB;KAC3B;IACD,iEAAiE;IACjE;QACE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAA,yBAAyB,EAAE,GAAG,CAAC;QAC9D,OAAO,EAAE,8DAA8D;QACvE,UAAU,EACR,wHAAwH;QAC1H,QAAQ,EAAE,SAAkB;KAC7B;IACD,iFAAiF;IACjF;QACE,KAAK,EAAE,aAAa,CAClB,gFAAgF,EAChF,IAAI,CACL;QACD,OAAO,EAAE,mEAAmE;QAC5E,UAAU,EACR,+IAA+I;QACjJ,QAAQ,EAAE,SAAkB;KAC7B;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,qBAAqB;IAC3B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC1E,WAAW,EAAE,wEAAwE;IACrF,eAAe,EAAE;;;;;;;;;;;mEAWgD;IACjE,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;IAClD,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,aAAa,EAAE,eAAe;IAC9B,UAAU,EAAE,QAAQ;IAEpB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,qEAAqE;QACrE,+CAA+C;QAC/C,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,4CAA4C;YACjD,GAAG,EAAE,gDAAgD;SACtD,CAAC,CAAC;QACH,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAEzB,gBAAgB;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,oBAAoB;gBACpB,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,KAAK,EAAE,CAAC;oBACV,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;wBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;wBACf,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/hasura-production-config.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Verify Hasura production security settings
+ *
+ * Validates that production docker-compose files include required Hasura security settings:
+ * - Introspection disabled
+ * - Allow-list enabled
+ * - Dev mode disabled
+ * - Console disabled
+ */
+export declare const hasuraProductionConfig: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=hasura-production-config.d.ts.map

package/dist/checks/security/hasura-production-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasura-production-config.d.ts","sourceRoot":"","sources":["../../../src/checks/security/hasura-production-config.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AA4EH,eAAO,MAAM,sBAAsB,sCAoDjC,CAAC"}

package/dist/checks/security/hasura-production-config.js

@@ -0,0 +1,122 @@
+// @fitness-ignore-file batch-operation-limits -- Promise.all is bounded to production docker-compose files (typically 1-3)
+/**
+ * @fileoverview Verify Hasura production security settings
+ *
+ * Validates that production docker-compose files include required Hasura security settings:
+ * - Introspection disabled
+ * - Allow-list enabled
+ * - Dev mode disabled
+ * - Console disabled
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck } from '@opensip-cli/fitness';
+const REQUIRED_SETTINGS = [
+    {
+        envVar: 'HASURA_GRAPHQL_ENABLE_INTROSPECTION',
+        expectedValue: '"false"',
+        description: 'Introspection must be disabled in production to prevent schema discovery',
+    },
+    {
+        envVar: 'HASURA_GRAPHQL_ENABLE_ALLOWLIST',
+        expectedValue: '"true"',
+        description: 'Allow-list must be enabled in production to restrict queries to known operations',
+    },
+    {
+        envVar: 'HASURA_GRAPHQL_DEV_MODE',
+        expectedValue: '"false"',
+        description: 'Dev mode must be disabled in production to hide detailed error messages',
+    },
+    {
+        envVar: 'HASURA_GRAPHQL_ENABLE_CONSOLE',
+        expectedValue: '"false"',
+        description: 'Console must be disabled in production to prevent unauthorized schema access',
+    },
+];
+function findHasuraEnvLine(content) {
+    const lines = content.split('\n');
+    for (const [i, line] of lines.entries()) {
+        if ((line ?? '').includes('HASURA_GRAPHQL_')) {
+            return i + 1;
+        }
+    }
+    return 1;
+}
+function checkMissingSettings(filePath, content) {
+    if (!content.includes('hasura') || !content.includes('HASURA_GRAPHQL_'))
+        return [];
+    const violations = [];
+    for (const setting of REQUIRED_SETTINGS) {
+        const presencePattern = new RegExp(String.raw `${setting.envVar}\s*:`);
+        const escapedValue = setting.expectedValue.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+        const correctValuePattern = new RegExp(String.raw `${setting.envVar}\s*:\s*${escapedValue}`);
+        if (!presencePattern.test(content)) {
+            violations.push({
+                filePath,
+                line: findHasuraEnvLine(content),
+                severity: 'warning',
+                message: `Missing ${setting.envVar}: ${setting.expectedValue}. ${setting.description}.`,
+                suggestion: `Add \`${setting.envVar}: ${setting.expectedValue}\` to the hasura environment section.`,
+            });
+        }
+        else if (!correctValuePattern.test(content)) {
+            const lines = content.split('\n');
+            const settingLine = lines.findIndex((l) => presencePattern.test(l));
+            violations.push({
+                filePath,
+                line: settingLine === -1 ? findHasuraEnvLine(content) : settingLine + 1,
+                severity: 'warning',
+                message: `${setting.envVar} has incorrect value. Expected: ${setting.expectedValue}. ${setting.description}.`,
+                suggestion: `Change to \`${setting.envVar}: ${setting.expectedValue}\`.`,
+            });
+        }
+    }
+    return violations;
+}
+export const hasuraProductionConfig = defineCheck({
+    id: '54cc4b96-2cb3-4a43-9405-550e6b25bbb9',
+    slug: 'hasura-production-config',
+    disabled: true,
+    scope: { languages: ['json', 'typescript', 'yaml'], concerns: ['config'] },
+    contentFilter: 'raw',
+    confidence: 'medium',
+    description: 'Verify Hasura production docker-compose has required security settings',
+    longDescription: `**Purpose:** Ensures production docker-compose files include all required Hasura GraphQL Engine security settings.
+
+**Detects:**
+- Missing \`HASURA_GRAPHQL_ENABLE_INTROSPECTION: "false"\` (prevents schema discovery)
+- Missing \`HASURA_GRAPHQL_ENABLE_ALLOWLIST: "true"\` (restricts queries to known operations)
+- Missing \`HASURA_GRAPHQL_DEV_MODE: "false"\` (hides detailed error messages)
+- Missing \`HASURA_GRAPHQL_ENABLE_CONSOLE: "false"\` (prevents unauthorized schema access)
+
+**Why it matters:** Hasura defaults are permissive for development. In production, exposed introspection, console, and dev mode leak schema details and enable unauthorized query exploration.
+
+**Scope:** Codebase-specific convention. Cross-file analysis on production docker-compose files (\`*prod*\`).`,
+    tags: ['security', 'hasura', 'graphql', 'infrastructure'],
+    fileTypes: ['yml', 'yaml'],
+    async analyzeAll(files) {
+        logger.debug({
+            evt: 'fitness.checks.hasura_production_config.analyze_all',
+            msg: 'Analyzing production docker-compose files for Hasura security settings',
+        });
+        const prodFiles = files.paths.filter((p) => {
+            /* v8 ignore next -- defensive: split + pop on a non-empty string never returns undefined */
+            const filename = p.split('/').pop() ?? '';
+            return filename.includes('prod');
+        });
+        // Read all prod files in parallel to avoid sequential async in loop
+        // @fitness-ignore-next-line no-unbounded-concurrency -- Bounded to production docker-compose files (typically 1-3)
+        const fileEntries = await Promise.all(prodFiles.map(async (filePath) => {
+            const content = await files.read(filePath);
+            return { filePath, content };
+        }));
+        const violations = [];
+        for (const { filePath, content } of fileEntries) {
+            // @lazy-ok -- result validation depends on preceding file read operation
+            if (!content)
+                continue;
+            violations.push(...checkMissingSettings(filePath, content));
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=hasura-production-config.js.map

package/dist/checks/security/hasura-production-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasura-production-config.js","sourceRoot":"","sources":["../../../src/checks/security/hasura-production-config.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAA0C,MAAM,sBAAsB,CAAC;AAQ3F,MAAM,iBAAiB,GAAsB;IAC3C;QACE,MAAM,EAAE,qCAAqC;QAC7C,aAAa,EAAE,SAAS;QACxB,WAAW,EAAE,0EAA0E;KACxF;IACD;QACE,MAAM,EAAE,iCAAiC;QACzC,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,kFAAkF;KAChG;IACD;QACE,MAAM,EAAE,yBAAyB;QACjC,aAAa,EAAE,SAAS;QACxB,WAAW,EAAE,yEAAyE;KACvF;IACD;QACE,MAAM,EAAE,+BAA+B;QACvC,aAAa,EAAE,SAAS;QACxB,WAAW,EAAE,8EAA8E;KAC5F;CACF,CAAC;AAEF,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnF,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAC;QAC9F,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,OAAO,CAAC,MAAM,UAAU,YAAY,EAAE,CAAC,CAAC;QAE5F,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ;gBACR,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC;gBAChC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,WAAW,GAAG;gBACvF,UAAU,EAAE,SAAS,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,uCAAuC;aACrG,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ;gBACR,IAAI,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC;gBACvE,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,mCAAmC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,WAAW,GAAG;gBAC7G,UAAU,EAAE,eAAe,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,KAAK;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC1E,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,wEAAwE;IACrF,eAAe,EAAE;;;;;;;;;;8GAU2F;IAC5G,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC;IACzD,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,qDAAqD;YAC1D,GAAG,EAAE,wEAAwE;SAC9E,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,oEAAoE;QACpE,mHAAmH;QACnH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC/B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;YAChD,yEAAyE;YACzE,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/index.d.ts

@@ -0,0 +1,17 @@
+export * from './api-key-rotation.js';
+export * from './auth-middleware-coverage.js';
+export * from './auth-route-guard.js';
+export * from './cors-configuration.js';
+export * from './csp-headers.js';
+export * from './dependency-vulnerability-audit.js';
+export * from './env-secret-exposure.js';
+export * from './hasura-production-config.js';
+export * from './jwt-validation.js';
+export * from './no-eval.js';
+export * from './no-hardcoded-secrets.js';
+export * from './package-supply-chain-policy.js';
+export * from './rate-limit-coverage.js';
+export * from './semgrep-scan.js';
+export * from './use-centralized-crypto.js';
+export * from './webhook-signature-verification.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/checks/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qCAAqC,CAAC;AACpD,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC"}

package/dist/checks/security/index.js

@@ -0,0 +1,17 @@
+export * from './api-key-rotation.js';
+export * from './auth-middleware-coverage.js';
+export * from './auth-route-guard.js';
+export * from './cors-configuration.js';
+export * from './csp-headers.js';
+export * from './dependency-vulnerability-audit.js';
+export * from './env-secret-exposure.js';
+export * from './hasura-production-config.js';
+export * from './jwt-validation.js';
+export * from './no-eval.js';
+export * from './no-hardcoded-secrets.js';
+export * from './package-supply-chain-policy.js';
+export * from './rate-limit-coverage.js';
+export * from './semgrep-scan.js';
+export * from './use-centralized-crypto.js';
+export * from './webhook-signature-verification.js';
+//# sourceMappingURL=index.js.map

package/dist/checks/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/checks/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qCAAqC,CAAC;AACpD,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC"}

package/dist/checks/security/jwt-validation.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Validate JWT handling follows security best practices
+ */
+/**
+ * Check: security/jwt-validation
+ *
+ * Validates JWT handling follows security best practices including
+ * algorithm specification, proper verification, and strong secrets.
+ */
+export declare const jwtValidation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=jwt-validation.d.ts.map

package/dist/checks/security/jwt-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-validation.d.ts","sourceRoot":"","sources":["../../../src/checks/security/jwt-validation.ts"],"names":[],"mappings":"AAEA;;GAEG;AA+RH;;;;;GAKG;AACH,eAAO,MAAM,aAAa,sCAgExB,CAAC"}

package/dist/checks/security/jwt-validation.js

@@ -0,0 +1,294 @@
+// @fitness-ignore-file file-length-limit -- reviewed: tightly coupled JWT validation logic with pattern detection, AST analysis, and violation reporting requires single-file cohesion
+// @fitness-ignore-file error-handling-quality -- reviewed: false positive; String.prototype.match() at line 141 is regex matching, not Result.match() error handling
+/**
+ * @fileoverview Validate JWT handling follows security best practices
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck } from '@opensip-cli/fitness';
+/**
+ * Check if line contains jwt.verify without algorithm option.
+ * Uses simple string matching to avoid ReDoS.
+ *
+ * @param line - Line to check
+ * @returns Match result
+ */
+function checkJwtVerifyWithoutAlgorithm(line) {
+    logger.debug({
+        evt: 'fitness.checks.jwt_validation.check_jwt_verify_without_algorithm',
+        msg: 'Checking for JWT verify without algorithm option',
+    });
+    const idx = line.indexOf('jwt.verify');
+    if (idx === -1)
+        return { matched: false, matchIndex: -1, matchText: '' };
+    // Find the end of the verify call
+    const afterVerify = line.slice(Math.max(0, idx));
+    const parenStart = afterVerify.indexOf('(');
+    if (parenStart === -1)
+        return { matched: false, matchIndex: -1, matchText: '' };
+    // Count parentheses to find end of call
+    let depth = 0;
+    let parenEnd = -1;
+    for (let i = parenStart; i < afterVerify.length; i++) {
+        const char = afterVerify[i];
+        if (char === '(') {
+            depth++;
+        }
+        else if (char === ')') {
+            depth--;
+            if (depth === 0) {
+                parenEnd = i;
+                break;
+            }
+        }
+        else {
+            // Other characters are ignored during parenthesis counting
+        }
+    }
+    if (parenEnd === -1)
+        return { matched: false, matchIndex: -1, matchText: '' };
+    const callContent = afterVerify.slice(parenStart, parenEnd + 1);
+    // Check if there are 2 args (no options) - simple comma count for basic calls
+    const commaCount = (callContent.match(/,/g) ?? []).length;
+    // jwt.verify(token, secret) has 1 comma, jwt.verify(token, secret, options) has 2+
+    // Also check if 'algorithms' is mentioned
+    if (commaCount === 1 && !callContent.toLowerCase().includes('algorithm')) {
+        return { matched: true, matchIndex: idx, matchText: 'jwt.verify' + callContent };
+    }
+    return { matched: false, matchIndex: -1, matchText: '' };
+}
+/**
+ * Check if line uses jwt.decode for authentication context.
+ *
+ * @param line - Line to check
+ * @returns Match result
+ */
+function checkJwtDecodeForAuth(line) {
+    logger.debug({
+        evt: 'fitness.checks.jwt_validation.check_jwt_decode_for_auth',
+        msg: 'Checking for JWT decode used for authentication',
+    });
+    const idx = line.indexOf('jwt.decode');
+    if (idx === -1)
+        return { matched: false, matchIndex: -1, matchText: '' };
+    // Check if line contains auth-related keywords
+    const lowerLine = line.toLowerCase();
+    const authKeywords = ['user', 'auth', 'session', 'token'];
+    const hasAuthKeyword = authKeywords.some((kw) => lowerLine.includes(kw));
+    if (hasAuthKeyword) {
+        return { matched: true, matchIndex: idx, matchText: 'jwt.decode' };
+    }
+    return { matched: false, matchIndex: -1, matchText: '' };
+}
+/* v8 ignore start -- secret-detection helpers iterate keywords and apply regex; covered indirectly via fixtures */
+/**
+ * Check if line has a weak JWT secret (short string literal).
+ *
+ * @param line - Line to check
+ * @returns Match result
+ */
+function checkWeakJwtSecret(line) {
+    logger.debug({
+        evt: 'fitness.checks.jwt_validation.check_weak_jwt_secret',
+        msg: 'Checking for weak JWT secret',
+    });
+    const lowerLine = line.toLowerCase();
+    const secretKeywords = ['jwtsecret', 'jwt_secret', 'jwt-secret', 'secret'];
+    for (const keyword of secretKeywords) {
+        const idx = lowerLine.indexOf(keyword);
+        if (idx === -1)
+            continue;
+        // Look for assignment after keyword - simple check for short strings
+        const afterKeyword = line.slice(Math.max(0, idx + keyword.length));
+        // Match patterns like: = 'short' or : "short"
+        // @fitness-ignore-next-line sonarjs-regular-expr -- Simple pattern with bounded quantifier {0,20} and negated class [^'"`]; no backtracking risk
+        const assignMatch = /^\s*[:=]\s*['"`]([^'"`]{0,20})['"`]/.exec(afterKeyword);
+        if (assignMatch?.[1] !== undefined && assignMatch[1].length <= 20) {
+            return { matched: true, matchIndex: idx, matchText: keyword + assignMatch[0] };
+        }
+    }
+    return { matched: false, matchIndex: -1, matchText: '' };
+}
+/**
+ * Check if line allows algorithm 'none'.
+ *
+ * @param line - Line to check
+ * @returns Match result
+ */
+function checkAlgorithmNone(line) {
+    logger.debug({
+        evt: 'fitness.checks.jwt_validation.check_algorithm_none',
+        msg: 'Checking for insecure algorithm none',
+    });
+    const lowerLine = line.toLowerCase();
+    // Look for algorithms: ['none'] or algorithm: ['none']
+    const patterns = ['algorithms', 'algorithm'];
+    for (const pattern of patterns) {
+        const idx = lowerLine.indexOf(pattern);
+        if (idx === -1)
+            continue;
+        const afterPattern = lowerLine.slice(Math.max(0, idx));
+        // Check for assignment to array containing 'none'
+        const hasNone = afterPattern.includes('[') &&
+            (afterPattern.includes("'none'") ||
+                afterPattern.includes('"none"') ||
+                afterPattern.includes('`none`'));
+        if (hasNone) {
+            const matchEnd = line.slice(Math.max(0, idx)).indexOf(']') + 1;
+            return { matched: true, matchIndex: idx, matchText: line.slice(idx, idx + matchEnd) };
+        }
+    }
+    return { matched: false, matchIndex: -1, matchText: '' };
+}
+/* v8 ignore stop */
+/**
+ * Check if .verify( call is missing issuer/audience validation.
+ * Only matches actual method calls (.verify() with opening paren),
+ * not method names that contain 'verify' as a substring (e.g., verifyEventSignature).
+ *
+ * @param line - Line to check
+ * @returns Match result
+ */
+function checkMissingIssuerAudience(line) {
+    logger.debug({
+        evt: 'fitness.checks.jwt_validation.check_missing_issuer_audience',
+        msg: 'Checking for missing issuer or audience validation',
+    });
+    // Look for .verify( specifically to match method calls, not substrings like verifyEventSignature
+    const idx = line.indexOf('.verify(');
+    if (idx === -1)
+        return { matched: false, matchIndex: -1, matchText: '' };
+    // Check if there's an options object
+    const afterVerify = line.slice(Math.max(0, idx));
+    if (!afterVerify.includes('{'))
+        return { matched: false, matchIndex: -1, matchText: '' };
+    // Check if issuer/audience/iss/aud is present
+    const lowerAfter = afterVerify.toLowerCase();
+    const hasValidation = lowerAfter.includes('issuer') ||
+        lowerAfter.includes('audience') ||
+        lowerAfter.includes('iss') ||
+        lowerAfter.includes('aud');
+    if (!hasValidation) {
+        return { matched: true, matchIndex: idx, matchText: '.verify(...)' };
+    }
+    return { matched: false, matchIndex: -1, matchText: '' };
+}
+const JWT_SECURITY_PATTERNS = [
+    {
+        // @fitness-ignore-next-line fitness-check-standards -- This is an internal pattern ID for violation grouping, not the check ID
+        id: 'jwt-verify-no-algorithm',
+        message: 'JWT verification without algorithm restriction - specify algorithms option',
+        suggestion: 'Add algorithms option to prevent algorithm substitution attacks: jwt.verify(token, secret, { algorithms: ["HS256"] }). This ensures only the expected algorithm is accepted.',
+        severity: 'error',
+        check: checkJwtVerifyWithoutAlgorithm,
+    },
+    {
+        id: 'jwt-decode-for-auth',
+        message: 'jwt.decode used for authentication - use jwt.verify instead',
+        suggestion: 'jwt.decode does not verify the signature! Use jwt.verify() for authentication: const payload = jwt.verify(token, secret, { algorithms: ["HS256"] });',
+        severity: 'error',
+        check: checkJwtDecodeForAuth,
+    },
+    {
+        id: 'weak-jwt-secret',
+        message: 'JWT secret appears weak (too short) - use a strong random secret',
+        suggestion: 'Use a cryptographically strong random secret of at least 256 bits (32 bytes). Generate with: openssl rand -base64 32. Store in environment variable, not in code.',
+        severity: 'warning',
+        check: checkWeakJwtSecret,
+    },
+    {
+        id: 'algorithm-none',
+        message: 'JWT algorithm "none" is insecure - never allow unsigned tokens',
+        suggestion: 'Remove "none" from allowed algorithms. This would allow unsigned tokens to bypass authentication. Use only secure algorithms like HS256, RS256, or ES256.',
+        severity: 'error',
+        check: checkAlgorithmNone,
+    },
+    {
+        id: 'missing-issuer-audience',
+        message: 'Consider adding issuer/audience validation for enhanced security',
+        suggestion: 'Add issuer and audience validation: jwt.verify(token, secret, { issuer: "your-issuer", audience: "your-api" }). This prevents token reuse across different services.',
+        severity: 'warning',
+        check: checkMissingIssuerAudience,
+    },
+];
+/**
+ * Check if content contains JWT-related keywords.
+ * Uses simple string matching to avoid regex issues.
+ *
+ * @param content - Content to check
+ * @returns True if JWT keywords found
+ */
+function hasJwtKeywords(content) {
+    logger.debug({
+        evt: 'fitness.checks.jwt_validation.has_jwt_keywords',
+        msg: 'Checking if content contains JWT-related keywords',
+    });
+    const lowerContent = content.toLowerCase();
+    return (lowerContent.includes('jwt') ||
+        lowerContent.includes('jsonwebtoken') ||
+        lowerContent.includes('jose'));
+}
+/**
+ * Check: security/jwt-validation
+ *
+ * Validates JWT handling follows security best practices including
+ * algorithm specification, proper verification, and strong secrets.
+ */
+export const jwtValidation = defineCheck({
+    id: '2f5c06d9-4b94-4dbf-a071-5ae021819d61',
+    slug: 'jwt-validation',
+    disabled: true,
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Validate JWT handling follows security best practices',
+    longDescription: `**Purpose:** Validates that JWT handling code follows security best practices for token verification, algorithm selection, and secret strength.
+
+**Detects:**
+- \`jwt.verify(token, secret)\` with only 2 arguments (missing algorithms option) — enables algorithm substitution attacks
+- \`jwt.decode\` used in auth context (decode does not verify signatures)
+- Weak JWT secrets: short string literals (<=20 chars) assigned to jwt_secret/jwt-secret/secret variables
+- Algorithm \`"none"\` in algorithms array — allows unsigned tokens
+- \`.verify()\` calls with options object but missing issuer/audience validation
+
+**Why it matters:** JWT misconfigurations are a top authentication bypass vector. Missing algorithm restriction, unverified tokens, and weak secrets can all lead to complete auth bypass.
+
+**Scope:** General best practice. Analyzes each file individually. Only scans files containing jwt, jsonwebtoken, or jose references.`,
+    tags: ['security', 'jwt', 'authentication'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.jwt_validation.analyze',
+            msg: 'Analyzing file for JWT validation best practices',
+        });
+        // Skip files that don't deal with JWT
+        if (!hasJwtKeywords(content)) {
+            return [];
+        }
+        const violations = [];
+        const lines = content.split('\n');
+        for (const [lineNum, line_] of lines.entries()) {
+            const line = line_ ?? '';
+            // Skip comments
+            const trimmed = line.trim();
+            if (trimmed.startsWith('//') || trimmed.startsWith('*')) {
+                continue;
+            }
+            for (const pattern of JWT_SECURITY_PATTERNS) {
+                const result = pattern.check(line);
+                if (result.matched) {
+                    violations.push({
+                        line: lineNum + 1,
+                        column: result.matchIndex,
+                        message: pattern.message,
+                        severity: pattern.severity,
+                        suggestion: pattern.suggestion,
+                        match: result.matchText,
+                        filePath,
+                    });
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=jwt-validation.js.map

package/dist/checks/security/jwt-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-validation.js","sourceRoot":"","sources":["../../../src/checks/security/jwt-validation.ts"],"names":[],"mappings":"AAAA,uLAAuL;AACvL,qKAAqK;AACrK;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAcxE;;;;;;GAMG;AACH,SAAS,8BAA8B,CAAC,IAAY;IAKlD,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,kEAAkE;QACvE,GAAG,EAAE,kDAAkD;KACxD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEzE,kCAAkC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEhF,wCAAwC;IACxC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;aAAM,CAAC;YACN,2DAA2D;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAE9E,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEhE,8EAA8E;IAC9E,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAE1D,mFAAmF;IACnF,0CAA0C;IAC1C,IAAI,UAAU,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,GAAG,WAAW,EAAE,CAAC;IACnF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAY;IAKzC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,yDAAyD;QAC9D,GAAG,EAAE,iDAAiD;KACvD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEzE,+CAA+C;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzE,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,mHAAmH;AACnH;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IAKtC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,qDAAqD;QAC1D,GAAG,EAAE,8BAA8B;KACpC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAE3E,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAS;QAEzB,qEAAqE;QACrE,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,8CAA8C;QAC9C,iJAAiJ;QACjJ,MAAM,WAAW,GAAG,qCAAqC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE7E,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IAKtC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,oDAAoD;QACzD,GAAG,EAAE,sCAAsC;KAC5C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAErC,uDAAuD;IACvD,MAAM,QAAQ,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAS;QAEzB,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvD,kDAAkD;QAClD,MAAM,OAAO,GACX,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1B,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC9B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAErC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AACD,oBAAoB;AAEpB;;;;;;;GAOG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAK9C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6DAA6D;QAClE,GAAG,EAAE,oDAAoD;KAC1D,CAAC,CAAC;IACH,iGAAiG;IACjG,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEzE,qCAAqC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEzF,8CAA8C;IAC9C,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,aAAa,GACjB,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE7B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IACvE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,qBAAqB,GAAyB;IAClD;QACE,+HAA+H;QAC/H,EAAE,EAAE,yBAAyB;QAC7B,OAAO,EAAE,4EAA4E;QACrF,UAAU,EACR,8KAA8K;QAChL,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,8BAA8B;KACtC;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,6DAA6D;QACtE,UAAU,EACR,sJAAsJ;QACxJ,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,qBAAqB;KAC7B;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,kEAAkE;QAC3E,UAAU,EACR,mKAAmK;QACrK,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,kBAAkB;KAC1B;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,gEAAgE;QACzE,UAAU,EACR,2JAA2J;QAC7J,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,kBAAkB;KAC1B;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,OAAO,EAAE,kEAAkE;QAC3E,UAAU,EACR,sKAAsK;QACxK,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,0BAA0B;KAClC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,gDAAgD;QACrD,GAAG,EAAE,mDAAmD;KACzD,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CACL,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;QACrC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;IACvC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,uDAAuD;IACpE,eAAe,EAAE;;;;;;;;;;;sIAWmH;IACpI,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC;IAC3C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,uCAAuC;YAC5C,GAAG,EAAE,kDAAkD;SACxD,CAAC,CAAC;QACH,sCAAsC;QACtC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAEzB,gBAAgB;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,MAAM,CAAC,UAAU;wBACzB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,KAAK,EAAE,MAAM,CAAC,SAAS;wBACvB,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}